BASELINE: Update Chromium to 84.0.4147.141

Change-Id: Ib85eb4cfa1cbe2b2b81e5022c8cad5c493969535
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1668 files changed, 48967 insertions, 31866 deletions

diff --git a/chromium/content/BUILD.gn b/chromium/content/BUILD.gn
index 1546f994dde..125c57090ec 100644
--- a/chromium/content/BUILD.gn
+++ b/chromium/content/BUILD.gn
@@ -82,7 +82,7 @@ if (!is_nacl_nonsfi) {
 if (is_component_build) {
   component("content") {
     public_deps =
-        content_shared_components + [ "//content/public/app:both_sources" ]
+        content_shared_components + [ "//content/public/app:app_sources" ]
   }
 } else if (is_nacl_nonsfi) {
   source_set("content") {
@@ -138,7 +138,10 @@ grit("dev_ui_content_resources") {
     "-E",
     "root_gen_dir=" + rebase_path(root_gen_dir, root_build_dir),
   ]
-  deps = [ "//content/browser/process_internals:mojo_bindings_js" ]
+  deps = [
+    "//content/browser/conversions:mojo_bindings_js",
+    "//content/browser/process_internals:mojo_bindings_js",
+  ]
 }
 
 # This target exists to "hold" the content_export header so we can do proper
diff --git a/chromium/content/app/BUILD.gn b/chromium/content/app/BUILD.gn
index c34b69641ae..703a60ebed5 100644
--- a/chromium/content/app/BUILD.gn
+++ b/chromium/content/app/BUILD.gn
@@ -6,197 +6,134 @@ import("//build/config/chrome_build.gni")
 import("//build/config/features.gni")
 import("//ppapi/buildflags/buildflags.gni")
 
-# Implements "content_main" given the defines and visibility. On Windows this
-# is compiled with a different define for browser and child, but all code needs
-# to be shared.
-template("implement_content_app") {
-  runner_target_name = "content_main_runner_" + target_name
-  main_target_name = target_name
-
-  extra_configs = [
-    "//build/config/compiler:wexit_time_destructors",
-    "//content:content_implementation",
-    "//tools/v8_context_snapshot:use_v8_context_snapshot",
-    "//v8:external_startup_data",
-  ]
-
-  content_app_deps = [
-    "//base",
-    "//base:i18n",
-    "//content:export",
-    "//content:sandbox_helper_win",
-    "//content/public/common:common_sources",
-    "//content/public/common:service_names",
-    "//crypto",
-    "//mojo/core/embedder",
-    "//ppapi/buildflags",
-    "//services/service_manager/embedder",
-    "//services/service_manager/public/mojom",
-    "//services/tracing/public/cpp",
-    "//ui/base",
-    "//ui/gfx",
-    "//ui/gfx/geometry",
+extra_configs = [
+  "//build/config/compiler:wexit_time_destructors",
+  "//content:content_implementation",
+  "//tools/v8_context_snapshot:use_v8_context_snapshot",
+  "//v8:external_startup_data",
+]
+
+content_app_deps = [
+  "//base",
+  "//base:i18n",
+  "//content:export",
+  "//content:sandbox_helper_win",
+  "//content/public/common:common_sources",
+  "//content/public/common:service_names",
+  "//crypto",
+  "//mojo/core/embedder",
+  "//ppapi/buildflags",
+  "//services/service_manager/embedder",
+  "//services/service_manager/public/mojom",
+  "//services/tracing/public/cpp",
+  "//ui/base",
+  "//ui/gfx",
+  "//ui/gfx/geometry",
+]
+
+if (is_win) {
+  content_app_deps += [ "//sandbox" ]
+} else if (is_android) {
+  # Many of these are required for JNI registration.
+  content_app_deps += [
+    "//content/browser",
+    "//content/child",
+    "//content/public/android:jni",
+    "//device/bluetooth",
+    "//device/gamepad",
+    "//gpu",
+    "//media",
+    "//media/capture",
+    "//media/midi",
+    "//net",
+    "//skia",
+    "//third_party/android_ndk:cpu_features",
+    "//ui/android",
+    "//ui/events",
+    "//ui/shell_dialogs",
   ]
+}
 
-  if (is_win) {
-    content_app_deps += [ "//sandbox" ]
-  } else if (is_android) {
-    # Android doesn't use the browser/child split and in the component build
-    # all symbols are exported from the .so, so the Android-specific files
-    # can include headers from both places. Many of these are required for
-    # JNI registration.
-    content_app_deps += [
-      "//content/browser",
-      "//content/child",
-      "//content/public/android:jni",
-      "//device/bluetooth",
-      "//device/gamepad",
-      "//gpu",
-      "//media",
-      "//media/capture",
-      "//media/midi",
-      "//net",
-      "//skia",
-      "//third_party/android_ndk:cpu_features",
-      "//ui/android",
-      "//ui/events",
-      "//ui/shell_dialogs",
-    ]
-  }
-
-  if (!is_multi_dll_chrome && enable_plugins) {
-    content_app_deps += [ "//content/ppapi_plugin:ppapi_plugin_sources" ]
-  }
-
-  # Compile content_main_runner_impl.[h, cc] in a separate target to exempt from
-  # GN header checking without exempting any other source file. These files
-  # includes headers of all process types and varies significantly per platform
-  # in between browser and child. Otherwise it would require many "nogncheck"
-  # annotations that would both be useless and add noise.
-  #
-  # This will generate :content_main_runner_both, :content_main_runner_browser,
-  # and :content_main_runner_child.
-  source_set(runner_target_name) {
-    visibility = [ ":$main_target_name" ]
-    check_includes = false
-
-    sources = [
-      "content_main_runner_impl.cc",
-      "content_main_runner_impl.h",
-    ]
-
-    configs += extra_configs
-    deps = content_app_deps
-    if (defined(invoker.deps)) {
-      deps += invoker.deps
-    }
-
-    forward_variables_from(invoker, [ "defines" ])
-  }
-
-  source_set(main_target_name) {
-    check_includes = false
-
-    sources = [
-      "content_service_manager_main_delegate.cc",
-      "content_service_manager_main_delegate.h",
-      "mojo/mojo_init.cc",
-      "mojo/mojo_init.h",
-    ]
-
-    if (defined(invoker.include_browser_sources) &&
-        invoker.include_browser_sources) {
-      sources += [
-        "service_manager_environment.cc",
-        "service_manager_environment.h",
-      ]
-    }
-
-    configs += extra_configs
-    deps = content_app_deps + [
-             ":$runner_target_name",
-             "//ipc",
-             "//services/service_manager/embedder",
-           ]
-    forward_variables_from(invoker,
-                           [
-                             "defines",
-                             "visibility",
-                           ])
-
-    if (is_android) {
-      sources += [
-        "android/content_child_process_service_delegate.cc",
-        "android/content_jni_onload.cc",
-        "android/content_main.cc",
-        "android/library_loader_hooks.cc",
-        "android/library_loader_hooks.h",
-      ]
-      deps += [
-        "//mojo/public/java/system:native_support",
-        "//ui/gl",
-      ]
-    } else {
-      sources += [ "content_main.cc" ]
-    }
-  }
+if (enable_plugins) {
+  content_app_deps += [ "//content/ppapi_plugin:ppapi_plugin_sources" ]
 }
 
-group("content_app_browser_deps") {
-  deps = [
-    "//content/browser",
-    "//content/public/browser:browser_sources",
+# Compile content_main_runner_impl.[h, cc] in a separate target to exempt from
+# GN header checking without exempting any other source file. These files
+# includes headers of all process types and varies significantly per platform
+# in between browser and child. Otherwise it would require many "nogncheck"
+# annotations that would both be useless and add noise.
+source_set("content_main_runner_app") {
+  visibility = [ ":app" ]
+  check_includes = false
+
+  sources = [
+    "content_main_runner_impl.cc",
+    "content_main_runner_impl.h",
   ]
+
+  configs += extra_configs
+  deps = content_app_deps + [
+           "//content/browser",
+           "//content/gpu:gpu_sources",
+           "//content/public/browser:browser_sources",
+           "//content/public/gpu:gpu_sources",
+           "//content/public/renderer:renderer_sources",
+           "//content/public/utility:utility_sources",
+           "//content/renderer",
+           "//content/utility",
+         ]
 }
 
-group("content_app_child_deps") {
-  deps = [
-    "//content/public/gpu:gpu_sources",
-    "//content/public/renderer:renderer_sources",
-    "//content/public/utility:utility_sources",
+source_set("app") {
+  # TODO(thakis): The comment above content_main_runner_app suggests this
+  # line shouldn't be here; try removing it.
+  check_includes = false
+
+  sources = [
+    "content_service_manager_main_delegate.cc",
+    "content_service_manager_main_delegate.h",
+    "mojo/mojo_init.cc",
+    "mojo/mojo_init.h",
+    "service_manager_environment.cc",
+    "service_manager_environment.h",
   ]
-}
 
-# This includes the app sources for both the browser and child processes.
-implement_content_app("both") {
+  configs += extra_configs
+  deps = content_app_deps + [
+           ":content_main_runner_app",
+           "//ipc",
+           "//services/service_manager/embedder",
+         ]
+
   # Only the public target should depend on this. All other targets (even
   # internal content ones) should depend on the public one.
   visibility = [
-    ":both_for_content_tests",  # See top of //content/BUILD.gn for why.
+    ":for_content_tests",  # See top of //content/BUILD.gn for why.
     "//content/public/app:*",
   ]
-  deps = [
-    ":content_app_browser_deps",
-    ":content_app_child_deps",
-    "//content/gpu:gpu_sources",
-    "//content/renderer",
-    "//content/utility",
-  ]
-  include_browser_sources = true
+
+  if (is_android) {
+    sources += [
+      "android/content_child_process_service_delegate.cc",
+      "android/content_jni_onload.cc",
+      "android/content_main.cc",
+      "android/library_loader_hooks.cc",
+      "android/library_loader_hooks.h",
+    ]
+    deps += [
+      "//mojo/public/java/system:native_support",
+      "//ui/gl",
+    ]
+  } else {
+    sources += [ "content_main.cc" ]
+  }
 }
 
 # See comment at the top of //content/BUILD.gn for how this works.
-group("both_for_content_tests") {
+group("for_content_tests") {
   visibility = [ "//content/test/*" ]
   if (!is_component_build) {
-    public_deps = [ ":both" ]
-  }
-}
-
-if (is_multi_dll_chrome) {
-  # It doesn't make sense to do the browser/child dll split in component mode.
-  assert(!is_component_build)
-
-  implement_content_app("browser") {
-    visibility = [ "//content/public/app:browser" ]
-    defines = [ "CHROME_MULTIPLE_DLL_BROWSER" ]
-    deps = [ ":content_app_browser_deps" ]
-    include_browser_sources = true
-  }
-
-  implement_content_app("child") {
-    visibility = [ "//content/public/app:child" ]
-    defines = [ "CHROME_MULTIPLE_DLL_CHILD" ]
-    deps = [ ":content_app_child_deps" ]
+    public_deps = [ ":app" ]
   }
 }
diff --git a/chromium/content/app/android/content_child_process_service_delegate.cc b/chromium/content/app/android/content_child_process_service_delegate.cc
index 4d5c0d3526f..4dbd12f92ea 100644
--- a/chromium/content/app/android/content_child_process_service_delegate.cc
+++ b/chromium/content/app/android/content_child_process_service_delegate.cc
@@ -9,8 +9,8 @@
 #include "base/android/library_loader/library_loader_hooks.h"
 #include "base/android/memory_pressure_listener_android.h"
 #include "base/android/unguessable_token_android.h"
+#include "base/check.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/unguessable_token.h"
 #include "content/child/child_thread_impl.h"
diff --git a/chromium/content/app/content_main_runner_impl.cc b/chromium/content/app/content_main_runner_impl.cc
index bb72915a26e..01327e6e6c5 100644
--- a/chromium/content/app/content_main_runner_impl.cc
+++ b/chromium/content/app/content_main_runner_impl.cc
@@ -49,15 +49,22 @@
 #include "components/download/public/common/download_task_runner.h"
 #include "content/app/mojo/mojo_init.h"
 #include "content/app/service_manager_environment.h"
+#include "content/browser/browser_main.h"
 #include "content/browser/browser_process_sub_thread.h"
 #include "content/browser/browser_thread_impl.h"
+#include "content/browser/gpu/gpu_main_thread_factory.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/scheduler/browser_task_executor.h"
 #include "content/browser/startup_data_impl.h"
 #include "content/browser/startup_helper.h"
 #include "content/browser/tracing/memory_instrumentation_util.h"
+#include "content/browser/utility_process_host.h"
+#include "content/child/field_trial.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/url_schemes.h"
+#include "content/gpu/in_process_gpu_thread.h"
 #include "content/public/app/content_main_delegate.h"
+#include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/system_connector.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_descriptor_keys.h"
@@ -67,6 +74,11 @@
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/sandbox_init.h"
+#include "content/public/gpu/content_gpu_client.h"
+#include "content/public/renderer/content_renderer_client.h"
+#include "content/public/utility/content_utility_client.h"
+#include "content/renderer/in_process_renderer_thread.h"
+#include "content/utility/in_process_utility_thread.h"
 #include "gin/v8_initializer.h"
 #include "media/base/media.h"
 #include "media/media_buildflags.h"
@@ -135,27 +147,6 @@
 
 #endif  // OS_LINUX
 
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER)
-#include "content/child/field_trial.h"
-#include "content/public/gpu/content_gpu_client.h"
-#include "content/public/renderer/content_renderer_client.h"
-#include "content/public/utility/content_utility_client.h"
-#endif
-
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
-#include "content/browser/browser_main.h"
-#include "content/public/browser/content_browser_client.h"
-#endif
-
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER) && !defined(CHROME_MULTIPLE_DLL_CHILD)
-#include "content/browser/gpu/gpu_main_thread_factory.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/utility_process_host.h"
-#include "content/gpu/in_process_gpu_thread.h"
-#include "content/renderer/in_process_renderer_thread.h"
-#include "content/utility/in_process_utility_thread.h"
-#endif
-
 #if BUILDFLAG(USE_ZYGOTE_HANDLE)
 #include "content/browser/sandbox_host_linux.h"
 #include "media/base/media_switches.h"
@@ -220,9 +211,7 @@ void LoadV8SnapshotFile() {
   }
 #endif  // OS_POSIX && !OS_MACOSX
 
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER)
   gin::V8Initializer::LoadV8Snapshot(kSnapshotType);
-#endif  // !CHROME_MULTIPLE_DLL_BROWSER
 }
 #endif  // V8_USE_EXTERNAL_STARTUP_DATA
 
@@ -415,12 +404,9 @@ class ContentClientInitializer {
   static void Set(const std::string& process_type,
                   ContentMainDelegate* delegate) {
     ContentClient* content_client = GetContentClient();
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
     if (process_type.empty())
       content_client->browser_ = delegate->CreateContentBrowserClient();
-#endif  // !CHROME_MULTIPLE_DLL_CHILD
 
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER)
     base::CommandLine* cmd = base::CommandLine::ForCurrentProcess();
     if (process_type == switches::kGpuProcess ||
         cmd->HasSwitch(switches::kSingleProcess) ||
@@ -434,7 +420,6 @@ class ContentClientInitializer {
     if (process_type == switches::kUtilityProcess ||
         cmd->HasSwitch(switches::kSingleProcess))
       content_client->utility_ = delegate->CreateContentUtilityClient();
-#endif  // !CHROME_MULTIPLE_DLL_BROWSER
   }
 };
 
@@ -500,26 +485,13 @@ int RunZygote(ContentMainDelegate* delegate) {
 #endif  // BUILDFLAG(USE_ZYGOTE_HANDLE)
 
 static void RegisterMainThreadFactories() {
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER) && !defined(CHROME_MULTIPLE_DLL_CHILD)
   UtilityProcessHost::RegisterUtilityMainThreadFactory(
       CreateInProcessUtilityThread);
   RenderProcessHostImpl::RegisterRendererMainThreadFactory(
       CreateInProcessRendererThread);
   content::RegisterGpuMainThreadFactory(CreateInProcessGpuThread);
-#else
-  base::CommandLine& command_line = *base::CommandLine::ForCurrentProcess();
-  if (command_line.HasSwitch(switches::kSingleProcess)) {
-    LOG(FATAL)
-        << "--single-process is not supported in chrome multiple dll browser.";
-  }
-  if (command_line.HasSwitch(switches::kInProcessGPU)) {
-    LOG(FATAL)
-        << "--in-process-gpu is not supported in chrome multiple dll browser.";
-  }
-#endif  // !CHROME_MULTIPLE_DLL_BROWSER && !CHROME_MULTIPLE_DLL_CHILD
 }
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
 // Run the main function for browser process.
 // Returns the exit code for this process.
 int RunBrowserProcessMain(const MainFunctionParams& main_function_params,
@@ -529,14 +501,12 @@ int RunBrowserProcessMain(const MainFunctionParams& main_function_params,
     return exit_code;
   return BrowserMain(main_function_params);
 }
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
 
 // Run the FooMain() for a given process type.
 // Returns the exit code for this process.
 int RunOtherNamedProcessTypeMain(const std::string& process_type,
                                  const MainFunctionParams& main_function_params,
                                  ContentMainDelegate* delegate) {
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER)
   static const MainFunction kMainFunctions[] = {
 #if BUILDFLAG(ENABLE_PLUGINS)
     {switches::kPpapiPluginProcess, PpapiPluginMain},
@@ -555,7 +525,6 @@ int RunOtherNamedProcessTypeMain(const std::string& process_type,
       return kMainFunctions[i].function(main_function_params);
     }
   }
-#endif  // !CHROME_MULTIPLE_DLL_BROWSER
 
 #if BUILDFLAG(USE_ZYGOTE_HANDLE)
   // Zygote startup is special -- see RunZygote comments above
@@ -853,7 +822,6 @@ int ContentMainRunnerImpl::Run(bool start_service_manager_only) {
   std::string process_type =
       command_line.GetSwitchValueASCII(switches::kProcessType);
 
-#if !defined(CHROME_MULTIPLE_DLL_BROWSER)
   // Run this logic on all child processes. Zygotes will run this at a later
   // point in time when the command line has been updated.
   if (!process_type.empty() &&
@@ -861,7 +829,6 @@ int ContentMainRunnerImpl::Run(bool start_service_manager_only) {
     InitializeFieldTrialAndFeatureList();
     delegate_->PostFieldTrialInitialization();
   }
-#endif
 
   MainFunctionParams main_params(command_line);
   main_params.ui_task = ui_task_;
@@ -874,15 +841,12 @@ int ContentMainRunnerImpl::Run(bool start_service_manager_only) {
 
   RegisterMainThreadFactories();
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
   if (process_type.empty())
     return RunServiceManager(main_params, start_service_manager_only);
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
 
   return RunOtherNamedProcessTypeMain(process_type, main_params, delegate_);
 }
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
 int ContentMainRunnerImpl::RunServiceManager(MainFunctionParams& main_params,
                                              bool start_service_manager_only) {
   TRACE_EVENT0("startup", "ContentMainRunnerImpl::RunServiceManager");
@@ -928,8 +892,7 @@ int ContentMainRunnerImpl::RunServiceManager(MainFunctionParams& main_params,
     // The hang watcher needs to be started once the feature list is available
     // but before the IO thread is started.
     if (base::FeatureList::IsEnabled(base::HangWatcher::kEnableHangWatcher)) {
-      hang_watcher_ = new base::HangWatcher(
-          base::BindRepeating((&base::HangWatcher::RecordHang)));
+      hang_watcher_ = new base::HangWatcher();
       ANNOTATE_LEAKING_OBJECT_PTR(hang_watcher_);
     }
 
@@ -956,7 +919,7 @@ int ContentMainRunnerImpl::RunServiceManager(MainFunctionParams& main_params,
     service_manager_environment_ = std::make_unique<ServiceManagerEnvironment>(
         BrowserTaskExecutor::CreateIOThread());
     download::SetIOTaskRunner(
-        service_manager_environment_->ipc_thread()->task_runner());
+        service_manager_environment_->io_thread()->task_runner());
 
     InitializeBrowserMemoryInstrumentationClient();
 
@@ -979,15 +942,12 @@ int ContentMainRunnerImpl::RunServiceManager(MainFunctionParams& main_params,
   main_params.startup_data = startup_data_.get();
   return RunBrowserProcessMain(main_params, delegate_);
 }
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
 
 void ContentMainRunnerImpl::Shutdown() {
   DCHECK(is_initialized_);
   DCHECK(!is_shutdown_);
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
   service_manager_environment_.reset();
-#endif
 
   if (completed_basic_startup_) {
     const base::CommandLine& command_line =
@@ -998,11 +958,9 @@ void ContentMainRunnerImpl::Shutdown() {
     delegate_->ProcessExiting(process_type);
   }
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
   service_manager_environment_.reset();
   // The BrowserTaskExecutor needs to be destroyed before |exit_manager_|.
   BrowserTaskExecutor::Shutdown();
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
 
 #if defined(OS_WIN)
 #ifdef _CRTDBG_MAP_ALLOC
diff --git a/chromium/content/app/content_main_runner_impl.h b/chromium/content/app/content_main_runner_impl.h
index 4632e35eaf6..299af287149 100644
--- a/chromium/content/app/content_main_runner_impl.h
+++ b/chromium/content/app/content_main_runner_impl.h
@@ -52,7 +52,6 @@ class ContentMainRunnerImpl : public ContentMainRunner {
   void Shutdown() override;
 
  private:
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
   int RunServiceManager(MainFunctionParams& main_function_params,
                         bool start_service_manager_only);
 
@@ -65,7 +64,6 @@ class ContentMainRunnerImpl : public ContentMainRunner {
       discardable_shared_memory_manager_;
   std::unique_ptr<StartupDataImpl> startup_data_;
   std::unique_ptr<ServiceManagerEnvironment> service_manager_environment_;
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
 
   // True if the runner has been initialized.
   bool is_initialized_ = false;
diff --git a/chromium/content/app/mojo/mojo_browsertest.cc b/chromium/content/app/mojo/mojo_browsertest.cc
index e747d26bab5..93c2f22b70c 100644
--- a/chromium/content/app/mojo/mojo_browsertest.cc
+++ b/chromium/content/app/mojo/mojo_browsertest.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/macros.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "mojo/public/c/system/core.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/app/service_manager_environment.cc b/chromium/content/app/service_manager_environment.cc
index 30fa151aa83..bcb71ae479b 100644
--- a/chromium/content/app/service_manager_environment.cc
+++ b/chromium/content/app/service_manager_environment.cc
@@ -10,6 +10,7 @@
 #include "content/browser/browser_process_sub_thread.h"
 #include "content/browser/service_manager/service_manager_context.h"
 #include "content/browser/startup_data_impl.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/service_manager_connection.h"
 #include "mojo/core/embedder/embedder.h"
 #include "mojo/core/embedder/scoped_ipc_support.h"
@@ -17,13 +18,19 @@
 namespace content {
 
 ServiceManagerEnvironment::ServiceManagerEnvironment(
-    std::unique_ptr<BrowserProcessSubThread> ipc_thread)
-    : ipc_thread_(std::move(ipc_thread)),
-      mojo_ipc_support_(std::make_unique<mojo::core::ScopedIPCSupport>(
-          ipc_thread_->task_runner(),
-          mojo::core::ScopedIPCSupport::ShutdownPolicy::FAST)),
-      service_manager_context_(
-          std::make_unique<ServiceManagerContext>(ipc_thread_->task_runner())) {
+    std::unique_ptr<BrowserProcessSubThread> io_thread)
+    : io_thread_(std::move(io_thread)) {
+  scoped_refptr<base::SingleThreadTaskRunner> mojo_ipc_task_runner =
+      io_thread_->task_runner();
+  if (base::FeatureList::IsEnabled(features::kMojoDedicatedThread)) {
+    mojo_ipc_thread_.StartWithOptions(
+        base::Thread::Options(base::MessagePumpType::IO, 0));
+    mojo_ipc_task_runner = mojo_ipc_thread_.task_runner();
+  }
+  mojo_ipc_support_ = std::make_unique<mojo::core::ScopedIPCSupport>(
+      mojo_ipc_task_runner, mojo::core::ScopedIPCSupport::ShutdownPolicy::FAST);
+  service_manager_context_ =
+      std::make_unique<ServiceManagerContext>(io_thread_->task_runner());
   ServiceManagerConnection::GetForProcess()->Start();
 }
 
@@ -32,7 +39,7 @@ ServiceManagerEnvironment::~ServiceManagerEnvironment() = default;
 std::unique_ptr<StartupDataImpl>
 ServiceManagerEnvironment::CreateBrowserStartupData() {
   auto startup_data = std::make_unique<StartupDataImpl>();
-  startup_data->ipc_thread = std::move(ipc_thread_);
+  startup_data->io_thread = std::move(io_thread_);
   startup_data->mojo_ipc_support = std::move(mojo_ipc_support_);
   startup_data->service_manager_shutdown_closure =
       base::BindOnce(&ServiceManagerContext::ShutDown,
diff --git a/chromium/content/app/service_manager_environment.h b/chromium/content/app/service_manager_environment.h
index 50ccf9abb71..222e69d680a 100644
--- a/chromium/content/app/service_manager_environment.h
+++ b/chromium/content/app/service_manager_environment.h
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "base/threading/thread.h"
 #include "content/common/content_export.h"
 
 namespace mojo {
@@ -27,22 +28,23 @@ struct StartupDataImpl;
 class CONTENT_EXPORT ServiceManagerEnvironment {
  public:
   explicit ServiceManagerEnvironment(
-      std::unique_ptr<BrowserProcessSubThread> ipc_thread);
+      std::unique_ptr<BrowserProcessSubThread> io_thread);
   ~ServiceManagerEnvironment();
 
-  BrowserProcessSubThread* ipc_thread() { return ipc_thread_.get(); }
+  BrowserProcessSubThread* io_thread() { return io_thread_.get(); }
 
   // Returns a new StartupDataImpl which captures and/or reflects the partial
   // state of this ServiceManagerEnvironment. This must be called and the
   // result passed to BrowserMain if the browser is going to be started within
   // Service Manager's process.
   //
-  // After this call, the ServiceManagerEnvironment no longer owns the IPC
-  // thread and |ipc_thread()| returns null.
+  // After this call, the ServiceManagerEnvironment no longer owns the IO
+  // thread and |io_thread()| returns null.
   std::unique_ptr<StartupDataImpl> CreateBrowserStartupData();
 
  private:
-  std::unique_ptr<BrowserProcessSubThread> ipc_thread_;
+  std::unique_ptr<BrowserProcessSubThread> io_thread_;
+  base::Thread mojo_ipc_thread_{"Mojo IPC"};
   std::unique_ptr<mojo::core::ScopedIPCSupport> mojo_ipc_support_;
   std::unique_ptr<ServiceManagerContext> service_manager_context_;
 
diff --git a/chromium/content/app_shim_remote_cocoa/DEPS b/chromium/content/app_shim_remote_cocoa/DEPS
index a9570cac7c9..76f1f747454 100644
--- a/chromium/content/app_shim_remote_cocoa/DEPS
+++ b/chromium/content/app_shim_remote_cocoa/DEPS
@@ -21,7 +21,6 @@ include_rules = [
   "+content/browser/web_contents/web_drag_dest_mac.h",
   "+content/common/content_export.h",
   "+content/common/cursors/webcursor.h",
-  "+content/common/edit_command.h",
   "+content/common/render_widget_host_ns_view.mojom.h",
   "+content/common/web_contents_ns_view_bridge.mojom.h",
   "+content/public/browser/content_browser_client.h",
diff --git a/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm b/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
index a8e5c8888cb..2aecd9c9316 100644
--- a/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
+++ b/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
@@ -22,6 +22,7 @@
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_associated_receiver.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "ui/accelerated_widget_mac/window_resize_helper_mac.h"
 #include "ui/base/cocoa/remote_accessibility_api.h"
 #include "ui/events/cocoa/cocoa_event_utils.h"
@@ -72,13 +73,13 @@ class RenderWidgetHostNSViewBridgeOwner
 
   void ForwardKeyboardEvent(const content::NativeWebKeyboardEvent& key_event,
                             const ui::LatencyInfo& latency_info) override {
-    std::vector<content::EditCommand> commands;
-    ForwardKeyboardEventWithCommands(key_event, latency_info, commands);
+    ForwardKeyboardEventWithCommands(
+        key_event, latency_info, std::vector<blink::mojom::EditCommandPtr>());
   }
   void ForwardKeyboardEventWithCommands(
       const content::NativeWebKeyboardEvent& key_event,
       const ui::LatencyInfo& latency_info,
-      const std::vector<content::EditCommand>& commands) override {
+      std::vector<blink::mojom::EditCommandPtr> edit_commands) override {
     const blink::WebKeyboardEvent* web_event =
         static_cast<const blink::WebKeyboardEvent*>(&key_event);
     std::unique_ptr<content::InputEvent> input_event =
@@ -87,7 +88,7 @@ class RenderWidgetHostNSViewBridgeOwner
         ui::EventToData(key_event.os_event);
     host_->ForwardKeyboardEventWithCommands(
         std::move(input_event), native_event_data, key_event.skip_in_browser,
-        commands);
+        std::move(edit_commands));
   }
   void RouteOrProcessMouseEvent(
       const blink::WebMouseEvent& web_event) override {
@@ -111,7 +112,7 @@ class RenderWidgetHostNSViewBridgeOwner
                     bool is_synthetically_injected) override {
     // The gesture type is not yet known, but assign a type to avoid
     // serialization asserts (the type will be stripped on the other side).
-    begin_event.SetType(blink::WebInputEvent::kGestureScrollBegin);
+    begin_event.SetType(blink::WebInputEvent::Type::kGestureScrollBegin);
     host_->GestureBegin(TranslateEvent(begin_event), is_synthetically_injected);
   }
   void GestureUpdate(blink::WebGestureEvent update_event) override {
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_host_helper.h b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_host_helper.h
index 9bbc973633e..12c45468e3c 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_host_helper.h
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_host_helper.h
@@ -6,6 +6,7 @@
 #define CONTENT_APP_SHIM_REMOTE_COCOA_RENDER_WIDGET_HOST_NS_VIEW_HOST_HELPER_H_
 
 #include "base/macros.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-forward.h"
 
 #include <vector>
 
@@ -21,7 +22,6 @@ class LatencyInfo;
 }  // namespace ui
 
 namespace content {
-struct EditCommand;
 struct NativeWebKeyboardEvent;
 }  // namespace content
 
@@ -60,7 +60,7 @@ class RenderWidgetHostNSViewHostHelper {
   virtual void ForwardKeyboardEventWithCommands(
       const content::NativeWebKeyboardEvent& key_event,
       const ui::LatencyInfo& latency_info,
-      const std::vector<content::EditCommand>& commands) = 0;
+      std::vector<blink::mojom::EditCommandPtr> commands) = 0;
 
   // Forward events to the renderer or the input router, as appropriate.
   virtual void RouteOrProcessMouseEvent(
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
index 52456e27ed1..0e4f3c5c7d3 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
@@ -14,9 +14,9 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/optional.h"
 #include "content/browser/renderer_host/input/mouse_wheel_rails_filter_mac.h"
-#include "content/common/edit_command.h"
 #include "content/common/render_widget_host_ns_view.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #import "ui/base/cocoa/command_dispatcher.h"
 #import "ui/base/cocoa/tool_tip_base_view.h"
 #include "ui/base/ime/ime_text_span.h"
@@ -169,7 +169,7 @@ struct DidOverscrollParams;
   // Contains edit commands received by the -doCommandBySelector: method when
   // handling a key down event, not including inserting commands, eg. insertTab,
   // etc.
-  content::EditCommands _editCommands;
+  std::vector<blink::mojom::EditCommandPtr> _editCommands;
 
   // Whether the previous mouse event was ignored due to hitTest check.
   BOOL _mouseEventWasIgnored;
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
index c7fb9423671..0d6c628b124 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
@@ -23,6 +23,7 @@
 #import "content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper.h"
 #import "content/public/browser/render_widget_host_view_mac_delegate.h"
 #include "content/public/common/content_features.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/platform/web_text_input_type.h"
 #include "ui/accessibility/platform/ax_platform_node.h"
 #import "ui/base/clipboard/clipboard_util_mac.h"
@@ -37,7 +38,6 @@
 #include "ui/events/keycodes/dom/keycode_converter.h"
 #include "ui/gfx/mac/coordinate_conversion.h"
 
-using content::EditCommand;
 using content::InputEvent;
 using content::NativeWebKeyboardEvent;
 using content::RenderWidgetHostViewMacEditCommandHelper;
@@ -78,7 +78,7 @@ class DummyHostHelper : public RenderWidgetHostNSViewHostHelper {
   void ForwardKeyboardEventWithCommands(
       const NativeWebKeyboardEvent& key_event,
       const ui::LatencyInfo& latency_info,
-      const std::vector<EditCommand>& commands) override {}
+      const std::vector<blink::mojom::EditCommandPtr> commands) override {}
   void RouteOrProcessMouseEvent(
       const blink::WebMouseEvent& web_event) override {}
   void RouteOrProcessTouchEvent(
@@ -715,7 +715,7 @@ void ExtractUnderlines(NSAttributedString* string,
     if (!_mouseEventWasIgnored) {
       WebMouseEvent exitEvent =
           WebMouseEventBuilder::Build(theEvent, self, _pointerType);
-      exitEvent.SetType(WebInputEvent::kMouseLeave);
+      exitEvent.SetType(WebInputEvent::Type::kMouseLeave);
       exitEvent.button = WebMouseEvent::Button::kNoButton;
       _hostHelper->ForwardMouseEvent(exitEvent);
     }
@@ -729,7 +729,7 @@ void ExtractUnderlines(NSAttributedString* string,
     // due to the hitTest, send a mouse enter event to the host view.
     WebMouseEvent enterEvent =
         WebMouseEventBuilder::Build(theEvent, self, _pointerType);
-    enterEvent.SetType(WebInputEvent::kMouseMove);
+    enterEvent.SetType(WebInputEvent::Type::kMouseMove);
     enterEvent.button = WebMouseEvent::Button::kNoButton;
     _hostHelper->RouteOrProcessMouseEvent(enterEvent);
   }
@@ -875,14 +875,18 @@ void ExtractUnderlines(NSAttributedString* string,
 }
 
 - (BOOL)performKeyEquivalent:(NSEvent*)theEvent {
+  // TODO(bokan): Tracing added temporarily to diagnose crbug.com/1039833.
+  TRACE_EVENT0("browser", "RenderWidgetHostViewCocoa::performKeyEquivalent");
   // |performKeyEquivalent:| is sent to all views of a window, not only down the
   // responder chain (cf. "Handling Key Equivalents" in
   // http://developer.apple.com/mac/library/documentation/Cocoa/Conceptual/EventOverview/HandlingKeyEvents/HandlingKeyEvents.html
   // ). A |performKeyEquivalent:| may also bubble up from a dialog child window
   // to perform browser commands such as switching tabs. We only want to handle
   // key equivalents if we're first responder in the keyWindow.
-  if (![[self window] isKeyWindow] || [[self window] firstResponder] != self)
+  if (![[self window] isKeyWindow] || [[self window] firstResponder] != self) {
+    TRACE_EVENT_INSTANT0("browser", "NotKeyWindow", TRACE_EVENT_SCOPE_THREAD);
     return NO;
+  }
 
   // If the event is reserved by the system, then do not pass it to web content.
   if (EventIsReservedBySystem(theEvent))
@@ -920,7 +924,8 @@ void ExtractUnderlines(NSAttributedString* string,
 }
 
 - (void)keyEvent:(NSEvent*)theEvent wasKeyEquivalent:(BOOL)equiv {
-  TRACE_EVENT0("browser", "RenderWidgetHostViewCocoa::keyEvent");
+  TRACE_EVENT1("browser", "RenderWidgetHostViewCocoa::keyEvent", "WindowNum",
+               [[self window] windowNumber]);
   NSEventType eventType = [theEvent type];
   NSEventModifierFlags modifierFlags = [theEvent modifierFlags];
   int keyCode = [theEvent keyCode];
@@ -952,8 +957,8 @@ void ExtractUnderlines(NSAttributedString* string,
   NativeWebKeyboardEvent event =
       NativeWebKeyboardEvent::CreateForRenderer(theEvent);
   ui::LatencyInfo latency_info;
-  if (event.GetType() == blink::WebInputEvent::kRawKeyDown ||
-      event.GetType() == blink::WebInputEvent::kChar) {
+  if (event.GetType() == blink::WebInputEvent::Type::kRawKeyDown ||
+      event.GetType() == blink::WebInputEvent::Type::kChar) {
     latency_info.set_source_event_type(ui::SourceEventType::KEY_PRESS);
   }
 
@@ -1055,7 +1060,7 @@ void ExtractUnderlines(NSAttributedString* string,
       delayEventUntilAfterImeCompostion = YES;
   } else {
     _hostHelper->ForwardKeyboardEventWithCommands(event, latency_info,
-                                                  _editCommands);
+                                                  std::move(_editCommands));
   }
 
   // Then send keypress and/or composition related events.
@@ -1109,13 +1114,13 @@ void ExtractUnderlines(NSAttributedString* string,
     // So before sending the real key down event, we need to send a fake key up
     // event to balance it.
     NativeWebKeyboardEvent fakeEvent = event;
-    fakeEvent.SetType(blink::WebInputEvent::kKeyUp);
+    fakeEvent.SetType(blink::WebInputEvent::Type::kKeyUp);
     fakeEvent.skip_in_browser = true;
     ui::LatencyInfo fake_event_latency_info = latency_info;
     fake_event_latency_info.set_source_event_type(ui::SourceEventType::OTHER);
     _hostHelper->ForwardKeyboardEvent(fakeEvent, fake_event_latency_info);
     _hostHelper->ForwardKeyboardEventWithCommands(
-        event, fake_event_latency_info, _editCommands);
+        event, fake_event_latency_info, std::move(_editCommands));
   }
 
   const NSUInteger kCtrlCmdKeyMask = NSControlKeyMask | NSCommandKeyMask;
@@ -1124,7 +1129,7 @@ void ExtractUnderlines(NSAttributedString* string,
     if (!textInserted && _textToBeInserted.length() == 1) {
       // If a single character was inserted, then we just send it as a keypress
       // event.
-      event.SetType(blink::WebInputEvent::kChar);
+      event.SetType(blink::WebInputEvent::Type::kChar);
       event.text[0] = _textToBeInserted[0];
       event.text[1] = 0;
       event.skip_in_browser = true;
@@ -1136,7 +1141,7 @@ void ExtractUnderlines(NSAttributedString* string,
       // We don't get insertText: calls if ctrl or cmd is down, or the key event
       // generates an insert command. So synthesize a keypress event for these
       // cases, unless the key event generated any other command.
-      event.SetType(blink::WebInputEvent::kChar);
+      event.SetType(blink::WebInputEvent::Type::kChar);
       event.skip_in_browser = true;
       _hostHelper->ForwardKeyboardEvent(event, latency_info);
     }
@@ -1195,7 +1200,7 @@ void ExtractUnderlines(NSAttributedString* string,
   if ([event type] == NSEventTypeMagnify ||
       [event type] == NSEventTypeEndGesture) {
     WebGestureEvent endEvent(WebGestureEventBuilder::Build(event, self));
-    endEvent.SetType(WebInputEvent::kGesturePinchEnd);
+    endEvent.SetType(WebInputEvent::Type::kGesturePinchEnd);
     endEvent.SetSourceDevice(blink::WebGestureDevice::kTouchpad);
     endEvent.SetNeedsWheelEvent(true);
     _hostHelper->GestureEnd(endEvent);
@@ -1996,7 +2001,7 @@ extern NSString* NSTextInputReplacementRangeAttributeName;
     // the next field on the page).
     if (!base::StartsWith(command, "insert",
                           base::CompareCase::INSENSITIVE_ASCII))
-      _editCommands.push_back(EditCommand(command, ""));
+      _editCommands.push_back(blink::mojom::EditCommand::New(command, ""));
   } else {
     _host->ExecuteEditCommand(command);
   }
@@ -2048,8 +2053,8 @@ extern NSString* NSTextInputReplacementRangeAttributeName;
   // If we switch windows (or are removed from the view hierarchy), cancel any
   // open mouse-downs.
   if (_hasOpenMouseDown) {
-    WebMouseEvent event(WebInputEvent::kMouseUp, WebInputEvent::kNoModifiers,
-                        ui::EventTimeForNow());
+    WebMouseEvent event(WebInputEvent::Type::kMouseUp,
+                        WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     event.button = WebMouseEvent::Button::kLeft;
     _hostHelper->ForwardMouseEvent(event);
     _hasOpenMouseDown = NO;
diff --git a/chromium/content/browser/BUILD.gn b/chromium/content/browser/BUILD.gn
index a5c2729a6c0..908a247e117 100644
--- a/chromium/content/browser/BUILD.gn
+++ b/chromium/content/browser/BUILD.gn
@@ -10,6 +10,7 @@ import("//build/config/ui.gni")
 import("//chromeos/assistant/assistant.gni")
 import("//components/ui_devtools/devtools.gni")
 import("//content/common/features.gni")
+import("//device/vr/buildflags/buildflags.gni")
 import("//gpu/vulkan/features.gni")
 import("//media/media_options.gni")
 import("//net/features.gni")
@@ -90,6 +91,7 @@ jumbo_source_set("browser") {
     "//content/browser/background_sync:background_sync_proto",
     "//content/browser/cache_storage:cache_storage_proto",
     "//content/browser/content_index:content_index_proto",
+    "//content/browser/conversions:mojo_bindings",
     "//content/browser/cookie_store:cookie_store_proto",
     "//content/browser/devtools:devtools_background_services_proto",
     "//content/browser/devtools:protocol_sources",
@@ -216,11 +218,12 @@ jumbo_source_set("browser") {
     "//ui/accessibility:ax_enums_mojo",
     "//ui/base",
     "//ui/base:buildflags",
+    "//ui/base:data_exchange",
     "//ui/base/clipboard",
     "//ui/base/cursor",
+    "//ui/base/cursor/mojom:cursor_type",
     "//ui/base/idle",
     "//ui/base/ime/init",
-    "//ui/base/mojom:cursor_type",
     "//ui/display",
     "//ui/display/types",
     "//ui/events",
@@ -254,6 +257,8 @@ jumbo_source_set("browser") {
   ]
 
   sources = [
+    "$target_gen_dir/devtools/protocol/audits.cc",
+    "$target_gen_dir/devtools/protocol/audits.h",
     "$target_gen_dir/devtools/protocol/background_service.cc",
     "$target_gen_dir/devtools/protocol/background_service.h",
     "$target_gen_dir/devtools/protocol/base_string_adapter.cc",
@@ -273,6 +278,8 @@ jumbo_source_set("browser") {
     "$target_gen_dir/devtools/protocol/inspector.h",
     "$target_gen_dir/devtools/protocol/io.cc",
     "$target_gen_dir/devtools/protocol/io.h",
+    "$target_gen_dir/devtools/protocol/log.cc",
+    "$target_gen_dir/devtools/protocol/log.h",
     "$target_gen_dir/devtools/protocol/memory.cc",
     "$target_gen_dir/devtools/protocol/memory.h",
     "$target_gen_dir/devtools/protocol/network.cc",
@@ -315,8 +322,6 @@ jumbo_source_set("browser") {
     "accessibility/accessibility_tree_formatter_base.h",
     "accessibility/accessibility_tree_formatter_blink.cc",
     "accessibility/accessibility_tree_formatter_blink.h",
-    "accessibility/accessibility_tree_formatter_browser.cc",
-    "accessibility/accessibility_tree_formatter_browser.h",
     "accessibility/accessibility_tree_formatter_mac.mm",
     "accessibility/accessibility_tree_formatter_stub.cc",
     "accessibility/accessibility_tree_formatter_uia_win.cc",
@@ -354,7 +359,6 @@ jumbo_source_set("browser") {
     "android/android_overlay_provider_impl.cc",
     "android/android_overlay_provider_impl.h",
     "android/app_web_message_port.cc",
-    "android/app_web_message_port.h",
     "android/background_sync_network_observer_android.cc",
     "android/background_sync_network_observer_android.h",
     "android/browser_startup_controller.cc",
@@ -681,13 +685,26 @@ jumbo_source_set("browser") {
     "content_service_delegate_impl.h",
     "conversions/conversion_host.cc",
     "conversions/conversion_host.h",
-    "conversions/conversion_manager.cc",
+    "conversions/conversion_internals_handler_impl.cc",
+    "conversions/conversion_internals_handler_impl.h",
+    "conversions/conversion_internals_ui.cc",
+    "conversions/conversion_internals_ui.h",
     "conversions/conversion_manager.h",
+    "conversions/conversion_manager_impl.cc",
+    "conversions/conversion_manager_impl.h",
+    "conversions/conversion_network_sender_impl.cc",
+    "conversions/conversion_network_sender_impl.h",
+    "conversions/conversion_page_metrics.cc",
+    "conversions/conversion_page_metrics.h",
     "conversions/conversion_policy.cc",
     "conversions/conversion_policy.h",
     "conversions/conversion_report.cc",
     "conversions/conversion_report.h",
+    "conversions/conversion_reporter_impl.cc",
+    "conversions/conversion_reporter_impl.h",
     "conversions/conversion_storage.h",
+    "conversions/conversion_storage_delegate_impl.cc",
+    "conversions/conversion_storage_delegate_impl.h",
     "conversions/conversion_storage_sql.cc",
     "conversions/conversion_storage_sql.h",
     "conversions/storable_conversion.cc",
@@ -740,6 +757,8 @@ jumbo_source_set("browser") {
     "devtools/devtools_video_consumer.h",
     "devtools/forwarding_agent_host.cc",
     "devtools/forwarding_agent_host.h",
+    "devtools/protocol/audits_handler.cc",
+    "devtools/protocol/audits_handler.h",
     "devtools/protocol/background_service_handler.cc",
     "devtools/protocol/background_service_handler.h",
     "devtools/protocol/browser_handler.cc",
@@ -762,6 +781,8 @@ jumbo_source_set("browser") {
     "devtools/protocol/inspector_handler.h",
     "devtools/protocol/io_handler.cc",
     "devtools/protocol/io_handler.h",
+    "devtools/protocol/log_handler.cc",
+    "devtools/protocol/log_handler.h",
     "devtools/protocol/memory_handler.cc",
     "devtools/protocol/memory_handler.h",
     "devtools/protocol/native_input_event_builder.h",
@@ -867,6 +888,8 @@ jumbo_source_set("browser") {
     "frame_host/clipboard_host_impl.cc",
     "frame_host/clipboard_host_impl.h",
     "frame_host/clipboard_host_impl_mac.mm",
+    "frame_host/cookie_utils.cc",
+    "frame_host/cookie_utils.h",
     "frame_host/cross_process_frame_connector.cc",
     "frame_host/cross_process_frame_connector.h",
     "frame_host/debug_urls.cc",
@@ -885,10 +908,6 @@ jumbo_source_set("browser") {
     "frame_host/frame_tree_node_blame_context.h",
     "frame_host/input/input_injector_impl.cc",
     "frame_host/input/input_injector_impl.h",
-    "frame_host/interstitial_page_impl.cc",
-    "frame_host/interstitial_page_impl.h",
-    "frame_host/interstitial_page_navigator_impl.cc",
-    "frame_host/interstitial_page_navigator_impl.h",
     "frame_host/ipc_utils.cc",
     "frame_host/ipc_utils.h",
     "frame_host/keep_alive_handle_factory.cc",
@@ -910,10 +929,7 @@ jumbo_source_set("browser") {
     "frame_host/navigation_throttle_runner.h",
     "frame_host/navigator.cc",
     "frame_host/navigator.h",
-    "frame_host/navigator_delegate.cc",
     "frame_host/navigator_delegate.h",
-    "frame_host/navigator_impl.cc",
-    "frame_host/navigator_impl.h",
     "frame_host/origin_policy_throttle.cc",
     "frame_host/origin_policy_throttle.h",
     "frame_host/popup_menu_helper_mac.h",
@@ -933,8 +949,6 @@ jumbo_source_set("browser") {
     "frame_host/render_frame_proxy_host.cc",
     "frame_host/render_frame_proxy_host.h",
     "frame_host/should_swap_browsing_instance.h",
-    "frame_host/webui_navigation_throttle.cc",
-    "frame_host/webui_navigation_throttle.h",
     "generic_sensor/sensor_provider_proxy_impl.cc",
     "generic_sensor/sensor_provider_proxy_impl.h",
     "geolocation/geolocation_service_impl.cc",
@@ -974,8 +988,8 @@ jumbo_source_set("browser") {
     "histogram_synchronizer.h",
     "histograms_internals_ui.cc",
     "histograms_internals_ui.h",
-    "idle/idle_manager.cc",
-    "idle/idle_manager.h",
+    "idle/idle_manager_impl.cc",
+    "idle/idle_manager_impl.h",
     "idle/idle_monitor.cc",
     "idle/idle_monitor.h",
     "image_capture/image_capture_impl.cc",
@@ -1004,6 +1018,8 @@ jumbo_source_set("browser") {
     "indexed_db/indexed_db_connection_coordinator.h",
     "indexed_db/indexed_db_context_impl.cc",
     "indexed_db/indexed_db_context_impl.h",
+    "indexed_db/indexed_db_control_wrapper.cc",
+    "indexed_db/indexed_db_control_wrapper.h",
     "indexed_db/indexed_db_cursor.cc",
     "indexed_db/indexed_db_cursor.h",
     "indexed_db/indexed_db_data_format_version.cc",
@@ -1588,6 +1604,8 @@ jumbo_source_set("browser") {
     "renderer_host/text_input_client_mac.mm",
     "renderer_host/text_input_client_message_filter.h",
     "renderer_host/text_input_client_message_filter.mm",
+    "renderer_host/text_input_host_impl.h",
+    "renderer_host/text_input_host_impl.mm",
     "renderer_host/text_input_manager.cc",
     "renderer_host/text_input_manager.h",
     "renderer_host/ui_events_helper.cc",
@@ -1596,8 +1614,8 @@ jumbo_source_set("browser") {
     "renderer_host/web_database_host_impl.h",
     "renderer_host/webmenurunner_mac.h",
     "renderer_host/webmenurunner_mac.mm",
-    "resolve_proxy_msg_helper.cc",
-    "resolve_proxy_msg_helper.h",
+    "resolve_proxy_helper.cc",
+    "resolve_proxy_helper.h",
     "resource_context_impl.cc",
     "resource_context_impl.h",
     "resource_coordinator_service.cc",
@@ -1630,6 +1648,8 @@ jumbo_source_set("browser") {
     "scheduler/responsiveness/watcher.h",
     "scoped_active_url.cc",
     "scoped_active_url.h",
+    "screen_enumeration/screen_change_monitor.cc",
+    "screen_enumeration/screen_change_monitor.h",
     "screen_enumeration/screen_enumeration_impl.cc",
     "screen_enumeration/screen_enumeration_impl.h",
     "screen_orientation/screen_orientation_provider.cc",
@@ -1646,11 +1666,13 @@ jumbo_source_set("browser") {
     "service_manager/service_manager_context.cc",
     "service_manager/service_manager_context.h",
     "service_process_host_impl.cc",
+    "service_sandbox_type.h",
     "service_worker/embedded_worker_instance.cc",
     "service_worker/embedded_worker_instance.h",
     "service_worker/embedded_worker_status.h",
     "service_worker/payment_handler_support.cc",
     "service_worker/payment_handler_support.h",
+    "service_worker/service_worker_accessed_callback.h",
     "service_worker/service_worker_cache_writer.cc",
     "service_worker/service_worker_cache_writer.h",
     "service_worker/service_worker_client_info.cc",
@@ -1727,10 +1749,8 @@ jumbo_source_set("browser") {
     "service_worker/service_worker_registration_status.h",
     "service_worker/service_worker_registry.cc",
     "service_worker/service_worker_registry.h",
-    "service_worker/service_worker_request_handler.cc",
-    "service_worker/service_worker_request_handler.h",
-    "service_worker/service_worker_resource_writer_impl.cc",
-    "service_worker/service_worker_resource_writer_impl.h",
+    "service_worker/service_worker_resource_ops.cc",
+    "service_worker/service_worker_resource_ops.h",
     "service_worker/service_worker_script_cache_map.cc",
     "service_worker/service_worker_script_cache_map.h",
     "service_worker/service_worker_script_loader_factory.cc",
@@ -1917,10 +1937,30 @@ jumbo_source_set("browser") {
     "web_package/web_bundle_handle.h",
     "web_package/web_bundle_handle_tracker.cc",
     "web_package/web_bundle_handle_tracker.h",
+    "web_package/web_bundle_interceptor_for_file.cc",
+    "web_package/web_bundle_interceptor_for_file.h",
+    "web_package/web_bundle_interceptor_for_history_navigation.cc",
+    "web_package/web_bundle_interceptor_for_history_navigation.h",
+    "web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.cc",
+    "web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h",
+    "web_package/web_bundle_interceptor_for_history_navigation_from_network.cc",
+    "web_package/web_bundle_interceptor_for_history_navigation_from_network.h",
+    "web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.cc",
+    "web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h",
+    "web_package/web_bundle_interceptor_for_network.cc",
+    "web_package/web_bundle_interceptor_for_network.h",
+    "web_package/web_bundle_interceptor_for_tracked_navigation_from_file.cc",
+    "web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h",
+    "web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.cc",
+    "web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h",
+    "web_package/web_bundle_interceptor_for_trustable_file.cc",
+    "web_package/web_bundle_interceptor_for_trustable_file.h",
     "web_package/web_bundle_navigation_info.cc",
     "web_package/web_bundle_navigation_info.h",
     "web_package/web_bundle_reader.cc",
     "web_package/web_bundle_reader.h",
+    "web_package/web_bundle_redirect_url_loader.cc",
+    "web_package/web_bundle_redirect_url_loader.h",
     "web_package/web_bundle_source.cc",
     "web_package/web_bundle_source.h",
     "web_package/web_bundle_url_loader_factory.cc",
@@ -2172,8 +2212,8 @@ jumbo_source_set("browser") {
       "media/session/pepper_player_delegate.h",
       "pepper_flash_settings_helper_impl.cc",
       "pepper_flash_settings_helper_impl.h",
-      "plugin_content_origin_whitelist.cc",
-      "plugin_content_origin_whitelist.h",
+      "plugin_content_origin_allowlist.cc",
+      "plugin_content_origin_allowlist.h",
       "plugin_data_remover_impl.cc",
       "plugin_data_remover_impl.h",
       "plugin_list.cc",
@@ -2293,6 +2333,8 @@ jumbo_source_set("browser") {
       "//build/config/linux/atspi2",
     ]
 
+    deps += [ "//ui/gfx/x" ]
+
     if (use_glib) {
       configs += [ "//build/config/linux:glib" ]
     }
@@ -2303,7 +2345,6 @@ jumbo_source_set("browser") {
   }
 
   if (use_x11) {
-    configs += [ "//build/config/linux:x11" ]
     deps += [
       "//ui/events/platform/x11",
       "//ui/gfx/x",
@@ -2666,6 +2707,41 @@ jumbo_source_set("browser") {
       "gpu/viz_devtools_connector.h",
     ]
   }
+
+  if (enable_vr) {
+    if (!is_android) {
+      sources += [
+        "xr/service/isolated_device_provider.cc",
+        "xr/service/isolated_device_provider.h",
+      ]
+    }
+
+    sources += [
+      "xr/metrics/session_metrics_helper.cc",
+      "xr/metrics/session_metrics_helper.h",
+      "xr/metrics/session_timer.cc",
+      "xr/metrics/session_timer.h",
+      "xr/metrics/session_tracker.h",
+      "xr/metrics/webxr_session_tracker.cc",
+      "xr/metrics/webxr_session_tracker.h",
+      "xr/service/browser_xr_runtime_impl.cc",
+      "xr/service/browser_xr_runtime_impl.h",
+      "xr/service/vr_service_impl.cc",
+      "xr/service/vr_service_impl.h",
+      "xr/service/xr_device_service.cc",
+      "xr/service/xr_device_service.h",
+      "xr/service/xr_runtime_manager_impl.cc",
+      "xr/service/xr_runtime_manager_impl.h",
+      "xr/xr_utils.cc",
+      "xr/xr_utils.h",
+    ]
+
+    deps += [
+      "//device/vr/buildflags",
+      "//device/vr/orientation",
+      "//services/metrics/public/cpp:ukm_builders",
+    ]
+  }
 }
 
 buildflag_header("accessibility_buildflags") {
@@ -2690,7 +2766,12 @@ if (is_android) {
 group("for_content_tests") {
   visibility = [
     "//content/test/*",
-    "//content/public/test/*",
+    "//content/public/test/android/*",
+
+    # TODO(danakj): Split out the web test parts of //content/shell/browser
+    # and only point to them here (similar to //content/renderer and
+    # //content/shell:web_test_renderer).
+    "//content/shell:content_shell_lib",
   ]
   if (!is_component_build) {
     public_deps = [ ":browser" ]
diff --git a/chromium/content/browser/DEPS b/chromium/content/browser/DEPS
index 66eb742c8b2..f6582e81fbb 100644
--- a/chromium/content/browser/DEPS
+++ b/chromium/content/browser/DEPS
@@ -55,12 +55,24 @@ include_rules = [
   # in the browser DLL.
   "+gin/v8_initializer.h",
   "+mojo",
-  "+services",
   "+sql",
   "+ui/aura_extra",
   "+components/vector_icons",
   "+ui/webui",
 
+  # TODO(crbug.com/1079201): Consider removing "+serivces". Each service should
+  # have explicit rules to allow services/*/public rather than adding a blanket
+  # dependency.
+  "+services",
+  "-services/content",
+  "+services/content/public",
+  "+services/content/navigable_contents_delegate.h",
+  "+services/content/service.h",
+  "+services/content/service_delegate.h",
+  "-services/network",
+  "+services/network/public/cpp",
+  "+services/network/public/mojom",
+
   # In general, //content shouldn't depend on //device.
   # This is the an exception.
   "+device/udev_linux",  # For udev utility and wrapper library.
@@ -81,13 +93,6 @@ include_rules = [
   "+chromeos",
   "+third_party/cros_system_api",
 
-  # Limit visibility into Content Service internals.
-  "-services/content",
-  "+services/content/public",
-  "+services/content/navigable_contents_delegate.h",
-  "+services/content/service.h",
-  "+services/content/service_delegate.h",
-
   # No inclusion of WebKit from the browser, other than the ones in
   # WebKit/public/{mojom,common}, or the ones that are strictly enum/POD,
   # header-only types, and some selected common code.
@@ -100,7 +105,6 @@ include_rules = [
   "+third_party/blink/public/platform/web_content_security_policy.h",
   "+third_party/blink/public/platform/web_drag_operation.h",
   "+third_party/blink/public/platform/web_fullscreen_video_status.h",
-  "+third_party/blink/public/platform/web_intrinsic_sizing_info.h",
   "+third_party/blink/public/platform/web_mixed_content_context_type.h",
   "+third_party/blink/public/platform/web_screen_info.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
@@ -117,7 +121,7 @@ include_rules = [
   "+third_party/blink/public/web/web_drag_status.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
   "+third_party/blink/public/web/web_serialized_script_value_version.h",
-  "+third_party/blink/public/web/web_tree_scope_type.h",
+  "+third_party/blink/public/mojom/frame/tree_scope_type.mojom.h",
 
   # DO NOT ADD ANY CHROME OR COMPONENTS INCLUDES HERE!!!
   # See https://sites.google.com/a/chromium.org/dev/developers/content-module
@@ -125,8 +129,44 @@ include_rules = [
 ]
 
 specific_include_rules = {
-  # To share values of UMA enums between product code and tests.
-  "cross_site_document_blocking_browsertest.cc": [
+  ".*test\.cc": [
+    "+services/network/test",
+  ],
+  "browser_main_loop\.cc": [
+    # TODO(crbug.com/1049894): Remove.
+    "+services/network/transitional_url_loader_factory_owner.h",
+  ],
+  "browsing_data_(filter_builder|remover)_impl_unittest\.cc": [
+    "+services/network/cookie_manager.h",
+  ],
+  "cross_origin_read_blocking_checker\.(cc|h)": [
+    # TODO(crbug.com/1049894): Remove.
+    "+services/network/cross_origin_read_blocking.h",
+  ],
+  "cross_site_document_blocking_browsertest\.cc": [
+    "+services/network/cross_origin_read_blocking.h",
+  ],
+  "navigation_url_loader_impl_unittest\.cc": [
+    "+services/network/resource_scheduler/resource_scheduler_client.h",
+    "+services/network/url_loader.h",
+    "+services/network/url_request_context_owner.h",
+  ],
+  "network_service_instance_impl\.cc": [
+    # TODO(crbug.com/1049894): Remove.
+    "+services/network/network_service.h",
+  ],
+  "service_worker_fetch_dispatcher\.cc": [
+    # TODO(crbug.com/1049894): Remove.
+    "+services/network/throttling/throttling_controller.h",
+  ],
+  "signed_exchange_certificate_chain\.h": [
+    "+services/network/ignore_errors_cert_verifier.h",
+  ],
+  "signed_exchange_handler_unittest\.cc": [
+    "+services/network/ignore_errors_cert_verifier.h",
+    "+services/network/network_context.h",
+  ],
+  "signed_exchange_subresource_prefetch_browsertest\.cc": [
     "+services/network/cross_origin_read_blocking.h",
   ],
   # SiteInstance and BrowsingInstance should not depend on the types of things
@@ -135,7 +175,12 @@ specific_include_rules = {
     "-content/browser/frame_host",
     "-content/browser/web_contents",
   ],
-  "storage_partition_impl_unittest.cc": [
+  "storage_partition_impl_unittest\.cc": [
+    "+services/network/cookie_manager.h",
     "+third_party/leveldatabase",
   ],
+  "utility_process_host\.cc": [
+    # TODO(crbug.com/1049894): Remove.
+    "+services/network/network_sandbox_win.h",
+  ],
 }
diff --git a/chromium/content/browser/OWNERS b/chromium/content/browser/OWNERS
index 603e58ede91..17ac4b0540c 100644
--- a/chromium/content/browser/OWNERS
+++ b/chromium/content/browser/OWNERS
@@ -32,6 +32,9 @@ per-file sandbox_host_linux.*=file://sandbox/linux/OWNERS
 per-file sandbox_ipc_linux.*=file://sandbox/linux/OWNERS
 per-file utility_process_sandbox_browsertest.cc=file://sandbox/linux/OWNERS
 
+# Service sandbox mappings require security review
+per-file service_sandbox_type.h=file://ipc/SECURITY_OWNERS
+
 # Service manifests provided by content require security review
 per-file builtin_service_manifests.*=set noparent
 per-file builtin_service_manifests.*=file://ipc/SECURITY_OWNERS
@@ -46,3 +49,7 @@ per-file storage_service*=file://components/services/storage/OWNERS
 
 # Variations.
 per-file field_trial_synchronizer.*=file://base/metrics/OWNERS
+
+# Cross origin opener policy.
+per-file cross_origin_opener_policy*=ahemery@chromium.org
+per-file cross_origin_opener_policy*=pmeuleman@chromium.org
diff --git a/chromium/content/browser/SITE_ISOLATION_OWNERS b/chromium/content/browser/SITE_ISOLATION_OWNERS
index c0d9435efcb..30845c15951 100644
--- a/chromium/content/browser/SITE_ISOLATION_OWNERS
+++ b/chromium/content/browser/SITE_ISOLATION_OWNERS
@@ -1,3 +1,4 @@
+acolwell@chromium.org
 alexmos@chromium.org
 creis@chromium.org
 lukasza@chromium.org
diff --git a/chromium/content/browser/accessibility/accessibility_action_browsertest.cc b/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
index 875f7da6cec..efe6f4683be 100644
--- a/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
@@ -4,13 +4,14 @@
 
 #include <string>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc b/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
index 99bda64d2fb..4b64570478c 100644
--- a/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
diff --git a/chromium/content/browser/accessibility/accessibility_event_recorder.cc b/chromium/content/browser/accessibility/accessibility_event_recorder.cc
index 744cc39d14e..555251c9218 100644
--- a/chromium/content/browser/accessibility/accessibility_event_recorder.cc
+++ b/chromium/content/browser/accessibility/accessibility_event_recorder.cc
@@ -35,7 +35,6 @@ AccessibilityEventRecorder::GetTestPasses() {
 #else   // defined(OS_ANDROID)
   return {
       {"blink", &AccessibilityEventRecorder::Create},
-      {"native", &AccessibilityEventRecorder::Create},
   };
 #endif  // defined(OS_ANDROID)
 }
diff --git a/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc b/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
index 8bb9c0e4d9d..ceca7d9f66b 100644
--- a/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
+++ b/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
@@ -282,7 +282,7 @@ void AccessibilityEventRecorderAuraLinux::ProcessATKEvent(
   AtkObject* obj = ATK_OBJECT(g_value_get_object(&params[0]));
   log += " " + AtkObjectToString(obj, log_name);
 
-  std::string states = "";
+  std::string states;
   AtkStateSet* state_set = atk_object_ref_state_set(obj);
   for (int i = ATK_STATE_INVALID; i < ATK_STATE_LAST_DEFINED; i++) {
     AtkStateType state_type = static_cast<AtkStateType>(i);
diff --git a/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc b/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
index 6d2333190dd..5e5895010af 100644
--- a/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
+++ b/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
@@ -414,7 +414,7 @@ AccessibilityEventRecorderUia::Thread::EventHandler::HandleAutomationEvent(
 
 std::string AccessibilityEventRecorderUia::Thread::EventHandler::GetSenderInfo(
     IUIAutomationElement* sender) {
-  std::string sender_info = "";
+  std::string sender_info;
 
   auto append_property = [&](const char* name, auto getter) {
     base::win::ScopedBstr bstr;
diff --git a/chromium/content/browser/accessibility/accessibility_ipc_error_browsertest.cc b/chromium/content/browser/accessibility/accessibility_ipc_error_browsertest.cc
index 0b61c49176b..47add23227a 100644
--- a/chromium/content/browser/accessibility/accessibility_ipc_error_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_ipc_error_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/accessibility_mode_browsertest.cc b/chromium/content/browser/accessibility/accessibility_mode_browsertest.cc
index 71c4587a6f6..89223097359 100644
--- a/chromium/content/browser/accessibility/accessibility_mode_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_mode_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_android.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_android.cc
index 908aabdc263..afeb78a3c21 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_android.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_android.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
+#include "content/browser/accessibility/accessibility_tree_formatter_base.h"
 
 #include <string>
 
@@ -63,11 +63,23 @@ const char* const INT_ATTRIBUTES[] = {
 }  // namespace
 
 class AccessibilityTreeFormatterAndroid
-    : public AccessibilityTreeFormatterBrowser {
+    : public AccessibilityTreeFormatterBase {
  public:
   AccessibilityTreeFormatterAndroid();
   ~AccessibilityTreeFormatterAndroid() override;
 
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTree(
+      BrowserAccessibility* root) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForProcess(
+      base::ProcessId pid) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForWindow(
+      gfx::AcceleratedWidget widget) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForPattern(
+      const base::StringPiece& pattern) override;
+
   void AddDefaultFilters(
       std::vector<PropertyFilter>* property_filters) override;
 
@@ -77,8 +89,13 @@ class AccessibilityTreeFormatterAndroid
   const std::string GetAllowString() override;
   const std::string GetDenyString() override;
   const std::string GetDenyNodeString() override;
+
+  void RecursiveBuildAccessibilityTree(const BrowserAccessibility& node,
+                                       base::DictionaryValue* dict) const;
+
   void AddProperties(const BrowserAccessibility& node,
-                     base::DictionaryValue* dict) override;
+                     base::DictionaryValue* dict) const;
+
   base::string16 ProcessTreeForOutput(
       const base::DictionaryValue& node,
       base::DictionaryValue* filtered_dict_result = nullptr) override;
@@ -104,6 +121,38 @@ AccessibilityTreeFormatterAndroid::AccessibilityTreeFormatterAndroid() {}
 
 AccessibilityTreeFormatterAndroid::~AccessibilityTreeFormatterAndroid() {}
 
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterAndroid::BuildAccessibilityTree(
+    BrowserAccessibility* root) {
+  CHECK(root);
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
+
+  // XXX: Android formatter should walk native Android tree (not internal one).
+  RecursiveBuildAccessibilityTree(*root, dict.get());
+  return dict;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterAndroid::BuildAccessibilityTreeForProcess(
+    base::ProcessId pid) {
+  NOTREACHED();
+  return nullptr;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterAndroid::BuildAccessibilityTreeForWindow(
+    gfx::AcceleratedWidget widget) {
+  NOTREACHED();
+  return nullptr;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterAndroid::BuildAccessibilityTreeForPattern(
+    const base::StringPiece& pattern) {
+  NOTREACHED();
+  return nullptr;
+}
+
 void AccessibilityTreeFormatterAndroid::AddDefaultFilters(
     std::vector<PropertyFilter>* property_filters) {
   AddPropertyFilter(property_filters, "hint=*");
@@ -112,9 +161,27 @@ void AccessibilityTreeFormatterAndroid::AddDefaultFilters(
                     PropertyFilter::DENY);
   AddPropertyFilter(property_filters, "has_image", PropertyFilter::DENY);
 }
+
+void AccessibilityTreeFormatterAndroid::RecursiveBuildAccessibilityTree(
+    const BrowserAccessibility& node,
+    base::DictionaryValue* dict) const {
+  AddProperties(node, dict);
+
+  auto children = std::make_unique<base::ListValue>();
+
+  for (size_t i = 0; i < node.PlatformChildCount(); ++i) {
+    BrowserAccessibility* child_node = node.PlatformGetChild(i);
+    std::unique_ptr<base::DictionaryValue> child_dict(
+        new base::DictionaryValue);
+    RecursiveBuildAccessibilityTree(*child_node, child_dict.get());
+    children->Append(std::move(child_dict));
+  }
+  dict->Set(kChildrenDictAttr, std::move(children));
+}
+
 void AccessibilityTreeFormatterAndroid::AddProperties(
     const BrowserAccessibility& node,
-    base::DictionaryValue* dict) {
+    base::DictionaryValue* dict) const {
   dict->SetInteger("id", node.GetId());
 
   const BrowserAccessibilityAndroid* android_node =
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
index 35563fac4af..85a308d7591 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
+#include "content/browser/accessibility/accessibility_tree_formatter_base.h"
 
 #include <atspi/atspi.h>
 #include <dbus/dbus.h>
@@ -27,7 +27,7 @@
 namespace content {
 
 class AccessibilityTreeFormatterAuraLinux
-    : public AccessibilityTreeFormatterBrowser {
+    : public AccessibilityTreeFormatterBase {
  public:
   AccessibilityTreeFormatterAuraLinux();
   ~AccessibilityTreeFormatterAuraLinux() override;
@@ -38,13 +38,13 @@ class AccessibilityTreeFormatterAuraLinux
   const std::string GetAllowString() override;
   const std::string GetDenyString() override;
   const std::string GetDenyNodeString() override;
-  void AddProperties(const BrowserAccessibility& node,
-                     base::DictionaryValue* dict) override;
 
   base::string16 ProcessTreeForOutput(
       const base::DictionaryValue& node,
       base::DictionaryValue* filtered_dict_result = nullptr) override;
 
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTree(
+      BrowserAccessibility* root) override;
   std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForProcess(
       base::ProcessId pid) override;
   std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForWindow(
@@ -54,6 +54,13 @@ class AccessibilityTreeFormatterAuraLinux
   std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeWithNode(
       AtspiAccessible* node);
 
+  void RecursiveBuildAccessibilityTree(AtspiAccessible* node,
+                                       base::DictionaryValue* dict);
+  void RecursiveBuildAccessibilityTree(AtkObject*, base::DictionaryValue*);
+
+  void AddProperties(AtkObject*, base::DictionaryValue*);
+  void AddProperties(AtspiAccessible*, base::DictionaryValue*);
+
   void AddTextProperties(AtkText* atk_text, base::DictionaryValue* dict);
   void AddActionProperties(AtkObject* atk_object, base::DictionaryValue* dict);
   void AddValueProperties(AtkObject* atk_object, base::DictionaryValue* dict);
@@ -61,11 +68,6 @@ class AccessibilityTreeFormatterAuraLinux
   void AddTableCellProperties(const ui::AXPlatformNodeAuraLinux* node,
                               AtkObject* atk_object,
                               base::DictionaryValue* dict);
-
-  void RecursiveBuildAccessibilityTree(AtspiAccessible* node,
-                                       base::DictionaryValue* dict);
-  virtual void AddProperties(AtspiAccessible* node,
-                             base::DictionaryValue* dict);
 };
 
 // static
@@ -136,6 +138,23 @@ AccessibilityTreeFormatterAuraLinux::BuildAccessibilityTreeForPattern(
 }
 
 std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterAuraLinux::BuildAccessibilityTree(
+    BrowserAccessibility* root) {
+  DCHECK(root);
+
+  BrowserAccessibilityAuraLinux* platform_root =
+      ToBrowserAccessibilityAuraLinux(root);
+  DCHECK(platform_root);
+
+  AtkObject* atk_root = platform_root->GetNativeViewAccessible();
+  DCHECK(atk_root);
+
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
+  RecursiveBuildAccessibilityTree(atk_root, dict.get());
+  return dict;
+}
+
+std::unique_ptr<base::DictionaryValue>
 AccessibilityTreeFormatterAuraLinux::BuildAccessibilityTreeForProcess(
     base::ProcessId pid) {
   LOG(ERROR) << "Aura Linux does not yet support building trees for processes";
@@ -163,6 +182,32 @@ AccessibilityTreeFormatterAuraLinux::BuildAccessibilityTreeWithNode(
 }
 
 void AccessibilityTreeFormatterAuraLinux::RecursiveBuildAccessibilityTree(
+    AtkObject* atk_node,
+    base::DictionaryValue* dict) {
+  AddProperties(atk_node, dict);
+
+  auto child_count = atk_object_get_n_accessible_children(atk_node);
+  if (child_count <= 0)
+    return;
+
+  auto children = std::make_unique<base::ListValue>();
+  for (auto i = 0; i < child_count; i++) {
+    std::unique_ptr<base::DictionaryValue> child_dict(
+        new base::DictionaryValue);
+
+    AtkObject* atk_child = atk_object_ref_accessible_child(atk_node, i);
+    CHECK(atk_child);
+
+    RecursiveBuildAccessibilityTree(atk_child, child_dict.get());
+    g_object_unref(atk_child);
+
+    children->Append(std::move(child_dict));
+  }
+
+  dict->Set(kChildrenDictAttr, std::move(children));
+}
+
+void AccessibilityTreeFormatterAuraLinux::RecursiveBuildAccessibilityTree(
     AtspiAccessible* node,
     base::DictionaryValue* dict) {
   AddProperties(node, dict);
@@ -412,18 +457,17 @@ void AccessibilityTreeFormatterAuraLinux::AddTableCellProperties(
 }
 
 void AccessibilityTreeFormatterAuraLinux::AddProperties(
-    const BrowserAccessibility& node,
+    AtkObject* atk_object,
     base::DictionaryValue* dict) {
-  dict->SetInteger("id", node.GetId());
-  BrowserAccessibilityAuraLinux* acc_obj =
-      ToBrowserAccessibilityAuraLinux(const_cast<BrowserAccessibility*>(&node));
-  DCHECK(acc_obj);
+  ui::AXPlatformNodeAuraLinux* platform_node =
+      ui::AXPlatformNodeAuraLinux::FromAtkObject(atk_object);
+  DCHECK(platform_node);
 
-  ui::AXPlatformNodeAuraLinux* ax_platform_node = acc_obj->GetNode();
-  DCHECK(ax_platform_node);
+  BrowserAccessibility* node = BrowserAccessibility::FromAXPlatformNodeDelegate(
+      platform_node->GetDelegate());
+  DCHECK(node);
 
-  AtkObject* atk_object = ax_platform_node->GetNativeViewAccessible();
-  DCHECK(atk_object);
+  dict->SetInteger("id", node->GetId());
 
   AtkRole role = atk_object_get_role(atk_object);
   if (role != ATK_ROLE_UNKNOWN) {
@@ -469,7 +513,7 @@ void AccessibilityTreeFormatterAuraLinux::AddProperties(
   AddActionProperties(atk_object, dict);
   AddValueProperties(atk_object, dict);
   AddTableProperties(atk_object, dict);
-  AddTableCellProperties(ax_platform_node, atk_object, dict);
+  AddTableCellProperties(platform_node, atk_object, dict);
 }
 
 void AccessibilityTreeFormatterAuraLinux::AddProperties(
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
index f5dae9ad7e8..14ccfb92527 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
@@ -9,7 +9,7 @@
 #include <memory>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/strings/pattern.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -189,6 +189,28 @@ AccessibilityTreeFormatterBase::GetVersionSpecificExpectedFileSuffix() {
   return FILE_PATH_LITERAL("");
 }
 
+bool AccessibilityTreeFormatterBase::FilterPropertyName(
+    const base::string16& text) {
+  // Find the first allow-filter matching the property name. The filter should
+  // be either an exact property match or a wildcard matching to support filter
+  // collections like AXRole* which matches AXRoleDescription.
+  const base::string16 delim = base::ASCIIToUTF16("=");
+  for (const auto& filter : property_filters_) {
+    base::String16Tokenizer tokenizer(filter.match_str, delim);
+    if (tokenizer.GetNext() && (text == tokenizer.token() ||
+                                base::MatchPattern(text, tokenizer.token()))) {
+      switch (filter.type) {
+        case PropertyFilter::ALLOW_EMPTY:
+        case PropertyFilter::ALLOW:
+          return true;
+        default:
+          break;
+      }
+    }
+  }
+  return false;
+}
+
 bool AccessibilityTreeFormatterBase::MatchesPropertyFilters(
     const base::string16& text,
     bool default_result) const {
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
index 6dc193e3cb2..702bcd6811a 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
@@ -86,6 +86,9 @@ class CONTENT_EXPORT AccessibilityTreeFormatterBase
   // Overridden by platform subclasses.
   //
 
+  // Returns true if the property name matches a property filter.
+  bool FilterPropertyName(const base::string16& text);
+
   // Process accessibility tree with filters for output.
   // Given a dictionary that contains a platform-specific dictionary
   // representing an accessibility tree, and utilizing property_filters_ and
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.cc
index c14ff8b923a..7bf60d5408d 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.cc
@@ -153,7 +153,7 @@ std::string IntAttrToString(const BrowserAccessibility& node,
 }  // namespace
 
 AccessibilityTreeFormatterBlink::AccessibilityTreeFormatterBlink()
-    : AccessibilityTreeFormatterBrowser() {}
+    : AccessibilityTreeFormatterBase() {}
 
 AccessibilityTreeFormatterBlink::~AccessibilityTreeFormatterBlink() {}
 
@@ -202,6 +202,53 @@ const char* const TREE_DATA_ATTRIBUTES[] = {"TreeData.textSelStartOffset",
 const char* STATE_FOCUSED = "focused";
 const char* STATE_OFFSCREEN = "offscreen";
 
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterBlink::BuildAccessibilityTree(
+    BrowserAccessibility* root) {
+  CHECK(root);
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
+  RecursiveBuildAccessibilityTree(*root, dict.get());
+  return dict;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterBlink::BuildAccessibilityTreeForProcess(
+    base::ProcessId pid) {
+  NOTREACHED();
+  return nullptr;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterBlink::BuildAccessibilityTreeForWindow(
+    gfx::AcceleratedWidget widget) {
+  NOTREACHED();
+  return nullptr;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterBlink::BuildAccessibilityTreeForPattern(
+    const base::StringPiece& pattern) {
+  NOTREACHED();
+  return nullptr;
+}
+
+void AccessibilityTreeFormatterBlink::RecursiveBuildAccessibilityTree(
+    const BrowserAccessibility& node,
+    base::DictionaryValue* dict) const {
+  AddProperties(node, dict);
+
+  auto children = std::make_unique<base::ListValue>();
+
+  for (size_t i = 0; i < ChildCount(node); ++i) {
+    BrowserAccessibility* child_node = GetChild(node, i);
+    std::unique_ptr<base::DictionaryValue> child_dict(
+        new base::DictionaryValue);
+    RecursiveBuildAccessibilityTree(*child_node, child_dict.get());
+    children->Append(std::move(child_dict));
+  }
+  dict->Set(kChildrenDictAttr, std::move(children));
+}
+
 uint32_t AccessibilityTreeFormatterBlink::ChildCount(
     const BrowserAccessibility& node) const {
   if (node.HasStringAttribute(ax::mojom::StringAttribute::kChildTreeId))
@@ -227,7 +274,7 @@ BrowserAccessibility* AccessibilityTreeFormatterBlink::GetChild(
 
 void AccessibilityTreeFormatterBlink::AddProperties(
     const BrowserAccessibility& node,
-    base::DictionaryValue* dict) {
+    base::DictionaryValue* dict) const {
   int id = node.GetId();
   dict->SetInteger("id", id);
 
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.h b/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.h
index eca5ae0af5d..29f82dfd6af 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.h
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_blink.h
@@ -9,18 +9,31 @@
 #include <string>
 #include <vector>
 
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
+#include "content/browser/accessibility/accessibility_tree_formatter_base.h"
 
 namespace content {
 
 class CONTENT_EXPORT AccessibilityTreeFormatterBlink
-    : public AccessibilityTreeFormatterBrowser {
+    : public AccessibilityTreeFormatterBase {
  public:
   explicit AccessibilityTreeFormatterBlink();
   ~AccessibilityTreeFormatterBlink() override;
 
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTree(
+      BrowserAccessibility* root) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForProcess(
+      base::ProcessId pid) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForWindow(
+      gfx::AcceleratedWidget widget) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForPattern(
+      const base::StringPiece& pattern) override;
+
   void AddDefaultFilters(
       std::vector<PropertyFilter>* property_filters) override;
+
   static std::unique_ptr<AccessibilityTreeFormatter> CreateBlink();
 
  private:
@@ -29,11 +42,17 @@ class CONTENT_EXPORT AccessibilityTreeFormatterBlink
   const std::string GetAllowString() override;
   const std::string GetDenyString() override;
   const std::string GetDenyNodeString() override;
-  uint32_t ChildCount(const BrowserAccessibility& node) const override;
+
+  void RecursiveBuildAccessibilityTree(const BrowserAccessibility& node,
+                                       base::DictionaryValue* dict) const;
+
+  uint32_t ChildCount(const BrowserAccessibility& node) const;
   BrowserAccessibility* GetChild(const BrowserAccessibility& node,
-                                 uint32_t i) const override;
+                                 uint32_t i) const;
+
   void AddProperties(const BrowserAccessibility& node,
-                     base::DictionaryValue* dict) override;
+                     base::DictionaryValue* dict) const;
+
   base::string16 ProcessTreeForOutput(
       const base::DictionaryValue& node,
       base::DictionaryValue* filtered_dict_result = nullptr) override;
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.cc
deleted file mode 100644
index 1eeeeb157dc..00000000000
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.cc
+++ /dev/null
@@ -1,67 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
-
-namespace content {
-
-std::unique_ptr<base::DictionaryValue>
-AccessibilityTreeFormatterBrowser::BuildAccessibilityTree(
-    BrowserAccessibility* root) {
-  CHECK(root);
-  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
-  RecursiveBuildAccessibilityTree(*root, dict.get());
-  return dict;
-}
-
-std::unique_ptr<base::DictionaryValue>
-AccessibilityTreeFormatterBrowser::BuildAccessibilityTreeForProcess(
-    base::ProcessId pid) {
-  NOTREACHED();
-  return nullptr;
-}
-
-std::unique_ptr<base::DictionaryValue>
-AccessibilityTreeFormatterBrowser::BuildAccessibilityTreeForWindow(
-    gfx::AcceleratedWidget widget) {
-  NOTREACHED();
-  return nullptr;
-}
-
-std::unique_ptr<base::DictionaryValue>
-AccessibilityTreeFormatterBrowser::BuildAccessibilityTreeForPattern(
-    const base::StringPiece& pattern) {
-  NOTREACHED();
-  return nullptr;
-}
-
-void AccessibilityTreeFormatterBrowser::RecursiveBuildAccessibilityTree(
-    const BrowserAccessibility& node,
-    base::DictionaryValue* dict) {
-  AddProperties(node, dict);
-
-  auto children = std::make_unique<base::ListValue>();
-
-  for (size_t i = 0; i < ChildCount(node); ++i) {
-    BrowserAccessibility* child_node = GetChild(node, i);
-    std::unique_ptr<base::DictionaryValue> child_dict(
-        new base::DictionaryValue);
-    RecursiveBuildAccessibilityTree(*child_node, child_dict.get());
-    children->Append(std::move(child_dict));
-  }
-  dict->Set(kChildrenDictAttr, std::move(children));
-}
-
-uint32_t AccessibilityTreeFormatterBrowser::ChildCount(
-    const BrowserAccessibility& node) const {
-  return node.PlatformChildCount();
-}
-
-BrowserAccessibility* AccessibilityTreeFormatterBrowser::GetChild(
-    const BrowserAccessibility& node,
-    uint32_t i) const {
-  return node.PlatformGetChild(i);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.h b/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.h
deleted file mode 100644
index 62535d38694..00000000000
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_browser.h
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_ACCESSIBILITY_ACCESSIBILITY_TREE_FORMATTER_BROWSER_H_
-#define CONTENT_BROWSER_ACCESSIBILITY_ACCESSIBILITY_TREE_FORMATTER_BROWSER_H_
-
-#include "content/browser/accessibility/accessibility_tree_formatter_base.h"
-
-#include "base/macros.h"
-#include "base/strings/string16.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/values.h"
-#include "content/browser/accessibility/browser_accessibility.h"
-#include "content/common/content_export.h"
-
-namespace content {
-
-// Inheritable class for tree formatters that rely on browser infrastructure for
-// walking the tree and getting properties. Tree formatters that walk native
-// objects should not inherit from this class.
-class CONTENT_EXPORT AccessibilityTreeFormatterBrowser
-    : public AccessibilityTreeFormatterBase {
- public:
-  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTree(
-      BrowserAccessibility* root) override;
-
-  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForProcess(
-      base::ProcessId pid) override;
-
-  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForWindow(
-      gfx::AcceleratedWidget widget) override;
-
-  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForPattern(
-      const base::StringPiece& pattern) override;
-
- protected:
-  void RecursiveBuildAccessibilityTree(const BrowserAccessibility& node,
-                                       base::DictionaryValue* dict);
-  virtual uint32_t ChildCount(const BrowserAccessibility& node) const;
-
-  virtual BrowserAccessibility* GetChild(const BrowserAccessibility& node,
-                                         uint32_t i) const;
-
-  // Add the attributes for each node into the given dict.
-  virtual void AddProperties(const BrowserAccessibility& node,
-                             base::DictionaryValue* dict) = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_ACCESSIBILITY_ACCESSIBILITY_TREE_FORMATTER_BROWSER_H_
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_mac.mm b/chromium/content/browser/accessibility/accessibility_tree_formatter_mac.mm
index 5a0c55df549..7388129d79b 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_mac.mm
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_mac.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
+#include "content/browser/accessibility/accessibility_tree_formatter_base.h"
 
 #import <Cocoa/Cocoa.h>
 
@@ -43,7 +43,6 @@ const char kRangeLenDictAttr[] = "len";
 
 std::unique_ptr<base::DictionaryValue> PopulatePosition(
     const BrowserAccessibility& node) {
-  DCHECK(node.instance_active());
   BrowserAccessibilityManager* root_manager = node.manager()->GetRootManager();
   DCHECK(root_manager);
 
@@ -153,74 +152,9 @@ std::unique_ptr<base::Value> PopulateObject(id value) {
       SysNSStringToUTF16([NSString stringWithFormat:@"%@", value])));
 }
 
-NSArray* AllAttributesArray() {
-  static NSArray* all_attributes = [@[
-    NSAccessibilityRoleDescriptionAttribute,
-    NSAccessibilityTitleAttribute,
-    NSAccessibilityValueAttribute,
-    NSAccessibilityMinValueAttribute,
-    NSAccessibilityMaxValueAttribute,
-    NSAccessibilityValueDescriptionAttribute,
-    NSAccessibilityDescriptionAttribute,
-    NSAccessibilityHelpAttribute,
-    @"AXInvalid",
-    NSAccessibilityDisclosingAttribute,
-    NSAccessibilityDisclosureLevelAttribute,
-    @"AXAccessKey",
-    @"AXARIAAtomic",
-    @"AXARIABusy",
-    @"AXARIAColumnCount",
-    @"AXARIAColumnIndex",
-    @"AXARIALive",
-    @"AXARIARelevant",
-    @"AXARIARowCount",
-    @"AXARIARowIndex",
-    @"AXARIASetSize",
-    @"AXARIAPosInSet",
-    @"AXAutocomplete",
-    @"AXAutocompleteValue",
-    @"AXBlockQuoteLevel",
-    NSAccessibilityColumnHeaderUIElementsAttribute,
-    NSAccessibilityColumnIndexRangeAttribute,
-    @"AXDOMIdentifier",
-    @"AXDropEffects",
-    @"AXEditableAncestor",
-    NSAccessibilityEnabledAttribute,
-    NSAccessibilityExpandedAttribute,
-    @"AXFocusableAncestor",
-    NSAccessibilityFocusedAttribute,
-    @"AXGrabbed",
-    NSAccessibilityHeaderAttribute,
-    @"AXHasPopup",
-    @"AXHasPopupValue",
-    @"AXHighestEditableAncestor",
-    NSAccessibilityIndexAttribute,
-    @"AXLanguage",
-    @"AXLoaded",
-    @"AXLoadingProcess",
-    NSAccessibilityNumberOfCharactersAttribute,
-    NSAccessibilitySortDirectionAttribute,
-    NSAccessibilityOrientationAttribute,
-    NSAccessibilityPlaceholderValueAttribute,
-    @"AXRequired",
-    NSAccessibilityRowHeaderUIElementsAttribute,
-    NSAccessibilityRowIndexRangeAttribute,
-    NSAccessibilitySelectedAttribute,
-    NSAccessibilitySelectedChildrenAttribute,
-    NSAccessibilityTitleUIElementAttribute,
-    NSAccessibilityURLAttribute,
-    NSAccessibilityVisibleCharacterRangeAttribute,
-    NSAccessibilityVisibleChildrenAttribute,
-    @"AXVisited",
-    @"AXLinkedUIElements"
-  ] retain];
-
-  return all_attributes;
-}
-
 }  // namespace
 
-class AccessibilityTreeFormatterMac : public AccessibilityTreeFormatterBrowser {
+class AccessibilityTreeFormatterMac : public AccessibilityTreeFormatterBase {
  public:
   explicit AccessibilityTreeFormatterMac();
   ~AccessibilityTreeFormatterMac() override;
@@ -228,14 +162,27 @@ class AccessibilityTreeFormatterMac : public AccessibilityTreeFormatterBrowser {
   void AddDefaultFilters(
       std::vector<PropertyFilter>* property_filters) override;
 
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTree(
+      BrowserAccessibility* root) override;
+
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForProcess(
+      base::ProcessId pid) override;
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForWindow(
+      gfx::AcceleratedWidget widget) override;
+  std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeForPattern(
+      const base::StringPiece& pattern) override;
+
  private:
+  void RecursiveBuildAccessibilityTree(const BrowserAccessibilityCocoa* node,
+                                       base::DictionaryValue* dict);
+
   base::FilePath::StringType GetExpectedFileSuffix() override;
   const std::string GetAllowEmptyString() override;
   const std::string GetAllowString() override;
   const std::string GetDenyString() override;
   const std::string GetDenyNodeString() override;
-  void AddProperties(const BrowserAccessibility& node,
-                     base::DictionaryValue* dict) override;
+  void AddProperties(const BrowserAccessibilityCocoa* node,
+                     base::DictionaryValue* dict);
   base::string16 ProcessTreeForOutput(
       const base::DictionaryValue& node,
       base::DictionaryValue* filtered_dict_result = nullptr) override;
@@ -262,37 +209,83 @@ AccessibilityTreeFormatterMac::~AccessibilityTreeFormatterMac() {}
 
 void AccessibilityTreeFormatterMac::AddDefaultFilters(
     std::vector<PropertyFilter>* property_filters) {
-  AddPropertyFilter(property_filters, "AXValueAutofill*");
-  AddPropertyFilter(property_filters, "AXAutocomplete*");
+  static NSArray* default_attributes = [@[
+    @"AXAutocompleteValue=*", @"AXDescription=*", @"AXRole=*", @"AXTitle=*",
+    @"AXTitleUIElement=*", @"AXHelp=*", @"AXValue=*"
+  ] retain];
+
+  for (NSString* attribute : default_attributes) {
+    AddPropertyFilter(property_filters, SysNSStringToUTF8(attribute));
+  }
+
+  if (show_ids()) {
+    AddPropertyFilter(property_filters, "id");
+  }
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterMac::BuildAccessibilityTree(
+    BrowserAccessibility* root) {
+  DCHECK(root);
+
+  std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
+  BrowserAccessibilityCocoa* cocoa_root = ToBrowserAccessibilityCocoa(root);
+  RecursiveBuildAccessibilityTree(cocoa_root, dict.get());
+  return dict;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterMac::BuildAccessibilityTreeForProcess(
+    base::ProcessId pid) {
+  NOTREACHED();
+  return nullptr;
+}
+
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterMac::BuildAccessibilityTreeForWindow(
+    gfx::AcceleratedWidget widget) {
+  NOTREACHED();
+  return nullptr;
 }
-void AccessibilityTreeFormatterMac::AddProperties(
-    const BrowserAccessibility& node,
-    base::DictionaryValue* dict) {
-  dict->SetInteger("id", node.GetId());
-  BrowserAccessibilityCocoa* cocoa_node =
-      ToBrowserAccessibilityCocoa(const_cast<BrowserAccessibility*>(&node));
-  NSArray* supportedAttributes = [cocoa_node accessibilityAttributeNames];
 
-  string role = SysNSStringToUTF8(
-      [cocoa_node accessibilityAttributeValue:NSAccessibilityRoleAttribute]);
-  dict->SetString(SysNSStringToUTF8(NSAccessibilityRoleAttribute), role);
+std::unique_ptr<base::DictionaryValue>
+AccessibilityTreeFormatterMac::BuildAccessibilityTreeForPattern(
+    const base::StringPiece& pattern) {
+  NOTREACHED();
+  return nullptr;
+}
 
-  NSString* subrole =
-      [cocoa_node accessibilityAttributeValue:NSAccessibilitySubroleAttribute];
-  if (subrole != nil) {
-    dict->SetString(SysNSStringToUTF8(NSAccessibilitySubroleAttribute),
-                    SysNSStringToUTF8(subrole));
+void AccessibilityTreeFormatterMac::RecursiveBuildAccessibilityTree(
+    const BrowserAccessibilityCocoa* cocoa_node,
+    base::DictionaryValue* dict) {
+  AddProperties(cocoa_node, dict);
+
+  auto children = std::make_unique<base::ListValue>();
+  for (BrowserAccessibilityCocoa* cocoa_child in [cocoa_node children]) {
+    std::unique_ptr<base::DictionaryValue> child_dict(
+        new base::DictionaryValue);
+    RecursiveBuildAccessibilityTree(cocoa_child, child_dict.get());
+    children->Append(std::move(child_dict));
   }
+  dict->Set(kChildrenDictAttr, std::move(children));
+}
 
-  for (NSString* requestedAttribute in AllAttributesArray()) {
-    if (![supportedAttributes containsObject:requestedAttribute])
-      continue;
-    id value = [cocoa_node accessibilityAttributeValue:requestedAttribute];
-    if (value != nil) {
-      dict->Set(SysNSStringToUTF8(requestedAttribute), PopulateObject(value));
+void AccessibilityTreeFormatterMac::AddProperties(
+    const BrowserAccessibilityCocoa* cocoa_node,
+    base::DictionaryValue* dict) {
+  BrowserAccessibility* node = [cocoa_node owner];
+  dict->SetString("id", base::NumberToString16(node->GetId()));
+
+  for (NSString* supportedAttribute in
+       [cocoa_node accessibilityAttributeNames]) {
+    if (FilterPropertyName(SysNSStringToUTF16(supportedAttribute))) {
+      id value = [cocoa_node accessibilityAttributeValue:supportedAttribute];
+      if (value != nil) {
+        dict->Set(SysNSStringToUTF8(supportedAttribute), PopulateObject(value));
+      }
     }
   }
-  dict->Set(kPositionDictAttr, PopulatePosition(node));
+  dict->Set(kPositionDictAttr, PopulatePosition(*node));
   dict->Set(kSizeDictAttr, PopulateSize(cocoa_node));
 }
 
@@ -304,60 +297,59 @@ base::string16 AccessibilityTreeFormatterMac::ProcessTreeForOutput(
     return error_value;
 
   base::string16 line;
-  if (show_ids()) {
-    int id_value;
-    dict.GetInteger("id", &id_value);
-    WriteAttribute(true, base::NumberToString16(id_value), &line);
-  }
 
-  NSArray* defaultAttributes =
-      [NSArray arrayWithObjects:NSAccessibilityTitleAttribute,
-                                NSAccessibilityTitleUIElementAttribute,
-                                NSAccessibilityDescriptionAttribute,
-                                NSAccessibilityHelpAttribute,
-                                NSAccessibilityValueAttribute, nil];
-  string s_value;
-  dict.GetString(SysNSStringToUTF8(NSAccessibilityRoleAttribute), &s_value);
-  WriteAttribute(true, s_value, &line);
-
-  string subroleAttribute = SysNSStringToUTF8(NSAccessibilitySubroleAttribute);
-  if (dict.GetString(subroleAttribute, &s_value)) {
-    WriteAttribute(
-        false, StringPrintf("%s=%s", subroleAttribute.c_str(), s_value.c_str()),
-        &line);
+  // AXRole and AXSubrole have own formatting and should be listed upfront.
+  std::string role_attr = SysNSStringToUTF8(NSAccessibilityRoleAttribute);
+  const std::string* value = dict.FindStringPath(role_attr);
+  if (value) {
+    WriteAttribute(true, *value, &line);
+  }
+  std::string subrole_attr = SysNSStringToUTF8(NSAccessibilitySubroleAttribute);
+  value = dict.FindStringPath(subrole_attr);
+  if (value) {
+    WriteAttribute(false,
+                   StringPrintf("%s=%s", subrole_attr.c_str(), value->c_str()),
+                   &line);
   }
 
-  for (NSString* requestedAttribute in AllAttributesArray()) {
-    string requestedAttributeUTF8 = SysNSStringToUTF8(requestedAttribute);
-    if (dict.GetString(requestedAttributeUTF8, &s_value)) {
-      WriteAttribute([defaultAttributes containsObject:requestedAttribute],
-                     StringPrintf("%s='%s'", requestedAttributeUTF8.c_str(),
-                                  s_value.c_str()),
-                     &line);
+  // Expose all other attributes.
+  for (auto item : dict.DictItems()) {
+    if (item.second.is_string()) {
+      if (item.first != role_attr && item.first != subrole_attr) {
+        WriteAttribute(false,
+                       StringPrintf("%s='%s'", item.first.c_str(),
+                                    item.second.GetString().c_str()),
+                       &line);
+      }
       continue;
     }
-    const base::Value* value;
-    if (dict.Get(requestedAttributeUTF8, &value)) {
-      std::string json_value;
-      base::JSONWriter::Write(*value, &json_value);
-      WriteAttribute([defaultAttributes containsObject:requestedAttribute],
-                     StringPrintf("%s=%s", requestedAttributeUTF8.c_str(),
-                                  json_value.c_str()),
-                     &line);
+
+    // Special processing for position and size.
+    if (item.second.is_dict()) {
+      if (item.first == kPositionDictAttr) {
+        WriteAttribute(false,
+                       FormatCoordinates(
+                           base::Value::AsDictionaryValue(item.second),
+                           kPositionDictAttr, kXCoordDictAttr, kYCoordDictAttr),
+                       &line);
+        continue;
+      }
+      if (item.first == kSizeDictAttr) {
+        WriteAttribute(
+            false,
+            FormatCoordinates(base::Value::AsDictionaryValue(item.second),
+                              kSizeDictAttr, kWidthDictAttr, kHeightDictAttr),
+            &line);
+        continue;
+      }
     }
-  }
-  const base::DictionaryValue* d_value = NULL;
-  if (dict.GetDictionary(kPositionDictAttr, &d_value)) {
-    WriteAttribute(false,
-                   FormatCoordinates(*d_value, kPositionDictAttr,
-                                     kXCoordDictAttr, kYCoordDictAttr),
-                   &line);
-  }
-  if (dict.GetDictionary(kSizeDictAttr, &d_value)) {
-    WriteAttribute(false,
-                   FormatCoordinates(*d_value, kSizeDictAttr, kWidthDictAttr,
-                                     kHeightDictAttr),
-                   &line);
+
+    // Write everything else as JSON.
+    std::string json_value;
+    base::JSONWriter::Write(item.second, &json_value);
+    WriteAttribute(
+        false, StringPrintf("%s=%s", item.first.c_str(), json_value.c_str()),
+        &line);
   }
 
   return line;
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_stub.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_stub.cc
index 4aaa1ce172a..1a3ddf8233c 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_stub.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_stub.cc
@@ -4,34 +4,14 @@
 
 #include "base/strings/string_number_conversions.h"
 #include "content/browser/accessibility/accessibility_tree_formatter_blink.h"
-#include "content/browser/accessibility/accessibility_tree_formatter_browser.h"
 
 namespace content {
 
-class AccessibilityTreeFormatterStub
-    : public AccessibilityTreeFormatterBrowser {
- public:
-  explicit AccessibilityTreeFormatterStub();
-  ~AccessibilityTreeFormatterStub() override;
-
- private:
-  base::FilePath::StringType GetExpectedFileSuffix() override;
-  const std::string GetAllowEmptyString() override;
-  const std::string GetAllowString() override;
-  const std::string GetDenyString() override;
-  const std::string GetDenyNodeString() override;
-  void AddProperties(const BrowserAccessibility& node,
-                     base::DictionaryValue* dict) override;
-  base::string16 ProcessTreeForOutput(
-      const base::DictionaryValue& node,
-      base::DictionaryValue* filtered_dict_result = nullptr) override;
-};
-
 #if !defined(PLATFORM_HAS_NATIVE_ACCESSIBILITY_IMPL)
 // static
 std::unique_ptr<AccessibilityTreeFormatter>
 AccessibilityTreeFormatter::Create() {
-  return std::make_unique<AccessibilityTreeFormatterStub>();
+  return AccessibilityTreeFormatterBlink::CreateBlink();
 }
 
 // static
@@ -39,49 +19,8 @@ std::vector<AccessibilityTreeFormatter::TestPass>
 AccessibilityTreeFormatter::GetTestPasses() {
   return {
       {"blink", &AccessibilityTreeFormatterBlink::CreateBlink},
-      {"native", &AccessibilityTreeFormatter::Create},
   };
 }
 #endif
 
-AccessibilityTreeFormatterStub::AccessibilityTreeFormatterStub()
-    : AccessibilityTreeFormatterBrowser() {}
-
-AccessibilityTreeFormatterStub::~AccessibilityTreeFormatterStub() {}
-
-void AccessibilityTreeFormatterStub::AddProperties(
-    const BrowserAccessibility& node,
-    base::DictionaryValue* dict) {
-  dict->SetInteger("id", node.GetId());
-}
-
-base::string16 AccessibilityTreeFormatterStub::ProcessTreeForOutput(
-    const base::DictionaryValue& node,
-    base::DictionaryValue* filtered_dict_result) {
-  int id_value;
-  node.GetInteger("id", &id_value);
-  return base::NumberToString16(id_value);
-}
-
-base::FilePath::StringType
-AccessibilityTreeFormatterStub::GetExpectedFileSuffix() {
-  return base::FilePath::StringType();
-}
-
-const std::string AccessibilityTreeFormatterStub::GetAllowEmptyString() {
-  return std::string();
-}
-
-const std::string AccessibilityTreeFormatterStub::GetAllowString() {
-  return std::string();
-}
-
-const std::string AccessibilityTreeFormatterStub::GetDenyString() {
-  return std::string();
-}
-
-const std::string AccessibilityTreeFormatterStub::GetDenyNodeString() {
-  return std::string();
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_uia_win.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_uia_win.cc
index 0fe7e1209d2..b7181143268 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_uia_win.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_uia_win.cc
@@ -395,14 +395,35 @@ AccessibilityTreeFormatterUia::BuildAccessibilityTree(
                                 &condition);
   CHECK(condition);
   Microsoft::WRL::ComPtr<IUIAutomationElement> start_element;
-  root->FindFirst(TreeScope_Subtree, condition.Get(), &start_element);
-  CHECK(start_element.Get());
 
-  // Build an accessibility tree starting from that element.
+  root->FindFirst(TreeScope_Subtree, condition.Get(), &start_element);
   std::unique_ptr<base::DictionaryValue> tree =
       std::make_unique<base::DictionaryValue>();
-  RecursiveBuildAccessibilityTree(start_element.Get(), root_bounds.left,
-                                  root_bounds.top, tree.get());
+
+  if (start_element.Get()) {
+    // Build an accessibility tree starting from that element.
+    RecursiveBuildAccessibilityTree(start_element.Get(), root_bounds.left,
+                                    root_bounds.top, tree.get());
+  } else {
+    // If the search failed, start dumping with the first thing that isn't a
+    // Pane.
+    // TODO(http://crbug.com/1071188): Figure out why the original FindFirst
+    // fails and remove this fallback codepath.
+    Microsoft::WRL::ComPtr<IUIAutomationElement> non_pane_descendant;
+    Microsoft::WRL::ComPtr<IUIAutomationCondition> is_pane_condition;
+    base::win::ScopedVariant pane_control_type_variant(UIA_PaneControlTypeId);
+    uia_->CreatePropertyCondition(UIA_ControlTypePropertyId,
+                                  pane_control_type_variant,
+                                  &is_pane_condition);
+    Microsoft::WRL::ComPtr<IUIAutomationCondition> not_is_pane_condition;
+    uia_->CreateNotCondition(is_pane_condition.Get(), &not_is_pane_condition);
+    root->FindFirst(TreeScope_Subtree, not_is_pane_condition.Get(),
+                    &non_pane_descendant);
+
+    DCHECK(non_pane_descendant.Get());
+    RecursiveBuildAccessibilityTree(non_pane_descendant.Get(), root_bounds.left,
+                                    root_bounds.top, tree.get());
+  }
   return tree;
 }
 
@@ -929,7 +950,7 @@ void AccessibilityTreeFormatterUia::WriteElementArray(
     base::DictionaryValue* dict) {
   int count;
   array->get_Length(&count);
-  base::string16 element_list = L"";
+  base::string16 element_list;
   for (int i = 0; i < count; i++) {
     Microsoft::WRL::ComPtr<IUIAutomationElement> element;
     if (SUCCEEDED(array->GetElement(i, &element))) {
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_win.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_win.cc
index 3ffab5ef7db..6b8e3a375b1 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_win.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_win.cc
@@ -277,7 +277,6 @@ std::unique_ptr<base::DictionaryValue>
 AccessibilityTreeFormatterWin::BuildAccessibilityTree(
     BrowserAccessibility* start_node) {
   DCHECK(start_node);
-  DCHECK(start_node->instance_active());
   BrowserAccessibilityManager* root_manager =
       start_node->manager()->GetRootManager();
   DCHECK(root_manager);
diff --git a/chromium/content/browser/accessibility/accessibility_win_browsertest.cc b/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
index dfc9944ecac..bda863e74b4 100644
--- a/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
@@ -40,6 +40,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
diff --git a/chromium/content/browser/accessibility/android_granularity_movement_browsertest.cc b/chromium/content/browser/accessibility/android_granularity_movement_browsertest.cc
index ab80d822f9b..196d21f1e80 100644
--- a/chromium/content/browser/accessibility/android_granularity_movement_browsertest.cc
+++ b/chromium/content/browser/accessibility/android_granularity_movement_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/accessibility/aom_browsertest.cc b/chromium/content/browser/accessibility/aom_browsertest.cc
index 2e423241b86..2fefe9ce4eb 100644
--- a/chromium/content/browser/accessibility/aom_browsertest.cc
+++ b/chromium/content/browser/accessibility/aom_browsertest.cc
@@ -2,12 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc b/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
index b741fa3e4cc..1823e3d65ec 100644
--- a/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "content/public/test/browser_test.h"
 #include "ui/accessibility/platform/ax_platform_node_textprovider_win.h"
 #include "ui/accessibility/platform/ax_platform_node_textrangeprovider_win.h"
 
diff --git a/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc b/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
index b2a93d3b1e0..b1772aa9847 100644
--- a/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/hit_test_region_observer.h"
 #include "content/shell/browser/shell.h"
@@ -2098,6 +2099,72 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
+                       ExpandToEnclosingWordWhenBeforeFirstWordBoundary) {
+  LoadInitialAccessibilityTreeFromHtml(
+      R"HTML(<!DOCTYPE html>
+      <html>
+      <body>
+        <p aria-label="space">&nbsp;</p>
+        <p>3.14</p>
+      </body>
+      </html>)HTML");
+
+  // Case 1: test on degenerate range before whitespace.
+  auto* node = FindNode(ax::mojom::Role::kParagraph, "space")
+                   ->PlatformDeepestFirstChild();
+  ASSERT_NE(nullptr, node);
+  EXPECT_TRUE(node->PlatformIsLeaf());
+  EXPECT_EQ(0u, node->PlatformChildCount());
+
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"\xA0");
+
+  // Make the range degenerate.
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
+      text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Character,
+      /*count*/ -1,
+      /*expected_text*/ L"",
+      /*expected_count*/ -1);
+  ASSERT_HRESULT_SUCCEEDED(
+      text_range_provider->ExpandToEnclosingUnit(TextUnit_Word));
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"\xA0\n");
+
+  // Case 2: test on range that includes the whitespace and the following word.
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"\xA0");
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
+                                   TextPatternRangeEndpoint_End, TextUnit_Word,
+                                   /*count*/ 1,
+                                   /*expected_text*/ L"\xA0\n3.14",
+                                   /*expected_count*/ 1);
+  ASSERT_HRESULT_SUCCEEDED(
+      text_range_provider->ExpandToEnclosingUnit(TextUnit_Word));
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"\xA0\n");
+
+  // Case 3: test on degenerate range after whitespace.
+  node = FindNode(ax::mojom::Role::kStaticText, "3.14");
+  ASSERT_NE(nullptr, node);
+  EXPECT_TRUE(node->PlatformIsLeaf());
+  EXPECT_EQ(0u, node->PlatformChildCount());
+
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"3.14");
+  // Make the range degenerate.
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
+                                   TextPatternRangeEndpoint_End, TextUnit_Word,
+                                   /*count*/ -1,
+                                   /*expected_text*/ L"",
+                                   /*expected_count*/ -1);
+  ASSERT_HRESULT_SUCCEEDED(
+      text_range_provider->ExpandToEnclosingUnit(TextUnit_Word));
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"3.14");
+}
+
+IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
                        EntireMarkupSuccessiveMoveByCharacter) {
   AssertMoveByUnitForMarkup(
       TextUnit_Character, "Test ing.",
@@ -2148,9 +2215,11 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
       TextUnit_Word, "<ol><li>item one</li><li>item two</li></ol>",
       {L"1. ", L"item ", L"one", L"2. ", L"item ", L"two"});
 
-  AssertMoveByUnitForMarkup(TextUnit_Word,
-                            "<ul><li>item one</li><li>item two</li></ul>",
-                            {L"• ", L"item ", L"one", L"• ", L"item ", L"two"});
+  // The following test should be enabled when crbug.com/1028830 is fixed.
+  // AssertMoveByUnitForMarkup(TextUnit_Word,
+  //                           "<ul><li>item one</li><li>item two</li></ul>",
+  //                           {L"• ", L"item ", L"one", L"• ", L"item ",
+  //                           L"two"});
 }
 
 IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
diff --git a/chromium/content/browser/accessibility/ax_platform_node_win_browsertest.cc b/chromium/content/browser/accessibility/ax_platform_node_win_browsertest.cc
index ae058590d24..e8774c8dc33 100644
--- a/chromium/content/browser/accessibility/ax_platform_node_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/ax_platform_node_win_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/browser_accessibility.cc b/chromium/content/browser/accessibility/browser_accessibility.cc
index 416d136e0aa..64000eb7dff 100644
--- a/chromium/content/browser/accessibility/browser_accessibility.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility.cc
@@ -16,6 +16,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
+#include "content/common/ax_serialization_utils.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "third_party/blink/public/strings/grit/blink_strings.h"
@@ -157,8 +158,6 @@ bool BrowserAccessibility::PlatformIsLeafIncludingIgnored() const {
 }
 
 bool BrowserAccessibility::CanFireEvents() const {
-  if (!instance_active())
-    return false;
   // Allow events unless this object would be trimmed away.
   return !PlatformIsChildOfLeafIncludingIgnored();
 }
@@ -180,9 +179,6 @@ uint32_t BrowserAccessibility::PlatformChildCount() const {
 }
 
 BrowserAccessibility* BrowserAccessibility::PlatformGetParent() const {
-  if (!instance_active())
-    return nullptr;
-
   ui::AXNode* parent = node_->GetUnignoredParent();
   if (parent)
     return manager_->GetFromAXNode(parent);
@@ -229,10 +225,6 @@ BrowserAccessibility* BrowserAccessibility::PlatformGetSelectionContainer()
   return container;
 }
 
-bool BrowserAccessibility::IsNative() const {
-  return false;
-}
-
 bool BrowserAccessibility::IsDescendantOf(
     const BrowserAccessibility* ancestor) const {
   if (!ancestor)
@@ -269,8 +261,9 @@ BrowserAccessibility* BrowserAccessibility::PlatformGetChild(
   BrowserAccessibility* result = nullptr;
 
   if (HasStringAttribute(ax::mojom::StringAttribute::kChildTreeId)) {
-    // A node should not have both children and a child tree.
-    DCHECK_EQ(node_->children().size(), 0u);
+    DCHECK_EQ(node_->children().size(), 0u)
+        << "A node should not have both children and a child tree.";
+
     // child_trees do not have siblings.
     if (child_index == 0)
       result = PlatformGetRootOfChildTree();
@@ -397,15 +390,11 @@ BrowserAccessibility* BrowserAccessibility::InternalDeepestLastChild() const {
 }
 
 uint32_t BrowserAccessibility::InternalChildCount() const {
-  if (!instance_active())
-    return 0;
   return node_->GetUnignoredChildCount();
 }
 
 BrowserAccessibility* BrowserAccessibility::InternalGetChild(
     uint32_t child_index) const {
-  if (!node_ || !manager_)
-    return nullptr;
   ui::AXNode* child_node = node_->GetUnignoredChildAtIndex(child_index);
   if (!child_node)
     return nullptr;
@@ -414,8 +403,6 @@ BrowserAccessibility* BrowserAccessibility::InternalGetChild(
 }
 
 BrowserAccessibility* BrowserAccessibility::InternalGetParent() const {
-  if (!node_ || !manager_)
-    return nullptr;
   ui::AXNode* child_node = node_->GetUnignoredParent();
   if (!child_node)
     return nullptr;
@@ -947,17 +934,6 @@ BrowserAccessibility* BrowserAccessibility::ApproximateHitTest(
   return this;
 }
 
-void BrowserAccessibility::Destroy() {
-  node_ = nullptr;
-  manager_ = nullptr;
-
-  NativeReleaseReference();
-}
-
-void BrowserAccessibility::NativeReleaseReference() {
-  delete this;
-}
-
 bool BrowserAccessibility::HasBoolAttribute(
     ax::mojom::BoolAttribute attribute) const {
   return GetData().HasBoolAttribute(attribute);
@@ -991,9 +967,6 @@ bool BrowserAccessibility::GetFloatAttribute(
 
 bool BrowserAccessibility::HasInheritedStringAttribute(
     ax::mojom::StringAttribute attribute) const {
-  if (!instance_active())
-    return false;
-
   if (GetData().HasStringAttribute(attribute))
     return true;
   return PlatformGetParent() &&
@@ -1169,8 +1142,6 @@ std::string BrowserAccessibility::GetLiveRegionText() const {
 }
 
 std::vector<int> BrowserAccessibility::GetLineStartOffsets() const {
-  if (!instance_active())
-    return std::vector<int>();
   return node()->GetOrComputeLineStartOffsets();
 }
 
@@ -1285,6 +1256,17 @@ gfx::Rect BrowserAccessibility::RelativeToAbsoluteBounds(
 
   if (coordinate_system == ui::AXCoordinateSystem::kScreenDIPs ||
       coordinate_system == ui::AXCoordinateSystem::kScreenPhysicalPixels) {
+    // Most platforms include page scale factor in the transform on the root
+    // node of the AXTree. That transform gets applied by the call to
+    // RelativeToTreeBounds() in the loop above. However, if the root transform
+    // did not include page scale factor, we need to apply it now.
+    // TODO(crbug.com/1074116): this should probably apply visual viewport
+    // offset as well.
+    if (!content::AXShouldIncludePageScaleFactorInRoot()) {
+      BrowserAccessibilityManager* root_manager = manager()->GetRootManager();
+      if (root_manager)
+        bounds.Scale(root_manager->GetPageScaleFactor());
+    }
     bounds.Offset(
         manager()->GetViewBoundsInScreenCoordinates().OffsetFromOrigin());
     if (coordinate_system == ui::AXCoordinateSystem::kScreenPhysicalPixels &&
@@ -1362,9 +1344,6 @@ ui::AXPlatformNode* BrowserAccessibility::GetTargetNodeForRelation(
     ax::mojom::IntAttribute attr) {
   DCHECK(ui::IsNodeIdIntAttribute(attr));
 
-  if (!node_)
-    return nullptr;
-
   int target_id;
   if (!GetData().GetIntAttribute(attr, &target_id))
     return nullptr;
@@ -1529,9 +1508,6 @@ gfx::NativeViewAccessible BrowserAccessibility::GetNSWindow() {
 }
 
 gfx::NativeViewAccessible BrowserAccessibility::GetParent() {
-  if (!instance_active())
-    return nullptr;
-
   BrowserAccessibility* parent = PlatformGetParent();
   if (parent)
     return parent->GetNativeViewAccessible();
@@ -1613,7 +1589,7 @@ BrowserAccessibility::PlatformChildIterator::PlatformChildIterator(
     const BrowserAccessibility* parent,
     BrowserAccessibility* child)
     : parent_(parent), platform_iterator(parent, child) {
-  DCHECK(parent && parent->instance_active());
+  DCHECK(parent);
 }
 
 BrowserAccessibility::PlatformChildIterator::~PlatformChildIterator() = default;
@@ -1629,27 +1605,22 @@ bool BrowserAccessibility::PlatformChildIterator::operator!=(
 }
 
 void BrowserAccessibility::PlatformChildIterator::operator++() {
-  DCHECK(parent_->instance_active());
   ++platform_iterator;
 }
 
 void BrowserAccessibility::PlatformChildIterator::operator++(int) {
-  DCHECK(parent_->instance_active());
   ++platform_iterator;
 }
 
 void BrowserAccessibility::PlatformChildIterator::operator--() {
-  DCHECK(parent_->instance_active());
   --platform_iterator;
 }
 
 void BrowserAccessibility::PlatformChildIterator::operator--(int) {
-  DCHECK(parent_->instance_active());
   --platform_iterator;
 }
 
 BrowserAccessibility* BrowserAccessibility::PlatformChildIterator::get() const {
-  DCHECK(parent_->instance_active());
   return platform_iterator.get();
 }
 
@@ -1659,7 +1630,6 @@ BrowserAccessibility::PlatformChildIterator::GetNativeViewAccessible() const {
 }
 
 int BrowserAccessibility::PlatformChildIterator::GetIndexInParent() const {
-  DCHECK(parent_->instance_active());
   if (platform_iterator == parent_->PlatformChildrenEnd().platform_iterator)
     return parent_->PlatformChildCount();
 
@@ -1689,8 +1659,6 @@ BrowserAccessibility::ChildrenEnd() {
 gfx::NativeViewAccessible BrowserAccessibility::HitTestSync(
     int physical_pixel_x,
     int physical_pixel_y) const {
-  if (!instance_active())
-    return nullptr;
   BrowserAccessibility* accessible = manager_->CachingAsyncHitTest(
       gfx::Point(physical_pixel_x, physical_pixel_y));
   if (!accessible)
@@ -2128,6 +2096,19 @@ bool BrowserAccessibility::IsInListMarker() const {
   return node()->IsInListMarker();
 }
 
+bool BrowserAccessibility::IsCollapsedMenuListPopUpButton() const {
+  return node()->IsCollapsedMenuListPopUpButton();
+}
+
+BrowserAccessibility*
+BrowserAccessibility::GetCollapsedMenuListPopUpButtonAncestor() const {
+  ui::AXNode* popup_button = node()->GetCollapsedMenuListPopUpButtonAncestor();
+  if (!popup_button)
+    return nullptr;
+
+  return manager()->GetFromAXNode(popup_button);
+}
+
 std::string BrowserAccessibility::ToString() const {
   return GetData().ToString();
 }
diff --git a/chromium/content/browser/accessibility/browser_accessibility.h b/chromium/content/browser/accessibility/browser_accessibility.h
index 4de8492fa21..c8184f66de2 100644
--- a/chromium/content/browser/accessibility/browser_accessibility.h
+++ b/chromium/content/browser/accessibility/browser_accessibility.h
@@ -84,6 +84,7 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   static BrowserAccessibility* FromAXPlatformNodeDelegate(
       ui::AXPlatformNodeDelegate* delegate);
 
+  BrowserAccessibility();
   ~BrowserAccessibility() override;
 
   // Called only once, immediately after construction. The constructor doesn't
@@ -175,6 +176,7 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
         BrowserAccessibility,
         &BrowserAccessibility::PlatformGetNextSibling,
         &BrowserAccessibility::PlatformGetPreviousSibling,
+        &BrowserAccessibility::PlatformGetFirstChild,
         &BrowserAccessibility::PlatformGetLastChild>
         platform_iterator;
   };
@@ -287,29 +289,11 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   BrowserAccessibility* ApproximateHitTest(
       const gfx::Point& blink_screen_point);
 
-  // Marks this object for deletion, releases our reference to it, and
-  // nulls out the pointer to the underlying AXNode.  May not delete
-  // the object immediately due to reference counting.
-  //
-  // Reference counting is used on some platforms because the
-  // operating system may hold onto a reference to a BrowserAccessibility
-  // object even after we're through with it. When a BrowserAccessibility
-  // has had Destroy() called but its reference count is not yet zero,
-  // instance_active() returns false and queries on this object return failure.
-  virtual void Destroy();
-
-  // Subclasses should override this to support platform reference counting.
-  virtual void NativeAddReference() {}
-
-  // Subclasses should override this to support platform reference counting.
-  virtual void NativeReleaseReference();
-
   //
   // Accessors
   //
 
   BrowserAccessibilityManager* manager() const { return manager_; }
-  bool instance_active() const { return node_ && manager_; }
   ui::AXNode* node() const { return node_; }
 
   // These access the internal unignored accessibility tree, which doesn't
@@ -327,6 +311,7 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
       BrowserAccessibility,
       &BrowserAccessibility::InternalGetNextSibling,
       &BrowserAccessibility::InternalGetPreviousSibling,
+      &BrowserAccessibility::InternalGetFirstChild,
       &BrowserAccessibility::InternalGetLastChild>;
   InternalChildIterator InternalChildrenBegin() const;
   InternalChildIterator InternalChildrenEnd() const;
@@ -339,11 +324,6 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   typedef base::StringPairs HtmlAttributes;
   const HtmlAttributes& GetHtmlAttributes() const;
 
-  // Returns true if this is a native platform-specific object, vs a
-  // cross-platform generic object. Don't call ToBrowserAccessibilityXXX if
-  // IsNative returns false.
-  virtual bool IsNative() const;
-
   // Accessing accessibility attributes:
   //
   // There are dozens of possible attributes for an accessibility node,
@@ -595,6 +575,8 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   base::Optional<int> GetPosInSet() const override;
   base::Optional<int> GetSetSize() const override;
   bool IsInListMarker() const;
+  bool IsCollapsedMenuListPopUpButton() const;
+  BrowserAccessibility* GetCollapsedMenuListPopUpButtonAncestor() const;
 
   // Returns true if:
   // 1. This node is a list, AND
@@ -616,8 +598,6 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
 
   virtual ui::TextAttributeList ComputeTextAttributes() const;
 
-  BrowserAccessibility();
-
   // The manager of this tree of accessibility objects.
   BrowserAccessibilityManager* manager_ = nullptr;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_android.cc b/chromium/content/browser/accessibility/browser_accessibility_android.cc
index c12d9effdf5..87f3bd2ddcb 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_android.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_android.cc
@@ -87,10 +87,6 @@ BrowserAccessibilityAndroid::~BrowserAccessibilityAndroid() {
     g_unique_id_map.Get().erase(unique_id());
 }
 
-bool BrowserAccessibilityAndroid::IsNative() const {
-  return true;
-}
-
 void BrowserAccessibilityAndroid::OnLocationChanged() {
   auto* manager =
       static_cast<BrowserAccessibilityManagerAndroid*>(this->manager());
@@ -891,6 +887,9 @@ base::string16 BrowserAccessibilityAndroid::GetRoleDescription() const {
     case ax::mojom::Role::kImage:
       message_id = IDS_AX_ROLE_GRAPHIC;
       break;
+    case ax::mojom::Role::kImeCandidate:
+      // No role description.
+      break;
     case ax::mojom::Role::kInlineTextBox:
       // No role description.
       break;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_android.h b/chromium/content/browser/accessibility/browser_accessibility_android.h
index bfccc065875..ed8924e9461 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_android.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_android.h
@@ -26,7 +26,6 @@ class CONTENT_EXPORT BrowserAccessibilityAndroid : public BrowserAccessibility {
 
   // Overrides from BrowserAccessibility.
   void OnDataChanged() override;
-  bool IsNative() const override;
   void OnLocationChanged() override;
   base::string16 GetValue() const override;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc b/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
index d666a2018df..a7463066f06 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
@@ -11,7 +11,6 @@ namespace content {
 
 BrowserAccessibilityAuraLinux* ToBrowserAccessibilityAuraLinux(
     BrowserAccessibility* obj) {
-  DCHECK(!obj || obj->IsNative());
   return static_cast<BrowserAccessibilityAuraLinux*>(obj);
 }
 
@@ -51,16 +50,9 @@ void BrowserAccessibilityAuraLinux::OnDataChanged() {
 }
 
 ui::AXPlatformNode* BrowserAccessibilityAuraLinux::GetAXPlatformNode() const {
-  if (!instance_active())
-    return nullptr;
-
   return GetNode();
 }
 
-bool BrowserAccessibilityAuraLinux::IsNative() const {
-  return true;
-}
-
 base::string16 BrowserAccessibilityAuraLinux::GetText() const {
   return GetHypertext();
 }
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux.h b/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
index 8f23f512581..6667aafd5ac 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
@@ -31,7 +31,6 @@ class BrowserAccessibilityAuraLinux : public BrowserAccessibility {
   // BrowserAccessibility methods.
   void OnDataChanged() override;
   ui::AXPlatformNode* GetAXPlatformNode() const override;
-  bool IsNative() const override;
   base::string16 GetText() const override;
   base::string16 GetHypertext() const override;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
index 6ba656b0d3e..5e588edf716 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
@@ -55,8 +55,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest, TestSimpleAtkText) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root_data),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ui::AXPlatformNodeAuraLinux* root_obj =
       ToBrowserAccessibilityAuraLinux(manager->GetRoot())->GetNode();
@@ -109,8 +108,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest, TestCompositeAtkText) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, text1, text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ui::AXPlatformNodeAuraLinux* root_obj =
       ToBrowserAccessibilityAuraLinux(manager->GetRoot())->GetNode();
@@ -213,8 +211,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest, TestComplexHypertext) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, text1, combo_box, text2, check_box,
                            radio_button, radio_button_text, link, link_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ui::AXPlatformNodeAuraLinux* root_obj =
       ToBrowserAccessibilityAuraLinux(manager->GetRoot())->GetNode();
@@ -398,8 +395,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest,
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          update, test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityAuraLinux* ax_root =
@@ -586,8 +582,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest,
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, container, combo_box, menu_list, menu_option_1,
                            menu_option_2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ui::AXPlatformNodeAuraLinux* combo_box_node =
       ToBrowserAccessibilityAuraLinux(manager->GetFromID(combo_box.id))
@@ -670,8 +665,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest,
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, combo_box, combo_box_div, static_text1,
                            static_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityAuraLinux* ax_root =
@@ -756,8 +750,7 @@ TEST_F(BrowserAccessibilityAuraLinuxTest, TextAtkStaticTextChange) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, div_editable, text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   text.SetName("Text2");
   ui::AXTree* tree = const_cast<ui::AXTree*>(manager->ax_tree());
diff --git a/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm b/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
index 7249acc6d7f..dc282c8b9a7 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
@@ -29,6 +29,7 @@
 #include "content/browser/accessibility/browser_accessibility_position.h"
 #include "content/browser/accessibility/one_shot_accessibility_tree_search.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_enum_util.h"
@@ -55,6 +56,7 @@ using content::BrowserAccessibilityDelegate;
 using content::BrowserAccessibilityManager;
 using content::BrowserAccessibilityManagerMac;
 using content::ContentClient;
+using content::IsUseZoomForDSFEnabled;
 using content::OneShotAccessibilityTreeSearch;
 using ui::AXNodeData;
 using ui::AXTreeIDRegistry;
@@ -340,11 +342,6 @@ AXPlatformRange CreateRangeFromTextMarkerRange(id marker_range) {
 BrowserAccessibilityPositionInstance CreateTreePosition(
     const BrowserAccessibility& object,
     int offset) {
-  // A tree position is one for which the |offset| argument refers to a child
-  // index instead of a character offset inside a text object.
-  if (!object.instance_active())
-    return BrowserAccessibilityPosition::CreateNullPosition();
-
   const BrowserAccessibilityManager* manager = object.manager();
   DCHECK(manager);
   return BrowserAccessibilityPosition::CreateTreePosition(
@@ -355,12 +352,6 @@ BrowserAccessibilityPositionInstance CreateTextPosition(
     const BrowserAccessibility& object,
     int offset,
     ax::mojom::TextAffinity affinity) {
-  // A text position is one for which the |offset| argument refers to a
-  // character offset inside a text object. As such, text positions are only
-  // valid on platform leaf objects, e.g. static text nodes and text fields.
-  if (!object.instance_active())
-    return BrowserAccessibilityPosition::CreateNullPosition();
-
   const BrowserAccessibilityManager* manager = object.manager();
   DCHECK(manager);
   return BrowserAccessibilityPosition::CreateTextPosition(
@@ -1747,9 +1738,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
   if (ui::IsLink(_owner->GetRole()))
     return true;
 
-  // VoiceOver will not read the label of a fieldset or radiogroup unless it is
+  // VoiceOver will not read the label of these roles unless it is
   // exposed in the description instead of the title.
   switch (_owner->GetRole()) {
+    case ax::mojom::Role::kGenericContainer:
     case ax::mojom::Role::kGroup:
     case ax::mojom::Role::kRadioGroup:
       return true;
@@ -1836,7 +1828,7 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 }
 
 - (BOOL)instanceActive {
-  return _owner && _owner->instance_active();
+  return _owner != nullptr;
 }
 
 // internal
@@ -3692,7 +3684,13 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
   screen_point +=
       manager->GetViewBoundsInScreenCoordinates().OffsetFromOrigin();
 
-  BrowserAccessibility* hit = manager->CachingAsyncHitTest(screen_point);
+  gfx::Point physical_pixel_point =
+      content::IsUseZoomForDSFEnabled()
+          ? screen_point
+          : ScaleToRoundedPoint(screen_point, manager->device_scale_factor());
+
+  BrowserAccessibility* hit =
+      manager->CachingAsyncHitTest(physical_pixel_point);
   if (!hit)
     return nil;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_cocoa_browsertest.mm b/chromium/content/browser/accessibility/browser_accessibility_cocoa_browsertest.mm
index 090e3849ebc..4148e32e718 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_cocoa_browsertest.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_cocoa_browsertest.mm
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/strings/sys_string_conversions.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_cocoa.h"
@@ -11,6 +11,7 @@
 #include "content/browser/accessibility/browser_accessibility_manager_mac.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/browser_accessibility_com_win.cc b/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
index c81bcbc85fa..89fd920e1cb 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
@@ -21,6 +21,7 @@
 #include "content/browser/accessibility/browser_accessibility_win.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
+#include "ui/accessibility/ax_enum_util.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_role_properties.h"
 #include "ui/base/win/accessibility_ids_win.h"
@@ -666,8 +667,9 @@ IFACEMETHODIMP BrowserAccessibilityComWin::doAction(LONG action_index) {
     return E_FAIL;
 
   if (!owner()->HasIntAttribute(ax::mojom::IntAttribute::kDefaultActionVerb) ||
-      action_index != 0)
+      action_index != 0) {
     return E_INVALIDARG;
+  }
 
   Manager()->DoDefaultAction(*owner());
   return S_OK;
@@ -708,8 +710,8 @@ IFACEMETHODIMP BrowserAccessibilityComWin::get_name(LONG action_index,
     return E_INVALIDARG;
   }
 
-  base::string16 action_verb = ui::ActionVerbToUnlocalizedString(
-      static_cast<ax::mojom::DefaultActionVerb>(action));
+  base::string16 action_verb = base::UTF8ToUTF16(
+      ui::ToString(static_cast<ax::mojom::DefaultActionVerb>(action)));
   if (action_verb.empty() || action_verb == L"none") {
     *name = nullptr;
     return S_FALSE;
@@ -739,8 +741,8 @@ BrowserAccessibilityComWin::get_localizedName(LONG action_index,
     return E_INVALIDARG;
   }
 
-  base::string16 action_verb = ui::ActionVerbToLocalizedString(
-      static_cast<ax::mojom::DefaultActionVerb>(action));
+  base::string16 action_verb = base::UTF8ToUTF16(
+      ui::ToLocalizedString(static_cast<ax::mojom::DefaultActionVerb>(action)));
   if (action_verb.empty()) {
     *localized_name = nullptr;
     return S_FALSE;
@@ -1669,15 +1671,22 @@ bool BrowserAccessibilityComWin::IsListBoxOptionOrMenuListOption() {
 }
 
 void BrowserAccessibilityComWin::FireNativeEvent(LONG win_event_type) const {
-  if (owner()->IsChildOfLeaf())
+  // We only allow events on descendants of a platform leaf when that platform
+  // leaf is a popup button parent of a menu list popup. On Windows, the menu
+  // list popup is not part of the tree when its parent is collapsed but events
+  // should be fired anyway.
+  if (owner()->IsChildOfLeaf() &&
+      !owner()->GetCollapsedMenuListPopUpButtonAncestor()) {
     return;
+  }
+
   Manager()->ToBrowserAccessibilityManagerWin()->FireWinAccessibilityEvent(
       win_event_type, owner());
 }
 
 BrowserAccessibilityComWin* ToBrowserAccessibilityComWin(
     BrowserAccessibility* obj) {
-  if (!obj || !obj->IsNative())
+  if (!obj)
     return nullptr;
   auto* result = static_cast<BrowserAccessibilityWin*>(obj)->GetCOM();
   return result;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_mac.h b/chromium/content/browser/accessibility/browser_accessibility_mac.h
index 53c3e87cb94..e5358e5b051 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_mac.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_mac.h
@@ -27,8 +27,7 @@ CONTENT_EXPORT BrowserAccessibilityCocoa* ToBrowserAccessibilityCocoa(
 class BrowserAccessibilityMac : public BrowserAccessibility {
  public:
   // BrowserAccessibility overrides.
-  void NativeReleaseReference() override;
-  bool IsNative() const override;
+  ~BrowserAccessibilityMac() override;
   void OnDataChanged() override;
   uint32_t PlatformChildCount() const override;
   BrowserAccessibility* PlatformGetChild(uint32_t child_index) const override;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_mac.mm b/chromium/content/browser/accessibility/browser_accessibility_mac.mm
index 34964ec49e2..1f160cf367f 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_mac.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_mac.mm
@@ -21,19 +21,14 @@ BrowserAccessibility* BrowserAccessibility::Create() {
 BrowserAccessibilityMac::BrowserAccessibilityMac()
     : browser_accessibility_cocoa_(NULL) {}
 
-bool BrowserAccessibilityMac::IsNative() const {
-  return true;
-}
-
-void BrowserAccessibilityMac::NativeReleaseReference() {
+BrowserAccessibilityMac::~BrowserAccessibilityMac() {
   // Detach this object from |browser_accessibility_cocoa_| so it
   // no longer has a pointer to this object.
   [browser_accessibility_cocoa_ detach];
+
   // Now, release it - but at this point, other processes may have a
   // reference to the cocoa object.
   [browser_accessibility_cocoa_ release];
-  // Finally, it's safe to delete this since we've detached.
-  delete this;
 }
 
 void BrowserAccessibilityMac::OnDataChanged() {
@@ -181,14 +176,12 @@ BrowserAccessibility* BrowserAccessibilityMac::PlatformGetPreviousSibling()
 const BrowserAccessibilityCocoa* ToBrowserAccessibilityCocoa(
     const BrowserAccessibility* obj) {
   DCHECK(obj);
-  DCHECK(obj->IsNative());
   return static_cast<const BrowserAccessibilityMac*>(obj)->native_view();
 }
 
 BrowserAccessibilityCocoa* ToBrowserAccessibilityCocoa(
     BrowserAccessibility* obj) {
   DCHECK(obj);
-  DCHECK(obj->IsNative());
   return static_cast<BrowserAccessibilityMac*>(obj)->native_view();
 }
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager.cc b/chromium/content/browser/accessibility/browser_accessibility_manager.cc
index 42bb313e767..f22af5da7db 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager.cc
@@ -122,10 +122,6 @@ ui::AXTreeUpdate MakeAXTreeUpdate(
   return update;
 }
 
-BrowserAccessibility* BrowserAccessibilityFactory::Create() {
-  return BrowserAccessibility::Create();
-}
-
 BrowserAccessibilityFindInPageInfo::BrowserAccessibilityFindInPageInfo()
     : request_id(-1),
       match_index(-1),
@@ -139,9 +135,8 @@ BrowserAccessibilityFindInPageInfo::BrowserAccessibilityFindInPageInfo()
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory) {
-  return new BrowserAccessibilityManager(initial_tree, delegate, factory);
+    BrowserAccessibilityDelegate* delegate) {
+  return new BrowserAccessibilityManager(initial_tree, delegate);
 }
 #endif
 
@@ -153,12 +148,10 @@ BrowserAccessibilityManager* BrowserAccessibilityManager::FromID(
 }
 
 BrowserAccessibilityManager::BrowserAccessibilityManager(
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
+    BrowserAccessibilityDelegate* delegate)
     : WebContentsObserver(delegate ? delegate->AccessibilityWebContents()
                                    : nullptr),
       delegate_(delegate),
-      factory_(factory),
       user_is_navigating_away_(false),
       connected_to_parent_tree_node_(false),
       ax_tree_id_(ui::AXTreeIDUnknown()),
@@ -171,12 +164,10 @@ BrowserAccessibilityManager::BrowserAccessibilityManager(
 
 BrowserAccessibilityManager::BrowserAccessibilityManager(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
+    BrowserAccessibilityDelegate* delegate)
     : WebContentsObserver(delegate ? delegate->AccessibilityWebContents()
                                    : nullptr),
       delegate_(delegate),
-      factory_(factory),
       user_is_navigating_away_(false),
       ax_tree_id_(ui::AXTreeIDUnknown()),
       device_scale_factor_(1.0f),
@@ -255,7 +246,6 @@ void BrowserAccessibilityManager::FireFocusEventsIfNeeded() {
   if (!focus)
     return;
 
-  DCHECK(focus->instance_active());
   // Don't fire focus events if the window itself doesn't have focus.
   // Bypass this check for some tests.
   if (!never_suppress_or_delay_events_for_testing_ &&
@@ -337,6 +327,18 @@ BrowserAccessibility* BrowserAccessibilityManager::GetParentNodeFromParentTree()
   return parent ? parent_manager->GetFromAXNode(parent) : nullptr;
 }
 
+BrowserAccessibility* BrowserAccessibilityManager::GetPopupRoot() const {
+  DCHECK(popup_root_ids_.size() <= 1);
+  if (popup_root_ids_.size() == 1) {
+    BrowserAccessibility* node = GetFromID(*popup_root_ids_.begin());
+    if (node) {
+      DCHECK(node->GetData().role == ax::mojom::Role::kRootWebArea);
+      return node;
+    }
+  }
+  return nullptr;
+}
+
 const ui::AXTreeData& BrowserAccessibilityManager::GetTreeData() const {
   return ax_tree()->data();
 }
@@ -608,7 +610,7 @@ BrowserAccessibility* BrowserAccessibilityManager::GetActiveDescendant(
   return focus;
 }
 
-bool BrowserAccessibilityManager::NativeViewHasFocus() const {
+bool BrowserAccessibilityManager::NativeViewHasFocus() {
   BrowserAccessibilityDelegate* delegate = GetDelegateFromRootManager();
   return delegate && delegate->AccessibilityViewHasFocus();
 }
@@ -890,13 +892,13 @@ void BrowserAccessibilityManager::ClearAccessibilityFocus(
   delegate_->AccessibilityPerformAction(action_data);
 }
 
-void BrowserAccessibilityManager::HitTest(const gfx::Point& page_point) const {
+void BrowserAccessibilityManager::HitTest(const gfx::Point& frame_point) const {
   if (!delegate_)
     return;
 
   ui::AXActionData action_data;
   action_data.action = ax::mojom::Action::kHitTest;
-  action_data.target_point = page_point;
+  action_data.target_point = frame_point;
   action_data.hit_test_event_to_fire = ax::mojom::Event::kHover;
   delegate_->AccessibilityPerformAction(action_data);
 }
@@ -1277,9 +1279,14 @@ void BrowserAccessibilityManager::OnSubtreeWillBeDeleted(ui::AXTree* tree,
 void BrowserAccessibilityManager::OnNodeCreated(ui::AXTree* tree,
                                                 ui::AXNode* node) {
   DCHECK(node);
-  BrowserAccessibility* wrapper = factory_->Create();
+  BrowserAccessibility* wrapper = BrowserAccessibility::Create();
   id_wrapper_map_[node->id()] = wrapper;
   wrapper->Init(this, node);
+
+  if (tree->root() != node &&
+      node->data().role == ax::mojom::Role::kRootWebArea) {
+    popup_root_ids_.insert(node->id());
+  }
 }
 
 void BrowserAccessibilityManager::OnNodeDeleted(ui::AXTree* tree,
@@ -1287,8 +1294,11 @@ void BrowserAccessibilityManager::OnNodeDeleted(ui::AXTree* tree,
   DCHECK_NE(node_id, ui::AXNode::kInvalidAXID);
   if (BrowserAccessibility* wrapper = GetFromID(node_id)) {
     id_wrapper_map_.erase(node_id);
-    wrapper->Destroy();
+    delete wrapper;
   }
+
+  if (popup_root_ids_.find(node_id) != popup_root_ids_.end())
+    popup_root_ids_.erase(node_id);
 }
 
 void BrowserAccessibilityManager::OnNodeReparented(ui::AXTree* tree,
@@ -1296,12 +1306,26 @@ void BrowserAccessibilityManager::OnNodeReparented(ui::AXTree* tree,
   DCHECK(node);
   BrowserAccessibility* wrapper = GetFromAXNode(node);
   if (!wrapper) {
-    wrapper = factory_->Create();
+    wrapper = BrowserAccessibility::Create();
     id_wrapper_map_[node->id()] = wrapper;
   }
   wrapper->Init(this, node);
 }
 
+void BrowserAccessibilityManager::OnRoleChanged(ui::AXTree* tree,
+                                                ui::AXNode* node,
+                                                ax::mojom::Role old_role,
+                                                ax::mojom::Role new_role) {
+  DCHECK(node);
+  if (tree->root() == node)
+    return;
+  if (new_role == ax::mojom::Role::kRootWebArea) {
+    popup_root_ids_.insert(node->id());
+  } else if (old_role == ax::mojom::Role::kRootWebArea) {
+    popup_root_ids_.erase(node->id());
+  }
+}
+
 void BrowserAccessibilityManager::OnAtomicUpdateFinished(
     ui::AXTree* tree,
     bool root_changed,
@@ -1402,12 +1426,8 @@ ui::AXNode* BrowserAccessibilityManager::GetParentNodeFromParentTreeAsAXNode()
 BrowserAccessibilityManager* BrowserAccessibilityManager::GetRootManager()
     const {
   BrowserAccessibility* parent = GetParentNodeFromParentTree();
-  if (parent) {
-    DCHECK(parent->instance_active())
-        << "The BrowserAccessibility object in the parent tree that is hosting "
-           "this tree should not have been destroyed before its child tree.";
+  if (parent)
     return parent->manager() ? parent->manager()->GetRootManager() : nullptr;
-  }
 
   if (IsRootTree())
     return const_cast<BrowserAccessibilityManager*>(this);
@@ -1491,9 +1511,18 @@ BrowserAccessibility* BrowserAccessibilityManager::CachingAsyncHitTest(
   gfx::Rect screen_view_bounds = GetViewBoundsInScreenCoordinates();
 
   if (delegate_) {
+    // Transform from screen to viewport to frame coordinates to pass to Blink.
+    // Note that page scale (pinch zoom) is independent of device scale factor
+    // (display DPI). Only the latter is affected by UseZoomForDSF.
+    // http://www.chromium.org/developers/design-documents/blink-coordinate-spaces
+    gfx::Point viewport_point =
+        blink_screen_point - screen_view_bounds.OffsetFromOrigin();
+    gfx::Point frame_point =
+        gfx::ScaleToRoundedPoint(viewport_point, 1.0f / page_scale_factor_);
+
     // This triggers an asynchronous request to compute the true object that's
     // under the point.
-    HitTest(blink_screen_point - screen_view_bounds.OffsetFromOrigin());
+    HitTest(frame_point);
 
     // Unfortunately we still have to return an answer synchronously because
     // the APIs were designed that way. The best case scenario is that the
@@ -1530,13 +1559,22 @@ void BrowserAccessibilityManager::CacheHitTestResult(
   last_hover_bounds_ = hit_test_result->GetClippedScreenBoundsRect();
 }
 
-void BrowserAccessibilityManager::OnPortalActivated() {
+void BrowserAccessibilityManager::DidActivatePortal(
+    WebContents* predecessor_contents) {
   if (GetTreeData().loaded) {
     FireGeneratedEvent(ui::AXEventGenerator::Event::PORTAL_ACTIVATED,
                        GetRoot());
   }
 }
 
+void BrowserAccessibilityManager::SetPageScaleFactor(float page_scale_factor) {
+  page_scale_factor_ = page_scale_factor;
+}
+
+float BrowserAccessibilityManager::GetPageScaleFactor() const {
+  return page_scale_factor_;
+}
+
 void BrowserAccessibilityManager::CollectChangedNodesAndParentsForAtomicUpdate(
     ui::AXTree* tree,
     const std::vector<ui::AXTreeObserver::Change>& changes,
@@ -1548,7 +1586,7 @@ void BrowserAccessibilityManager::CollectChangedNodesAndParentsForAtomicUpdate(
     DCHECK(changed_node);
 
     BrowserAccessibility* obj = GetFromAXNode(changed_node);
-    if (obj && obj->IsNative())
+    if (obj)
       nodes_needing_update->insert(obj->GetAXPlatformNode());
 
     // When a node is a text node or line break, update its parent, because
@@ -1559,7 +1597,7 @@ void BrowserAccessibilityManager::CollectChangedNodesAndParentsForAtomicUpdate(
 
     if (ui::IsTextOrLineBreak(changed_node->data().role)) {
       BrowserAccessibility* parent_obj = GetFromAXNode(parent);
-      if (parent_obj && parent_obj->IsNative())
+      if (parent_obj)
         nodes_needing_update->insert(parent_obj->GetAXPlatformNode());
     }
 
@@ -1573,9 +1611,36 @@ void BrowserAccessibilityManager::CollectChangedNodesAndParentsForAtomicUpdate(
     }
 
     BrowserAccessibility* editable_root_obj = GetFromAXNode(editable_root);
-    if (editable_root_obj && editable_root_obj->IsNative())
+    if (editable_root_obj)
       nodes_needing_update->insert(editable_root_obj->GetAXPlatformNode());
   }
 }
 
+bool BrowserAccessibilityManager::ShouldFireEventForNode(
+    BrowserAccessibility* node) const {
+  if (!node || !node->CanFireEvents())
+    return false;
+
+  // If the root delegate isn't the main-frame, this may be a new frame that
+  // hasn't yet been swapped in or added to the frame tree. Suppress firing
+  // events until then.
+  BrowserAccessibilityDelegate* root_delegate = GetDelegateFromRootManager();
+  if (!root_delegate)
+    return false;
+  if (!root_delegate->AccessibilityIsMainFrame())
+    return false;
+
+  // Don't fire events when this document might be stale as the user has
+  // started navigating to a new document.
+  if (user_is_navigating_away_)
+    return false;
+
+  // Inline text boxes are an internal implementation detail, we don't
+  // expose them to the platform.
+  if (node->GetRole() == ax::mojom::Role::kInlineTextBox)
+    return false;
+
+  return true;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager.h b/chromium/content/browser/accessibility/browser_accessibility_manager.h
index e64372b96b9..8892004aaac 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager.h
@@ -86,10 +86,10 @@ class CONTENT_EXPORT BrowserAccessibilityDelegate {
   virtual ~BrowserAccessibilityDelegate() {}
 
   virtual void AccessibilityPerformAction(const ui::AXActionData& data) = 0;
-  virtual bool AccessibilityViewHasFocus() const = 0;
+  virtual bool AccessibilityViewHasFocus() = 0;
   virtual void AccessibilityViewSetFocus() = 0;
-  virtual gfx::Rect AccessibilityGetViewBounds() const = 0;
-  virtual float AccessibilityGetDeviceScaleFactor() const = 0;
+  virtual gfx::Rect AccessibilityGetViewBounds() = 0;
+  virtual float AccessibilityGetDeviceScaleFactor() = 0;
   virtual void AccessibilityFatalError() = 0;
   virtual gfx::AcceleratedWidget AccessibilityGetAcceleratedWidget() = 0;
   virtual gfx::NativeViewAccessible AccessibilityGetNativeViewAccessible() = 0;
@@ -99,16 +99,7 @@ class CONTENT_EXPORT BrowserAccessibilityDelegate {
 
   // Returns true if this delegate represents the main (topmost) frame in a
   // tree of frames.
-  virtual bool AccessibilityIsMainFrame() const = 0;
-};
-
-class CONTENT_EXPORT BrowserAccessibilityFactory {
- public:
-  virtual ~BrowserAccessibilityFactory() {}
-
-  // Create an instance of BrowserAccessibility and return a new
-  // reference to it.
-  virtual BrowserAccessibility* Create();
+  virtual bool AccessibilityIsMainFrame() = 0;
 };
 
 // This is all of the information about the current find in page result,
@@ -146,8 +137,7 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // with no parent window pointer. Only useful for unit tests.
   static BrowserAccessibilityManager* Create(
       const ui::AXTreeUpdate& initial_tree,
-      BrowserAccessibilityDelegate* delegate,
-      BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+      BrowserAccessibilityDelegate* delegate);
 
   static BrowserAccessibilityManager* FromID(ui::AXTreeID ax_tree_id);
 
@@ -185,6 +175,11 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // If this tree has a parent tree, return the parent node in that tree.
   BrowserAccessibility* GetParentNodeFromParentTree() const;
 
+  // In general, there is only a single node with the role of kRootWebArea,
+  // but if a popup is opened, a second nested "root" is created in the same
+  // tree as the "true" root. This will keep track of the nested root node.
+  BrowserAccessibility* GetPopupRoot() const;
+
   // Get the AXTreeData for this frame.
   const ui::AXTreeData& GetTreeData() const;
 
@@ -204,7 +199,10 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   virtual void UserIsReloading();
   void NavigationSucceeded();
   void NavigationFailed();
+
+  // WebContentsObserver overrides
   void DidStopLoading() override;
+  void DidActivatePortal(WebContents* predecessor_contents) override;
 
   // Keep track of if this page is hidden by an interstitial, in which case
   // we need to suppress all events.
@@ -245,9 +243,11 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   void DoDefaultAction(const BrowserAccessibility& node);
   void GetImageData(const BrowserAccessibility& node,
                     const gfx::Size& max_size);
-  // See third_party/blink/renderer/core/layout/hit_test_location.h for
-  // information on hit test coordinates expected by Blink.
-  void HitTest(const gfx::Point& page_point) const;
+  // Per third_party/blink/renderer/core/layout/hit_test_location.h, Blink
+  // expects hit test points in page coordinates. However, WebAXObject::HitTest
+  // applies the visual viewport offset, so we want to pass that function a
+  // point in frame coordinates.
+  void HitTest(const gfx::Point& frame_point) const;
   void Increment(const BrowserAccessibility& node);
   void LoadInlineTextBoxes(const BrowserAccessibility& node);
   void ScrollToMakeVisible(
@@ -345,7 +345,7 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   BrowserAccessibility* GetActiveDescendant(BrowserAccessibility* focus) const;
 
   // Returns true if native focus is anywhere in this WebContents or not.
-  bool NativeViewHasFocus() const;
+  bool NativeViewHasFocus();
 
   // True by default, but some platforms want to treat the root
   // scroll offsets separately.
@@ -416,6 +416,10 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   void OnNodeCreated(ui::AXTree* tree, ui::AXNode* node) override;
   void OnNodeDeleted(ui::AXTree* tree, int32_t node_id) override;
   void OnNodeReparented(ui::AXTree* tree, ui::AXNode* node) override;
+  void OnRoleChanged(ui::AXTree* tree,
+                     ui::AXNode* node,
+                     ax::mojom::Role old_role,
+                     ax::mojom::Role new_role) override;
   void OnAtomicUpdateFinished(
       ui::AXTree* tree,
       bool root_changed,
@@ -461,17 +465,19 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // call to CachingAsyncHitTest().
   void CacheHitTestResult(BrowserAccessibility* hit_test_result) const;
 
-  // Called when |this| is an accessibility manager for a portal's main frame,
-  // and when that portal is activated.
-  void OnPortalActivated();
+  // Updates the page scale factor for this frame.
+  void SetPageScaleFactor(float page_scale_factor);
+
+  // Returns the current page scale factor for this frame.
+  float GetPageScaleFactor() const;
 
  protected:
-  BrowserAccessibilityManager(BrowserAccessibilityDelegate* delegate,
-                              BrowserAccessibilityFactory* factory);
+  FRIEND_TEST_ALL_PREFIXES(BrowserAccessibilityManagerTest,
+                           TestShouldFireEventForNode);
+  explicit BrowserAccessibilityManager(BrowserAccessibilityDelegate* delegate);
 
   BrowserAccessibilityManager(const ui::AXTreeUpdate& initial_tree,
-                              BrowserAccessibilityDelegate* delegate,
-                              BrowserAccessibilityFactory* factory);
+                              BrowserAccessibilityDelegate* delegate);
 
   // Send platform-specific notifications to each of these objects that
   // their location has changed. This is called by OnLocationChanges
@@ -487,15 +493,14 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
       const std::vector<ui::AXTreeObserver::Change>& changes,
       std::set<ui::AXPlatformNode*>* nodes_needing_update);
 
+  bool ShouldFireEventForNode(BrowserAccessibility* node) const;
+
   static void SetLastFocusedNode(BrowserAccessibility* node);
   static BrowserAccessibility* GetLastFocusedNode();
 
   // The object that can perform actions on our behalf.
   BrowserAccessibilityDelegate* delegate_;
 
-  // Factory to create BrowserAccessibility objects (for dependency injection).
-  std::unique_ptr<BrowserAccessibilityFactory> factory_;
-
   // A mapping from a node id to its wrapper of type BrowserAccessibility.
   std::map<int32_t, BrowserAccessibility*> id_wrapper_map_;
 
@@ -528,6 +533,10 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // cached each time there's any update to the accessibility tree.
   float device_scale_factor_;
 
+  // The page scale factor for the view associated with this frame,
+  // cached when we get an update via SetPageScaleFactor().
+  float page_scale_factor_ = 1.0f;
+
   // For testing only: If true, the manually-set device scale factor will be
   // used and it won't be updated from the delegate.
   bool use_custom_device_scale_factor_for_testing_;
@@ -540,6 +549,10 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // For testing only: A function to call when a generated event is fired.
   GeneratedEventCallbackForTesting generated_event_callback_for_testing_;
 
+  // Keeps track of the nested popup root's id, if it exists. See GetPopupRoot()
+  // for details.
+  std::set<int32_t> popup_root_ids_;
+
   // Fire all events regardless of focus and with no delay, to avoid test
   // flakiness. See NeverSuppressOrDelayEventsForTesting() for details.
   static bool never_suppress_or_delay_events_for_testing_;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_android.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_android.cc
index 7d58ea55bec..7ac1ed3294c 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_android.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_android.cc
@@ -18,18 +18,16 @@ namespace content {
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory) {
-  return new BrowserAccessibilityManagerAndroid(initial_tree, nullptr, delegate,
-                                                factory);
+    BrowserAccessibilityDelegate* delegate) {
+  return new BrowserAccessibilityManagerAndroid(initial_tree, nullptr,
+                                                delegate);
 }
 
 BrowserAccessibilityManagerAndroid::BrowserAccessibilityManagerAndroid(
     const ui::AXTreeUpdate& initial_tree,
     base::WeakPtr<WebContentsAccessibilityAndroid> web_contents_accessibility,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
-    : BrowserAccessibilityManager(delegate, factory),
+    BrowserAccessibilityDelegate* delegate)
+    : BrowserAccessibilityManager(delegate),
       web_contents_accessibility_(std::move(web_contents_accessibility)),
       prune_tree_for_screen_reader_(true) {
   // The Java layer handles the root scroll offset.
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_android.h b/chromium/content/browser/accessibility/browser_accessibility_manager_android.h
index 7785dcdbe71..bf675e03573 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_android.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_android.h
@@ -43,8 +43,7 @@ class CONTENT_EXPORT BrowserAccessibilityManagerAndroid
   BrowserAccessibilityManagerAndroid(
       const ui::AXTreeUpdate& initial_tree,
       base::WeakPtr<WebContentsAccessibilityAndroid> web_contents_accessibility,
-      BrowserAccessibilityDelegate* delegate,
-      BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+      BrowserAccessibilityDelegate* delegate);
 
   ~BrowserAccessibilityManagerAndroid() override;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.cc
index 035c84ed138..e4ee1b221bf 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.cc
@@ -17,10 +17,8 @@ namespace content {
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory) {
-  return new BrowserAccessibilityManagerAuraLinux(initial_tree, delegate,
-                                                  factory);
+    BrowserAccessibilityDelegate* delegate) {
+  return new BrowserAccessibilityManagerAuraLinux(initial_tree, delegate);
 }
 
 BrowserAccessibilityManagerAuraLinux*
@@ -30,9 +28,8 @@ BrowserAccessibilityManager::ToBrowserAccessibilityManagerAuraLinux() {
 
 BrowserAccessibilityManagerAuraLinux::BrowserAccessibilityManagerAuraLinux(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
-    : BrowserAccessibilityManager(delegate, factory) {
+    BrowserAccessibilityDelegate* delegate)
+    : BrowserAccessibilityManager(delegate) {
   Initialize(initial_tree);
 }
 
@@ -72,9 +69,6 @@ void BrowserAccessibilityManagerAuraLinux::FireSelectedEvent(
 void BrowserAccessibilityManagerAuraLinux::FireLoadingEvent(
     BrowserAccessibility* node,
     bool is_loading) {
-  if (!node->IsNative())
-    return;
-
   gfx::NativeViewAccessible obj = node->GetNativeViewAccessible();
   if (!ATK_IS_OBJECT(obj))
     return;
@@ -87,18 +81,12 @@ void BrowserAccessibilityManagerAuraLinux::FireLoadingEvent(
 void BrowserAccessibilityManagerAuraLinux::FireExpandedEvent(
     BrowserAccessibility* node,
     bool is_expanded) {
-  if (!node->IsNative())
-    return;
-
   ToBrowserAccessibilityAuraLinux(node)->GetNode()->OnExpandedStateChanged(
       is_expanded);
 }
 
 void BrowserAccessibilityManagerAuraLinux::FireEvent(BrowserAccessibility* node,
                                                      ax::mojom::Event event) {
-  if (!node->IsNative())
-    return;
-
   ToBrowserAccessibilityAuraLinux(node)->GetNode()->NotifyAccessibilityEvent(
       event);
 }
@@ -127,11 +115,19 @@ void BrowserAccessibilityManagerAuraLinux::FireDescriptionChangedEvent(
   ToBrowserAccessibilityAuraLinux(node)->GetNode()->OnDescriptionChanged();
 }
 
+void BrowserAccessibilityManagerAuraLinux::FireSortDirectionChangedEvent(
+    BrowserAccessibility* node) {
+  ToBrowserAccessibilityAuraLinux(node)->GetNode()->OnSortDirectionChanged();
+}
+
 void BrowserAccessibilityManagerAuraLinux::FireSubtreeCreatedEvent(
     BrowserAccessibility* node) {
   // Sending events during a load would create a lot of spam, don't do that.
-  if (GetTreeData().loaded)
-    ToBrowserAccessibilityAuraLinux(node)->GetNode()->OnSubtreeCreated();
+  if (!GetTreeData().loaded)
+    return;
+  if (!CanEmitChildrenChanged(node))
+    return;
+  ToBrowserAccessibilityAuraLinux(node)->GetNode()->OnSubtreeCreated();
 }
 
 void BrowserAccessibilityManagerAuraLinux::FireGeneratedEvent(
@@ -176,6 +172,9 @@ void BrowserAccessibilityManagerAuraLinux::FireGeneratedEvent(
     case ui::AXEventGenerator::Event::SELECTED_CHANGED:
       FireSelectedEvent(node);
       break;
+    case ui::AXEventGenerator::Event::SORT_CHANGED:
+      FireSortDirectionChangedEvent(node);
+      break;
     case ui::AXEventGenerator::Event::SUBTREE_CREATED:
       FireSubtreeCreatedEvent(node);
       break;
@@ -208,8 +207,10 @@ void BrowserAccessibilityManagerAuraLinux::OnNodeDataWillChange(
   // children-changed:add is handled with the generated Event::IGNORED_CHANGED.
   if (!old_node_data.IsIgnored() && new_node_data.IsIgnored()) {
     BrowserAccessibility* obj = GetFromID(old_node_data.id);
-    if (obj && obj->IsNative() && obj->GetParent()) {
+    if (obj && obj->GetParent()) {
       DCHECK(!obj->IsIgnored());
+      if (!CanEmitChildrenChanged(obj))
+        return;
       g_signal_emit_by_name(obj->GetParent(), "children-changed::remove",
                             obj->GetIndexInParent(),
                             obj->GetNativeViewAccessible());
@@ -225,8 +226,9 @@ void BrowserAccessibilityManagerAuraLinux::OnSubtreeWillBeDeleted(
     return;
 
   BrowserAccessibility* obj = GetFromAXNode(node);
-  if (obj && obj->IsNative())
-    ToBrowserAccessibilityAuraLinux(obj)->GetNode()->OnSubtreeWillBeDeleted();
+  if (!CanEmitChildrenChanged(obj))
+    return;
+  ToBrowserAccessibilityAuraLinux(obj)->GetNode()->OnSubtreeWillBeDeleted();
 }
 
 void BrowserAccessibilityManagerAuraLinux::OnAtomicUpdateFinished(
@@ -270,4 +272,14 @@ void BrowserAccessibilityManagerAuraLinux::OnFindInPageTermination() {
       ->TerminateFindInPage();
 }
 
+bool BrowserAccessibilityManagerAuraLinux::CanEmitChildrenChanged(
+    BrowserAccessibility* node) const {
+  if (!node || !ShouldFireEventForNode(node))
+    return false;
+  BrowserAccessibility* parent = node->PlatformGetParent();
+  if (!parent || parent->PlatformIsLeaf())
+    return false;
+  return true;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
index 7ee8c62e7b3..d86cba09251 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
@@ -17,10 +17,8 @@ class BrowserAccessibilityAuraLinux;
 class CONTENT_EXPORT BrowserAccessibilityManagerAuraLinux
     : public BrowserAccessibilityManager {
  public:
-  BrowserAccessibilityManagerAuraLinux(
-      const ui::AXTreeUpdate& initial_tree,
-      BrowserAccessibilityDelegate* delegate,
-      BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+  BrowserAccessibilityManagerAuraLinux(const ui::AXTreeUpdate& initial_tree,
+                                       BrowserAccessibilityDelegate* delegate);
 
   ~BrowserAccessibilityManagerAuraLinux() override;
 
@@ -41,6 +39,7 @@ class CONTENT_EXPORT BrowserAccessibilityManagerAuraLinux
   void FireLoadingEvent(BrowserAccessibility* node, bool is_loading);
   void FireNameChangedEvent(BrowserAccessibility* node);
   void FireDescriptionChangedEvent(BrowserAccessibility* node);
+  void FireSortDirectionChangedEvent(BrowserAccessibility* node);
   void FireSubtreeCreatedEvent(BrowserAccessibility* node);
   void OnFindInPageResult(int request_id,
                           int match_index,
@@ -51,6 +50,8 @@ class CONTENT_EXPORT BrowserAccessibilityManagerAuraLinux
   void OnFindInPageTermination() override;
 
  protected:
+  FRIEND_TEST_ALL_PREFIXES(BrowserAccessibilityManagerAuraLinuxTest,
+                           TestEmitChildrenChanged);
   // AXTreeObserver methods.
   void OnNodeDataWillChange(ui::AXTree* tree,
                             const ui::AXNodeData& old_node_data,
@@ -62,6 +63,7 @@ class CONTENT_EXPORT BrowserAccessibilityManagerAuraLinux
       const std::vector<ui::AXTreeObserver::Change>& changes) override;
 
  private:
+  bool CanEmitChildrenChanged(BrowserAccessibility* node) const;
   void FireEvent(BrowserAccessibility* node, ax::mojom::Event event);
 
   AtkObject* parent_object_;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux_unittest.cc
new file mode 100644
index 00000000000..887fdec0726
--- /dev/null
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux_unittest.cc
@@ -0,0 +1,110 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/accessibility/browser_accessibility_manager_auralinux.h"
+
+#include <atk/atk.h>
+
+#include "content/browser/accessibility/browser_accessibility.h"
+#include "content/browser/accessibility/browser_accessibility_manager.h"
+#include "content/browser/accessibility/test_browser_accessibility_delegate.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/accessibility/ax_enums.mojom.h"
+#include "ui/accessibility/platform/ax_platform_node.h"
+#include "ui/accessibility/platform/ax_platform_node_auralinux.h"
+
+namespace content {
+
+class BrowserAccessibilityManagerAuraLinuxTest : public testing::Test {
+ public:
+  BrowserAccessibilityManagerAuraLinuxTest() = default;
+  ~BrowserAccessibilityManagerAuraLinuxTest() override = default;
+
+ protected:
+  std::unique_ptr<TestBrowserAccessibilityDelegate>
+      test_browser_accessibility_delegate_;
+
+ private:
+  void SetUp() override;
+
+  DISALLOW_COPY_AND_ASSIGN(BrowserAccessibilityManagerAuraLinuxTest);
+};
+
+void BrowserAccessibilityManagerAuraLinuxTest::SetUp() {
+  ui::AXPlatformNode::NotifyAddAXModeFlags(ui::kAXModeComplete);
+  test_browser_accessibility_delegate_ =
+      std::make_unique<TestBrowserAccessibilityDelegate>();
+}
+
+TEST_F(BrowserAccessibilityManagerAuraLinuxTest, TestEmitChildrenChanged) {
+  ui::AXTreeUpdate initial_state;
+  ui::AXTreeID tree_id = ui::AXTreeID::CreateNewAXTreeID();
+  initial_state.tree_data.tree_id = tree_id;
+  initial_state.has_tree_data = true;
+  initial_state.tree_data.loaded = true;
+  initial_state.root_id = 1;
+  initial_state.nodes.resize(3);
+  initial_state.nodes[0].id = 1;
+  initial_state.nodes[0].child_ids = {2};
+  initial_state.nodes[0].role = ax::mojom::Role::kRootWebArea;
+  initial_state.nodes[1].id = 2;
+  initial_state.nodes[1].child_ids = {3};
+  initial_state.nodes[1].role = ax::mojom::Role::kStaticText;
+  initial_state.nodes[2].id = 3;
+  initial_state.nodes[2].role = ax::mojom::Role::kInlineTextBox;
+
+  std::unique_ptr<BrowserAccessibilityManager> manager(
+      BrowserAccessibilityManager::Create(
+          initial_state, test_browser_accessibility_delegate_.get()));
+
+  AtkObject* atk_root = manager->GetRoot()->GetNativeViewAccessible();
+  ui::AXPlatformNodeAuraLinux* root_document_root_node =
+      static_cast<ui::AXPlatformNodeAuraLinux*>(
+          ui::AXPlatformNode::FromNativeViewAccessible(atk_root));
+  g_signal_connect(atk_root, "children-changed::remove",
+                   G_CALLBACK(+[](AtkObject* obj, int index, gpointer child,
+                                  gpointer user_data) {
+                     EXPECT_EQ(ATK_ROLE_DOCUMENT_WEB, atk_object_get_role(obj));
+                   }),
+                   nullptr);
+  g_signal_connect(atk_root, "children-changed::add",
+                   G_CALLBACK(+[](AtkObject* obj, int index, gpointer child,
+                                  gpointer user_data) {
+                     EXPECT_EQ(ATK_ROLE_DOCUMENT_WEB, atk_object_get_role(obj));
+                   }),
+                   nullptr);
+  BrowserAccessibility* static_text_accessible =
+      manager->GetRoot()->PlatformGetChild(0);
+  // StaticText node triggers 'children-changed' event to the parent,
+  // ATK_ROLE_DOCUMENT_WEB, when subtree is changed.
+  BrowserAccessibilityManagerAuraLinux* aura_linux_manager =
+      manager->ToBrowserAccessibilityManagerAuraLinux();
+  aura_linux_manager->FireSubtreeCreatedEvent(static_text_accessible);
+  aura_linux_manager->OnSubtreeWillBeDeleted(manager->ax_tree(),
+                                             static_text_accessible->node());
+
+  AtkObject* atk_object = root_document_root_node->ChildAtIndex(0);
+  g_signal_connect(atk_object, "children-changed::remove",
+                   G_CALLBACK(+[](AtkObject*, int index, gpointer child,
+                                  gpointer user_data) {
+                     EXPECT_TRUE(false) << "should not be reached.";
+                   }),
+                   nullptr);
+  g_signal_connect(atk_object, "children-changed::add",
+                   G_CALLBACK(+[](AtkObject* obj, int index, gpointer child,
+                                  gpointer user_data) {
+                     EXPECT_TRUE(false) << "should not be reached.";
+                   }),
+                   nullptr);
+
+  BrowserAccessibility* inline_text_accessible =
+      static_text_accessible->PlatformGetChild(0);
+  // PlatformLeaf node such as InlineText should not trigger
+  // 'children-changed' event to the parent when subtree is changed.
+  aura_linux_manager->FireSubtreeCreatedEvent(inline_text_accessible);
+  aura_linux_manager->OnSubtreeWillBeDeleted(manager->ax_tree(),
+                                             inline_text_accessible->node());
+}
+
+}  // namespace content
\ No newline at end of file
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_mac.h b/chromium/content/browser/accessibility/browser_accessibility_manager_mac.h
index 5f85185511e..8fb447a74cb 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_mac.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_mac.h
@@ -22,10 +22,8 @@ namespace content {
 class CONTENT_EXPORT BrowserAccessibilityManagerMac
     : public BrowserAccessibilityManager {
  public:
-  BrowserAccessibilityManagerMac(
-      const ui::AXTreeUpdate& initial_tree,
-      BrowserAccessibilityDelegate* delegate,
-      BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+  BrowserAccessibilityManagerMac(const ui::AXTreeUpdate& initial_tree,
+                                 BrowserAccessibilityDelegate* delegate);
 
   ~BrowserAccessibilityManagerMac() override;
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_mac.mm b/chromium/content/browser/accessibility/browser_accessibility_manager_mac.mm
index 8e8b6b785ed..07645b4165b 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_mac.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_mac.mm
@@ -5,8 +5,8 @@
 #include "content/browser/accessibility/browser_accessibility_manager_mac.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #import "base/mac/mac_util.h"
 #import "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
@@ -106,9 +106,8 @@ namespace content {
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory) {
-  return new BrowserAccessibilityManagerMac(initial_tree, delegate, factory);
+    BrowserAccessibilityDelegate* delegate) {
+  return new BrowserAccessibilityManagerMac(initial_tree, delegate);
 }
 
 BrowserAccessibilityManagerMac*
@@ -118,9 +117,8 @@ BrowserAccessibilityManager::ToBrowserAccessibilityManagerMac() {
 
 BrowserAccessibilityManagerMac::BrowserAccessibilityManagerMac(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
-    : BrowserAccessibilityManager(delegate, factory) {
+    BrowserAccessibilityDelegate* delegate)
+    : BrowserAccessibilityManager(delegate) {
   Initialize(initial_tree);
   ax_tree()->SetEnableExtraMacNodes(true);
 }
@@ -205,9 +203,6 @@ void BrowserAccessibilityManagerMac::FireGeneratedEvent(
     ui::AXEventGenerator::Event event_type,
     BrowserAccessibility* node) {
   BrowserAccessibilityManager::FireGeneratedEvent(event_type, node);
-  if (!node->IsNative())
-    return;
-
   auto native_node = ToBrowserAccessibilityCocoa(node);
   DCHECK(native_node);
 
@@ -251,8 +246,8 @@ void BrowserAccessibilityManagerMac::FireGeneratedEvent(
         mac_notification = NSAccessibilitySelectedRowsChangedNotification;
       } else {
         // VoiceOver does not read anything if selection changes on the
-        // currently focused object, and the focus did not move. Detect a
-        // selection change in a where the focus did not change.
+        // currently focused object, and the focus did not move. Fire a
+        // selection change if the focus did not change.
         BrowserAccessibility* focus = GetFocus();
         BrowserAccessibility* container =
             focus->PlatformGetSelectionContainer();
@@ -471,9 +466,6 @@ void BrowserAccessibilityManagerMac::FireGeneratedEvent(
 void BrowserAccessibilityManagerMac::FireNativeMacNotification(
     NSString* mac_notification,
     BrowserAccessibility* node) {
-  if (!node->IsNative())
-    return;
-
   DCHECK(mac_notification);
   auto native_node = ToBrowserAccessibilityCocoa(node);
   DCHECK(native_node);
@@ -496,7 +488,7 @@ void BrowserAccessibilityManagerMac::OnAtomicUpdateFinished(
   std::set<const BrowserAccessibilityCocoa*> changed_editable_roots;
   for (const auto& change : changes) {
     const BrowserAccessibility* obj = GetFromAXNode(change.node);
-    if (obj && obj->IsNative() && obj->HasState(ax::mojom::State::kEditable)) {
+    if (obj && obj->HasState(ax::mojom::State::kEditable)) {
       const BrowserAccessibilityCocoa* editable_root =
           [ToBrowserAccessibilityCocoa(obj) editableAncestor];
       if (editable_root && [editable_root instanceActive])
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
index 3a2a83c7426..101b72a2ea8 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "build/buildflag.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #if defined(OS_WIN)
@@ -21,47 +22,6 @@
 namespace content {
 namespace {
 
-// Subclass of BrowserAccessibility that counts the number of instances.
-class CountedBrowserAccessibility : public BrowserAccessibility {
- public:
-  CountedBrowserAccessibility() {
-    global_obj_count_++;
-    native_ref_count_ = 1;
-  }
-  ~CountedBrowserAccessibility() override { global_obj_count_--; }
-
-  // TODO: Existing cross-platform BrowserAccessibiltity hypertext tests rely on
-  // the default behavior of inner text. Since hypertext implementations are
-  // platform specific and are unavailable here, refactor tests which rely on
-  // GetHypertext (such as GetRootFrameHypertextRangeBoundsRect) as platform
-  // unit tests.
-  base::string16 GetHypertext() const override { return GetInnerText(); }
-
-  void NativeAddReference() override { native_ref_count_++; }
-
-  void NativeReleaseReference() override {
-    native_ref_count_--;
-    if (native_ref_count_ == 0)
-      delete this;
-  }
-
-  bool CanFireEvents() const override { return false; }
-
-  int native_ref_count_;
-  static int global_obj_count_;
-};
-
-int CountedBrowserAccessibility::global_obj_count_ = 0;
-
-// Factory that creates a CountedBrowserAccessibility.
-class CountedBrowserAccessibilityFactory : public BrowserAccessibilityFactory {
- public:
-  ~CountedBrowserAccessibilityFactory() override {}
-  BrowserAccessibility* Create() override {
-    return new CountedBrowserAccessibility();
-  }
-};
-
 class CountingAXTreeObserver : public ui::AXTreeObserver {
  public:
   CountingAXTreeObserver() {}
@@ -104,427 +64,6 @@ void BrowserAccessibilityManagerTest::SetUp() {
       std::make_unique<TestBrowserAccessibilityDelegate>();
 }
 
-TEST_F(BrowserAccessibilityManagerTest, TestNoLeaks) {
-  // Create ui::AXNodeData objects for a simple document tree,
-  // representing the accessibility information used to initialize
-  // BrowserAccessibilityManager.
-  ui::AXNodeData button;
-  button.id = 2;
-  button.SetName("Button");
-  button.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData checkbox;
-  checkbox.id = 3;
-  checkbox.SetName("Checkbox");
-  checkbox.role = ax::mojom::Role::kCheckBox;
-
-  ui::AXNodeData root;
-  root.id = 1;
-  root.SetName("Document");
-  root.role = ax::mojom::Role::kRootWebArea;
-  root.child_ids.push_back(2);
-  root.child_ids.push_back(3);
-
-  // Construct a BrowserAccessibilityManager with this
-  // ui::AXNodeData tree and a factory for an instance-counting
-  // BrowserAccessibility, and ensure that exactly 3 instances were
-  // created. Note that the manager takes ownership of the factory.
-  CountedBrowserAccessibility::global_obj_count_ = 0;
-  BrowserAccessibilityManager* manager = BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(root, button, checkbox),
-      test_browser_accessibility_delegate_.get(),
-      new CountedBrowserAccessibilityFactory());
-
-  ASSERT_EQ(3, CountedBrowserAccessibility::global_obj_count_);
-
-  // Delete the manager and test that all 3 instances are deleted.
-  delete manager;
-  ASSERT_EQ(0, CountedBrowserAccessibility::global_obj_count_);
-
-  // Construct a manager again, and this time save references to two of
-  // the three nodes in the tree.
-  manager = BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(root, button, checkbox),
-      test_browser_accessibility_delegate_.get(),
-      new CountedBrowserAccessibilityFactory());
-  ASSERT_EQ(3, CountedBrowserAccessibility::global_obj_count_);
-
-  CountedBrowserAccessibility* root_accessible =
-      static_cast<CountedBrowserAccessibility*>(manager->GetRoot());
-  root_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child1_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          root_accessible->PlatformGetChild(1));
-  child1_accessible->NativeAddReference();
-
-  // Now delete the manager, and only one of the three nodes in the tree
-  // should be released.
-  delete manager;
-  ASSERT_EQ(2, CountedBrowserAccessibility::global_obj_count_);
-
-  // Release each of our references and make sure that each one results in
-  // the instance being deleted as its reference count hits zero.
-  root_accessible->NativeReleaseReference();
-  ASSERT_EQ(1, CountedBrowserAccessibility::global_obj_count_);
-  child1_accessible->NativeReleaseReference();
-  ASSERT_EQ(0, CountedBrowserAccessibility::global_obj_count_);
-}
-
-TEST_F(BrowserAccessibilityManagerTest, TestReuseBrowserAccessibilityObjects) {
-  // Make sure that changes to a subtree reuse as many objects as possible.
-
-  // Tree 1:
-  //
-  // root
-  //   child1
-  //   child2
-  //   child3
-
-  ui::AXNodeData tree1_child1;
-  tree1_child1.id = 2;
-  tree1_child1.SetName("Child1");
-  tree1_child1.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_child2;
-  tree1_child2.id = 3;
-  tree1_child2.SetName("Child2");
-  tree1_child2.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_child3;
-  tree1_child3.id = 4;
-  tree1_child3.SetName("Child3");
-  tree1_child3.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_root;
-  tree1_root.id = 1;
-  tree1_root.SetName("Document");
-  tree1_root.role = ax::mojom::Role::kRootWebArea;
-  tree1_root.child_ids.push_back(2);
-  tree1_root.child_ids.push_back(3);
-  tree1_root.child_ids.push_back(4);
-
-  // Tree 2:
-  //
-  // root
-  //   child0  <-- inserted
-  //   child1
-  //   child2
-  //           <-- child3 deleted
-
-  ui::AXNodeData tree2_child0;
-  tree2_child0.id = 5;
-  tree2_child0.SetName("Child0");
-  tree2_child0.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree2_root;
-  tree2_root.id = 1;
-  tree2_root.SetName("DocumentChanged");
-  tree2_root.role = ax::mojom::Role::kRootWebArea;
-  tree2_root.child_ids.push_back(5);
-  tree2_root.child_ids.push_back(2);
-  tree2_root.child_ids.push_back(3);
-
-  // Construct a BrowserAccessibilityManager with tree1.
-  CountedBrowserAccessibility::global_obj_count_ = 0;
-  BrowserAccessibilityManager* manager = BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(tree1_root, tree1_child1, tree1_child2, tree1_child3),
-      test_browser_accessibility_delegate_.get(),
-      new CountedBrowserAccessibilityFactory());
-  ASSERT_EQ(4, CountedBrowserAccessibility::global_obj_count_);
-
-  // Save references to all of the objects.
-  CountedBrowserAccessibility* root_accessible =
-      static_cast<CountedBrowserAccessibility*>(manager->GetRoot());
-  root_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child1_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          root_accessible->PlatformGetChild(0));
-  child1_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child2_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          root_accessible->PlatformGetChild(1));
-  child2_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child3_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          root_accessible->PlatformGetChild(2));
-  child3_accessible->NativeAddReference();
-
-  // Check the index in parent.
-  EXPECT_EQ(0, child1_accessible->GetIndexInParent());
-  EXPECT_EQ(1, child2_accessible->GetIndexInParent());
-  EXPECT_EQ(2, child3_accessible->GetIndexInParent());
-
-  // Process a notification containing the changed subtree.
-  AXEventNotificationDetails notification;
-  notification.updates.resize(1);
-  notification.updates[0].nodes.push_back(tree2_root);
-  notification.updates[0].nodes.push_back(tree2_child0);
-  ASSERT_TRUE(manager->OnAccessibilityEvents(notification));
-
-  // There should be 5 objects now: the 4 from the new tree, plus the
-  // reference to child3 we kept.
-  EXPECT_EQ(5, CountedBrowserAccessibility::global_obj_count_);
-
-  // Check that our references to the root, child1, and child2 are still valid,
-  // but that the reference to child3 is now invalid.
-  EXPECT_TRUE(root_accessible->instance_active());
-  EXPECT_TRUE(child1_accessible->instance_active());
-  EXPECT_TRUE(child2_accessible->instance_active());
-  EXPECT_FALSE(child3_accessible->instance_active());
-
-  // Check that the index in parent has been updated.
-  EXPECT_EQ(1, child1_accessible->GetIndexInParent());
-  EXPECT_EQ(2, child2_accessible->GetIndexInParent());
-
-  // Release our references. The object count should only decrease by 1
-  // for child3.
-  root_accessible->NativeReleaseReference();
-  child1_accessible->NativeReleaseReference();
-  child2_accessible->NativeReleaseReference();
-  child3_accessible->NativeReleaseReference();
-
-  EXPECT_EQ(4, CountedBrowserAccessibility::global_obj_count_);
-
-  // Delete the manager and make sure all memory is cleaned up.
-  delete manager;
-  ASSERT_EQ(0, CountedBrowserAccessibility::global_obj_count_);
-}
-
-TEST_F(BrowserAccessibilityManagerTest, TestReuseBrowserAccessibilityObjects2) {
-  // Similar to the test above, but with a more complicated tree.
-
-  // Tree 1:
-  //
-  // root
-  //   container
-  //     child1
-  //       grandchild1
-  //     child2
-  //       grandchild2
-  //     child3
-  //       grandchild3
-
-  ui::AXNodeData tree1_grandchild1;
-  tree1_grandchild1.id = 4;
-  tree1_grandchild1.SetName("GrandChild1");
-  tree1_grandchild1.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_child1;
-  tree1_child1.id = 3;
-  tree1_child1.SetName("Child1");
-  tree1_child1.role = ax::mojom::Role::kButton;
-  tree1_child1.child_ids.push_back(4);
-
-  ui::AXNodeData tree1_grandchild2;
-  tree1_grandchild2.id = 6;
-  tree1_grandchild2.SetName("GrandChild1");
-  tree1_grandchild2.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_child2;
-  tree1_child2.id = 5;
-  tree1_child2.SetName("Child2");
-  tree1_child2.role = ax::mojom::Role::kButton;
-  tree1_child2.child_ids.push_back(6);
-
-  ui::AXNodeData tree1_grandchild3;
-  tree1_grandchild3.id = 8;
-  tree1_grandchild3.SetName("GrandChild3");
-  tree1_grandchild3.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree1_child3;
-  tree1_child3.id = 7;
-  tree1_child3.SetName("Child3");
-  tree1_child3.role = ax::mojom::Role::kButton;
-  tree1_child3.child_ids.push_back(8);
-
-  ui::AXNodeData tree1_container;
-  tree1_container.id = 2;
-  tree1_container.SetName("Container");
-  tree1_container.role = ax::mojom::Role::kGroup;
-  tree1_container.child_ids.push_back(3);
-  tree1_container.child_ids.push_back(5);
-  tree1_container.child_ids.push_back(7);
-
-  ui::AXNodeData tree1_root;
-  tree1_root.id = 1;
-  tree1_root.SetName("Document");
-  tree1_root.role = ax::mojom::Role::kRootWebArea;
-  tree1_root.child_ids.push_back(2);
-
-  // Tree 2:
-  //
-  // root
-  //   container
-  //     child0         <-- inserted
-  //       grandchild0  <--
-  //     child1
-  //       grandchild1
-  //     child2
-  //       grandchild2
-  //                    <-- child3 (and grandchild3) deleted
-
-  ui::AXNodeData tree2_grandchild0;
-  tree2_grandchild0.id = 9;
-  tree2_grandchild0.SetName("GrandChild0");
-  tree2_grandchild0.role = ax::mojom::Role::kButton;
-
-  ui::AXNodeData tree2_child0;
-  tree2_child0.id = 10;
-  tree2_child0.SetName("Child0");
-  tree2_child0.role = ax::mojom::Role::kButton;
-  tree2_child0.child_ids.push_back(9);
-
-  ui::AXNodeData tree2_container;
-  tree2_container.id = 2;
-  tree2_container.SetName("Container");
-  tree2_container.role = ax::mojom::Role::kGroup;
-  tree2_container.child_ids.push_back(10);
-  tree2_container.child_ids.push_back(3);
-  tree2_container.child_ids.push_back(5);
-
-  // Construct a BrowserAccessibilityManager with tree1.
-  CountedBrowserAccessibility::global_obj_count_ = 0;
-  BrowserAccessibilityManager* manager = BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(tree1_root, tree1_container, tree1_child1,
-                       tree1_grandchild1, tree1_child2, tree1_grandchild2,
-                       tree1_child3, tree1_grandchild3),
-      test_browser_accessibility_delegate_.get(),
-      new CountedBrowserAccessibilityFactory());
-  ASSERT_EQ(8, CountedBrowserAccessibility::global_obj_count_);
-
-  // Save references to some objects.
-  CountedBrowserAccessibility* root_accessible =
-      static_cast<CountedBrowserAccessibility*>(manager->GetRoot());
-  root_accessible->NativeAddReference();
-  CountedBrowserAccessibility* container_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          root_accessible->PlatformGetChild(0));
-  container_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child2_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          container_accessible->PlatformGetChild(1));
-  child2_accessible->NativeAddReference();
-  CountedBrowserAccessibility* child3_accessible =
-      static_cast<CountedBrowserAccessibility*>(
-          container_accessible->PlatformGetChild(2));
-  child3_accessible->NativeAddReference();
-
-  // Check the index in parent.
-  EXPECT_EQ(1, child2_accessible->GetIndexInParent());
-  EXPECT_EQ(2, child3_accessible->GetIndexInParent());
-
-  // Process a notification containing the changed subtree rooted at
-  // the container.
-  AXEventNotificationDetails notification;
-  notification.updates.resize(1);
-  notification.updates[0].nodes.push_back(tree2_container);
-  notification.updates[0].nodes.push_back(tree2_child0);
-  notification.updates[0].nodes.push_back(tree2_grandchild0);
-  ASSERT_TRUE(manager->OnAccessibilityEvents(notification));
-
-  // There should be 9 objects now: the 8 from the new tree, plus the
-  // reference to child3 we kept.
-  EXPECT_EQ(9, CountedBrowserAccessibility::global_obj_count_);
-
-  // Check that our references to the root and container and child2 are
-  // still valid, but that the reference to child3 is now invalid.
-  EXPECT_TRUE(root_accessible->instance_active());
-  EXPECT_TRUE(container_accessible->instance_active());
-  EXPECT_TRUE(child2_accessible->instance_active());
-  EXPECT_FALSE(child3_accessible->instance_active());
-
-  // Ensure that we retain the parent of the detached subtree.
-  EXPECT_EQ(root_accessible, container_accessible->PlatformGetParent());
-  EXPECT_EQ(0, container_accessible->GetIndexInParent());
-
-  // Check that the index in parent has been updated.
-  EXPECT_EQ(2, child2_accessible->GetIndexInParent());
-
-  // Release our references. The object count should only decrease by 1
-  // for child3.
-  root_accessible->NativeReleaseReference();
-  container_accessible->NativeReleaseReference();
-  child2_accessible->NativeReleaseReference();
-  child3_accessible->NativeReleaseReference();
-
-  EXPECT_EQ(8, CountedBrowserAccessibility::global_obj_count_);
-
-  // Delete the manager and make sure all memory is cleaned up.
-  delete manager;
-  ASSERT_EQ(0, CountedBrowserAccessibility::global_obj_count_);
-}
-
-TEST_F(BrowserAccessibilityManagerTest, TestMoveChildUp) {
-  // Tree 1:
-  //
-  // 1
-  //   2
-  //   3
-  //     4
-
-  ui::AXNodeData tree1_4;
-  tree1_4.id = 4;
-
-  ui::AXNodeData tree1_3;
-  tree1_3.id = 3;
-  tree1_3.child_ids.push_back(4);
-
-  ui::AXNodeData tree1_2;
-  tree1_2.id = 2;
-
-  ui::AXNodeData tree1_1;
-  tree1_1.id = 1;
-  tree1_1.role = ax::mojom::Role::kRootWebArea;
-  tree1_1.child_ids.push_back(2);
-  tree1_1.child_ids.push_back(3);
-
-  // Tree 2:
-  //
-  // 1
-  //   4    <-- moves up a level and gains child
-  //     6  <-- new
-  //   5    <-- new
-
-  ui::AXNodeData tree2_6;
-  tree2_6.id = 6;
-
-  ui::AXNodeData tree2_5;
-  tree2_5.id = 5;
-
-  ui::AXNodeData tree2_4;
-  tree2_4.id = 4;
-  tree2_4.child_ids.push_back(6);
-
-  ui::AXNodeData tree2_1;
-  tree2_1.id = 1;
-  tree2_1.child_ids.push_back(4);
-  tree2_1.child_ids.push_back(5);
-
-  // Construct a BrowserAccessibilityManager with tree1.
-  CountedBrowserAccessibility::global_obj_count_ = 0;
-  BrowserAccessibilityManager* manager = BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(tree1_1, tree1_2, tree1_3, tree1_4),
-      test_browser_accessibility_delegate_.get(),
-      new CountedBrowserAccessibilityFactory());
-  ASSERT_EQ(4, CountedBrowserAccessibility::global_obj_count_);
-
-  // Process a notification containing the changed subtree.
-  AXEventNotificationDetails notification;
-  notification.updates.resize(1);
-  notification.updates[0].nodes.push_back(tree2_1);
-  notification.updates[0].nodes.push_back(tree2_4);
-  notification.updates[0].nodes.push_back(tree2_5);
-  notification.updates[0].nodes.push_back(tree2_6);
-  ASSERT_TRUE(manager->OnAccessibilityEvents(notification));
-
-  // There should be 4 objects now.
-  EXPECT_EQ(4, CountedBrowserAccessibility::global_obj_count_);
-
-  // Delete the manager and make sure all memory is cleaned up.
-  delete manager;
-  ASSERT_EQ(0, CountedBrowserAccessibility::global_obj_count_);
-}
-
 // Temporarily disabled due to bug http://crbug.com/765490
 TEST_F(BrowserAccessibilityManagerTest, DISABLED_TestFatalError) {
   // Test that BrowserAccessibilityManager raises a fatal error
@@ -537,13 +76,10 @@ TEST_F(BrowserAccessibilityManagerTest, DISABLED_TestFatalError) {
   root.child_ids.push_back(2);
   root.child_ids.push_back(2);
 
-  CountedBrowserAccessibilityFactory* factory =
-      new CountedBrowserAccessibilityFactory();
   std::unique_ptr<BrowserAccessibilityManager> manager;
   ASSERT_FALSE(test_browser_accessibility_delegate_->got_fatal_error());
   manager.reset(BrowserAccessibilityManager::Create(
-      MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get(),
-      factory));
+      MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get()));
   ASSERT_TRUE(test_browser_accessibility_delegate_->got_fatal_error());
 
   ui::AXNodeData root2;
@@ -572,14 +108,16 @@ TEST_F(BrowserAccessibilityManagerTest, DISABLED_TestFatalError) {
   grandchild6.id = 6;
 
   test_browser_accessibility_delegate_->reset_got_fatal_error();
-  factory = new CountedBrowserAccessibilityFactory();
   manager.reset(BrowserAccessibilityManager::Create(
       MakeAXTreeUpdate(root2, child1, child2, grandchild4, grandchild5,
                        grandchild6),
-      test_browser_accessibility_delegate_.get(), factory));
+      test_browser_accessibility_delegate_.get()));
   ASSERT_TRUE(test_browser_accessibility_delegate_->got_fatal_error());
 }
 
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
 TEST_F(BrowserAccessibilityManagerTest, BoundsForRange) {
   ui::AXNodeData root;
   root.id = 1;
@@ -631,8 +169,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRange) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -685,6 +222,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRange) {
                     0, 13, ui::AXClippingBehavior::kUnclipped)
                 .ToString());
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
 TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeMultiElement) {
   ui::AXNodeData root;
@@ -731,8 +269,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeMultiElement) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, static_text2,
                            inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -793,6 +330,9 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeMultiElement) {
                 .ToString());
 }
 
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
 TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeBiDi) {
   // In this example, we assume that the string "123abc" is rendered with
   // "123" going left-to-right and "abc" going right-to-left. In other
@@ -846,8 +386,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeBiDi) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -893,8 +432,12 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeBiDi) {
                     2, 2, ui::AXClippingBehavior::kUnclipped)
                 .ToString());
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
-TEST_F(BrowserAccessibilityManagerTest, DISABLED_BoundsForRangeScrolledWindow) {
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
+TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeScrolledWindow) {
   ui::AXNodeData root;
   root.id = 1;
   root.role = ax::mojom::Role::kRootWebArea;
@@ -926,8 +469,7 @@ TEST_F(BrowserAccessibilityManagerTest, DISABLED_BoundsForRangeScrolledWindow) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -949,7 +491,11 @@ TEST_F(BrowserAccessibilityManagerTest, DISABLED_BoundsForRangeScrolledWindow) {
                   .ToString());
   }
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
 TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeOnParentElement) {
   ui::AXNodeData root;
   root.id = 1;
@@ -1013,8 +559,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeOnParentElement) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, div, static_text1, img, static_text2,
                            inline_text1, inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
   BrowserAccessibility* div_accessible = root_accessible->PlatformGetChild(0);
@@ -1056,6 +601,7 @@ TEST_F(BrowserAccessibilityManagerTest, BoundsForRangeOnParentElement) {
                     0, 5, ui::AXClippingBehavior::kUnclipped)
                 .ToString());
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
 TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousInTreeOrder) {
   ui::AXNodeData root;
@@ -1081,8 +627,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousInTreeOrder) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, node2, node3, node4, node5),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -1185,8 +730,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextNonDescendantInTreeOrder) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, node2, node3, node4, node5),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -1245,6 +789,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousTextOnlyObject) {
 
   ui::AXNodeData node5;
   node5.id = 8;
+  node5.role = ax::mojom::Role::kGenericContainer;
   root.child_ids.push_back(8);
 
   ui::AXNodeData text4;
@@ -1252,12 +797,16 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousTextOnlyObject) {
   text4.role = ax::mojom::Role::kLineBreak;
   node5.child_ids.push_back(9);
 
+  ui::AXNodeData link;
+  link.id = 10;
+  link.role = ax::mojom::Role::kLink;
+  node5.child_ids.push_back(10);
+
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, node2, node3, node4, node5, text1, text2,
-                           text3, text4),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+                           text3, text4, link),
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -1280,7 +829,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousTextOnlyObject) {
   ASSERT_NE(nullptr, text3_accessible);
   BrowserAccessibility* node5_accessible = root_accessible->PlatformGetChild(3);
   ASSERT_NE(nullptr, node5_accessible);
-  ASSERT_EQ(1U, node5_accessible->PlatformChildCount());
+  ASSERT_EQ(2U, node5_accessible->PlatformChildCount());
   BrowserAccessibility* text4_accessible =
       node5_accessible->PlatformGetChild(0);
   ASSERT_NE(nullptr, text4_accessible);
@@ -1313,6 +862,9 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousTextOnlyObject) {
   EXPECT_EQ(nullptr, manager->PreviousTextOnlyObject(root_accessible));
 }
 
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
 TEST_F(BrowserAccessibilityManagerTest, TestFindIndicesInCommonParent) {
   ui::AXNodeData root;
   root.id = 1;
@@ -1367,8 +919,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestFindIndicesInCommonParent) {
           MakeAXTreeUpdate(root, div, button, button_text, line_break,
                            paragraph, paragraph_text, paragraph_line1,
                            paragraph_line2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -1456,7 +1007,11 @@ TEST_F(BrowserAccessibilityManagerTest, TestFindIndicesInCommonParent) {
   EXPECT_EQ(0, child_index1);
   EXPECT_EQ(1, child_index2);
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
+// This test depends on hypertext, which is only used on
+// Linux and Windows.
+#if defined(OS_WIN) || BUILDFLAG(USE_ATK)
 TEST_F(BrowserAccessibilityManagerTest, TestGetTextForRange) {
   ui::AXNodeData root;
   root.id = 1;
@@ -1523,8 +1078,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestGetTextForRange) {
           MakeAXTreeUpdate(root, div, button, button_text, container,
                            container_text, line_break, paragraph,
                            paragraph_text, paragraph_line1, paragraph_line2),
-          test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -1640,6 +1194,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestGetTextForRange) {
       BrowserAccessibilityManager::GetTextForRange(
           *paragraph_line2_accessible, 6, *paragraph_line1_accessible, 0));
 }
+#endif  // defined(OS_WIN) || BUILDFLAG(USE_ATK)
 
 TEST_F(BrowserAccessibilityManagerTest, DeletingFocusedNodeDoesNotCrash) {
   // Create a really simple tree with one root node and one focused child.
@@ -1656,8 +1211,7 @@ TEST_F(BrowserAccessibilityManagerTest, DeletingFocusedNodeDoesNotCrash) {
   initial_state.tree_data.focus_id = 2;
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          initial_state, test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          initial_state, test_browser_accessibility_delegate_.get()));
 
   EXPECT_EQ(1, manager->GetRoot()->GetId());
   ASSERT_NE(nullptr, manager->GetFocus());
@@ -1703,8 +1257,7 @@ TEST_F(BrowserAccessibilityManagerTest, DeletingFocusedNodeDoesNotCrash2) {
   initial_state.tree_data.focus_id = 2;
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          initial_state, test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          initial_state, test_browser_accessibility_delegate_.get()));
 
   EXPECT_EQ(1, manager->GetRoot()->GetId());
   ASSERT_NE(nullptr, manager->GetFocus());
@@ -1745,8 +1298,7 @@ TEST_F(BrowserAccessibilityManagerTest, TreeUpdatesAreMergedWhenPossible) {
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          tree, test_browser_accessibility_delegate_.get(),
-          new CountedBrowserAccessibilityFactory()));
+          tree, test_browser_accessibility_delegate_.get()));
 
   CountingAXTreeObserver observer;
   manager->ax_tree()->AddObserver(&observer);
@@ -1826,13 +1378,11 @@ TEST_F(BrowserAccessibilityManagerTest, TestHitTestScaled) {
   // Create the two managers.
   std::unique_ptr<BrowserAccessibilityManager> parent_manager(
       BrowserAccessibilityManager::Create(
-          parent_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          parent_update, test_browser_accessibility_delegate_.get()));
 
   std::unique_ptr<BrowserAccessibilityManager> child_manager(
       BrowserAccessibilityManager::Create(
-          child_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          child_update, test_browser_accessibility_delegate_.get()));
 
   // Verify that they're properly connected.
   ASSERT_EQ(parent_manager.get(), child_manager->GetRootManager());
@@ -1854,4 +1404,92 @@ TEST_F(BrowserAccessibilityManagerTest, TestHitTestScaled) {
                                 ax::mojom::StringAttribute::kName));
 }
 
+TEST_F(BrowserAccessibilityManagerTest, TestShouldFireEventForNode) {
+  ui::AXNodeData inline_text;
+  inline_text.id = 1111;
+  inline_text.role = ax::mojom::Role::kInlineTextBox;
+
+  ui::AXNodeData text;
+  text.id = 111;
+  text.role = ax::mojom::Role::kStaticText;
+  text.child_ids = {inline_text.id};
+
+  ui::AXNodeData paragraph;
+  paragraph.id = 11;
+  paragraph.role = ax::mojom::Role::kParagraph;
+  paragraph.child_ids = {text.id};
+
+  ui::AXNodeData root;
+  root.id = 1;
+  root.role = ax::mojom::Role::kRootWebArea;
+  root.child_ids = {paragraph.id};
+
+  std::unique_ptr<BrowserAccessibilityManager> manager(
+      BrowserAccessibilityManager::Create(
+          MakeAXTreeUpdate(root, paragraph, text, inline_text),
+          test_browser_accessibility_delegate_.get()));
+
+  EXPECT_TRUE(manager->ShouldFireEventForNode(manager->GetFromID(1)));
+  EXPECT_TRUE(manager->ShouldFireEventForNode(manager->GetFromID(11)));
+  EXPECT_TRUE(manager->ShouldFireEventForNode(manager->GetFromID(111)));
+  EXPECT_FALSE(manager->ShouldFireEventForNode(manager->GetFromID(1111)));
+}
+
+TEST_F(BrowserAccessibilityManagerTest, NestedChildRoot) {
+  ui::AXNodeData root;
+  root.id = 1;
+  root.role = ax::mojom::Role::kRootWebArea;
+
+  ui::AXNodeData popup_button;
+  popup_button.id = 2;
+  popup_button.role = ax::mojom::Role::kPopUpButton;
+  root.child_ids.push_back(2);
+
+  ui::AXNodeData child_tree_root;
+  child_tree_root.id = 3;
+  child_tree_root.role = ax::mojom::Role::kRootWebArea;
+  root.child_ids.push_back(3);
+
+  std::unique_ptr<BrowserAccessibilityManager> manager(
+      BrowserAccessibilityManager::Create(
+          MakeAXTreeUpdate(root, popup_button, child_tree_root),
+          test_browser_accessibility_delegate_.get()));
+
+  ASSERT_NE(manager->GetPopupRoot(), nullptr);
+  EXPECT_EQ(manager->GetPopupRoot()->GetId(), 3);
+
+  // Update tree to change the role of the nested child root, add new child root
+  // in same update.
+  child_tree_root.role = ax::mojom::Role::kGroup;
+  ui::AXNodeData second_child_tree_root;
+  second_child_tree_root.id = 4;
+  second_child_tree_root.role = ax::mojom::Role::kRootWebArea;
+  root.child_ids.push_back(4);
+
+  manager->Initialize(
+      MakeAXTreeUpdate(root, child_tree_root, second_child_tree_root));
+
+  ASSERT_NE(manager->GetPopupRoot(), nullptr);
+  EXPECT_EQ(manager->GetPopupRoot()->GetId(), 4);
+
+  // Update tree to change the role of the nested child root, so that there is
+  // no longer any nested child root.
+  second_child_tree_root.role = ax::mojom::Role::kGroup;
+  manager->Initialize(MakeAXTreeUpdate(second_child_tree_root));
+  EXPECT_EQ(manager->GetPopupRoot(), nullptr);
+
+  // Test deleting child root.
+
+  // First, ensure a child root exists.
+  second_child_tree_root.role = ax::mojom::Role::kRootWebArea;
+  manager->Initialize(MakeAXTreeUpdate(second_child_tree_root));
+  ASSERT_NE(manager->GetPopupRoot(), nullptr);
+  EXPECT_EQ(manager->GetPopupRoot()->GetId(), 4);
+
+  // Now remove the child root from the tree.
+  root.child_ids = {2, 3};
+  manager->Initialize(MakeAXTreeUpdate(root));
+  EXPECT_EQ(manager->GetPopupRoot(), nullptr);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
index b422a0d4fd8..cc3a7d1c522 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
@@ -30,9 +30,8 @@ namespace content {
 // static
 BrowserAccessibilityManager* BrowserAccessibilityManager::Create(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory) {
-  return new BrowserAccessibilityManagerWin(initial_tree, delegate, factory);
+    BrowserAccessibilityDelegate* delegate) {
+  return new BrowserAccessibilityManagerWin(initial_tree, delegate);
 }
 
 BrowserAccessibilityManagerWin*
@@ -42,10 +41,8 @@ BrowserAccessibilityManager::ToBrowserAccessibilityManagerWin() {
 
 BrowserAccessibilityManagerWin::BrowserAccessibilityManagerWin(
     const ui::AXTreeUpdate& initial_tree,
-    BrowserAccessibilityDelegate* delegate,
-    BrowserAccessibilityFactory* factory)
-    : BrowserAccessibilityManager(delegate, factory),
-      load_complete_pending_(false) {
+    BrowserAccessibilityDelegate* delegate)
+    : BrowserAccessibilityManager(delegate), load_complete_pending_(false) {
   ui::win::CreateATLModuleIfNeeded();
   Initialize(initial_tree);
 }
@@ -363,6 +360,7 @@ void BrowserAccessibilityManagerWin::FireGeneratedEvent(
       aria_properties_events_.insert(node);
       break;
     case ui::AXEventGenerator::Event::SORT_CHANGED:
+      FireWinAccessibilityEvent(IA2_EVENT_OBJECT_ATTRIBUTE_CHANGED, node);
       aria_properties_events_.insert(node);
       break;
     case ui::AXEventGenerator::Event::SUBTREE_CREATED:
@@ -660,33 +658,6 @@ void BrowserAccessibilityManagerWin::OnAtomicUpdateFinished(
   }
 }
 
-bool BrowserAccessibilityManagerWin::ShouldFireEventForNode(
-    BrowserAccessibility* node) const {
-  if (!node || !node->CanFireEvents())
-    return false;
-
-  // If the root delegate isn't the main-frame, this may be a new frame that
-  // hasn't yet been swapped in or added to the frame tree. Suppress firing
-  // events until then.
-  BrowserAccessibilityDelegate* root_delegate = GetDelegateFromRootManager();
-  if (!root_delegate)
-    return false;
-  if (!root_delegate->AccessibilityIsMainFrame())
-    return false;
-
-  // Don't fire events when this document might be stale as the user has
-  // started navigating to a new document.
-  if (user_is_navigating_away_)
-    return false;
-
-  // Inline text boxes are an internal implementation detail, we don't
-  // expose them to Windows.
-  if (node->GetRole() == ax::mojom::Role::kInlineTextBox)
-    return false;
-
-  return true;
-}
-
 void BrowserAccessibilityManagerWin::HandleSelectedStateChanged(
     BrowserAccessibility* node) {
   const bool is_selected =
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_win.h b/chromium/content/browser/accessibility/browser_accessibility_manager_win.h
index c67cdb93308..d1baa803849 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_win.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_win.h
@@ -31,10 +31,8 @@ static const wchar_t kUiaTestCompleteSentinel[] = L"kUiaTestCompleteSentinel";
 class CONTENT_EXPORT BrowserAccessibilityManagerWin
     : public BrowserAccessibilityManager {
  public:
-  BrowserAccessibilityManagerWin(
-      const ui::AXTreeUpdate& initial_tree,
-      BrowserAccessibilityDelegate* delegate,
-      BrowserAccessibilityFactory* factory = new BrowserAccessibilityFactory());
+  BrowserAccessibilityManagerWin(const ui::AXTreeUpdate& initial_tree,
+                                 BrowserAccessibilityDelegate* delegate);
 
   ~BrowserAccessibilityManagerWin() override;
 
@@ -86,8 +84,6 @@ class CONTENT_EXPORT BrowserAccessibilityManagerWin
       bool root_changed,
       const std::vector<ui::AXTreeObserver::Change>& changes) override;
 
-  bool ShouldFireEventForNode(BrowserAccessibility* node) const;
-
  private:
   void HandleSelectedStateChanged(BrowserAccessibility* node);
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_win_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_win_unittest.cc
index 9d53a8bee2a..d3d1ed42450 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_win_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_win_unittest.cc
@@ -68,8 +68,7 @@ TEST_F(BrowserAccessibilityManagerWinTest, DynamicallyAddedIFrame) {
 
   std::unique_ptr<BrowserAccessibilityManager> root_manager(
       BrowserAccessibilityManager::Create(
-          MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get()));
 
   TestFragmentRootDelegate test_fragment_root_delegate(root_manager.get());
 
@@ -94,8 +93,7 @@ TEST_F(BrowserAccessibilityManagerWinTest, DynamicallyAddedIFrame) {
 
   std::unique_ptr<BrowserAccessibilityManager> iframe_manager(
       BrowserAccessibilityManager::Create(MakeAXTreeUpdate(root),
-                                          iframe_delegate.get(),
-                                          new BrowserAccessibilityFactory()));
+                                          iframe_delegate.get()));
 
   // The new frame is not a root frame, so the fragment root's lone child should
   // still be the same as before.
@@ -129,8 +127,7 @@ TEST_F(BrowserAccessibilityManagerWinTest, ChildTree) {
 
   std::unique_ptr<BrowserAccessibilityManager> parent_manager(
       BrowserAccessibilityManager::Create(
-          parent_tree_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          parent_tree_update, test_browser_accessibility_delegate_.get()));
 
   TestFragmentRootDelegate test_fragment_root_delegate(parent_manager.get());
 
@@ -153,8 +150,7 @@ TEST_F(BrowserAccessibilityManagerWinTest, ChildTree) {
   child_tree_delegate->accelerated_widget_ = gfx::kMockAcceleratedWidget;
   std::unique_ptr<BrowserAccessibilityManager> child_manager(
       BrowserAccessibilityManager::Create(child_tree_update,
-                                          child_tree_delegate.get(),
-                                          new BrowserAccessibilityFactory()));
+                                          child_tree_delegate.get()));
 
   // The fragment root's lone child should still be the same as before.
   EXPECT_EQ(fragment_root->GetChildCount(), 1);
diff --git a/chromium/content/browser/accessibility/browser_accessibility_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_unittest.cc
index b056e581043..e0d1eadd2b0 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_unittest.cc
@@ -57,8 +57,7 @@ TEST_F(BrowserAccessibilityTest, TestCanFireEvents) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, para1, text1),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_obj = manager->GetRoot();
   EXPECT_FALSE(root_obj->PlatformIsLeaf());
@@ -172,13 +171,11 @@ TEST_F(BrowserAccessibilityTest, PlatformChildIterator) {
 
   std::unique_ptr<BrowserAccessibilityManager> parent_manager(
       BrowserAccessibilityManager::Create(
-          parent_tree_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          parent_tree_update, test_browser_accessibility_delegate_.get()));
 
   std::unique_ptr<BrowserAccessibilityManager> child_manager(
       BrowserAccessibilityManager::Create(
-          child_tree_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          child_tree_update, test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_obj = parent_manager->GetRoot();
   // Test traversal
@@ -319,8 +316,7 @@ TEST_F(BrowserAccessibilityTest, GetInnerTextRangeBoundsRect) {
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible =
       browser_accessibility_manager->GetRoot();
@@ -435,8 +431,7 @@ TEST_F(BrowserAccessibilityTest, GetInnerTextRangeBoundsRectMultiElement) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, static_text2,
                            inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible =
       browser_accessibility_manager->GetRoot();
@@ -562,8 +557,7 @@ TEST_F(BrowserAccessibilityTest, GetInnerTextRangeBoundsRectBiDi) {
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text1, inline_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible =
       browser_accessibility_manager->GetRoot();
@@ -649,8 +643,7 @@ TEST_F(BrowserAccessibilityTest, GetInnerTextRangeBoundsRectScrolledWindow) {
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text, inline_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   browser_accessibility_manager
       ->SetUseRootScrollOffsetsWhenComputingBoundsForTesting(true);
@@ -688,8 +681,7 @@ TEST_F(BrowserAccessibilityTest, GetAuthorUniqueId) {
 
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
-          MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          MakeAXTreeUpdate(root), test_browser_accessibility_delegate_.get()));
   ASSERT_NE(nullptr, browser_accessibility_manager.get());
 
   BrowserAccessibility* root_accessible =
@@ -731,8 +723,7 @@ TEST_F(BrowserAccessibilityTest, NextWordPositionWithHypertext) {
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, input, static_text, inline_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
   ASSERT_NE(nullptr, browser_accessibility_manager.get());
 
   BrowserAccessibility* root_accessible =
@@ -810,13 +801,11 @@ TEST_F(BrowserAccessibilityTest, PortalName) {
 
   std::unique_ptr<BrowserAccessibilityManager> parent_manager(
       BrowserAccessibilityManager::Create(
-          parent_tree_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          parent_tree_update, test_browser_accessibility_delegate_.get()));
 
   std::unique_ptr<BrowserAccessibilityManager> child_manager(
       BrowserAccessibilityManager::Create(
-          child_tree_update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          child_tree_update, test_browser_accessibility_delegate_.get()));
 
   // Portal node should use name from root of child tree.
   EXPECT_EQ("name", child_manager->GetRoot()->GetName());
@@ -847,8 +836,7 @@ TEST_F(BrowserAccessibilityTest, GetIndexInParent) {
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, static_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
   ASSERT_NE(nullptr, browser_accessibility_manager.get());
 
   BrowserAccessibility* root_accessible =
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win.cc b/chromium/content/browser/accessibility/browser_accessibility_win.cc
index 5124398767c..e92df444a70 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_win.cc
@@ -40,15 +40,29 @@ void BrowserAccessibilityWin::UpdatePlatformAttributes() {
   GetCOM()->UpdateStep3FireEvents();
 }
 
-ui::AXPlatformNode* BrowserAccessibilityWin::GetAXPlatformNode() const {
-  if (!instance_active())
-    return nullptr;
+bool BrowserAccessibilityWin::PlatformIsLeafIncludingIgnored() const {
+  // On Windows, we want to hide the subtree of a collapsed <select> element.
+  // Otherwise, ATs are always going to announce its options whether it's
+  // collapsed or expanded. In the AXTree, this element corresponds to a node
+  // with role ax::mojom::Role::kPopUpButton parent of a node with role
+  // ax::mojom::Role::kMenuListPopup.
+  if (IsCollapsedMenuListPopUpButton())
+    return true;
 
-  return GetCOM();
+  return BrowserAccessibility::PlatformIsLeafIncludingIgnored();
 }
 
-bool BrowserAccessibilityWin::IsNative() const {
-  return true;
+bool BrowserAccessibilityWin::CanFireEvents() const {
+  // On Windows, we want to hide the subtree of a collapsed <select> element but
+  // we still need to fire events on those hidden nodes.
+  if (!IsIgnored() && GetCollapsedMenuListPopUpButtonAncestor())
+    return true;
+
+  return BrowserAccessibility::CanFireEvents();
+}
+
+ui::AXPlatformNode* BrowserAccessibilityWin::GetAXPlatformNode() const {
+  return GetCOM();
 }
 
 void BrowserAccessibilityWin::OnLocationChanged() {
@@ -104,13 +118,11 @@ BrowserAccessibilityComWin* BrowserAccessibilityWin::GetCOM() const {
 }
 
 BrowserAccessibilityWin* ToBrowserAccessibilityWin(BrowserAccessibility* obj) {
-  DCHECK(!obj || obj->IsNative());
   return static_cast<BrowserAccessibilityWin*>(obj);
 }
 
 const BrowserAccessibilityWin* ToBrowserAccessibilityWin(
     const BrowserAccessibility* obj) {
-  DCHECK(!obj || obj->IsNative());
   return static_cast<const BrowserAccessibilityWin*>(obj);
 }
 
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win.h b/chromium/content/browser/accessibility/browser_accessibility_win.h
index 6087e0f0256..18bcad491c6 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_win.h
@@ -25,8 +25,9 @@ class CONTENT_EXPORT BrowserAccessibilityWin : public BrowserAccessibility {
   //
   // BrowserAccessibility methods.
   //
+  bool PlatformIsLeafIncludingIgnored() const override;
+  bool CanFireEvents() const override;
   ui::AXPlatformNode* GetAXPlatformNode() const override;
-  bool IsNative() const override;
   void OnLocationChanged() override;
   base::string16 GetText() const override;
   base::string16 GetHypertext() const override;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
index f6e0719f5c0..69cac2a162c 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
@@ -151,8 +151,7 @@ TEST_F(BrowserAccessibilityWinTest, TestNoLeaks) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, button, checkbox),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   // Delete the manager and test that all 3 instances are deleted.
   manager.reset();
@@ -161,8 +160,7 @@ TEST_F(BrowserAccessibilityWinTest, TestNoLeaks) {
   // to get new references to two of the three nodes in the tree.
   manager.reset(BrowserAccessibilityManager::Create(
       MakeAXTreeUpdate(root, button, checkbox),
-      test_browser_accessibility_delegate_.get(),
-      new BrowserAccessibilityFactory()));
+      test_browser_accessibility_delegate_.get()));
   IAccessible* root_accessible =
       ToBrowserAccessibilityWin(manager->GetRoot())->GetCOM();
   IDispatch* root_iaccessible = NULL;
@@ -205,8 +203,7 @@ TEST_F(BrowserAccessibilityWinTest, TestChildrenChange) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   // Query for the text IAccessible and verify that it returns "old text" as its
   // value.
@@ -294,8 +291,7 @@ TEST_F(BrowserAccessibilityWinTest, TestChildrenChangeNoLeaks) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, div, text3, text4),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   // Notify the BrowserAccessibilityManager that the div node and its children
   // were removed and ensure that only one BrowserAccessibility instance exists.
@@ -420,8 +416,7 @@ TEST_F(BrowserAccessibilityWinTest, TestTextBoundaries) {
           MakeAXTreeUpdate(root, text_field, static_text1, inline_box1,
                            line_break1, static_text2, inline_box2, line_break2,
                            static_text3, inline_box3),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibilityWin* root_obj =
       ToBrowserAccessibilityWin(manager->GetRoot());
@@ -624,8 +619,7 @@ TEST_F(BrowserAccessibilityWinTest, TestSimpleHypertext) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, text1, text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibilityComWin* root_obj =
       ToBrowserAccessibilityWin(manager->GetRoot())->GetCOM();
@@ -739,8 +733,7 @@ TEST_F(BrowserAccessibilityWinTest, TestComplexHypertext) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, text1, combo_box, text2, check_box, button,
                            button_text, link, link_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibilityComWin* root_obj =
       ToBrowserAccessibilityWin(manager->GetRoot())->GetCOM();
@@ -893,8 +886,7 @@ TEST_F(BrowserAccessibilityWinTest, TestGetUIADescendants) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, para1, text1, text2, text3, para2, text4,
                            text5, button, image),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_obj = manager->GetRoot();
   BrowserAccessibility* para_obj = root_obj->PlatformGetChild(0);
@@ -966,8 +958,7 @@ TEST_F(BrowserAccessibilityWinTest, TestCreateEmptyDocument) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       new BrowserAccessibilityManagerWin(
           BrowserAccessibilityManagerWin::GetEmptyDocument(),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   // Verify the root is as we expect by default.
   BrowserAccessibility* root = manager->GetRoot();
@@ -1047,8 +1038,7 @@ TEST_F(BrowserAccessibilityWinTest, EmptyDocHasUniqueIdWin) {
   std::unique_ptr<BrowserAccessibilityManagerWin> manager(
       new BrowserAccessibilityManagerWin(
           BrowserAccessibilityManagerWin::GetEmptyDocument(),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   // Verify the root is as we expect by default.
   BrowserAccessibility* root = manager->GetRoot();
@@ -1093,8 +1083,7 @@ TEST_F(BrowserAccessibilityWinTest, TestIA2Attributes) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, pseudo_before, checkbox),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1206,8 +1195,7 @@ TEST_F(BrowserAccessibilityWinTest, TestValueAttributeInTextControls) {
           MakeAXTreeUpdate(root, combo_box, combo_box_text, search_box,
                            search_box_text, new_line, text_field, link,
                            link_text, slider, slider_text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1371,8 +1359,7 @@ TEST_F(BrowserAccessibilityWinTest, TestWordBoundariesInTextControls) {
           MakeAXTreeUpdate(root, textarea, textarea_div, textarea_text,
                            textarea_line1, textarea_line2, text_field,
                            text_field_div, text_field_text, text_field_line),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1474,8 +1461,7 @@ TEST_F(BrowserAccessibilityWinTest, TextBoundariesOnlyEmbeddedObjectsNoCrash) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root_data, menu_data, button_1_data, button_2_data,
                            static_text_data),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1608,8 +1594,7 @@ TEST_F(BrowserAccessibilityWinTest, TestTextBoundariesEmbeddedCharacterText) {
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          update, test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1879,8 +1864,7 @@ TEST_F(BrowserAccessibilityWinTest, TestCaretAndSelectionInSimpleFields) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, combo_box, text_field),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -1995,8 +1979,7 @@ TEST_F(BrowserAccessibilityWinTest, TestCaretInContentEditables) {
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          update, test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -2118,8 +2101,7 @@ TEST_F(BrowserAccessibilityWinTest, TestSelectionInContentEditables) {
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          update, test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -2254,8 +2236,7 @@ TEST_F(BrowserAccessibilityWinTest, TestIAccessibleHyperlink) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, div, link, text),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* root_accessible =
@@ -2455,8 +2436,7 @@ TEST_F(BrowserAccessibilityWinTest, TestTextAttributesInContentEditables) {
 
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
-          update, test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          update, test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* ax_root =
@@ -2687,8 +2667,7 @@ TEST_F(BrowserAccessibilityWinTest,
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, combo_box, combo_box_div, static_text1,
                            static_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* ax_root =
@@ -2787,8 +2766,7 @@ TEST_F(BrowserAccessibilityWinTest, TestNewMisspellingsInSimpleTextFields) {
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, combo_box, combo_box_div, static_text1,
                            static_text2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   ASSERT_NE(nullptr, manager->GetRoot());
   BrowserAccessibilityWin* ax_root =
@@ -2893,8 +2871,7 @@ TEST_F(BrowserAccessibilityWinTest, TestDeepestFirstLastChild) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, child1, child2, child2_child1, child2_child2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -2977,8 +2954,7 @@ TEST_F(BrowserAccessibilityWinTest, TestInheritedStringAttributes) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, child1, child2, child2_child1, child2_child2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root_accessible = manager->GetRoot();
   ASSERT_NE(nullptr, root_accessible);
@@ -3037,8 +3013,7 @@ TEST_F(BrowserAccessibilityWinTest, UniqueIdWinInvalidAfterDeletingTree) {
   std::unique_ptr<BrowserAccessibilityManagerWin> manager(
       new BrowserAccessibilityManagerWin(
           MakeAXTreeUpdate(root_node, child_node),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root = manager->GetRoot();
   int32_t root_unique_id = GetUniqueId(root);
@@ -3048,8 +3023,7 @@ TEST_F(BrowserAccessibilityWinTest, UniqueIdWinInvalidAfterDeletingTree) {
   // Now destroy that original tree and create a new tree.
   manager.reset(new BrowserAccessibilityManagerWin(
       MakeAXTreeUpdate(root_node, child_node),
-      test_browser_accessibility_delegate_.get(),
-      new BrowserAccessibilityFactory()));
+      test_browser_accessibility_delegate_.get()));
   root = manager->GetRoot();
   int32_t root_unique_id_2 = GetUniqueId(root);
   child = root->PlatformGetChild(0);
@@ -3098,8 +3072,7 @@ TEST_F(BrowserAccessibilityWinTest, AccChildOnlyReturnsDescendants) {
   std::unique_ptr<BrowserAccessibilityManagerWin> manager(
       new BrowserAccessibilityManagerWin(
           MakeAXTreeUpdate(root_node, child_node),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibility* root = manager->GetRoot();
   BrowserAccessibility* child = root->PlatformGetChild(0);
@@ -3138,8 +3111,7 @@ TEST_F(BrowserAccessibilityWinTest, DISABLED_TestIAccessible2Relations) {
   std::unique_ptr<BrowserAccessibilityManager> manager(
       BrowserAccessibilityManager::Create(
           MakeAXTreeUpdate(root, child1, child2),
-          test_browser_accessibility_delegate_.get(),
-          new BrowserAccessibilityFactory()));
+          test_browser_accessibility_delegate_.get()));
 
   BrowserAccessibilityWin* ax_root =
       ToBrowserAccessibilityWin(manager->GetRoot());
diff --git a/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc b/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
index 3b73e03be1a..9754f150103 100644
--- a/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
+++ b/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -35,13 +36,6 @@
 #include "ui/base/win/atl_module.h"
 #endif
 
-// TODO(dmazzoni): Disabled accessibility tests on Win64. crbug.com/179717
-#if defined(OS_WIN) && defined(ARCH_CPU_X86_64)
-#define MAYBE_TableSpan DISABLED_TableSpan
-#else
-#define MAYBE_TableSpan TableSpan
-#endif
-
 namespace content {
 
 class CrossPlatformAccessibilityBrowserTest : public ContentBrowserTest {
@@ -505,68 +499,6 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
   RecursiveAssertUniqueIds(root, &ids);
 }
 
-IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest, MAYBE_TableSpan) {
-  // +---+---+---+
-  // |   1   | 2 |
-  // +---+---+---+
-  // | 3 |   4   |
-  // +---+---+---+
-
-  const char url_str[] =
-      "data:text/html,"
-      "<!doctype html>"
-      "<table border=1>"
-      " <tr>"
-      "  <td colspan=2>1</td><td>2</td>"
-      " </tr>"
-      " <tr>"
-      "  <td>3</td><td colspan=2>4</td>"
-      " </tr>"
-      "</table>";
-  GURL url(url_str);
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  const ui::AXTree& tree = GetAXTree();
-  const ui::AXNode* root = tree.root();
-  const ui::AXNode* table = root->GetUnignoredChildAtIndex(0);
-  EXPECT_EQ(ax::mojom::Role::kTable, table->data().role);
-  ASSERT_GE(table->GetUnignoredChildCount(), 2u);
-  EXPECT_EQ(ax::mojom::Role::kRow,
-            table->GetUnignoredChildAtIndex(0)->data().role);
-  EXPECT_EQ(ax::mojom::Role::kRow,
-            table->GetUnignoredChildAtIndex(1)->data().role);
-  EXPECT_EQ(3, GetIntAttr(table, ax::mojom::IntAttribute::kTableColumnCount));
-  EXPECT_EQ(2, GetIntAttr(table, ax::mojom::IntAttribute::kTableRowCount));
-
-  const ui::AXNode* cell1 =
-      table->GetUnignoredChildAtIndex(0)->GetUnignoredChildAtIndex(0);
-  const ui::AXNode* cell2 =
-      table->GetUnignoredChildAtIndex(0)->GetUnignoredChildAtIndex(1);
-  const ui::AXNode* cell3 =
-      table->GetUnignoredChildAtIndex(1)->GetUnignoredChildAtIndex(0);
-  const ui::AXNode* cell4 =
-      table->GetUnignoredChildAtIndex(1)->GetUnignoredChildAtIndex(1);
-
-  EXPECT_EQ(0,
-            GetIntAttr(cell1, ax::mojom::IntAttribute::kTableCellColumnIndex));
-  EXPECT_EQ(0, GetIntAttr(cell1, ax::mojom::IntAttribute::kTableCellRowIndex));
-  EXPECT_EQ(2,
-            GetIntAttr(cell1, ax::mojom::IntAttribute::kTableCellColumnSpan));
-  EXPECT_EQ(1, GetIntAttr(cell1, ax::mojom::IntAttribute::kTableCellRowSpan));
-  EXPECT_EQ(2,
-            GetIntAttr(cell2, ax::mojom::IntAttribute::kTableCellColumnIndex));
-  EXPECT_EQ(1,
-            GetIntAttr(cell2, ax::mojom::IntAttribute::kTableCellColumnSpan));
-  EXPECT_EQ(0,
-            GetIntAttr(cell3, ax::mojom::IntAttribute::kTableCellColumnIndex));
-  EXPECT_EQ(1,
-            GetIntAttr(cell3, ax::mojom::IntAttribute::kTableCellColumnSpan));
-  EXPECT_EQ(1,
-            GetIntAttr(cell4, ax::mojom::IntAttribute::kTableCellColumnIndex));
-  EXPECT_EQ(2,
-            GetIntAttr(cell4, ax::mojom::IntAttribute::kTableCellColumnSpan));
-}
-
 IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest, WritableElement) {
   const char url_str[] =
       "data:text/html,"
diff --git a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
index 26740865c5b..e90ddb72ebd 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
@@ -110,6 +110,12 @@ void DumpAccessibilityTestBase::SetUp() {
   ChooseFeatures(&enabled_features, &disabled_features);
 
   scoped_feature_list_.InitWithFeatures(enabled_features, disabled_features);
+
+  // The <input type="color"> popup tested in
+  // AccessibilityInputColorWithPopupOpen requires the ability to read pixels
+  // from a Canvas, so we need to be able to produce pixel output.
+  EnablePixelOutput();
+
   ContentBrowserTest::SetUp();
 }
 
@@ -396,9 +402,9 @@ void DumpAccessibilityTestBase::WaitForAXTreeLoaded(
     // We also ignore frame tree nodes created for portals in the outer
     // WebContents as the node doesn't have a url set.
     std::string url = node->current_url().spec();
-    if (url != url::kAboutBlankURL &&
+    if (url != url::kAboutBlankURL && !url.empty() &&
         node->frame_owner_element_type() !=
-            blink::FrameOwnerElementType::kPortal) {
+            blink::mojom::FrameOwnerElementType::kPortal) {
       all_frame_urls.push_back(url);
     }
   }
diff --git a/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc b/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
index dc15cce615f..bdbeed607fa 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
@@ -26,6 +26,7 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -268,6 +269,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
   RunEventTest(FILE_PATH_LITERAL("aria-controls-changed.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
+                       AccessibilityEventsAriaComboBoxUneditable) {
+  RunEventTest(FILE_PATH_LITERAL("aria-combo-box-uneditable.html"));
+}
+
 #if defined(OS_WIN)
 #define MAYBE_AccessibilityEventsAriaDisabledChanged \
   DISABLED_AccessibilityEventsAriaDisabledChanged
@@ -561,8 +567,15 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
   RunEventTest(FILE_PATH_LITERAL("form-required-changed.html"));
 }
 
+// Flaky on Windows: https://crbug.com/1078490.
+#if defined(OS_WIN)
+#define MAYBE_AccessibilityEventsFocusListbox \
+  DISABLED_AccessibilityEventsFocusListbox
+#else
+#define MAYBE_AccessibilityEventsFocusListbox AccessibilityEventsFocusListbox
+#endif
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
-                       AccessibilityEventsFocusListbox) {
+                       MAYBE_AccessibilityEventsFocusListbox) {
   RunEventTest(FILE_PATH_LITERAL("focus-listbox.html"));
 }
 
@@ -580,8 +593,15 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
   RunEventTest(FILE_PATH_LITERAL("input-type-text-value-changed.html"));
 }
 
+// Flaky on Windows: https://crbug.com/1078490.
+#if defined(OS_WIN)
+#define MAYBE_AccessibilityEventsListboxFocus \
+  DISABLED_AccessibilityEventsListboxFocus
+#else
+#define MAYBE_AccessibilityEventsListboxFocus AccessibilityEventsListboxFocus
+#endif
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
-                       AccessibilityEventsListboxFocus) {
+                       MAYBE_AccessibilityEventsListboxFocus) {
   RunEventTest(FILE_PATH_LITERAL("listbox-focus.html"));
 }
 
@@ -605,8 +625,16 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
   RunEventTest(FILE_PATH_LITERAL("live-region-change.html"));
 }
 
+// Flaky on Windows: https://crbug.com/1078490.
+#if defined(OS_WIN)
+#define MAYBE_AccessibilityEventsLiveRegionCreate \
+  DISABLED_AccessibilityEventsLiveRegionCreate
+#else
+#define MAYBE_AccessibilityEventsLiveRegionCreate \
+  AccessibilityEventsLiveRegionCreate
+#endif
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
-                       AccessibilityEventsLiveRegionCreate) {
+                       MAYBE_AccessibilityEventsLiveRegionCreate) {
   RunEventTest(FILE_PATH_LITERAL("live-region-create.html"));
 }
 
@@ -670,8 +698,15 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
   RunEventTest(FILE_PATH_LITERAL("multiple-aria-properties-changed.html"));
 }
 
+// Flaky on Windows: https://crbug.com/1078490.
+#if defined(OS_WIN)
+#define MAYBE_AccessibilityEventsNameChange \
+  DISABLED_AccessibilityEventsNameChange
+#else
+#define MAYBE_AccessibilityEventsNameChange AccessibilityEventsNameChange
+#endif
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
-                       AccessibilityEventsNameChange) {
+                       MAYBE_AccessibilityEventsNameChange) {
   RunEventTest(FILE_PATH_LITERAL("name-change.html"));
 }
 
diff --git a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
index 83e873280c3..c4bc659e60c 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
@@ -24,6 +24,7 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "ui/accessibility/accessibility_switches.h"
@@ -76,7 +77,7 @@ class DumpAccessibilityTreeTest : public DumpAccessibilityTestBase {
         switches::kEnableBlinkFeatures, "AccessibilityObjectModel");
     // Enable display locking, used in some tests.
     base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        switches::kEnableBlinkFeatures, "CSSSubtreeVisibilityHiddenMatchable");
+        switches::kEnableBlinkFeatures, "CSSContentVisibilityHiddenMatchable");
   }
 
   void RunAriaTest(const base::FilePath::CharType* file_path) {
@@ -186,6 +187,18 @@ class DumpAccessibilityTreeTest : public DumpAccessibilityTestBase {
 
     RunTest(test_harness_file, "accessibility/test-harness");
   }
+
+ protected:
+  // Override from DumpAccessibilityTestBase.
+  void ChooseFeatures(std::vector<base::Feature>* enabled_features,
+                      std::vector<base::Feature>* disabled_features) override {
+    // http://crbug.com/1063155 - temporary until this is enabled
+    // everywhere.
+    enabled_features->emplace_back(
+        features::kEnableAccessibilityExposeHTMLElement);
+    DumpAccessibilityTestBase::ChooseFeatures(enabled_features,
+                                              disabled_features);
+  }
 };
 
 void DumpAccessibilityTreeTest::AddDefaultFilters(
@@ -225,57 +238,6 @@ INSTANTIATE_TEST_SUITE_P(
                      AccessibilityTreeFormatter::GetTestPasses().size()),
     DumpAccessibilityTreeTestPassToString());
 
-// http://crbug.com/1063155 - subclass of DumpAccessibilityTreeTest
-// that enables exposing the HTML element. Temporary until this is enabled
-// everywhere.
-class DumpAccessibilityTreeTestWithHTMLElement
-    : public DumpAccessibilityTreeTest {
- private:
-  void ChooseFeatures(std::vector<base::Feature>* enabled_features,
-                      std::vector<base::Feature>* disabled_features) override {
-    enabled_features->emplace_back(
-        features::kEnableAccessibilityExposeHTMLElement);
-    DumpAccessibilityTreeTest::ChooseFeatures(enabled_features,
-                                              disabled_features);
-  }
-};
-
-INSTANTIATE_TEST_SUITE_P(
-    All,
-    DumpAccessibilityTreeTestWithHTMLElement,
-    ::testing::Range(size_t{0},
-                     AccessibilityTreeFormatter::GetTestPasses().size()),
-    DumpAccessibilityTreeTestPassToString());
-
-// TODO(crbug.com/1063155): put these back in sorted order once they pass
-// with the kEnableAccessibilityExposeHTMLElement flag.
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       AccessibilityAriaProgressbar) {
-  RunAriaTest(FILE_PATH_LITERAL("aria-progressbar.html"));
-}
-
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCanvas) {
-  RunHtmlTest(FILE_PATH_LITERAL("canvas.html"));
-}
-
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       AccessibilityModalDialogClosed) {
-  RunHtmlTest(FILE_PATH_LITERAL("modal-dialog-closed.html"));
-}
-
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityDialog) {
-  RunHtmlTest(FILE_PATH_LITERAL("dialog.html"));
-}
-
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityListMarkers) {
-  RunHtmlTest(FILE_PATH_LITERAL("list-markers.html"));
-}
-
-// TODO(crbug.com/1063155): in process of refactoring all tests to enable the
-// kEnableAccessibilityExposeHTMLElement flag, without doing all at the
-// same time.
-#define DumpAccessibilityTreeTest DumpAccessibilityTreeTestWithHTMLElement
-
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCSSColor) {
   RunCSSTest(FILE_PATH_LITERAL("color.html"));
 }
@@ -473,17 +435,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAriaAlert) {
   RunAriaTest(FILE_PATH_LITERAL("aria-alert.html"));
 }
 
-#if defined(OS_WIN)
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       DISABLED_AccessibilityAriaAlertDialog) {
-  RunAriaTest(FILE_PATH_LITERAL("aria-alertdialog.html"));
-}
-#else
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityAriaAlertDialog) {
   RunAriaTest(FILE_PATH_LITERAL("aria-alertdialog.html"));
 }
-#endif
 
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityAriaAnyUnignored) {
@@ -565,6 +520,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunAriaTest(FILE_PATH_LITERAL("aria-combobox.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityAriaComboboxUneditable) {
+  RunAriaTest(FILE_PATH_LITERAL("aria-combobox-uneditable.html"));
+}
+
 #if defined(OS_ANDROID)
 // TODO(crbug.com/986673): test is flaky on android.
 #define MAYBE_AccessibilityAriaOnePointOneCombobox \
@@ -971,6 +931,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAriaPressed) {
   RunAriaTest(FILE_PATH_LITERAL("aria-pressed.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityAriaProgressbar) {
+  RunAriaTest(FILE_PATH_LITERAL("aria-progressbar.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAriaRadio) {
   RunAriaTest(FILE_PATH_LITERAL("aria-radio.html"));
 }
@@ -1317,6 +1282,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityButtonNameCalc) {
   RunHtmlTest(FILE_PATH_LITERAL("button-name-calc.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCanvas) {
+  RunHtmlTest(FILE_PATH_LITERAL("canvas.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCanvasFallback) {
   RunHtmlTest(FILE_PATH_LITERAL("canvas-fallback.html"));
 }
@@ -1367,6 +1336,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityDfn) {
   RunHtmlTest(FILE_PATH_LITERAL("dfn.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityDialog) {
+  RunHtmlTest(FILE_PATH_LITERAL("dialog.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityDisabled) {
   RunHtmlTest(FILE_PATH_LITERAL("disabled.html"));
 }
@@ -1462,6 +1435,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityFigcaption) {
   RunHtmlTest(FILE_PATH_LITERAL("figcaption.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityFigcaptionNested) {
+  RunHtmlTest(FILE_PATH_LITERAL("figcaption-nested.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityFigure) {
   RunHtmlTest(FILE_PATH_LITERAL("figure.html"));
 }
@@ -1544,13 +1522,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunAriaTest(FILE_PATH_LITERAL("hidden-labelled-by.html"));
 }
 
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTestWithHTMLElement,
-                       AccessibilityHR) {
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityHR) {
   RunHtmlTest(FILE_PATH_LITERAL("hr.html"));
 }
 
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTestWithHTMLElement,
-                       AccessibilityHTML) {
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityHTML) {
   RunHtmlTest(FILE_PATH_LITERAL("html.html"));
 }
 
@@ -1573,8 +1549,9 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunHtmlTest(FILE_PATH_LITERAL("iframe.html"));
 }
 
+// https://crbug.com/622387
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       AccessibilityIframeCrossProcess) {
+                       DISABLED_AccessibilityIframeCrossProcess) {
   RunHtmlTest(FILE_PATH_LITERAL("iframe-cross-process.html"));
 }
 
@@ -1666,6 +1643,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityInputColor) {
   RunHtmlTest(FILE_PATH_LITERAL("input-color.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityInputColorWithPopupOpen) {
+  RunHtmlTest(FILE_PATH_LITERAL("input-color-with-popup-open.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityInputDate) {
   RunHtmlTest(FILE_PATH_LITERAL("input-date.html"));
 }
@@ -1940,6 +1922,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunHtmlTest(FILE_PATH_LITERAL("list-marker-styles.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityListMarkers) {
+  RunHtmlTest(FILE_PATH_LITERAL("list-markers.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityLongText) {
   RunHtmlTest(FILE_PATH_LITERAL("long-text.html"));
 }
@@ -1970,6 +1956,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityMeter) {
 }
 
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityModalDialogClosed) {
+  RunHtmlTest(FILE_PATH_LITERAL("modal-dialog-closed.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityModalDialogOpened) {
   RunHtmlTest(FILE_PATH_LITERAL("modal-dialog-opened.html"));
 }
@@ -1993,9 +1984,6 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunHtmlTest(FILE_PATH_LITERAL("modal-dialog-stack.html"));
 }
 
-// TODO(crbug.com/1063155) - see TODO with the same bug number above.
-#undef DumpAccessibilityTreeTest
-
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityNavigation) {
   RunHtmlTest(FILE_PATH_LITERAL("navigation.html"));
 }
@@ -2012,6 +2000,15 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityObject) {
   RunHtmlTest(FILE_PATH_LITERAL("object.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityObjectImage) {
+  RunHtmlTest(FILE_PATH_LITERAL("object-image.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityObjectImageError) {
+  RunHtmlTest(FILE_PATH_LITERAL("object-image-error.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityOffscreen) {
   RunHtmlTest(FILE_PATH_LITERAL("offscreen.html"));
 }
@@ -2079,6 +2076,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
 }
 
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityPortalWithWidgetInside) {
+  RunHtmlTest(FILE_PATH_LITERAL("portal-with-widget-inside.html"));
+}
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityPortalNameFromVisibleText) {
   RunHtmlTest(FILE_PATH_LITERAL("portal-name-from-visible-text.html"));
 }
@@ -2350,9 +2351,7 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, DeleteSelectionCrash) {
   RunHtmlTest(FILE_PATH_LITERAL("delete-selection-crash.html"));
 }
 
-// crbug.com/1053526: Disabled pending the referenced bug fix.
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       DISABLED_DisplayLockingActivatable) {
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, DisplayLockingActivatable) {
   RunDisplayLockingTest(FILE_PATH_LITERAL("activatable.html"));
 }
 
diff --git a/chromium/content/browser/accessibility/fullscreen_browsertest.cc b/chromium/content/browser/accessibility/fullscreen_browsertest.cc
index cbdfaab2762..b32920ef5b5 100644
--- a/chromium/content/browser/accessibility/fullscreen_browsertest.cc
+++ b/chromium/content/browser/accessibility/fullscreen_browsertest.cc
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/hit_testing_browsertest.cc b/chromium/content/browser/accessibility/hit_testing_browsertest.cc
index 4fe50c077c0..7c4afb60284 100644
--- a/chromium/content/browser/accessibility/hit_testing_browsertest.cc
+++ b/chromium/content/browser/accessibility/hit_testing_browsertest.cc
@@ -2,10 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
+#include "content/browser/accessibility/hit_testing_browsertest.h"
+
+#include "base/check.h"
 #include "build/build_config.h"
 #include "build/chromecast_buildflags.h"
-#include "content/browser/accessibility/accessibility_content_browsertest.h"
+#include "content/browser/accessibility/accessibility_tree_formatter_blink.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -13,6 +15,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -20,157 +23,255 @@
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
-#include "testing/gtest/include/gtest/gtest.h"
 #include "ui/accessibility/platform/ax_platform_node_base.h"
 #include "ui/display/display_switches.h"
+#include "ui/gfx/geometry/vector2d_conversions.h"
 
 namespace content {
 
-class AccessibilityHitTestingBrowserTest
-    : public AccessibilityContentBrowserTest {
- public:
-  AccessibilityHitTestingBrowserTest() = default;
-  ~AccessibilityHitTestingBrowserTest() override = default;
+#define EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(css_point, expected_node, \
+                                             hit_node)                 \
+  SCOPED_TRACE(GetScopedTrace(css_point));                             \
+  EXPECT_EQ(expected_node->GetId(), hit_node->GetId());
 
-  BrowserAccessibilityManager* GetRootBrowserAccessibilityManager() {
-    WebContentsImpl* web_contents =
-        static_cast<WebContentsImpl*>(shell()->web_contents());
-    return web_contents->GetRootBrowserAccessibilityManager();
-  }
+AccessibilityHitTestingBrowserTest::AccessibilityHitTestingBrowserTest() =
+    default;
+AccessibilityHitTestingBrowserTest::~AccessibilityHitTestingBrowserTest() =
+    default;
+
+void AccessibilityHitTestingBrowserTest::SetUpCommandLine(
+    base::CommandLine* command_line) {
+  double device_scale_factor;
+  bool use_zoom_for_dsf;
+  std::tie(device_scale_factor, use_zoom_for_dsf) = GetParam();
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kForceDeviceScaleFactor,
+      base::StringPrintf("%.2f", device_scale_factor));
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kEnableUseZoomForDSF, use_zoom_for_dsf ? "true" : "false");
+}
 
-  float GetDeviceScaleFactor() {
-    return GetRootBrowserAccessibilityManager()->device_scale_factor();
-  }
+std::string AccessibilityHitTestingBrowserTest::TestPassToString::operator()(
+    const ::testing::TestParamInfo<AccessibilityZoomTestParam>& info) const {
+  double device_scale_factor;
+  bool use_zoom_for_dsf;
+  std::tie(device_scale_factor, use_zoom_for_dsf) = info.param;
+  std::string name =
+      base::StringPrintf("ZoomFactor%g_UseZoomForDSF%s", device_scale_factor,
+                         use_zoom_for_dsf ? "On" : "Off");
+
+  // The test harness only allows alphanumeric characters and underscores
+  // in param names.
+  std::string sanitized_name;
+  base::ReplaceChars(name, ".", "_", &sanitized_name);
+  return sanitized_name;
+}
 
-  gfx::Rect GetViewBoundsInScreenCoordinates() {
-    return GetRootBrowserAccessibilityManager()
-        ->GetViewBoundsInScreenCoordinates();
-  }
+BrowserAccessibilityManager*
+AccessibilityHitTestingBrowserTest::GetRootBrowserAccessibilityManager() {
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  return web_contents->GetRootBrowserAccessibilityManager();
+}
+
+float AccessibilityHitTestingBrowserTest::GetDeviceScaleFactor() {
+  return GetRootBrowserAccessibilityManager()->device_scale_factor();
+}
+
+float AccessibilityHitTestingBrowserTest::GetPageScaleFactor() {
+  return GetRootBrowserAccessibilityManager()->GetPageScaleFactor();
+}
+
+gfx::Rect
+AccessibilityHitTestingBrowserTest::GetViewBoundsInScreenCoordinates() {
+  return GetRootBrowserAccessibilityManager()
+      ->GetViewBoundsInScreenCoordinates();
+}
 
   // http://www.chromium.org/developers/design-documents/blink-coordinate-spaces
   // If UseZoomForDSF is enabled, device scale factor gets applied going from
   // CSS to page pixels, i.e. before view offset.
   // if UseZoomForDSF is disabled, device scale factor gets applied going from
   // screen to physical pixels, i.e. after view offset.
-  gfx::Point CSSToPagePoint(gfx::Point css_point) {
-    gfx::Point page_point;
-    if (IsUseZoomForDSFEnabled())
-      page_point = ScaleToRoundedPoint(css_point, GetDeviceScaleFactor());
-    else
-      page_point = css_point;
-
-    return page_point;
+gfx::Point AccessibilityHitTestingBrowserTest::CSSToFramePoint(
+    gfx::Point css_point) {
+  gfx::Point page_point;
+  if (IsUseZoomForDSFEnabled())
+    page_point = ScaleToRoundedPoint(css_point, GetDeviceScaleFactor());
+  else
+    page_point = css_point;
+
+  gfx::Point frame_point = page_point - scroll_offset_;
+  return frame_point;
+}
+
+gfx::Point AccessibilityHitTestingBrowserTest::CSSToPhysicalPixelPoint(
+    gfx::Point css_point) {
+  gfx::Point frame_point = CSSToFramePoint(css_point);
+  gfx::Point viewport_point =
+      gfx::ScaleToRoundedPoint(frame_point, GetPageScaleFactor());
+
+  gfx::Rect screen_view_bounds = GetViewBoundsInScreenCoordinates();
+  gfx::Point screen_point =
+      viewport_point + screen_view_bounds.OffsetFromOrigin();
+
+  gfx::Point physical_pixel_point;
+  if (IsUseZoomForDSFEnabled()) {
+    physical_pixel_point = screen_point;
+  } else {
+    physical_pixel_point =
+        ScaleToRoundedPoint(screen_point, GetDeviceScaleFactor());
   }
 
-  gfx::Point CSSToPhysicalPixelPoint(gfx::Point css_point) {
-    gfx::Point page_point = CSSToPagePoint(css_point);
+  return physical_pixel_point;
+}
 
-    gfx::Rect screen_view_bounds = GetViewBoundsInScreenCoordinates();
-    gfx::Point screen_point =
-        page_point + screen_view_bounds.OffsetFromOrigin();
+BrowserAccessibility*
+AccessibilityHitTestingBrowserTest::HitTestAndWaitForResultWithEvent(
+    const gfx::Point& point,
+    ax::mojom::Event event_to_fire) {
+  BrowserAccessibilityManager* manager = GetRootBrowserAccessibilityManager();
+
+  AccessibilityNotificationWaiter event_waiter(
+      shell()->web_contents(), ui::kAXModeComplete, event_to_fire);
+  ui::AXActionData action_data;
+  action_data.action = ax::mojom::Action::kHitTest;
+  action_data.target_point = CSSToFramePoint(point);
+  action_data.hit_test_event_to_fire = event_to_fire;
+  manager->delegate()->AccessibilityPerformAction(action_data);
+  event_waiter.WaitForNotification();
+
+  RenderFrameHostImpl* target_frame = event_waiter.event_render_frame_host();
+  BrowserAccessibilityManager* target_manager =
+      target_frame->browser_accessibility_manager();
+  int event_target_id = event_waiter.event_target_id();
+  BrowserAccessibility* hit_node = target_manager->GetFromID(event_target_id);
+  return hit_node;
+}
 
-    gfx::Point physical_pixel_point;
-    if (IsUseZoomForDSFEnabled()) {
-      physical_pixel_point = screen_point;
-    } else {
-      physical_pixel_point =
-          ScaleToRoundedPoint(screen_point, GetDeviceScaleFactor());
-    }
+BrowserAccessibility*
+AccessibilityHitTestingBrowserTest::HitTestAndWaitForResult(
+    const gfx::Point& point) {
+  return HitTestAndWaitForResultWithEvent(point, ax::mojom::Event::kHover);
+}
 
-    return physical_pixel_point;
-  }
+BrowserAccessibility*
+AccessibilityHitTestingBrowserTest::CallCachingAsyncHitTest(
+    const gfx::Point& page_point) {
+  gfx::Point screen_point = CSSToPhysicalPixelPoint(page_point);
 
-  BrowserAccessibility* HitTestAndWaitForResultWithEvent(
-      const gfx::Point& point,
-      ax::mojom::Event event_to_fire) {
-    BrowserAccessibilityManager* manager = GetRootBrowserAccessibilityManager();
-
-    AccessibilityNotificationWaiter event_waiter(
-        shell()->web_contents(), ui::kAXModeComplete, event_to_fire);
-    ui::AXActionData action_data;
-    action_data.action = ax::mojom::Action::kHitTest;
-    action_data.target_point = CSSToPagePoint(point);
-    action_data.hit_test_event_to_fire = event_to_fire;
-    manager->delegate()->AccessibilityPerformAction(action_data);
-    event_waiter.WaitForNotification();
-
-    RenderFrameHostImpl* target_frame = event_waiter.event_render_frame_host();
-    BrowserAccessibilityManager* target_manager =
-        target_frame->browser_accessibility_manager();
-    int event_target_id = event_waiter.event_target_id();
-    BrowserAccessibility* hit_node = target_manager->GetFromID(event_target_id);
-    return hit_node;
-  }
+  // Each call to CachingAsyncHitTest results in at least one HOVER
+  // event received. Block until we receive it. CachingAsyncHitTestNearestLeaf
+  // will call CachingAsyncHitTest.
+  AccessibilityNotificationWaiter hover_waiter(
+      shell()->web_contents(), ui::kAXModeComplete, ax::mojom::Event::kHover);
 
-  BrowserAccessibility* HitTestAndWaitForResult(const gfx::Point& point) {
-    return HitTestAndWaitForResultWithEvent(point, ax::mojom::Event::kHover);
-  }
+  BrowserAccessibility* result =
+      GetRootBrowserAccessibilityManager()->CachingAsyncHitTest(screen_point);
 
-  BrowserAccessibility* TapAndWaitForResult(const gfx::Point& point) {
-    AccessibilityNotificationWaiter event_waiter(shell()->web_contents(),
-                                                 ui::kAXModeComplete,
-                                                 ax::mojom::Event::kClicked);
-
-    SimulateTapAt(shell()->web_contents(), point);
-    event_waiter.WaitForNotification();
+  hover_waiter.WaitForNotification();
+  return result;
+}
 
-    RenderFrameHostImpl* target_frame = event_waiter.event_render_frame_host();
-    BrowserAccessibilityManager* target_manager =
-        target_frame->browser_accessibility_manager();
-    int event_target_id = event_waiter.event_target_id();
-    BrowserAccessibility* hit_node = target_manager->GetFromID(event_target_id);
-    return hit_node;
+BrowserAccessibility* AccessibilityHitTestingBrowserTest::CallNearestLeafNode(
+    const gfx::Point& page_point) {
+  gfx::Point screen_point = CSSToPhysicalPixelPoint(page_point);
+  BrowserAccessibilityManager* manager =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetRootBrowserAccessibilityManager();
+
+  // Each call to CachingAsyncHitTest results in at least one HOVER
+  // event received. Block until we receive it. CachingAsyncHitTest
+  // will call CachingAsyncHitTest.
+  AccessibilityNotificationWaiter hover_waiter(
+      shell()->web_contents(), ui::kAXModeComplete, ax::mojom::Event::kHover);
+  ui::AXPlatformNodeBase* platform_node = nullptr;
+  if (manager->GetRoot()->GetAXPlatformNode()) {
+    platform_node = static_cast<ui::AXPlatformNodeBase*>(
+                        manager->GetRoot()->GetAXPlatformNode())
+                        ->NearestLeafToPoint(screen_point);
   }
+  hover_waiter.WaitForNotification();
+  if (platform_node) {
+    return BrowserAccessibility::FromAXPlatformNodeDelegate(
+        platform_node->GetDelegate());
+  }
+  return nullptr;
+}
 
-  BrowserAccessibility* CallCachingAsyncHitTest(const gfx::Point& page_point) {
-    gfx::Point screen_point = CSSToPhysicalPixelPoint(page_point);
-
-    // Each call to CachingAsyncHitTest results in at least one HOVER
-    // event received. Block until we receive it. CachingAsyncHitTestNearestLeaf
-    // will call CachingAsyncHitTest.
-    AccessibilityNotificationWaiter hover_waiter(
-        shell()->web_contents(), ui::kAXModeComplete, ax::mojom::Event::kHover);
+void AccessibilityHitTestingBrowserTest::SynchronizeThreads() {
+  MainThreadFrameObserver observer(shell()
+                                       ->web_contents()
+                                       ->GetRenderWidgetHostView()
+                                       ->GetRenderWidgetHost());
+  observer.Wait();
+}
 
-    BrowserAccessibility* result =
-        GetRootBrowserAccessibilityManager()->CachingAsyncHitTest(screen_point);
+void AccessibilityHitTestingBrowserTest::SimulatePinchZoom(
+    float desired_page_scale) {
+  RenderFrameSubmissionObserver observer(shell()->web_contents());
+  AccessibilityNotificationWaiter accessibility_waiter(
+      shell()->web_contents(), ui::AXMode(),
+      ax::mojom::Event::kLocationChanged);
 
-    hover_waiter.WaitForNotification();
-    return result;
-  }
+  const gfx::Rect contents_rect = shell()->web_contents()->GetContainerBounds();
+  const gfx::Point pinch_position(contents_rect.x(), contents_rect.y());
+  SimulateGesturePinchSequence(shell()->web_contents(), pinch_position,
+                               desired_page_scale,
+                               blink::WebGestureDevice::kTouchscreen);
 
-  ui::AXPlatformNodeBase* CallNearestLeafNode(const gfx::Point& page_point) {
-    gfx::Point screen_point = CSSToPhysicalPixelPoint(page_point);
-    BrowserAccessibilityManager* manager =
-        static_cast<WebContentsImpl*>(shell()->web_contents())
-            ->GetRootBrowserAccessibilityManager();
-
-    // Each call to CachingAsyncHitTest results in at least one HOVER
-    // event received. Block until we receive it. CachingAsyncHitTest
-    // will call CachingAsyncHitTest.
-    AccessibilityNotificationWaiter hover_waiter(
-        shell()->web_contents(), ui::kAXModeComplete, ax::mojom::Event::kHover);
-    ui::AXPlatformNodeBase* result = nullptr;
-    if (manager->GetRoot()->GetAXPlatformNode()) {
-      result = static_cast<ui::AXPlatformNodeBase*>(
-                   manager->GetRoot()->GetAXPlatformNode())
-                   ->NearestLeafToPoint(screen_point);
-    }
-    hover_waiter.WaitForNotification();
-    return result;
-  }
+  // Wait for the gesture to be reflected, then make a note of the new scale
+  // factor and any scroll offset that may have been introduced.
+  observer.WaitForPageScaleFactor(desired_page_scale, 0);
+  const cc::RenderFrameMetadata& render_frame_metadata =
+      observer.LastRenderFrameMetadata();
+  DCHECK(render_frame_metadata.page_scale_factor == desired_page_scale);
+  if (render_frame_metadata.root_scroll_offset)
+    scroll_offset_ = gfx::ToRoundedVector2d(
+        render_frame_metadata.root_scroll_offset.value());
+  else
+    scroll_offset_ = gfx::Vector2d();
+
+  // Ensure we get an accessibility update reflecting the new scale factor.
+  accessibility_waiter.WaitForNotification();
+}
 
-  RenderWidgetHostImpl* GetRenderWidgetHost() {
-    return RenderWidgetHostImpl::From(shell()
-                                          ->web_contents()
-                                          ->GetRenderWidgetHostView()
-                                          ->GetRenderWidgetHost());
-  }
+base::string16
+AccessibilityHitTestingBrowserTest::FormatHitTestAccessibilityTree() {
+  std::unique_ptr<AccessibilityTreeFormatter> accessibility_tree_formatter =
+      AccessibilityTreeFormatterBlink::CreateBlink();
+  accessibility_tree_formatter->set_show_ids(true);
+  accessibility_tree_formatter->SetPropertyFilters(
+      {{base::ASCIIToUTF16("name=*"),
+        AccessibilityTreeFormatter::PropertyFilter::ALLOW},
+       {base::ASCIIToUTF16("location=*"),
+        AccessibilityTreeFormatter::PropertyFilter::ALLOW},
+       {base::ASCIIToUTF16("size=*"),
+        AccessibilityTreeFormatter::PropertyFilter::ALLOW}});
+  base::string16 accessibility_tree;
+  accessibility_tree_formatter->FormatAccessibilityTreeForTesting(
+      GetRootAndAssertNonNull(), &accessibility_tree);
+  return accessibility_tree;
+}
 
-  void SynchronizeThreads() {
-    MainThreadFrameObserver observer(GetRenderWidgetHost());
-    observer.Wait();
-  }
-};
+std::string AccessibilityHitTestingBrowserTest::GetScopedTrace(
+    gfx::Point css_point) {
+  std::stringstream string_stream;
+  string_stream << std::endl
+                << "View bounds: "
+                << GetRootBrowserAccessibilityManager()
+                       ->GetViewBoundsInScreenCoordinates()
+                       .ToString()
+                << " Page scale: " << GetPageScaleFactor()
+                << " Scroll offset: " << scroll_offset_.ToString() << std::endl
+                << "Test point CSS: " << css_point.ToString()
+                << " Frame: " << CSSToFramePoint(css_point).ToString()
+                << " Physical: "
+                << CSSToPhysicalPixelPoint(css_point).ToString() << std::endl
+                << "Accessibility tree: " << std::endl
+                << FormatHitTestAccessibilityTree();
+  return string_stream.str();
+}
 
 class AccessibilityHitTestingCrossProcessBrowserTest
     : public AccessibilityHitTestingBrowserTest {
@@ -180,6 +281,7 @@ class AccessibilityHitTestingCrossProcessBrowserTest
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     IsolateAllSitesForTesting(command_line);
+    AccessibilityHitTestingBrowserTest::SetUpCommandLine(command_line);
   }
 
   void SetUpOnMainThread() override {
@@ -189,47 +291,19 @@ class AccessibilityHitTestingCrossProcessBrowserTest
   }
 };
 
-using AccessibilityZoomTestParam = std::tuple<double, bool>;
-
-class AccessibilityHitTestingZoomBrowserTest
-    : public AccessibilityHitTestingBrowserTest,
-      public ::testing::WithParamInterface<AccessibilityZoomTestParam> {
- public:
-  AccessibilityHitTestingZoomBrowserTest() = default;
-  ~AccessibilityHitTestingZoomBrowserTest() override = default;
-
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    double device_scale_factor;
-    bool use_zoom_for_dsf;
-    std::tie(device_scale_factor, use_zoom_for_dsf) = GetParam();
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        switches::kForceDeviceScaleFactor,
-        base::StringPrintf("%.2f", device_scale_factor));
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        switches::kEnableUseZoomForDSF, use_zoom_for_dsf ? "true" : "false");
-  }
-
-  struct TestPassToString {
-    std::string operator()(
-        const ::testing::TestParamInfo<AccessibilityZoomTestParam>& info)
-        const {
-      double device_scale_factor;
-      bool use_zoom_for_dsf;
-      std::tie(device_scale_factor, use_zoom_for_dsf) = info.param;
-      return base::StringPrintf("ZoomFactor%g_UseZoomForDSF%s",
-                                device_scale_factor,
-                                use_zoom_for_dsf ? "On" : "Off");
-    }
-  };
-};
+INSTANTIATE_TEST_SUITE_P(
+    All,
+    AccessibilityHitTestingBrowserTest,
+    ::testing::Combine(::testing::Values(1, 2), ::testing::Bool()),
+    AccessibilityHitTestingBrowserTest::TestPassToString());
 
 INSTANTIATE_TEST_SUITE_P(
     All,
-    AccessibilityHitTestingZoomBrowserTest,
+    AccessibilityHitTestingCrossProcessBrowserTest,
     ::testing::Combine(::testing::Values(1, 2), ::testing::Bool()),
-    AccessibilityHitTestingZoomBrowserTest::TestPassToString());
+    AccessibilityHitTestingBrowserTest::TestPassToString());
 
-IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingZoomBrowserTest,
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
                        CachingAsyncHitTest) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
@@ -247,32 +321,25 @@ IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingZoomBrowserTest,
                                                 "rectA");
 
   // Test a hit on a rect in the main frame.
-  gfx::Point rect2_point(49, 20);
-  BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect2_point);
-  BrowserAccessibility* expected_node =
-      FindNode(ax::mojom::Role::kGenericContainer, "rect2");
-
-  // Compare several properties so that we generate rich log output if the test
-  // fails.
-  EXPECT_EQ(expected_node->GetName(), hit_node->GetName());
-  EXPECT_EQ(expected_node->GetId(), hit_node->GetId());
-  EXPECT_EQ(expected_node->GetClippedScreenBoundsRect(),
-            hit_node->GetClippedScreenBoundsRect());
+  {
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
   // Test a hit on a rect in the iframe.
-  gfx::Point rectB_point(79, 79);
-  hit_node = CallCachingAsyncHitTest(rectB_point);
-  expected_node = FindNode(ax::mojom::Role::kGenericContainer, "rectB");
-
-  // Compare several properties so that we generate rich log output if the test
-  // fails.
-  EXPECT_EQ(expected_node->GetName(), hit_node->GetName());
-  EXPECT_EQ(expected_node->GetId(), hit_node->GetId());
-  EXPECT_EQ(expected_node->GetClippedScreenBoundsRect(),
-            hit_node->GetClippedScreenBoundsRect());
+  {
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 
-IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingZoomBrowserTest, HitTest) {
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest, HitTest) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
@@ -289,32 +356,30 @@ IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingZoomBrowserTest, HitTest) {
                                                 "rectA");
 
   // Test a hit on a rect in the main frame.
-  gfx::Point rect2_point(49, 20);
-  BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect2_point);
-  BrowserAccessibility* expected_node =
-      FindNode(ax::mojom::Role::kGenericContainer, "rect2");
-
-  // Compare several properties so that we generate rich log output if the test
-  // fails.
-  EXPECT_EQ(expected_node->GetName(), hit_node->GetName());
-  EXPECT_EQ(expected_node->GetId(), hit_node->GetId());
-  EXPECT_EQ(expected_node->GetClippedScreenBoundsRect(),
-            hit_node->GetClippedScreenBoundsRect());
+  {
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
   // Test a hit on a rect in the iframe.
-  gfx::Point rectB_point(79, 79);
-  hit_node = HitTestAndWaitForResult(rectB_point);
-  expected_node = FindNode(ax::mojom::Role::kGenericContainer, "rectB");
-
-  // Compare several properties so that we generate rich log output if the test
-  // fails.
-  EXPECT_EQ(expected_node->GetName(), hit_node->GetName());
-  EXPECT_EQ(expected_node->GetId(), hit_node->GetId());
-  EXPECT_EQ(expected_node->GetClippedScreenBoundsRect(),
-            hit_node->GetClippedScreenBoundsRect());
+  {
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+
+    // Test with a different event.
+    hit_node = HitTestAndWaitForResultWithEvent(rect_b_point,
+                                                ax::mojom::Event::kAlert);
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
                        HitTestOutsideDocumentBoundsReturnsRoot) {
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
@@ -340,84 +405,13 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
   ASSERT_EQ(ax::mojom::Role::kRootWebArea, hit_node->GetRole());
 }
 
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
-                       HitTestingInIframes) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-
-  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
-
-  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
-                                         ui::kAXModeComplete,
-                                         ax::mojom::Event::kLoadComplete);
-  GURL url(embedded_test_server()->GetURL(
-      "/accessibility/html/iframe-coordinates.html"));
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-  waiter.WaitForNotification();
-
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Ordinary Button");
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Scrolled Button");
-
-  // Send a series of hit test requests, and for each one
-  // wait for the hover event in response, verifying we hit the
-  // correct object.
-
-  // (26, 26) -> "Button"
-  BrowserAccessibility* hit_node;
-  hit_node = HitTestAndWaitForResult(gfx::Point(26, 26));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  ASSERT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 50) -> "Button"
-  hit_node = HitTestAndWaitForResult(gfx::Point(50, 50));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  ASSERT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 305) -> div in first iframe
-  hit_node = HitTestAndWaitForResult(gfx::Point(50, 305));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-
-  // (50, 350) -> "Ordinary Button"
-  hit_node = HitTestAndWaitForResult(gfx::Point(50, 350));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  ASSERT_EQ("Ordinary Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 455) -> "Scrolled Button"
-  hit_node = HitTestAndWaitForResult(gfx::Point(50, 455));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  ASSERT_EQ("Scrolled Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 505) -> div in second iframe
-  hit_node = HitTestAndWaitForResult(gfx::Point(50, 505));
-  ASSERT_TRUE(hit_node != nullptr);
-  ASSERT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-
-  // (50, 505) -> div in second iframe
-  // but with a different event
-  hit_node = HitTestAndWaitForResultWithEvent(gfx::Point(50, 505),
-                                              ax::mojom::Event::kAlert);
-  ASSERT_NE(hit_node, nullptr);
-  ASSERT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-}
-
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingCrossProcessBrowserTest,
-                       HitTestingInCrossProcessIframes) {
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingCrossProcessBrowserTest,
+                       HitTestingInCrossProcessIframeWithScrolling) {
   GURL url_a(embedded_test_server()->GetURL(
-      "a.com", "/accessibility/hit_testing/hit_testing_a.html"));
+      "a.com", "/accessibility/hit_testing/simple_rectangles.html"));
   GURL url_b(embedded_test_server()->GetURL(
-      "b.com", "/accessibility/hit_testing/hit_testing_b.html"));
-  GURL url_c(embedded_test_server()->GetURL(
-      "c.com", "/accessibility/hit_testing/hit_testing_c.html"));
+      "b.com",
+      "/accessibility/hit_testing/simple_rectangles_scrolling_iframe.html"));
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   AccessibilityNotificationWaiter waiter(shell()->web_contents(),
@@ -427,7 +421,7 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingCrossProcessBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url_a));
   waiter.WaitForNotification();
   WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Button A");
+                                                "rectA");
 
   auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
   FrameTreeNode* root = web_contents->GetFrameTree()->root();
@@ -437,97 +431,23 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingCrossProcessBrowserTest,
   NavigateFrameToURL(child, url_b);
   EXPECT_EQ(url_b, child->current_url());
   WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Button B");
-  ASSERT_EQ(1U, child->child_count());
-
-  FrameTreeNode* grand_child = child->child_at(0);
-  NavigateFrameToURL(grand_child, url_c);
-  EXPECT_EQ(url_c, grand_child->current_url());
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Button C");
+                                                "rectF");
 
   FrameTreeVisualizer visualizer;
   EXPECT_EQ(
-      " Site A ------------ proxies for B C\n"
-      "   +--Site B ------- proxies for A C\n"
-      "        +--Site C -- proxies for A B\n"
+      " Site A ------------ proxies for B\n"
+      "   +--Site B ------- proxies for A\n"
       "Where A = http://a.com/\n"
-      "      B = http://b.com/\n"
-      "      C = http://c.com/",
+      "      B = http://b.com/",
       visualizer.DepictFrameTree(root));
 
-  {
-    // (26, 26) -> "Button A"
-    BrowserAccessibility* hit_node;
-    hit_node = HitTestAndWaitForResult(gfx::Point(26, 26));
-    ASSERT_TRUE(hit_node != nullptr);
-    ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-    ASSERT_EQ("Button A",
-              hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-  }
-
-  {
-    // (26, 176) -> "Button B"
-    // 176 = height of div in parent (150), plus button offset (26).
-    BrowserAccessibility* hit_node;
-    hit_node = HitTestAndWaitForResult(gfx::Point(26, 176));
-    ASSERT_TRUE(hit_node != nullptr);
-    ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-    ASSERT_EQ("Button B",
-              hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-  }
-
-  {
-    // (26, 326) -> "Button C"
-    // 326 = 2x height of div in ancestors (300), plus button offset (26).
-    BrowserAccessibility* hit_node;
-    hit_node = HitTestAndWaitForResult(gfx::Point(26, 326));
-    ASSERT_TRUE(hit_node != nullptr);
-    ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-    ASSERT_EQ("Button C",
-              hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-  }
-}
-
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingCrossProcessBrowserTest,
-                       HitTestingInScrolledCrossProcessIframe) {
-  GURL url_a(embedded_test_server()->GetURL(
-      "a.com", "/accessibility/hit_testing/hit_testing_a.html"));
-  GURL url_b(embedded_test_server()->GetURL(
-      "b.com", "/accessibility/hit_testing/hit_testing_b_tall.html"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
-  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
-                                         ui::kAXModeComplete,
-                                         ax::mojom::Event::kLoadComplete);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url_a));
-  waiter.WaitForNotification();
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Button A");
-
-  auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
-  FrameTreeNode* root = web_contents->GetFrameTree()->root();
-  ASSERT_EQ(1U, root->child_count());
-
-  FrameTreeNode* child = root->child_at(0);
-  NavigateFrameToURL(child, url_b);
-  EXPECT_EQ(url_b, child->current_url());
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Button B");
-  ASSERT_EQ(1U, child->child_count());
-
   // Before scrolling.
   {
-    // (26, 476) -> "Button B"
-    // 476 = height of div in parent (150), plus the placeholder div height
-    // (300), plus button offset (26).
-    BrowserAccessibility* hit_node;
-    hit_node = HitTestAndWaitForResult(gfx::Point(26, 476));
-    ASSERT_TRUE(hit_node != nullptr);
-    ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-    ASSERT_EQ("Button B",
-              hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
   }
 
   // Scroll div up 100px.
@@ -543,20 +463,16 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingCrossProcessBrowserTest,
 
   // After scrolling.
   {
-    // (26, 376) -> "Button B"
-    // 376 = height of div in parent (150), plus the placeholder div height
-    // (300), plus button offset (26), less the scroll delta.
-    BrowserAccessibility* hit_node;
-    hit_node = HitTestAndWaitForResult(gfx::Point(26, 476 - scroll_delta));
-    ASSERT_TRUE(hit_node != nullptr);
-    ASSERT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-    ASSERT_EQ("Button B",
-              hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+    gfx::Point rect_g_point(79, 89);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_g_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectG");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_g_point, expected_node, hit_node);
   }
 }
 
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
-                       CachingAsyncHitTestingInIframes) {
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
+                       CachingAsyncHitTestMissesElement) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
@@ -565,14 +481,12 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
                                          ui::kAXModeComplete,
                                          ax::mojom::Event::kLoadComplete);
   GURL url(embedded_test_server()->GetURL(
-      "/accessibility/hit_testing/hit_testing.html"));
+      "/accessibility/hit_testing/simple_rectangles_with_curtain.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
   waiter.WaitForNotification();
 
   WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Ordinary Button");
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Scrolled Button");
+                                                "rectA");
 
   // For each point we try, the first time we call CachingAsyncHitTest it
   // should FAIL and return the wrong object, because this test page has
@@ -581,51 +495,38 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
   // return the correct result (since CallCachingAsyncHitTest waits for the
   // HOVER event to be received).
 
-  // (50, 50) -> "Button"
-  BrowserAccessibility* hit_node;
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 50));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetRole());
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 50));
-  EXPECT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 305) -> div in first iframe
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 305));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 305));
-  EXPECT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
+  // Test a hit on a rect in the main frame.
+  {
+    // First call should land on the wrong element.
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_NE(expected_node->GetName(), hit_node->GetName());
+
+    // Call again and we should get the correct element.
+    hit_node = CallCachingAsyncHitTest(rect_2_point);
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
-  // (50, 350) -> "Ordinary Button"
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 350));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetRole());
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 350));
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Ordinary Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 455) -> "Scrolled Button"
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 455));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetRole());
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 455));
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Scrolled Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 505) -> div in second iframe
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 505));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-  hit_node = CallCachingAsyncHitTest(gfx::Point(50, 505));
-  EXPECT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
+  // Test a hit on a rect in the iframe.
+  {
+    // First call should land on the wrong element.
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_NE(expected_node->GetName(), hit_node->GetName());
+
+    // Call again and we should get the correct element.
+    hit_node = CallCachingAsyncHitTest(rect_b_point);
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 
 #if !defined(OS_ANDROID) && !defined(OS_MACOSX)
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
-                       HitTestingWithPinchZoom) {
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
+                       CachingAsyncHitTest_WithPinchZoom) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
@@ -634,96 +535,39 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
                                          ui::kAXModeComplete,
                                          ax::mojom::Event::kLoadComplete);
 
-  const char url_str[] =
-      "data:text/html,"
-      "<!doctype html>"
-      "<html>"
-      "<head><title>Accessibility Test</title>"
-      "<style>body {margin: 0px;}"
-      "button {display: block; height: 50px; width: 50px}</style>"
-      "</head>"
-      "<body>"
-      "<button>Button 1</button>"
-      "<button>Button 2</button>"
-      "</body></html>";
-
-  GURL url(url_str);
+  GURL url(embedded_test_server()->GetURL(
+      "/accessibility/hit_testing/simple_rectangles.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
   SynchronizeThreads();
   waiter.WaitForNotification();
 
-  BrowserAccessibility* hit_node;
-
-  // Use a tap event instead of a hittest to make sure that we are using
-  // px as input, rather than dips.
-
-  // (10, 10) -> "Button 1"
-  hit_node = TapAndWaitForResult(gfx::Point(10, 10));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 1",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (60, 60) -> No button there, hits the ignored <body> node
-  hit_node = TapAndWaitForResult(gfx::Point(60, 60));
-  EXPECT_NE(nullptr, hit_node);
-  EXPECT_EQ(ax::mojom::Role::kGenericContainer, hit_node->GetRole());
-  EXPECT_TRUE(hit_node->HasState(ax::mojom::State::kIgnored));
-  EXPECT_EQ("body",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kHtmlTag));
-
-  // (10, 60) -> "Button 2"
-  hit_node = TapAndWaitForResult(gfx::Point(10, 60));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 2",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  content::TestPageScaleObserver scale_observer(shell()->web_contents());
-  const gfx::Rect contents_rect = shell()->web_contents()->GetContainerBounds();
-  const gfx::Point pinch_position(contents_rect.x(), contents_rect.y());
-  SimulateGesturePinchSequence(shell()->web_contents(), pinch_position, 2.0f,
-                               blink::WebGestureDevice::kTouchscreen);
-  scale_observer.WaitForPageScaleUpdate();
-
-  // (10, 10) -> "Button 1"
-  hit_node = TapAndWaitForResult(gfx::Point(10, 10));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 1",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (60, 60) -> "Button 1"
-  hit_node = TapAndWaitForResult(gfx::Point(60, 60));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 1",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
+                                                "rectA");
 
-  // (10, 60) -> "Button 1"
-  hit_node = TapAndWaitForResult(gfx::Point(10, 60));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 1",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  // Apply pinch zoom.
+  SimulatePinchZoom(1.25f);
 
-  // (10, 110) -> "Button 2"
-  hit_node = TapAndWaitForResult(gfx::Point(10, 110));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 2",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  // Test a hit on a rect in the main frame.
+  {
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
-  // (190, 190) -> "Button 2"
-  hit_node = TapAndWaitForResult(gfx::Point(90, 190));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button 2",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  // Test a hit on a rect in the iframe.
+  {
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
-                       HitTestingWithPinchZoomAndIframes) {
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
+                       HitTest_WithPinchZoom) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
@@ -733,51 +577,90 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
                                          ax::mojom::Event::kLoadComplete);
 
   GURL url(embedded_test_server()->GetURL(
-      "/accessibility/html/iframe-coordinates.html"));
+      "/accessibility/hit_testing/simple_rectangles.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
   SynchronizeThreads();
   waiter.WaitForNotification();
 
   WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Ordinary Button");
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Scrolled Button");
+                                                "rectA");
 
-  content::TestPageScaleObserver scale_observer(shell()->web_contents());
-  const gfx::Rect contents_rect = shell()->web_contents()->GetContainerBounds();
-  const gfx::Point pinch_position(contents_rect.x(), contents_rect.y());
+  // Apply pinch zoom.
+  SimulatePinchZoom(1.25f);
 
-  SimulateGesturePinchSequence(shell()->web_contents(), pinch_position, 1.25f,
-                               blink::WebGestureDevice::kTouchscreen);
-  scale_observer.WaitForPageScaleUpdate();
+  // Test a hit on a rect in the main frame.
+  {
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
-  BrowserAccessibility* hit_node;
+  // Test a hit on a rect in the iframe.
+  {
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = HitTestAndWaitForResult(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
+}
 
-  // (26, 26) -> No button because of pinch.
-  hit_node = TapAndWaitForResult(gfx::Point(26, 26));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetRole());
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
+                       CachingAsyncHitTestMissesElement_WithPinchZoom) {
+  ASSERT_TRUE(embedded_test_server()->Start());
 
-  // (63, 63) -> "Button"
-  hit_node = TapAndWaitForResult(gfx::Point(63, 63));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
-  // (63, 438) -> "Ordinary Button"
-  hit_node = TapAndWaitForResult(gfx::Point(63, 438));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Ordinary Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ui::kAXModeComplete,
+                                         ax::mojom::Event::kLoadComplete);
+  GURL url(embedded_test_server()->GetURL(
+      "/accessibility/hit_testing/simple_rectangles_with_curtain.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  waiter.WaitForNotification();
 
-  // (63, 569) -> "Scrolled Button"
-  hit_node = TapAndWaitForResult(gfx::Point(63, 569));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetRole());
-  EXPECT_EQ("Scrolled Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
+                                                "rectA");
+
+  // Apply pinch zoom.
+  SimulatePinchZoom(1.25f);
+
+  // For each point we try, the first time we call CachingAsyncHitTest it
+  // should FAIL and return the wrong object, because this test page has
+  // been designed to confound local synchronous hit testing using
+  // z-indexes. However, calling CachingAsyncHitTest a second time should
+  // return the correct result (since CallCachingAsyncHitTest waits for the
+  // HOVER event to be received).
+
+  // Test a hit on a rect in the main frame.
+  {
+    // First call should land on the wrong element.
+    gfx::Point rect_2_point(49, 20);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    EXPECT_NE(expected_node->GetName(), hit_node->GetName());
+
+    // Call again and we should get the correct element.
+    hit_node = CallCachingAsyncHitTest(rect_2_point);
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
+
+  // Test a hit on a rect in the iframe.
+  {
+    // First call should land on the wrong element.
+    gfx::Point rect_b_point(79, 79);
+    BrowserAccessibility* hit_node = CallCachingAsyncHitTest(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    EXPECT_NE(expected_node->GetName(), hit_node->GetName());
+
+    // Call again and we should get the correct element.
+    hit_node = CallCachingAsyncHitTest(rect_b_point);
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 
 #endif  // !defined(OS_ANDROID) && !defined(OS_MACOSX)
@@ -786,7 +669,7 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
 // Chrome OS or Chromecast)
 #if defined(OS_WIN) || \
     (defined(OS_LINUX) && !defined(OS_CHROMEOS) && !BUILDFLAG(IS_CHROMECAST))
-IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingBrowserTest,
                        NearestLeafInIframes) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
@@ -796,77 +679,30 @@ IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
                                          ui::kAXModeComplete,
                                          ax::mojom::Event::kLoadComplete);
   GURL url(embedded_test_server()->GetURL(
-      "/accessibility/hit_testing/hit_testing.html"));
+      "/accessibility/hit_testing/text_ranges.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
   waiter.WaitForNotification();
 
   WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Ordinary Button");
-  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
-                                                "Scrolled Button");
-
-  // For each point we try, the first time we call CachingAsyncHitTest it
-  // should FAIL and return the wrong object, because this test page has
-  // been designed to confound local synchronous hit testing using
-  // z-indexes. However, calling CachingAsyncHitTest a second time should
-  // return the correct result (since CallCachingAsyncHitTest waits for the
-  // HOVER event to be received). CachingAsyncHitTest is called by
-  // GetNearestLeaf
-
-  // (50, 50) -> "Button"
-  ui::AXPlatformNodeBase* hit_node;
-  hit_node = CallNearestLeafNode(gfx::Point(50, 50));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetData().role);
-  hit_node = CallNearestLeafNode(gfx::Point(50, 50));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (280, 50) -> "Button" is still the closest node to the cursor.
-  hit_node = CallNearestLeafNode(gfx::Point(280, 50));
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetData().role);
-  hit_node = CallNearestLeafNode(gfx::Point(280, 50));
-  EXPECT_EQ("Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 305) -> "Ordinary Button" is the closest leaf node.
-  hit_node = CallNearestLeafNode(gfx::Point(50, 305));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetData().role);
-  hit_node = CallNearestLeafNode(gfx::Point(50, 305));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetData().role);
-  EXPECT_EQ("Ordinary Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
-
-  // (50, 350) -> "Ordinary Button". As we are still within the previous cached
-  // hit test's bounds, the subsequent call correctly gets the descendant.
-  hit_node = CallNearestLeafNode(gfx::Point(50, 350));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetData().role);
-  EXPECT_EQ("Ordinary Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+                                                "rectA");
 
-  // (50, 455) -> "Scrolled Button"
-  hit_node = CallNearestLeafNode(gfx::Point(50, 455));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetData().role);
-  hit_node = CallNearestLeafNode(gfx::Point(50, 455));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetData().role);
-  EXPECT_EQ("Scrolled Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  // Test a hit on text in the main frame.
+  {
+    gfx::Point rect_2_point(70, 20);
+    BrowserAccessibility* hit_node = CallNearestLeafNode(rect_2_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kStaticText, "2");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_2_point, expected_node, hit_node);
+  }
 
-  // (50, 505) -> "Scrolled Button"
-  hit_node = CallNearestLeafNode(gfx::Point(50, 505));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_NE(ax::mojom::Role::kButton, hit_node->GetData().role);
-  hit_node = CallNearestLeafNode(gfx::Point(50, 505));
-  ASSERT_TRUE(hit_node != nullptr);
-  EXPECT_EQ(ax::mojom::Role::kButton, hit_node->GetData().role);
-  EXPECT_EQ("Scrolled Button",
-            hit_node->GetStringAttribute(ax::mojom::StringAttribute::kName));
+  // Test a hit on text in the iframe.
+  {
+    gfx::Point rect_b_point(100, 100);
+    BrowserAccessibility* hit_node = CallNearestLeafNode(rect_b_point);
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kStaticText, "B");
+    EXPECT_ACCESSIBILITY_HIT_TEST_RESULT(rect_b_point, expected_node, hit_node);
+  }
 }
 #endif
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/hit_testing_browsertest.h b/chromium/content/browser/accessibility/hit_testing_browsertest.h
new file mode 100644
index 00000000000..05b294cef07
--- /dev/null
+++ b/chromium/content/browser/accessibility/hit_testing_browsertest.h
@@ -0,0 +1,55 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_BROWSERTEST_H_
+#define CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_BROWSERTEST_H_
+
+#include "content/browser/accessibility/accessibility_content_browsertest.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+// First parameter of the tuple = device scale factor
+// Second parameter = whether use-zoom-for-dsf is enabled
+using AccessibilityZoomTestParam = std::tuple<double, bool>;
+
+class AccessibilityHitTestingBrowserTest
+    : public AccessibilityContentBrowserTest,
+      public ::testing::WithParamInterface<AccessibilityZoomTestParam> {
+ public:
+  AccessibilityHitTestingBrowserTest();
+  ~AccessibilityHitTestingBrowserTest() override;
+
+  void SetUpCommandLine(base::CommandLine* command_line) override;
+
+  struct TestPassToString {
+    std::string operator()(
+        const ::testing::TestParamInfo<AccessibilityZoomTestParam>& info) const;
+  };
+
+ protected:
+  BrowserAccessibilityManager* GetRootBrowserAccessibilityManager();
+  float GetDeviceScaleFactor();
+  float GetPageScaleFactor();
+  gfx::Rect GetViewBoundsInScreenCoordinates();
+  gfx::Point CSSToFramePoint(gfx::Point css_point);
+  gfx::Point CSSToPhysicalPixelPoint(gfx::Point css_point);
+  BrowserAccessibility* HitTestAndWaitForResultWithEvent(
+      const gfx::Point& point,
+      ax::mojom::Event event_to_fire);
+  BrowserAccessibility* HitTestAndWaitForResult(const gfx::Point& point);
+  BrowserAccessibility* CallCachingAsyncHitTest(const gfx::Point& page_point);
+  BrowserAccessibility* CallNearestLeafNode(const gfx::Point& page_point);
+  void SynchronizeThreads();
+  base::string16 FormatHitTestAccessibilityTree();
+  std::string GetScopedTrace(gfx::Point css_point);
+  void SimulatePinchZoom(float desired_page_scale);
+
+  float page_scale_ = 1.0f;
+  gfx::Vector2d scroll_offset_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_BROWSERTEST_H_
diff --git a/chromium/content/browser/accessibility/hit_testing_win_browsertest.cc b/chromium/content/browser/accessibility/hit_testing_win_browsertest.cc
new file mode 100644
index 00000000000..810ab398d06
--- /dev/null
+++ b/chromium/content/browser/accessibility/hit_testing_win_browsertest.cc
@@ -0,0 +1,273 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_WIN_BROWSERTEST_H_
+#define CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_WIN_BROWSERTEST_H_
+
+#include "content/browser/accessibility/hit_testing_browsertest.h"
+
+#include "base/win/scoped_variant.h"
+#include "content/browser/accessibility/browser_accessibility.h"
+#include "content/browser/accessibility/browser_accessibility_manager.h"
+#include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "ui/accessibility/accessibility_switches.h"
+
+#include <objbase.h>
+#include <uiautomation.h>
+#include <wrl/client.h>
+
+using Microsoft::WRL::ComPtr;
+
+namespace content {
+
+#define EXPECT_ACCESSIBILITY_WIN_HIT_TEST_RESULT(css_point, expected_unknown, \
+                                                 hit_unknown)                 \
+  SCOPED_TRACE(GetScopedTrace(css_point));                                    \
+  EXPECT_EQ(expected_unknown, hit_unknown);
+
+class AccessibilityHitTestingWinBrowserTest
+    : public AccessibilityHitTestingBrowserTest {
+ public:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    AccessibilityHitTestingBrowserTest::SetUpCommandLine(command_line);
+
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        ::switches::kEnableExperimentalUIAutomation);
+  }
+
+  ComPtr<IAccessible> GetWebContentRootIAccessible() {
+    ComPtr<IAccessible> content_root;
+    GetRootBrowserAccessibilityManager()
+        ->GetRoot()
+        ->GetNativeViewAccessible()
+        ->QueryInterface(IID_PPV_ARGS(&content_root));
+    return content_root;
+  }
+
+  ComPtr<IRawElementProviderFragmentRoot> GetWebContentFragmentRoot() {
+    ComPtr<IRawElementProviderFragment> content_root;
+    GetWebContentRootIAccessible().As(&content_root);
+    ComPtr<IRawElementProviderFragmentRoot> fragment_root;
+    content_root->get_FragmentRoot(&fragment_root);
+    return fragment_root;
+  }
+
+  ComPtr<ITextProvider> GetWebContentRootTextProvider() {
+    ComPtr<IRawElementProviderSimple> content_root;
+    GetWebContentRootIAccessible().As(&content_root);
+    ComPtr<ITextProvider> text_provider;
+    content_root->GetPatternProvider(UIA_TextPatternId, &text_provider);
+    return text_provider;
+  }
+};
+
+INSTANTIATE_TEST_SUITE_P(
+    All,
+    AccessibilityHitTestingWinBrowserTest,
+    ::testing::Combine(::testing::Values(1, 2), ::testing::Bool()),
+    AccessibilityHitTestingBrowserTest::TestPassToString());
+
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingWinBrowserTest, AccHitTest) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
+
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ui::kAXModeComplete,
+                                         ax::mojom::Event::kLoadComplete);
+  GURL url(embedded_test_server()->GetURL(
+      "/accessibility/hit_testing/simple_rectangles.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  waiter.WaitForNotification();
+
+  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
+                                                "rectA");
+
+  ComPtr<IAccessible> root_accessible = GetWebContentRootIAccessible();
+
+  // Test a hit on a rect in the main frame.
+  {
+    gfx::Point rect_2_point(49, 20);
+    gfx::Point rect_2_point_physical = CSSToPhysicalPixelPoint(rect_2_point);
+    base::win::ScopedVariant hit_variant;
+    ASSERT_HRESULT_SUCCEEDED(root_accessible->accHitTest(
+        rect_2_point_physical.x(), rect_2_point_physical.y(),
+        hit_variant.Receive()));
+    ASSERT_EQ(hit_variant.type(), VT_DISPATCH);
+    ComPtr<IAccessible> hit_accessible;
+    ASSERT_HRESULT_SUCCEEDED(hit_variant.ptr()->pdispVal->QueryInterface(
+        IID_PPV_ARGS(&hit_accessible)));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    ComPtr<IAccessible> expected_accessible;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_accessible)));
+    EXPECT_ACCESSIBILITY_WIN_HIT_TEST_RESULT(
+        rect_2_point, expected_accessible.Get(), hit_accessible.Get());
+  }
+
+  // Test a hit on a rect in the iframe.
+  {
+    gfx::Point rect_b_point(79, 79);
+    gfx::Point rect_b_point_physical = CSSToPhysicalPixelPoint(rect_b_point);
+    base::win::ScopedVariant hit_variant;
+    ASSERT_HRESULT_SUCCEEDED(root_accessible->accHitTest(
+        rect_b_point_physical.x(), rect_b_point_physical.y(),
+        hit_variant.Receive()));
+    ASSERT_EQ(hit_variant.type(), VT_DISPATCH);
+    ComPtr<IAccessible> hit_accessible;
+    ASSERT_HRESULT_SUCCEEDED(hit_variant.ptr()->pdispVal->QueryInterface(
+        IID_PPV_ARGS(&hit_accessible)));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    ComPtr<IAccessible> expected_accessible;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_accessible)));
+    EXPECT_ACCESSIBILITY_WIN_HIT_TEST_RESULT(
+        rect_b_point, expected_accessible.Get(), hit_accessible.Get());
+  }
+}
+
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingWinBrowserTest,
+                       ElementProviderFromPoint) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
+
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ui::kAXModeComplete,
+                                         ax::mojom::Event::kLoadComplete);
+  GURL url(embedded_test_server()->GetURL(
+      "/accessibility/hit_testing/simple_rectangles.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  waiter.WaitForNotification();
+
+  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
+                                                "rectA");
+
+  ComPtr<IRawElementProviderFragmentRoot> fragment_root =
+      GetWebContentFragmentRoot();
+
+  // Test a hit on a rect in the main frame.
+  {
+    gfx::Point rect_2_point(49, 20);
+    gfx::Point rect_2_point_physical = CSSToPhysicalPixelPoint(rect_2_point);
+    ComPtr<IRawElementProviderFragment> hit_fragment;
+    ASSERT_HRESULT_SUCCEEDED(fragment_root->ElementProviderFromPoint(
+        rect_2_point_physical.x(), rect_2_point_physical.y(), &hit_fragment));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    ComPtr<IRawElementProviderFragment> expected_fragment;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_fragment)));
+    EXPECT_ACCESSIBILITY_WIN_HIT_TEST_RESULT(
+        rect_2_point, expected_fragment.Get(), hit_fragment.Get());
+  }
+
+  // Test a hit on a rect in the iframe.
+  {
+    gfx::Point rect_b_point(79, 79);
+    gfx::Point rect_b_point_physical = CSSToPhysicalPixelPoint(rect_b_point);
+    ComPtr<IRawElementProviderFragment> hit_fragment;
+    ASSERT_HRESULT_SUCCEEDED(fragment_root->ElementProviderFromPoint(
+        rect_b_point_physical.x(), rect_b_point_physical.y(), &hit_fragment));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    ComPtr<IRawElementProviderFragment> expected_fragment;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_fragment)));
+    EXPECT_EQ(hit_fragment.Get(), expected_fragment.Get());
+    EXPECT_ACCESSIBILITY_WIN_HIT_TEST_RESULT(
+        rect_b_point, expected_fragment.Get(), hit_fragment.Get());
+  }
+}
+
+IN_PROC_BROWSER_TEST_P(AccessibilityHitTestingWinBrowserTest,
+                       TextProviderRangeFromPoint) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
+
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ui::kAXModeComplete,
+                                         ax::mojom::Event::kLoadComplete);
+  GURL url(embedded_test_server()->GetURL(
+      "/accessibility/hit_testing/text_ranges.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  waiter.WaitForNotification();
+
+  WaitForAccessibilityTreeToContainNodeWithName(shell()->web_contents(),
+                                                "rectA");
+
+  ComPtr<ITextProvider> text_provider = GetWebContentRootTextProvider();
+
+  // Test a hit on a text in the main frame.
+  {
+    gfx::Point rect_2_point(70, 20);
+    gfx::Point rect_2_point_physical = CSSToPhysicalPixelPoint(rect_2_point);
+    UiaPoint uia_point;
+    uia_point.x = rect_2_point_physical.x();
+    uia_point.y = rect_2_point_physical.y();
+    ComPtr<ITextRangeProvider> hit_text_range;
+    ASSERT_HRESULT_SUCCEEDED(
+        text_provider->RangeFromPoint(uia_point, &hit_text_range));
+    ASSERT_HRESULT_SUCCEEDED(
+        hit_text_range->ExpandToEnclosingUnit(TextUnit_Character));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rect2");
+    ComPtr<IRawElementProviderSimple> expected_provider;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_provider)));
+    ComPtr<ITextRangeProvider> expected_text_range;
+    ASSERT_HRESULT_SUCCEEDED(text_provider->RangeFromChild(
+        expected_provider.Get(), &expected_text_range));
+
+    SCOPED_TRACE(GetScopedTrace(rect_2_point));
+    BOOL compare_result;
+    ASSERT_HRESULT_SUCCEEDED(
+        hit_text_range->Compare(expected_text_range.Get(), &compare_result));
+    EXPECT_TRUE(compare_result);
+  }
+
+  // Test a hit on a text in the iframe.
+  {
+    gfx::Point rect_b_point(100, 100);
+    gfx::Point rect_b_point_physical = CSSToPhysicalPixelPoint(rect_b_point);
+    UiaPoint uia_point;
+    uia_point.x = rect_b_point_physical.x();
+    uia_point.y = rect_b_point_physical.y();
+    ComPtr<ITextRangeProvider> hit_text_range;
+    ASSERT_HRESULT_SUCCEEDED(
+        text_provider->RangeFromPoint(uia_point, &hit_text_range));
+    ASSERT_HRESULT_SUCCEEDED(
+        hit_text_range->ExpandToEnclosingUnit(TextUnit_Character));
+    BrowserAccessibility* expected_node =
+        FindNode(ax::mojom::Role::kGenericContainer, "rectB");
+    ComPtr<IRawElementProviderSimple> expected_provider;
+    ASSERT_HRESULT_SUCCEEDED(
+        expected_node->GetNativeViewAccessible()->QueryInterface(
+            IID_PPV_ARGS(&expected_provider)));
+    ComPtr<ITextRangeProvider> expected_text_range;
+    ASSERT_HRESULT_SUCCEEDED(text_provider->RangeFromChild(
+        expected_provider.Get(), &expected_text_range));
+
+    SCOPED_TRACE(GetScopedTrace(rect_b_point));
+    BOOL compare_result;
+    ASSERT_HRESULT_SUCCEEDED(
+        hit_text_range->Compare(expected_text_range.Get(), &compare_result));
+    EXPECT_TRUE(compare_result);
+  }
+}
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_ACCESSIBILITY_HIT_TESTING_WIN_BROWSERTEST_H_
diff --git a/chromium/content/browser/accessibility/line_layout_browsertest.cc b/chromium/content/browser/accessibility/line_layout_browsertest.cc
index 14093038968..1280e9bc76b 100644
--- a/chromium/content/browser/accessibility/line_layout_browsertest.cc
+++ b/chromium/content/browser/accessibility/line_layout_browsertest.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
 #include "build/build_config.h"
 #include "content/browser/accessibility/browser_accessibility.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
index 622983533e2..6a36c176910 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
@@ -414,11 +414,6 @@ bool AccessibilityMediaPredicate(BrowserAccessibility* start,
   return tag == "audio" || tag == "video";
 }
 
-bool AccessibilityPopupButtonPredicate(BrowserAccessibility* start,
-                                       BrowserAccessibility* node) {
-  return (node->GetRole() == ax::mojom::Role::kPopUpButton);
-}
-
 bool AccessibilityRadioButtonPredicate(BrowserAccessibility* start,
                                        BrowserAccessibility* node) {
   return (node->GetRole() == ax::mojom::Role::kRadioButton ||
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
index fe0864c586b..27128a08c3a 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
@@ -51,7 +51,6 @@ DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityListItemPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityLiveRegionPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityMainPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityMediaPredicate);
-DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityPopupButtonPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityRadioButtonPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityRadioGroupPredicate);
 DECLARE_ACCESSIBILITY_PREDICATE(AccessibilityTablePredicate);
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
index 2bed95c0cd3..c920deb7adc 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
@@ -29,10 +29,8 @@ class TestBrowserAccessibilityManager
 #else
 class TestBrowserAccessibilityManager : public BrowserAccessibilityManager {
  public:
-  TestBrowserAccessibilityManager(const ui::AXTreeUpdate& initial_tree)
-      : BrowserAccessibilityManager(initial_tree,
-                                    nullptr,
-                                    new BrowserAccessibilityFactory()) {}
+  explicit TestBrowserAccessibilityManager(const ui::AXTreeUpdate& initial_tree)
+      : BrowserAccessibilityManager(initial_tree, nullptr) {}
 };
 #endif
 
diff --git a/chromium/content/browser/accessibility/site_per_process_accessibility_browsertest.cc b/chromium/content/browser/accessibility/site_per_process_accessibility_browsertest.cc
index c2f90fbb680..6c60abaf02d 100644
--- a/chromium/content/browser/accessibility/site_per_process_accessibility_browsertest.cc
+++ b/chromium/content/browser/accessibility/site_per_process_accessibility_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/snapshot_ax_tree_browsertest.cc b/chromium/content/browser/accessibility/snapshot_ax_tree_browsertest.cc
index af1e2929ffb..6d1a247582b 100644
--- a/chromium/content/browser/accessibility/snapshot_ax_tree_browsertest.cc
+++ b/chromium/content/browser/accessibility/snapshot_ax_tree_browsertest.cc
@@ -6,6 +6,7 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
index 65ec2ada0af..9e3fe4f42ca 100644
--- a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
+++ b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
@@ -14,18 +14,17 @@ TestBrowserAccessibilityDelegate::TestBrowserAccessibilityDelegate()
 void TestBrowserAccessibilityDelegate::AccessibilityPerformAction(
     const ui::AXActionData& data) {}
 
-bool TestBrowserAccessibilityDelegate::AccessibilityViewHasFocus() const {
+bool TestBrowserAccessibilityDelegate::AccessibilityViewHasFocus() {
   return false;
 }
 
 void TestBrowserAccessibilityDelegate::AccessibilityViewSetFocus() {}
 
-gfx::Rect TestBrowserAccessibilityDelegate::AccessibilityGetViewBounds() const {
+gfx::Rect TestBrowserAccessibilityDelegate::AccessibilityGetViewBounds() {
   return gfx::Rect();
 }
 
-float TestBrowserAccessibilityDelegate::AccessibilityGetDeviceScaleFactor()
-    const {
+float TestBrowserAccessibilityDelegate::AccessibilityGetDeviceScaleFactor() {
   return 1.0f;
 }
 
@@ -52,7 +51,7 @@ WebContents* TestBrowserAccessibilityDelegate::AccessibilityWebContents() {
   return nullptr;
 }
 
-bool TestBrowserAccessibilityDelegate::AccessibilityIsMainFrame() const {
+bool TestBrowserAccessibilityDelegate::AccessibilityIsMainFrame() {
   return is_root_frame_;
 }
 
diff --git a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
index 1d5d743f6fc..818e827bd32 100644
--- a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
+++ b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
@@ -14,17 +14,17 @@ class TestBrowserAccessibilityDelegate : public BrowserAccessibilityDelegate {
   TestBrowserAccessibilityDelegate();
 
   void AccessibilityPerformAction(const ui::AXActionData& data) override;
-  bool AccessibilityViewHasFocus() const override;
+  bool AccessibilityViewHasFocus() override;
   void AccessibilityViewSetFocus() override;
-  gfx::Rect AccessibilityGetViewBounds() const override;
-  float AccessibilityGetDeviceScaleFactor() const override;
+  gfx::Rect AccessibilityGetViewBounds() override;
+  float AccessibilityGetDeviceScaleFactor() override;
   void AccessibilityFatalError() override;
   gfx::AcceleratedWidget AccessibilityGetAcceleratedWidget() override;
   gfx::NativeViewAccessible AccessibilityGetNativeViewAccessible() override;
   gfx::NativeViewAccessible AccessibilityGetNativeViewAccessibleForWindow()
       override;
   WebContents* AccessibilityWebContents() override;
-  bool AccessibilityIsMainFrame() const override;
+  bool AccessibilityIsMainFrame() override;
 
   bool got_fatal_error() const;
   void reset_got_fatal_error();
diff --git a/chromium/content/browser/accessibility/touch_accessibility_aura_browsertest.cc b/chromium/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
index 4733dfa45f7..5a66cb427af 100644
--- a/chromium/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
+++ b/chromium/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/accessibility/web_contents_accessibility_android.cc b/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
index cf0a02b990d..4633b8e274d 100644
--- a/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
+++ b/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
@@ -295,7 +295,7 @@ ui::AXNode* g_autofill_popup_proxy_node_ax_node = nullptr;
 
 void DeleteAutofillPopupProxy() {
   if (g_autofill_popup_proxy_node) {
-    g_autofill_popup_proxy_node->Destroy();
+    delete g_autofill_popup_proxy_node;
     delete g_autofill_popup_proxy_node_ax_node;
     g_autofill_popup_proxy_node = nullptr;
   }
diff --git a/chromium/content/browser/android/app_web_message_port.cc b/chromium/content/browser/android/app_web_message_port.cc
index 1370b77002e..13993f4c378 100644
--- a/chromium/content/browser/android/app_web_message_port.cc
+++ b/chromium/content/browser/android/app_web_message_port.cc
@@ -2,36 +2,68 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/android/app_web_message_port.h"
+#include "content/public/browser/android/app_web_message_port.h"
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
-#include "base/bind.h"
-#include "base/threading/thread_task_runner_handle.h"
+#include "base/memory/ptr_util.h"
 #include "content/public/android/content_jni_headers/AppWebMessagePort_jni.h"
-#include "mojo/public/cpp/system/message_pipe.h"
 #include "third_party/blink/public/common/messaging/string_message_codec.h"
 
-using blink::MessagePortChannel;
-
 namespace content {
 
+namespace AppWebMessagePort {
+
 // static
-std::vector<blink::MessagePortChannel> AppWebMessagePort::UnwrapJavaArray(
+std::vector<blink::MessagePortDescriptor> UnwrapJavaArray(
     JNIEnv* env,
     const base::android::JavaRef<jobjectArray>& jports) {
-  std::vector<blink::MessagePortChannel> channels;
+  std::vector<blink::MessagePortDescriptor> ports;
   if (!jports.is_null()) {
     for (auto jport : jports.ReadElements<jobject>()) {
-      jint native_port = Java_AppWebMessagePort_releaseNativeHandle(env, jport);
-      channels.push_back(blink::MessagePortChannel(
-          mojo::ScopedMessagePipeHandle(mojo::MessagePipeHandle(native_port))));
+      jlong port_ptr =
+          Java_AppWebMessagePort_releaseNativeMessagePortDescriptor(env, jport);
+      // Ports are heap allocated native objects. Since we are taking ownership
+      // of the object from the Java code we are responsible for cleaning it up.
+      std::unique_ptr<blink::MessagePortDescriptor> port = base::WrapUnique(
+          reinterpret_cast<blink::MessagePortDescriptor*>(port_ptr));
+      ports.push_back(std::move(*port));
     }
   }
-  return channels;
+  return ports;
 }
 
+// static
+base::android::ScopedJavaGlobalRef<jobjectArray> WrapJavaArray(
+    JNIEnv* env,
+    std::vector<blink::MessagePortDescriptor> descriptors) {
+  // Convert to an array of raw blink::MessagePortDescriptor pointers. Ownership
+  // of these objects is passed to Java.
+  std::vector<int64_t> descriptor_ptrs;
+  descriptor_ptrs.reserve(descriptors.size());
+  for (size_t i = 0; i < descriptors.size(); ++i) {
+    blink::MessagePortDescriptor* descriptor =
+        new blink::MessagePortDescriptor(std::move(descriptors[i]));
+    descriptor_ptrs.push_back(reinterpret_cast<int64_t>(descriptor));
+  }
+
+  // Now convert to a Java array.
+  base::android::ScopedJavaLocalRef<jlongArray> native_descriptors =
+      base::android::ToJavaLongArray(env, descriptor_ptrs.data(),
+                                     descriptor_ptrs.size());
+
+  // And finally convert this to a Java array of AppWebMessagePorts.
+  base::android::ScopedJavaLocalRef<jobjectArray> ports =
+      Java_AppWebMessagePort_createFromNativeBlinkMessagePortDescriptors(
+          env, native_descriptors);
+
+  base::android::ScopedJavaGlobalRef<jobjectArray> global_ports(ports);
+  return global_ports;
+}
+
+}  // namespace AppWebMessagePort
+
 base::android::ScopedJavaLocalRef<jstring>
 JNI_AppWebMessagePort_DecodeStringMessage(
     JNIEnv* env,
diff --git a/chromium/content/browser/android/app_web_message_port.h b/chromium/content/browser/android/app_web_message_port.h
deleted file mode 100644
index 2d1f3a4d712..00000000000
--- a/chromium/content/browser/android/app_web_message_port.h
+++ /dev/null
@@ -1,22 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
-#define CONTENT_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
-
-#include "base/android/jni_weak_ref.h"
-#include "third_party/blink/public/common/messaging/message_port_channel.h"
-
-namespace content {
-
-namespace AppWebMessagePort {
-
-std::vector<blink::MessagePortChannel> UnwrapJavaArray(
-    JNIEnv* env,
-    const base::android::JavaRef<jobjectArray>& jports);
-
-}  // namespace AppWebMessagePort
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
diff --git a/chromium/content/browser/android/browser_startup_controller.cc b/chromium/content/browser/android/browser_startup_controller.cc
index bb6c2b43b2a..1ba3c6de0b8 100644
--- a/chromium/content/browser/android/browser_startup_controller.cc
+++ b/chromium/content/browser/android/browser_startup_controller.cc
@@ -8,8 +8,6 @@
 #include "base/android/jni_string.h"
 #include "content/browser/android/content_startup_flags.h"
 #include "content/browser/browser_main_loop.h"
-#include "ppapi/buildflags/buildflags.h"
-
 #include "content/public/android/content_jni_headers/BrowserStartupControllerImpl_jni.h"
 
 using base::android::JavaParamRef;
@@ -38,14 +36,6 @@ static void JNI_BrowserStartupControllerImpl_SetCommandLineFlags(
   SetContentCommandLineFlags(static_cast<bool>(single_process));
 }
 
-static jboolean JNI_BrowserStartupControllerImpl_IsOfficialBuild(JNIEnv* env) {
-#if defined(OFFICIAL_BUILD)
-  return true;
-#else
-  return false;
-#endif
-}
-
 static void JNI_BrowserStartupControllerImpl_FlushStartupTasks(JNIEnv* env) {
   BrowserMainLoop::GetInstance()->SynchronouslyFlushStartupTasks();
 }
diff --git a/chromium/content/browser/android/content_startup_flags.cc b/chromium/content/browser/android/content_startup_flags.cc
index 680ae76ce5c..9fcc54f2f4a 100644
--- a/chromium/content/browser/android/content_startup_flags.cc
+++ b/chromium/content/browser/android/content_startup_flags.cc
@@ -7,7 +7,6 @@
 #include "base/android/build_info.h"
 #include "base/base_switches.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/system/sys_info.h"
 #include "cc/base/switches.h"
 #include "content/public/browser/android/compositor.h"
diff --git a/chromium/content/browser/android/content_ui_event_handler.cc b/chromium/content/browser/android/content_ui_event_handler.cc
index a83b28fb043..5b2621ef435 100644
--- a/chromium/content/browser/android/content_ui_event_handler.cc
+++ b/chromium/content/browser/android/content_ui_event_handler.cc
@@ -31,13 +31,6 @@ ContentUiEventHandler::ContentUiEventHandler(JNIEnv* env,
 
 RenderWidgetHostViewAndroid* ContentUiEventHandler::GetRenderWidgetHostView() {
   RenderWidgetHostView* rwhv = web_contents_->GetRenderWidgetHostView();
-  if (web_contents_->ShowingInterstitialPage()) {
-    rwhv = web_contents_->GetInterstitialPage()
-               ->GetMainFrame()
-               ->GetRenderViewHost()
-               ->GetWidget()
-               ->GetView();
-  }
   return static_cast<RenderWidgetHostViewAndroid*>(rwhv);
 }
 
diff --git a/chromium/content/browser/android/content_url_loader_factory.cc b/chromium/content/browser/android/content_url_loader_factory.cc
index 7803bf587fc..0be595decec 100644
--- a/chromium/content/browser/android/content_url_loader_factory.cc
+++ b/chromium/content/browser/android/content_url_loader_factory.cc
@@ -20,6 +20,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/file_url_loader.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
@@ -28,6 +29,7 @@
 #include "net/base/net_errors.h"
 #include "net/http/http_byte_range.h"
 #include "net/http/http_util.h"
+#include "services/network/public/cpp/cors/cors.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
@@ -108,9 +110,11 @@ class ContentURLLoader : public network::mojom::URLLoader {
   }
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {}
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}
@@ -124,8 +128,28 @@ class ContentURLLoader : public network::mojom::URLLoader {
       const network::ResourceRequest& request,
       mojo::PendingReceiver<network::mojom::URLLoader> loader,
       mojo::PendingRemote<network::mojom::URLLoaderClient> client_remote) {
+    bool disable_web_security =
+        base::CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kDisableWebSecurity);
+    network::mojom::FetchResponseType response_type =
+        network::cors::CalculateResponseType(request.mode,
+                                             disable_web_security);
+
+    // Don't allow content:// requests with kSameOrigin or kCors* unless the
+    // web security is turned off.
+    if ((!disable_web_security &&
+         request.mode == network::mojom::RequestMode::kSameOrigin) ||
+        response_type == network::mojom::FetchResponseType::kCors) {
+      mojo::Remote<network::mojom::URLLoaderClient>(std::move(client_remote))
+          ->OnComplete(
+              network::URLLoaderCompletionStatus(network::CorsErrorStatus(
+                  network::mojom::CorsError::kCorsDisabledScheme)));
+      return;
+    }
+
     auto head = network::mojom::URLResponseHead::New();
     head->request_start = head->response_start = base::TimeTicks::Now();
+    head->response_type = response_type;
     receiver_.Bind(std::move(loader));
     receiver_.set_disconnect_handler(base::BindOnce(
         &ContentURLLoader::OnMojoDisconnect, base::Unretained(this)));
@@ -194,9 +218,8 @@ class ContentURLLoader : public network::mojom::URLLoader {
 
     if (!head->mime_type.empty()) {
       head->headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
-      head->headers->AddHeader(
-          base::StringPrintf("%s: %s", net::HttpRequestHeaders::kContentType,
-                             head->mime_type.c_str()));
+      head->headers->SetHeader(net::HttpRequestHeaders::kContentType,
+                               head->mime_type);
     }
 
     client->OnReceiveResponse(std::move(head));
diff --git a/chromium/content/browser/android/content_view_statics.cc b/chromium/content/browser/android/content_view_statics.cc
index 4de0ef22b73..d03ec360ac6 100644
--- a/chromium/content/browser/android/content_view_statics.cc
+++ b/chromium/content/browser/android/content_view_statics.cc
@@ -8,8 +8,8 @@
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
 #include "base/android/scoped_java_ref.h"
+#include "base/check.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/common/view_messages.h"
 #include "content/public/android/content_jni_headers/ContentViewStaticsImpl_jni.h"
diff --git a/chromium/content/browser/android/gesture_listener_manager.cc b/chromium/content/browser/android/gesture_listener_manager.cc
index 3609cf16141..3a0e3d7b3b8 100644
--- a/chromium/content/browser/android/gesture_listener_manager.cc
+++ b/chromium/content/browser/android/gesture_listener_manager.cc
@@ -27,39 +27,39 @@ namespace {
 
 int ToGestureEventType(WebInputEvent::Type type) {
   switch (type) {
-    case WebInputEvent::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollBegin:
       return ui::GESTURE_EVENT_TYPE_SCROLL_START;
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollEnd:
       return ui::GESTURE_EVENT_TYPE_SCROLL_END;
-    case WebInputEvent::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureScrollUpdate:
       return ui::GESTURE_EVENT_TYPE_SCROLL_BY;
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       return ui::GESTURE_EVENT_TYPE_FLING_START;
-    case WebInputEvent::kGestureFlingCancel:
+    case WebInputEvent::Type::kGestureFlingCancel:
       return ui::GESTURE_EVENT_TYPE_FLING_CANCEL;
-    case WebInputEvent::kGestureShowPress:
+    case WebInputEvent::Type::kGestureShowPress:
       return ui::GESTURE_EVENT_TYPE_SHOW_PRESS;
-    case WebInputEvent::kGestureTap:
+    case WebInputEvent::Type::kGestureTap:
       return ui::GESTURE_EVENT_TYPE_SINGLE_TAP_CONFIRMED;
-    case WebInputEvent::kGestureTapUnconfirmed:
+    case WebInputEvent::Type::kGestureTapUnconfirmed:
       return ui::GESTURE_EVENT_TYPE_SINGLE_TAP_UNCONFIRMED;
-    case WebInputEvent::kGestureTapDown:
+    case WebInputEvent::Type::kGestureTapDown:
       return ui::GESTURE_EVENT_TYPE_TAP_DOWN;
-    case WebInputEvent::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureTapCancel:
       return ui::GESTURE_EVENT_TYPE_TAP_CANCEL;
-    case WebInputEvent::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
       return ui::GESTURE_EVENT_TYPE_DOUBLE_TAP;
-    case WebInputEvent::kGestureLongPress:
+    case WebInputEvent::Type::kGestureLongPress:
       return ui::GESTURE_EVENT_TYPE_LONG_PRESS;
-    case WebInputEvent::kGestureLongTap:
+    case WebInputEvent::Type::kGestureLongTap:
       return ui::GESTURE_EVENT_TYPE_LONG_TAP;
-    case WebInputEvent::kGesturePinchBegin:
+    case WebInputEvent::Type::kGesturePinchBegin:
       return ui::GESTURE_EVENT_TYPE_PINCH_BEGIN;
-    case WebInputEvent::kGesturePinchEnd:
+    case WebInputEvent::Type::kGesturePinchEnd:
       return ui::GESTURE_EVENT_TYPE_PINCH_END;
-    case WebInputEvent::kGesturePinchUpdate:
+    case WebInputEvent::Type::kGesturePinchUpdate:
       return ui::GESTURE_EVENT_TYPE_PINCH_BY;
-    case WebInputEvent::kGestureTwoFingerTap:
+    case WebInputEvent::Type::kGestureTwoFingerTap:
     default:
       NOTREACHED() << "Invalid source gesture type: "
                    << WebInputEvent::GetName(type);
@@ -139,7 +139,7 @@ void GestureListenerManager::SetMultiTouchZoomSupportEnabled(
 
 void GestureListenerManager::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // This is called to fix crash happening while WebContents is being
   // destroyed. See https://crbug.com/803244#c20
   if (web_contents_->IsBeingDestroyed())
@@ -149,8 +149,8 @@ void GestureListenerManager::GestureEventAck(
   if (j_obj.is_null())
     return;
   Java_GestureListenerManagerImpl_onEventAck(
-      env, j_obj, event.GetType(),
-      ack_result == INPUT_EVENT_ACK_STATE_CONSUMED);
+      env, j_obj, static_cast<int>(event.GetType()),
+      ack_result == blink::mojom::InputEventResultState::kConsumed);
 }
 
 void GestureListenerManager::DidStopFlinging() {
@@ -162,10 +162,10 @@ void GestureListenerManager::DidStopFlinging() {
 }
 
 bool GestureListenerManager::FilterInputEvent(const WebInputEvent& event) {
-  if (event.GetType() != WebInputEvent::kGestureTap &&
-      event.GetType() != WebInputEvent::kGestureLongTap &&
-      event.GetType() != WebInputEvent::kGestureLongPress &&
-      event.GetType() != WebInputEvent::kMouseDown)
+  if (event.GetType() != WebInputEvent::Type::kGestureTap &&
+      event.GetType() != WebInputEvent::Type::kGestureLongTap &&
+      event.GetType() != WebInputEvent::Type::kGestureLongPress &&
+      event.GetType() != WebInputEvent::Type::kMouseDown)
     return false;
 
   JNIEnv* env = AttachCurrentThread();
@@ -175,7 +175,7 @@ bool GestureListenerManager::FilterInputEvent(const WebInputEvent& event) {
 
   web_contents_->GetNativeView()->RequestFocus();
 
-  if (event.GetType() == WebInputEvent::kMouseDown)
+  if (event.GetType() == WebInputEvent::Type::kMouseDown)
     return false;
 
   const WebGestureEvent& gesture = static_cast<const WebGestureEvent&>(event);
diff --git a/chromium/content/browser/android/gesture_listener_manager.h b/chromium/content/browser/android/gesture_listener_manager.h
index 6f97c1c6358..12c831f4ed8 100644
--- a/chromium/content/browser/android/gesture_listener_manager.h
+++ b/chromium/content/browser/android/gesture_listener_manager.h
@@ -9,7 +9,7 @@
 #include "base/android/scoped_java_ref.h"
 #include "base/macros.h"
 #include "content/browser/android/render_widget_host_connector.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace blink {
 class WebGestureEvent;
@@ -44,7 +44,7 @@ class CONTENT_EXPORT GestureListenerManager : public RenderWidgetHostConnector {
       const base::android::JavaParamRef<jobject>& obj,
       jboolean enabled);
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultState ack_result);
   void DidStopFlinging();
   bool FilterInputEvent(const blink::WebInputEvent& event);
 
diff --git a/chromium/content/browser/android/java/gin_java_script_to_java_types_coercion.cc b/chromium/content/browser/android/java/gin_java_script_to_java_types_coercion.cc
index 84fd5489a41..0d2d8226dc7 100644
--- a/chromium/content/browser/android/java/gin_java_script_to_java_types_coercion.cc
+++ b/chromium/content/browser/android/java/gin_java_script_to_java_types_coercion.cc
@@ -11,6 +11,8 @@
 
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/browser/android/java/java_type.cc b/chromium/content/browser/android/java/java_type.cc
index 2322cacbd35..0fc14a5813e 100644
--- a/chromium/content/browser/android/java/java_type.cc
+++ b/chromium/content/browser/android/java/java_type.cc
@@ -4,7 +4,8 @@
 
 #include "content/browser/android/java/java_type.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 
 namespace content {
diff --git a/chromium/content/browser/android/message_port_descriptor.cc b/chromium/content/browser/android/message_port_descriptor.cc
index 2cb32fcddee..fa2587c233d 100644
--- a/chromium/content/browser/android/message_port_descriptor.cc
+++ b/chromium/content/browser/android/message_port_descriptor.cc
@@ -19,52 +19,6 @@
 using base::android::JavaRef;
 using base::android::ScopedJavaLocalRef;
 
-namespace blink {
-
-// Helper that provides access to protected member functions of
-// blink::MessagePortDescriptor.
-class MessagePortJavaAccess {
- public:
-  static MessagePortDescriptor::InstrumentationDelegate* GetDelegate() {
-    return MessagePortDescriptor::GetInstrumentationDelegate();
-  }
-
-  static mojo::ScopedMessagePipeHandle TakeHandleToEntangleWithEmbedder(
-      blink::MessagePortDescriptor* message_port_descriptor) {
-    return message_port_descriptor->TakeHandleToEntangleWithEmbedder();
-  }
-
-  static void GiveDisentangledHandle(
-      blink::MessagePortDescriptor* message_port_descriptor,
-      mojo::ScopedMessagePipeHandle handle) {
-    message_port_descriptor->GiveDisentangledHandle(std::move(handle));
-  }
-
-  static void Init(blink::MessagePortDescriptor* message_port_descriptor,
-                   mojo::ScopedMessagePipeHandle handle,
-                   const base::UnguessableToken& id,
-                   uint64_t sequence_number) {
-    message_port_descriptor->Init(std::move(handle), id, sequence_number);
-  }
-
-  static mojo::ScopedMessagePipeHandle TakeHandle(
-      blink::MessagePortDescriptor* message_port_descriptor) {
-    return message_port_descriptor->TakeHandle();
-  }
-
-  static base::UnguessableToken TakeId(
-      blink::MessagePortDescriptor* message_port_descriptor) {
-    return message_port_descriptor->TakeId();
-  }
-
-  static uint64_t TakeSequenceNumber(
-      blink::MessagePortDescriptor* message_port_descriptor) {
-    return message_port_descriptor->TakeSequenceNumber();
-  }
-};
-
-}  // namespace blink
-
 namespace {
 
 mojo::ScopedMessagePipeHandle WrapNativeHandle(jint native_handle) {
@@ -103,8 +57,8 @@ JNI_EXPORT jlong JNI_AppWebMessagePortDescriptor_Create(JNIEnv* env,
   // Ownership is passed to the Java code. This is cleaned up when
   // CloseAndDestroy is called.
   blink::MessagePortDescriptor* port = new blink::MessagePortDescriptor();
-  blink::MessagePortJavaAccess::Init(port, WrapNativeHandle(native_handle), id,
-                                     sequence_number);
+  port->InitializeFromSerializedValues(WrapNativeHandle(native_handle), id,
+                                       sequence_number);
 
   return reinterpret_cast<jlong>(port);
 }
@@ -119,10 +73,10 @@ JNI_EXPORT jint JNI_AppWebMessagePortDescriptor_TakeHandleToEntangle(
   DCHECK(!message_port_descriptor->IsEntangled());
 
   // Ownership of the underlying native handle is passed to Java. It is returned
-  // before tear-down via GiveDisentangledHandle.
+  // before tear-down via "giveDisentangledHandle", or marked as having been
+  // closed via "onConnectionError".
   mojo::ScopedMessagePipeHandle handle =
-      blink::MessagePortJavaAccess::TakeHandleToEntangleWithEmbedder(
-          message_port_descriptor);
+      message_port_descriptor->TakeHandleToEntangleWithEmbedder();
 
   return static_cast<jint>(handle.release().value());
 }
@@ -137,8 +91,24 @@ JNI_EXPORT void JNI_AppWebMessagePortDescriptor_GiveDisentangledHandle(
   DCHECK(message_port_descriptor->IsValid());
   DCHECK(message_port_descriptor->IsEntangled());
 
-  blink::MessagePortJavaAccess::GiveDisentangledHandle(
-      message_port_descriptor, WrapNativeHandle(native_handle));
+  message_port_descriptor->GiveDisentangledHandle(
+      WrapNativeHandle(native_handle));
+}
+
+JNI_EXPORT void JNI_AppWebMessagePortDescriptor_OnConnectionError(
+    JNIEnv* env,
+    jlong native_message_port_decriptor) {
+  blink::MessagePortDescriptor* message_port_descriptor =
+      reinterpret_cast<blink::MessagePortDescriptor*>(
+          native_message_port_decriptor);
+  DCHECK(message_port_descriptor->IsValid());
+  DCHECK(message_port_descriptor->IsEntangled());
+
+  // Return an empty message pipe.
+  // TODO(chrisha): Once MessagePortDescriptor vends Connectors directly,
+  // this should use a dedicated member function much like the Java counterpart.
+  message_port_descriptor->GiveDisentangledHandle(
+      mojo::ScopedMessagePipeHandle());
 }
 
 JNI_EXPORT ScopedJavaLocalRef<jlongArray>
@@ -153,11 +123,10 @@ JNI_AppWebMessagePortDescriptor_PassSerialized(
 
   // Tear down and free the native object.
   mojo::ScopedMessagePipeHandle handle =
-      blink::MessagePortJavaAccess::TakeHandle(message_port_descriptor);
-  base::UnguessableToken id =
-      blink::MessagePortJavaAccess::TakeId(message_port_descriptor);
+      message_port_descriptor->TakeHandleForSerialization();
+  base::UnguessableToken id = message_port_descriptor->TakeIdForSerialization();
   uint64_t sequence_number =
-      blink::MessagePortJavaAccess::TakeSequenceNumber(message_port_descriptor);
+      message_port_descriptor->TakeSequenceNumberForSerialization();
   delete message_port_descriptor;
 
   // Serialize its contents and pass to the Java implementation.
@@ -180,3 +149,26 @@ JNI_EXPORT void JNI_AppWebMessagePortDescriptor_CloseAndDestroy(
   message_port_descriptor->Reset();
   delete message_port_descriptor;
 }
+
+JNI_EXPORT void JNI_AppWebMessagePortDescriptor_DisentangleCloseAndDestroy(
+    JNIEnv* env,
+    jlong native_message_port_descriptor) {
+  DCHECK_NE(0u, native_message_port_descriptor);
+  blink::MessagePortDescriptor* message_port_descriptor =
+      reinterpret_cast<blink::MessagePortDescriptor*>(
+          native_message_port_descriptor);
+  // The descriptor should be valid.
+  DCHECK(message_port_descriptor->IsValid());
+
+  // If the descriptor is entangled, then disentangle it with a dummy handle.
+  // This is because the handle has actually been closed down directly by the
+  // Java code.
+  if (message_port_descriptor->IsEntangled()) {
+    message_port_descriptor->GiveDisentangledHandle(
+        mojo::ScopedMessagePipeHandle());
+  }
+
+  // Reset it and finally delete the object.
+  message_port_descriptor->Reset();
+  delete message_port_descriptor;
+}
\ No newline at end of file
diff --git a/chromium/content/browser/android/overscroll_controller_android.cc b/chromium/content/browser/android/overscroll_controller_android.cc
index 7c20c8f16a5..af013af38de 100644
--- a/chromium/content/browser/android/overscroll_controller_android.cc
+++ b/chromium/content/browser/android/overscroll_controller_android.cc
@@ -151,23 +151,23 @@ bool OverscrollControllerAndroid::WillHandleGestureEvent(
 
   bool handled = false;
   switch (event.GetType()) {
-    case blink::WebInputEvent::kGestureScrollBegin:
+    case blink::WebInputEvent::Type::kGestureScrollBegin:
       refresh_effect_->OnScrollBegin(
           gfx::ScalePoint(event.PositionInWidget(), dpi_scale_));
       break;
 
-    case blink::WebInputEvent::kGestureScrollUpdate: {
+    case blink::WebInputEvent::Type::kGestureScrollUpdate: {
       gfx::Vector2dF scroll_delta(event.data.scroll_update.delta_x,
                                   event.data.scroll_update.delta_y);
       scroll_delta.Scale(dpi_scale_);
       handled = refresh_effect_->WillHandleScrollUpdate(scroll_delta);
     } break;
 
-    case blink::WebInputEvent::kGestureScrollEnd:
+    case blink::WebInputEvent::Type::kGestureScrollEnd:
       refresh_effect_->OnScrollEnd(gfx::Vector2dF());
       break;
 
-    case blink::WebInputEvent::kGestureFlingStart: {
+    case blink::WebInputEvent::Type::kGestureFlingStart: {
       if (refresh_effect_->IsActive()) {
         gfx::Vector2dF scroll_velocity(event.data.fling_start.velocity_x,
                                        event.data.fling_start.velocity_y);
@@ -187,7 +187,7 @@ bool OverscrollControllerAndroid::WillHandleGestureEvent(
       }
     } break;
 
-    case blink::WebInputEvent::kGesturePinchBegin:
+    case blink::WebInputEvent::Type::kGesturePinchBegin:
       refresh_effect_->ReleaseWithoutActivation();
       break;
 
@@ -200,22 +200,22 @@ bool OverscrollControllerAndroid::WillHandleGestureEvent(
 
 void OverscrollControllerAndroid::OnGestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   if (!enabled_)
     return;
 
   // The overscroll effect requires an explicit release signal that may not be
   // sent from the renderer compositor.
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd ||
-      event.GetType() == blink::WebInputEvent::kGestureFlingStart) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd ||
+      event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart) {
     OnOverscrolled(DidOverscrollParams());
   }
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate &&
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate &&
       refresh_effect_) {
     // The effect should only be allowed if the scroll events go unconsumed.
     if (refresh_effect_->IsAwaitingScrollUpdateAck() &&
-        ack_result == INPUT_EVENT_ACK_STATE_CONSUMED) {
+        ack_result == blink::mojom::InputEventResultState::kConsumed) {
       refresh_effect_->Reset();
     }
   }
diff --git a/chromium/content/browser/android/overscroll_controller_android.h b/chromium/content/browser/android/overscroll_controller_android.h
index 42bbdd76aee..2ff14f62902 100644
--- a/chromium/content/browser/android/overscroll_controller_android.h
+++ b/chromium/content/browser/android/overscroll_controller_android.h
@@ -11,7 +11,7 @@
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/android/overscroll_glow.h"
 #include "ui/android/overscroll_refresh.h"
 #include "ui/gfx/geometry/vector2d_f.h"
@@ -56,7 +56,7 @@ class CONTENT_EXPORT OverscrollControllerAndroid
 
   // To be called upon receipt of a gesture event ack.
   void OnGestureEventAck(const blink::WebGestureEvent& event,
-                         InputEventAckState ack_result);
+                         blink::mojom::InputEventResultState ack_result);
 
   // To be called upon receipt of an overscroll event.
   void OnOverscrolled(const ui::DidOverscrollParams& overscroll_params);
diff --git a/chromium/content/browser/android/overscroll_controller_android_unittest.cc b/chromium/content/browser/android/overscroll_controller_android_unittest.cc
index 787ccedd26d..ab6cd0d1d56 100644
--- a/chromium/content/browser/android/overscroll_controller_android_unittest.cc
+++ b/chromium/content/browser/android/overscroll_controller_android_unittest.cc
@@ -35,7 +35,7 @@ namespace {
 class MockCompositor : public WindowAndroidCompositor {
  public:
   ~MockCompositor() override {}
-  void AttachLayerForReadback(scoped_refptr<cc::Layer>) override {}
+  std::unique_ptr<ReadbackRef> TakeReadbackRef() override { return nullptr; }
   void RequestCopyOfOutputOnRootLayer(
       std::unique_ptr<viz::CopyOutputRequest>) override {}
   void SetNeedsAnimate() override {}
@@ -207,10 +207,11 @@ TEST_F(OverscrollControllerAndroidUnitTest,
   controller_->OnOverscrolled(params);
 
   // Generate a consumed scroll update.
-  blink::WebGestureEvent event(blink::WebInputEvent::kGestureScrollUpdate,
+  blink::WebGestureEvent event(blink::WebInputEvent::Type::kGestureScrollUpdate,
                                blink::WebInputEvent::kNoModifiers,
                                ui::EventTimeForNow());
-  controller_->OnGestureEventAck(event, INPUT_EVENT_ACK_STATE_CONSUMED);
+  controller_->OnGestureEventAck(
+      event, blink::mojom::InputEventResultState::kConsumed);
 
   testing::Mock::VerifyAndClearExpectations(&refresh_);
 }
diff --git a/chromium/content/browser/android/render_widget_host_connector.cc b/chromium/content/browser/android/render_widget_host_connector.cc
index fcd28dfdc11..661519bf455 100644
--- a/chromium/content/browser/android/render_widget_host_connector.cc
+++ b/chromium/content/browser/android/render_widget_host_connector.cc
@@ -4,7 +4,6 @@
 
 #include "content/browser/android/render_widget_host_connector.h"
 
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_android.h"
 #include "content/browser/web_contents/web_contents_android.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -75,10 +74,6 @@ void RenderWidgetHostConnector::Observer::RenderViewHostChanged(
     RenderViewHost* old_host,
     RenderViewHost* new_host) {
   // |RenderViewHostChanged| is called only for main rwhva change.
-  // No need to update connection if an interstitial page is active.
-  if (web_contents()->ShowingInterstitialPage())
-    return;
-
   auto* new_view = new_host ? static_cast<RenderWidgetHostViewBase*>(
                                   new_host->GetWidget()->GetView())
                             : nullptr;
@@ -137,15 +132,6 @@ void RenderWidgetHostConnector::Observer::UpdateRenderWidgetHostView(
 RenderWidgetHostViewAndroid*
 RenderWidgetHostConnector::Observer::GetRenderWidgetHostViewAndroid() const {
   RenderWidgetHostView* rwhv = web_contents()->GetRenderWidgetHostView();
-  WebContentsImpl* web_contents_impl =
-      static_cast<WebContentsImpl*>(web_contents());
-  if (web_contents_impl->ShowingInterstitialPage()) {
-    rwhv = web_contents_impl->GetInterstitialPage()
-               ->GetMainFrame()
-               ->GetRenderViewHost()
-               ->GetWidget()
-               ->GetView();
-  }
   DCHECK(!rwhv || !static_cast<RenderWidgetHostViewBase*>(rwhv)
                        ->IsRenderWidgetHostViewChildFrame());
   return static_cast<RenderWidgetHostViewAndroid*>(rwhv);
diff --git a/chromium/content/browser/android/render_widget_host_connector_browsertest.cc b/chromium/content/browser/android/render_widget_host_connector_browsertest.cc
index 1d692dc48ed..7739a969e81 100644
--- a/chromium/content/browser/android/render_widget_host_connector_browsertest.cc
+++ b/chromium/content/browser/android/render_widget_host_connector_browsertest.cc
@@ -4,8 +4,7 @@
 
 #include "content/browser/android/render_widget_host_connector_browsertest.h"
 
-#include "content/browser/frame_host/interstitial_page_impl.h"
-#include "content/public/browser/interstitial_page_delegate.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/test/content_browser_test_utils_internal.h"
@@ -15,16 +14,6 @@
 
 namespace content {
 
-namespace {
-
-class TestInterstitialDelegate : public InterstitialPageDelegate {
- private:
-  // InterstitialPageDelegate implementation.
-  std::string GetHTMLContents() override { return "<p>Interstitial</p>"; }
-};
-
-}  // namespace
-
 RenderWidgetHostConnectorTest::RenderWidgetHostConnectorTest() {}
 
 void RenderWidgetHostConnectorTest::SetUpOnMainThread() {
@@ -71,54 +60,6 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostConnectorTest,
   EXPECT_EQ(new_rwhva, connector->GetRWHVAForTesting());
 }
 
-IN_PROC_BROWSER_TEST_F(RenderWidgetHostConnectorTest,
-                       RestoreMainRWHVAAfterInterstitial) {
-  EXPECT_TRUE(
-      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
-
-  RenderWidgetHostViewAndroid* main_rwhva = render_widget_host_view_android();
-  RenderWidgetHostConnector* connector = render_widget_host_connector();
-  EXPECT_EQ(main_rwhva, connector->GetRWHVAForTesting());
-
-  // Show an interstitial and then hide. Then interstitial RWHVA should be
-  // updated accordingly, and the old main RWHVA reference should be restored.
-  WebContentsImpl* contents = web_contents();
-  GURL interstitial_url("http://interstitial");
-  InterstitialPageImpl* interstitial = new InterstitialPageImpl(
-      contents, static_cast<RenderWidgetHostDelegate*>(contents), true,
-      interstitial_url, new TestInterstitialDelegate);
-  interstitial->Show();
-  WaitForInterstitialAttach(contents);
-  EXPECT_NE(main_rwhva, connector->GetRWHVAForTesting());
-
-  interstitial->Hide();
-  EXPECT_EQ(main_rwhva, connector->GetRWHVAForTesting());
-}
-
-IN_PROC_BROWSER_TEST_F(RenderWidgetHostConnectorTest,
-                       MainPageDestroyedWhileInBackground) {
-  EXPECT_TRUE(
-      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
-
-  RenderWidgetHostViewAndroid* main_rwhva = render_widget_host_view_android();
-  RenderWidgetHostConnector* connector = render_widget_host_connector();
-  EXPECT_EQ(main_rwhva, connector->GetRWHVAForTesting());
-
-  // Show an interstitial and destroy the main page in the background.
-  WebContentsImpl* contents = web_contents();
-  GURL interstitial_url("http://interstitial");
-  InterstitialPageImpl* interstitial = new InterstitialPageImpl(
-      contents, static_cast<RenderWidgetHostDelegate*>(contents), true,
-      interstitial_url, new TestInterstitialDelegate);
-  interstitial->Show();
-  WaitForInterstitialAttach(contents);
-  main_rwhva->Destroy();
-
-  // Ensure active RWHVA set to null even when the main one is destroyed first.
-  interstitial->Hide();
-  EXPECT_EQ(nullptr, connector->GetRWHVAForTesting());
-}
-
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostConnectorTest, DestroyEarly) {
   EXPECT_TRUE(
       NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
diff --git a/chromium/content/browser/android/select_popup.cc b/chromium/content/browser/android/select_popup.cc
index f6561ffadd4..068f8194415 100644
--- a/chromium/content/browser/android/select_popup.cc
+++ b/chromium/content/browser/android/select_popup.cc
@@ -10,8 +10,6 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_contents/web_contents_view_android.h"
 #include "content/public/android/content_jni_headers/SelectPopup_jni.h"
-#include "content/public/browser/render_frame_host.h"
-#include "content/public/common/menu_item.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "ui/gfx/geometry/rect_f.h"
 
@@ -54,19 +52,25 @@ SelectPopup::~SelectPopup() {
   if (j_obj.is_null())
     return;
   Java_SelectPopup_onNativeDestroyed(env, j_obj);
+  popup_client_.reset();
 }
 
-void SelectPopup::ShowMenu(RenderFrameHost* frame,
-                           const gfx::Rect& bounds,
-                           const std::vector<MenuItem>& items,
-                           int selected_item,
-                           bool multiple,
-                           bool right_aligned) {
+void SelectPopup::ShowMenu(
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+    const gfx::Rect& bounds,
+    std::vector<blink::mojom::MenuItemPtr> items,
+    int selected_item,
+    bool multiple,
+    bool right_aligned) {
   JNIEnv* env = AttachCurrentThread();
   ScopedJavaLocalRef<jobject> j_obj = java_obj_.get(env);
   if (j_obj.is_null())
     return;
 
+  // Hide the popup menu if the mojo connection is still open.
+  if (popup_client_)
+    HideMenu();
+
   // For multi-select list popups we find the list of previous selections by
   // iterating through the items. But for single selection popups we take the
   // given |selected_item| as is.
@@ -75,7 +79,7 @@ void SelectPopup::ShowMenu(RenderFrameHost* frame,
     std::unique_ptr<jint[]> native_selected_array(new jint[items.size()]);
     size_t selected_count = 0;
     for (size_t i = 0; i < items.size(); ++i) {
-      if (items[i].checked)
+      if (items[i]->checked)
         native_selected_array[selected_count++] = i;
     }
 
@@ -91,14 +95,14 @@ void SelectPopup::ShowMenu(RenderFrameHost* frame,
 
   ScopedJavaLocalRef<jintArray> enabled_array(env,
                                               env->NewIntArray(items.size()));
-  std::vector<base::string16> labels;
+  std::vector<std::string> labels;
   labels.reserve(items.size());
   for (size_t i = 0; i < items.size(); ++i) {
-    labels.push_back(items[i].label);
-    jint enabled = (items[i].type == MenuItem::GROUP
+    labels.push_back(items[i]->label.value_or(""));
+    jint enabled = (items[i]->type == blink::mojom::MenuItem::Type::kGroup
                         ? POPUP_ITEM_TYPE_GROUP
-                        : (items[i].enabled ? POPUP_ITEM_TYPE_ENABLED
-                                            : POPUP_ITEM_TYPE_DISABLED));
+                        : (items[i]->enabled ? POPUP_ITEM_TYPE_ENABLED
+                                             : POPUP_ITEM_TYPE_DISABLED));
     env->SetIntArrayRegion(enabled_array.obj(), i, 1, &enabled);
   }
   ScopedJavaLocalRef<jobjectArray> items_array(
@@ -108,15 +112,20 @@ void SelectPopup::ShowMenu(RenderFrameHost* frame,
   const ScopedJavaLocalRef<jobject> popup_view = popup_view_.view();
   if (popup_view.is_null())
     return;
-  // |bounds| is in physical pixels if --use-zoom-for-dsf is enabled. Otherwise,
-  // it is in DIP pixels.
+
+  popup_client_.Bind(std::move(popup_client));
+  popup_client_.set_disconnect_handler(
+      base::BindOnce(&SelectPopup::HideMenu, base::Unretained(this)));
+
+  // |bounds| is in physical pixels if --use-zoom-for-dsf is enabled.
+  // Otherwise, it is in DIP pixels.
   gfx::RectF bounds_dip = gfx::RectF(bounds);
   if (IsUseZoomForDSFEnabled())
     bounds_dip.Scale(1 / web_contents_->GetNativeView()->GetDipScale());
   view->SetAnchorRect(popup_view, bounds_dip);
-  Java_SelectPopup_show(env, j_obj, popup_view,
-                        reinterpret_cast<intptr_t>(frame), items_array,
-                        enabled_array, multiple, selected_array, right_aligned);
+  Java_SelectPopup_show(
+      env, j_obj, popup_view, reinterpret_cast<jlong>(popup_client_.get()),
+      items_array, enabled_array, multiple, selected_array, right_aligned);
 }
 
 void SelectPopup::HideMenu() {
@@ -125,23 +134,25 @@ void SelectPopup::HideMenu() {
   if (!j_obj.is_null())
     Java_SelectPopup_hideWithoutCancel(env, j_obj);
   popup_view_.Reset();
+  popup_client_.reset();
 }
 
 void SelectPopup::SelectMenuItems(JNIEnv* env,
                                   const JavaParamRef<jobject>& obj,
-                                  jlong selectPopupSourceFrame,
+                                  jlong selectPopupDelegate,
                                   const JavaParamRef<jintArray>& indices) {
-  RenderFrameHostImpl* rfhi =
-      reinterpret_cast<RenderFrameHostImpl*>(selectPopupSourceFrame);
-  DCHECK(rfhi);
+  blink::mojom::PopupMenuClient* popup_client_raw_ptr =
+      reinterpret_cast<blink::mojom::PopupMenuClient*>(selectPopupDelegate);
+  DCHECK(popup_client_raw_ptr && popup_client_.get() == popup_client_raw_ptr);
+
   if (indices == NULL) {
-    rfhi->DidCancelPopupMenu();
+    popup_client_->DidCancel();
     return;
   }
 
   std::vector<int> selected_indices;
   base::android::JavaIntArrayToIntVector(env, indices, &selected_indices);
-  rfhi->DidSelectPopupMenuItems(selected_indices);
+  popup_client_->DidAcceptIndices(selected_indices);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/android/select_popup.h b/chromium/content/browser/android/select_popup.h
index 3ef5def0c0a..9edb8cc8d95 100644
--- a/chromium/content/browser/android/select_popup.h
+++ b/chromium/content/browser/android/select_popup.h
@@ -9,6 +9,9 @@
 
 #include "base/android/jni_weak_ref.h"
 #include "base/android/scoped_java_ref.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "ui/android/view_android.h"
 
 namespace gfx {
@@ -17,9 +20,7 @@ class Rect;
 
 namespace content {
 
-class RenderFrameHost;
 class WebContentsImpl;
-struct MenuItem;
 
 class SelectPopup {
  public:
@@ -30,9 +31,9 @@ class SelectPopup {
   // |multiple| defines if it should support multi-select.
   // If not |multiple|, |selected_item| sets the initially selected item.
   // Otherwise, item's "checked" flag selects it.
-  void ShowMenu(RenderFrameHost* frame,
+  void ShowMenu(mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
                 const gfx::Rect& bounds,
-                const std::vector<MenuItem>& items,
+                std::vector<blink::mojom::MenuItemPtr> items,
                 int selected_item,
                 bool multiple,
                 bool right_aligned);
@@ -51,6 +52,7 @@ class SelectPopup {
 
   // Select popup view
   ui::ViewAndroid::ScopedAnchorView popup_view_;
+  mojo::Remote<blink::mojom::PopupMenuClient> popup_client_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc b/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
index 79d2cedc907..fe5611a5b4a 100644
--- a/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
+++ b/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
@@ -4,8 +4,8 @@
 
 #include "content/browser/android/selection/composited_touch_handle_drawable.h"
 
+#include "base/check.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/numerics/ranges.h"
 #include "cc/layers/ui_resource_layer.h"
diff --git a/chromium/content/browser/android/synchronous_compositor_browsertest.cc b/chromium/content/browser/android/synchronous_compositor_browsertest.cc
index 45838b75b95..8052f5b65c6 100644
--- a/chromium/content/browser/android/synchronous_compositor_browsertest.cc
+++ b/chromium/content/browser/android/synchronous_compositor_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/android/synchronous_compositor.h"
 #include "content/public/browser/android/synchronous_compositor_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
diff --git a/chromium/content/browser/android/synchronous_compositor_host.cc b/chromium/content/browser/android/synchronous_compositor_host.cc
index a28701ca7c2..9a61f070139 100644
--- a/chromium/content/browser/android/synchronous_compositor_host.cc
+++ b/chromium/content/browser/android/synchronous_compositor_host.cc
@@ -22,7 +22,6 @@
 #include "content/browser/renderer_host/render_widget_host_view_android.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/android/sync_compositor_statics.h"
-#include "content/common/input/sync_compositor_messages.h"
 #include "content/public/browser/android/synchronous_compositor_client.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -114,8 +113,8 @@ class SynchronousCompositorControlHost
   }
 
   void BeginFrameResponse(
-      const content::SyncCompositorCommonRendererParams& params) override {
-    if (!bridge_->BeginFrameResponseOnIOThread(params)) {
+      mojom::SyncCompositorCommonRendererParamsPtr params) override {
+    if (!bridge_->BeginFrameResponseOnIOThread(std::move(params))) {
       bad_message::ReceivedBadMessage(
           process_id_, bad_message::SYNC_COMPOSITOR_NO_BEGIN_FRAME);
     }
@@ -202,15 +201,16 @@ SynchronousCompositorHost::DemandDrawHwAsync(
     return frame_future;
   }
 
-  SyncCompositorDemandDrawHwParams params(viewport_size,
-                                          viewport_rect_for_tile_priority,
-                                          transform_for_tile_priority);
+  mojom::SyncCompositorDemandDrawHwParamsPtr params =
+      mojom::SyncCompositorDemandDrawHwParams::New(
+          viewport_size, viewport_rect_for_tile_priority,
+          transform_for_tile_priority);
   mojom::SynchronousCompositor* compositor = GetSynchronousCompositor();
   if (!bridge_->SetFrameFutureOnUIThread(frame_future)) {
     frame_future->SetFrame(nullptr);
   } else {
     DCHECK(compositor);
-    compositor->DemandDrawHwAsync(params);
+    compositor->DemandDrawHwAsync(std::move(params));
   }
   return frame_future;
 }
@@ -219,14 +219,15 @@ SynchronousCompositor::Frame SynchronousCompositorHost::DemandDrawHw(
     const gfx::Size& viewport_size,
     const gfx::Rect& viewport_rect_for_tile_priority,
     const gfx::Transform& transform_for_tile_priority) {
-  SyncCompositorDemandDrawHwParams params(viewport_size,
-                                          viewport_rect_for_tile_priority,
-                                          transform_for_tile_priority);
+  mojom::SyncCompositorDemandDrawHwParamsPtr params =
+      mojom::SyncCompositorDemandDrawHwParams::New(
+          viewport_size, viewport_rect_for_tile_priority,
+          transform_for_tile_priority);
   uint32_t layer_tree_frame_sink_id;
   uint32_t metadata_version = 0u;
   base::Optional<viz::CompositorFrame> compositor_frame;
   base::Optional<viz::HitTestRegionList> hit_test_region_list;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
 
   {
     mojo::SyncCallRestrictions::ScopedAllowSyncCall allow_sync_call;
@@ -234,13 +235,14 @@ SynchronousCompositor::Frame SynchronousCompositorHost::DemandDrawHw(
         allow_base_sync_primitives;
     if (!IsReadyForSynchronousCall() ||
         !GetSynchronousCompositor()->DemandDrawHw(
-            params, &common_renderer_params, &layer_tree_frame_sink_id,
-            &metadata_version, &compositor_frame, &hit_test_region_list)) {
+            std::move(params), &common_renderer_params,
+            &layer_tree_frame_sink_id, &metadata_version, &compositor_frame,
+            &hit_test_region_list)) {
       return SynchronousCompositor::Frame();
     }
   }
 
-  UpdateState(common_renderer_params);
+  UpdateState(std::move(common_renderer_params));
 
   if (!compositor_frame)
     return SynchronousCompositor::Frame();
@@ -288,19 +290,21 @@ bool SynchronousCompositorHost::DemandDrawSwInProc(SkCanvas* canvas) {
   mojo::SyncCallRestrictions::ScopedAllowSyncCall allow_sync_call;
   base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope
       allow_base_sync_primitives;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   base::Optional<viz::CompositorFrameMetadata> metadata;
   ScopedSetSkCanvas set_sk_canvas(canvas);
-  SyncCompositorDemandDrawSwParams params;  // Unused.
+  mojom::SyncCompositorDemandDrawSwParamsPtr params =
+      mojom::SyncCompositorDemandDrawSwParams::New();  // Unused.
   uint32_t metadata_version = 0u;
   invalidate_needs_draw_ = false;
   if (!IsReadyForSynchronousCall() ||
-      !GetSynchronousCompositor()->DemandDrawSw(params, &common_renderer_params,
+      !GetSynchronousCompositor()->DemandDrawSw(std::move(params),
+                                                &common_renderer_params,
                                                 &metadata_version, &metadata))
     return false;
   if (!metadata)
     return false;
-  UpdateState(common_renderer_params);
+  UpdateState(std::move(common_renderer_params));
   UpdateFrameMetaData(metadata_version, std::move(*metadata));
   return true;
 }
@@ -332,17 +336,18 @@ bool SynchronousCompositorHost::DemandDrawSw(SkCanvas* canvas) {
   if (use_in_process_zero_copy_software_draw_)
     return DemandDrawSwInProc(canvas);
 
-  SyncCompositorDemandDrawSwParams params;
-  params.size = gfx::Size(canvas->getBaseLayerSize().width(),
-                          canvas->getBaseLayerSize().height());
+  mojom::SyncCompositorDemandDrawSwParamsPtr params =
+      mojom::SyncCompositorDemandDrawSwParams::New();
+  params->size = gfx::Size(canvas->getBaseLayerSize().width(),
+                           canvas->getBaseLayerSize().height());
   SkIRect canvas_clip = canvas->getDeviceClipBounds();
-  params.clip = gfx::SkIRectToRect(canvas_clip);
-  params.transform.matrix() = canvas->getTotalMatrix();
-  if (params.size.IsEmpty())
+  params->clip = gfx::SkIRectToRect(canvas_clip);
+  params->transform.matrix() = canvas->getTotalMatrix();
+  if (params->size.IsEmpty())
     return true;
 
   SkImageInfo info =
-      SkImageInfo::MakeN32Premul(params.size.width(), params.size.height());
+      SkImageInfo::MakeN32Premul(params->size.width(), params->size.height());
   DCHECK_EQ(kRGBA_8888_SkColorType, info.colorType());
   size_t stride = info.minRowBytes();
   size_t buffer_size = info.computeByteSize(stride);
@@ -355,14 +360,15 @@ bool SynchronousCompositorHost::DemandDrawSw(SkCanvas* canvas) {
 
   base::Optional<viz::CompositorFrameMetadata> metadata;
   uint32_t metadata_version = 0u;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   {
     mojo::SyncCallRestrictions::ScopedAllowSyncCall allow_sync_call;
     base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope
         allow_base_sync_primitives;
     if (!IsReadyForSynchronousCall() ||
         !GetSynchronousCompositor()->DemandDrawSw(
-            params, &common_renderer_params, &metadata_version, &metadata)) {
+            std::move(params), &common_renderer_params, &metadata_version,
+            &metadata)) {
       return false;
     }
   }
@@ -370,7 +376,7 @@ bool SynchronousCompositorHost::DemandDrawSw(SkCanvas* canvas) {
   if (!metadata)
     return false;
 
-  UpdateState(common_renderer_params);
+  UpdateState(std::move(common_renderer_params));
   UpdateFrameMetaData(metadata_version, std::move(*metadata));
 
   SkBitmap bitmap;
@@ -412,7 +418,7 @@ void SynchronousCompositorHost::SetSoftwareDrawSharedMemoryIfNeeded(
   }
 
   bool success = false;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   {
     mojo::SyncCallRestrictions::ScopedAllowSyncCall allow_sync_call;
     base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope
@@ -425,7 +431,7 @@ void SynchronousCompositorHost::SetSoftwareDrawSharedMemoryIfNeeded(
     }
   }
   software_draw_shm_ = std::move(software_draw_shm);
-  UpdateState(common_renderer_params);
+  UpdateState(std::move(common_renderer_params));
 }
 
 void SynchronousCompositorHost::SendZeroMemory() {
@@ -481,7 +487,7 @@ void SynchronousCompositorHost::DidChangeRootLayerScrollOffset(
 
 void SynchronousCompositorHost::SynchronouslyZoomBy(float zoom_delta,
                                                     const gfx::Point& anchor) {
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   {
     mojo::SyncCallRestrictions::ScopedAllowSyncCall allow_sync_call;
     base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope
@@ -492,7 +498,7 @@ void SynchronousCompositorHost::SynchronouslyZoomBy(float zoom_delta,
       return;
     }
   }
-  UpdateState(common_renderer_params);
+  UpdateState(std::move(common_renderer_params));
 }
 
 void SynchronousCompositorHost::OnComputeScroll(
@@ -538,23 +544,23 @@ void SynchronousCompositorHost::LayerTreeFrameSinkCreated() {
 }
 
 void SynchronousCompositorHost::UpdateState(
-    const SyncCompositorCommonRendererParams& params) {
+    mojom::SyncCompositorCommonRendererParamsPtr params) {
   // Ignore if |renderer_param_version_| is newer than |params.version|. This
   // comparison takes into account when the unsigned int wraps.
-  if ((renderer_param_version_ - params.version) < 0x80000000) {
+  if ((renderer_param_version_ - params->version) < 0x80000000) {
     return;
   }
-  renderer_param_version_ = params.version;
-  root_scroll_offset_ = params.total_scroll_offset;
-  max_scroll_offset_ = params.max_scroll_offset;
-  scrollable_size_ = params.scrollable_size;
-  page_scale_factor_ = params.page_scale_factor;
-  min_page_scale_factor_ = params.min_page_scale_factor;
-  max_page_scale_factor_ = params.max_page_scale_factor;
-  invalidate_needs_draw_ |= params.invalidate_needs_draw;
-
-  if (need_invalidate_count_ != params.need_invalidate_count) {
-    need_invalidate_count_ = params.need_invalidate_count;
+  renderer_param_version_ = params->version;
+  root_scroll_offset_ = params->total_scroll_offset;
+  max_scroll_offset_ = params->max_scroll_offset;
+  scrollable_size_ = params->scrollable_size;
+  page_scale_factor_ = params->page_scale_factor;
+  min_page_scale_factor_ = params->min_page_scale_factor;
+  max_page_scale_factor_ = params->max_page_scale_factor;
+  invalidate_needs_draw_ |= params->invalidate_needs_draw;
+
+  if (need_invalidate_count_ != params->need_invalidate_count) {
+    need_invalidate_count_ = params->need_invalidate_count;
     if (invalidate_needs_draw_) {
       client_->PostInvalidate(this);
     } else {
@@ -563,8 +569,8 @@ void SynchronousCompositorHost::UpdateState(
   }
 
   if (did_activate_pending_tree_count_ !=
-      params.did_activate_pending_tree_count) {
-    did_activate_pending_tree_count_ = params.did_activate_pending_tree_count;
+      params->did_activate_pending_tree_count) {
+    did_activate_pending_tree_count_ = params->did_activate_pending_tree_count;
     client_->DidUpdateContent(this);
   }
 
diff --git a/chromium/content/browser/android/synchronous_compositor_host.h b/chromium/content/browser/android/synchronous_compositor_host.h
index bf5106b2102..10db0c6de51 100644
--- a/chromium/content/browser/android/synchronous_compositor_host.h
+++ b/chromium/content/browser/android/synchronous_compositor_host.h
@@ -21,9 +21,9 @@
 #include "content/common/content_export.h"
 #include "content/common/input/synchronous_compositor.mojom.h"
 #include "content/public/browser/android/synchronous_compositor.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/android/view_android.h"
 #include "ui/gfx/geometry/scroll_offset.h"
 #include "ui/gfx/geometry/size_f.h"
@@ -38,7 +38,6 @@ class RenderProcessHost;
 class RenderWidgetHostViewAndroid;
 class SynchronousCompositorClient;
 class SynchronousCompositorSyncCallBridge;
-struct SyncCompositorCommonRendererParams;
 
 class CONTENT_EXPORT SynchronousCompositorHost
     : public SynchronousCompositor,
@@ -91,7 +90,8 @@ class CONTENT_EXPORT SynchronousCompositorHost
 
   // mojom::SynchronousCompositorHost overrides.
   void LayerTreeFrameSinkCreated() override;
-  void UpdateState(const SyncCompositorCommonRendererParams& params) override;
+  void UpdateState(
+      mojom::SyncCompositorCommonRendererParamsPtr params) override;
   void SetNeedsBeginFrames(bool needs_begin_frames) override;
 
   // viz::BeginFrameObserver implementation.
diff --git a/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.cc b/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.cc
index ad94ce328a4..77afdc2b962 100644
--- a/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.cc
+++ b/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.cc
@@ -69,13 +69,13 @@ bool SynchronousCompositorSyncCallBridge::ReceiveFrameOnIOThread(
 }
 
 bool SynchronousCompositorSyncCallBridge::BeginFrameResponseOnIOThread(
-    const SyncCompositorCommonRendererParams& render_params) {
+    mojom::SyncCompositorCommonRendererParamsPtr render_params) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   base::AutoLock lock(lock_);
   if (begin_frame_response_valid_)
     return false;
   begin_frame_response_valid_ = true;
-  last_render_params_ = render_params;
+  last_render_params_ = *render_params;
   begin_frame_condition_.Signal();
   return true;
 }
@@ -125,8 +125,7 @@ bool SynchronousCompositorSyncCallBridge::IsRemoteReadyOnUIThread() {
 void SynchronousCompositorSyncCallBridge::BeginFrameCompleteOnUIThread() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  bool update_state = false;
-  SyncCompositorCommonRendererParams render_params;
+  mojom::SyncCompositorCommonRendererParamsPtr render_params;
   {
     base::AutoLock lock(lock_);
     if (remote_state_ != RemoteState::READY)
@@ -141,12 +140,11 @@ void SynchronousCompositorSyncCallBridge::BeginFrameCompleteOnUIThread() {
     DCHECK(begin_frame_response_valid_ || remote_state_ != RemoteState::READY);
     begin_frame_response_valid_ = false;
     if (remote_state_ == RemoteState::READY) {
-      update_state = true;
-      render_params = last_render_params_;
+      render_params = last_render_params_.Clone();
     }
   }
-  if (update_state)
-    host_->UpdateState(render_params);
+  if (render_params)
+    host_->UpdateState(std::move(render_params));
 }
 
 void SynchronousCompositorSyncCallBridge::ProcessFrameMetadataOnUIThread(
diff --git a/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.h b/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.h
index 00b63295173..977bcd9899f 100644
--- a/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.h
+++ b/chromium/content/browser/android/synchronous_compositor_sync_call_bridge.h
@@ -10,7 +10,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/thread_annotations.h"
 #include "components/viz/common/quads/compositor_frame.h"
-#include "content/common/input/sync_compositor_messages.h"
+#include "content/common/input/synchronous_compositor.mojom.h"
 #include "content/public/browser/android/synchronous_compositor.h"
 
 namespace content {
@@ -88,7 +88,7 @@ class SynchronousCompositorSyncCallBridge
   // Receive a BeginFrameResponse. Returns true if handling the response was
   // successful or not.
   bool BeginFrameResponseOnIOThread(
-      const SyncCompositorCommonRendererParams& render_params);
+      mojom::SyncCompositorCommonRendererParamsPtr render_params);
 
   // Schedule a callback for when vsync finishes and wait for the
   // BeginFrameResponse callback.
@@ -133,7 +133,8 @@ class SynchronousCompositorSyncCallBridge
   base::Lock lock_;
   FrameFutureQueue frame_futures_ GUARDED_BY(lock_);
   bool begin_frame_response_valid_ GUARDED_BY(lock_) = false;
-  SyncCompositorCommonRendererParams last_render_params_ GUARDED_BY(lock_);
+  mojom::SyncCompositorCommonRendererParams last_render_params_
+      GUARDED_BY(lock_);
   base::ConditionVariable begin_frame_condition_ GUARDED_BY(lock_);
   RemoteState remote_state_ GUARDED_BY(lock_) = RemoteState::INIT;
 
diff --git a/chromium/content/browser/android/tracing_controller_android.cc b/chromium/content/browser/android/tracing_controller_android.cc
index 11870af0d38..9c6c152f726 100644
--- a/chromium/content/browser/android/tracing_controller_android.cc
+++ b/chromium/content/browser/android/tracing_controller_android.cc
@@ -68,9 +68,8 @@ void TracingControllerAndroid::StopTracing(
       base::android::ConvertJavaStringToUTF8(env, jfilepath));
   ScopedJavaGlobalRef<jobject> global_callback(env, callback);
   auto endpoint = TracingController::CreateFileEndpoint(
-      file_path,
-      base::BindRepeating(&TracingControllerAndroid::OnTracingStopped,
-                          weak_factory_.GetWeakPtr(), global_callback));
+      file_path, base::BindOnce(&TracingControllerAndroid::OnTracingStopped,
+                                weak_factory_.GetWeakPtr(), global_callback));
   if (compressfile) {
     endpoint =
         TracingControllerImpl::CreateCompressedStringEndpoint(endpoint, true);
diff --git a/chromium/content/browser/appcache/DEPS b/chromium/content/browser/appcache/DEPS
index 09bb6e3e3bb..792a10a0d31 100644
--- a/chromium/content/browser/appcache/DEPS
+++ b/chromium/content/browser/appcache/DEPS
@@ -5,6 +5,7 @@ include_rules = [
 specific_include_rules = {
   "appcache_fuzzer\.cc": [
     "+content/app/mojo/mojo_init.h",
+    "+services/network/test/test_url_loader_factory.h",
     "+third_party/libprotobuf-mutator/src/src/libfuzzer/libfuzzer_macro.h",
   ],
 }
diff --git a/chromium/content/browser/appcache/appcache.cc b/chromium/content/browser/appcache/appcache.cc
index 52f9bcd1631..13811b177db 100644
--- a/chromium/content/browser/appcache/appcache.cc
+++ b/chromium/content/browser/appcache/appcache.cc
@@ -9,7 +9,8 @@
 #include <algorithm>
 #include <vector>
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/stl_util.h"
 #include "content/browser/appcache/appcache_database.h"
 #include "content/browser/appcache/appcache_group.h"
@@ -96,9 +97,6 @@ bool AppCache::AddOrModifyEntry(const GURL& url, const AppCacheEntry& entry) {
     cache_size_ += entry.response_size();  // New entry. Add to cache size.
     padding_size_ += entry.padding_size();
   }
-  // TODO(pwnall): Figure out if we want to overwrite or max the two entries.
-  ret.first->second.set_token_expires(
-      std::max(entry.token_expires(), ret.first->second.token_expires()));
   return ret.second;
 }
 
@@ -149,8 +147,7 @@ bool SortNamespacesByLength(
 }
 }
 
-void AppCache::InitializeWithManifest(AppCacheManifest* manifest,
-                                      base::Time token_expires) {
+void AppCache::InitializeWithManifest(AppCacheManifest* manifest) {
   DCHECK(manifest);
   manifest_parser_version_ = manifest->parser_version;
   manifest_scope_ = manifest->scope;
@@ -158,7 +155,7 @@ void AppCache::InitializeWithManifest(AppCacheManifest* manifest,
   fallback_namespaces_.swap(manifest->fallback_namespaces);
   online_whitelist_namespaces_.swap(manifest->online_whitelist_namespaces);
   online_whitelist_all_ = manifest->online_whitelist_all;
-  token_expires_ = token_expires;
+  token_expires_ = manifest->token_expires;
 
   // Sort the namespaces by url string length, longest to shortest,
   // since longer matches trump when matching a url to a namespace.
@@ -166,12 +163,6 @@ void AppCache::InitializeWithManifest(AppCacheManifest* manifest,
             SortNamespacesByLength);
   std::sort(fallback_namespaces_.begin(), fallback_namespaces_.end(),
             SortNamespacesByLength);
-
-  for (auto& intercept : intercept_namespaces_)
-    intercept.token_expires = token_expires;
-
-  for (auto& fallback : fallback_namespaces_)
-    fallback.token_expires = token_expires;
 }
 
 void AppCache::InitializeWithDatabaseRecords(
@@ -188,9 +179,8 @@ void AppCache::InitializeWithDatabaseRecords(
   token_expires_ = cache_record.token_expires;
 
   for (const AppCacheDatabase::EntryRecord& entry : entries) {
-    AddEntry(entry.url,
-             AppCacheEntry(entry.flags, entry.response_id, entry.response_size,
-                           entry.padding_size, entry.token_expires));
+    AddEntry(entry.url, AppCacheEntry(entry.flags, entry.response_id,
+                                      entry.response_size, entry.padding_size));
   }
   DCHECK_EQ(cache_size_, cache_record.cache_size);
   DCHECK_EQ(padding_size_, cache_record.padding_size);
@@ -243,7 +233,6 @@ void AppCache::ToDatabaseRecords(
     record.response_id = pair.second.response_id();
     record.response_size = pair.second.response_size();
     record.padding_size = pair.second.padding_size();
-    record.token_expires = pair.second.token_expires();
   }
 
   const url::Origin origin = url::Origin::Create(group->manifest_url());
@@ -254,7 +243,6 @@ void AppCache::ToDatabaseRecords(
     record.cache_id = cache_id_;
     record.origin = origin;
     record.namespace_ = intercept_namespace;
-    record.token_expires = intercept_namespace.token_expires;
   }
 
   for (const AppCacheNamespace& fallback_namespace : fallback_namespaces_) {
@@ -263,7 +251,6 @@ void AppCache::ToDatabaseRecords(
     record.cache_id = cache_id_;
     record.origin = origin;
     record.namespace_ = fallback_namespace;
-    record.token_expires = fallback_namespace.token_expires;
   }
 
   for (const AppCacheNamespace& online_namespace :
@@ -341,7 +328,6 @@ void AppCache::ToResourceInfoVector(
     info.response_size = pair.second.response_size();
     info.padding_size = pair.second.padding_size();
     info.response_id = pair.second.response_id();
-    info.token_expires = pair.second.token_expires();
   }
 }
 
diff --git a/chromium/content/browser/appcache/appcache.h b/chromium/content/browser/appcache/appcache.h
index 8d9c10f1c02..14af3e86f15 100644
--- a/chromium/content/browser/appcache/appcache.h
+++ b/chromium/content/browser/appcache/appcache.h
@@ -141,8 +141,7 @@ class CONTENT_EXPORT AppCache
 
   // Initializes the cache with information in the manifest.
   // Do not use the manifest after this call.
-  void InitializeWithManifest(AppCacheManifest* manifest,
-                              base::Time token_expires);
+  void InitializeWithManifest(AppCacheManifest* manifest);
 
   // Initializes the cache with the information in the database records.
   void InitializeWithDatabaseRecords(
diff --git a/chromium/content/browser/appcache/appcache_browsertest.cc b/chromium/content/browser/appcache/appcache_browsertest.cc
index 3441761c672..c20d15e6fef 100644
--- a/chromium/content/browser/appcache/appcache_browsertest.cc
+++ b/chromium/content/browser/appcache/appcache_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/appcache/appcache_database.cc b/chromium/content/browser/appcache/appcache_database.cc
index 8ffa4bc305c..b97aa41c977 100644
--- a/chromium/content/browser/appcache/appcache_database.cc
+++ b/chromium/content/browser/appcache/appcache_database.cc
@@ -20,6 +20,7 @@
 #include "sql/statement.h"
 #include "sql/transaction.h"
 #include "storage/browser/quota/padding_key.h"
+#include "third_party/blink/public/common/features.h"
 
 namespace content {
 
@@ -503,25 +504,22 @@ bool AppCacheDatabase::CommitLazyLastAccessTimes() {
   return transaction.Commit();
 }
 
-bool AppCacheDatabase::UpdateEvictionTimesAndTokenExpires(
+bool AppCacheDatabase::UpdateEvictionTimes(
     int64_t group_id,
     base::Time last_full_update_check_time,
-    base::Time first_evictable_error_time,
-    base::Time token_expires) {
+    base::Time first_evictable_error_time) {
   if (!LazyOpen(kCreateIfNeeded))
     return false;
 
   static const char kSql[] =
       "UPDATE Groups"
       " SET last_full_update_check_time = ?,"
-      "     first_evictable_error_time = ?,"
-      "     token_expires = ?"
+      "     first_evictable_error_time = ?"
       " WHERE group_id = ?";
   sql::Statement statement(db_->GetCachedStatement(SQL_FROM_HERE, kSql));
   statement.BindInt64(0, last_full_update_check_time.ToInternalValue());
   statement.BindInt64(1, first_evictable_error_time.ToInternalValue());
-  statement.BindInt64(2, token_expires.ToInternalValue());
-  statement.BindInt64(3, group_id);
+  statement.BindInt64(2, group_id);
   return statement.Run();  // Will succeed even if group_id is invalid.
 }
 
@@ -573,9 +571,11 @@ bool AppCacheDatabase::FindCachesForOrigin(const url::Origin& origin,
   if (!FindGroupsForOrigin(origin, &group_records))
     return false;
 
-  CacheRecord cache_record;
   for (const auto& record : group_records) {
-    if (FindCacheForGroup(record.group_id, &cache_record))
+    CacheRecord cache_record;
+    if (!FindCacheForGroup(record.group_id, &cache_record))
+      continue;
+    if (HasValidOriginTrialToken(&cache_record))
       records->push_back(cache_record);
   }
   return true;
@@ -952,6 +952,12 @@ bool AppCacheDatabase::DeleteDeletableResponseIds(
   return RunCachedStatementWithIds(SQL_FROM_HERE, kSql, response_ids);
 }
 
+bool AppCacheDatabase::HasValidOriginTrialToken(CacheRecord* cache_record) {
+  if (!is_origin_trial_required_)
+    return true;
+  return cache_record->token_expires > base::Time::Now();
+}
+
 bool AppCacheDatabase::RunCachedStatementWithIds(
     sql::StatementID statement_id,
     const char* sql,
diff --git a/chromium/content/browser/appcache/appcache_database.h b/chromium/content/browser/appcache/appcache_database.h
index 6ce57fe5650..06146d16417 100644
--- a/chromium/content/browser/appcache/appcache_database.h
+++ b/chromium/content/browser/appcache/appcache_database.h
@@ -152,11 +152,9 @@ class CONTENT_EXPORT AppCacheDatabase {
   // the database is functioning.
   bool UpdateLastAccessTime(int64_t group_id, base::Time last_access_time);
   bool LazyUpdateLastAccessTime(int64_t group_id, base::Time last_access_time);
-  bool UpdateEvictionTimesAndTokenExpires(
-      int64_t group_id,
-      base::Time last_full_update_check_time,
-      base::Time first_evictable_error_time,
-      base::Time token_expires);
+  bool UpdateEvictionTimes(int64_t group_id,
+                           base::Time last_full_update_check_time,
+                           base::Time first_evictable_error_time);
   bool CommitLazyLastAccessTimes();  // The destructor calls this too.
 
   bool FindCache(int64_t cache_id, CacheRecord* record);
@@ -210,12 +208,16 @@ class CONTENT_EXPORT AppCacheDatabase {
   bool InsertDeletableResponseIds(const std::vector<int64_t>& response_ids);
   bool DeleteDeletableResponseIds(const std::vector<int64_t>& response_ids);
 
+  void SetOriginTrialRequired(bool req) { is_origin_trial_required_ = req; }
+
   // So our callers can wrap operations in transactions.
   sql::Database* db_connection() {
     LazyOpen(true);
     return db_.get();
   }
 
+  bool HasValidOriginTrialToken(CacheRecord* record);
+
  private:
   bool RunCachedStatementWithIds(sql::StatementID statement_id,
                                  const char* sql,
@@ -261,6 +263,7 @@ class CONTENT_EXPORT AppCacheDatabase {
   bool is_disabled_;
   bool is_recreating_;
   bool was_corruption_detected_;
+  bool is_origin_trial_required_ = false;
 
   friend class content::AppCacheDatabaseTest;
   friend class content::AppCacheStorageImplTest;
diff --git a/chromium/content/browser/appcache/appcache_database_unittest.cc b/chromium/content/browser/appcache/appcache_database_unittest.cc
index e606c47873b..e842db8b39f 100644
--- a/chromium/content/browser/appcache/appcache_database_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_database_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
 #include "base/strings/stringprintf.h"
+#include "base/test/scoped_feature_list.h"
 #include "content/browser/appcache/appcache_database.h"
 #include "content/browser/appcache/appcache_entry.h"
 #include "sql/database.h"
@@ -20,6 +21,7 @@
 #include "sql/test/test_helpers.h"
 #include "sql/transaction.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/sqlite/sqlite3.h"
 
 namespace {
@@ -32,6 +34,11 @@ namespace content {
 
 class AppCacheDatabaseTest : public testing::Test {
  public:
+  AppCacheDatabaseTest() {
+    appcache_require_origin_trial_feature_.InitAndDisableFeature(
+        blink::features::kAppCacheRequireOriginTrial);
+  }
+
   int64_t GetCacheManifestParserVersion(const content::AppCacheDatabase& db,
                                         int64_t cache_id) {
     static const char kSql[] =
@@ -55,6 +62,9 @@ class AppCacheDatabaseTest : public testing::Test {
     EXPECT_TRUE(statement.Step());
     return statement.ColumnString(0);
   }
+
+ private:
+  base::test::ScopedFeatureList appcache_require_origin_trial_feature_;
 };
 
 TEST_F(AppCacheDatabaseTest, LazyOpen) {
@@ -87,7 +97,7 @@ TEST_F(AppCacheDatabaseTest, ReCreate) {
   const base::FilePath kNestedDir = temp_dir.GetPath().AppendASCII("nested");
   const base::FilePath kOtherFile =  kNestedDir.AppendASCII("other_file");
   EXPECT_TRUE(base::CreateDirectory(kNestedDir));
-  EXPECT_EQ(3, base::WriteFile(kOtherFile, "foo", 3));
+  EXPECT_TRUE(base::WriteFile(kOtherFile, "foo"));
 
   AppCacheDatabase db(kDbFile);
   EXPECT_FALSE(db.LazyOpen(false));
@@ -120,7 +130,7 @@ TEST_F(AppCacheDatabaseTest, QuickIntegrityCheck) {
 
   const base::FilePath kDbFile = mock_dir.AppendASCII("appcache.db");
   const base::FilePath kOtherFile = mock_dir.AppendASCII("other_file");
-  EXPECT_EQ(3, base::WriteFile(kOtherFile, "foo", 3));
+  EXPECT_TRUE(base::WriteFile(kOtherFile, "foo"));
 
   // First create a valid db file.
   {
@@ -183,7 +193,7 @@ TEST_F(AppCacheDatabaseTest, ExperimentalFlags) {
   const base::FilePath kDbFile = temp_dir.GetPath().AppendASCII("appcache.db");
   const base::FilePath kOtherFile =
       temp_dir.GetPath().AppendASCII("other_file");
-  EXPECT_EQ(3, base::WriteFile(kOtherFile, "foo", 3));
+  EXPECT_TRUE(base::WriteFile(kOtherFile, "foo"));
   EXPECT_TRUE(base::PathExists(kOtherFile));
 
   // Inject a non empty flags value, and verify it got there.
@@ -497,8 +507,7 @@ TEST_F(AppCacheDatabaseTest, GroupAccessAndEvictionTimes) {
   // See that the methods behave as expected with an empty db.
   // To accommodate lazy updating, for consistency, none of them fail
   // given ids not found in the db.
-  EXPECT_TRUE(
-      db.UpdateEvictionTimesAndTokenExpires(1, kDayOne, kDayTwo, kDayTwo));
+  EXPECT_TRUE(db.UpdateEvictionTimes(1, kDayOne, kDayTwo));
   EXPECT_TRUE(db.UpdateLastAccessTime(1, kDayOne));
   EXPECT_TRUE(db.CommitLazyLastAccessTimes());
   EXPECT_TRUE(db.LazyUpdateLastAccessTime(1, kDayTwo));
@@ -513,7 +522,6 @@ TEST_F(AppCacheDatabaseTest, GroupAccessAndEvictionTimes) {
   record.last_access_time = kDayOne;
   record.last_full_update_check_time = kDayOne;
   record.first_evictable_error_time = kDayOne;
-  record.token_expires = kDayOne;
   EXPECT_TRUE(db.InsertGroup(&record));
 
   // Verify the round trip.
@@ -522,18 +530,15 @@ TEST_F(AppCacheDatabaseTest, GroupAccessAndEvictionTimes) {
   EXPECT_EQ(kDayOne, record.last_access_time);
   EXPECT_EQ(kDayOne, record.last_full_update_check_time);
   EXPECT_EQ(kDayOne, record.first_evictable_error_time);
-  EXPECT_EQ(kDayOne, record.token_expires);
 
   // Update the times to DAY2 and verify.
-  EXPECT_TRUE(
-      db.UpdateEvictionTimesAndTokenExpires(1, kDayTwo, kDayTwo, kDayTwo));
+  EXPECT_TRUE(db.UpdateEvictionTimes(1, kDayTwo, kDayTwo));
   EXPECT_TRUE(db.UpdateLastAccessTime(1, kDayTwo));
   record = AppCacheDatabase::GroupRecord();
   EXPECT_TRUE(db.FindGroup(1, &record));
   EXPECT_EQ(kDayTwo, record.last_access_time);
   EXPECT_EQ(kDayTwo, record.last_full_update_check_time);
   EXPECT_EQ(kDayTwo, record.first_evictable_error_time);
-  EXPECT_EQ(kDayTwo, record.token_expires);
 
   // Lazy update back to DAY1 and verify its reflected without having committed.
   EXPECT_TRUE(db.lazy_last_access_times_.empty());
diff --git a/chromium/content/browser/appcache/appcache_disk_cache.cc b/chromium/content/browser/appcache/appcache_disk_cache.cc
index 69d6e9b366d..020d35ab556 100644
--- a/chromium/content/browser/appcache/appcache_disk_cache.cc
+++ b/chromium/content/browser/appcache/appcache_disk_cache.cc
@@ -10,8 +10,8 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
+#include "base/check.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
@@ -192,9 +192,9 @@ class ActiveCall : public base::RefCounted<ActiveCall> {
 
 AppCacheDiskCache::AppCacheDiskCache()
 #if defined(APPCACHE_USE_SIMPLE_CACHE)
-    : AppCacheDiskCache("DiskCache.AppCache", true)
+    : AppCacheDiskCache(true)
 #else
-    : AppCacheDiskCache("DiskCache.AppCache", false)
+    : AppCacheDiskCache(false)
 #endif
 {
 }
@@ -308,12 +308,10 @@ base::WeakPtr<AppCacheDiskCache> AppCacheDiskCache::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
 
-AppCacheDiskCache::AppCacheDiskCache(const char* uma_name,
-                                     bool use_simple_cache)
+AppCacheDiskCache::AppCacheDiskCache(bool use_simple_cache)
     : use_simple_cache_(use_simple_cache),
       is_disabled_(false),
-      is_waiting_to_initialize_(false),
-      uma_name_(uma_name) {}
+      is_waiting_to_initialize_(false) {}
 
 AppCacheDiskCache::PendingCall::PendingCall()
     : call_type(CREATE), key(0), entry(nullptr) {}
diff --git a/chromium/content/browser/appcache/appcache_disk_cache.h b/chromium/content/browser/appcache/appcache_disk_cache.h
index 6f3d3360e93..603e7817e95 100644
--- a/chromium/content/browser/appcache/appcache_disk_cache.h
+++ b/chromium/content/browser/appcache/appcache_disk_cache.h
@@ -92,13 +92,10 @@ class CONTENT_EXPORT AppCacheDiskCache {
     is_waiting_to_initialize_ = is_waiting_to_initialize;
   }
 
-  const char* uma_name() { return uma_name_; }
-
   disk_cache::Backend* disk_cache() { return disk_cache_.get(); }
 
  protected:
-  // |uma_name| must remain valid for the life of the object.
-  explicit AppCacheDiskCache(const char* uma_name, bool use_simple_cache);
+  explicit AppCacheDiskCache(bool use_simple_cache);
 
  private:
   class CreateBackendCallbackShim;
@@ -160,7 +157,6 @@ class CONTENT_EXPORT AppCacheDiskCache {
   std::vector<PendingCall> pending_calls_;
   std::set<AppCacheDiskCacheEntry*> open_entries_;
   std::unique_ptr<disk_cache::Backend> disk_cache_;
-  const char* const uma_name_;
 
   base::WeakPtrFactory<AppCacheDiskCache> weak_factory_{this};
 };
diff --git a/chromium/content/browser/appcache/appcache_disk_cache_ops.cc b/chromium/content/browser/appcache/appcache_disk_cache_ops.cc
index 81a2cf2acf5..0bb3e722065 100644
--- a/chromium/content/browser/appcache/appcache_disk_cache_ops.cc
+++ b/chromium/content/browser/appcache/appcache_disk_cache_ops.cc
@@ -9,8 +9,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/numerics/checked_math.h"
 #include "base/pickle.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -18,7 +18,6 @@
 #include "net/base/completion_once_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
-#include "storage/common/storage_histograms.h"
 
 namespace content {
 
@@ -265,8 +264,6 @@ void AppCacheResponseReader::OnIOComplete(int result) {
       read_position_ += result;
     }
   }
-  if (result > 0 && disk_cache_)
-    storage::RecordBytesRead(disk_cache_->uma_name(), result);
   InvokeUserCompletionCallback(result);
   // Note: |this| may have been deleted by the completion callback.
 }
@@ -363,8 +360,6 @@ void AppCacheResponseWriter::OnIOComplete(int result) {
     else
       info_size_ = result;
   }
-  if (result > 0 && disk_cache_)
-    storage::RecordBytesWritten(disk_cache_->uma_name(), result);
   InvokeUserCompletionCallback(result);
   // Note: |this| may have been deleted by the completion callback.
 }
@@ -489,8 +484,6 @@ void AppCacheResponseMetadataWriter::OnOpenEntryComplete() {
 
 void AppCacheResponseMetadataWriter::OnIOComplete(int result) {
   DCHECK(result < 0 || write_amount_ == result);
-  if (result > 0 && disk_cache_)
-    storage::RecordBytesWritten(disk_cache_->uma_name(), result);
   InvokeUserCompletionCallback(result);
   // Note: |this| may have been deleted by the completion callback.
 }
diff --git a/chromium/content/browser/appcache/appcache_entry.h b/chromium/content/browser/appcache/appcache_entry.h
index 7a87551bc51..7593f731751 100644
--- a/chromium/content/browser/appcache/appcache_entry.h
+++ b/chromium/content/browser/appcache/appcache_entry.h
@@ -33,13 +33,11 @@ class AppCacheEntry {
       int type = 0,
       int64_t response_id = blink::mojom::kAppCacheNoResponseId,
       int64_t response_size = 0,
-      int64_t padding_size = 0,
-      base::Time token_expires = base::Time())
+      int64_t padding_size = 0)
       : types_(type),
         response_id_(response_id),
         response_size_(response_size),
-        padding_size_(padding_size),
-        token_expires_(token_expires) {
+        padding_size_(padding_size) {
     DCHECK_GE(response_size, 0);
     DCHECK_GE(padding_size, 0);
 
@@ -91,17 +89,11 @@ class AppCacheEntry {
     padding_size_ = padding_size;
   }
 
-  base::Time token_expires() const { return token_expires_; }
-  void set_token_expires(base::Time expires) { token_expires_ = expires; }
-
  private:
   int types_;
   int64_t response_id_;
   int64_t response_size_;
   int64_t padding_size_;
-  // Origin Trial expiration time for this entry.
-  // This is base::Time() if this was never updated with an OT token.
-  base::Time token_expires_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/appcache/appcache_group.cc b/chromium/content/browser/appcache/appcache_group.cc
index 46ab4835436..5e176e8f5e9 100644
--- a/chromium/content/browser/appcache/appcache_group.cc
+++ b/chromium/content/browser/appcache/appcache_group.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/appcache/appcache.h"
diff --git a/chromium/content/browser/appcache/appcache_group.h b/chromium/content/browser/appcache/appcache_group.h
index 7787e4d95b4..5e8fb22aa9f 100644
--- a/chromium/content/browser/appcache/appcache_group.h
+++ b/chromium/content/browser/appcache/appcache_group.h
@@ -101,8 +101,6 @@ class CONTENT_EXPORT AppCacheGroup
   void set_first_evictable_error_time(base::Time time) {
     first_evictable_error_time_ = time;
   }
-  base::Time token_expires() const { return token_expires_; }
-  void set_token_expires(base::Time expires) { token_expires_ = expires; }
 
   AppCache* newest_complete_cache() const { return newest_complete_cache_; }
 
@@ -179,10 +177,6 @@ class CONTENT_EXPORT AppCacheGroup
   // value is reset after a successful update or update check.
   base::Time first_evictable_error_time_;
 
-  // Origin Trial expiration time for this group.
-  // This is base::Time() if this was never updated with an OT token.
-  base::Time token_expires_;
-
   // Old complete app caches.
   std::vector<AppCache*> old_caches_;
 
diff --git a/chromium/content/browser/appcache/appcache_host.cc b/chromium/content/browser/appcache/appcache_host.cc
index 2ad47be7e65..4268404fba4 100644
--- a/chromium/content/browser/appcache/appcache_host.cc
+++ b/chromium/content/browser/appcache/appcache_host.cc
@@ -7,7 +7,7 @@
 #include <utility>
 #include <vector>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -104,6 +104,8 @@ AppCacheHost::AppCacheHost(
         ChildProcessSecurityPolicyImpl::GetInstance()->CreateHandle(
             process_id_);
   }
+  is_origin_trial_required_ =
+      service_->appcache_policy()->IsOriginTrialRequiredForAppCache();
 }
 
 AppCacheHost::~AppCacheHost() {
@@ -215,7 +217,8 @@ void AppCacheHost::SelectCache(const GURL& document_url,
 
     AppCachePolicy* policy = service()->appcache_policy();
     if (policy && !policy->CanCreateAppCache(
-                      manifest_url, site_for_cookies_.RepresentativeUrl())) {
+                      manifest_url, site_for_cookies_.RepresentativeUrl(),
+                      top_frame_origin_)) {
       FinishCacheSelection(nullptr, nullptr, mojo::ReportBadMessageCallback());
       frontend()->EventRaised(
           blink::mojom::AppCacheEventID::APPCACHE_CHECKING_EVENT);
@@ -404,6 +407,7 @@ std::unique_ptr<AppCacheRequestHandler> AppCacheHost::CreateRequestHandler(
     // for checking whether the creation of the appcache is allowed.
     site_for_cookies_ = request->GetSiteForCookies();
     site_for_cookies_initialized_ = true;
+    top_frame_origin_ = request->GetTopFrameOrigin();
     return base::WrapUnique(new AppCacheRequestHandler(
         this, resource_type, should_reset_appcache, std::move(request)));
   }
@@ -712,6 +716,10 @@ void AppCacheHost::OnContentBlocked(const GURL& manifest_url) {
   OnAppCacheAccessed(manifest_url, /*blocked=*/true);
 }
 
+bool AppCacheHost::IsOriginTrialRequiredForAppCache() {
+  return is_origin_trial_required_;
+}
+
 void AppCacheHost::OnAppCacheAccessed(const GURL& manifest_url, bool blocked) {
   if (!blocked && manifest_url.is_empty())
     return;
diff --git a/chromium/content/browser/appcache/appcache_host.h b/chromium/content/browser/appcache/appcache_host.h
index be06852b567..111775d8c80 100644
--- a/chromium/content/browser/appcache/appcache_host.h
+++ b/chromium/content/browser/appcache/appcache_host.h
@@ -17,6 +17,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
+#include "base/optional.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_service_impl.h"
 #include "content/browser/appcache/appcache_storage.h"
@@ -229,6 +230,10 @@ class CONTENT_EXPORT AppCacheHost : public blink::mojom::AppCacheHost,
     site_for_cookies_initialized_ = true;
   }
 
+  const base::Optional<url::Origin>& top_frame_origin() const {
+    return top_frame_origin_;
+  }
+
   void set_origin_for_url_loader_factory(const url::Origin& origin) {
     origin_for_url_loader_factory_ = origin;
   }
@@ -248,6 +253,8 @@ class CONTENT_EXPORT AppCacheHost : public blink::mojom::AppCacheHost,
 
   void OnContentBlocked(const GURL& manifest_url);
 
+  bool IsOriginTrialRequiredForAppCache();
+
  private:
   friend class content::AppCacheStorageImplTest;
   friend class content::AppCacheRequestHandlerTest;
@@ -411,6 +418,9 @@ class CONTENT_EXPORT AppCacheHost : public blink::mojom::AppCacheHost,
   // To be used in policy checks.
   net::SiteForCookies site_for_cookies_;
   bool site_for_cookies_initialized_ = false;
+  base::Optional<url::Origin> top_frame_origin_;
+
+  bool is_origin_trial_required_ = false;
 
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheGroupTest, CleanupUnusedGroup);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheGroupTest, QueueUpdate);
diff --git a/chromium/content/browser/appcache/appcache_host_unittest.cc b/chromium/content/browser/appcache/appcache_host_unittest.cc
index 6061be5af05..b7bb68c212f 100644
--- a/chromium/content/browser/appcache/appcache_host_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_host_unittest.cc
@@ -118,11 +118,11 @@ class AppCacheHostTest : public testing::Test {
     void RegisterClient(scoped_refptr<storage::QuotaClient> client) override {}
     void NotifyStorageAccessed(const url::Origin& origin,
                                blink::mojom::StorageType type) override {}
-    void NotifyStorageModified(storage::QuotaClient::ID client_id,
+    void NotifyStorageModified(storage::QuotaClientType client_id,
                                const url::Origin& origin,
                                blink::mojom::StorageType type,
                                int64_t delta) override {}
-    void SetUsageCacheEnabled(storage::QuotaClient::ID client_id,
+    void SetUsageCacheEnabled(storage::QuotaClientType client_id,
                               const url::Origin& origin,
                               blink::mojom::StorageType type,
                               bool enabled) override {}
diff --git a/chromium/content/browser/appcache/appcache_internals_ui.cc b/chromium/content/browser/appcache/appcache_internals_ui.cc
index 7e9f65c8fe9..af801a08a1a 100644
--- a/chromium/content/browser/appcache/appcache_internals_ui.cc
+++ b/chromium/content/browser/appcache/appcache_internals_ui.cc
@@ -8,7 +8,8 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
@@ -146,7 +147,6 @@ GetDictionaryValueForAppCacheResourceInfo(
   dict->SetBoolean("isFallback", resource_info.is_fallback);
   dict->SetBoolean("isIntercept", resource_info.is_intercept);
   dict->SetBoolean("isForeign", resource_info.is_foreign);
-  dict->SetDouble("tokenExpires", resource_info.token_expires.ToJsTime());
 
   return dict;
 }
diff --git a/chromium/content/browser/appcache/appcache_manifest_parser.cc b/chromium/content/browser/appcache/appcache_manifest_parser.cc
index a6383478580..34496153913 100644
--- a/chromium/content/browser/appcache/appcache_manifest_parser.cc
+++ b/chromium/content/browser/appcache/appcache_manifest_parser.cc
@@ -36,11 +36,14 @@
 #include <tuple>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_functions.h"
+#include "base/notreached.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/appcache/appcache.h"
+#include "third_party/blink/public/common/origin_trials/trial_token.h"
+#include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -53,6 +56,7 @@ enum class Mode {
   kIntercept,       // In the CHROMIUM-INTERCEPT: section. (non-standard)
   kFallback,        // In the FALLBACK: section.
   kOnlineSafelist,  // In the NETWORK: section.
+  kOriginTrial,     // In the ORIGIN-TRIAL: section. (non-standard)
   kUnknown,         // Sections that are not covered by the spec.
 };
 
@@ -185,6 +189,10 @@ Mode ParseModeSettingLine(base::StringPiece line) {
   if (line == kInterceptLine)
     return Mode::kIntercept;
 
+  static constexpr base::StringPiece kOriginTrialLine("ORIGIN-TRIAL:");
+  if (line == kOriginTrialLine)
+    return Mode::kOriginTrial;
+
   return Mode::kUnknown;
 }
 
@@ -217,10 +225,9 @@ bool IsUrlWithinScope(const GURL& url, const GURL& scope) {
 //
 // The manifest parser accumulates metrics data in an instance of this class by
 // calling the Record*() methods. When the manifest is successfully parsed, the
-// accumulated metrics are logged by calling RecordParseSuccess() or
-// RecordParseWithInvalidManifestUrl(). Metrics for manifests that don't parse
-// in the success case are discarded.  Failure metrics are used to log
-// early-exit conditions like invalid manifest URLs.
+// accumulated metrics are logged by calling RecordParseSuccess(). Metrics for
+// manifests that don't parse in the success case are discarded. Failure metrics
+// are used to log early-exit conditions like invalid manifest URLs.
 class ParseMetricsRecorder {
  public:
   ParseMetricsRecorder() = default;
@@ -245,22 +252,6 @@ class ParseMetricsRecorder {
     has_intercept_entry_ = true;
   }
 
-  // Manifest URL is valid and parsing the manifest can proceed.
-  void RecordValidManifestUrl() {
-#if DCHECK_IS_ON()
-    DCHECK(!finalized_) << "Metrics already recorded";
-#endif  // DCHECK_IS_ON()
-    has_valid_manifest_url_ = true;
-  }
-
-  // Manifest URL is invalid and parsing the manifest must early-exit.
-  void RecordInvalidManifestUrl() {
-#if DCHECK_IS_ON()
-    DCHECK(!finalized_) << "Metrics already recorded";
-#endif  // DCHECK_IS_ON()
-    has_valid_manifest_url_ = false;
-  }
-
   // Called after the parser has successfully consumed the entire manifest.
   //
   // Must be called exactly once. No other Record*() method may be called after
@@ -278,22 +269,6 @@ class ParseMetricsRecorder {
     base::UmaHistogramEnumeration(
         "appcache.Manifest.InterceptUsage",
         has_intercept_entry_ ? InterceptUsage::kExact : InterceptUsage::kNone);
-    base::UmaHistogramBoolean("appcache.Manifest.ValidManifestURL",
-                              has_valid_manifest_url_);
-  }
-
-  // Called if the parser has early exited due to an invalid manifest URL.
-  //
-  // Must be called exactly once. No other Record*() method may be called after
-  // this method is called.
-  void RecordParseWithInvalidManifestUrl() {
-#if DCHECK_IS_ON()
-    DCHECK(!finalized_) << "Metrics already recorded";
-    finalized_ = true;
-#endif  // DCHECK_IS_ON()
-
-    base::UmaHistogramBoolean("appcache.Manifest.ValidManifestURL",
-                              has_valid_manifest_url_);
   }
 
  private:
@@ -315,15 +290,15 @@ class ParseMetricsRecorder {
   bool has_chrome_header_ = false;
   bool used_dangerous_mode_ = false;
   bool has_intercept_entry_ = false;
-  bool has_valid_manifest_url_ = false;
 
 #if DCHECK_IS_ON()
-  // True after RecordParseSuccess() or RecordParseWithInvalidManifestUrl() was
-  // called.
+  // True after RecordParseSuccess() was called.
   bool finalized_ = false;
 #endif  // DCHECK_IS_ON()
 };
 
+constexpr char kAppCacheOriginTrialName[] = "AppCache";
+
 }  // namespace
 
 AppCacheManifest::AppCacheManifest() = default;
@@ -395,11 +370,7 @@ bool ParseManifest(const GURL& manifest_url,
     return false;
 
   if (!manifest_url.is_valid()) {
-    parse_metrics.RecordInvalidManifestUrl();
-    parse_metrics.RecordParseWithInvalidManifestUrl();
     return false;
-  } else {
-    parse_metrics.RecordValidManifestUrl();
   }
 
   if (!AppCache::CheckValidManifestScope(manifest_url, manifest_scope))
@@ -415,8 +386,11 @@ bool ParseManifest(const GURL& manifest_url,
   // Changing the manifest, the scope, or the version of the manifest will
   // trigger a refetch of the manifest.
   //
-  // This code generates manifests with parser version 1.
-  manifest.parser_version = 1;
+  // Version 2: Manifests can have an ORIGIN-TRIAL section.  This is a
+  // separate version so that a new version of Chrome will force a refetch.
+  //
+  // This code generates manifests with parser version 2.
+  manifest.parser_version = 2;
   manifest.scope = manifest_scope;
 
   const GURL manifest_scope_url = manifest_url.Resolve(manifest_scope);
@@ -457,6 +431,28 @@ bool ParseManifest(const GURL& manifest_url,
       continue;
     }
 
+    if (mode == Mode::kOriginTrial) {
+      // Only accept the first valid token.
+      if (manifest.token_expires != base::Time())
+        continue;
+
+      base::StringPiece origin_trial_token;
+      std::tie(origin_trial_token, line) = SplitLineToken(line);
+
+      if (!blink::TrialTokenValidator::IsTrialPossibleOnOrigin(manifest_url))
+        continue;
+
+      blink::TrialTokenValidator validator;
+      url::Origin origin = url::Origin::Create(manifest_url);
+      blink::TrialTokenResult result = validator.ValidateToken(
+          origin_trial_token, origin, base::Time::Now());
+      if (result.status == blink::OriginTrialTokenStatus::kSuccess) {
+        if (result.feature_name == kAppCacheOriginTrialName)
+          manifest.token_expires = result.expiry_time;
+      }
+      continue;
+    }
+
     // Chrome does not implement the SETTINGS: section. If we ever decided to do
     // so, the implementation would go here.
 
@@ -574,4 +570,8 @@ bool ParseManifest(const GURL& manifest_url,
   return true;
 }
 
+std::string GetAppCacheOriginTrialNameForTesting() {
+  return kAppCacheOriginTrialName;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/appcache/appcache_manifest_parser.h b/chromium/content/browser/appcache/appcache_manifest_parser.h
index 95a27bc4dbd..5efca31b74f 100644
--- a/chromium/content/browser/appcache/appcache_manifest_parser.h
+++ b/chromium/content/browser/appcache/appcache_manifest_parser.h
@@ -61,6 +61,7 @@ struct CONTENT_EXPORT AppCacheManifest {
   bool online_whitelist_all = false;
   bool did_ignore_intercept_namespaces = false;
   bool did_ignore_fallback_namespaces = false;
+  base::Time token_expires;
 };
 
 enum ParseMode {
@@ -75,6 +76,8 @@ CONTENT_EXPORT bool ParseManifest(const GURL& manifest_url,
                                   ParseMode parse_mode,
                                   AppCacheManifest& manifest);
 
+CONTENT_EXPORT std::string GetAppCacheOriginTrialNameForTesting();
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_APPCACHE_APPCACHE_MANIFEST_PARSER_H_
diff --git a/chromium/content/browser/appcache/appcache_manifest_parser_unittest.cc b/chromium/content/browser/appcache/appcache_manifest_parser_unittest.cc
index 4d0df39cd00..cf9f81d69ea 100644
--- a/chromium/content/browser/appcache/appcache_manifest_parser_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_manifest_parser_unittest.cc
@@ -8,19 +8,29 @@
 #include <unordered_set>
 #include <vector>
 
+#include "base/bind.h"
 #include "base/stl_util.h"
 #include "base/test/gtest_util.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "content/browser/appcache/appcache_manifest_parser.h"
+#include "content/browser/appcache/test_origin_trial_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/origin_trials/trial_token.h"
+#include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "url/gurl.h"
 
 namespace content {
 
+static TestOriginTrialPolicy g_origin_trial_policy;
+
 class AppCacheManifestParserTest : public testing::Test {
+  void SetUp() override {
+    blink::TrialTokenValidator::SetOriginTrialPolicyGetter(base::BindRepeating(
+        []() -> blink::OriginTrialPolicy* { return &g_origin_trial_policy; }));
+  }
 };
 
-TEST(AppCacheManifestParserTest, NoData) {
+TEST_F(AppCacheManifestParserTest, NoData) {
   const GURL url("http://localhost");
   const std::string scope = url.GetWithoutFilename().path();
   AppCacheManifest manifest;
@@ -34,7 +44,7 @@ TEST(AppCacheManifestParserTest, NoData) {
                              manifest));
 }
 
-TEST(AppCacheManifestParserTest, CheckSignature) {
+TEST_F(AppCacheManifestParserTest, CheckSignature) {
   const GURL url("http://localhost");
   const std::string scope = url.GetWithoutFilename().path();
 
@@ -76,7 +86,7 @@ TEST(AppCacheManifestParserTest, CheckSignature) {
   }
 }
 
-TEST(AppCacheManifestParserTest, HeaderMetrics) {
+TEST_F(AppCacheManifestParserTest, HeaderMetrics) {
   const GURL url("http://localhost");
   const std::string scope = url.GetWithoutFilename().path();
 
@@ -104,7 +114,7 @@ TEST(AppCacheManifestParserTest, HeaderMetrics) {
   }
 }
 
-TEST(AppCacheManifestParserTest, DangerousModeMetrics) {
+TEST_F(AppCacheManifestParserTest, DangerousModeMetrics) {
   const GURL url("http://localhost");
   const std::string scope = url.GetWithoutFilename().path();
 
@@ -134,7 +144,7 @@ TEST(AppCacheManifestParserTest, DangerousModeMetrics) {
   }
 }
 
-TEST(AppCacheManifestParserTest, NoManifestUrl) {
+TEST_F(AppCacheManifestParserTest, NoManifestUrl) {
   base::HistogramTester tester;
   AppCacheManifest manifest;
   const std::string kData("CACHE MANIFEST\r"
@@ -150,17 +160,9 @@ TEST(AppCacheManifestParserTest, NoManifestUrl) {
   EXPECT_TRUE(manifest.online_whitelist_namespaces.empty());
   EXPECT_FALSE(manifest.online_whitelist_all);
   EXPECT_EQ(manifest.parser_version, -1);
-
-  // Verify UMA values show the invalid manifest URL.
-  int invalid_count = 1;
-  int valid_count = 0;
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 0,
-                           invalid_count);
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 1,
-                           valid_count);
 }
 
-TEST(AppCacheManifestParserTest, NoManifestScope) {
+TEST_F(AppCacheManifestParserTest, NoManifestScope) {
   base::HistogramTester tester;
   AppCacheManifest manifest;
   const std::string kData(
@@ -177,18 +179,9 @@ TEST(AppCacheManifestParserTest, NoManifestScope) {
   EXPECT_TRUE(manifest.online_whitelist_namespaces.empty());
   EXPECT_FALSE(manifest.online_whitelist_all);
   EXPECT_EQ(manifest.parser_version, -1);
-
-  // Verify UMA values show neither a valid nor invalid manifest URL since
-  // metrics weren't recorded.
-  int invalid_count = 0;
-  int valid_count = 0;
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 0,
-                           invalid_count);
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 1,
-                           valid_count);
 }
 
-TEST(AppCacheManifestParserTest, NoManifestUrlAndScope) {
+TEST_F(AppCacheManifestParserTest, NoManifestUrlAndScope) {
   base::HistogramTester tester;
   AppCacheManifest manifest;
   const std::string kData(
@@ -205,17 +198,9 @@ TEST(AppCacheManifestParserTest, NoManifestUrlAndScope) {
   EXPECT_TRUE(manifest.online_whitelist_namespaces.empty());
   EXPECT_FALSE(manifest.online_whitelist_all);
   EXPECT_EQ(manifest.parser_version, -1);
-
-  // Verify UMA values show the invalid manifest URL.
-  int invalid_count = 1;
-  int valid_count = 0;
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 0,
-                           invalid_count);
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 1,
-                           valid_count);
 }
 
-TEST(AppCacheManifestParserTest, SimpleManifest) {
+TEST_F(AppCacheManifestParserTest, SimpleManifest) {
   base::HistogramTester tester;
   AppCacheManifest manifest;
   const std::string kData(
@@ -232,19 +217,10 @@ TEST(AppCacheManifestParserTest, SimpleManifest) {
   EXPECT_TRUE(manifest.fallback_namespaces.empty());
   EXPECT_TRUE(manifest.online_whitelist_namespaces.empty());
   EXPECT_FALSE(manifest.online_whitelist_all);
-  EXPECT_EQ(manifest.parser_version, 1);
-
-  // Verify UMA values show neither the valid or invalid manifest URL since
-  // metrics weren't recorded.
-  int invalid_count = 0;
-  int valid_count = 1;
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 0,
-                           invalid_count);
-  tester.ExpectBucketCount("appcache.Manifest.ValidManifestURL", 1,
-                           valid_count);
+  EXPECT_EQ(manifest.parser_version, 2);
 }
 
-TEST(AppCacheManifestParserTest, ExplicitUrls) {
+TEST_F(AppCacheManifestParserTest, ExplicitUrls) {
   AppCacheManifest manifest;
   const GURL kUrl("http://www.foo.com");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -273,7 +249,7 @@ TEST(AppCacheManifestParserTest, ExplicitUrls) {
   EXPECT_FALSE(manifest.online_whitelist_all);
   EXPECT_FALSE(manifest.did_ignore_intercept_namespaces);
   EXPECT_FALSE(manifest.did_ignore_fallback_namespaces);
-  EXPECT_EQ(manifest.parser_version, 1);
+  EXPECT_EQ(manifest.parser_version, 2);
 
   std::unordered_set<std::string> urls = manifest.explicit_urls;
   const size_t kExpected = 5;
@@ -307,7 +283,7 @@ TEST(AppCacheManifestParserTest, ExplicitUrls) {
   EXPECT_TRUE(urls.find("http://www.foo.com/*") != urls.end());
 }
 
-TEST(AppCacheManifestParserTest, WhitelistUrls) {
+TEST_F(AppCacheManifestParserTest, WhitelistUrls) {
   AppCacheManifest manifest;
   const GURL kUrl("http://www.bar.com");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -352,7 +328,7 @@ TEST(AppCacheManifestParserTest, WhitelistUrls) {
   EXPECT_EQ(GURL("http://www.bar.com/*foo"), online[5].namespace_url);
 }
 
-TEST(AppCacheManifestParserTest, FallbackUrls) {
+TEST_F(AppCacheManifestParserTest, FallbackUrls) {
   AppCacheManifest manifest;
   const GURL kUrl("http://glorp.com");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -427,7 +403,7 @@ TEST(AppCacheManifestParserTest, FallbackUrls) {
   EXPECT_FALSE(manifest.did_ignore_fallback_namespaces);
 }
 
-TEST(AppCacheManifestParserTest, FallbackUrlsWithPort) {
+TEST_F(AppCacheManifestParserTest, FallbackUrlsWithPort) {
   AppCacheManifest manifest;
   const GURL kUrl("http://www.portme.com:1234");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -477,7 +453,7 @@ TEST(AppCacheManifestParserTest, FallbackUrlsWithPort) {
   EXPECT_FALSE(manifest.did_ignore_fallback_namespaces);
 }
 
-TEST(AppCacheManifestParserTest, InterceptUrls) {
+TEST_F(AppCacheManifestParserTest, InterceptUrls) {
   AppCacheManifest manifest;
   const GURL kUrl("http://www.portme.com:1234");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -536,7 +512,7 @@ TEST(AppCacheManifestParserTest, InterceptUrls) {
   EXPECT_FALSE(manifest.did_ignore_fallback_namespaces);
 }
 
-TEST(AppCacheManifestParserTest, ComboUrls) {
+TEST_F(AppCacheManifestParserTest, ComboUrls) {
   AppCacheManifest manifest;
   const GURL kUrl("http://combo.com:42");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -603,7 +579,7 @@ TEST(AppCacheManifestParserTest, ComboUrls) {
   EXPECT_TRUE(manifest.intercept_namespaces.empty());
 }
 
-TEST(AppCacheManifestParserTest, UnusualUtf8) {
+TEST_F(AppCacheManifestParserTest, UnusualUtf8) {
   AppCacheManifest manifest;
   const GURL kUrl("http://bad.com");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -619,7 +595,7 @@ TEST(AppCacheManifestParserTest, UnusualUtf8) {
   EXPECT_TRUE(urls.find("http://bad.com/nonbmp%F1%84%AB%BC") != urls.end());
 }
 
-TEST(AppCacheManifestParserTest, IgnoreAfterSpace) {
+TEST_F(AppCacheManifestParserTest, IgnoreAfterSpace) {
   AppCacheManifest manifest;
   const GURL kUrl("http://smorg.borg");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -634,7 +610,7 @@ TEST(AppCacheManifestParserTest, IgnoreAfterSpace) {
   EXPECT_TRUE(urls.find("http://smorg.borg/resource.txt") != urls.end());
 }
 
-TEST(AppCacheManifestParserTest, DifferentOriginUrlWithSecureScheme) {
+TEST_F(AppCacheManifestParserTest, DifferentOriginUrlWithSecureScheme) {
   AppCacheManifest manifest;
   const GURL kUrl("https://www.foo.com");
   const std::string kScope = kUrl.GetWithoutFilename().path();
@@ -664,7 +640,7 @@ TEST(AppCacheManifestParserTest, DifferentOriginUrlWithSecureScheme) {
       urls.end());
 }
 
-TEST(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithGlobalScope) {
+TEST_F(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithGlobalScope) {
   const GURL kUrl("http://foo.com/scope/manifest?with_query_args");
   const std::string kScope = kUrl.GetWithEmptyPath().path();
   const std::string kData(
@@ -693,7 +669,7 @@ TEST(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithGlobalScope) {
             manifest.fallback_namespaces[0].namespace_url);
 }
 
-TEST(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithDefaultScope) {
+TEST_F(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithDefaultScope) {
   const GURL kUrl("http://foo.com/scope/manifest?with_query_args");
   const std::string kScope = kUrl.GetWithoutFilename().path();
   const std::string kData(
@@ -711,7 +687,7 @@ TEST(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithDefaultScope) {
   EXPECT_TRUE(ParseManifest(kUrl, kScope, kData.c_str(), kData.length(),
                             PARSE_MANIFEST_ALLOWING_DANGEROUS_FEATURES,
                             manifest));
-  EXPECT_EQ(manifest.parser_version, 1);
+  EXPECT_EQ(manifest.parser_version, 2);
   EXPECT_FALSE(manifest.did_ignore_fallback_namespaces);
   EXPECT_EQ(1u, manifest.fallback_namespaces.size());
 
@@ -724,7 +700,7 @@ TEST(AppCacheManifestParserTest, IgnoreDangerousFallbacksWithDefaultScope) {
             manifest.fallback_namespaces[0].namespace_url);
 }
 
-TEST(AppCacheManifestParserTest, InterceptUsageMetricsWithGlobalScope) {
+TEST_F(AppCacheManifestParserTest, InterceptUsageMetricsWithGlobalScope) {
   const GURL url("http://foo.com/scope/manifest?with_query_args");
   const std::string scope = url.GetWithEmptyPath().path();
 
@@ -762,7 +738,7 @@ TEST(AppCacheManifestParserTest, InterceptUsageMetricsWithGlobalScope) {
   }
 }
 
-TEST(AppCacheManifestParserTest, InterceptUsageMetricsWithDefaultScope) {
+TEST_F(AppCacheManifestParserTest, InterceptUsageMetricsWithDefaultScope) {
   const GURL url("http://foo.com/scope/manifest?with_query_args");
   const std::string scope = url.GetWithoutFilename().path();
 
@@ -806,4 +782,66 @@ TEST(AppCacheManifestParserTest, InterceptUsageMetricsWithDefaultScope) {
   }
 }
 
+TEST_F(AppCacheManifestParserTest, OriginTrial) {
+  AppCacheManifest manifest;
+  const GURL kUrl("http://mockhost");
+  const std::string kScope = kUrl.GetWithoutFilename().path();
+
+// tools/origin_trials/generate_token.py http://mockhost AppCache
+// --expire-days=2000
+#define APPCACHE_ORIGIN_TRIAL_TOKEN                                            \
+  "AhiiB7vi3JiEO1/"                                                            \
+  "RQIytQslLSN3WYVu3Xd32abYhTia+91ladjnXSClfU981x+"                            \
+  "aoPimEqYVy6tWoeMZZYTpqlggAAABNeyJvcmlnaW4iOiAiaHR0cDovL21vY2tob3N0OjgwIiwg" \
+  "ImZlYXR1cmUiOiAiQXBwQ2FjaGUiLCAiZXhwaXJ5IjogMTc2MTE2NjQxOH0="
+
+  const std::string kData(
+      "CACHE MANIFEST\r"
+      "# a comment\r"
+      "CACHE:\r"
+      "NETWORK:\r"
+      "UNKNOWN:\r"
+      "ORIGIN-TRIAL:\r" APPCACHE_ORIGIN_TRIAL_TOKEN
+      " ignoredsamelinetoken\r"
+      "ignoredsecondtoken\r"
+      "ignoredthirdtoken\r"
+      "FALLBACK:\r");
+
+  EXPECT_TRUE(ParseManifest(kUrl, kScope, kData.c_str(), kData.length(),
+                            PARSE_MANIFEST_ALLOWING_DANGEROUS_FEATURES,
+                            manifest));
+
+  // Get the expected expiration date of the test token.
+  base::Time expect_token_expires;
+  {
+    blink::TrialTokenValidator validator;
+    url::Origin origin = url::Origin::Create(kUrl);
+    const char* token = APPCACHE_ORIGIN_TRIAL_TOKEN;
+    blink::TrialTokenResult expect_token_result =
+        validator.ValidateToken(token, origin, base::Time::Now());
+    expect_token_expires = expect_token_result.expiry_time;
+    ASSERT_EQ(expect_token_result.status,
+              blink::OriginTrialTokenStatus::kSuccess);
+    EXPECT_EQ(GetAppCacheOriginTrialNameForTesting(),
+              expect_token_result.feature_name);
+    EXPECT_NE(base::Time(), expect_token_expires);
+  }
+
+  EXPECT_EQ(manifest.token_expires, expect_token_expires);
+}
+
+TEST_F(AppCacheManifestParserTest, OriginTrialEmpty) {
+  AppCacheManifest manifest;
+  const GURL kUrl("http://mockhost");
+  const std::string kScope = kUrl.GetWithoutFilename().path();
+  const std::string kData(
+      "CACHE MANIFEST\r"
+      "ORIGIN-TRIAL:\r");
+
+  EXPECT_TRUE(ParseManifest(kUrl, kScope, kData.c_str(), kData.length(),
+                            PARSE_MANIFEST_ALLOWING_DANGEROUS_FEATURES,
+                            manifest));
+  EXPECT_EQ(manifest.token_expires, base::Time());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/appcache/appcache_policy.h b/chromium/content/browser/appcache/appcache_policy.h
index 64fd5df6ceb..93ce0342e9b 100644
--- a/chromium/content/browser/appcache/appcache_policy.h
+++ b/chromium/content/browser/appcache/appcache_policy.h
@@ -5,8 +5,14 @@
 #ifndef CONTENT_BROWSER_APPCACHE_APPCACHE_POLICY_H_
 #define CONTENT_BROWSER_APPCACHE_APPCACHE_POLICY_H_
 
+#include "base/optional.h"
+
 class GURL;
 
+namespace url {
+class Origin;
+}
+
 namespace content {
 
 class AppCachePolicy {
@@ -16,12 +22,22 @@ class AppCachePolicy {
   // Called prior to loading a main resource from the appache.
   // Returns true if allowed. This is expected to return immediately
   // without any user prompt.
-  virtual bool CanLoadAppCache(const GURL& manifest_url,
-                               const GURL& first_party) = 0;
+  virtual bool CanLoadAppCache(
+      const GURL& manifest_url,
+
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) = 0;
 
   // Called prior to creating a new appcache. Returns true if allowed.
-  virtual bool CanCreateAppCache(const GURL& manifest_url,
-                                 const GURL& first_party) = 0;
+  virtual bool CanCreateAppCache(
+      const GURL& manifest_url,
+
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) = 0;
+
+  // Returns true if origin trial tokens are required in order to fetch or
+  // update manifests, as well as load any resources from such a manifest.
+  virtual bool IsOriginTrialRequiredForAppCache() = 0;
 
  protected:
   ~AppCachePolicy() = default;
diff --git a/chromium/content/browser/appcache/appcache_quota_client.cc b/chromium/content/browser/appcache/appcache_quota_client.cc
index 7929610c18f..c49dac61143 100644
--- a/chromium/content/browser/appcache/appcache_quota_client.cc
+++ b/chromium/content/browser/appcache/appcache_quota_client.cc
@@ -14,10 +14,10 @@
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_service_impl.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 
 using blink::mojom::StorageType;
-using storage::QuotaClient;
 
 namespace content {
 namespace {
@@ -56,8 +56,8 @@ AppCacheQuotaClient::~AppCacheQuotaClient() {
   DCHECK(current_delete_request_callback_.is_null());
 }
 
-QuotaClient::ID AppCacheQuotaClient::id() const {
-  return kAppcache;
+storage::QuotaClientType AppCacheQuotaClient::type() const {
+  return storage::QuotaClientType::kAppcache;
 }
 
 void AppCacheQuotaClient::OnQuotaManagerDestroyed() {
diff --git a/chromium/content/browser/appcache/appcache_quota_client.h b/chromium/content/browser/appcache/appcache_quota_client.h
index e3b6278684a..41ad80d8b59 100644
--- a/chromium/content/browser/appcache/appcache_quota_client.h
+++ b/chromium/content/browser/appcache/appcache_quota_client.h
@@ -17,6 +17,7 @@
 #include "content/common/content_export.h"
 #include "net/base/completion_repeating_callback.h"
 #include "storage/browser/quota/quota_client.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "storage/browser/quota/quota_task.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom-forward.h"
 #include "url/origin.h"
@@ -39,7 +40,7 @@ class AppCacheQuotaClient : public storage::QuotaClient {
   explicit AppCacheQuotaClient(base::WeakPtr<AppCacheServiceImpl> service);
 
   // QuotaClient method overrides
-  ID id() const override;
+  storage::QuotaClientType type() const override;
   void OnQuotaManagerDestroyed() override;
   void GetOriginUsage(const url::Origin& origin,
                       blink::mojom::StorageType type,
diff --git a/chromium/content/browser/appcache/appcache_request.cc b/chromium/content/browser/appcache/appcache_request.cc
index 598c6e78cb6..a19a46c184f 100644
--- a/chromium/content/browser/appcache/appcache_request.cc
+++ b/chromium/content/browser/appcache/appcache_request.cc
@@ -5,9 +5,11 @@
 #include "content/browser/appcache/appcache_request.h"
 
 #include "content/common/appcache_interfaces.h"
+#include "net/base/isolation_info.h"
 #include "net/url_request/redirect_info.h"
 #include "net/url_request/redirect_util.h"
 #include "net/url_request/url_request.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -30,6 +32,12 @@ int AppCacheRequest::GetResponseCode() const {
   return 0;
 }
 
+base::Optional<url::Origin> AppCacheRequest::GetTopFrameOrigin() const {
+  return request_.trusted_params
+             ? request_.trusted_params->isolation_info.top_frame_origin()
+             : base::nullopt;
+}
+
 std::string AppCacheRequest::GetResponseHeaderByName(
     const std::string& name) const {
   std::string header;
diff --git a/chromium/content/browser/appcache/appcache_request.h b/chromium/content/browser/appcache/appcache_request.h
index 244ab6058b4..cf189e45d3d 100644
--- a/chromium/content/browser/appcache/appcache_request.h
+++ b/chromium/content/browser/appcache/appcache_request.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/sequence_checker.h"
 #include "content/common/content_export.h"
 #include "services/network/public/cpp/resource_request.h"
@@ -23,6 +24,10 @@ namespace network {
 struct ResourceRequest;
 }
 
+namespace url {
+class Origin;
+}
+
 namespace content {
 
 // Interface for an AppCache request. Subclasses implement this interface to
@@ -44,6 +49,9 @@ class CONTENT_EXPORT AppCacheRequest {
     return request_.site_for_cookies;
   }
 
+  // Used for cookie policy.
+  base::Optional<url::Origin> GetTopFrameOrigin() const;
+
   // The referrer for this request.
   const GURL GetReferrer() const { return request_.referrer; }
 
diff --git a/chromium/content/browser/appcache/appcache_request_handler.cc b/chromium/content/browser/appcache/appcache_request_handler.cc
index b4f33199c06..9346278ec04 100644
--- a/chromium/content/browser/appcache/appcache_request_handler.cc
+++ b/chromium/content/browser/appcache/appcache_request_handler.cc
@@ -360,7 +360,8 @@ void AppCacheRequestHandler::OnMainResponseFound(
   bool was_blocked_by_policy =
       !manifest_url.is_empty() && policy &&
       !policy->CanLoadAppCache(manifest_url,
-                               host_->site_for_cookies().RepresentativeUrl());
+                               host_->site_for_cookies().RepresentativeUrl(),
+                               host_->top_frame_origin());
 
   if (was_blocked_by_policy) {
     if (blink::IsResourceTypeFrame(resource_type_)) {
diff --git a/chromium/content/browser/appcache/appcache_service_impl.cc b/chromium/content/browser/appcache/appcache_service_impl.cc
index 60db213f4ce..27a5bfb3a96 100644
--- a/chromium/content/browser/appcache/appcache_service_impl.cc
+++ b/chromium/content/browser/appcache/appcache_service_impl.cc
@@ -11,8 +11,8 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/browser/appcache/appcache_storage.cc b/chromium/content/browser/appcache/appcache_storage.cc
index 23b1a4093b2..c184f416e57 100644
--- a/chromium/content/browser/appcache/appcache_storage.cc
+++ b/chromium/content/browser/appcache/appcache_storage.cc
@@ -14,14 +14,8 @@
 #include "content/browser/appcache/appcache_service_impl.h"
 #include "storage/browser/quota/quota_client.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
-#include "third_party/blink/public/common/origin_trials/trial_token.h"
-#include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 
-namespace {
-constexpr char kAppCacheOriginTrialName[] = "AppCache";
-}
-
 namespace content {
 
 // static
@@ -106,37 +100,6 @@ void AppCacheStorage::LoadResponseInfo(const GURL& manifest_url,
   info_load->StartIfNeeded();
 }
 
-base::Time AppCacheStorage::GetOriginTrialExpiration(
-    const GURL& request_url,
-    const net::HttpResponseHeaders* response_headers,
-    base::Time current_time) {
-  if (!blink::TrialTokenValidator::IsTrialPossibleOnOrigin(request_url))
-    return base::Time();
-
-  if (!response_headers)
-    return base::Time();
-
-  blink::TrialTokenValidator validator;
-  std::string token_feature;
-  base::Time expiry_time;
-  url::Origin origin = url::Origin::Create(request_url);
-  size_t iter = 0;
-  std::string token;
-  while (response_headers->EnumerateHeader(&iter, "Origin-Trial", &token)) {
-    if (validator.ValidateToken(token, origin, current_time, &token_feature,
-                                &expiry_time) ==
-        blink::OriginTrialTokenStatus::kSuccess) {
-      if (token_feature == kAppCacheOriginTrialName)
-        return expiry_time;
-    }
-  }
-  return base::Time();
-}
-
-std::string AppCacheStorage::GetOriginTrialNameForTesting() {
-  return kAppCacheOriginTrialName;
-}
-
 base::WeakPtr<AppCacheStorage> AppCacheStorage::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
@@ -151,7 +114,7 @@ void AppCacheStorage::UpdateUsageMapAndNotify(const url::Origin& origin,
     usage_map_.erase(origin);
   if (new_usage != old_usage && service()->quota_manager_proxy()) {
     service()->quota_manager_proxy()->NotifyStorageModified(
-        storage::QuotaClient::kAppcache, origin,
+        storage::QuotaClientType::kAppcache, origin,
         blink::mojom::StorageType::kTemporary, new_usage - old_usage);
   }
 }
@@ -160,7 +123,7 @@ void AppCacheStorage::ClearUsageMapAndNotify() {
   if (service()->quota_manager_proxy()) {
     for (const auto& pair : usage_map_) {
       service()->quota_manager_proxy()->NotifyStorageModified(
-          storage::QuotaClient::kAppcache, pair.first,
+          storage::QuotaClientType::kAppcache, pair.first,
           blink::mojom::StorageType::kTemporary, -(pair.second));
     }
   }
diff --git a/chromium/content/browser/appcache/appcache_storage.h b/chromium/content/browser/appcache/appcache_storage.h
index ddeb6a6ff92..8eb81867e7e 100644
--- a/chromium/content/browser/appcache/appcache_storage.h
+++ b/chromium/content/browser/appcache/appcache_storage.h
@@ -22,10 +22,6 @@
 
 class GURL;
 
-namespace net {
-class HttpResponseHeaders;
-}  // namespace net
-
 namespace content {
 
 namespace appcache_storage_unittest {
@@ -226,14 +222,6 @@ class CONTENT_EXPORT AppCacheStorage {
   // Simple ptr back to the service object that owns us.
   AppCacheServiceImpl* service() { return service_; }
 
-  // Returns base::Time() if the reverse origin trial is not enabled.
-  base::Time GetOriginTrialExpiration(
-      const GURL& request_url,
-      const net::HttpResponseHeaders* response_headers,
-      base::Time current_time);
-
-  static std::string GetOriginTrialNameForTesting();
-
   // Returns a weak pointer reference to the AppCacheStorage instance.
   base::WeakPtr<AppCacheStorage> GetWeakPtr();
 
diff --git a/chromium/content/browser/appcache/appcache_storage_impl.cc b/chromium/content/browser/appcache/appcache_storage_impl.cc
index 566e15138f8..a11ce32c276 100644
--- a/chromium/content/browser/appcache/appcache_storage_impl.cc
+++ b/chromium/content/browser/appcache/appcache_storage_impl.cc
@@ -28,6 +28,7 @@
 #include "content/browser/appcache/appcache_entry.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_histograms.h"
+#include "content/browser/appcache/appcache_policy.h"
 #include "content/browser/appcache/appcache_quota_client.h"
 #include "content/browser/appcache/appcache_response_info.h"
 #include "content/browser/appcache/appcache_service_impl.h"
@@ -39,6 +40,7 @@
 #include "storage/browser/quota/quota_client.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/appcache/appcache_info.mojom.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 
@@ -358,6 +360,9 @@ void AppCacheStorageImpl::GetAllInfoTask::Run() {
     for (const auto& group : groups) {
       AppCacheDatabase::CacheRecord cache_record;
       database_->FindCacheForGroup(group.group_id, &cache_record);
+      if (!database_->HasValidOriginTrialToken(&cache_record))
+        continue;
+
       blink::mojom::AppCacheInfo info;
       info.manifest_url = group.manifest_url;
       info.creation_time = group.creation_time;
@@ -365,8 +370,7 @@ void AppCacheStorageImpl::GetAllInfoTask::Run() {
       info.padding_sizes = cache_record.padding_size;
       info.last_access_time = group.last_access_time;
       info.last_update_time = cache_record.update_time;
-      // TODO(enne): should this be cache? group? both??
-      info.token_expires = group.token_expires;
+      info.token_expires = cache_record.token_expires;
       info.cache_id = cache_record.cache_id;
       info.group_id = group.group_id;
       info.is_complete = true;
@@ -509,10 +513,16 @@ class AppCacheStorageImpl::CacheLoadTask : public StoreOrLoadTask {
 };
 
 void AppCacheStorageImpl::CacheLoadTask::Run() {
-  success_ =
-      database_->FindCache(cache_id_, &cache_record_) &&
-      database_->FindGroup(cache_record_.group_id, &group_record_) &&
-      FindRelatedCacheRecords(cache_id_);
+  success_ = database_->FindCache(cache_id_, &cache_record_);
+  if (!success_)
+    return;
+  if (!database_->HasValidOriginTrialToken(&cache_record_)) {
+    success_ = false;
+    return;
+  }
+
+  success_ = database_->FindGroup(cache_record_.group_id, &group_record_) &&
+             FindRelatedCacheRecords(cache_id_);
 
   if (success_)
     database_->LazyUpdateLastAccessTime(group_record_.group_id,
@@ -557,8 +567,16 @@ class AppCacheStorageImpl::GroupLoadTask : public StoreOrLoadTask {
 void AppCacheStorageImpl::GroupLoadTask::Run() {
   success_ =
       database_->FindGroupForManifestUrl(manifest_url_, &group_record_) &&
-      database_->FindCacheForGroup(group_record_.group_id, &cache_record_) &&
-      FindRelatedCacheRecords(cache_record_.cache_id);
+      database_->FindCacheForGroup(group_record_.group_id, &cache_record_);
+
+  if (!success_)
+    return;
+  if (!database_->HasValidOriginTrialToken(&cache_record_)) {
+    success_ = false;
+    return;
+  }
+
+  success_ = FindRelatedCacheRecords(cache_record_.cache_id);
 
   if (success_) {
     database_->LazyUpdateLastAccessTime(group_record_.group_id,
@@ -637,7 +655,6 @@ AppCacheStorageImpl::StoreGroupAndCacheTask::StoreGroupAndCacheTask(
       group->last_full_update_check_time();
   group_record_.first_evictable_error_time =
       group->first_evictable_error_time();
-  group_record_.token_expires = group->token_expires();
   newest_cache->ToDatabaseRecords(
       group,
       &cache_record_, &entry_records_,
@@ -704,9 +721,9 @@ void AppCacheStorageImpl::StoreGroupAndCacheTask::Run() {
     database_->UpdateLastAccessTime(group_record_.group_id,
                                     base::Time::Now());
 
-    database_->UpdateEvictionTimesAndTokenExpires(
-        group_record_.group_id, group_record_.last_full_update_check_time,
-        group_record_.first_evictable_error_time, group_record_.token_expires);
+    database_->UpdateEvictionTimes(group_record_.group_id,
+                                   group_record_.last_full_update_check_time,
+                                   group_record_.first_evictable_error_time);
 
     AppCacheDatabase::CacheRecord cache;
     if (database_->FindCacheForGroup(group_record_.group_id, &cache)) {
@@ -735,8 +752,6 @@ void AppCacheStorageImpl::StoreGroupAndCacheTask::Run() {
     }
   }
 
-  cache_record_.token_expires = group_record_.token_expires;
-
   success_ =
       success_ &&
       database_->InsertCache(&cache_record_) &&
@@ -950,10 +965,11 @@ void AppCacheStorageImpl::FindMainResponseTask::Run() {
   if (!preferred_manifest_url_.is_empty()) {
     AppCacheDatabase::GroupRecord preferred_group;
     AppCacheDatabase::CacheRecord preferred_cache;
-    if (database_->FindGroupForManifestUrl(
-            preferred_manifest_url_, &preferred_group) &&
-        database_->FindCacheForGroup(
-            preferred_group.group_id, &preferred_cache)) {
+    if (database_->FindGroupForManifestUrl(preferred_manifest_url_,
+                                           &preferred_group) &&
+        database_->FindCacheForGroup(preferred_group.group_id,
+                                     &preferred_cache) &&
+        database_->HasValidOriginTrialToken(&preferred_cache)) {
       preferred_cache_id = preferred_cache.cache_id;
     }
   }
@@ -983,10 +999,14 @@ bool AppCacheStorageImpl::FindMainResponseTask::FindExactMatch(
     // Take the first with a valid, non-foreign entry.
     for (const auto& entry : entries) {
       AppCacheDatabase::GroupRecord group_record;
+      AppCacheDatabase::CacheRecord cache_record;
       if ((entry.flags & AppCacheEntry::FOREIGN) ||
-          !database_->FindGroupForCache(entry.cache_id, &group_record)) {
+          !database_->FindGroupForCache(entry.cache_id, &group_record) ||
+          !database_->FindCache(entry.cache_id, &cache_record) ||
+          !database_->HasValidOriginTrialToken(&cache_record)) {
         continue;
       }
+
       manifest_url_ = group_record.manifest_url;
       group_id_ = group_record.group_id;
       entry_ = AppCacheEntry(entry.flags, entry.response_id);
@@ -1070,8 +1090,14 @@ FindMainResponseTask::FindFirstValidNamespace(
                              namespace_record->namespace_.target_url,
                              &entry_record)) {
       AppCacheDatabase::GroupRecord group_record;
-      if ((entry_record.flags & AppCacheEntry::FOREIGN) ||
-          !database_->FindGroupForCache(entry_record.cache_id, &group_record)) {
+      AppCacheDatabase::CacheRecord cache_record;
+      if (entry_record.flags & AppCacheEntry::FOREIGN)
+        continue;
+      if (!database_->FindGroupForCache(entry_record.cache_id, &group_record))
+        continue;
+      if (!database_->FindCache(entry_record.cache_id, &cache_record))
+        continue;
+      if (!database_->HasValidOriginTrialToken(&cache_record)) {
         continue;
       }
       manifest_url_ = group_record.manifest_url;
@@ -1350,8 +1376,7 @@ class AppCacheStorageImpl::UpdateEvictionTimesTask
       : DatabaseTask(storage),
         group_id_(group->group_id()),
         last_full_update_check_time_(group->last_full_update_check_time()),
-        first_evictable_error_time_(group->first_evictable_error_time()),
-        token_expires_(group->token_expires()) {}
+        first_evictable_error_time_(group->first_evictable_error_time()) {}
 
   // DatabaseTask:
   void Run() override;
@@ -1363,13 +1388,11 @@ class AppCacheStorageImpl::UpdateEvictionTimesTask
   int64_t group_id_;
   base::Time last_full_update_check_time_;
   base::Time first_evictable_error_time_;
-  base::Time token_expires_;
 };
 
 void AppCacheStorageImpl::UpdateEvictionTimesTask::Run() {
-  database_->UpdateEvictionTimesAndTokenExpires(
-      group_id_, last_full_update_check_time_, first_evictable_error_time_,
-      token_expires_);
+  database_->UpdateEvictionTimes(group_id_, last_full_update_check_time_,
+                                 first_evictable_error_time_);
 }
 
 // AppCacheStorageImpl ---------------------------------------------------
@@ -1411,6 +1434,10 @@ void AppCacheStorageImpl::Initialize(
   if (!is_incognito_)
     db_file_path = cache_directory_.Append(kAppCacheDatabaseName);
   database_ = std::make_unique<AppCacheDatabase>(db_file_path);
+  DCHECK(service_);
+  DCHECK(service_->appcache_policy());
+  database_->SetOriginTrialRequired(
+      service_->appcache_policy()->IsOriginTrialRequiredForAppCache());
 
   db_task_runner_ = db_task_runner;
 
diff --git a/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc b/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
index 12317bccde1..f519c0e099f 100644
--- a/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
@@ -23,6 +23,8 @@
 #include "base/stl_util.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/task_environment.h"
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread.h"
@@ -34,6 +36,7 @@
 #include "content/browser/appcache/appcache_request.h"
 #include "content/browser/appcache/appcache_request_handler.h"
 #include "content/browser/appcache/appcache_service_impl.h"
+#include "content/browser/appcache/mock_appcache_policy.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_task_traits.h"
@@ -50,6 +53,7 @@
 #include "sql/test/test_helpers.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
 #include "third_party/blink/public/mojom/appcache/appcache_info.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
@@ -181,11 +185,11 @@ class AppCacheStorageImplTest : public testing::Test {
       last_origin_ = origin;
     }
 
-    void NotifyStorageModified(storage::QuotaClient::ID client_id,
+    void NotifyStorageModified(storage::QuotaClientType client_id,
                                const url::Origin& origin,
                                StorageType type,
                                int64_t delta) override {
-      EXPECT_EQ(storage::QuotaClient::kAppcache, client_id);
+      EXPECT_EQ(storage::QuotaClientType::kAppcache, client_id);
       EXPECT_EQ(StorageType::kTemporary, type);
       ++notify_storage_modified_count_;
       last_origin_ = origin;
@@ -196,7 +200,7 @@ class AppCacheStorageImplTest : public testing::Test {
     void RegisterClient(scoped_refptr<storage::QuotaClient> client) override {}
     void NotifyOriginInUse(const url::Origin& origin) override {}
     void NotifyOriginNoLongerInUse(const url::Origin& origin) override {}
-    void SetUsageCacheEnabled(storage::QuotaClient::ID client_id,
+    void SetUsageCacheEnabled(storage::QuotaClientType client_id,
                               const url::Origin& origin,
                               StorageType type,
                               bool enabled) override {}
@@ -269,6 +273,8 @@ class AppCacheStorageImplTest : public testing::Test {
             BrowserContext::GetDefaultStoragePartition(&browser_context_))) {
     ChildProcessSecurityPolicyImpl::GetInstance()->Add(kProcessId,
                                                        &browser_context_);
+    appcache_require_origin_trial_feature_.InitAndDisableFeature(
+        blink::features::kAppCacheRequireOriginTrial);
   }
 
   ~AppCacheStorageImplTest() override {
@@ -288,6 +294,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
   void SetUpTest() {
     service_ = std::make_unique<AppCacheServiceImpl>(nullptr, nullptr);
+    service_->set_appcache_policy(&mock_policy_);
     service_->Initialize(base::FilePath());
     mock_quota_manager_proxy_ = base::MakeRefCounted<MockQuotaManagerProxy>();
     service_->quota_manager_proxy_ = mock_quota_manager_proxy_;
@@ -398,6 +405,43 @@ class AppCacheStorageImplTest : public testing::Test {
     TestFinished();
   }
 
+  void LoadCache_OriginTrialSuccess() {
+    AddToDatabase(kManifestUrl, 222, 111, valid_token_expires());
+    AppCacheDatabase::EntryRecord entry_record;
+    entry_record.cache_id = 111;
+    entry_record.url = kEntryUrl;
+    entry_record.flags = AppCacheEntry::EXPLICIT;
+    entry_record.response_id = 1;
+    EXPECT_TRUE(database()->InsertEntry(&entry_record));
+
+    storage()->LoadCache(111, delegate());
+
+    PushNextTask(base::BindLambdaForTesting([&]() {
+      EXPECT_EQ(111, delegate()->loaded_cache_id_);
+      EXPECT_EQ(1, mock_quota_manager_proxy_->notify_storage_accessed_count_);
+      EXPECT_EQ(0, mock_quota_manager_proxy_->notify_storage_modified_count_);
+      TestFinished();
+    }));
+  }
+
+  void LoadCache_OriginTrialFailure() {
+    int64_t cache_id = storage()->NewCacheId();
+    int64_t group_id = storage()->NewGroupId();
+    AddToDatabase(kManifestUrl, group_id, cache_id, invalid_token_expires());
+    AppCacheDatabase::EntryRecord entry_record;
+    entry_record.cache_id = cache_id;
+    entry_record.url = kEntryUrl;
+    entry_record.flags = AppCacheEntry::EXPLICIT;
+    entry_record.response_id = 1;
+    EXPECT_TRUE(database()->InsertEntry(&entry_record));
+
+    storage()->LoadCache(cache_id, delegate());
+    EXPECT_FALSE(delegate()->loaded_cache_.get());
+    EXPECT_EQ(0, mock_quota_manager_proxy_->notify_storage_accessed_count_);
+    EXPECT_EQ(0, mock_quota_manager_proxy_->notify_storage_modified_count_);
+    TestFinished();
+  }
+
   // CreateGroup  --------------------------------------------
 
   void CreateGroupInEmptyOrigin() {
@@ -453,7 +497,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a group and newest cache that
     // appear to be "stored" and "not currently in use".
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, valid_token_expires(), true);
     group_ = nullptr;
     cache_ = nullptr;
 
@@ -555,7 +599,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a group and old complete cache
     // that appear to be "stored"
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     EXPECT_EQ(kDefaultEntrySize + kDefaultEntryPadding,
               storage()->usage_map_[kOrigin]);
 
@@ -607,7 +651,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a group and old complete cache
     // that appear to be "stored"
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     EXPECT_EQ(kDefaultEntrySize + kDefaultEntryPadding,
               storage()->usage_map_[kOrigin]);
 
@@ -744,7 +788,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a group and newest cache that
     // appears to be "stored" and "currently in use".
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     EXPECT_EQ(kDefaultEntrySize + kDefaultEntryPadding,
               storage()->usage_map_[kOrigin]);
 
@@ -813,7 +857,7 @@ class AppCacheStorageImplTest : public testing::Test {
   void MarkEntryAsForeign() {
     // Setup some preconditions. Create a cache with an entry
     // in storage and in the working set.
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::EXPLICIT));
     AppCacheDatabase::EntryRecord entry_record;
     entry_record.cache_id = 1;
@@ -849,7 +893,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a cache with an entry
     // in storage, but not in the working set.
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::EXPLICIT));
     AppCacheDatabase::EntryRecord entry_record;
     entry_record.cache_id = 1;
@@ -924,7 +968,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a complete cache with an entry
     // in storage.
-    MakeCacheAndGroup(kManifestUrl, 2, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 2, 1, invalid_token_expires(), true);
     cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::EXPLICIT, 1));
     AppCacheDatabase::EntryRecord entry_record;
     entry_record.cache_id = 1;
@@ -946,6 +990,25 @@ class AppCacheStorageImplTest : public testing::Test {
     EXPECT_NE(kEntryUrl, delegate()->found_url_);
   }
 
+  void BasicFindMainResponse_OriginTrialFailure() {
+    PushNextTask(
+        base::BindOnce(&AppCacheStorageImplTest::Verify_FindNoMainResponse,
+                       base::Unretained(this)));
+
+    // Add cache/group/entry to the database.
+    AddToDatabase(kManifestUrl, 2, 1, invalid_token_expires());
+    AppCacheDatabase::EntryRecord entry_record;
+    entry_record.cache_id = 1;
+    entry_record.url = kEntryUrl;
+    entry_record.flags = AppCacheEntry::EXPLICIT;
+    entry_record.response_id = 1;
+    EXPECT_TRUE(database()->InsertEntry(&entry_record));
+
+    // Conduct the test.
+    storage()->FindResponseForMainRequest(kEntryUrl, GURL(), delegate());
+    EXPECT_NE(kEntryUrl, delegate()->found_url_);
+  }
+
   void Verify_BasicFindMainResponse() {
     EXPECT_EQ(kEntryUrl, delegate()->found_url_);
     EXPECT_EQ(kManifestUrl, delegate()->found_manifest_url_);
@@ -974,7 +1037,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
     // Setup some preconditions. Create a complete cache with a
     // fallback namespace and entry.
-    MakeCacheAndGroup(kManifestUrl, 2, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 2, 1, valid_token_expires(), true);
     cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::FALLBACK, 1));
     cache_->AddEntry(kEntryUrl2, AppCacheEntry(AppCacheEntry::FALLBACK, 2));
     cache_->fallback_namespaces_.push_back(AppCacheNamespace(
@@ -1022,24 +1085,89 @@ class AppCacheStorageImplTest : public testing::Test {
     TestFinished();
   }
 
+  void FindMainFallbackResponse_OriginTrialFailure() {
+    PushNextTask(base::BindLambdaForTesting([&]() {
+      EXPECT_EQ(kFallbackTestUrl, delegate()->found_url_);
+      EXPECT_TRUE(delegate()->found_manifest_url_.is_empty());
+      EXPECT_EQ(0, delegate()->found_cache_id_);
+      EXPECT_EQ(0, delegate()->found_group_id_);
+      EXPECT_FALSE(delegate()->found_entry_.has_response_id());
+      EXPECT_EQ(0, delegate()->found_fallback_entry_.response_id());
+      EXPECT_TRUE(delegate()->found_namespace_entry_url_.is_empty());
+      TestFinished();
+    }));
+
+    // Setup some preconditions. Create a complete cache with a
+    // fallback namespace and entry.
+    MakeCacheAndGroup(kManifestUrl, 2, 1, invalid_token_expires(), true);
+    cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::FALLBACK, 1));
+    cache_->AddEntry(kEntryUrl2, AppCacheEntry(AppCacheEntry::FALLBACK, 2));
+    cache_->fallback_namespaces_.push_back(AppCacheNamespace(
+        APPCACHE_FALLBACK_NAMESPACE, kFallbackNamespace2, kEntryUrl2));
+    cache_->fallback_namespaces_.push_back(AppCacheNamespace(
+        APPCACHE_FALLBACK_NAMESPACE, kFallbackNamespace, kEntryUrl));
+    AppCacheDatabase::CacheRecord cache_record;
+    std::vector<AppCacheDatabase::EntryRecord> entries;
+    std::vector<AppCacheDatabase::NamespaceRecord> intercepts;
+    std::vector<AppCacheDatabase::NamespaceRecord> fallbacks;
+    std::vector<AppCacheDatabase::OnlineWhiteListRecord> whitelists;
+    cache_->ToDatabaseRecords(group_.get(), &cache_record, &entries,
+                              &intercepts, &fallbacks, &whitelists);
+
+    for (const auto& entry : entries) {
+      // MakeCacheAndGroup has inserted the default entry record already.
+      if (entry.url != kDefaultEntryUrl)
+        EXPECT_TRUE(database()->InsertEntry(&entry));
+    }
+
+    cache_ = nullptr;
+    group_ = nullptr;
+
+    EXPECT_TRUE(database()->InsertNamespaceRecords(fallbacks));
+    EXPECT_TRUE(database()->InsertOnlineWhiteListRecords(whitelists));
+
+    // Conduct the test. Although the test url is in both fallback namespace
+    // urls, it will match neither of them because its group does not have a
+    // valid origin trial token.
+    storage()->FindResponseForMainRequest(kFallbackTestUrl, GURL(), delegate());
+    EXPECT_NE(kFallbackTestUrl, delegate()->found_url_);
+  }
+
   // BasicFindMainInterceptResponse  -------------------------------
 
   void BasicFindMainInterceptResponseInDatabase() {
-    BasicFindMainInterceptResponse(true);
+    PushNextTask(base::BindOnce(
+        &AppCacheStorageImplTest::Verify_BasicFindMainInterceptResponse,
+        base::Unretained(this)));
+    BasicFindMainInterceptResponse(true, valid_token_expires());
   }
 
   void BasicFindMainInterceptResponseInWorkingSet() {
-    BasicFindMainInterceptResponse(false);
-  }
-
-  void BasicFindMainInterceptResponse(bool drop_from_working_set) {
     PushNextTask(base::BindOnce(
         &AppCacheStorageImplTest::Verify_BasicFindMainInterceptResponse,
         base::Unretained(this)));
+    BasicFindMainInterceptResponse(false, valid_token_expires());
+  }
+
+  void FindMainInterceptResponse_OriginTrialFailure() {
+    PushNextTask(base::BindLambdaForTesting([&]() {
+      EXPECT_EQ(kInterceptTestUrl, delegate()->found_url_);
+      EXPECT_TRUE(delegate()->found_manifest_url_.is_empty());
+      EXPECT_EQ(0, delegate()->found_cache_id_);
+      EXPECT_EQ(0, delegate()->found_group_id_);
+      EXPECT_FALSE(delegate()->found_entry_.has_response_id());
+      EXPECT_EQ(0, delegate()->found_fallback_entry_.response_id());
+      EXPECT_TRUE(delegate()->found_namespace_entry_url_.is_empty());
+      TestFinished();
+    }));
+    BasicFindMainInterceptResponse(true, invalid_token_expires());
+  }
 
+  void BasicFindMainInterceptResponse(bool drop_from_working_set,
+                                      base::Time token_expires) {
     // Setup some preconditions. Create a complete cache with an
     // intercept namespace and entry.
-    MakeCacheAndGroup(kManifestUrl, 2, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 2, 1, token_expires, true);
     cache_->AddEntry(kEntryUrl, AppCacheEntry(AppCacheEntry::INTERCEPT, 1));
     cache_->AddEntry(kEntryUrl2, AppCacheEntry(AppCacheEntry::INTERCEPT, 2));
     cache_->intercept_namespaces_.push_back(AppCacheNamespace(
@@ -1109,7 +1237,7 @@ class AppCacheStorageImplTest : public testing::Test {
   }
 
   void MakeMultipleHitCacheAndGroup(const GURL& manifest_url, int id) {
-    MakeCacheAndGroup(manifest_url, id, id, true);
+    MakeCacheAndGroup(manifest_url, id, id, invalid_token_expires(), true);
     AppCacheDatabase::EntryRecord entry_record;
 
     // Add an entry for kEntryUrl
@@ -1251,7 +1379,7 @@ class AppCacheStorageImplTest : public testing::Test {
     // Setup some preconditions. Create a complete cache with a
     // foreign entry, an online namespace, and a second online
     // namespace nested within a fallback namespace.
-    MakeCacheAndGroup(kManifestUrl, 1, 1, true);
+    MakeCacheAndGroup(kManifestUrl, 1, 1, invalid_token_expires(), true);
     cache_->AddEntry(
         kEntryUrl,
         AppCacheEntry(AppCacheEntry::EXPLICIT | AppCacheEntry::FOREIGN, 1));
@@ -1411,17 +1539,13 @@ class AppCacheStorageImplTest : public testing::Test {
           temp_directory_.GetPath().AppendASCII("Cache");
       ASSERT_TRUE(base::CreateDirectory(disk_cache_directory));
       base::FilePath index_file = disk_cache_directory.AppendASCII("index");
-      EXPECT_EQ(static_cast<int>(kCorruptData.length()),
-                base::WriteFile(index_file, kCorruptData.data(),
-                                kCorruptData.length()));
+      EXPECT_TRUE(base::WriteFile(index_file, kCorruptData));
 
       // Also add a corrupt entry file so that simple disk_cache does not try
       // to automatically recover from the corrupted index.
       base::FilePath entry_file =
           disk_cache_directory.AppendASCII("01234567_0");
-      EXPECT_EQ(static_cast<int>(kCorruptData.length()),
-                base::WriteFile(entry_file, kCorruptData.data(),
-                                kCorruptData.length()));
+      EXPECT_TRUE(base::WriteFile(entry_file, kCorruptData));
     }
 
     // Create records for a degenerate cached manifest that only contains
@@ -1459,6 +1583,7 @@ class AppCacheStorageImplTest : public testing::Test {
     service_ = std::make_unique<AppCacheServiceImpl>(
         nullptr, weak_partition_factory_.GetWeakPtr());
 
+    service_->set_appcache_policy(&mock_policy_);
     service_->Initialize(temp_directory_.GetPath());
     mock_quota_manager_proxy_ = base::MakeRefCounted<MockQuotaManagerProxy>();
     service_->quota_manager_proxy_ = mock_quota_manager_proxy_;
@@ -1587,9 +1712,16 @@ class AppCacheStorageImplTest : public testing::Test {
 
   void OnBadMessage(const std::string& reason) { NOTREACHED(); }
 
+  static base::Time invalid_token_expires() { return base::Time(); }
+
+  static base::Time valid_token_expires() {
+    return base::Time::Now() + base::TimeDelta::FromDays(10);
+  }
+
   void MakeCacheAndGroup(const GURL& manifest_url,
                          int64_t group_id,
                          int64_t cache_id,
+                         base::Time token_expires,
                          bool add_to_database) {
     AppCacheEntry default_entry(AppCacheEntry::EXPLICIT,
                                 cache_id + kDefaultEntryIdOffset,
@@ -1600,35 +1732,46 @@ class AppCacheStorageImplTest : public testing::Test {
     cache_->AddEntry(kDefaultEntryUrl, default_entry);
     cache_->set_complete(true);
     group_->AddCache(cache_.get());
+    if (add_to_database)
+      AddToDatabase(manifest_url, group_id, cache_id, token_expires);
+  }
+
+  void AddToDatabase(const GURL& manifest_url,
+                     int64_t group_id,
+                     int64_t cache_id,
+                     base::Time token_expires) {
     url::Origin manifest_origin(url::Origin::Create(manifest_url));
-    if (add_to_database) {
-      AppCacheDatabase::GroupRecord group_record;
-      group_record.group_id = group_id;
-      group_record.manifest_url = manifest_url;
-      group_record.origin = manifest_origin;
-      EXPECT_TRUE(database()->InsertGroup(&group_record));
-      AppCacheDatabase::CacheRecord cache_record;
-      cache_record.cache_id = cache_id;
-      cache_record.group_id = group_id;
-      cache_record.online_wildcard = false;
-      cache_record.update_time = kZeroTime;
-      cache_record.cache_size = kDefaultEntrySize;
-      cache_record.padding_size = kDefaultEntryPadding;
-      cache_record.manifest_parser_version = 1;
-      cache_record.manifest_scope = std::string("/");
-      EXPECT_TRUE(database()->InsertCache(&cache_record));
-      AppCacheDatabase::EntryRecord entry_record;
-      entry_record.cache_id = cache_id;
-      entry_record.url = kDefaultEntryUrl;
-      entry_record.flags = default_entry.types();
-      entry_record.response_id = default_entry.response_id();
-      entry_record.response_size = default_entry.response_size();
-      entry_record.padding_size = default_entry.padding_size();
-      EXPECT_TRUE(database()->InsertEntry(&entry_record));
-
-      storage()->usage_map_[manifest_origin] =
-          default_entry.response_size() + default_entry.padding_size();
-    }
+    AppCacheEntry default_entry(AppCacheEntry::EXPLICIT,
+                                cache_id + kDefaultEntryIdOffset,
+                                kDefaultEntrySize, kDefaultEntryPadding);
+
+    AppCacheDatabase::GroupRecord group_record;
+    group_record.group_id = group_id;
+    group_record.manifest_url = manifest_url;
+    group_record.origin = manifest_origin;
+    EXPECT_TRUE(database()->InsertGroup(&group_record));
+    AppCacheDatabase::CacheRecord cache_record;
+    cache_record.cache_id = cache_id;
+    cache_record.group_id = group_id;
+    cache_record.online_wildcard = false;
+    cache_record.update_time = kZeroTime;
+    cache_record.cache_size = kDefaultEntrySize;
+    cache_record.padding_size = kDefaultEntryPadding;
+    cache_record.manifest_parser_version = 1;
+    cache_record.manifest_scope = std::string("/");
+    cache_record.token_expires = token_expires;
+    EXPECT_TRUE(database()->InsertCache(&cache_record));
+    AppCacheDatabase::EntryRecord entry_record;
+    entry_record.cache_id = cache_id;
+    entry_record.url = kDefaultEntryUrl;
+    entry_record.flags = default_entry.types();
+    entry_record.response_id = default_entry.response_id();
+    entry_record.response_size = default_entry.response_size();
+    entry_record.padding_size = default_entry.padding_size();
+    EXPECT_TRUE(database()->InsertEntry(&entry_record));
+
+    storage()->usage_map_[manifest_origin] =
+        default_entry.response_size() + default_entry.padding_size();
   }
 
   // Data members --------------------------------------------------
@@ -1636,6 +1779,7 @@ class AppCacheStorageImplTest : public testing::Test {
 
   base::OnceClosure test_finished_cb_;
   base::stack<base::OnceClosure> task_stack_;
+  MockAppCachePolicy mock_policy_;
   std::unique_ptr<AppCacheServiceImpl> service_;
   std::unique_ptr<MockStorageDelegate> delegate_;
   scoped_refptr<MockQuotaManagerProxy> mock_quota_manager_proxy_;
@@ -1655,6 +1799,7 @@ class AppCacheStorageImplTest : public testing::Test {
   std::unique_ptr<AppCacheRequestHandler> handler_;
   URLLoaderInterceptor interceptor_;
   TestBrowserContext browser_context_;
+  base::test::ScopedFeatureList appcache_require_origin_trial_feature_;
   base::WeakPtrFactory<StoragePartitionImpl> weak_partition_factory_;
 
   // Test data
@@ -1709,6 +1854,18 @@ TEST_F(AppCacheStorageImplTest, LoadCache_NearHit) {
   RunTestOnUIThread(&AppCacheStorageImplTest::LoadCache_NearHit);
 }
 
+TEST_F(AppCacheStorageImplTest, LoadCache_OriginTrialSuccess) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(&AppCacheStorageImplTest::LoadCache_OriginTrialSuccess);
+}
+
+TEST_F(AppCacheStorageImplTest, LoadCache_OriginTrialFailure) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(&AppCacheStorageImplTest::LoadCache_OriginTrialFailure);
+}
+
 TEST_F(AppCacheStorageImplTest, CreateGroupInEmptyOrigin) {
   RunTestOnUIThread(&AppCacheStorageImplTest::CreateGroupInEmptyOrigin);
 }
@@ -1721,6 +1878,12 @@ TEST_F(AppCacheStorageImplTest, LoadGroupAndCache_FarHit) {
   RunTestOnUIThread(&AppCacheStorageImplTest::LoadGroupAndCache_FarHit);
 }
 
+TEST_F(AppCacheStorageImplTest, LoadGroupAndCache_OriginTrialSuccess) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(&AppCacheStorageImplTest::LoadGroupAndCache_FarHit);
+}
+
 TEST_F(AppCacheStorageImplTest, StoreNewGroup) {
   RunTestOnUIThread(&AppCacheStorageImplTest::StoreNewGroup);
 }
@@ -1762,6 +1925,20 @@ TEST_F(AppCacheStorageImplTest, BasicFindMainResponseInDatabase) {
   RunTestOnUIThread(&AppCacheStorageImplTest::BasicFindMainResponseInDatabase);
 }
 
+TEST_F(AppCacheStorageImplTest, BasicFindMainResponse_OriginTrialFailure) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::BasicFindMainResponse_OriginTrialFailure);
+}
+
+TEST_F(AppCacheStorageImplTest, BasicFindMainResponse_OriginTrialSuccess) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::BasicFindMainFallbackResponseInDatabase);
+}
+
 TEST_F(AppCacheStorageImplTest, BasicFindMainResponseInWorkingSet) {
   RunTestOnUIThread(
       &AppCacheStorageImplTest::BasicFindMainResponseInWorkingSet);
@@ -1777,6 +1954,20 @@ TEST_F(AppCacheStorageImplTest, BasicFindMainFallbackResponseInWorkingSet) {
       &AppCacheStorageImplTest::BasicFindMainFallbackResponseInWorkingSet);
 }
 
+TEST_F(AppCacheStorageImplTest, FindMainFallbackResponse_OriginTrialSuccess) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::BasicFindMainFallbackResponseInDatabase);
+}
+
+TEST_F(AppCacheStorageImplTest, FindMainFallbackResponse_OriginTrialFailure) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::FindMainFallbackResponse_OriginTrialFailure);
+}
+
 TEST_F(AppCacheStorageImplTest, BasicFindMainInterceptResponseInDatabase) {
   RunTestOnUIThread(
       &AppCacheStorageImplTest::BasicFindMainInterceptResponseInDatabase);
@@ -1787,6 +1978,20 @@ TEST_F(AppCacheStorageImplTest, BasicFindMainInterceptResponseInWorkingSet) {
       &AppCacheStorageImplTest::BasicFindMainInterceptResponseInWorkingSet);
 }
 
+TEST_F(AppCacheStorageImplTest, FindMainInterceptResponse_OriginTrialSuccess) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::BasicFindMainInterceptResponseInDatabase);
+}
+
+TEST_F(AppCacheStorageImplTest, FindMainInterceptResponse_OriginTrialFailure) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(
+      &AppCacheStorageImplTest::FindMainInterceptResponse_OriginTrialFailure);
+}
+
 TEST_F(AppCacheStorageImplTest, FindMainResponseWithMultipleHits) {
   RunTestOnUIThread(&AppCacheStorageImplTest::FindMainResponseWithMultipleHits);
 }
diff --git a/chromium/content/browser/appcache/appcache_subresource_url_factory.cc b/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
index c519b4f9649..29e1451a99f 100644
--- a/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
+++ b/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/debug/crash_logging.h"
-#include "base/logging.h"
 #include "content/browser/appcache/appcache_host.h"
 #include "content/browser/appcache/appcache_request.h"
 #include "content/browser/appcache/appcache_request_handler.h"
@@ -131,16 +131,18 @@ class SubresourceLoader : public network::mojom::URLLoader,
 
   // network::mojom::URLLoader implementation
   // Called by the remote client in the renderer.
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {
-    DCHECK(removed_headers.empty() && modified_headers.IsEmpty())
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {
+    DCHECK(modified_headers.IsEmpty() && modified_cors_exempt_headers.IsEmpty())
         << "Redirect with modified headers was not supported yet. "
            "crbug.com/845683";
     if (!handler_) {
-      network_loader_->FollowRedirect({} /* removed_headers */,
-                                      {} /* modified_headers */,
-                                      base::nullopt /* new_url */);
+      network_loader_->FollowRedirect(
+          removed_headers, {} /* modified_headers */,
+          {} /* modified_cors_exempt_headers */, base::nullopt /* new_url */);
       return;
     }
     DCHECK(network_loader_);
@@ -157,9 +159,9 @@ class SubresourceLoader : public network::mojom::URLLoader,
     if (handler) {
       CreateAndStartAppCacheLoader(std::move(handler));
     } else {
-      network_loader_->FollowRedirect({} /* removed_headers */,
-                                      {} /* modified_headers */,
-                                      base::nullopt /* new_url */);
+      network_loader_->FollowRedirect(
+          {} /* removed_headers */, {} /* modified_headers */,
+          {} /* modified_cors_exempt_headers */, base::nullopt /* new_url */);
     }
   }
 
diff --git a/chromium/content/browser/appcache/appcache_unittest.cc b/chromium/content/browser/appcache/appcache_unittest.cc
index 02fcaf3b6cd..8fcfc54df73 100644
--- a/chromium/content/browser/appcache/appcache_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_unittest.cc
@@ -125,8 +125,7 @@ TEST_F(AppCacheTest, InitializeWithManifest) {
       APPCACHE_NETWORK_NAMESPACE, GURL("http://w2.com"), GURL()));
   manifest.online_whitelist_all = true;
 
-  base::Time token_expires;
-  cache->InitializeWithManifest(&manifest, token_expires);
+  cache->InitializeWithManifest(&manifest);
   const std::vector<AppCacheNamespace>& fallbacks =
       cache->fallback_namespaces_;
   size_t expected = 1;
@@ -176,7 +175,6 @@ TEST_F(AppCacheTest, FindResponseForRequest) {
   const int64_t kForeignExplicitResponseId = 4;
   const int64_t kExplicitInOnlineNamespaceResponseId = 5;
   const int64_t kInterceptResponseId = 6;
-  const base::Time token_expires;
 
   AppCacheManifest manifest;
   manifest.online_whitelist_namespaces.push_back(AppCacheNamespace(
@@ -197,7 +195,7 @@ TEST_F(AppCacheTest, FindResponseForRequest) {
 
   // Create a cache with some namespaces and entries.
   auto cache = base::MakeRefCounted<AppCache>(service.storage(), 1234);
-  cache->InitializeWithManifest(&manifest, token_expires);
+  cache->InitializeWithManifest(&manifest);
   cache->AddEntry(
       kFallbackEntryUrl1,
       AppCacheEntry(AppCacheEntry::FALLBACK, kFallbackResponseId1));
@@ -377,7 +375,6 @@ TEST_F(AppCacheTest, ToFromDatabaseRecords) {
       "/patternwhitelist* isPattern\r"
       "/whitelist\r"
       "*\r");
-  const base::Time token_expires;
 
   MockAppCacheService service;
   auto cache = base::MakeRefCounted<AppCache>(service.storage(), kCacheId);
@@ -387,7 +384,7 @@ TEST_F(AppCacheTest, ToFromDatabaseRecords) {
   EXPECT_TRUE(
       ParseManifest(kManifestUrl, kManifestScope, kData.c_str(), kData.length(),
                     PARSE_MANIFEST_ALLOWING_DANGEROUS_FEATURES, manifest));
-  cache->InitializeWithManifest(&manifest, token_expires);
+  cache->InitializeWithManifest(&manifest);
   EXPECT_EQ(APPCACHE_NETWORK_NAMESPACE,
             cache->online_whitelist_namespaces_[0].type);
   EXPECT_EQ(kPatternWhitelistUrl,
diff --git a/chromium/content/browser/appcache/appcache_update_job.cc b/chromium/content/browser/appcache/appcache_update_job.cc
index 2f0caeeeb60..0680e53423b 100644
--- a/chromium/content/browser/appcache/appcache_update_job.cc
+++ b/chromium/content/browser/appcache/appcache_update_job.cc
@@ -16,6 +16,7 @@
 #include "content/browser/appcache/appcache_disk_cache_ops.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_histograms.h"
+#include "content/browser/appcache/appcache_policy.h"
 #include "content/browser/appcache/appcache_response_info.h"
 #include "content/browser/appcache/appcache_update_job_cache_copier.h"
 #include "content/browser/appcache/appcache_update_url_fetcher.h"
@@ -26,6 +27,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "storage/browser/quota/padding_key.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "url/origin.h"
@@ -281,6 +283,8 @@ AppCacheUpdateJob::AppCacheUpdateJob(AppCacheServiceImpl* service,
       stored_state_(UNSTORED),
       storage_(service->storage()) {
   service_->AddObserver(this);
+  is_origin_trial_required_ =
+      service_->appcache_policy()->IsOriginTrialRequiredForAppCache();
 }
 
 AppCacheUpdateJob::~AppCacheUpdateJob() {
@@ -482,8 +486,6 @@ void AppCacheUpdateJob::HandleManifestFetchCompleted(URLFetcher* url_fetcher,
 
   std::unique_ptr<URLFetcher> manifest_fetcher = std::move(manifest_fetcher_);
   UpdateURLLoaderRequest* request = manifest_fetcher->request();
-  auto token_expires = storage_->GetOriginTrialExpiration(
-      request->GetURL(), request->GetResponseHeaders(), base::Time::Now());
 
   int response_code = -1;
   bool is_valid_response_code = false;
@@ -505,20 +507,21 @@ void AppCacheUpdateJob::HandleManifestFetchCompleted(URLFetcher* url_fetcher,
     manifest_response_info_ =
         std::make_unique<net::HttpResponseInfo>(request->GetResponseInfo());
     if (update_type_ == UPGRADE_ATTEMPT) {
-      CheckIfManifestChanged(token_expires);  // continues asynchronously
+      CheckIfManifestChanged();  // continues asynchronously
     } else {
-      HandleFetchedManifestChanged(token_expires);
+      HandleFetchedManifestChanged();
     }
     return;
   }
 
   if (response_code == 304 && update_type_ == UPGRADE_ATTEMPT) {
-    if (fetched_manifest_scope_ == cached_manifest_scope_) {
+    if (cached_manifest_parser_version_ >= 2 &&
+        fetched_manifest_scope_ == cached_manifest_scope_) {
       HandleFetchedManifestIsUnchanged();
     } else {
-      // We don't check if |cached_manifest_parser_version_| is 0 here since in
-      // that case we didn't add conditional headers and don't expect a 304
-      // response.
+      // We don't check if |cached_manifest_parser_version_| is less than 2 here
+      // since in that case we didn't add conditional headers and don't expect a
+      // 304 response.
       ReadManifestFromCacheAndContinue();
     }
     return;
@@ -530,13 +533,13 @@ void AppCacheUpdateJob::HandleManifestFetchCompleted(URLFetcher* url_fetcher,
     return;
   }
 
-  const char kFormatString[] = "Manifest fetch failed (%d) %s";
+  static const char kFormatString[] = "Manifest fetch failed (%d) %s";
   std::string message = FormatUrlErrorMessage(
       kFormatString, manifest_url_, manifest_fetcher->result(), response_code);
   HandleCacheFailure(
       blink::mojom::AppCacheErrorDetails(
           message, blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR,
-          manifest_url_, response_code, false /*is_cross_origin*/),
+          manifest_url_, response_code, /*is_cross_origin=*/false),
       manifest_fetcher->result(), GURL());
 }
 
@@ -548,7 +551,7 @@ void AppCacheUpdateJob::OnGroupMadeObsolete(AppCacheGroup* group,
       "The cache has been made obsolete, "
       "the manifest file returned 404 or 410",
       blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR, GURL(),
-      response_code, false /*is_cross_origin*/));
+      response_code, /*is_cross_origin=*/false));
   if (success) {
     DCHECK(group->is_obsolete());
     NotifyAllAssociatedHosts(
@@ -561,7 +564,7 @@ void AppCacheUpdateJob::OnGroupMadeObsolete(AppCacheGroup* group,
         blink::mojom::AppCacheErrorDetails(
             "Failed to mark the cache as obsolete",
             blink::mojom::AppCacheErrorReason::APPCACHE_UNKNOWN_ERROR, GURL(),
-            0, false /*is_cross_origin*/),
+            0, /*is_cross_origin=*/false),
         DB_ERROR, GURL());
   }
 }
@@ -573,8 +576,8 @@ void AppCacheUpdateJob::HandleFetchedManifestIsUnchanged() {
   internal_state_ = AppCacheUpdateJobState::NO_UPDATE;
 
   // We should only ever allow AppCaches to remain unchanged if their parser
-  // version is 1 or higher.
-  DCHECK_GE(cached_manifest_parser_version_, 1);
+  // version is 2 or higher.
+  DCHECK_GE(cached_manifest_parser_version_, 2);
 
   // No manifest update is planned.  Set the fetched manifest parser version
   // and scope to match their initial values.
@@ -591,7 +594,7 @@ void AppCacheUpdateJob::HandleFetchedManifestIsUnchanged() {
   MaybeCompleteUpdate();  // if not done, run async 7.9.4 step 7 substeps
 }
 
-void AppCacheUpdateJob::HandleFetchedManifestChanged(base::Time token_expires) {
+void AppCacheUpdateJob::HandleFetchedManifestChanged() {
   DCHECK_EQ(internal_state_, AppCacheUpdateJobState::FETCH_MANIFEST);
 
   AppCacheManifest manifest;
@@ -601,21 +604,36 @@ void AppCacheUpdateJob::HandleFetchedManifestChanged(base::Time token_expires) {
                          ? PARSE_MANIFEST_ALLOWING_DANGEROUS_FEATURES
                          : PARSE_MANIFEST_PER_STANDARD,
                      manifest)) {
-    const char kFormatString[] = "Failed to parse manifest %s";
+    static const char kFormatString[] = "Failed to parse manifest %s";
     const std::string message = base::StringPrintf(kFormatString,
         manifest_url_.spec().c_str());
     HandleCacheFailure(
         blink::mojom::AppCacheErrorDetails(
             message,
             blink::mojom::AppCacheErrorReason::APPCACHE_SIGNATURE_ERROR, GURL(),
-            0, false /*is_cross_origin*/),
+            0, /*is_cross_origin=*/false),
+        MANIFEST_ERROR, GURL());
+    VLOG(1) << message;
+    return;
+  }
+
+  if (is_origin_trial_required_ &&
+      manifest.token_expires <= base::Time::Now()) {
+    static const char kFormatString[] =
+        "Invalid or missing manifest origin trial token: %s";
+    const std::string message =
+        base::StringPrintf(kFormatString, manifest_url_.spec().c_str());
+    HandleCacheFailure(
+        blink::mojom::AppCacheErrorDetails(
+            message, blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR,
+            manifest_url_, 0, /*is_cross_origin=*/false),
         MANIFEST_ERROR, GURL());
     VLOG(1) << message;
     return;
   }
 
   // Ensure the manifest parser version matches what we configured.
-  DCHECK_EQ(manifest.parser_version, 1);
+  DCHECK_EQ(manifest.parser_version, 2);
   fetched_manifest_parser_version_ = manifest.parser_version;
 
   // Ensure the manifest scope matches what we configured.
@@ -626,7 +644,8 @@ void AppCacheUpdateJob::HandleFetchedManifestChanged(base::Time token_expires) {
   inprogress_cache_ =
       base::MakeRefCounted<AppCache>(storage_, storage_->NewCacheId());
   BuildUrlFileList(manifest);
-  inprogress_cache_->InitializeWithManifest(&manifest, token_expires);
+
+  inprogress_cache_->InitializeWithManifest(&manifest);
 
   // Associate all pending master hosts with the newly created cache.
   for (const auto& pair : pending_master_entries_) {
@@ -716,9 +735,6 @@ void AppCacheUpdateJob::HandleResourceFetchCompleted(URLFetcher* url_fetcher,
     entry.SetResponseAndPaddingSizes(
         entry_fetcher->response_writer()->amount_written(),
         ComputeAppCacheResponsePadding(url, manifest_url_));
-    entry.set_token_expires(storage_->GetOriginTrialExpiration(
-        url, entry_fetcher->request()->GetResponseHeaders(),
-        base::Time::Now()));
     if (!inprogress_cache_->AddOrModifyEntry(url, entry))
       duplicate_response_ids_.push_back(entry.response_id());
 
@@ -748,7 +764,7 @@ void AppCacheUpdateJob::HandleResourceFetchCompleted(URLFetcher* url_fetcher,
   } else if (entry.IsExplicit() || entry.IsFallback() || entry.IsIntercept()) {
     VLOG(1) << "Request error: " << net_error
             << " response code: " << response_code;
-    const char kFormatString[] = "Resource fetch failed (%d) %s";
+    static const char kFormatString[] = "Resource fetch failed (%d) %s";
     std::string message = FormatUrlErrorMessage(
         kFormatString, url, entry_fetcher->result(), response_code);
     ResultType result = entry_fetcher->result();
@@ -804,9 +820,6 @@ void AppCacheUpdateJob::HandleResourceFetchCompleted(URLFetcher* url_fetcher,
     entry.SetResponseAndPaddingSizes(
         entry_fetcher->existing_entry().response_size(),
         entry_fetcher->existing_entry().padding_size());
-    entry.set_token_expires(storage_->GetOriginTrialExpiration(
-        url, entry_fetcher->request()->GetResponseHeaders(),
-        base::Time::Now()));
     inprogress_cache_->AddOrModifyEntry(url, entry);
   }
 
@@ -833,8 +846,6 @@ void AppCacheUpdateJob::ContinueHandleResourceFetchCompleted(
   entry.SetResponseAndPaddingSizes(
       cache_copier->response_writer()->amount_written(),
       ComputeAppCacheResponsePadding(url, manifest_url_));
-  entry.set_token_expires(storage_->GetOriginTrialExpiration(
-      url, entry_fetcher->request()->GetResponseHeaders(), base::Time::Now()));
   inprogress_cache_->AddOrModifyEntry(url, entry);
   cache_copier.reset();
   cache_copier_by_url_.erase(url);
@@ -891,12 +902,10 @@ void AppCacheUpdateJob::HandleNewMasterEntryFetchCompleted(
     DCHECK(entry_fetcher->response_writer());
     // Master entries cannot be cross-origin by definition, so they do not
     // require padding.
-    base::Time token_expires = storage_->GetOriginTrialExpiration(
-        url, entry_fetcher->request()->GetResponseHeaders(), base::Time::Now());
     AppCacheEntry master_entry(
         AppCacheEntry::MASTER, entry_fetcher->response_writer()->response_id(),
         entry_fetcher->response_writer()->amount_written(),
-        /*padding_size=*/0, token_expires);
+        /*padding_size=*/0);
     if (cache->AddOrModifyEntry(url, master_entry))
       added_master_entries_.push_back(url);
     else
@@ -924,13 +933,13 @@ void AppCacheUpdateJob::HandleNewMasterEntryFetchCompleted(
 
     failed_master_entries_.insert(url);
 
-    const char kFormatString[] = "Manifest fetch failed (%d) %s";
+    static const char kFormatString[] = "Manifest fetch failed (%d) %s";
     std::string message =
         FormatUrlErrorMessage(kFormatString, request->GetURL(),
                               entry_fetcher->result(), response_code);
     host_notifier.SendErrorNotifications(blink::mojom::AppCacheErrorDetails(
         message, blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR,
-        request->GetURL(), response_code, false /*is_cross_origin*/));
+        request->GetURL(), response_code, /*is_cross_origin=*/false));
 
     // In downloading case, update result is different if all master entries
     // failed vs. only some failing.
@@ -945,7 +954,7 @@ void AppCacheUpdateJob::HandleNewMasterEntryFetchCompleted(
             blink::mojom::AppCacheErrorDetails(
                 message,
                 blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR,
-                request->GetURL(), response_code, false /*is_cross_origin*/),
+                request->GetURL(), response_code, /*is_cross_origin=*/false),
             entry_fetcher->result(), GURL());
         return;
       }
@@ -989,13 +998,10 @@ void AppCacheUpdateJob::HandleManifestRefetchCompleted(URLFetcher* url_fetcher,
       scoped_refptr<HttpResponseInfoIOBuffer> io_buffer =
           base::MakeRefCounted<HttpResponseInfoIOBuffer>(
               std::move(manifest_response_info_));
-      base::Time token_expires = storage_->GetOriginTrialExpiration(
-          manifest_url_, manifest_fetcher->request()->GetResponseHeaders(),
-          base::Time::Now());
       manifest_response_writer_->WriteInfo(
           io_buffer.get(),
           base::BindOnce(&AppCacheUpdateJob::OnManifestInfoWriteComplete,
-                         base::Unretained(this), token_expires));
+                         base::Unretained(this)));
     }
   } else {
     VLOG(1) << "Request error: " << net_error
@@ -1006,10 +1012,10 @@ void AppCacheUpdateJob::HandleManifestRefetchCompleted(URLFetcher* url_fetcher,
           blink::mojom::AppCacheErrorDetails(
               "Manifest changed during update",
               blink::mojom::AppCacheErrorReason::APPCACHE_CHANGED_ERROR, GURL(),
-              0, false /*is_cross_origin*/),
+              0, /*is_cross_origin=*/false),
           MANIFEST_ERROR, GURL());
     } else {
-      const char kFormatString[] = "Manifest re-fetch failed (%d) %s";
+      static const char kFormatString[] = "Manifest re-fetch failed (%d) %s";
       std::string message =
           FormatUrlErrorMessage(kFormatString, manifest_url_,
                                 manifest_fetcher->result(), response_code);
@@ -1023,55 +1029,48 @@ void AppCacheUpdateJob::HandleManifestRefetchCompleted(URLFetcher* url_fetcher,
           blink::mojom::AppCacheErrorDetails(
               message,
               blink::mojom::AppCacheErrorReason::APPCACHE_MANIFEST_ERROR,
-              GURL(), response_code, false /*is_cross_origin*/),
+              GURL(), response_code, /*is_cross_origin=*/false),
           result, GURL());
     }
   }
 }
 
-void AppCacheUpdateJob::OnManifestInfoWriteComplete(base::Time token_expires,
-                                                    int result) {
+void AppCacheUpdateJob::OnManifestInfoWriteComplete(int result) {
   if (result > 0) {
     scoped_refptr<net::StringIOBuffer> io_buffer =
         base::MakeRefCounted<net::StringIOBuffer>(manifest_data_);
     manifest_response_writer_->WriteData(
         io_buffer.get(), manifest_data_.length(),
         base::BindOnce(&AppCacheUpdateJob::OnManifestDataWriteComplete,
-                       base::Unretained(this), token_expires));
+                       base::Unretained(this)));
   } else {
     HandleCacheFailure(
         blink::mojom::AppCacheErrorDetails(
             "Failed to write the manifest headers to storage",
             blink::mojom::AppCacheErrorReason::APPCACHE_UNKNOWN_ERROR, GURL(),
-            0, false /*is_cross_origin*/),
+            0, /*is_cross_origin=*/false),
         DISKCACHE_ERROR, GURL());
   }
 }
 
-void AppCacheUpdateJob::OnManifestDataWriteComplete(base::Time token_expires,
-                                                    int result) {
+void AppCacheUpdateJob::OnManifestDataWriteComplete(int result) {
   if (result > 0) {
     // The manifest determines the cache's origin, so the manifest entry is
     // always same-origin, and thus does not require padding.
     AppCacheEntry entry(AppCacheEntry::MANIFEST,
                         manifest_response_writer_->response_id(),
                         manifest_response_writer_->amount_written(),
-                        /*padding_size=*/0, token_expires);
+                        /*padding_size=*/0);
     if (!inprogress_cache_->AddOrModifyEntry(manifest_url_, entry))
       duplicate_response_ids_.push_back(entry.response_id());
 
-    // Although the manifest url entry has the right token_expires,
-    // push this to the cache as well.
-    // TODO(pwnall): Figure out if we want to overwrite or max the two entries.
-    inprogress_cache_->set_token_expires(
-        std::max(token_expires, inprogress_cache_->token_expires()));
     StoreGroupAndCache();
   } else {
     HandleCacheFailure(
         blink::mojom::AppCacheErrorDetails(
             "Failed to write the manifest data to storage",
             blink::mojom::AppCacheErrorReason::APPCACHE_UNKNOWN_ERROR, GURL(),
-            0, false /*is_cross_origin*/),
+            0, /*is_cross_origin=*/false),
         DISKCACHE_ERROR, GURL());
   }
 }
@@ -1112,11 +1111,6 @@ void AppCacheUpdateJob::StoreGroupAndCache() {
   group_->set_first_evictable_error_time(base::Time());
   if (doing_full_update_check_)
     group_->set_last_full_update_check_time(base::Time::Now());
-
-  // TODO(pwnall): Figure out if we want to overwrite or max the two entries.
-  group_->set_token_expires(
-      std::max(group_->token_expires(), newest_cache->token_expires()));
-
   storage_->StoreGroupAndNewestCache(group_, newest_cache.get(), this);
 }
 
@@ -1148,7 +1142,7 @@ void AppCacheUpdateJob::OnGroupAndNewestCacheStored(AppCacheGroup* group,
     reason = blink::mojom::AppCacheErrorReason::APPCACHE_QUOTA_ERROR;
   }
   HandleCacheFailure(blink::mojom::AppCacheErrorDetails(
-                         message, reason, GURL(), 0, false /*is_cross_origin*/),
+                         message, reason, GURL(), 0, /*is_cross_origin=*/false),
                      result, GURL());
 }
 
@@ -1227,7 +1221,7 @@ void AppCacheUpdateJob::OnServiceReinitialized(
     disabled_storage_reference_ = old_storage_ref;
 }
 
-void AppCacheUpdateJob::CheckIfManifestChanged(base::Time token_expires) {
+void AppCacheUpdateJob::CheckIfManifestChanged() {
   DCHECK_EQ(internal_state_, AppCacheUpdateJobState::FETCH_MANIFEST);
   DCHECK_EQ(update_type_, UPGRADE_ATTEMPT);
   AppCacheEntry* entry = nullptr;
@@ -1244,7 +1238,7 @@ void AppCacheUpdateJob::CheckIfManifestChanged(base::Time token_expires) {
           blink::mojom::AppCacheErrorDetails(
               "Manifest entry not found in existing cache",
               blink::mojom::AppCacheErrorReason::APPCACHE_UNKNOWN_ERROR, GURL(),
-              0, false /*is_cross_origin*/),
+              0, /*is_cross_origin=*/false),
           DB_ERROR, GURL());
       service->DeleteAppCacheGroup(manifest_url_,
                                    net::CompletionOnceCallback());
@@ -1253,12 +1247,12 @@ void AppCacheUpdateJob::CheckIfManifestChanged(base::Time token_expires) {
   }
 
   if (fetched_manifest_scope_ != cached_manifest_scope_) {
-    HandleFetchedManifestChanged(token_expires);
+    HandleFetchedManifestChanged();
     return;
   }
 
-  if (cached_manifest_parser_version_ < 1) {
-    HandleFetchedManifestChanged(token_expires);
+  if (cached_manifest_parser_version_ < 2) {
+    HandleFetchedManifestChanged();
     return;
   }
 
@@ -1270,25 +1264,23 @@ void AppCacheUpdateJob::CheckIfManifestChanged(base::Time token_expires) {
   manifest_response_reader_->ReadData(
       read_manifest_buffer_.get(), kAppCacheFetchBufferSize,
       base::BindOnce(&AppCacheUpdateJob::OnManifestDataReadComplete,
-                     base::Unretained(this), token_expires));  // async read
+                     base::Unretained(this)));  // async read
 }
 
-void AppCacheUpdateJob::OnManifestDataReadComplete(base::Time token_expires,
-                                                   int result) {
-  DCHECK_GE(cached_manifest_parser_version_, 1);
+void AppCacheUpdateJob::OnManifestDataReadComplete(int result) {
+  DCHECK_GE(cached_manifest_parser_version_, 2);
   DCHECK_EQ(fetched_manifest_scope_, cached_manifest_scope_);
   if (result > 0) {
     loaded_manifest_data_.append(read_manifest_buffer_->data(), result);
     manifest_response_reader_->ReadData(
         read_manifest_buffer_.get(), kAppCacheFetchBufferSize,
         base::BindOnce(&AppCacheUpdateJob::OnManifestDataReadComplete,
-                       base::Unretained(this), token_expires));  // read more
+                       base::Unretained(this)));  // read more
   } else {
     read_manifest_buffer_ = nullptr;
     manifest_response_reader_.reset();
-    if (result < 0 || manifest_data_ != loaded_manifest_data_ ||
-        read_manifest_token_expires_ != token_expires) {
-      HandleFetchedManifestChanged(token_expires);
+    if (result < 0 || manifest_data_ != loaded_manifest_data_) {
+      HandleFetchedManifestChanged();
     } else {
       HandleFetchedManifestIsUnchanged();
     }
@@ -1298,7 +1290,6 @@ void AppCacheUpdateJob::OnManifestDataReadComplete(base::Time token_expires,
 void AppCacheUpdateJob::ReadManifestFromCacheAndContinue() {
   DCHECK_EQ(internal_state_, AppCacheUpdateJobState::FETCH_MANIFEST);
   DCHECK_EQ(update_type_, UPGRADE_ATTEMPT);
-  DCHECK_NE(fetched_manifest_scope_, cached_manifest_scope_);
   // |manifest_response_info_| should have been saved in OnResponseInfoLoaded(),
   // we'll reuse it later in ContinueHandleManifestFetchCompleted() so make sure
   // it's still there.
@@ -1317,7 +1308,7 @@ void AppCacheUpdateJob::ReadManifestFromCacheAndContinue() {
           blink::mojom::AppCacheErrorDetails(
               "Manifest entry not found in existing cache",
               blink::mojom::AppCacheErrorReason::APPCACHE_UNKNOWN_ERROR, GURL(),
-              0, false /*is_cross_origin*/),
+              0, /*is_cross_origin=*/false),
           DB_ERROR, GURL());
       service->DeleteAppCacheGroup(manifest_url_,
                                    net::CompletionOnceCallback());
@@ -1335,7 +1326,6 @@ void AppCacheUpdateJob::ReadManifestFromCacheAndContinue() {
       read_manifest_buffer_.get(), kAppCacheFetchBufferSize,
       base::BindOnce(&AppCacheUpdateJob::OnManifestFromCacheDataReadComplete,
                      base::Unretained(this)));  // async read
-  read_manifest_token_expires_ = entry->token_expires();
 }
 
 void AppCacheUpdateJob::OnManifestFromCacheDataReadComplete(int result) {
@@ -1351,12 +1341,7 @@ void AppCacheUpdateJob::OnManifestFromCacheDataReadComplete(int result) {
     manifest_data_ = loaded_manifest_data_;
     read_manifest_buffer_ = nullptr;
     manifest_response_reader_.reset();
-
-    // This path is only hit via a 304 response, where we are not expected
-    // to update the token expires, so pretend it hasn't been set.
-    base::Time token_expires;
-
-    HandleFetchedManifestChanged(token_expires);
+    HandleFetchedManifestChanged();
   }
 }
 
@@ -1619,7 +1604,7 @@ void AppCacheUpdateJob::OnResponseInfoLoaded(
       // be deleted.
       manifest_response_info_ =
           std::make_unique<net::HttpResponseInfo>(*http_info);
-      if (cached_manifest_parser_version_ >= 1) {
+      if (cached_manifest_parser_version_ >= 2) {
         manifest_fetcher_->set_existing_response_headers(
             http_info->headers.get());
       }
@@ -1653,7 +1638,6 @@ void AppCacheUpdateJob::OnResponseInfoLoaded(
       entry.set_response_id(response_id);
       entry.SetResponseAndPaddingSizes(copy_me->response_size(),
                                        copy_me->padding_size());
-      entry.set_token_expires(copy_me->token_expires());
       inprogress_cache_->AddOrModifyEntry(url, entry);
       NotifyAllProgress(url);
       ++url_fetches_completed_;
diff --git a/chromium/content/browser/appcache/appcache_update_job.h b/chromium/content/browser/appcache/appcache_update_job.h
index cb82bb5ddc6..9909165d0f9 100644
--- a/chromium/content/browser/appcache/appcache_update_job.h
+++ b/chromium/content/browser/appcache/appcache_update_job.h
@@ -141,7 +141,7 @@ class CONTENT_EXPORT AppCacheUpdateJob
   // new master entry.
   void FetchManifest();
   void HandleManifestFetchCompleted(URLFetcher* url_fetcher, int net_error);
-  void HandleFetchedManifestChanged(base::Time token_expires);
+  void HandleFetchedManifestChanged();
   void HandleFetchedManifestIsUnchanged();
 
   void HandleResourceFetchCompleted(URLFetcher* url_fetcher, int net_error);
@@ -153,8 +153,8 @@ class CONTENT_EXPORT AppCacheUpdateJob
   void RefetchManifest();
   void HandleManifestRefetchCompleted(URLFetcher* url_fetcher, int net_error);
 
-  void OnManifestInfoWriteComplete(base::Time token_expires, int result);
-  void OnManifestDataWriteComplete(base::Time token_expires, int result);
+  void OnManifestInfoWriteComplete(int result);
+  void OnManifestDataWriteComplete(int result);
 
   void StoreGroupAndCache();
 
@@ -169,8 +169,8 @@ class CONTENT_EXPORT AppCacheUpdateJob
 
   // Checks if manifest is byte for byte identical with the manifest
   // in the newest application cache.
-  void CheckIfManifestChanged(base::Time token_expires);
-  void OnManifestDataReadComplete(base::Time token_expires, int result);
+  void CheckIfManifestChanged();
+  void OnManifestDataReadComplete(int result);
 
   // Used to read a manifest from the cache in case of a 304 Not Modified HTTP
   // response.
@@ -304,7 +304,6 @@ class CONTENT_EXPORT AppCacheUpdateJob
   std::unique_ptr<net::HttpResponseInfo> manifest_response_info_;
   std::unique_ptr<AppCacheResponseWriter> manifest_response_writer_;
   scoped_refptr<net::IOBuffer> read_manifest_buffer_;
-  base::Time read_manifest_token_expires_;
   std::string loaded_manifest_data_;
   std::unique_ptr<AppCacheResponseReader> manifest_response_reader_;
   bool manifest_has_valid_mime_type_;
@@ -334,6 +333,10 @@ class CONTENT_EXPORT AppCacheUpdateJob
   // |cache_copier_by_url_| owns all running cache copies, indexed by |url|.
   std::map<GURL, std::unique_ptr<CacheCopier>> cache_copier_by_url_;
 
+  // Whether to gate the fetch/update of a manifest on the presence of
+  // an origin trial token in the manifest.
+  bool is_origin_trial_required_ = false;
+
   AppCacheStorage* storage_;
   base::WeakPtrFactory<AppCacheUpdateJob> weak_factory_{this};
 
diff --git a/chromium/content/browser/appcache/appcache_update_job_unittest.cc b/chromium/content/browser/appcache/appcache_update_job_unittest.cc
index 8dfa7482ea0..6e9dd515471 100644
--- a/chromium/content/browser/appcache/appcache_update_job_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_update_job_unittest.cc
@@ -31,6 +31,7 @@
 #include "content/browser/appcache/appcache_response_info.h"
 #include "content/browser/appcache/appcache_update_url_loader_request.h"
 #include "content/browser/appcache/mock_appcache_service.h"
+#include "content/browser/appcache/test_origin_trial_policy.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/url_loader_factory_getter.h"
@@ -49,6 +50,7 @@
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/origin_trials/origin_trial_policy.h"
 #include "third_party/blink/public/common/origin_trials/trial_token.h"
 #include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
@@ -56,43 +58,22 @@
 #include "third_party/blink/public/mojom/appcache/appcache_info.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 
-// TODO(enne): consolidate multiple TestOriginTrialPolicy implementations
 namespace {
-const char* kTestAppCacheOriginTrialToken =
-  "AhiiB7vi3JiEO1/"
-  "RQIytQslLSN3WYVu3Xd32abYhTia+91ladjnXSClfU981x+"
-  "aoPimEqYVy6tWoeMZZYTpqlggAAABNeyJvcmlnaW4iOiAiaHR0cDovL21vY2tob3N0OjgwIiwg"
-  "ImZlYXR1cmUiOiAiQXBwQ2FjaGUiLCAiZXhwaXJ5IjogMTc2MTE2NjQxOH0=";
-
-const uint8_t kTestPublicKey[] = {
-    0x75, 0x10, 0xac, 0xf9, 0x3a, 0x1c, 0xb8, 0xa9, 0x28, 0x70, 0xd2,
-    0x9a, 0xd0, 0x0b, 0x59, 0xe1, 0xac, 0x2b, 0xb7, 0xd5, 0xca, 0x1f,
-    0x64, 0x90, 0x08, 0x8e, 0xa8, 0xe0, 0x56, 0x3a, 0x04, 0xd0,
-};
-
-class TestOriginTrialPolicy : public blink::OriginTrialPolicy {
- public:
-  TestOriginTrialPolicy() {
-    public_keys_.push_back(
-        base::StringPiece(reinterpret_cast<const char*>(kTestPublicKey),
-                          base::size(kTestPublicKey)));
-  }
-
-  bool IsOriginTrialsSupported() const override { return true; }
-  std::vector<base::StringPiece> GetPublicKeys() const override {
-    return public_keys_;
-  }
-  bool IsOriginSecure(const GURL& url) const override { return true; }
+// tools/origin_trials/generate_token.py http://mockhost AppCache
+// --expire-days=2000
+#define APPCACHE_ORIGIN_TRIAL_TOKEN                                            \
+  "AhiiB7vi3JiEO1/"                                                            \
+  "RQIytQslLSN3WYVu3Xd32abYhTia+91ladjnXSClfU981x+"                            \
+  "aoPimEqYVy6tWoeMZZYTpqlggAAABNeyJvcmlnaW4iOiAiaHR0cDovL21vY2tob3N0OjgwIiwg" \
+  "ImZlYXR1cmUiOiAiQXBwQ2FjaGUiLCAiZXhwaXJ5IjogMTc2MTE2NjQxOH0="
 
- private:
-  std::vector<base::StringPiece> public_keys_;
-};
-
-static TestOriginTrialPolicy g_origin_trial_policy;
+const char* kTestAppCacheOriginTrialToken = APPCACHE_ORIGIN_TRIAL_TOKEN;
 
 }  // namespace
 
 namespace content {
+static TestOriginTrialPolicy g_origin_trial_policy;
+
 namespace appcache_update_job_unittest {
 
 class AppCacheUpdateJobTest;
@@ -112,6 +93,16 @@ const char kManifest1Contents[] =
     "NETWORK:\n"
     "*\n";
 
+const char kManifest1OriginTrialContents[] =
+    "CACHE MANIFEST\n"
+    "explicit1\n"
+    "ORIGIN-TRIAL:\n" APPCACHE_ORIGIN_TRIAL_TOKEN
+    "\n"
+    "FALLBACK:\n"
+    "fallback1 fallback1a\n"
+    "NETWORK:\n"
+    "*\n";
+
 const char kManifest1WithNotModifiedContents[] =
     "CACHE MANIFEST\n"
     "explicit1\n"
@@ -139,6 +130,20 @@ const char kManifest2Contents[] =
     "NETWORK:\n"
     "*\n";
 
+const char kManifest2OriginTrialContents[] =
+    "CACHE MANIFEST\n"
+    "explicit1\n"
+    "CHROMIUM-INTERCEPT:\n"
+    "intercept1 return intercept1a\n"
+    "/bar/intercept2 return intercept2a\n"
+    "ORIGIN-TRIAL:\n" APPCACHE_ORIGIN_TRIAL_TOKEN
+    "\n"
+    "FALLBACK:\n"
+    "fallback1 fallback1a\n"
+    "/bar/fallback2 fallback2a\n"
+    "NETWORK:\n"
+    "*\n";
+
 const char kScopeManifestContents[] =
     "CACHE MANIFEST\n"
     "CHROMIUM-INTERCEPT:\n"
@@ -189,8 +194,7 @@ class MockHttpServer {
 
   static void GetMockResponse(const std::string& path,
                               std::string* headers,
-                              std::string* body,
-                              bool append_origin_trial_header) {
+                              std::string* body) {
     const char ok_headers[] =
         "HTTP/1.1 200 OK\n"
         "\n";
@@ -260,6 +264,9 @@ class MockHttpServer {
     } else if (path == "/files/manifest2") {
       (*headers) = std::string(manifest_headers, base::size(manifest_headers));
       (*body) = kManifest2Contents;
+    } else if (path == "/files/manifest2-origin-trial") {
+      (*headers) = std::string(manifest_headers, base::size(manifest_headers));
+      (*body) = kManifest2OriginTrialContents;
     } else if (path == "/files/manifest2-with-root-override") {
       (*headers) = GetManifestHeaders(/*ok=*/true, /*scope=*/"/");
       (*body) = kManifest2Contents;
@@ -375,25 +382,6 @@ class MockHttpServer {
           std::string(not_found_headers, base::size(not_found_headers));
       (*body) = "";
     }
-
-    // Do some hacky string editing to conditionally edit in the
-    // origin trial header if requested.
-    if (append_origin_trial_header) {
-      int insert_idx = 0;
-      size_t len = headers->length();
-      for (size_t i = len - 1; i > 0; --i) {
-        char c = (*headers)[i];
-        if (c != '\0' && c != '\n') {
-          insert_idx = i + 1;
-          break;
-        }
-      }
-      CHECK_GT(insert_idx, 0);
-      headers->erase(insert_idx, len - insert_idx);
-      (*headers) += "\nOrigin-Trial: ";
-      (*headers) += kTestAppCacheOriginTrialToken;
-      (*headers) += "\n\n";
-    }
   }
 };
 
@@ -704,7 +692,10 @@ class AppCacheUpdateJobTest : public testing::Test,
                                 base::Unretained(this))),
         process_id_(123),
         weak_partition_factory_(static_cast<StoragePartitionImpl*>(
-            BrowserContext::GetDefaultStoragePartition(&browser_context_))) {}
+            BrowserContext::GetDefaultStoragePartition(&browser_context_))) {
+    appcache_require_origin_trial_feature_.InitAndDisableFeature(
+        blink::features::kAppCacheRequireOriginTrial);
+  }
 
   // TODO(ananta/michaeln): Remove dependencies on URLRequest based
   // classes by refactoring the response headers/data into a common class.
@@ -725,8 +716,7 @@ class AppCacheUpdateJobTest : public testing::Test,
     if (RetryRequestTestJob::IsRetryUrl(url_request.url)) {
       RetryRequestTestJob::GetResponseForURL(url_request.url, &headers, &body);
     } else {
-      MockHttpServer::GetMockResponse(url_request.url.path(), &headers, &body,
-                                      append_origin_trial_header_to_responses_);
+      MockHttpServer::GetMockResponse(url_request.url.path(), &headers, &body);
     }
 
     net::HttpResponseInfo info;
@@ -1138,6 +1128,85 @@ class AppCacheUpdateJobTest : public testing::Test,
     WaitForUpdateToFinish();
   }
 
+  void UpgradeNotModifiedVersion1Test() {
+    MakeService();
+    group_ = base::MakeRefCounted<AppCacheGroup>(
+        service_->storage(), MockHttpServer::GetMockUrl("files/notmodified"),
+        service_->storage()->NewGroupId());
+    AppCacheUpdateJob* update =
+        new AppCacheUpdateJob(service_.get(), group_.get());
+    group_->update_job_ = update;
+
+    // Create response writer to get a response id.
+    response_writer_ =
+        service_->storage()->CreateResponseWriter(group_->manifest_url());
+
+    AppCache* cache = MakeCacheForGroup(service_->storage()->NewCacheId(),
+                                        response_writer_->response_id());
+    cache->set_manifest_parser_version(1);
+    EXPECT_EQ(cache->token_expires(), base::Time());
+
+    MockFrontend* frontend = MakeMockFrontend();
+    AppCacheHost* host = MakeHost(frontend);
+    host->AssociateCompleteCache(cache);
+
+    // Set up checks for when update job finishes.
+    do_checks_after_update_finished_ = true;
+    expect_group_obsolete_ = false;
+    expect_group_has_cache_ = true;
+    tested_manifest_path_override_ = "files/notmodified";
+    tested_manifest_ = MANIFEST1;
+
+    // Get the expected expiration date of the test token.
+    {
+      blink::TrialTokenValidator validator;
+      blink::TrialTokenResult result = validator.ValidateToken(
+          kTestAppCacheOriginTrialToken, MockHttpServer::GetOrigin(),
+          base::Time::Now());
+      expect_token_expires_ = result.expiry_time;
+      ASSERT_EQ(result.status, blink::OriginTrialTokenStatus::kSuccess);
+      EXPECT_EQ(GetAppCacheOriginTrialNameForTesting(), result.feature_name);
+      EXPECT_NE(base::Time(), expect_token_expires_);
+    }
+
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_CHECKING_EVENT);
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_DOWNLOADING_EVENT);
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_PROGRESS_EVENT);
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_PROGRESS_EVENT);
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_PROGRESS_EVENT);
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_UPDATE_READY_EVENT);
+
+    // Seed the response_info working set with canned data so that an existing
+    // manifest is reused by the update job.
+    const char kData[] =
+        "HTTP/1.1 200 OK\0"
+        "Last-Modified: Sat, 29 Oct 1994 19:43:31 GMT\0"
+        "\0";
+    const std::string kRawHeaders(kData, base::size(kData));
+    MakeAppCacheResponseInfo(group_->manifest_url(),
+                             response_writer_->response_id(), kRawHeaders);
+
+    // Last data parsed pretends to be version 1, and doesn't know about
+    // the origin trial (verified above).  Even with a 304, this should
+    // refresh the token expires field.
+    const std::string seed_data(kManifest1OriginTrialContents);
+    scoped_refptr<net::StringIOBuffer> io_buffer =
+        base::MakeRefCounted<net::StringIOBuffer>(seed_data);
+    response_writer_->WriteData(
+        io_buffer.get(), seed_data.length(),
+        base::BindOnce(
+            &AppCacheUpdateJobTest::StartUpdateAfterSeedingStorageData,
+            base::Unretained(this)));
+
+    // Start update after data write completes asynchronously.
+  }
+
   void UpgradeManifestDataChangedScopeUnchangedTest() {
     MakeService();
     // URL path /files/manifest2-with-root-override has a cached scope of "/".
@@ -3980,18 +4049,20 @@ class AppCacheUpdateJobTest : public testing::Test,
     // Get the expected expiration date of the test token.
     {
       blink::TrialTokenValidator validator;
-      std::string token_feature;
-      ASSERT_EQ(validator.ValidateToken(
-                    kTestAppCacheOriginTrialToken, MockHttpServer::GetOrigin(),
-                    base::Time::Now(), &token_feature, &expect_token_expires_),
-                blink::OriginTrialTokenStatus::kSuccess);
-      EXPECT_EQ(AppCacheStorage::GetOriginTrialNameForTesting(), token_feature);
+      blink::TrialTokenResult result = validator.ValidateToken(
+          kTestAppCacheOriginTrialToken, MockHttpServer::GetOrigin(),
+          base::Time::Now());
+      expect_token_expires_ = result.expiry_time;
+      ASSERT_EQ(result.status, blink::OriginTrialTokenStatus::kSuccess);
+      EXPECT_EQ(GetAppCacheOriginTrialNameForTesting(), result.feature_name);
       EXPECT_NE(base::Time(), expect_token_expires_);
     }
 
     MakeService();
+    tested_manifest_path_override_ = "files/manifest2-origin-trial";
     group_ = base::MakeRefCounted<AppCacheGroup>(
-        service_->storage(), MockHttpServer::GetMockUrl("files/manifest2"),
+        service_->storage(),
+        MockHttpServer::GetMockUrl(tested_manifest_path_override_),
         service_->storage()->NewGroupId());
     AppCacheUpdateJob* update =
         new AppCacheUpdateJob(service_.get(), group_.get());
@@ -4008,7 +4079,6 @@ class AppCacheUpdateJobTest : public testing::Test,
     host1->AssociateCompleteCache(cache);
 
     // Set up checks for when update job finishes.
-    append_origin_trial_header_to_responses_ = true;
     do_checks_after_update_finished_ = true;
     expect_group_obsolete_ = false;
     expect_group_has_cache_ = true;
@@ -4043,6 +4113,31 @@ class AppCacheUpdateJobTest : public testing::Test,
     // Start update after data write completes asynchronously.
   }
 
+  void OriginTrialRequiredNoTokenTest() {
+    GURL manifest_url = MockHttpServer::GetMockUrl("files/manifest1");
+
+    MakeService();
+    group_ = base::MakeRefCounted<AppCacheGroup>(
+        service_->storage(), manifest_url, service_->storage()->NewGroupId());
+    ASSERT_TRUE(group_->last_full_update_check_time().is_null());
+    AppCacheUpdateJob* update =
+        new AppCacheUpdateJob(service_.get(), group_.get());
+    group_->update_job_ = update;
+
+    MockFrontend* frontend = MakeMockFrontend();
+    AppCacheHost* host = MakeHost(frontend);
+    update->StartUpdate(host, GURL());
+
+    // Set up checks for when update job finishes.
+    do_checks_after_update_finished_ = true;
+    expect_group_obsolete_ = false;
+    expect_group_has_cache_ = false;
+    frontend->AddExpectedEvent(
+        blink::mojom::AppCacheEventID::APPCACHE_CHECKING_EVENT);
+
+    WaitForUpdateToFinish();
+  }
+
   void WaitForUpdateToFinish() {
     if (group_->update_status() == AppCacheGroup::IDLE)
       UpdateFinished();
@@ -4106,7 +4201,7 @@ class AppCacheUpdateJobTest : public testing::Test,
                               int64_t manifest_response_id) {
     AppCache* cache = new AppCache(service_->storage(), cache_id);
     cache->set_complete(true);
-    cache->set_manifest_parser_version(1);
+    cache->set_manifest_parser_version(2);
     cache->set_manifest_scope("/");
     cache->set_update_time(base::Time::Now() - kOneHour);
     group_->AddCache(cache);
@@ -4190,6 +4285,7 @@ class AppCacheUpdateJobTest : public testing::Test,
 
     if (expect_group_has_cache_) {
       ASSERT_TRUE(group_->newest_complete_cache() != nullptr);
+      EXPECT_EQ(group_->newest_complete_cache()->manifest_parser_version(), 2);
 
       if (expect_non_null_update_time_)
         EXPECT_TRUE(!group_->newest_complete_cache()->update_time().is_null());
@@ -4233,23 +4329,11 @@ class AppCacheUpdateJobTest : public testing::Test,
       EXPECT_TRUE(group_->newest_complete_cache() == nullptr);
     }
 
-    // Verify token_expires times on cache, group, entry, namespaces.
-    {
-      EXPECT_EQ(group_->token_expires(), expect_token_expires_);
-      if (expect_group_has_cache_) {
-        AppCache* cache = group_->newest_complete_cache();
-        ASSERT_TRUE(cache);
-        EXPECT_EQ(cache->token_expires(), expect_token_expires_);
-        for (const auto& pair : cache->entries()) {
-          EXPECT_EQ(pair.second.token_expires(), expect_token_expires_);
-        }
-        for (auto& fallback : cache->fallback_namespaces_) {
-          EXPECT_EQ(fallback.token_expires, expect_token_expires_);
-        }
-        for (auto& intercept : cache->intercept_namespaces_) {
-          EXPECT_EQ(intercept.token_expires, expect_token_expires_);
-        }
-      }
+    // Verify token_expires times on cache.
+    if (expect_group_has_cache_) {
+      AppCache* cache = group_->newest_complete_cache();
+      ASSERT_TRUE(cache);
+      EXPECT_EQ(cache->token_expires(), expect_token_expires_);
     }
 
     // Check expected events.
@@ -4954,14 +5038,14 @@ class AppCacheUpdateJobTest : public testing::Test,
   AppCache::EntryMap expect_extra_entries_;
   std::map<GURL, int64_t> expect_response_ids_;
 
-  bool append_origin_trial_header_to_responses_ = false;
-
   content::TestBrowserContext browser_context_;
   URLLoaderInterceptor interceptor_;
   const int process_id_;
   std::map<GURL, std::unique_ptr<HttpHeadersRequestTestJob>>
       http_headers_request_test_jobs_;
 
+  base::test::ScopedFeatureList appcache_require_origin_trial_feature_;
+
   base::WeakPtrFactory<StoragePartitionImpl> weak_partition_factory_;
 };
 
@@ -5064,6 +5148,10 @@ TEST_F(AppCacheUpdateJobTest, UpgradeNotModified) {
   RunTestOnUIThread(&AppCacheUpdateJobTest::UpgradeNotModifiedTest);
 }
 
+TEST_F(AppCacheUpdateJobTest, UpgradeNotModifiedVersion1) {
+  RunTestOnUIThread(&AppCacheUpdateJobTest::UpgradeNotModifiedVersion1Test);
+}
+
 TEST_F(AppCacheUpdateJobTest, UpgradeManifestDataChangedScopeUnchanged) {
   RunTestOnUIThread(
       &AppCacheUpdateJobTest::UpgradeManifestDataChangedScopeUnchangedTest);
@@ -5372,9 +5460,25 @@ TEST_F(AppCacheUpdateJobTest, CrossOriginHttpsDenied) {
   RunTestOnUIThread(&AppCacheUpdateJobTest::CrossOriginHttpsDeniedTest);
 }
 
-TEST_F(AppCacheUpdateJobTest, OriginTrialUpdate) {
+TEST_F(AppCacheUpdateJobTest, OriginTrialUpdateWithFeature) {
+  // Updating a manifest with a valid token should work
+  // with or without the kAppCacheRequireOriginTrial feature.
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
   RunTestOnUIThread(&AppCacheUpdateJobTest::OriginTrialUpdateTest);
 }
 
+TEST_F(AppCacheUpdateJobTest, OriginTrialUpdateWithoutFeature) {
+  base::test::ScopedFeatureList f;
+  f.InitAndDisableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(&AppCacheUpdateJobTest::OriginTrialUpdateTest);
+}
+
+TEST_F(AppCacheUpdateJobTest, OriginTrialRequiredNoToken) {
+  base::test::ScopedFeatureList f;
+  f.InitAndEnableFeature(blink::features::kAppCacheRequireOriginTrial);
+  RunTestOnUIThread(&AppCacheUpdateJobTest::OriginTrialRequiredNoTokenTest);
+}
+
 }  // namespace appcache_update_job_unittest
 }  // namespace content
diff --git a/chromium/content/browser/appcache/appcache_url_loader.cc b/chromium/content/browser/appcache/appcache_url_loader.cc
index ee0aa21afd0..a734156b49c 100644
--- a/chromium/content/browser/appcache/appcache_url_loader.cc
+++ b/chromium/content/browser/appcache/appcache_url_loader.cc
@@ -144,6 +144,7 @@ base::WeakPtr<AppCacheURLLoader> AppCacheURLLoader::GetWeakPtr() {
 void AppCacheURLLoader::FollowRedirect(
     const std::vector<std::string>& modified_headers,
     const net::HttpRequestHeaders& removed_headers,
+    const net::HttpRequestHeaders& removed_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   NOTREACHED() << "appcache never produces redirects";
 }
diff --git a/chromium/content/browser/appcache/appcache_url_loader.h b/chromium/content/browser/appcache/appcache_url_loader.h
index 8d32d7b35cf..8e1fa3b9dda 100644
--- a/chromium/content/browser/appcache/appcache_url_loader.h
+++ b/chromium/content/browser/appcache/appcache_url_loader.h
@@ -127,9 +127,11 @@ class CONTENT_EXPORT AppCacheURLLoader : public AppCacheStorage::Delegate,
   base::WeakPtr<AppCacheURLLoader> GetWeakPtr();
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/browser/appcache/appcache_working_set.cc b/chromium/content/browser/appcache/appcache_working_set.cc
index 7d512965f72..43020460062 100644
--- a/chromium/content/browser/appcache/appcache_working_set.cc
+++ b/chromium/content/browser/appcache/appcache_working_set.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/appcache/appcache_working_set.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/browser/appcache/appcache.h"
 #include "content/browser/appcache/appcache_group.h"
 #include "content/browser/appcache/appcache_response_info.h"
diff --git a/chromium/content/browser/appcache/chrome_appcache_service.cc b/chromium/content/browser/appcache/chrome_appcache_service.cc
index ca42159f3e2..c098e0d26d5 100644
--- a/chromium/content/browser/appcache/chrome_appcache_service.cc
+++ b/chromium/content/browser/appcache/chrome_appcache_service.cc
@@ -37,8 +37,8 @@ void ChromeAppCacheService::Initialize(
   browser_context_ = browser_context;
 
   // Init our base class.
-  AppCacheServiceImpl::Initialize(cache_path_);
   set_appcache_policy(this);
+  AppCacheServiceImpl::Initialize(cache_path_);
   set_special_storage_policy(special_storage_policy.get());
 }
 
@@ -56,18 +56,28 @@ void ChromeAppCacheService::Shutdown() {
   partition_ = nullptr;
 }
 
-bool ChromeAppCacheService::CanLoadAppCache(const GURL& manifest_url,
-                                            const GURL& first_party) {
+bool ChromeAppCacheService::CanLoadAppCache(
+    const GURL& manifest_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return GetContentClient()->browser()->AllowAppCache(manifest_url, first_party,
-                                                      browser_context_);
+  return GetContentClient()->browser()->AllowAppCache(
+      manifest_url, site_for_cookies, top_frame_origin, browser_context_);
 }
 
 bool ChromeAppCacheService::CanCreateAppCache(
-    const GURL& manifest_url, const GURL& first_party) {
+    const GURL& manifest_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  return GetContentClient()->browser()->AllowAppCache(
+      manifest_url, site_for_cookies, top_frame_origin, browser_context_);
+}
+
+bool ChromeAppCacheService::IsOriginTrialRequiredForAppCache() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return GetContentClient()->browser()->AllowAppCache(manifest_url, first_party,
-                                                      browser_context_);
+  return GetContentClient()->browser()->IsOriginTrialRequiredForAppCache(
+      browser_context_);
 }
 
 ChromeAppCacheService::~ChromeAppCacheService() = default;
diff --git a/chromium/content/browser/appcache/chrome_appcache_service.h b/chromium/content/browser/appcache/chrome_appcache_service.h
index 39d15f7e6d8..731abba3872 100644
--- a/chromium/content/browser/appcache/chrome_appcache_service.h
+++ b/chromium/content/browser/appcache/chrome_appcache_service.h
@@ -64,10 +64,15 @@ class CONTENT_EXPORT ChromeAppCacheService
   void Shutdown();
 
   // AppCachePolicy overrides
-  bool CanLoadAppCache(const GURL& manifest_url,
-                       const GURL& first_party) override;
-  bool CanCreateAppCache(const GURL& manifest_url,
-                         const GURL& first_party) override;
+  bool CanLoadAppCache(
+      const GURL& manifest_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) override;
+  bool CanCreateAppCache(
+      const GURL& manifest_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) override;
+  bool IsOriginTrialRequiredForAppCache() override;
 
  protected:
   ~ChromeAppCacheService() override;
diff --git a/chromium/content/browser/appcache/mock_appcache_policy.cc b/chromium/content/browser/appcache/mock_appcache_policy.cc
index f2667dc1de7..c9fbcfa5469 100644
--- a/chromium/content/browser/appcache/mock_appcache_policy.cc
+++ b/chromium/content/browser/appcache/mock_appcache_policy.cc
@@ -4,6 +4,9 @@
 
 #include "content/browser/appcache/mock_appcache_policy.h"
 
+#include "base/feature_list.h"
+#include "third_party/blink/public/common/features.h"
+
 namespace content {
 
 MockAppCachePolicy::MockAppCachePolicy()
@@ -12,16 +15,27 @@ MockAppCachePolicy::MockAppCachePolicy()
 
 MockAppCachePolicy::~MockAppCachePolicy() = default;
 
-bool MockAppCachePolicy::CanLoadAppCache(const GURL& manifest_url,
-                                         const GURL& first_party) {
+bool MockAppCachePolicy::CanLoadAppCache(
+    const GURL& manifest_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
   requested_manifest_url_ = manifest_url;
   return can_load_return_value_;
 }
 
-bool MockAppCachePolicy::CanCreateAppCache(const GURL& manifest_url,
-                                           const GURL& first_party) {
+bool MockAppCachePolicy::CanCreateAppCache(
+    const GURL& manifest_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
   requested_manifest_url_ = manifest_url;
   return can_create_return_value_;
 }
 
+bool MockAppCachePolicy::IsOriginTrialRequiredForAppCache() {
+  // Ignore the force enable override preference here and just check the
+  // feature.
+  return base::FeatureList::IsEnabled(
+      blink::features::kAppCacheRequireOriginTrial);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/appcache/mock_appcache_policy.h b/chromium/content/browser/appcache/mock_appcache_policy.h
index a571e25efb6..747315ee28f 100644
--- a/chromium/content/browser/appcache/mock_appcache_policy.h
+++ b/chromium/content/browser/appcache/mock_appcache_policy.h
@@ -16,10 +16,15 @@ class MockAppCachePolicy : public AppCachePolicy {
   MockAppCachePolicy();
   virtual ~MockAppCachePolicy();
 
-  bool CanLoadAppCache(const GURL& manifest_url,
-                       const GURL& first_party) override;
-  bool CanCreateAppCache(const GURL& manifest_url,
-                         const GURL& first_party) override;
+  bool CanLoadAppCache(
+      const GURL& manifest_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) override;
+  bool CanCreateAppCache(
+      const GURL& manifest_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) override;
+  bool IsOriginTrialRequiredForAppCache() override;
 
   bool can_load_return_value_;
   bool can_create_return_value_;
diff --git a/chromium/content/browser/appcache/mock_appcache_service.h b/chromium/content/browser/appcache/mock_appcache_service.h
index 37d49075dda..7e840039721 100644
--- a/chromium/content/browser/appcache/mock_appcache_service.h
+++ b/chromium/content/browser/appcache/mock_appcache_service.h
@@ -7,6 +7,7 @@
 
 #include "base/compiler_specific.h"
 #include "content/browser/appcache/appcache_service_impl.h"
+#include "content/browser/appcache/mock_appcache_policy.h"
 #include "content/browser/appcache/mock_appcache_storage.h"
 #include "storage/browser/quota/quota_manager.h"
 
@@ -20,6 +21,7 @@ class MockAppCacheService : public AppCacheServiceImpl {
         mock_delete_appcaches_for_origin_result_(net::OK),
         delete_called_count_(0) {
     storage_ = std::make_unique<MockAppCacheStorage>(this);
+    set_appcache_policy(&mock_policy_);
   }
   MockAppCacheService() : MockAppCacheService(nullptr) {}
 
@@ -39,6 +41,8 @@ class MockAppCacheService : public AppCacheServiceImpl {
   int delete_called_count() const { return delete_called_count_; }
 
  private:
+  MockAppCachePolicy mock_policy_;
+
   int mock_delete_appcaches_for_origin_result_;
   int delete_called_count_;
 };
diff --git a/chromium/content/browser/appcache/mock_appcache_storage.cc b/chromium/content/browser/appcache/mock_appcache_storage.cc
index 986b51b198a..7cbebb28247 100644
--- a/chromium/content/browser/appcache/mock_appcache_storage.cc
+++ b/chromium/content/browser/appcache/mock_appcache_storage.cc
@@ -7,8 +7,8 @@
 #include <stddef.h>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
diff --git a/chromium/content/browser/appcache/mock_appcache_storage_unittest.cc b/chromium/content/browser/appcache/mock_appcache_storage_unittest.cc
index ec5674884f5..a74291ea96e 100644
--- a/chromium/content/browser/appcache/mock_appcache_storage_unittest.cc
+++ b/chromium/content/browser/appcache/mock_appcache_storage_unittest.cc
@@ -476,7 +476,6 @@ TEST_F(MockAppCacheStorageTest, BasicFindMainFallbackResponse) {
   const GURL kManifestUrl("http://blah/manifest");
   const int64_t kResponseId1 = 1;
   const int64_t kResponseId2 = 2;
-  const base::Time token_expires;
 
   AppCacheManifest manifest;
   manifest.fallback_namespaces.push_back(AppCacheNamespace(
@@ -485,7 +484,7 @@ TEST_F(MockAppCacheStorageTest, BasicFindMainFallbackResponse) {
       APPCACHE_FALLBACK_NAMESPACE, kFallbackNamespaceUrl2, kFallbackEntryUrl2));
 
   auto cache = base::MakeRefCounted<AppCache>(service.storage(), kCacheId);
-  cache->InitializeWithManifest(&manifest, token_expires);
+  cache->InitializeWithManifest(&manifest);
   cache->AddEntry(kFallbackEntryUrl1,
                   AppCacheEntry(AppCacheEntry::FALLBACK, kResponseId1));
   cache->AddEntry(kFallbackEntryUrl2,
@@ -588,13 +587,12 @@ TEST_F(MockAppCacheStorageTest, FindMainResponseExclusions) {
   const GURL kManifestUrl("http://blah/manifest");
   const GURL kOnlineNamespaceUrl("http://blah/online_namespace");
   const int64_t kResponseId = 1;
-  const base::Time token_expires;
 
   AppCacheManifest manifest;
   manifest.online_whitelist_namespaces.push_back(AppCacheNamespace(
       APPCACHE_NETWORK_NAMESPACE, kOnlineNamespaceUrl, GURL()));
   auto cache = base::MakeRefCounted<AppCache>(service.storage(), kCacheId);
-  cache->InitializeWithManifest(&manifest, token_expires);
+  cache->InitializeWithManifest(&manifest);
   cache->AddEntry(
       kEntryUrl,
       AppCacheEntry(AppCacheEntry::EXPLICIT | AppCacheEntry::FOREIGN,
diff --git a/chromium/content/browser/appcache/test_origin_trial_policy.cc b/chromium/content/browser/appcache/test_origin_trial_policy.cc
new file mode 100644
index 00000000000..cf705329dba
--- /dev/null
+++ b/chromium/content/browser/appcache/test_origin_trial_policy.cc
@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/appcache/test_origin_trial_policy.h"
+
+#include "base/stl_util.h"
+
+namespace content {
+
+const uint8_t kTestPublicKey[] = {
+    0x75, 0x10, 0xac, 0xf9, 0x3a, 0x1c, 0xb8, 0xa9, 0x28, 0x70, 0xd2,
+    0x9a, 0xd0, 0x0b, 0x59, 0xe1, 0xac, 0x2b, 0xb7, 0xd5, 0xca, 0x1f,
+    0x64, 0x90, 0x08, 0x8e, 0xa8, 0xe0, 0x56, 0x3a, 0x04, 0xd0,
+};
+
+TestOriginTrialPolicy::TestOriginTrialPolicy() {
+  public_keys_.push_back(
+      base::StringPiece(reinterpret_cast<const char*>(kTestPublicKey),
+                        base::size(kTestPublicKey)));
+}
+
+bool TestOriginTrialPolicy::IsOriginTrialsSupported() const {
+  return true;
+}
+
+std::vector<base::StringPiece> TestOriginTrialPolicy::GetPublicKeys() const {
+  return public_keys_;
+}
+
+bool TestOriginTrialPolicy::IsOriginSecure(const GURL& url) const {
+  return true;
+}
+
+TestOriginTrialPolicy::~TestOriginTrialPolicy() = default;
+
+}  // namespace content
diff --git a/chromium/content/browser/appcache/test_origin_trial_policy.h b/chromium/content/browser/appcache/test_origin_trial_policy.h
new file mode 100644
index 00000000000..a6ac44abb14
--- /dev/null
+++ b/chromium/content/browser/appcache/test_origin_trial_policy.h
@@ -0,0 +1,27 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_APPCACHE_TEST_ORIGIN_TRIAL_POLICY_H_
+#define CONTENT_BROWSER_APPCACHE_TEST_ORIGIN_TRIAL_POLICY_H_
+
+#include "third_party/blink/public/common/origin_trials/origin_trial_policy.h"
+
+namespace content {
+
+class TestOriginTrialPolicy : public blink::OriginTrialPolicy {
+ public:
+  TestOriginTrialPolicy();
+  ~TestOriginTrialPolicy() override;
+
+  bool IsOriginTrialsSupported() const override;
+  std::vector<base::StringPiece> GetPublicKeys() const override;
+  bool IsOriginSecure(const GURL& url) const override;
+
+ private:
+  std::vector<base::StringPiece> public_keys_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_APPCACHE_TEST_ORIGIN_TRIAL_POLICY_H_
diff --git a/chromium/content/browser/audio/audio_service.cc b/chromium/content/browser/audio/audio_service.cc
index 867c86cd614..cf3f44a6b6f 100644
--- a/chromium/content/browser/audio/audio_service.cc
+++ b/chromium/content/browser/audio/audio_service.cc
@@ -15,6 +15,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/browser/browser_main_loop.h"
+#include "content/browser/service_sandbox_type.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -124,7 +125,6 @@ void LaunchAudioServiceOutOfProcess(
       std::move(receiver),
       ServiceProcessHost::Options()
           .WithDisplayName("Audio Service")
-          .WithSandboxType(service_manager::SandboxType::kAudio)
 #if defined(OS_MACOSX)
           // On Mac, the audio service requires a CFRunLoop provided by a
           // UI MessageLoop type, to run AVFoundation and CoreAudio code.
diff --git a/chromium/content/browser/back_forward_cache_browsertest.cc b/chromium/content/browser/back_forward_cache_browsertest.cc
index 3ee1c7019d4..949450a204c 100644
--- a/chromium/content/browser/back_forward_cache_browsertest.cc
+++ b/chromium/content/browser/back_forward_cache_browsertest.cc
@@ -39,6 +39,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/back_forward_cache_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -61,8 +62,11 @@
 #include "net/test/test_data_directory.h"
 #include "services/device/public/cpp/test/fake_sensor_and_provider.h"
 #include "services/device/public/cpp/test/scoped_geolocation_overrider.h"
+#include "services/device/public/mojom/vibration_manager.mojom.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
+#include "third_party/blink/public/mojom/app_banner/app_banner.mojom.h"
 
 using testing::_;
 using testing::Each;
@@ -444,7 +448,7 @@ class BackForwardCacheBrowserTest : public ContentBrowserTest,
 
 // Match RenderFrameHostImpl* that are in the BackForwardCache.
 MATCHER(InBackForwardCache, "") {
-  return arg->is_in_back_forward_cache();
+  return arg->IsInBackForwardCache();
 }
 
 // Match RenderFrameDeleteObserver* which observed deletion of the RenderFrame.
@@ -569,11 +573,11 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Basic) {
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_EQ(rfh_a->GetVisibilityState(), PageVisibilityState::kHidden);
   EXPECT_EQ(origin_a, rfh_a->GetLastCommittedOrigin());
   EXPECT_EQ(origin_b, rfh_b->GetLastCommittedOrigin());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
   EXPECT_EQ(rfh_b->GetVisibilityState(), PageVisibilityState::kVisible);
 
   // 3) Go back to A.
@@ -584,9 +588,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Basic) {
   EXPECT_EQ(origin_a, rfh_a->GetLastCommittedOrigin());
   EXPECT_EQ(origin_b, rfh_b->GetLastCommittedOrigin());
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
   EXPECT_EQ(rfh_a->GetVisibilityState(), PageVisibilityState::kVisible);
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
   EXPECT_EQ(rfh_b->GetVisibilityState(), PageVisibilityState::kHidden);
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
@@ -610,8 +614,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicDocumentInitiated) {
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // The two pages are using different BrowsingInstances.
   EXPECT_FALSE(rfh_a->GetSiteInstance()->IsRelatedSiteInstance(
@@ -623,8 +627,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicDocumentInitiated) {
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -646,16 +650,16 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // 3) Go back to A.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -665,8 +669,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   EXPECT_EQ(rfh_b, current_frame_host());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -676,8 +680,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -687,8 +691,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   EXPECT_EQ(rfh_b, current_frame_host());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
@@ -716,7 +720,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // The BrowsingInstance shouldn't have changed.
   EXPECT_EQ(browsing_instance_id,
             rfh_a2->GetSiteInstance()->GetBrowsingInstanceId());
-  EXPECT_FALSE(rfh_a1->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a1->IsInBackForwardCache());
   // The main frame should have been reused for the navigation.
   EXPECT_EQ(rfh_a1, rfh_a2);
 }
@@ -771,7 +775,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, WindowOpen) {
   EXPECT_TRUE(ExecJs(rfh_a_new, JsReplace("location = $1;", url_b.spec())));
   EXPECT_TRUE(WaitForLoadStop(web_contents()));
   EXPECT_FALSE(delete_observer_rfh_a_new.deleted());
-  EXPECT_TRUE(rfh_a_new->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a_new->IsInBackForwardCache());
 
   // 6) Go back to A. The current document can finally enter the
   // BackForwardCache, because it is alone in its BrowsingInstance and has never
@@ -781,7 +785,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, WindowOpen) {
   EXPECT_TRUE(ExecJs(rfh_b_new, "history.back();"));
   EXPECT_TRUE(WaitForLoadStop(web_contents()));
   EXPECT_FALSE(delete_observer_rfh_b_new.deleted());
-  EXPECT_TRUE(rfh_b_new->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b_new->IsInBackForwardCache());
 }
 
 // Navigate from A(B) to C and go back.
@@ -804,9 +808,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicIframe) {
   RenderFrameDeletedObserver delete_observer_rfh_c(rfh_c);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_c->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_c->IsInBackForwardCache());
 
   // 3) Go back to A(B).
   web_contents()->GetController().GoBack();
@@ -815,9 +819,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicIframe) {
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_c->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -1204,7 +1208,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page A should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3. Navigate from an uncacheable to a cached page page (B->A).
   web_contents()->GetController().GoBack();
@@ -1225,7 +1229,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page A should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 5. Navigate from a cacheable page to a cached page (C->A).
   web_contents()->GetController().GoBack();
@@ -1234,7 +1238,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page C should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
-  EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_c->IsInBackForwardCache());
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
                 FROM_HERE);
@@ -1298,7 +1302,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page A should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Verify proxies are stored as well.
   auto* cached_entry = cache.GetEntry(rfh_a->nav_entry_id());
@@ -1327,7 +1331,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page A should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Verify proxies are stored as well.
   cached_entry = cache.GetEntry(rfh_a->nav_entry_id());
@@ -1344,7 +1348,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // Page C should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
-  EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_c->IsInBackForwardCache());
 
   // Verify proxies are stored as well.
   cached_entry = cache.GetEntry(rfh_c->nav_entry_id());
@@ -1527,8 +1531,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // 4) Go back to A and check the title again.
   web_contents()->GetController().GoBack();
@@ -1536,7 +1540,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
   {
     base::string16 title_when_loaded = base::UTF8ToUTF16("loaded!");
     TitleWatcher title_watcher(web_contents(), title_when_loaded);
@@ -1619,8 +1623,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
       FROM_HERE);
 }
 
+// TODO(https://crbug.com/1075936) disabled due to flakiness
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
-                       DoesNotCacheIfMainFrameStillLoading) {
+                       DISABLED_DoesNotCacheIfMainFrameStillLoading) {
   net::test_server::ControllableHttpResponse response(embedded_test_server(),
                                                       "/main_document");
   ASSERT_TRUE(embedded_test_server()->Start());
@@ -1923,7 +1928,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 5) Go back to the page with WakeLock.
   web_contents()->GetController().GoBack();
@@ -1986,6 +1991,116 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, DoesNotCacheIfHttpError) {
       FROM_HERE);
 }
 
+class MockAppBannerService : public blink::mojom::AppBannerService {
+ public:
+  MockAppBannerService() = default;
+  ~MockAppBannerService() override = default;
+
+  void Bind(mojo::ScopedMessagePipeHandle handle) {
+    receiver_.Bind(mojo::PendingReceiver<blink::mojom::AppBannerService>(
+        std::move(handle)));
+  }
+
+  mojo::Remote<blink::mojom::AppBannerController>& controller() {
+    return controller_;
+  }
+
+  void OnBannerPromptRequested(bool) {}
+
+  void SendBannerPromptRequest() {
+    blink::mojom::AppBannerController* controller_ptr = controller_.get();
+    base::OnceCallback<void(bool)> callback = base::BindOnce(
+        &MockAppBannerService::OnBannerPromptRequested, base::Unretained(this));
+    controller_ptr->BannerPromptRequest(
+        receiver_.BindNewPipeAndPassRemote(),
+        event_.BindNewPipeAndPassReceiver(), {"web"},
+        base::BindOnce(&MockAppBannerService::OnBannerPromptReply,
+                       base::Unretained(this), std::move(callback)));
+  }
+
+  void OnBannerPromptReply(base::OnceCallback<void(bool)> callback,
+                           blink::mojom::AppBannerPromptReply reply) {
+    std::move(callback).Run(reply ==
+                            blink::mojom::AppBannerPromptReply::CANCEL);
+  }
+
+  // blink::mojom::AppBannerService:
+  void DisplayAppBanner() override {}
+
+ private:
+  mojo::Receiver<blink::mojom::AppBannerService> receiver_{this};
+  mojo::Remote<blink::mojom::AppBannerEvent> event_;
+  mojo::Remote<blink::mojom::AppBannerController> controller_;
+
+  DISALLOW_COPY_AND_ASSIGN(MockAppBannerService);
+};
+
+class BackForwardCacheBrowserTestWithAppBanner
+    : public BackForwardCacheBrowserTest {
+ protected:
+  void SetUpOnMainThread() override {
+    web_contents()->GetMainFrame()->GetRemoteInterfaces()->GetInterface(
+        mock_app_banner_service_.controller().BindNewPipeAndPassReceiver());
+    BackForwardCacheBrowserTest::SetUpOnMainThread();
+  }
+
+  void SendBannerPromptRequest() {
+    mock_app_banner_service_.SendBannerPromptRequest();
+  }
+
+ private:
+  MockAppBannerService mock_app_banner_service_;
+};
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithAppBanner,
+                       DoesNotCacheIfAppBanner) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to A and request a PWA app banner.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
+  SendBannerPromptRequest();
+  RenderFrameDeletedObserver delete_observer_rfh(current_frame_host());
+
+  // 2) Navigate away. Page A requested a PWA app banner, and thus not cached.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+  delete_observer_rfh.WaitUntilDeleted();
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectNotRestored(
+      {BackForwardCacheMetrics::NotRestoredReason::kBlocklistedFeatures},
+      FROM_HERE);
+  ExpectBlocklistedFeature(
+      blink::scheduler::WebSchedulerTrackedFeature::kAppBanner, FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, DoesNotCacheIfWebDatabase) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to a page with WebDatabase usage.
+  GURL url(embedded_test_server()->GetURL("/simple_database.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver deleted(rfh_a);
+
+  // 2) Navigate away.
+  shell()->LoadURL(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  // The page uses WebDatabase so it should be deleted.
+  deleted.WaitUntilDeleted();
+
+  // 3) Go back to the page with WebDatabase.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectNotRestored(
+      {BackForwardCacheMetrics::NotRestoredReason::kBlocklistedFeatures},
+      FROM_HERE);
+  ExpectBlocklistedFeature(
+      blink::scheduler::WebSchedulerTrackedFeature::kWebDatabase, FROM_HERE);
+}
+
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
                        DoesNotCacheIfPageUnreachable) {
   ASSERT_TRUE(embedded_test_server()->Start());
@@ -2068,8 +2183,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // 3) Execute JavaScript on A.
   EvictByJavaScript(rfh_a);
@@ -2111,9 +2226,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_c->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_c->IsInBackForwardCache());
 
   // 3) Execute JavaScript on B.
   //
@@ -2156,8 +2271,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // 4) Execute JavaScript on A in the new world.
   EXPECT_FALSE(ExecJs(rfh_a, "console.log('hi');",
@@ -2216,8 +2331,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
 
   // 3) Execute JavaScript on A when restoring A.
   // Execute JavaScript after committing but before swapping happens on the
@@ -2254,8 +2369,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // A is not destroyed. A is reloaded instead.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
   EXPECT_NE("initial document", EvalJs(rfh_a, "window.foo"));
 
   ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
@@ -2289,8 +2404,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Events) {
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
   // TODO(yuzus): Post message to the frozen page, and make sure that the
   // messages arrive after the page visibility events, not before them.
 
@@ -2333,9 +2448,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, EventsForSubframes) {
   RenderFrameDeletedObserver delete_observer_rfh_c(rfh_c);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_c->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_c->IsInBackForwardCache());
   // TODO(yuzus): Post message to the frozen page, and make sure that the
   // messages arrive after the page visibility events, not before them.
 
@@ -2346,9 +2461,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, EventsForSubframes) {
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_c->IsInBackForwardCache());
   // visibilitychange events are added twice per each because it is fired for
   // both window and document.
   MatchEventList(
@@ -2388,8 +2503,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_FALSE(rfh_b->IsInBackForwardCache());
   // TODO(yuzus): Post message to the frozen page, and make sure that the
   // messages arrive after the page visibility events, not before them.
 
@@ -2424,7 +2539,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   RenderFrameHostImpl* rfh_b = current_frame_host();
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Cancel all navigation attempts.
   content::TestNavigationThrottleInserter throttle_inserter(
@@ -2461,7 +2576,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   RenderFrameHostImpl* rfh_b = current_frame_host();
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Cancel all navigation attempts.
   content::TestNavigationThrottleInserter throttle_inserter(
@@ -2522,7 +2637,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_NE(rfh_a, rfh_b);
 
   // 3) Start navigation to page A, and cause the document to be evicted during
@@ -2570,7 +2685,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameHostImpl* rfh_b2 = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b2(rfh_b2);
   EXPECT_FALSE(delete_observer_rfh_a1.deleted());
-  EXPECT_TRUE(rfh_a1->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a1->IsInBackForwardCache());
   EXPECT_NE(rfh_a1, rfh_b2);
 
   // 3) Start navigation to page A, and flush the cache during the navigation.
@@ -2589,7 +2704,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // rfh_a should have been deleted, and page A navigated to normally.
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
   delete_observer_rfh_a1.WaitUntilDeleted();
-  EXPECT_TRUE(rfh_b2->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b2->IsInBackForwardCache());
   RenderFrameHostImpl* rfh_a3 = current_frame_host();
   EXPECT_EQ(rfh_a3->GetLastCommittedURL(), url_a);
 }
@@ -2612,7 +2727,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
 
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
 
   // 3) Crash A's renderer process while it is in the cache.
@@ -2824,7 +2939,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CacheHTTPDocumentOnly) {
 
     if (test_case.expectation == STORED) {
       EXPECT_FALSE(delete_observer.deleted());
-      EXPECT_TRUE(rfh->is_in_back_forward_cache());
+      EXPECT_TRUE(rfh->IsInBackForwardCache());
       continue;
     }
 
@@ -2834,7 +2949,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CacheHTTPDocumentOnly) {
     if (test_case.url == blank_url &&
         !SiteIsolationPolicy::UseDedicatedProcessesForAllSites()) {
       EXPECT_FALSE(delete_observer.deleted());
-      EXPECT_FALSE(rfh->is_in_back_forward_cache());
+      EXPECT_FALSE(rfh->IsInBackForwardCache());
       EXPECT_EQ(rfh, current_frame_host());
       continue;
     }
@@ -2928,6 +3043,118 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
                            FROM_HERE);
 }
 
+class BackForwardCacheBrowserTestWithVibration
+    : public BackForwardCacheBrowserTest,
+      public device::mojom::VibrationManager {
+ public:
+  BackForwardCacheBrowserTestWithVibration() {
+    OverrideVibrationManagerBinderForTesting(base::BindRepeating(
+        &BackForwardCacheBrowserTestWithVibration::BindVibrationManager,
+        base::Unretained(this)));
+  }
+
+  ~BackForwardCacheBrowserTestWithVibration() override {
+    OverrideVibrationManagerBinderForTesting(base::NullCallback());
+  }
+
+  void BindVibrationManager(
+      mojo::PendingReceiver<device::mojom::VibrationManager> receiver) {
+    receiver_.Bind(std::move(receiver));
+  }
+
+  bool TriggerVibrate(RenderFrameHostImpl* rfh,
+                      int duration,
+                      base::OnceClosure vibrate_done) {
+    vibrate_done_ = std::move(vibrate_done);
+    bool result;
+    std::string script = "domAutomationController.send(navigator.vibrate(" +
+                         base::NumberToString(duration) + "))";
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(rfh, script, &result));
+    return result;
+  }
+
+  bool TriggerShortVibrationSequence(RenderFrameHostImpl* rfh,
+                                     base::OnceClosure vibrate_done) {
+    vibrate_done_ = std::move(vibrate_done);
+    bool result;
+    std::string script =
+        "domAutomationController.send(navigator.vibrate([10] * 1000))";
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(rfh, script, &result));
+    return result;
+  }
+
+  bool IsCancelled() { return cancelled_; }
+
+ private:
+  // device::mojom::VibrationManager:
+  void Vibrate(int64_t milliseconds, VibrateCallback callback) override {
+    cancelled_ = false;
+    std::move(callback).Run();
+    std::move(vibrate_done_).Run();
+  }
+
+  void Cancel(CancelCallback callback) override {
+    cancelled_ = true;
+    std::move(callback).Run();
+  }
+
+  bool cancelled_ = false;
+  base::OnceClosure vibrate_done_;
+  mojo::Receiver<device::mojom::VibrationManager> receiver_{this};
+};
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithVibration,
+                       VibrationStopsAfterEnteringCache) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to a page with a long vibration.
+  GURL url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  base::RunLoop run_loop;
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  ASSERT_TRUE(TriggerVibrate(rfh_a, 10000, run_loop.QuitClosure()));
+  EXPECT_FALSE(IsCancelled());
+
+  // 2) Navigate away and expect the vibration to be canceled.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+  EXPECT_NE(current_frame_host(), rfh_a);
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(IsCancelled());
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithVibration,
+                       ShortVibrationSequenceStopsAfterEnteringCache) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to a page with a long vibration.
+  GURL url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  base::RunLoop run_loop;
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  ASSERT_TRUE(TriggerShortVibrationSequence(rfh_a, run_loop.QuitClosure()));
+  EXPECT_FALSE(IsCancelled());
+
+  // 2) Navigate away and expect the vibration to be canceled.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+  EXPECT_NE(current_frame_host(), rfh_a);
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(IsCancelled());
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+}
+
 class BackForwardCacheBrowserTestWithServiceWorkerEnabled
     : public BackForwardCacheBrowserTest,
       public testing::WithParamInterface<bool> {
@@ -2970,7 +3197,7 @@ IN_PROC_BROWSER_TEST_P(BackForwardCacheBrowserTestWithServiceWorkerEnabled,
       NavigateToURL(shell(), https_server()->GetURL("b.com", "/title1.html")));
 
   EXPECT_FALSE(deleted.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Go back to A. The navigation should be served from the cache.
   web_contents()->GetController().GoBack();
@@ -3001,7 +3228,7 @@ IN_PROC_BROWSER_TEST_P(BackForwardCacheBrowserTestWithServiceWorkerEnabled,
   EXPECT_TRUE(
       NavigateToURL(tab_x, https_server()->GetURL("b.com", "/title1.html")));
   EXPECT_FALSE(deleted.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   // 4) Navigate to A in tab Y.
   EXPECT_TRUE(NavigateToURL(
       tab_y,
@@ -3067,7 +3294,7 @@ IN_PROC_BROWSER_TEST_P(BackForwardCacheBrowserTestWithServiceWorkerEnabled,
   EXPECT_TRUE(NavigateToURL(tab_to_be_bfcached,
                             https_server.GetURL("b.com", "/title1.html")));
   EXPECT_FALSE(deleted_observer_rfh.deleted());
-  EXPECT_TRUE(rfh->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh->IsInBackForwardCache());
 
   // 5) Trigger client.postMessage via |tab_to_execute_service_worker|. Cache in
   // |tab_to_be_bfcached| will be evicted.
@@ -3112,7 +3339,7 @@ IN_PROC_BROWSER_TEST_P(BackForwardCacheBrowserTestWithServiceWorkerEnabled,
   EXPECT_TRUE(NavigateToURL(tab_to_be_bfcached,
                             https_server.GetURL("b.com", "/title1.html")));
   EXPECT_FALSE(deleted.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Navigate to A in |tab_to_execute_service_worker|.
   EXPECT_TRUE(NavigateToURL(
@@ -3172,7 +3399,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CachePagesWithBeacon) {
 
   // Page A should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 }
 
 // Regression test for https://crbug.com/993337.
@@ -3212,13 +3439,13 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // 3) Navigate to B3.
   EXPECT_TRUE(NavigateToURL(shell(), url_b3));
-  EXPECT_TRUE(rfh_a2->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a2->IsInBackForwardCache());
   RenderFrameHostImpl* rfh_b3 = current_frame_host();
 
   // 4) Do a history navigation back to A1.
   web_contents()->GetController().GoToIndex(0);
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_TRUE(rfh_b3->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b3->IsInBackForwardCache());
 
   // Note that the frame for A1 gets created before A2 is deleted from the
   // cache, so there will be a brief period where two the main frames (A1 and
@@ -3257,7 +3484,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // 3) Navigate to D3.
   EXPECT_TRUE(NavigateToURL(shell(), url_d3));
-  EXPECT_TRUE(rfh_a2->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a2->IsInBackForwardCache());
   RenderFrameHostImpl* rfh_d3 = current_frame_host();
 
   // 4) Do a history navigation back to A1(B).
@@ -3265,7 +3492,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   // D3 takes A2(B(C))'s place in the cache.
-  EXPECT_TRUE(rfh_d3->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_d3->IsInBackForwardCache());
   delete_rfh_a2.WaitUntilDeleted();
 }
 
@@ -3286,7 +3513,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // 3) Navigate to B3.
   EXPECT_TRUE(NavigateToURL(shell(), url_b3));
-  EXPECT_TRUE(rfh_a2->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a2->IsInBackForwardCache());
   RenderFrameHostImpl* rfh_b3 = current_frame_host();
   // Make B3 ineligible for caching, so that navigating doesn't evict A2
   // due to the cache size limit.
@@ -3346,13 +3573,13 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // 2) Navigate to B2.
   EXPECT_TRUE(NavigateToURL(shell(), url_b2));
   RenderFrameHostImpl* rfh_b2 = current_frame_host();
-  EXPECT_TRUE(rfh_a1->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a1->IsInBackForwardCache());
 
   // 3) Navigate to A3.
   EXPECT_TRUE(NavigateToURL(shell(), url_a3));
   RenderFrameHostImpl* rfh_a3 = current_frame_host();
-  EXPECT_TRUE(rfh_a1->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b2->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a1->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b2->IsInBackForwardCache());
   // A1 and A3 shouldn't be treated as the same site instance.
   EXPECT_NE(rfh_a1->GetSiteInstance(), rfh_a3->GetSiteInstance());
 
@@ -3360,17 +3587,17 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // Make sure we can store A1 and A3 in the cache at the same time.
   EXPECT_TRUE(NavigateToURL(shell(), url_b4));
   RenderFrameHostImpl* rfh_b4 = current_frame_host();
-  EXPECT_TRUE(rfh_a1->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b2->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_a3->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a1->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b2->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_a3->IsInBackForwardCache());
 
   // 5) Go back to A3.
   // Make sure we can restore A3, while A1 remains in the cache.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_TRUE(rfh_a1->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b2->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b4->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a1->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b2->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b4->IsInBackForwardCache());
   EXPECT_EQ(rfh_a3, current_frame_host());
   // B2 and B4 shouldn't be treated as the same site instance.
   EXPECT_NE(rfh_b2->GetSiteInstance(), rfh_b4->GetSiteInstance());
@@ -3379,9 +3606,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // Make sure we can restore A1, while coming from A3.
   web_contents()->GetController().GoToIndex(0);
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_TRUE(rfh_b2->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b4->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_a3->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b2->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b4->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_a3->IsInBackForwardCache());
   EXPECT_EQ(rfh_a1, current_frame_host());
 }
 
@@ -3427,7 +3654,7 @@ IN_PROC_BROWSER_TEST_F(GeolocationBackForwardCacheBrowserTest,
   // The page has no inflight geolocation request when we navigated away,
   // so it should have been cached.
   EXPECT_FALSE(deleted.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 }
 
 // Test that a page which has an inflight geolocation query can be bfcached,
@@ -3478,7 +3705,7 @@ IN_PROC_BROWSER_TEST_F(GeolocationBackForwardCacheBrowserTest,
   // The page has no inflight geolocation request when we navigated away,
   // so it should have been cached.
   EXPECT_FALSE(deleted.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Resume resolving Geoposition queries.
   geo_override_.Resume();
@@ -3495,7 +3722,7 @@ IN_PROC_BROWSER_TEST_F(GeolocationBackForwardCacheBrowserTest,
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
 
   // Wait for an update after the user navigates back to A.
   EXPECT_EQ("resolved", EvalJs(rfh_a, R"(
@@ -3561,7 +3788,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, TimedEviction) {
 
   // 4) Confirm A is still in BackForwardCache.
   ASSERT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 5) Fast forward to when eviction is due.
   task_runner->FastForwardBy(delta);
@@ -3680,7 +3907,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // 2) Navigate to B.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_FALSE(rfh_a->is_evicted_from_back_forward_cache());
 
   BackForwardCache::DisableForRenderFrameHost(rfh_a, kDisabledReasonForTest);
@@ -3747,8 +3974,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, MetricsNotRecorded) {
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   // 3) Navigate to B#2 (same document navigation).
-  EXPECT_TRUE(ExecJs(shell(), JsReplace("location = $1", url_b2.spec())));
-  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_TRUE(NavigateToURLFromRenderer(shell(), url_b2));
 
   // 4) Go back to B.
   web_contents()->GetController().GoBack();
@@ -3801,7 +4027,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithDomainControlEnabled,
   // 3) Check if rfh_a is stored in back-forward cache, since it matches to
   // the list of allowed urls, it should be stored.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 4) Now go back to the last stored page, which in our case should be A.
   web_contents()->GetController().GoBack();
@@ -3811,7 +4037,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithDomainControlEnabled,
   // 5) Check if rfh_b is stored in back-forward cache, since it matches to
   // the list of allowed urls, it should be stored.
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
 }
 
 // We don't want to allow websites which doesn't match "allowed_websites" of
@@ -4052,7 +4278,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Encoding) {
   EXPECT_EQ(web_contents()->GetEncoding(), "windows-1250");
 
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_EQ(web_contents()->GetEncoding(), "UTF-8");
 
   web_contents()->GetController().GoBack();
@@ -4212,7 +4438,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, MAYBE_NavigationStart) {
   // 2) Navigate to B. A should be in the back forward cache.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Navigate back and expect everything to be restored.
   NavigationHandleObserver observer(web_contents(), url_a);
@@ -4301,7 +4527,7 @@ IN_PROC_BROWSER_TEST_F(
   // 2) Navigate to B.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   ASSERT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   WaitForFirstVisuallyNonEmptyPaint(shell()->web_contents());
 
   // 3) Navigate to back to A.
@@ -4329,7 +4555,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
   WaitForFirstVisuallyNonEmptyPaint(web_contents());
   ASSERT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_EQ(web_contents()->GetThemeColor(), base::nullopt);
 
   ThemeColorObserver observer(web_contents());
@@ -4396,7 +4622,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, AudioSuspendAndResume) {
 
   // 2) Navigate to B.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Navigate back to A.
   web_contents()->GetController().GoBack();
@@ -4476,7 +4702,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, VideoSuspendAndResume) {
 
   // 2) Navigate to B.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Navigate back to A.
   web_contents()->GetController().GoBack();
@@ -4899,7 +5125,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestForHighMemoryDevices,
 
   // 3) A should be stored in back-forward cache because the physical memory is
   // greater than the memory threshold.
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 }
 
 IN_PROC_BROWSER_TEST_F(
@@ -5014,7 +5240,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // 2) Navigate to an error page and expect the old page to be stored in
   // bfcache.
   EXPECT_FALSE(NavigateToURL(shell(), error_url));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Navigate back and expect the page to be restored from bfcache.
   web_contents()->GetController().GoBack();
@@ -5098,7 +5324,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
 
   // The page should still be requesting dialogs in a loop. Wait for one to be
   // requested.
@@ -5166,7 +5392,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   EXPECT_EQ(rfh_a, current_frame_host());
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
 
   // Try show another dialog. It should work.
   ExecuteScriptAsync(rfh_a, R"(window.alert("alert");)");
@@ -5330,13 +5556,13 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
   ASSERT_TRUE(NavigateToURL(shell(), url_b));
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // Navigate back to A. Ensure that connection state has been updated
   // accordingly.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->IsInBackForwardCache());
   EXPECT_EQ(presentation_connection_id, EvalJs(rfh_a, "connection.id"));
   EXPECT_EQ("closed", EvalJs(rfh_a, "connection.state"));
   EXPECT_TRUE(EvalJs(rfh_a, "connectionClosed").ExtractBool());
@@ -5395,7 +5621,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, FrameServiceBase) {
 
   // - Page A should be in the cache.
   ASSERT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
   EXPECT_FALSE(echo_deleted);
 
   // 3) Go back.
@@ -5592,10 +5818,45 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CheckIsCurrent) {
 
   // 2) Navigate to C.
   EXPECT_TRUE(NavigateToURL(shell(), url_c));
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
 
   EXPECT_FALSE(rfh_a->IsCurrent());
   EXPECT_FALSE(rfh_b->IsCurrent());
 }
+
+// Test that LifecycleState is updated correctly when page enters and restores
+// back from BackForwardCache.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       CheckLifecycleStateTransition) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title2.html"));
+
+  // 1) Navigate to A and check the LifecycleState of A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+
+  // 2) Navigate to B, now A enters BackForwardCache. Check the LifecycleState
+  // of both RenderFrameHost A and B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kInBackForwardCache,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_b->lifecycle_state());
+
+  // 3) Go back to A and check again the LifecycleState of both RenderFrameHost
+  // A and B.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_TRUE(rfh_b->IsInBackForwardCache());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kInBackForwardCache,
+            rfh_b->lifecycle_state());
+}
 }  // namespace content
diff --git a/chromium/content/browser/background_fetch/background_fetch_metrics.cc b/chromium/content/browser/background_fetch/background_fetch_metrics.cc
index f25c2ae7263..f400054f2b1 100644
--- a/chromium/content/browser/background_fetch/background_fetch_metrics.cc
+++ b/chromium/content/browser/background_fetch/background_fetch_metrics.cc
@@ -33,6 +33,9 @@ void RecordBackgroundFetchUkmEvent(
     BackgroundFetchPermission permission) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
+  // TODO(crbug.com/1061899): The code here should take an explicit reference
+  // to the corresponding frame instead of using the current main frame.
+
   // Only record UKM data if there's a frame associated.
   auto* web_contents = WebContents::FromFrameTreeNodeId(frame_tree_node_id);
   if (!web_contents)
@@ -44,7 +47,8 @@ void RecordBackgroundFetchUkmEvent(
   if (!origin.IsSameOriginWith(url::Origin::Create(displayed_origin)))
     return;
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(web_contents)
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
 
   ukm::builders::BackgroundFetch(source_id)
       .SetHasTitle(!options->title.empty())
diff --git a/chromium/content/browser/background_fetch/background_fetch_scheduler.cc b/chromium/content/browser/background_fetch/background_fetch_scheduler.cc
index da1c6bf2beb..4e2d28de560 100644
--- a/chromium/content/browser/background_fetch/background_fetch_scheduler.cc
+++ b/chromium/content/browser/background_fetch/background_fetch_scheduler.cc
@@ -88,6 +88,13 @@ BackgroundFetchScheduler::BackgroundFetchScheduler(
 
 BackgroundFetchScheduler::~BackgroundFetchScheduler() = default;
 
+BackgroundFetchScheduler::RegistrationData::RegistrationData(
+    const BackgroundFetchRegistrationId& registration_id,
+    blink::mojom::BackgroundFetchRegistrationDataPtr registration)
+    : registration_id(registration_id), registration(std::move(registration)) {}
+
+BackgroundFetchScheduler::RegistrationData::~RegistrationData() = default;
+
 bool BackgroundFetchScheduler::ScheduleDownload() {
   DCHECK_LT(num_running_downloads_, max_running_downloads_);
 
@@ -207,8 +214,8 @@ void BackgroundFetchScheduler::FinishJob(
 
   auto it = job_controllers_.find(registration_id.unique_id());
   if (it != job_controllers_.end()) {
-    completed_fetches_[it->first] = {registration_id,
-                                     it->second->NewRegistrationData()};
+    completed_fetches_[it->first] = std::make_unique<RegistrationData>(
+        registration_id, it->second->NewRegistrationData());
 
     // Reset scheduler params.
     num_running_downloads_ -= it->second->pending_downloads();
@@ -242,7 +249,7 @@ void BackgroundFetchScheduler::DidMarkForDeletion(
   DCHECK(it != completed_fetches_.end());
 
   blink::mojom::BackgroundFetchRegistrationDataPtr& registration_data =
-      it->second.second;
+      it->second->registration;
   // Include any other failure reasons the marking for deletion may have found.
   if (registration_data->failure_reason == BackgroundFetchFailureReason::NONE)
     registration_data->failure_reason = failure_reason;
@@ -268,6 +275,9 @@ void BackgroundFetchScheduler::DidMarkForDeletion(
     // No need to keep the controller around since there won't be dispatch
     // events.
     completed_fetches_.erase(it);
+  } else {
+    // The registration is now safe to delete.
+    it->second->processing_completed = true;
   }
 }
 
@@ -305,8 +315,11 @@ void BackgroundFetchScheduler::DispatchClickEvent(
     return;
 
   event_dispatcher_.DispatchBackgroundFetchClickEvent(
-      it->second.first, std::move(it->second.second), base::DoNothing());
-  completed_fetches_.erase(unique_id);
+      it->second->registration_id, it->second->registration.Clone(),
+      base::DoNothing());
+
+  if (it->second->processing_completed)
+    completed_fetches_.erase(unique_id);
 }
 
 std::unique_ptr<BackgroundFetchJobController>
diff --git a/chromium/content/browser/background_fetch/background_fetch_scheduler.h b/chromium/content/browser/background_fetch/background_fetch_scheduler.h
index f48e974ed2f..f1e27f402f0 100644
--- a/chromium/content/browser/background_fetch/background_fetch_scheduler.h
+++ b/chromium/content/browser/background_fetch/background_fetch_scheduler.h
@@ -171,14 +171,23 @@ class CONTENT_EXPORT BackgroundFetchScheduler
   // The current fetch job controllers that are being processed.
   base::circular_deque<BackgroundFetchJobController*> active_controllers_;
 
-  // Map from |unique_id|s to {|registration_id|, |registration|}.
+  struct RegistrationData {
+    RegistrationData(
+        const BackgroundFetchRegistrationId& registration_id,
+        blink::mojom::BackgroundFetchRegistrationDataPtr registration);
+    ~RegistrationData();
+
+    BackgroundFetchRegistrationId registration_id;
+    blink::mojom::BackgroundFetchRegistrationDataPtr registration;
+    // Wheter all processing is completed and this data is safe to erase now.
+    bool processing_completed = false;
+  };
+
+  // Map from |unique_id|s to the registration data.
   // An entry in here means the fetch has completed. This information is needed
   // after the fetch has completed to dispatch the backgroundfetchclick event.
   // TODO(crbug.com/857122): Clean this up when the UI is no longer showing.
-  std::map<std::string,
-           std::pair<BackgroundFetchRegistrationId,
-                     blink::mojom::BackgroundFetchRegistrationDataPtr>>
-      completed_fetches_;
+  std::map<std::string, std::unique_ptr<RegistrationData>> completed_fetches_;
 
   // Scheduling params - Finch configurable.
   int max_running_downloads_;
diff --git a/chromium/content/browser/background_fetch/background_fetch_test_base.cc b/chromium/content/browser/background_fetch/background_fetch_test_base.cc
index 43d5f762de3..ab80bc50bbe 100644
--- a/chromium/content/browser/background_fetch/background_fetch_test_base.cc
+++ b/chromium/content/browser/background_fetch/background_fetch_test_base.cc
@@ -11,10 +11,10 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/guid.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
 #include "base/time/time.h"
diff --git a/chromium/content/browser/background_fetch/mock_background_fetch_delegate.cc b/chromium/content/browser/background_fetch/mock_background_fetch_delegate.cc
index c8a4aacde31..4ebfb985b7b 100644
--- a/chromium/content/browser/background_fetch/mock_background_fetch_delegate.cc
+++ b/chromium/content/browser/background_fetch/mock_background_fetch_delegate.cc
@@ -38,7 +38,7 @@ MockBackgroundFetchDelegate::TestResponseBuilder::AddResponseHeader(
     const std::string& name,
     const std::string& value) {
   DCHECK(response_);
-  response_->headers->AddHeader(name + ": " + value);
+  response_->headers->AddHeader(name, value);
   return *this;
 }
 
diff --git a/chromium/content/browser/background_fetch/storage/image_helpers_unittest.cc b/chromium/content/browser/background_fetch/storage/image_helpers_unittest.cc
index e4ade4af0b3..6845ce8c152 100644
--- a/chromium/content/browser/background_fetch/storage/image_helpers_unittest.cc
+++ b/chromium/content/browser/background_fetch/storage/image_helpers_unittest.cc
@@ -8,7 +8,7 @@
 #include <string>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/run_loop.h"
 #include "base/test/task_environment.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/browser/background_fetch/storage/start_next_pending_request_task.cc b/chromium/content/browser/background_fetch/storage/start_next_pending_request_task.cc
index 5711818d490..8d4ea453b87 100644
--- a/chromium/content/browser/background_fetch/storage/start_next_pending_request_task.cc
+++ b/chromium/content/browser/background_fetch/storage/start_next_pending_request_task.cc
@@ -79,8 +79,8 @@ void StartNextPendingRequestTask::DidGetPendingRequests(
       {{ActiveRequestKey(active_request_.unique_id(),
                          active_request_.request_index()),
         active_request_.SerializeAsString()}},
-      base::BindRepeating(&StartNextPendingRequestTask::DidStoreActiveRequest,
-                          weak_factory_.GetWeakPtr()));
+      base::BindOnce(&StartNextPendingRequestTask::DidStoreActiveRequest,
+                     weak_factory_.GetWeakPtr()));
 }
 
 void StartNextPendingRequestTask::DidStoreActiveRequest(
diff --git a/chromium/content/browser/background_sync/background_sync_manager.cc b/chromium/content/browser/background_sync/background_sync_manager.cc
index 8259e4a5988..2088219de8a 100644
--- a/chromium/content/browser/background_sync/background_sync_manager.cc
+++ b/chromium/content/browser/background_sync/background_sync_manager.cc
@@ -14,6 +14,7 @@
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/default_clock.h"
diff --git a/chromium/content/browser/background_sync/background_sync_manager_unittest.cc b/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
index 57a8c51b380..9c68e9a5a9f 100644
--- a/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
+++ b/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
@@ -11,9 +11,9 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/metrics/field_trial.h"
 #include "base/run_loop.h"
diff --git a/chromium/content/browser/background_sync/one_shot_background_sync_browsertest.cc b/chromium/content/browser/background_sync/one_shot_background_sync_browsertest.cc
index 330f12bbfcb..252eca77898 100644
--- a/chromium/content/browser/background_sync/one_shot_background_sync_browsertest.cc
+++ b/chromium/content/browser/background_sync/one_shot_background_sync_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/background_sync_test_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/background_sync/periodic_background_sync_browsertest.cc b/chromium/content/browser/background_sync/periodic_background_sync_browsertest.cc
index e10c34f357d..5d88459db53 100644
--- a/chromium/content/browser/background_sync/periodic_background_sync_browsertest.cc
+++ b/chromium/content/browser/background_sync/periodic_background_sync_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/background_sync/background_sync_manager.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/background_sync_test_util.h"
+#include "content/public/test/browser_test.h"
 
 namespace {
 
diff --git a/chromium/content/browser/bad_message.h b/chromium/content/browser/bad_message.h
index 473a6a93edc..58b8f8de059 100644
--- a/chromium/content/browser/bad_message.h
+++ b/chromium/content/browser/bad_message.h
@@ -253,6 +253,7 @@ enum BadMessageReason {
   RFH_BAD_DOCUMENT_POLICY_HEADER = 225,
   RFMF_INVALID_PLUGIN_EMBEDDER_ORIGIN = 226,
   RFH_INVALID_CALL_FROM_NOT_MAIN_FRAME = 227,
+  INPUT_ROUTER_INVALID_EVENT_SOURCE = 228,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
diff --git a/chromium/content/browser/battery_monitor_browsertest.cc b/chromium/content/browser/battery_monitor_browsertest.cc
index 12d9493a3ff..dada4efb42a 100644
--- a/chromium/content/browser/battery_monitor_browsertest.cc
+++ b/chromium/content/browser/battery_monitor_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/macros.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/blob_storage/blob_storage_browsertest.cc b/chromium/content/browser/blob_storage/blob_storage_browsertest.cc
index f36b8a3488b..c81215a7c12 100644
--- a/chromium/content/browser/blob_storage/blob_storage_browsertest.cc
+++ b/chromium/content/browser/blob_storage/blob_storage_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/blob_storage/blob_url_browsertest.cc b/chromium/content/browser/blob_storage/blob_url_browsertest.cc
index 6e913b29acb..1ab173932e9 100644
--- a/chromium/content/browser/blob_storage/blob_url_browsertest.cc
+++ b/chromium/content/browser/blob_storage/blob_url_browsertest.cc
@@ -8,6 +8,7 @@
 #include "build/build_config.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/blob_storage/blob_url_unittest.cc b/chromium/content/browser/blob_storage/blob_url_unittest.cc
index 30ea1e4c60b..a64a3c5073f 100644
--- a/chromium/content/browser/blob_storage/blob_url_unittest.cc
+++ b/chromium/content/browser/blob_storage/blob_url_unittest.cc
@@ -87,17 +87,13 @@ class BlobURLTest : public testing::Test {
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
 
     temp_file1_ = temp_dir_.GetPath().AppendASCII("BlobFile1.dat");
-    ASSERT_EQ(static_cast<int>(base::size(kTestFileData1) - 1),
-              base::WriteFile(temp_file1_, kTestFileData1,
-                              base::size(kTestFileData1) - 1));
+    ASSERT_TRUE(base::WriteFile(temp_file1_, kTestFileData1));
     base::File::Info file_info1;
     base::GetFileInfo(temp_file1_, &file_info1);
     temp_file_modification_time1_ = file_info1.last_modified;
 
     temp_file2_ = temp_dir_.GetPath().AppendASCII("BlobFile2.dat");
-    ASSERT_EQ(static_cast<int>(base::size(kTestFileData2) - 1),
-              base::WriteFile(temp_file2_, kTestFileData2,
-                              base::size(kTestFileData2) - 1));
+    ASSERT_TRUE(base::WriteFile(temp_file2_, kTestFileData2));
     base::File::Info file_info2;
     base::GetFileInfo(temp_file2_, &file_info2);
     temp_file_modification_time2_ = file_info2.last_modified;
@@ -341,9 +337,7 @@ TEST_F(BlobURLTest, TestGetLargeFileRequest) {
   large_data.reserve(kBufferSize * 5);
   for (int i = 0; i < kBufferSize * 5; ++i)
     large_data.append(1, static_cast<char>(i % 256));
-  ASSERT_EQ(
-      static_cast<int>(large_data.size()),
-      base::WriteFile(large_temp_file, large_data.data(), large_data.size()));
+  ASSERT_TRUE(base::WriteFile(large_temp_file, large_data));
   blob_data_->AppendFile(large_temp_file, 0,
                          std::numeric_limits<uint64_t>::max(), base::Time());
   TestSuccessNonrangeRequest(large_data, large_data.size());
diff --git a/chromium/content/browser/bluetooth/README.md b/chromium/content/browser/bluetooth/README.md
index 4f1bcfaba4d..f5c31b52045 100644
--- a/chromium/content/browser/bluetooth/README.md
+++ b/chromium/content/browser/bluetooth/README.md
@@ -1,26 +1,103 @@
 # Web Bluetooth Service in Content
 
-`content/*/bluetooth` implements the [Web Bluetooth specification]
-using the [/device/bluetooth] code module.
+This directory contains the implementation of the [Web Bluetooth specification]
+using the Bluetooth abstraction module implemented in `//device/bluetooth`. See
+the [Bluetooth Abstraction README] for more details on the cross-platform
+implementation of Bluetooth in Chromium.
 
-This service is exposed to the web in the [blink bluetooth module].
+This service is exposed to the Web through the Blink Bluetooth module, which
+accesses the Web Bluetooth Service through Mojo IPC. For more details, see the
+[Web Bluetooth Blink Module README].
 
 [Web Bluetooth specification]: https://webbluetoothcg.github.io/web-bluetooth/
-[/device/bluetooth]: /device/bluetooth
-[blink bluetooth module]: /third_party/blink/renderer/modules/bluetooth/
+[Bluetooth Abstraction README]: ../../../device/bluetooth/README.md
+[Web Bluetooth Blink Module README]:
+../../../third_party/blink/renderer/modules/bluetooth/README.md
 
+## Web Bluetooth Permissions
+
+The legacy permissions system is implemented by `bluetooth_allowed_devices.h`,
+which is created per origin.
+
+The new permissions system is implemented by providing an implementation for
+the `//content/public/browser/bluetooth_delegate.h` interface. In Chrome, the
+implementation of this interface is provided by
+`//chrome/browser/chrome_bluetooth_delegate.h` which forwards permission
+queries to `//chrome/browser/bluetooth/bluetooth_chooser_context.h`. This
+class uses `//components/permissions/chooser_context_base.h` as the base.
+This base class is also in use by other device APIs, like WebUSB. The new
+permission system enables Web Bluetooth permissions to be persistent and to
+be exposed in the settings UI for users to manage more easily. For more
+details on the new permissions system, see the [Web Bluetooth Persistent
+Permissions] design document.
+
+[Web Bluetooth Persistent Permissions]:
+https://docs.google.com/document/d/1h3uAVXJARHrNWaNACUPiQhLt7XI-fFFQoARSs1WgMDM/edit?usp=sharing
 
 ## Testing
 
-Bluetooth web tests in `third_party/blink/web_tests/bluetooth/` rely on
-fake Bluetooth implementation classes constructed in
-`content/shell/browser/layout_test/layout_test_bluetooth_adapter_provider`.
-These tests span JavaScript binding to the `device/bluetooth` API layer.
+The Web Bluetooth Service is primarily tested using Blink Web Tests and Web
+Platform Tests. These tests are found in
+`//third_party/blink/web_tests/bluetooth` and
+`//third_party/blink/web_tests/external/wpt/bluetooth`. There is currently an
+ongoing effort to refactor the Web Bluetooth tests using the legacy
+[BluetoothFakeAdapter] test infrastructure to use the new [FakeBluetooth]
+Test API. For more details, see the [Web Bluetooth Web Tests README] and the
+[Web Bluetooth Web Platform Tests README].
 
+TODO(https://crbug.com/509038): Update this document when the remaining tests
+have been submitted to W3C Web Platform Tests.
 
-## Design Documents
+The tests are run using `content_shell`, which fakes the Bluetooth related UI
+and the new permissions system. For more details, see the following files in
+`//content/shell/browser/web_test`:
+* [fake_bluetooth_chooser.h]
+* [fake_bluetooth_delegate.h]
+* [fake_bluetooth_scanning_prompt.h]
+* [web_test_bluetooth_adapter_provider.h][BluetoothFakeAdapter]
+* [web_test_first_device_bluetooth_chooser.h]
+
+[BluetoothFakeAdapter]:
+../../shell/browser/web_test/web_test_bluetooth_adapter_provider.h
+[FakeBluetooth]:
+../../../device/bluetooth/test/fake_bluetooth.h
+[Web Bluetooth Web Tests README]:
+../../../third_party/blink/web_tests/bluetooth/README.md
+[Web Bluetooth Web Platform Tests README]:
+../../../third_party/blink/web_tests/external/wpt/bluetooth/README.md
+[fake_bluetooth_chooser.h]:
+../../shell/browser/web_test/fake_bluetooth_chooser.h
+[fake_bluetooth_delegate.h]:
+../../shell/browser/web_test/fake_bluetooth_delegate.h
+[fake_bluetooth_scanning_prompt.h]:
+../../shell/browser/web_test/fake_bluetooth_scanning_prompt.h
+[web_test_first_device_bluetooth_chooser.h]:
+../../shell/browser/web_test/web_test_first_device_bluetooth_chooser.h
+
+# Resources and Documentation
 
-See: [Class Diagram of Web Bluetooth through Bluetooth Android][Class]
+Mailing list: web-bluetooth@chromium.org
+
+Bug tracker: [Blink>Bluetooth]
+
+* [Web Bluetooth specification]
+* [Bluetooth Abstraction README]
+* [Web Bluetooth Blink Module README]
+* [BluetoothFakeAdapter]
+* [FakeBluetooth]
+
+[Blink>Bluetooth]: https://bugs.chromium.org/p/chromium/issues/list?q=component%3ABlink%3EBluetooth&can=2
+
+## Design Documents
 
-[Class]: https://sites.google.com/a/chromium.org/dev/developers/design-documents/bluetooth-design-docs/web-bluetooth-through-bluetooth-android-class-diagram
+* [Class Diagram of Web Bluetooth through Bluetooth Android]
+* [Web Bluetooth Testing]
+* [Web Bluetooth Test Scanning]
+* [Web Bluetooth Persistent Permissions]
 
+[Class Diagram of Web Bluetooth through Bluetooth Android]:
+https://sites.google.com/a/chromium.org/dev/developers/design-documents/bluetooth-design-docs/web-bluetooth-through-bluetooth-android-class-diagram
+[Web Bluetooth Testing]:
+https://docs.google.com/document/d/1Nhv_oVDCodd1pEH_jj9k8gF4rPGb_84VYaZ9IG8M_WY/edit?usp=sharing
+[Web Bluetooth Test Scanning]:
+https://docs.google.com/document/d/1XFl_4ZAgO8ddM6U53A9AfUuZeWgJnlYD5wtbXqEpzeg/edit?usp=sharing
diff --git a/chromium/content/browser/bluetooth/bluetooth_blocklist.cc b/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
index d044a46c0fc..ff6f57e51c0 100644
--- a/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
+++ b/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/bluetooth/bluetooth_blocklist.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/optional.h"
 #include "base/strings/string_split.h"
diff --git a/chromium/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc b/chromium/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc
index a10f4a421d2..416fde8aeed 100644
--- a/chromium/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc
+++ b/chromium/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc
@@ -5,7 +5,6 @@
 #include <iostream>
 
 #include "base/hash/hash.h"
-#include "base/logging.h"
 #include "device/bluetooth/public/cpp/bluetooth_uuid.h"
 
 int main(int argc, char** argv) {
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
index d183bbf89bd..847c0750756 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -352,7 +352,8 @@ void WebBluetoothServiceImpl::OnBluetoothScanningPromptEvent(
 }
 
 WebBluetoothServiceImpl::ScanningClient::ScanningClient(
-    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+        client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback,
     BluetoothDeviceScanningPromptController* prompt_controller)
@@ -361,14 +362,14 @@ WebBluetoothServiceImpl::ScanningClient::ScanningClient(
       callback_(std::move(callback)),
       prompt_controller_(prompt_controller) {
   DCHECK(options_->filters.has_value() || options_->accept_all_advertisements);
-  client_.set_disconnect_handler(base::BindRepeating(
+  client_.set_disconnect_handler(base::BindOnce(
       &ScanningClient::DisconnectionHandler, base::Unretained(this)));
 }
 
 WebBluetoothServiceImpl::ScanningClient::~ScanningClient() {}
 
 bool WebBluetoothServiceImpl::ScanningClient::SendEvent(
-    blink::mojom::WebBluetoothScanResultPtr result) {
+    blink::mojom::WebBluetoothAdvertisingEventPtr result) {
   if (disconnected_)
     return false;
 
@@ -377,7 +378,7 @@ bool WebBluetoothServiceImpl::ScanningClient::SendEvent(
       AddFilteredDeviceToPrompt(result->device->id.str(), result->name);
 
     if (allow_send_event_)
-      client_->ScanEvent(std::move(result));
+      client_->AdvertisingEvent(std::move(result));
 
     return true;
   }
@@ -388,8 +389,9 @@ bool WebBluetoothServiceImpl::ScanningClient::SendEvent(
   // or |services| have been set. If one of these is set, we will check the
   // scan result to see if it matches the filter's value.  If it doesn't, we'll
   // just continue with the next filter. If all of the properties in a filter
-  // have a match, we can post the ScanEvent.  Otherwise, we are going to drop
-  // it.  This logic can be reduced a bit, but I think clarity will decrease.
+  // have a match, we can post the AdvertisingEvent. Otherwise, we are going to
+  // drop it. This logic can be reduced a bit, but I think clarity will
+  // decrease.
 
   for (auto& filter : options_->filters.value()) {
     // Check to see if there is a direct match against the advertisement name
@@ -428,7 +430,7 @@ bool WebBluetoothServiceImpl::ScanningClient::SendEvent(
       AddFilteredDeviceToPrompt(result->device->id.str(), result->name);
 
     if (allow_send_event_)
-      client_->ScanEvent(std::move(result));
+      client_->AdvertisingEvent(std::move(result));
     return true;
   }
 
@@ -438,18 +440,10 @@ bool WebBluetoothServiceImpl::ScanningClient::SendEvent(
 
 void WebBluetoothServiceImpl::ScanningClient::RunRequestScanningStartCallback(
     blink::mojom::WebBluetoothResult result) {
-  if (result == blink::mojom::WebBluetoothResult::SUCCESS) {
-    auto scanning_result =
-        blink::mojom::RequestScanningStartResult::NewOptions(options_.Clone());
-    std::move(callback_).Run(std::move(scanning_result));
-  } else if (result == blink::mojom::WebBluetoothResult::SCANNING_BLOCKED ||
-             result == blink::mojom::WebBluetoothResult::PROMPT_CANCELED) {
-    auto scanning_result =
-        blink::mojom::RequestScanningStartResult::NewErrorResult(result);
-    std::move(callback_).Run(std::move(scanning_result));
-  } else {
-    NOTREACHED();
-  }
+  DCHECK(result == blink::mojom::WebBluetoothResult::SUCCESS ||
+         result == blink::mojom::WebBluetoothResult::SCANNING_BLOCKED ||
+         result == blink::mojom::WebBluetoothResult::PROMPT_CANCELED);
+  std::move(callback_).Run(result);
 }
 
 void WebBluetoothServiceImpl::ScanningClient::DisconnectionHandler() {
@@ -555,7 +549,7 @@ void WebBluetoothServiceImpl::DeviceAdvertisementReceived(
     }
     device->name = device_name;
 
-    auto result = blink::mojom::WebBluetoothScanResult::New();
+    auto result = blink::mojom::WebBluetoothAdvertisingEvent::New();
     result->device = std::move(device);
 
     result->name = advertisement_name;
@@ -1263,13 +1257,13 @@ void WebBluetoothServiceImpl::RemoteDescriptorWriteValue(
 }
 
 void WebBluetoothServiceImpl::RequestScanningStart(
-    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient>
+    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
         client_info,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client(
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient> client(
       std::move(client_info));
 
   if (!GetAdapter()) {
@@ -1281,9 +1275,8 @@ void WebBluetoothServiceImpl::RequestScanningStart(
                          std::move(options), std::move(callback)));
       return;
     }
-    auto result = blink::mojom::RequestScanningStartResult::NewErrorResult(
+    std::move(callback).Run(
         blink::mojom::WebBluetoothResult::BLUETOOTH_LOW_ENERGY_NOT_AVAILABLE);
-    std::move(callback).Run(std::move(result));
     return;
   }
 
@@ -1292,7 +1285,8 @@ void WebBluetoothServiceImpl::RequestScanningStart(
 }
 
 void WebBluetoothServiceImpl::RequestScanningStartImpl(
-    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+        client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback,
     scoped_refptr<device::BluetoothAdapter> adapter) {
@@ -1305,9 +1299,8 @@ void WebBluetoothServiceImpl::RequestScanningStartImpl(
   }
 
   if (!adapter) {
-    auto result = blink::mojom::RequestScanningStartResult::NewErrorResult(
+    std::move(callback).Run(
         blink::mojom::WebBluetoothResult::BLUETOOTH_LOW_ENERGY_NOT_AVAILABLE);
-    std::move(callback).Run(std::move(result));
     return;
   }
 
@@ -1320,16 +1313,12 @@ void WebBluetoothServiceImpl::RequestScanningStartImpl(
       web_contents()->GetBrowserContext(), requesting_origin, embedding_origin);
 
   if (blocked) {
-    auto result = blink::mojom::RequestScanningStartResult::NewErrorResult(
-        blink::mojom::WebBluetoothResult::SCANNING_BLOCKED);
-    std::move(callback).Run(std::move(result));
+    std::move(callback).Run(blink::mojom::WebBluetoothResult::SCANNING_BLOCKED);
     return;
   }
 
   if (discovery_callback_) {
-    auto result = blink::mojom::RequestScanningStartResult::NewErrorResult(
-        blink::mojom::WebBluetoothResult::PROMPT_CANCELED);
-    std::move(callback).Run(std::move(result));
+    std::move(callback).Run(blink::mojom::WebBluetoothResult::PROMPT_CANCELED);
     return;
   }
 
@@ -1371,7 +1360,8 @@ void WebBluetoothServiceImpl::RequestScanningStartImpl(
 }
 
 void WebBluetoothServiceImpl::OnStartDiscoverySession(
-    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+        client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     std::unique_ptr<device::BluetoothDiscoverySession> session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -1405,9 +1395,8 @@ void WebBluetoothServiceImpl::OnDiscoverySessionError() {
 
   device_scanning_prompt_controller_.reset();
 
-  auto result = blink::mojom::RequestScanningStartResult::NewErrorResult(
-      blink::mojom::WebBluetoothResult::NO_BLUETOOTH_ADAPTER);
-  std::move(discovery_callback_).Run(std::move(result));
+  std::move(discovery_callback_)
+      .Run(blink::mojom::WebBluetoothResult::NO_BLUETOOTH_ADAPTER);
 }
 
 void WebBluetoothServiceImpl::RequestDeviceImpl(
@@ -1726,7 +1715,7 @@ void WebBluetoothServiceImpl::OnDescriptorWriteValueFailed(
 
 CacheQueryResult WebBluetoothServiceImpl::QueryCacheForDevice(
     const blink::WebBluetoothDeviceId& device_id) {
-  std::string device_address = "";
+  std::string device_address;
   if (base::FeatureList::IsEnabled(
           features::kWebBluetoothNewPermissionsBackend)) {
     BluetoothDelegate* delegate =
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
index 7ab5a25a4c6..ee48a997ce9 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
@@ -115,13 +115,13 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
 
   class ScanningClient {
    public:
-    ScanningClient(
-        mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
-        blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
-        RequestScanningStartCallback callback,
-        BluetoothDeviceScanningPromptController* prompt_controller);
+    ScanningClient(mojo::AssociatedRemote<
+                       blink::mojom::WebBluetoothAdvertisementClient> client,
+                   blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
+                   RequestScanningStartCallback callback,
+                   BluetoothDeviceScanningPromptController* prompt_controller);
     ~ScanningClient();
-    bool SendEvent(blink::mojom::WebBluetoothScanResultPtr result);
+    bool SendEvent(blink::mojom::WebBluetoothAdvertisingEventPtr result);
 
     void set_prompt_controller(
         BluetoothDeviceScanningPromptController* prompt_controller) {
@@ -151,7 +151,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
 
     bool disconnected_ = false;
     bool allow_send_event_ = false;
-    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client_;
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+        client_;
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options_;
     RequestScanningStartCallback callback_;
     BluetoothDeviceScanningPromptController* prompt_controller_;
@@ -246,8 +247,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
       const std::vector<uint8_t>& value,
       RemoteDescriptorWriteValueCallback callback) override;
   void RequestScanningStart(
-      mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient>
-          client,
+      mojo::PendingAssociatedRemote<
+          blink::mojom::WebBluetoothAdvertisementClient> client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       RequestScanningStartCallback callback) override;
 
@@ -260,13 +261,15 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
                       scoped_refptr<device::BluetoothAdapter> adapter);
 
   void RequestScanningStartImpl(
-      mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+          client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       RequestScanningStartCallback callback,
       scoped_refptr<device::BluetoothAdapter> adapter);
 
   void OnStartDiscoverySession(
-      mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+          client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       std::unique_ptr<device::BluetoothDiscoverySession> session);
 
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 3ec54580d65..ce83a2ae348 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -105,27 +105,28 @@ class FakeWebContentsDelegate : public content::WebContentsDelegate {
   FakeBluetoothScanningPrompt* prompt_ = nullptr;
 };
 
-class FakeWebBluetoothScanClientImpl : blink::mojom::WebBluetoothScanClient {
+class FakeWebBluetoothAdvertisementClientImpl
+    : blink::mojom::WebBluetoothAdvertisementClient {
  public:
-  FakeWebBluetoothScanClientImpl() = default;
-  ~FakeWebBluetoothScanClientImpl() override = default;
+  FakeWebBluetoothAdvertisementClientImpl() = default;
+  ~FakeWebBluetoothAdvertisementClientImpl() override = default;
 
   // Move-only class.
-  FakeWebBluetoothScanClientImpl(const FakeWebBluetoothScanClientImpl&) =
-      delete;
-  FakeWebBluetoothScanClientImpl& operator=(
-      const FakeWebBluetoothScanClientImpl&) = delete;
+  FakeWebBluetoothAdvertisementClientImpl(
+      const FakeWebBluetoothAdvertisementClientImpl&) = delete;
+  FakeWebBluetoothAdvertisementClientImpl& operator=(
+      const FakeWebBluetoothAdvertisementClientImpl&) = delete;
 
-  // blink::mojom::WebBluetoothScanClient:
-  void ScanEvent(blink::mojom::WebBluetoothScanResultPtr result) override {}
+  // blink::mojom::WebBluetoothAdvertisementClient:
+  void AdvertisingEvent(
+      blink::mojom::WebBluetoothAdvertisingEventPtr event) override {}
 
-  void BindReceiver(
-      mojo::PendingAssociatedReceiver<blink::mojom::WebBluetoothScanClient>
-          receiver) {
+  void BindReceiver(mojo::PendingAssociatedReceiver<
+                    blink::mojom::WebBluetoothAdvertisementClient> receiver) {
     receiver_.Bind(std::move(receiver));
-    receiver_.set_disconnect_handler(
-        base::BindOnce(&FakeWebBluetoothScanClientImpl::OnConnectionError,
-                       base::Unretained(this)));
+    receiver_.set_disconnect_handler(base::BindOnce(
+        &FakeWebBluetoothAdvertisementClientImpl::OnConnectionError,
+        base::Unretained(this)));
   }
 
   void OnConnectionError() { on_connection_error_called_ = true; }
@@ -133,8 +134,8 @@ class FakeWebBluetoothScanClientImpl : blink::mojom::WebBluetoothScanClient {
   bool on_connection_error_called() { return on_connection_error_called_; }
 
  private:
-  mojo::AssociatedReceiver<blink::mojom::WebBluetoothScanClient> receiver_{
-      this};
+  mojo::AssociatedReceiver<blink::mojom::WebBluetoothAdvertisementClient>
+      receiver_{this};
   bool on_connection_error_called_ = false;
 };
 
@@ -183,12 +184,12 @@ class WebBluetoothServiceImplTest : public RenderViewHostImplTestHarness {
                                                        name_prefix);
   }
 
-  blink::mojom::RequestScanningStartResultPtr
-  RequestScanningStartAndSimulatePromptEvent(
+  blink::mojom::WebBluetoothResult RequestScanningStartAndSimulatePromptEvent(
       const blink::mojom::WebBluetoothLeScanFilter& filter,
-      FakeWebBluetoothScanClientImpl* client_impl,
+      FakeWebBluetoothAdvertisementClientImpl* client_impl,
       content::BluetoothScanningPrompt::Event event) {
-    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient> client;
+    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+        client;
     client_impl->BindReceiver(client.InitWithNewEndpointAndPassReceiver());
     auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
     options->filters.emplace();
@@ -201,13 +202,12 @@ class WebBluetoothServiceImplTest : public RenderViewHostImplTestHarness {
     // the entire RequestScanningStart flow has finished before the method
     // returns.
     base::RunLoop callback_loop, request_loop;
-    blink::mojom::RequestScanningStartResultPtr result;
+    blink::mojom::WebBluetoothResult result;
     service_->RequestScanningStart(
         std::move(client), std::move(options),
         base::BindLambdaForTesting(
-            [&callback_loop,
-             &result](blink::mojom::RequestScanningStartResultPtr p) {
-              result = std::move(p);
+            [&callback_loop, &result](blink::mojom::WebBluetoothResult r) {
+              result = std::move(r);
               callback_loop.Quit();
             }));
 
@@ -249,12 +249,12 @@ TEST_F(WebBluetoothServiceImplTest, PermissionAllowed) {
   filters->push_back(filter.Clone());
   EXPECT_FALSE(service_->AreScanFiltersAllowed(filters));
 
-  FakeWebBluetoothScanClientImpl client_impl;
-  blink::mojom::RequestScanningStartResultPtr result =
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
+  blink::mojom::WebBluetoothResult result =
       RequestScanningStartAndSimulatePromptEvent(
           *filter, &client_impl,
           content::BluetoothScanningPrompt::Event::kAllow);
-  EXPECT_FALSE(result->is_error_result());
+  EXPECT_EQ(result, blink::mojom::WebBluetoothResult::SUCCESS);
   // |filters| should be allowed.
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters));
 }
@@ -263,8 +263,9 @@ TEST_F(WebBluetoothServiceImplTest, ClearStateDuringRequestScanningStart) {
   blink::mojom::WebBluetoothLeScanFilterPtr filter = CreateScanFilter("a", "b");
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters;
 
-  FakeWebBluetoothScanClientImpl client_impl;
-  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient> client;
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
+  mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothAdvertisementClient>
+      client;
   client_impl.BindReceiver(client.InitWithNewEndpointAndPassReceiver());
 
   auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
@@ -277,13 +278,12 @@ TEST_F(WebBluetoothServiceImplTest, ClearStateDuringRequestScanningStart) {
   // executing and |result| has been populated. |request_loop| ensures that the
   // entire RequestScanningStart flow has finished before |result| is checked.
   base::RunLoop callback_loop, request_loop;
-  blink::mojom::RequestScanningStartResultPtr result;
+  blink::mojom::WebBluetoothResult result;
   service_->RequestScanningStart(
       std::move(client), std::move(options),
       base::BindLambdaForTesting(
-          [&callback_loop,
-           &result](blink::mojom::RequestScanningStartResultPtr p) {
-            result = std::move(p);
+          [&callback_loop, &result](blink::mojom::WebBluetoothResult r) {
+            result = std::move(r);
             callback_loop.Quit();
           }));
 
@@ -299,7 +299,7 @@ TEST_F(WebBluetoothServiceImplTest, ClearStateDuringRequestScanningStart) {
       }));
   request_loop.Run();
 
-  EXPECT_TRUE(result->is_error_result());
+  EXPECT_NE(result, blink::mojom::WebBluetoothResult::SUCCESS);
 }
 
 TEST_F(WebBluetoothServiceImplTest, PermissionPromptCanceled) {
@@ -309,15 +309,13 @@ TEST_F(WebBluetoothServiceImplTest, PermissionPromptCanceled) {
   filters->push_back(filter.Clone());
   EXPECT_FALSE(service_->AreScanFiltersAllowed(filters));
 
-  FakeWebBluetoothScanClientImpl client_impl;
-  blink::mojom::RequestScanningStartResultPtr result =
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
+  blink::mojom::WebBluetoothResult result =
       RequestScanningStartAndSimulatePromptEvent(
           *filter, &client_impl,
           content::BluetoothScanningPrompt::Event::kCanceled);
 
-  EXPECT_TRUE(result->is_error_result());
-  EXPECT_EQ(blink::mojom::WebBluetoothResult::PROMPT_CANCELED,
-            result->get_error_result());
+  EXPECT_EQ(blink::mojom::WebBluetoothResult::PROMPT_CANCELED, result);
   // |filters| should still not be allowed.
   EXPECT_FALSE(service_->AreScanFiltersAllowed(filters));
 }
@@ -328,12 +326,12 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters;
   filters.emplace();
   filters->push_back(filter.Clone());
-  FakeWebBluetoothScanClientImpl client_impl;
-  blink::mojom::RequestScanningStartResultPtr result =
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
+  blink::mojom::WebBluetoothResult result =
       RequestScanningStartAndSimulatePromptEvent(
           *filter, &client_impl,
           content::BluetoothScanningPrompt::Event::kAllow);
-  EXPECT_FALSE(result->is_error_result());
+  EXPECT_EQ(result, blink::mojom::WebBluetoothResult::SUCCESS);
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters));
 
   contents()->SetVisibilityAndNotifyObservers(content::Visibility::HIDDEN);
@@ -348,7 +346,7 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters;
   filters.emplace();
   filters->push_back(filter.Clone());
-  FakeWebBluetoothScanClientImpl client_impl;
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
   RequestScanningStartAndSimulatePromptEvent(
       *filter, &client_impl, content::BluetoothScanningPrompt::Event::kAllow);
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters));
@@ -365,7 +363,7 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters;
   filters.emplace();
   filters->push_back(filter.Clone());
-  FakeWebBluetoothScanClientImpl client_impl;
+  FakeWebBluetoothAdvertisementClientImpl client_impl;
   RequestScanningStartAndSimulatePromptEvent(
       *filter, &client_impl, content::BluetoothScanningPrompt::Event::kAllow);
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters));
@@ -383,12 +381,12 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters_1;
   filters_1.emplace();
   filters_1->push_back(filter_1.Clone());
-  FakeWebBluetoothScanClientImpl client_impl_1;
-  blink::mojom::RequestScanningStartResultPtr result_1 =
+  FakeWebBluetoothAdvertisementClientImpl client_impl_1;
+  blink::mojom::WebBluetoothResult result_1 =
       RequestScanningStartAndSimulatePromptEvent(
           *filter_1, &client_impl_1,
           content::BluetoothScanningPrompt::Event::kAllow);
-  EXPECT_FALSE(result_1->is_error_result());
+  EXPECT_EQ(result_1, blink::mojom::WebBluetoothResult::SUCCESS);
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters_1));
   EXPECT_FALSE(client_impl_1.on_connection_error_called());
 
@@ -397,12 +395,12 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters_2;
   filters_2.emplace();
   filters_2->push_back(filter_2.Clone());
-  FakeWebBluetoothScanClientImpl client_impl_2;
-  blink::mojom::RequestScanningStartResultPtr result_2 =
+  FakeWebBluetoothAdvertisementClientImpl client_impl_2;
+  blink::mojom::WebBluetoothResult result_2 =
       RequestScanningStartAndSimulatePromptEvent(
           *filter_2, &client_impl_2,
           content::BluetoothScanningPrompt::Event::kAllow);
-  EXPECT_FALSE(result_2->is_error_result());
+  EXPECT_EQ(result_2, blink::mojom::WebBluetoothResult::SUCCESS);
   EXPECT_TRUE(service_->AreScanFiltersAllowed(filters_2));
   EXPECT_FALSE(client_impl_2.on_connection_error_called());
 
@@ -411,14 +409,12 @@ TEST_F(WebBluetoothServiceImplTest,
   base::Optional<WebBluetoothServiceImpl::ScanFilters> filters_3;
   filters_3.emplace();
   filters_3->push_back(filter_3.Clone());
-  FakeWebBluetoothScanClientImpl client_impl_3;
-  blink::mojom::RequestScanningStartResultPtr result_3 =
+  FakeWebBluetoothAdvertisementClientImpl client_impl_3;
+  blink::mojom::WebBluetoothResult result_3 =
       RequestScanningStartAndSimulatePromptEvent(
           *filter_3, &client_impl_3,
           content::BluetoothScanningPrompt::Event::kBlock);
-  EXPECT_TRUE(result_3->is_error_result());
-  EXPECT_EQ(blink::mojom::WebBluetoothResult::SCANNING_BLOCKED,
-            result_3->get_error_result());
+  EXPECT_EQ(blink::mojom::WebBluetoothResult::SCANNING_BLOCKED, result_3);
   EXPECT_FALSE(service_->AreScanFiltersAllowed(filters_3));
 
   // The previously granted Bluetooth scanning permission should be revoked.
diff --git a/chromium/content/browser/bookmarklet_browsertest.cc b/chromium/content/browser/bookmarklet_browsertest.cc
index 027f338bee4..ed52980cf43 100644
--- a/chromium/content/browser/bookmarklet_browsertest.cc
+++ b/chromium/content/browser/bookmarklet_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/strings/string_util.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -24,13 +25,8 @@ class BookmarkletTest : public ContentBrowserTest {
     EXPECT_EQ("start page", GetBodyText());
   }
 
-  std::string GetBodyText() {
-    std::string body_text;
-    EXPECT_TRUE(ExecuteScriptAndExtractString(
-        shell(),
-        "window.domAutomationController.send(document.body.innerText);",
-        &body_text));
-    return body_text;
+  content::EvalJsResult GetBodyText() {
+    return EvalJs(shell(), "document.body.innerText");
   }
 };
 
diff --git a/chromium/content/browser/browser_context.cc b/chromium/content/browser/browser_context.cc
index 90ec29eda0e..85251cbcd6b 100644
--- a/chromium/content/browser/browser_context.cc
+++ b/chromium/content/browser/browser_context.cc
@@ -16,19 +16,18 @@
 
 #include "base/base64.h"
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/guid.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/no_destructor.h"
-#include "base/rand_util.h"
+#include "base/notreached.h"
 #include "base/supports_user_data.h"
 #include "base/task/post_task.h"
 #include "base/threading/sequenced_task_runner_handle.h"
@@ -54,25 +53,18 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/shared_cors_origin_access_list.h"
 #include "content/public/browser/site_instance.h"
-#include "content/public/browser/system_connector.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/service_manager_connection.h"
-#include "content/public/common/service_names.mojom.h"
 #include "media/base/media_switches.h"
 #include "media/capabilities/in_memory_video_decode_stats_db_impl.h"
 #include "media/capabilities/video_decode_stats_db_impl.h"
 #include "media/learning/common/media_learning_tasks.h"
 #include "media/learning/impl/learning_session_impl.h"
 #include "media/mojo/services/video_decode_perf_history.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "net/cookies/cookie_store.h"
 #include "net/url_request/url_request_context.h"
 #include "services/content/service.h"
 #include "services/network/public/cpp/features.h"
-#include "services/service_manager/public/cpp/connector.h"
-#include "services/service_manager/public/cpp/service.h"
-#include "services/service_manager/public/mojom/service.mojom.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/database/database_tracker.h"
 #include "storage/browser/file_system/external_mount_points.h"
@@ -83,26 +75,6 @@ namespace content {
 
 namespace {
 
-using TokenToContextMap = std::map<base::Token, BrowserContext*>;
-TokenToContextMap& GetTokenToContextMap() {
-  static base::NoDestructor<TokenToContextMap> map;
-  return *map;
-}
-
-class ServiceInstanceGroupHolder : public base::SupportsUserData::Data {
- public:
-  explicit ServiceInstanceGroupHolder(const base::Token& instance_group)
-      : instance_group_(instance_group) {}
-  ~ServiceInstanceGroupHolder() override {}
-
-  const base::Token& instance_group() const { return instance_group_; }
-
- private:
-  base::Token instance_group_;
-
-  DISALLOW_COPY_AND_ASSIGN(ServiceInstanceGroupHolder);
-};
-
 class ContentServiceHolder : public base::SupportsUserData::Data {
  public:
   explicit ContentServiceHolder(BrowserContext* browser_context)
@@ -126,8 +98,6 @@ const char kBrowsingDataRemoverKey[] = "browsing-data-remover";
 const char kContentServiceKey[] = "content-service";
 const char kDownloadManagerKeyName[] = "download_manager";
 const char kPermissionControllerKey[] = "permission-controller";
-const char kServiceManagerConnection[] = "service-manager-connection";
-const char kServiceInstanceGroup[] = "service-instance-group";
 const char kStoragePartitionMapKeyName[] = "content_storage_partition_map";
 const char kVideoDecodePerfHistoryId[] = "video-decode-perf-history";
 const char kLearningSession[] = "learning-session";
@@ -136,16 +106,6 @@ const char kLearningSession[] = "learning-session";
 const char kMountPointsKey[] = "mount_points";
 #endif  // defined(OS_CHROMEOS)
 
-void RemoveBrowserContextFromInstanceGroupMap(BrowserContext* browser_context) {
-  ServiceInstanceGroupHolder* holder = static_cast<ServiceInstanceGroupHolder*>(
-      browser_context->GetUserData(kServiceInstanceGroup));
-  if (holder) {
-    auto it = GetTokenToContextMap().find(holder->instance_group());
-    if (it != GetTokenToContextMap().end())
-      GetTokenToContextMap().erase(it);
-  }
-}
-
 StoragePartitionImplMap* GetStoragePartitionMap(
     BrowserContext* browser_context) {
   StoragePartitionImplMap* partition_map =
@@ -196,26 +156,6 @@ void SetDownloadManager(
   context->SetUserData(kDownloadManagerKeyName, std::move(download_manager));
 }
 
-class BrowserContextServiceManagerConnectionHolder
-    : public base::SupportsUserData::Data {
- public:
-  explicit BrowserContextServiceManagerConnectionHolder(
-      service_manager::mojom::ServiceRequest request)
-      : service_manager_connection_(ServiceManagerConnection::Create(
-            std::move(request),
-            base::CreateSingleThreadTaskRunner({BrowserThread::IO}))) {}
-  ~BrowserContextServiceManagerConnectionHolder() override {}
-
-  ServiceManagerConnection* service_manager_connection() {
-    return service_manager_connection_.get();
-  }
-
- private:
-  std::unique_ptr<ServiceManagerConnection> service_manager_connection_;
-
-  DISALLOW_COPY_AND_ASSIGN(BrowserContextServiceManagerConnectionHolder);
-};
-
 base::WeakPtr<storage::BlobStorageContext> BlobStorageContextGetterForBrowser(
     scoped_refptr<ChromeBlobStorageContext> blob_context) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -419,6 +359,11 @@ void BrowserContext::DeliverPushMessage(
 
 // static
 void BrowserContext::NotifyWillBeDestroyed(BrowserContext* browser_context) {
+  TRACE_EVENT1("shutdown", "BrowserContext::NotifyWillBeDestroyed",
+               "browser_context", browser_context);
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN1(
+      "shutdown", "BrowserContext::NotifyWillBeDestroyed() called.",
+      browser_context, "browser_context", browser_context);
   // Make sure NotifyWillBeDestroyed is idempotent.  This helps facilitate the
   // pattern where NotifyWillBeDestroyed is called from *both*
   // ShellBrowserContext and its derived classes (e.g. WebTestBrowserContext).
@@ -426,14 +371,6 @@ void BrowserContext::NotifyWillBeDestroyed(BrowserContext* browser_context) {
     return;
   browser_context->was_notify_will_be_destroyed_called_ = true;
 
-  // Stop the ServiceManagerConnection from handling any new incoming requests
-  // before we tear anything down. This prevents races at shutdown.
-  BrowserContextServiceManagerConnectionHolder* connection_holder =
-      static_cast<BrowserContextServiceManagerConnectionHolder*>(
-          browser_context->GetUserData(kServiceManagerConnection));
-  if (connection_holder)
-    connection_holder->service_manager_connection()->Stop();
-
   // Subclasses of BrowserContext may expect there to be no more
   // RenderProcessHosts using them by the time this function returns. We
   // therefore explicitly tear down embedded Content Service instances now to
@@ -503,6 +440,7 @@ void BrowserContext::SaveSessionState(BrowserContext* browser_context) {
   indexed_db_control.SetForceKeepSessionState();
 }
 
+// static
 void BrowserContext::SetDownloadManagerForTesting(
     BrowserContext* browser_context,
     std::unique_ptr<content::DownloadManager> download_manager) {
@@ -519,87 +457,17 @@ void BrowserContext::SetPermissionControllerForTesting(
                                std::move(permission_controller));
 }
 
-// static
-void BrowserContext::Initialize(BrowserContext* browser_context,
-                                const base::FilePath& path) {
-  const base::Token new_group = base::Token::CreateRandom();
-  RemoveBrowserContextFromInstanceGroupMap(browser_context);
-  GetTokenToContextMap()[new_group] = browser_context;
-  browser_context->SetUserData(
-      kServiceInstanceGroup,
-      std::make_unique<ServiceInstanceGroupHolder>(new_group));
-
-  auto* system_connector = GetSystemConnector();
-  if (system_connector && base::ThreadTaskRunnerHandle::IsSet()) {
-    // NOTE: Many unit tests create a TestBrowserContext without initializing
-    // Mojo or the global service manager connection.
-
-    mojo::PendingRemote<service_manager::mojom::Service> service;
-    auto service_receiver = service.InitWithNewPipeAndPassReceiver();
-
-    mojo::Remote<service_manager::mojom::ProcessMetadata> metadata;
-    service_manager::Identity identity(mojom::kBrowserServiceName, new_group,
-                                       base::Token{},
-                                       base::Token::CreateRandom());
-    system_connector->RegisterServiceInstance(
-        identity, std::move(service), metadata.BindNewPipeAndPassReceiver());
-    metadata->SetPID(base::GetCurrentProcId());
-
-    BrowserContextServiceManagerConnectionHolder* connection_holder =
-        new BrowserContextServiceManagerConnectionHolder(
-            std::move(service_receiver));
-    browser_context->SetUserData(kServiceManagerConnection,
-                                 base::WrapUnique(connection_holder));
-    ServiceManagerConnection* connection =
-        connection_holder->service_manager_connection();
-
-    connection->Start();
-  }
-}
-
-// static
-const base::Token& BrowserContext::GetServiceInstanceGroupFor(
-    BrowserContext* browser_context) {
-  ServiceInstanceGroupHolder* holder = static_cast<ServiceInstanceGroupHolder*>(
-      browser_context->GetUserData(kServiceInstanceGroup));
-  CHECK(holder) << "Attempting to get the instance group for a BrowserContext "
-                << "that was never Initialized().";
-  return holder->instance_group();
-}
-
-// static
-BrowserContext* BrowserContext::GetBrowserContextForServiceInstanceGroup(
-    const base::Token& instance_group) {
-  auto it = GetTokenToContextMap().find(instance_group);
-  return it != GetTokenToContextMap().end() ? it->second : nullptr;
-}
-
-// static
-service_manager::Connector* BrowserContext::GetConnectorFor(
-    BrowserContext* browser_context) {
-  ServiceManagerConnection* connection =
-      GetServiceManagerConnectionFor(browser_context);
-  return connection ? connection->GetConnector() : nullptr;
-}
-
-// static
-ServiceManagerConnection* BrowserContext::GetServiceManagerConnectionFor(
-    BrowserContext* browser_context) {
-  BrowserContextServiceManagerConnectionHolder* connection_holder =
-      static_cast<BrowserContextServiceManagerConnectionHolder*>(
-          browser_context->GetUserData(kServiceManagerConnection));
-  return connection_holder ? connection_holder->service_manager_connection()
-                           : nullptr;
-}
-
 BrowserContext::BrowserContext()
-    : unique_id_(base::UnguessableToken::Create().ToString()) {}
+    : unique_id_(base::UnguessableToken::Create().ToString()) {
+  TRACE_EVENT1("shutdown", "BrowserContext::BrowserContext", "browser_context",
+               this);
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN1("shutdown", "Browser.BrowserContext", this,
+                                    "browser_context", this);
+}
 
 BrowserContext::~BrowserContext() {
-  CHECK(GetUserData(kServiceInstanceGroup))
-      << "Attempting to destroy a BrowserContext that never called "
-      << "Initialize()";
-
+  TRACE_EVENT1("shutdown", "BrowserContext::~BrowserContext", "browser_context",
+               this);
   DCHECK(!GetUserData(kStoragePartitionMapKeyName))
       << "StoragePartitionMap is not shut down properly";
 
@@ -614,12 +482,16 @@ BrowserContext::~BrowserContext() {
       ChildProcessSecurityPolicyImpl::GetInstance();
   policy->RemoveStateForBrowserContext(*this);
 
-  RemoveBrowserContextFromInstanceGroupMap(this);
-
   if (GetUserData(kDownloadManagerKeyName))
     GetDownloadManager(this)->Shutdown();
 
   TtsControllerImpl::GetInstance()->OnBrowserContextDestroyed(this);
+
+  TRACE_EVENT_NESTABLE_ASYNC_END1(
+      "shutdown", "BrowserContext::NotifyWillBeDestroyed() called.", this,
+      "browser_context", this);
+  TRACE_EVENT_NESTABLE_ASYNC_END1("shutdown", "Browser.BrowserContext", this,
+                                  "browser_context", this);
 }
 
 void BrowserContext::ShutdownStoragePartitions() {
diff --git a/chromium/content/browser/browser_interface_binders.cc b/chromium/content/browser/browser_interface_binders.cc
index 1bef4a1447a..05f1bfb376c 100644
--- a/chromium/content/browser/browser_interface_binders.cc
+++ b/chromium/content/browser/browser_interface_binders.cc
@@ -13,6 +13,8 @@
 #include "content/browser/bad_message.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/content_index/content_index_service_impl.h"
+#include "content/browser/conversions/conversion_internals.mojom.h"
+#include "content/browser/conversions/conversion_internals_ui.h"
 #include "content/browser/cookie_store/cookie_store_context.h"
 #include "content/browser/eye_dropper_chooser_impl.h"
 #include "content/browser/feature_observer.h"
@@ -37,6 +39,7 @@
 #include "content/browser/worker_host/dedicated_worker_host.h"
 #include "content/browser/worker_host/shared_worker_connector_impl.h"
 #include "content/browser/worker_host/shared_worker_host.h"
+#include "content/browser/xr/service/vr_service_impl.h"
 #include "content/common/input/input_injector.mojom.h"
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
 #include "content/common/media/renderer_audio_output_stream_factory.mojom.h"
@@ -45,18 +48,17 @@
 #include "content/public/browser/device_service.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/shared_worker_instance.h"
-#include "content/public/browser/webvr_service_provider.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/url_constants.h"
 #include "device/gamepad/gamepad_monitor.h"
 #include "device/gamepad/public/mojom/gamepad.mojom.h"
+#include "device/vr/buildflags/buildflags.h"
 #include "device/vr/public/mojom/vr_service.mojom.h"
 #include "media/capture/mojom/image_capture.mojom.h"
 #include "media/mojo/mojom/interface_factory.mojom-forward.h"
 #include "media/mojo/mojom/media_metrics_provider.mojom.h"
 #include "media/mojo/mojom/remoting.mojom.h"
-#include "media/mojo/mojom/soda_service.mojom.h"
 #include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "media/mojo/services/video_decode_perf_history.h"
 #include "services/device/public/mojom/sensor_provider.mojom.h"
@@ -116,6 +118,7 @@
 #if !defined(OS_ANDROID)
 #include "content/browser/installedapp/installed_app_provider_impl.h"
 #include "content/public/common/content_switches.h"
+#include "media/mojo/mojom/speech_recognition_service.mojom.h"
 #include "third_party/blink/public/mojom/hid/hid.mojom.h"
 #include "third_party/blink/public/mojom/installedapp/installed_app_provider.mojom.h"
 #include "third_party/blink/public/mojom/serial/serial.mojom.h"
@@ -134,6 +137,11 @@
 #include "media/mojo/mojom/remoting.mojom-forward.h"
 #endif
 
+#if defined(OS_MACOSX)
+#include "content/browser/renderer_host/text_input_host_impl.h"
+#include "third_party/blink/public/mojom/input/text_input_host.mojom.h"
+#endif
+
 namespace content {
 namespace internal {
 
@@ -178,6 +186,15 @@ void BindTextDetection(
   GetShapeDetectionService()->BindTextDetection(std::move(receiver));
 }
 
+#if defined(OS_MACOSX)
+void BindTextInputHost(
+    mojo::PendingReceiver<blink::mojom::TextInputHost> receiver) {
+  base::PostTask(
+      FROM_HERE, {BrowserThread::IO},
+      base::BindOnce(&TextInputHostImpl::Create, std::move(receiver)));
+}
+#endif
+
 void BindBadgeServiceForServiceWorkerOnUI(
     int service_worker_process_id,
     const GURL& service_worker_scope,
@@ -213,6 +230,33 @@ void BindColorChooserFactoryForFrame(
   web_contents->OnColorChooserFactoryReceiver(std::move(receiver));
 }
 
+void BindConversionInternalsHandler(
+    content::RenderFrameHost* host,
+    mojo::PendingReceiver<::mojom::ConversionInternalsHandler> receiver) {
+  auto* contents = WebContents::FromRenderFrameHost(host);
+  DCHECK_EQ(contents->GetLastCommittedURL().host_piece(),
+            kChromeUIConversionInternalsHost);
+  DCHECK(contents->GetLastCommittedURL().SchemeIs(kChromeUIScheme));
+
+  content::WebUI* web_ui = contents->GetWebUI();
+
+  // Performs a safe downcast to the concrete ConversionInternalsUI subclass.
+  ConversionInternalsUI* conversion_internals_ui =
+      web_ui ? web_ui->GetController()->GetAs<ConversionInternalsUI>()
+             : nullptr;
+
+  // This is expected to be called only for main frames and for the right WebUI
+  // pages matching the same WebUI associated to the RenderFrameHost.
+  if (host->GetParent() || !conversion_internals_ui) {
+    ReceivedBadMessage(
+        host->GetProcess(),
+        bad_message::BadMessageReason::RFH_INVALID_WEB_UI_CONTROLLER);
+    return;
+  }
+
+  conversion_internals_ui->BindInterface(std::move(receiver));
+}
+
 void BindProcessInternalsHandler(
     content::RenderFrameHost* host,
     mojo::PendingReceiver<::mojom::ProcessInternalsHandler> receiver) {
@@ -442,8 +486,7 @@ void BindVibrationManager(
 }  // namespace
 
 // Documents/frames
-void PopulateFrameBinders(RenderFrameHostImpl* host,
-                          service_manager::BinderMap* map) {
+void PopulateFrameBinders(RenderFrameHostImpl* host, mojo::BinderMap* map) {
   map->Add<blink::mojom::AppCacheBackend>(base::BindRepeating(
       &RenderFrameHostImpl::CreateAppCacheBackend, base::Unretained(host)));
 
@@ -502,7 +545,8 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
       &RenderFrameHostImpl::GetSpeechSynthesis, base::Unretained(host)));
 
   map->Add<blink::mojom::ScreenEnumeration>(
-      base::BindRepeating(&ScreenEnumerationImpl::Create));
+      base::BindRepeating(&RenderFrameHostImpl::BindScreenEnumerationReceiver,
+                          base::Unretained(host)));
 
   if (base::FeatureList::IsEnabled(features::kSmsReceiver)) {
     map->Add<blink::mojom::SmsReceiver>(base::BindRepeating(
@@ -545,9 +589,6 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
   map->Add<blink::mojom::PushMessaging>(base::BindRepeating(
       &RenderFrameHostImpl::GetPushMessaging, base::Unretained(host)));
 
-  map->Add<blink::mojom::CredentialManager>(base::BindRepeating(
-      &RenderFrameHostImpl::GetCredentialManager, base::Unretained(host)));
-
   map->Add<blink::mojom::Authenticator>(base::BindRepeating(
       &RenderFrameHostImpl::GetAuthenticator, base::Unretained(host)));
 
@@ -590,7 +631,7 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
                           base::Unretained(host)));
 
   map->Add<media::mojom::ImageCapture>(
-      base::BindRepeating(&ImageCaptureImpl::Create));
+      base::BindRepeating(&ImageCaptureImpl::Create, base::Unretained(host)));
 
   map->Add<media::mojom::InterfaceFactory>(base::BindRepeating(
       &RenderFrameHostImpl::BindMediaInterfaceFactoryReceiver,
@@ -614,6 +655,10 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
       base::BindRepeating(&RenderFrameHostImpl::BindRestrictedCookieManager,
                           base::Unretained(host)));
 
+  map->Add<network::mojom::HasTrustTokensAnswerer>(
+      base::BindRepeating(&RenderFrameHostImpl::BindHasTrustTokensAnswerer,
+                          base::Unretained(host)));
+
   map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
       base::BindRepeating(&BindBarcodeDetectionProvider));
 
@@ -646,11 +691,16 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
   map->Add<blink::mojom::SerialService>(base::BindRepeating(
       &RenderFrameHostImpl::BindSerialService, base::Unretained(host)));
 #endif  // !defined(OS_ANDROID)
+
+#if defined(OS_MACOSX)
+  map->Add<blink::mojom::TextInputHost>(
+      base::BindRepeating(&BindTextInputHost));
+#endif
 }
 
 void PopulateBinderMapWithContext(
     RenderFrameHostImpl* host,
-    service_manager::BinderMapWithContext<RenderFrameHost*>* map) {
+    mojo::BinderMapWithContext<RenderFrameHost*>* map) {
   // Register empty binders for interfaces not bound by content but requested
   // by blink.
   // This avoids renderer kills when no binder is found in the absence of the
@@ -663,8 +713,12 @@ void PopulateBinderMapWithContext(
       &EmptyBinderForFrame<payments::mojom::PaymentRequest>));
   map->Add<blink::mojom::AnchorElementMetricsHost>(base::BindRepeating(
       &EmptyBinderForFrame<blink::mojom::AnchorElementMetricsHost>));
-  map->Add<media::mojom::SodaContext>(
-      base::BindRepeating(&EmptyBinderForFrame<media::mojom::SodaContext>));
+  map->Add<blink::mojom::CredentialManager>(base::BindRepeating(
+      &EmptyBinderForFrame<blink::mojom::CredentialManager>));
+#if !defined(OS_ANDROID)
+  map->Add<media::mojom::SpeechRecognitionContext>(base::BindRepeating(
+      &EmptyBinderForFrame<media::mojom::SpeechRecognitionContext>));
+#endif
 #if BUILDFLAG(ENABLE_UNHANDLED_TAP)
   map->Add<blink::mojom::UnhandledTapNotifier>(base::BindRepeating(
       &EmptyBinderForFrame<blink::mojom::UnhandledTapNotifier>));
@@ -688,8 +742,15 @@ void PopulateBinderMapWithContext(
       base::BindRepeating(&PictureInPictureServiceImpl::Create));
   map->Add<blink::mojom::WakeLockService>(
       base::BindRepeating(&WakeLockServiceImpl::Create));
+#if BUILDFLAG(ENABLE_VR)
+  map->Add<device::mojom::VRService>(
+      base::BindRepeating(&VRServiceImpl::Create));
+#else
   map->Add<device::mojom::VRService>(
-      base::BindRepeating(&WebvrServiceProvider::BindWebvrService));
+      base::BindRepeating(&EmptyBinderForFrame<device::mojom::VRService>));
+#endif
+  map->Add<::mojom::ConversionInternalsHandler>(
+      base::BindRepeating(&BindConversionInternalsHandler));
   map->Add<::mojom::ProcessInternalsHandler>(
       base::BindRepeating(&BindProcessInternalsHandler));
 #if defined(OS_ANDROID)
@@ -712,8 +773,7 @@ void PopulateBinderMapWithContext(
                                                                          map);
 }
 
-void PopulateBinderMap(RenderFrameHostImpl* host,
-                       service_manager::BinderMap* map) {
+void PopulateBinderMap(RenderFrameHostImpl* host, mojo::BinderMap* map) {
   PopulateFrameBinders(host, map);
 }
 
@@ -727,14 +787,12 @@ const url::Origin& GetContextForHost(DedicatedWorkerHost* host) {
 }
 
 void PopulateDedicatedWorkerBinders(DedicatedWorkerHost* host,
-                                    service_manager::BinderMap* map) {
+                                    mojo::BinderMap* map) {
   // Do nothing for interfaces that the renderer might request, but doesn't
   // always expect to be bound.
   map->Add<blink::mojom::FeatureObserver>(base::DoNothing());
 
   // static binders
-  map->Add<blink::mojom::ScreenEnumeration>(
-      base::BindRepeating(&ScreenEnumerationImpl::Create));
   map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
       base::BindRepeating(&BindBarcodeDetectionProvider));
   map->Add<shape_detection::mojom::FaceDetectionProvider>(
@@ -777,7 +835,7 @@ void PopulateDedicatedWorkerBinders(DedicatedWorkerHost* host,
 
 void PopulateBinderMapWithContext(
     DedicatedWorkerHost* host,
-    service_manager::BinderMapWithContext<const url::Origin&>* map) {
+    mojo::BinderMapWithContext<const url::Origin&>* map) {
   // render process host binders taking an origin
   map->Add<payments::mojom::PaymentManager>(BindWorkerReceiverForOrigin(
       &RenderProcessHostImpl::CreatePaymentManagerForOrigin, host));
@@ -804,8 +862,7 @@ void PopulateBinderMapWithContext(
           &RenderProcessHostImpl::BindQuotaManagerHost, host));
 }
 
-void PopulateBinderMap(DedicatedWorkerHost* host,
-                       service_manager::BinderMap* map) {
+void PopulateBinderMap(DedicatedWorkerHost* host, mojo::BinderMap* map) {
   PopulateDedicatedWorkerBinders(host, map);
 }
 
@@ -814,15 +871,12 @@ url::Origin GetContextForHost(SharedWorkerHost* host) {
   return url::Origin::Create(host->instance().url());
 }
 
-void PopulateSharedWorkerBinders(SharedWorkerHost* host,
-                                 service_manager::BinderMap* map) {
+void PopulateSharedWorkerBinders(SharedWorkerHost* host, mojo::BinderMap* map) {
   // Do nothing for interfaces that the renderer might request, but doesn't
   // always expect to be bound.
   map->Add<blink::mojom::FeatureObserver>(base::DoNothing());
 
   // static binders
-  map->Add<blink::mojom::ScreenEnumeration>(
-      base::BindRepeating(&ScreenEnumerationImpl::Create));
   map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
       base::BindRepeating(&BindBarcodeDetectionProvider));
   map->Add<shape_detection::mojom::FaceDetectionProvider>(
@@ -847,7 +901,7 @@ void PopulateSharedWorkerBinders(SharedWorkerHost* host,
 
 void PopulateBinderMapWithContext(
     SharedWorkerHost* host,
-    service_manager::BinderMapWithContext<const url::Origin&>* map) {
+    mojo::BinderMapWithContext<const url::Origin&>* map) {
   // render process host binders taking an origin
   map->Add<blink::mojom::FileSystemManager>(BindWorkerReceiverForOrigin(
       &RenderProcessHostImpl::BindFileSystemManager, host));
@@ -876,8 +930,7 @@ void PopulateBinderMapWithContext(
           &RenderProcessHostImpl::BindQuotaManagerHost, host));
 }
 
-void PopulateBinderMap(SharedWorkerHost* host,
-                       service_manager::BinderMap* map) {
+void PopulateBinderMap(SharedWorkerHost* host, mojo::BinderMap* map) {
   PopulateSharedWorkerBinders(host, map);
 }
 
@@ -889,7 +942,7 @@ ServiceWorkerVersionInfo GetContextForHost(ServiceWorkerProviderHost* host) {
 }
 
 void PopulateServiceWorkerBinders(ServiceWorkerProviderHost* host,
-                                  service_manager::BinderMap* map) {
+                                  mojo::BinderMap* map) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
   // Do nothing for interfaces that the renderer might request, but doesn't
@@ -897,8 +950,6 @@ void PopulateServiceWorkerBinders(ServiceWorkerProviderHost* host,
   map->Add<blink::mojom::FeatureObserver>(base::DoNothing());
 
   // static binders
-  map->Add<blink::mojom::ScreenEnumeration>(
-      base::BindRepeating(&ScreenEnumerationImpl::Create));
   map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
       base::BindRepeating(&BindBarcodeDetectionProvider));
   map->Add<shape_detection::mojom::FaceDetectionProvider>(
@@ -922,8 +973,7 @@ void PopulateServiceWorkerBinders(ServiceWorkerProviderHost* host,
 
 void PopulateBinderMapWithContext(
     ServiceWorkerProviderHost* host,
-    service_manager::BinderMapWithContext<const ServiceWorkerVersionInfo&>*
-        map) {
+    mojo::BinderMapWithContext<const ServiceWorkerVersionInfo&>* map) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
   // static binders
@@ -981,8 +1031,7 @@ void PopulateBinderMapWithContext(
           &RenderProcessHostImpl::BindQuotaManagerHost, host));
 }
 
-void PopulateBinderMap(ServiceWorkerProviderHost* host,
-                       service_manager::BinderMap* map) {
+void PopulateBinderMap(ServiceWorkerProviderHost* host, mojo::BinderMap* map) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   PopulateServiceWorkerBinders(host, map);
 }
diff --git a/chromium/content/browser/browser_interface_binders.h b/chromium/content/browser/browser_interface_binders.h
index e1c65070077..c913b5b8e4c 100644
--- a/chromium/content/browser/browser_interface_binders.h
+++ b/chromium/content/browser/browser_interface_binders.h
@@ -7,8 +7,8 @@
 
 #include "content/browser/service_worker/service_worker_info.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/binder_map.h"
 #include "services/device/public/mojom/vibration_manager.mojom-forward.h"
-#include "services/service_manager/public/cpp/binder_map.h"
 #include "url/origin.h"
 
 namespace content {
@@ -31,35 +31,31 @@ namespace internal {
 // handling InterfaceProvider's GetInterface() calls (see crbug.com/718652).
 
 // Registers the handlers for interfaces requested by frames.
-void PopulateBinderMap(RenderFrameHostImpl* host,
-                       service_manager::BinderMap* map);
+void PopulateBinderMap(RenderFrameHostImpl* host, mojo::BinderMap* map);
 void PopulateBinderMapWithContext(
     RenderFrameHostImpl* host,
-    service_manager::BinderMapWithContext<RenderFrameHost*>* map);
+    mojo::BinderMapWithContext<RenderFrameHost*>* map);
 RenderFrameHost* GetContextForHost(RenderFrameHostImpl* host);
 
 // Registers the handlers for interfaces requested by dedicated workers.
-void PopulateBinderMap(DedicatedWorkerHost* host,
-                       service_manager::BinderMap* map);
+void PopulateBinderMap(DedicatedWorkerHost* host, mojo::BinderMap* map);
 void PopulateBinderMapWithContext(
     DedicatedWorkerHost* host,
-    service_manager::BinderMapWithContext<const url::Origin&>* map);
+    mojo::BinderMapWithContext<const url::Origin&>* map);
 const url::Origin& GetContextForHost(DedicatedWorkerHost* host);
 
 // Registers the handlers for interfaces requested by shared workers.
-void PopulateBinderMap(SharedWorkerHost* host, service_manager::BinderMap* map);
+void PopulateBinderMap(SharedWorkerHost* host, mojo::BinderMap* map);
 void PopulateBinderMapWithContext(
     SharedWorkerHost* host,
-    service_manager::BinderMapWithContext<const url::Origin&>* map);
+    mojo::BinderMapWithContext<const url::Origin&>* map);
 url::Origin GetContextForHost(SharedWorkerHost* host);
 
 // Registers the handlers for interfaces requested by service workers.
-void PopulateBinderMap(ServiceWorkerProviderHost* host,
-                       service_manager::BinderMap* map);
+void PopulateBinderMap(ServiceWorkerProviderHost* host, mojo::BinderMap* map);
 void PopulateBinderMapWithContext(
     ServiceWorkerProviderHost* host,
-    service_manager::BinderMapWithContext<const ServiceWorkerVersionInfo&>*
-        map);
+    mojo::BinderMapWithContext<const ServiceWorkerVersionInfo&>* map);
 ServiceWorkerVersionInfo GetContextForHost(ServiceWorkerProviderHost* host);
 
 }  // namespace internal
diff --git a/chromium/content/browser/browser_interface_broker_impl.h b/chromium/content/browser/browser_interface_broker_impl.h
index a764d3fc24f..af69373bb08 100644
--- a/chromium/content/browser/browser_interface_broker_impl.h
+++ b/chromium/content/browser/browser_interface_broker_impl.h
@@ -27,22 +27,19 @@ class BrowserInterfaceBrokerImpl : public blink::mojom::BrowserInterfaceBroker {
   // blink::mojom::BrowserInterfaceBroker
   void GetInterface(mojo::GenericPendingReceiver receiver) {
     DCHECK(receiver.interface_name().has_value());
-    auto interface_name = receiver.interface_name().value();
-    auto pipe = receiver.PassPipe();
-    if (!binder_map_.TryBind(interface_name, &pipe)) {
+    if (!binder_map_.TryBind(&receiver)) {
       if (!binder_map_with_context_.TryBind(internal::GetContextForHost(host_),
-                                            interface_name, &pipe)) {
+                                            &receiver)) {
         host_->ReportNoBinderForInterface("No binder found for interface " +
-                                          interface_name);
+                                          *receiver.interface_name());
       }
     }
   }
 
  private:
   ExecutionContextHost* const host_;
-  service_manager::BinderMap binder_map_;
-  service_manager::BinderMapWithContext<InterfaceBinderContext>
-      binder_map_with_context_;
+  mojo::BinderMap binder_map_;
+  mojo::BinderMapWithContext<InterfaceBinderContext> binder_map_with_context_;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserInterfaceBrokerImpl);
 };
diff --git a/chromium/content/browser/browser_main_loop.cc b/chromium/content/browser/browser_main_loop.cc
index e9609ef58a8..d014ef7e1d8 100644
--- a/chromium/content/browser/browser_main_loop.cc
+++ b/chromium/content/browser/browser_main_loop.cc
@@ -15,7 +15,6 @@
 #include "base/base_switches.h"
 #include "base/bind.h"
 #include "base/command_line.h"
-#include "base/debug/alias.h"
 #include "base/deferred_sequenced_task_runner.h"
 #include "base/feature_list.h"
 #include "base/location.h"
@@ -84,6 +83,7 @@
 #include "content/browser/scheduler/responsiveness/watcher.h"
 #include "content/browser/screenlock_monitor/screenlock_monitor.h"
 #include "content/browser/screenlock_monitor/screenlock_monitor_device_source.h"
+#include "content/browser/sms/sms_provider.h"
 #include "content/browser/speech/speech_recognition_manager_impl.h"
 #include "content/browser/startup_data_impl.h"
 #include "content/browser/startup_task_runner.h"
@@ -226,7 +226,6 @@
 #if defined(USE_X11)
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "ui/base/x/x11_util_internal.h"  // nogncheck
-#include "ui/gfx/x/x11_connection.h"      // nogncheck
 #include "ui/gfx/x/x11_types.h"           // nogncheck
 #endif
 
@@ -295,13 +294,11 @@ static void SetUpGLibLogHandler() {
 }
 #endif  // defined(USE_GLIB)
 
-// Tell compiler not to inline this function so it's possible to tell what
-// thread was unresponsive by inspecting the callstack.
+// NOINLINE so it's possible to tell what thread was unresponsive by inspecting
+// the callstack.
 NOINLINE void ResetThread_IO(
     std::unique_ptr<BrowserProcessSubThread> io_thread) {
-  const int line_number = __LINE__;
   io_thread.reset();
-  base::debug::Alias(&line_number);
 }
 
 enum WorkerPoolType : size_t {
@@ -411,7 +408,6 @@ class OopDataDecoder : public data_decoder::ServiceProvider {
     ServiceProcessHost::Launch(
         std::move(receiver),
         ServiceProcessHost::Options()
-            .WithSandboxType(service_manager::SandboxType::kUtility)
             .WithDisplayName("Data Decoder Service")
             .Pass());
   }
@@ -593,7 +589,7 @@ void BrowserMainLoop::Init() {
         static_cast<StartupDataImpl*>(parameters_.startup_data);
     // This is always invoked before |io_thread_| is initialized (i.e. never
     // resets it).
-    io_thread_ = std::move(startup_data->ipc_thread);
+    io_thread_ = std::move(startup_data->io_thread);
     mojo_ipc_support_ = std::move(startup_data->mojo_ipc_support);
     service_manager_shutdown_closure_ =
         std::move(startup_data->service_manager_shutdown_closure);
@@ -617,8 +613,8 @@ int BrowserMainLoop::EarlyInitialization() {
 
 #if defined(USE_X11)
   if (UsingInProcessGpu()) {
-    if (!gfx::InitializeThreadedX11()) {
-      LOG(ERROR) << "Failed to put Xlib into threaded mode.";
+    if (!gfx::GetXDisplay()) {
+      LOG(ERROR) << "Failed to open an X11 connection.";
     }
   }
 #endif
@@ -1577,4 +1573,16 @@ bool BrowserMainLoop::AudioServiceOutOfProcess() const {
          !GetContentClient()->browser()->OverridesAudioManager();
 }
 
+SmsProvider* BrowserMainLoop::GetSmsProvider() {
+  if (!sms_provider_) {
+    sms_provider_ = SmsProvider::Create();
+  }
+  return sms_provider_.get();
+}
+
+void BrowserMainLoop::SetSmsProviderForTesting(
+    std::unique_ptr<SmsProvider> provider) {
+  sms_provider_ = std::move(provider);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/browser_main_loop.h b/chromium/content/browser/browser_main_loop.h
index 42bf9a2fd82..affe516c1aa 100644
--- a/chromium/content/browser/browser_main_loop.h
+++ b/chromium/content/browser/browser_main_loop.h
@@ -87,6 +87,7 @@ class MediaKeysListenerManagerImpl;
 class MediaStreamManager;
 class SaveFileManager;
 class ScreenlockMonitor;
+class SmsProvider;
 class SpeechRecognitionManagerImpl;
 class StartupTaskRunner;
 class TracingControllerImpl;
@@ -215,6 +216,9 @@ class CONTENT_EXPORT BrowserMainLoop {
   }
 #endif
 
+  SmsProvider* GetSmsProvider();
+  void SetSmsProviderForTesting(std::unique_ptr<SmsProvider>);
+
   BrowserMainParts* parts() { return parts_.get(); }
 
  private:
@@ -368,6 +372,8 @@ class CONTENT_EXPORT BrowserMainLoop {
   // Must be deleted on the IO thread.
   std::unique_ptr<SpeechRecognitionManagerImpl> speech_recognition_manager_;
 
+  std::unique_ptr<SmsProvider> sms_provider_;
+
 #if defined(OS_WIN)
   std::unique_ptr<media::SystemMessageWindowWin> system_message_window_;
 #elif defined(OS_LINUX) && defined(USE_UDEV)
diff --git a/chromium/content/browser/browser_main_loop_unittest.cc b/chromium/content/browser/browser_main_loop_unittest.cc
index 442a0d2ad8c..b16c715b555 100644
--- a/chromium/content/browser/browser_main_loop_unittest.cc
+++ b/chromium/content/browser/browser_main_loop_unittest.cc
@@ -60,7 +60,7 @@ TEST_F(BrowserMainLoopTest, CreateThreadsInSingleProcess) {
   MainFunctionParams main_function_params(GetProcessCommandLine());
 
   StartupDataImpl startup_data;
-  startup_data.ipc_thread = BrowserTaskExecutor::CreateIOThread();
+  startup_data.io_thread = BrowserTaskExecutor::CreateIOThread();
   main_function_params.startup_data = &startup_data;
 
   BrowserMainLoop browser_main_loop(
@@ -82,7 +82,7 @@ TEST_F(BrowserMainLoopTest,
   MainFunctionParams main_function_params(GetProcessCommandLine());
 
   StartupDataImpl startup_data;
-  startup_data.ipc_thread = BrowserTaskExecutor::CreateIOThread();
+  startup_data.io_thread = BrowserTaskExecutor::CreateIOThread();
   main_function_params.startup_data = &startup_data;
 
   BrowserMainLoop browser_main_loop(
diff --git a/chromium/content/browser/browser_main_runner_impl.cc b/chromium/content/browser/browser_main_runner_impl.cc
index 4b59e815be0..6607523e72c 100644
--- a/chromium/content/browser/browser_main_runner_impl.cc
+++ b/chromium/content/browser/browser_main_runner_impl.cc
@@ -5,11 +5,11 @@
 #include "content/browser/browser_main_runner_impl.h"
 
 #include "base/base_switches.h"
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
 #include "base/debug/leak_annotations.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/run_loop.h"
 #include "base/synchronization/atomic_flag.h"
diff --git a/chromium/content/browser/browser_plugin/browser_plugin_embedder.cc b/chromium/content/browser/browser_plugin/browser_plugin_embedder.cc
index 5e6c510c928..4f49dfd044b 100644
--- a/chromium/content/browser/browser_plugin/browser_plugin_embedder.cc
+++ b/chromium/content/browser/browser_plugin/browser_plugin_embedder.cc
@@ -156,9 +156,6 @@ bool BrowserPluginEmbedder::AreAnyGuestsCurrentlyAudible() {
 // static
 bool BrowserPluginEmbedder::UnlockMouseIfNecessaryCallback(bool* mouse_unlocked,
                                                            WebContents* guest) {
-  *mouse_unlocked |= static_cast<WebContentsImpl*>(guest)
-                         ->GetBrowserPluginGuest()
-                         ->mouse_locked();
   guest->GotResponseToLockMouseRequest(
       blink::mojom::PointerLockResult::kUserRejected);
 
diff --git a/chromium/content/browser/browser_plugin/browser_plugin_guest.cc b/chromium/content/browser/browser_plugin/browser_plugin_guest.cc
index f9cc362c3f0..8641ed5e5d9 100644
--- a/chromium/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/chromium/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -68,7 +68,6 @@ BrowserPluginGuest::BrowserPluginGuest(bool has_render_view,
       attached_(false),
       browser_plugin_instance_id_(browser_plugin::kInstanceIDNone),
       focused_(false),
-      mouse_locked_(false),
       is_full_page_plugin_(false),
       has_render_view_(has_render_view),
       is_in_destruction_(false),
@@ -90,11 +89,6 @@ int BrowserPluginGuest::LoadURLWithParams(
   return MSG_ROUTING_NONE;
 }
 
-void BrowserPluginGuest::SizeContents(const gfx::Size& new_size) {
-  // TODO(wjmaclean): Verify whether this is used via WebContentsViewChildFrame.
-  GetWebContents()->GetView()->SizeContents(new_size);
-}
-
 void BrowserPluginGuest::WillDestroy() {
   is_in_destruction_ = true;
 
@@ -142,8 +136,6 @@ void BrowserPluginGuest::SetFocus(RenderWidgetHost* rwh,
         ->SetInitialFocus(focus_type == blink::mojom::FocusType::kBackward);
   }
   RenderWidgetHostImpl::From(rwh)->GetWidgetInputHandler()->SetFocus(focused);
-  if (!focused && mouse_locked_)
-    DidUnlockMouse();
 
   // Restore the last seen state of text input to the view.
   RenderWidgetHostViewBase* rwhv = static_cast<RenderWidgetHostViewBase*>(
@@ -399,30 +391,6 @@ void BrowserPluginGuest::DidTextInputStateChange(const TextInputState& params) {
 void BrowserPluginGuest::DidUnlockMouse() {
 }
 
-bool BrowserPluginGuest::OnMessageReceived(const IPC::Message& message,
-                                           RenderFrameHost* render_frame_host) {
-  // This will eventually be the home for more IPC handlers that depend on
-  // RenderFrameHost. Until more are moved here, though, the IPC_* macros won't
-  // compile if there are no handlers for a platform. So we have both #if guards
-  // around the whole thing (unfortunate but temporary), and #if guards where
-  // they belong, only around the one IPC handler. TODO(avi): Move more of the
-  // frame-based handlers to this function and remove the outer #if layer.
-#if defined(OS_MACOSX)
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(BrowserPluginGuest, message,
-                                   render_frame_host)
-    // MacOS X creates and populates platform-specific select drop-down menus
-    // whereas other platforms merely create a popup window that the guest
-    // renderer process paints inside.
-    IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-#else
-  return false;
-#endif
-}
-
 void BrowserPluginGuest::OnDetach(int browser_plugin_instance_id) {
   if (!attached())
     return;
@@ -546,30 +514,6 @@ void BrowserPluginGuest::OnSetFocus(int browser_plugin_instance_id,
   SetFocus(rwh, focused, focus_type);
 }
 
-void BrowserPluginGuest::OnSetEditCommandsForNextKeyEvent(
-    int browser_plugin_instance_id,
-    const std::vector<EditCommand>& edit_commands) {
-  GetWebContents()
-      ->GetRenderViewHost()
-      ->GetWidget()
-      ->GetWidgetInputHandler()
-      ->SetEditCommandsForNextKeyEvent(edit_commands);
-}
-
-void BrowserPluginGuest::OnUnlockMouseAck(int browser_plugin_instance_id) {
-  // mouse_locked_ could be false here if the lock attempt was cancelled due
-  // to window focus, or for various other reasons before the guest was informed
-  // of the lock's success.
-  if (mouse_locked_) {
-    mojom::WidgetInputHandler* input_handler = GetWebContents()
-                                                   ->GetRenderViewHost()
-                                                   ->GetWidget()
-                                                   ->GetWidgetInputHandler();
-    input_handler->MouseLockLost();
-  }
-  mouse_locked_ = false;
-}
-
 void BrowserPluginGuest::OnSynchronizeVisualProperties(
     int browser_plugin_instance_id,
     const FrameVisualProperties& visual_properties) {
@@ -622,23 +566,28 @@ void BrowserPluginGuest::OnSynchronizeVisualProperties(
 }
 
 #if defined(OS_MACOSX)
-void BrowserPluginGuest::OnShowPopup(
+bool BrowserPluginGuest::ShowPopupMenu(
     RenderFrameHost* render_frame_host,
-    const FrameHostMsg_ShowPopup_Params& params) {
-  gfx::Rect translated_bounds(params.bounds);
+    mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+    const gfx::Rect& bounds,
+    int32_t item_height,
+    double font_size,
+    int32_t selected_item,
+    std::vector<blink::mojom::MenuItemPtr>* menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
+  gfx::Rect translated_bounds(bounds);
   WebContents* guest = web_contents();
   translated_bounds.set_origin(
       guest->GetRenderWidgetHostView()->TransformPointToRootCoordSpace(
           translated_bounds.origin()));
   BrowserPluginPopupMenuHelper popup_menu_helper(
-      owner_web_contents_->GetMainFrame(), render_frame_host);
-  popup_menu_helper.ShowPopupMenu(translated_bounds,
-                                  params.item_height,
-                                  params.item_font_size,
-                                  params.selected_item,
-                                  params.popup_items,
-                                  params.right_aligned,
-                                  params.allow_multiple_selection);
+      owner_web_contents_->GetMainFrame(), render_frame_host,
+      std::move(*popup_client));
+  popup_menu_helper.ShowPopupMenu(translated_bounds, item_height, font_size,
+                                  selected_item, std::move(*menu_items),
+                                  right_aligned, allow_multiple_selection);
+  return true;
 }
 #endif
 
diff --git a/chromium/content/browser/browser_plugin/browser_plugin_guest.h b/chromium/content/browser/browser_plugin/browser_plugin_guest.h
index 92be1fea6df..f92c7dafc9b 100644
--- a/chromium/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/chromium/content/browser/browser_plugin/browser_plugin_guest.h
@@ -22,6 +22,8 @@
 
 #include <map>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "base/compiler_specific.h"
 #include "base/containers/circular_deque.h"
@@ -32,14 +34,16 @@
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
 #include "components/viz/common/surfaces/scoped_surface_id_allocator.h"
 #include "content/browser/renderer_host/input_event_shim.h"
-#include "content/common/edit_command.h"
 #include "content/public/browser/browser_plugin_guest_delegate.h"
 #include "content/public/browser/guest_host.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/common/screen_info.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-forward.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-forward.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/web/web_drag_status.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
@@ -47,10 +51,6 @@
 #include "ui/base/ime/text_input_type.h"
 #include "ui/gfx/geometry/rect.h"
 
-#if defined(OS_MACOSX)
-struct FrameHostMsg_ShowPopup_Params;
-#endif
-
 namespace gfx {
 class Range;
 }  // namespace gfx
@@ -133,9 +133,6 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
                 bool focused,
                 blink::mojom::FocusType focus_type);
 
-  // Return true if the mouse is locked.
-  bool mouse_locked() const { return mouse_locked_; }
-
   // Creates a new guest WebContentsImpl with the provided |params| with |this|
   // as the |opener|.
   WebContentsImpl* CreateNewGuestWindow(
@@ -183,13 +180,24 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
   void DidFinishNavigation(NavigationHandle* navigation_handle) override;
 
   void RenderProcessGone(base::TerminationStatus status) override;
-  bool OnMessageReceived(const IPC::Message& message,
-                         RenderFrameHost* render_frame_host) override;
+#if defined(OS_MACOSX)
+  // On MacOS X popups are painted by the browser process. We handle them here
+  // so that they are positioned correctly.
+  bool ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+      const gfx::Rect& bounds,
+      int32_t item_height,
+      double font_size,
+      int32_t selected_item,
+      std::vector<blink::mojom::MenuItemPtr>* menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
+#endif
 
   // GuestHost implementation.
   int LoadURLWithParams(
       const NavigationController::LoadURLParams& load_params) override;
-  void SizeContents(const gfx::Size& new_size) override;
   void WillDestroy() override;
 
   // Exposes the protected web_contents() from WebContentsObserver.
@@ -218,7 +226,6 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
       const gfx::Point& relative_point);
 
  protected:
-
   // BrowserPluginGuest is a WebContentsObserver of |web_contents| and
   // |web_contents| has to stay valid for the lifetime of BrowserPluginGuest.
   // Constructor protected for testing.
@@ -261,10 +268,7 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
   // Sets the name of the guest so that other guests in the same partition can
   // access it.
   void OnSetName(int instance_id, const std::string& name);
-  // Updates the size state of the guest.
-  void OnSetEditCommandsForNextKeyEvent(
-      int instance_id,
-      const std::vector<EditCommand>& edit_commands);
+
   // TODO(wjmaclean): Investigate how to update this comment.
   // The guest WebContents is visible if both its embedder is visible and
   // the browser plugin element is visible. If either one is not then the
@@ -282,7 +286,6 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
   // Additionally, it will slow down Javascript execution and garbage
   // collection. See RenderThreadImpl::IdleHandler (executed when hidden) and
   // RenderThreadImpl::IdleHandlerInForegroundTab (executed when visible).
-  void OnUnlockMouseAck(int instance_id);
   void OnSynchronizeVisualProperties(
       int instance_id,
       const FrameVisualProperties& visual_properties);
@@ -296,15 +299,8 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
   void OnExtendSelectionAndDelete(int instance_id, int before, int after);
 
   // Message handlers for messages from guest.
-  void OnHandleInputEventAck(
-      blink::WebInputEvent::Type event_type,
-      InputEventAckState ack_result);
-#if defined(OS_MACOSX)
-  // On MacOS X popups are painted by the browser process. We handle them here
-  // so that they are positioned correctly.
-  void OnShowPopup(RenderFrameHost* render_frame_host,
-                   const FrameHostMsg_ShowPopup_Params& params);
-#endif
+  void OnHandleInputEventAck(blink::WebInputEvent::Type event_type,
+                             blink::mojom::InputEventResultState ack_result);
   void OnUpdateFrameName(int frame_id,
                          bool is_top_level,
                          const std::string& name);
@@ -323,7 +319,6 @@ class CONTENT_EXPORT BrowserPluginGuest : public GuestHost,
   int browser_plugin_instance_id_;
   gfx::Rect frame_rect_;
   bool focused_;
-  bool mouse_locked_;
   // Whether the browser plugin is inside a plugin document.
   bool is_full_page_plugin_;
 
diff --git a/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.h b/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.h
index ebb46abce68..bf3f6ed7c19 100644
--- a/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.h
+++ b/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.h
@@ -7,6 +7,8 @@
 
 #include "base/macros.h"
 #include "content/browser/frame_host/popup_menu_helper_mac.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 
 namespace content {
 
@@ -21,8 +23,10 @@ class BrowserPluginPopupMenuHelper : public PopupMenuHelper,
   // Creates a BrowserPluginPopupMenuHelper that positions popups relative to
   // |embedder_rfh| and will notify |guest_rfh| when a user selects or cancels
   // the popup.
-  BrowserPluginPopupMenuHelper(RenderFrameHostImpl* embedder_rfh,
-                               RenderFrameHost* guest_rfh);
+  BrowserPluginPopupMenuHelper(
+      RenderFrameHostImpl* embedder_rfh,
+      RenderFrameHost* guest_rfh,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client);
 
  private:
   // PopupMenuHelper:
diff --git a/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.mm b/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.mm
index 1784e0e900f..1df3725f70e 100644
--- a/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.mm
+++ b/chromium/content/browser/browser_plugin/browser_plugin_popup_menu_helper_mac.mm
@@ -12,8 +12,10 @@ namespace content {
 
 BrowserPluginPopupMenuHelper::BrowserPluginPopupMenuHelper(
     RenderFrameHostImpl* embedder_rfh,
-    RenderFrameHost* guest_rfh)
-    : PopupMenuHelper(this, guest_rfh), embedder_rfh_(embedder_rfh) {}
+    RenderFrameHost* guest_rfh,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client)
+    : PopupMenuHelper(this, guest_rfh, std::move(popup_client)),
+      embedder_rfh_(embedder_rfh) {}
 
 RenderWidgetHostViewMac*
     BrowserPluginPopupMenuHelper::GetRenderWidgetHostView() const {
diff --git a/chromium/content/browser/browser_process_sub_thread.cc b/chromium/content/browser/browser_process_sub_thread.cc
index f7c731ed7f9..748e7cf0b5b 100644
--- a/chromium/content/browser/browser_process_sub_thread.cc
+++ b/chromium/content/browser/browser_process_sub_thread.cc
@@ -125,14 +125,14 @@ void BrowserProcessSubThread::CompleteInitializationOnBrowserThread() {
 // them together.
 
 NOINLINE void BrowserProcessSubThread::UIThreadRun(base::RunLoop* run_loop) {
-  const int line_number = __LINE__;
   Thread::Run(run_loop);
+
+  // Inhibit tail calls of Run and inhibit code folding.
+  const int line_number = __LINE__;
   base::debug::Alias(&line_number);
 }
 
 NOINLINE void BrowserProcessSubThread::IOThreadRun(base::RunLoop* run_loop) {
-  const int line_number = __LINE__;
-
   // Register the IO thread for hang watching before it starts running and set
   // up a closure to automatically unregister it when Run() returns.
   base::ScopedClosureRunner unregister_thread_closure;
@@ -142,6 +142,9 @@ NOINLINE void BrowserProcessSubThread::IOThreadRun(base::RunLoop* run_loop) {
   }
 
   Thread::Run(run_loop);
+
+  // Inhibit tail calls of Run and inhibit code folding.
+  const int line_number = __LINE__;
   base::debug::Alias(&line_number);
 }
 
diff --git a/chromium/content/browser/browser_thread_browsertest.cc b/chromium/content/browser/browser_thread_browsertest.cc
index f53229fa11e..68e737d5354 100644
--- a/chromium/content/browser/browser_thread_browsertest.cc
+++ b/chromium/content/browser/browser_thread_browsertest.cc
@@ -13,6 +13,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_utils.h"
 
diff --git a/chromium/content/browser/browser_thread_impl.cc b/chromium/content/browser/browser_thread_impl.cc
index 87535e6ec73..895ad848bcf 100644
--- a/chromium/content/browser/browser_thread_impl.cc
+++ b/chromium/content/browser/browser_thread_impl.cc
@@ -10,8 +10,8 @@
 #include "base/atomicops.h"
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/compiler_specific.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/message_loop/message_loop_current.h"
 #include "base/no_destructor.h"
diff --git a/chromium/content/browser/browser_url_handler_impl.cc b/chromium/content/browser/browser_url_handler_impl.cc
index d0a943d69f5..88bc53e9626 100644
--- a/chromium/content/browser/browser_url_handler_impl.cc
+++ b/chromium/content/browser/browser_url_handler_impl.cc
@@ -125,6 +125,23 @@ void BrowserURLHandlerImpl::RewriteURLIfNecessary(
   RewriteURLIfNecessary(url, browser_context, &ignored_reverse_on_redirect);
 }
 
+std::vector<GURL> BrowserURLHandlerImpl::GetPossibleRewrites(
+    const GURL& url,
+    BrowserContext* browser_context) {
+  std::vector<GURL> rewrites;
+  for (const auto& it : url_handlers_) {
+    const URLHandler& handler = it.first;
+    if (!handler)
+      continue;
+
+    GURL mutable_url(url);
+    if (handler(&mutable_url, browser_context))
+      rewrites.push_back(std::move(mutable_url));
+  }
+
+  return rewrites;
+}
+
 void BrowserURLHandlerImpl::FixupURLBeforeRewrite(
     GURL* url,
     BrowserContext* browser_context) {
diff --git a/chromium/content/browser/browser_url_handler_impl.h b/chromium/content/browser/browser_url_handler_impl.h
index 5d83a2ff8c6..1823ec65981 100644
--- a/chromium/content/browser/browser_url_handler_impl.h
+++ b/chromium/content/browser/browser_url_handler_impl.h
@@ -26,6 +26,9 @@ class CONTENT_EXPORT BrowserURLHandlerImpl : public BrowserURLHandler {
   // BrowserURLHandler implementation:
   void RewriteURLIfNecessary(GURL* url,
                              BrowserContext* browser_context) override;
+  std::vector<GURL> GetPossibleRewrites(
+      const GURL& url,
+      BrowserContext* browser_context) override;
   void SetFixupHandler(URLHandler handler) override;
   void AddHandlerPair(URLHandler handler, URLHandler reverse_handler) override;
 
@@ -63,6 +66,7 @@ class CONTENT_EXPORT BrowserURLHandlerImpl : public BrowserURLHandler {
   FRIEND_TEST_ALL_PREFIXES(BrowserURLHandlerImplTest, BasicRewriteAndReverse);
   FRIEND_TEST_ALL_PREFIXES(BrowserURLHandlerImplTest, NullHandlerReverse);
   FRIEND_TEST_ALL_PREFIXES(BrowserURLHandlerImplTest, ViewSourceReverse);
+  FRIEND_TEST_ALL_PREFIXES(BrowserURLHandlerImplTest, GetPossibleRewrites);
 
   DISALLOW_COPY_AND_ASSIGN(BrowserURLHandlerImpl);
 };
diff --git a/chromium/content/browser/browser_url_handler_impl_unittest.cc b/chromium/content/browser/browser_url_handler_impl_unittest.cc
index c55206cc6fd..0f7b9fd60ca 100644
--- a/chromium/content/browser/browser_url_handler_impl_unittest.cc
+++ b/chromium/content/browser/browser_url_handler_impl_unittest.cc
@@ -5,6 +5,7 @@
 #include "content/browser/browser_url_handler_impl.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -98,4 +99,32 @@ TEST_F(BrowserURLHandlerImplTest, ViewSourceReverse) {
   ASSERT_EQ("view-source:http://foo/?a=1", url.spec());
 }
 
+// Verify that GetPossibleRewrites retrieves the rewrites from all handlers that
+// match, in order of priority.
+TEST_F(BrowserURLHandlerImplTest, GetPossibleRewrites) {
+  BrowserTaskEnvironment task_environment;
+  TestBrowserContext browser_context;
+  BrowserURLHandlerImpl handler;
+
+  auto rewriter1 = [](GURL* url, BrowserContext* context) {
+    *url = GURL("https://test1.example");
+    return true;
+  };
+  auto rewriter2 = [](GURL* url, BrowserContext* context) { return false; };
+  auto rewriter3 = [](GURL* url, BrowserContext* context) {
+    *url = GURL("https://test3.example");
+    return true;
+  };
+  handler.AddHandlerPair(rewriter1, BrowserURLHandlerImpl::null_handler());
+  handler.AddHandlerPair(rewriter2, BrowserURLHandlerImpl::null_handler());
+  handler.AddHandlerPair(rewriter3, BrowserURLHandlerImpl::null_handler());
+
+  GURL url("https://example.com");
+  std::vector<GURL> rewrites =
+      handler.GetPossibleRewrites(url, &browser_context);
+
+  EXPECT_THAT(rewrites, testing::ElementsAre(GURL("https://test1.example"),
+                                             GURL("https://test3.example")));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
index c1a83d3ee7e..78664acc30d 100644
--- a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
@@ -10,7 +10,6 @@
 #include "base/bind.h"
 #include "base/callback.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
-#include "url/origin.h"
 
 using net::registry_controlled_domains::GetDomainAndRegistry;
 using net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES;
@@ -36,25 +35,28 @@ bool IsSubdomainOfARegistrableDomain(const std::string& domain) {
 // True if the domain of |url| is in the whitelist, or isn't in the blacklist.
 // The whitelist or blacklist is represented as |origins|,
 // |registerable_domains|, and |mode|.
-bool MatchesURL(
-    const std::set<url::Origin>& origins,
-    const std::set<std::string>& registerable_domains,
-    BrowsingDataFilterBuilder::Mode mode,
-    const GURL& url) {
-  std::string url_registerable_domain =
-      GetDomainAndRegistry(url, INCLUDE_PRIVATE_REGISTRIES);
-  bool found_domain =
-      (registerable_domains.find(
-          url_registerable_domain != "" ? url_registerable_domain
-                                        : url.host()) !=
-       registerable_domains.end());
-
-  bool found_origin = (origins.find(url::Origin::Create(url)) != origins.end());
-
+bool MatchesOrigin(const std::set<url::Origin>& origins,
+                   const std::set<std::string>& registerable_domains,
+                   BrowsingDataFilterBuilder::Mode mode,
+                   const url::Origin& origin) {
+  std::string registerable_domain =
+      GetDomainAndRegistry(origin, INCLUDE_PRIVATE_REGISTRIES);
+  bool found_domain = base::Contains(
+      registerable_domains,
+      registerable_domain == "" ? origin.host() : registerable_domain);
+  bool found_origin = base::Contains(origins, origin);
   return ((found_domain || found_origin) ==
           (mode == BrowsingDataFilterBuilder::WHITELIST));
 }
 
+bool MatchesURL(const std::set<url::Origin>& origins,
+                const std::set<std::string>& registerable_domains,
+                BrowsingDataFilterBuilder::Mode mode,
+                const GURL& url) {
+  return MatchesOrigin(origins, registerable_domains, mode,
+                       url::Origin::Create(url));
+}
+
 // True if none of the supplied domains matches this plugin's |site| and we're
 // a blacklist, or one of them does and we're a whitelist. The whitelist or
 // blacklist is represented by |domains_and_ips| and |mode|.
@@ -123,10 +125,19 @@ bool BrowsingDataFilterBuilderImpl::IsEmptyBlacklist() {
 }
 
 base::RepeatingCallback<bool(const GURL&)>
-BrowsingDataFilterBuilderImpl::BuildGeneralFilter() {
+BrowsingDataFilterBuilderImpl::BuildUrlFilter() {
+  if (IsEmptyBlacklist())
+    return base::BindRepeating([](const GURL&) { return true; });
   return base::BindRepeating(&MatchesURL, origins_, domains_, mode_);
 }
 
+base::RepeatingCallback<bool(const url::Origin&)>
+BrowsingDataFilterBuilderImpl::BuildOriginFilter() {
+  if (IsEmptyBlacklist())
+    return base::BindRepeating([](const url::Origin&) { return true; });
+  return base::BindRepeating(&MatchesOrigin, origins_, domains_, mode_);
+}
+
 network::mojom::ClearDataFilterPtr
 BrowsingDataFilterBuilderImpl::BuildNetworkServiceFilter() {
   if (IsEmptyBlacklist())
diff --git a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.h b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.h
index 6ce2caabca6..695769ea11d 100644
--- a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.h
+++ b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.h
@@ -9,6 +9,7 @@
 
 #include "base/macros.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -18,11 +19,15 @@ class CONTENT_EXPORT BrowsingDataFilterBuilderImpl
   explicit BrowsingDataFilterBuilderImpl(Mode mode);
   ~BrowsingDataFilterBuilderImpl() override;
 
+  // TODO(csharrison): consider exposing / using this in the //content public
+  // API.
+  base::RepeatingCallback<bool(const url::Origin&)> BuildOriginFilter();
+
   // BrowsingDataFilterBuilder implementation:
   void AddOrigin(const url::Origin& origin) override;
   void AddRegisterableDomain(const std::string& registrable_domain) override;
   bool IsEmptyBlacklist() override;
-  base::RepeatingCallback<bool(const GURL&)> BuildGeneralFilter() override;
+  base::RepeatingCallback<bool(const GURL&)> BuildUrlFilter() override;
   network::mojom::ClearDataFilterPtr BuildNetworkServiceFilter() override;
   network::mojom::CookieDeletionFilterPtr BuildCookieDeletionFilter() override;
   base::RepeatingCallback<bool(const std::string& site)> BuildPluginFilter()
diff --git a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
index b30d0638a4f..2dc273ade6b 100644
--- a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
@@ -131,8 +131,7 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // We match any URL on the specified domains.
@@ -177,8 +176,7 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // We match any URL that are not on the specified domains.
@@ -427,8 +425,7 @@ TEST(BrowsingDataFilterBuilderImplTest, OriginWhitelist) {
       BrowsingDataFilterBuilderImpl::WHITELIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://www.google.com")));
   builder.AddOrigin(url::Origin::Create(GURL("http://www.example.com")));
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // Whitelist matches any URL on the specified origins.
@@ -459,8 +456,7 @@ TEST(BrowsingDataFilterBuilderImplTest, OriginBlacklist) {
       BrowsingDataFilterBuilderImpl::BLACKLIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://www.google.com")));
   builder.AddOrigin(url::Origin::Create(GURL("http://www.example.com")));
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // URLS on explicitly specified origins are not matched.
@@ -492,8 +488,7 @@ TEST(BrowsingDataFilterBuilderImplTest, CombinedWhitelist) {
       BrowsingDataFilterBuilderImpl::WHITELIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://google.com")));
   builder.AddRegisterableDomain("example.com");
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // Whitelist matches any URL on the specified origins.
@@ -516,8 +511,7 @@ TEST(BrowsingDataFilterBuilderImplTest, CombinedBlacklist) {
       BrowsingDataFilterBuilderImpl::BLACKLIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://google.com")));
   builder.AddRegisterableDomain("example.com");
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder.BuildUrlFilter();
 
   TestCase test_cases[] = {
       // URLS on explicitly specified origins are not matched.
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc b/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
index e828d201b56..d83d797445d 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
@@ -13,6 +13,7 @@
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/callback_helpers.h"
+#include "base/feature_list.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
@@ -21,6 +22,7 @@
 #include "base/task/post_task.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
+#include "content/browser/browsing_data/browsing_data_filter_builder_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
@@ -31,6 +33,7 @@
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_features.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/cpp/features.h"
@@ -67,30 +70,30 @@ base::OnceClosure RunsOrPostOnCurrentTaskRunner(base::OnceClosure closure) {
 // it matches |predicate|. If |origin_type_mask| contains embedder-specific
 // datatypes, |embedder_matcher| must not be null; the decision for those
 // datatypes will be delegated to it.
-bool DoesOriginMatchMaskAndURLs(
+bool DoesOriginMatchMaskAndPredicate(
     int origin_type_mask,
-    base::OnceCallback<bool(const GURL&)> predicate,
+    base::OnceCallback<bool(const url::Origin&)> predicate,
     const BrowsingDataRemoverDelegate::EmbedderOriginTypeMatcher&
         embedder_matcher,
     const url::Origin& origin,
     storage::SpecialStoragePolicy* policy) {
-  if (predicate && !std::move(predicate).Run(origin.GetURL()))
+  if (predicate && !std::move(predicate).Run(origin))
     return false;
 
   const std::vector<std::string>& schemes = url::GetWebStorageSchemes();
   bool is_web_scheme = base::Contains(schemes, origin.scheme());
 
   // If a websafe origin is unprotected, it matches iff UNPROTECTED_WEB.
-  if ((!policy || !policy->IsStorageProtected(origin.GetURL())) &&
+  if ((origin_type_mask & BrowsingDataRemover::ORIGIN_TYPE_UNPROTECTED_WEB) &&
       is_web_scheme &&
-      (origin_type_mask & BrowsingDataRemover::ORIGIN_TYPE_UNPROTECTED_WEB)) {
+      (!policy || !policy->IsStorageProtected(origin.GetURL()))) {
     return true;
   }
   origin_type_mask &= ~BrowsingDataRemover::ORIGIN_TYPE_UNPROTECTED_WEB;
 
   // Hosted applications (protected and websafe origins) iff PROTECTED_WEB.
-  if (policy && policy->IsStorageProtected(origin.GetURL()) && is_web_scheme &&
-      (origin_type_mask & BrowsingDataRemover::ORIGIN_TYPE_PROTECTED_WEB)) {
+  if ((origin_type_mask & BrowsingDataRemover::ORIGIN_TYPE_PROTECTED_WEB) &&
+      is_web_scheme && policy && policy->IsStorageProtected(origin.GetURL())) {
     return true;
   }
   origin_type_mask &= ~BrowsingDataRemover::ORIGIN_TYPE_PROTECTED_WEB;
@@ -157,9 +160,9 @@ bool BrowsingDataRemoverImpl::DoesOriginMatchMaskForTesting(
   if (embedder_delegate_)
     embedder_matcher = embedder_delegate_->GetOriginTypeMatcher();
 
-  return DoesOriginMatchMaskAndURLs(origin_type_mask, base::NullCallback(),
-                                    std::move(embedder_matcher), origin,
-                                    policy);
+  return DoesOriginMatchMaskAndPredicate(origin_type_mask, base::NullCallback(),
+                                         std::move(embedder_matcher), origin,
+                                         policy);
 }
 
 void BrowsingDataRemoverImpl::Remove(const base::Time& delete_begin,
@@ -300,15 +303,18 @@ void BrowsingDataRemoverImpl::RemoveImpl(
 
   //////////////////////////////////////////////////////////////////////////////
   // INITIALIZATION
-  base::RepeatingCallback<bool(const GURL& url)> filter =
-      filter_builder->BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> url_filter =
+      filter_builder->BuildUrlFilter();
+  base::RepeatingCallback<bool(const url::Origin&)> origin_filter =
+      static_cast<BrowsingDataFilterBuilderImpl*>(filter_builder)
+          ->BuildOriginFilter();
 
   // Some backends support a filter that |is_null()| to make complete deletion
   // more efficient.
-  base::RepeatingCallback<bool(const GURL&)> nullable_filter =
+  base::RepeatingCallback<bool(const GURL&)> nullable_url_filter =
       filter_builder->IsEmptyBlacklist()
           ? base::RepeatingCallback<bool(const GURL&)>()
-          : filter;
+          : url_filter;
 
   //////////////////////////////////////////////////////////////////////////////
   // DATA_TYPE_DOWNLOADS
@@ -317,7 +323,7 @@ void BrowsingDataRemoverImpl::RemoveImpl(
     base::RecordAction(UserMetricsAction("ClearBrowsingData_Downloads"));
     DownloadManager* download_manager =
         BrowserContext::GetDownloadManager(browser_context_);
-    download_manager->RemoveDownloadsByURLAndTime(filter, delete_begin_,
+    download_manager->RemoveDownloadsByURLAndTime(url_filter, delete_begin_,
                                                   delete_end_);
   }
 
@@ -378,6 +384,10 @@ void BrowsingDataRemoverImpl::RemoveImpl(
     storage_partition_remove_mask |=
         StoragePartition::REMOVE_DATA_MASK_PLUGIN_PRIVATE_DATA;
   }
+  if (remove_mask & DATA_TYPE_CONVERSIONS) {
+    storage_partition_remove_mask |=
+        StoragePartition::REMOVE_DATA_MASK_CONVERSIONS;
+  }
 
   StoragePartition* storage_partition;
   if (storage_partition_for_testing_) {
@@ -423,8 +433,8 @@ void BrowsingDataRemoverImpl::RemoveImpl(
 
     storage_partition->ClearData(
         storage_partition_remove_mask, quota_storage_remove_mask,
-        base::BindRepeating(&DoesOriginMatchMaskAndURLs, origin_type_mask_,
-                            filter, std::move(embedder_matcher)),
+        base::BindRepeating(&DoesOriginMatchMaskAndPredicate, origin_type_mask_,
+                            origin_filter, std::move(embedder_matcher)),
         std::move(deletion_filter), perform_storage_cleanup, delete_begin_,
         delete_end_,
         CreateTaskCompletionClosure(TracingDataType::kStoragePartition));
@@ -449,9 +459,20 @@ void BrowsingDataRemoverImpl::RemoveImpl(
         delete_begin, delete_end, filter_builder->BuildNetworkServiceFilter(),
         CreateTaskCompletionClosureForMojo(TracingDataType::kHttpCache));
 
-    storage_partition->ClearCodeCaches(
-        delete_begin, delete_end, nullable_filter,
-        CreateTaskCompletionClosureForMojo(TracingDataType::kCodeCaches));
+    if (base::FeatureList::IsEnabled(
+            features::kCodeCacheDeletionWithoutFilter)) {
+      // Experimentally perform blacklist deletions without filter and skip
+      // origin specific deletions. See crbug.com/1040039#26.
+      if (filter_builder->GetMode() == BrowsingDataFilterBuilder::BLACKLIST) {
+        storage_partition->ClearCodeCaches(
+            delete_begin, delete_end, /*filter=*/base::NullCallback(),
+            CreateTaskCompletionClosureForMojo(TracingDataType::kCodeCaches));
+      }
+    } else {
+      storage_partition->ClearCodeCaches(
+          delete_begin, delete_end, nullable_url_filter,
+          CreateTaskCompletionClosureForMojo(TracingDataType::kCodeCaches));
+    }
 
     // TODO(crbug.com/1985971) : Implement filtering for NetworkHistory.
     if (filter_builder->GetMode() == BrowsingDataFilterBuilder::BLACKLIST) {
@@ -466,6 +487,23 @@ void BrowsingDataRemoverImpl::RemoveImpl(
     RenderFrameHostImpl::ClearAllPrefetchedSignedExchangeCache();
   }
 
+  //////////////////////////////////////////////////////////////////////////////
+  // Prototype Trust Token API (https://github.com/wicg/trust-token-api).
+
+  // We don't support clearing data for specific time ranges because much Trust
+  // Tokens state (e.g. issuers associated with each top-level origin) has no
+  // notion of associated creation time. Consequently, like for reporting and
+  // network error logging below, a data removal request for certain
+  // sites/origins that has the Trust Tokens type in scope will clear all Trust
+  // Tokens data associated with the requested sites/origins.
+  if (remove_mask & DATA_TYPE_TRUST_TOKENS) {
+    network::mojom::NetworkContext* network_context =
+        storage_partition->GetNetworkContext();
+    network_context->ClearTrustTokenData(
+        filter_builder->BuildNetworkServiceFilter(),
+        CreateTaskCompletionClosureForMojo(TracingDataType::kTrustTokens));
+  }
+
 #if BUILDFLAG(ENABLE_REPORTING)
   //////////////////////////////////////////////////////////////////////////////
   // Reporting cache.
@@ -599,12 +637,6 @@ void BrowsingDataRemoverImpl::Notify() {
       base::UmaHistogramMediumTimes(
           "History.ClearBrowsingData.Duration.TimeRangeDeletion", delta);
     }
-    // TODO(dullweber): Remove this metric after M83.
-    if (!task.delete_begin.is_null() || !task.delete_end.is_max() ||
-        !task.filter_builder->IsEmptyBlacklist()) {
-      base::UmaHistogramMediumTimes(
-          "History.ClearBrowsingData.Duration.PartialDeletion", delta);
-    }
   } else {
     base::UmaHistogramMediumTimes(
         "History.ClearBrowsingData.Duration.OriginDeletion", delta);
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl.h b/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
index d610e54d188..34357d25bbc 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
@@ -107,7 +107,9 @@ class CONTENT_EXPORT BrowsingDataRemoverImpl
     kAuthCache = 9,
     kCodeCaches = 10,
     kNetworkErrorLogging = 11,
-    kMaxValue = kNetworkErrorLogging,
+    kTrustTokens = 12,
+    kConversions = 13,
+    kMaxValue = kConversions,
   };
 
   // Represents a single removal task. Contains all parameters needed to execute
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc b/chromium/content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc
index fd2eec9edb0..8552434f393 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/test/bind_test_util.h"
+#include "base/test/scoped_feature_list.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
 #include "content/public/browser/browsing_data_remover.h"
@@ -16,6 +17,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browsing_data_remover_test_util.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -29,6 +31,7 @@
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -215,6 +218,12 @@ class BrowsingDataRemoverImplBrowserTest : public ContentBrowserTest {
         .get();
   }
 
+  network::mojom::NetworkContext* network_context() {
+    return BrowserContext::GetDefaultStoragePartition(
+               shell()->web_contents()->GetBrowserContext())
+        ->GetNetworkContext();
+  }
+
  private:
   net::test_server::EmbeddedTestServer ssl_server_;
 };
@@ -271,4 +280,193 @@ IN_PROC_BROWSER_TEST_F(BrowsingDataRemoverImplBrowserTest,
   EXPECT_FALSE(IsHttpAuthCacheSet());
 }
 
+namespace {
+
+// Provide BrowsingDataRemoverImplTrustTokenTest the Trust Tokens
+// feature as a mixin so that it gets set before the superclass initializes the
+// test's NetworkContext, as the NetworkContext's initialization must occur with
+// the feature enabled.
+class WithTrustTokensEnabled {
+ public:
+  WithTrustTokensEnabled() {
+    feature_list_.InitAndEnableFeature(network::features::kTrustTokens);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Tests Trust Tokens clearing by calling HasTrustTokensAnswerer::HasTrustTokens
+// with a HasTrustTokensAnswerer obtained from the provided NetworkContext.
+//
+// The Trust Tokens functionality places a cap of 2 distinct arguments to the
+// |issuer| argument of
+//       HasTrustTokensAnswerer(origin)::HasTrustTokens(issuer)
+// for each top-frame origin |origin|. (This limit is recorded in persistent
+// storage scoped to the origin |origin| and is not related to the lifetime of
+// the specific HasTrustTokensAnswerer object.)
+//
+// To add an origin, the tester creates a HasTrustTokensAnswerer parameterized
+// by |origin| and calls HasTrustTokens with two distinct "priming" issuer
+// arguments. This will make the Trust Tokens persistent storage record that
+// |origin| is associated with each of these issuers, with the effect that
+// (barring a data clear) subsequent HasTrustTokens calls with different issuer
+// arguments will fail. To check if an origin is present, the tester calls
+//    HasTrustTokensAnswerer(origin)::HasTrustTokens(issuer)
+// with an |issuer| argument distinct from the two earlier "priming" issuers.
+// This third HasTrustTokens call will error out exactly if |origin| was
+// previously added by AddOrigin.
+//
+// Usage:
+//   >= 0 AddOrigin() - origins must be HTTPS
+//   (clear data)
+//   >= 0 HasOrigin()
+class TrustTokensTester {
+ public:
+  explicit TrustTokensTester(network::mojom::NetworkContext* network_context)
+      : network_context_(network_context) {}
+
+  void AddOrigin(const url::Origin& origin) {
+    mojo::Remote<network::mojom::HasTrustTokensAnswerer> answerer;
+    network_context_->GetHasTrustTokensAnswerer(
+        answerer.BindNewPipeAndPassReceiver(), origin);
+
+    // Calling HasTrustTokens will associate the issuer argument with the
+    // origin |origin|.
+    //
+    // Do this until the |origin| is associated with
+    // network::kTrustTokenPerToplevelMaxNumberOfAssociatedIssuers many issuers
+    // (namely 2; this value is not expected to change frequently).
+    //
+    // After the limit is reached, subsequent HasTrustToken(origin, issuer)
+    // queries will fail for any issuers not in {https://prime0.example,
+    // https://prime1.example} --- unless data for |origin| is cleared.
+    for (int i = 0; i < 2; ++i) {
+      base::RunLoop run_loop;
+      answerer->HasTrustTokens(
+          url::Origin::Create(
+              GURL(base::StringPrintf("https://prime%d.example", i))),
+          base::BindLambdaForTesting(
+              [&](network::mojom::HasTrustTokensResultPtr) {
+                run_loop.Quit();
+              }));
+      run_loop.Run();
+    }
+  }
+
+  bool HasOrigin(const url::Origin& origin) {
+    mojo::Remote<network::mojom::HasTrustTokensAnswerer> answerer;
+    network_context_->GetHasTrustTokensAnswerer(
+        answerer.BindNewPipeAndPassReceiver(), origin);
+
+    base::RunLoop run_loop;
+    bool has_origin = false;
+
+    // Since https://probe.example is not among the issuer origins previously
+    // provided to HasTrustTokens(origin, _) calls in AddOrigin:
+    // - If data has not been cleared,
+    //     HasTrustToken(origin, https://probe.example)
+    //   is expected to fail with kResourceExhausted because |origin| is at its
+    //   number-of-associated-issuers limit, so the answerer will refuse to
+    //   answer a query for an origin it has not yet seen.
+    // - If data has been cleared, the answerer should be able to fulfill the
+    //   query.
+    answerer->HasTrustTokens(
+        url::Origin::Create(GURL("https://probe.example")),
+        base::BindLambdaForTesting([&](network::mojom::HasTrustTokensResultPtr
+                                           result) {
+          // HasTrustTokens will error out with kResourceExhausted exactly
+          // when the top-frame origin |origin| was previously added by
+          // AddOrigin.
+          if (result->status ==
+              network::mojom::TrustTokenOperationStatus::kResourceExhausted) {
+            has_origin = true;
+          }
+
+          run_loop.Quit();
+        }));
+
+    run_loop.Run();
+
+    return has_origin;
+  }
+
+ private:
+  network::mojom::NetworkContext* network_context_;
+};
+
+}  // namespace
+
+class BrowsingDataRemoverImplTrustTokenTest
+    : public WithTrustTokensEnabled,
+      public BrowsingDataRemoverImplBrowserTest {};
+
+IN_PROC_BROWSER_TEST_F(BrowsingDataRemoverImplTrustTokenTest, Remove) {
+  TrustTokensTester tester(network_context());
+
+  auto origin = url::Origin::Create(GURL("https://topframe.example"));
+
+  tester.AddOrigin(origin);
+  ASSERT_TRUE(tester.HasOrigin(origin));
+
+  RemoveAndWait(BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS);
+
+  EXPECT_FALSE(tester.HasOrigin(origin));
+}
+
+IN_PROC_BROWSER_TEST_F(BrowsingDataRemoverImplTrustTokenTest, RemoveByDomain) {
+  TrustTokensTester tester(network_context());
+
+  auto origin = url::Origin::Create(GURL("https://topframe.example"));
+  auto sub_origin = url::Origin::Create(GURL("https://sub.topframe.example"));
+  auto another_origin =
+      url::Origin::Create(GURL("https://another-topframe.example"));
+
+  tester.AddOrigin(origin);
+  tester.AddOrigin(sub_origin);
+  tester.AddOrigin(another_origin);
+
+  ASSERT_TRUE(tester.HasOrigin(origin));
+  ASSERT_TRUE(tester.HasOrigin(sub_origin));
+  ASSERT_TRUE(tester.HasOrigin(another_origin));
+
+  std::unique_ptr<BrowsingDataFilterBuilder> builder(
+      BrowsingDataFilterBuilder::Create(BrowsingDataFilterBuilder::WHITELIST));
+  builder->AddRegisterableDomain("topframe.example");
+  RemoveWithFilterAndWait(BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS,
+                          std::move(builder));
+
+  EXPECT_FALSE(tester.HasOrigin(origin));
+  EXPECT_FALSE(tester.HasOrigin(sub_origin));
+  EXPECT_TRUE(tester.HasOrigin(another_origin));
+}
+
+IN_PROC_BROWSER_TEST_F(BrowsingDataRemoverImplTrustTokenTest,
+                       PreserveByDomain) {
+  TrustTokensTester tester(network_context());
+
+  auto origin = url::Origin::Create(GURL("https://topframe.example"));
+  auto sub_origin = url::Origin::Create(GURL("https://sub.topframe.example"));
+  auto another_origin =
+      url::Origin::Create(GURL("https://another-topframe.example"));
+
+  tester.AddOrigin(origin);
+  tester.AddOrigin(sub_origin);
+  tester.AddOrigin(another_origin);
+  ASSERT_TRUE(tester.HasOrigin(origin));
+  ASSERT_TRUE(tester.HasOrigin(sub_origin));
+  ASSERT_TRUE(tester.HasOrigin(another_origin));
+
+  // Delete all data *except* that specified by the filter.
+  std::unique_ptr<BrowsingDataFilterBuilder> builder(
+      BrowsingDataFilterBuilder::Create(BrowsingDataFilterBuilder::BLACKLIST));
+  builder->AddRegisterableDomain("topframe.example");
+  RemoveWithFilterAndWait(BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS,
+                          std::move(builder));
+
+  EXPECT_TRUE(tester.HasOrigin(origin));
+  EXPECT_TRUE(tester.HasOrigin(sub_origin));
+  EXPECT_FALSE(tester.HasOrigin(another_origin));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc b/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
index 34e2c8e62ed..8000ba6f877 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
@@ -19,7 +19,6 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
@@ -28,6 +27,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/cancelable_task_tracker.h"
 #include "base/task/post_task.h"
+#include "base/test/gmock_callback_support.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "content/public/browser/browser_context.h"
@@ -55,6 +55,7 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/cookie_manager.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/test/test_network_context.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -72,6 +73,7 @@
 #include "net/reporting/reporting_test_util.h"
 #endif  // BUILDFLAG(ENABLE_REPORTING)
 
+using base::test::RunOnceClosure;
 using testing::_;
 using testing::ByRef;
 using testing::Eq;
@@ -84,6 +86,8 @@ using testing::MatchResultListener;
 using testing::Not;
 using testing::Return;
 using testing::SizeIs;
+using testing::StrictMock;
+using testing::Truly;
 using testing::UnorderedElementsAre;
 using testing::WithArgs;
 using CookieDeletionFilterPtr = network::mojom::CookieDeletionFilterPtr;
@@ -145,7 +149,9 @@ net::CanonicalCookie CreateCookieWithHost(const url::Origin& origin) {
 class StoragePartitionRemovalTestStoragePartition
     : public TestStoragePartition {
  public:
-  StoragePartitionRemovalTestStoragePartition() = default;
+  StoragePartitionRemovalTestStoragePartition() {
+    set_network_context(&network_context_);
+  }
   ~StoragePartitionRemovalTestStoragePartition() override = default;
 
   void ClearDataForOrigin(uint32_t remove_mask,
@@ -206,6 +212,7 @@ class StoragePartitionRemovalTestStoragePartition
 
  private:
   StoragePartitionRemovalData storage_partition_removal_data_;
+  network::TestNetworkContext network_context_;
 
   DISALLOW_COPY_AND_ASSIGN(StoragePartitionRemovalTestStoragePartition);
 };
@@ -326,9 +333,13 @@ class BrowsingDataRemoverImplTest : public testing::Test {
                                      const base::Time& delete_end,
                                      int remove_mask,
                                      bool include_protected_origins) {
+    // TODO(msramek): Consider moving |storage_partition| to the test fixture.
     StoragePartitionRemovalTestStoragePartition storage_partition;
-    network::TestNetworkContext nop_network_context;
-    storage_partition.set_network_context(&nop_network_context);
+
+    if (network_context_override_) {
+      storage_partition.set_network_context(network_context_override_);
+    }
+
     remover_->OverrideStoragePartitionForTesting(&storage_partition);
 
     int origin_type_mask = BrowsingDataRemover::ORIGIN_TYPE_UNPROTECTED_WEB;
@@ -351,6 +362,11 @@ class BrowsingDataRemoverImplTest : public testing::Test {
       int remove_mask,
       std::unique_ptr<BrowsingDataFilterBuilder> filter_builder) {
     StoragePartitionRemovalTestStoragePartition storage_partition;
+
+    if (network_context_override_) {
+      storage_partition.set_network_context(network_context_override_);
+    }
+
     remover_->OverrideStoragePartitionForTesting(&storage_partition);
 
     BrowsingDataRemoverCompletionObserver completion_observer(remover_);
@@ -392,6 +408,10 @@ class BrowsingDataRemoverImplTest : public testing::Test {
     return mock_policy_.get();
   }
 
+  void set_network_context_override(network::mojom::NetworkContext* context) {
+    network_context_override_ = context;
+  }
+
   bool Match(const GURL& origin,
              int mask,
              storage::SpecialStoragePolicy* policy) {
@@ -406,6 +426,8 @@ class BrowsingDataRemoverImplTest : public testing::Test {
   BrowserTaskEnvironment task_environment_;
   std::unique_ptr<BrowserContext> browser_context_;
 
+  network::mojom::NetworkContext* network_context_override_ = nullptr;
+
   StoragePartitionRemovalData storage_partition_removal_data_;
 
   scoped_refptr<storage::MockSpecialStoragePolicy> mock_policy_;
@@ -1230,8 +1252,7 @@ TEST_F(BrowsingDataRemoverImplTest, RemoveDownloadsByOrigin) {
   std::unique_ptr<BrowsingDataFilterBuilder> builder(
       BrowsingDataFilterBuilder::Create(BrowsingDataFilterBuilder::WHITELIST));
   builder->AddRegisterableDomain("host1.com");
-  base::RepeatingCallback<bool(const GURL&)> filter =
-      builder->BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter = builder->BuildUrlFilter();
 
   EXPECT_CALL(*tester.download_manager(),
               RemoveDownloadsByURLAndTime(ProbablySameFilter(filter), _, _));
@@ -1258,6 +1279,15 @@ TEST_F(BrowsingDataRemoverImplTest, RemoveShaderCache) {
             StoragePartition::REMOVE_DATA_MASK_SHADER_CACHE);
 }
 
+TEST_F(BrowsingDataRemoverImplTest, RemoveConversions) {
+  BlockUntilBrowsingDataRemoved(base::Time(), base::Time::Max(),
+                                BrowsingDataRemover::DATA_TYPE_CONVERSIONS,
+                                false);
+  StoragePartitionRemovalData removal_data = GetStoragePartitionRemovalData();
+  EXPECT_EQ(removal_data.remove_mask,
+            StoragePartition::REMOVE_DATA_MASK_CONVERSIONS);
+}
+
 class MultipleTasksObserver {
  public:
   // A simple implementation of BrowsingDataRemover::Observer.
@@ -1479,4 +1509,91 @@ TEST_F(BrowsingDataRemoverImplTest, MultipleTasksInQuickSuccession) {
   EXPECT_FALSE(remover->IsRemovingForTesting());
 }
 
+namespace {
+class MockNetworkContext : public network::TestNetworkContext {
+ public:
+  MOCK_METHOD2(
+      ClearTrustTokenData,
+      void(network::mojom::ClearDataFilterPtr,
+           network::mojom::NetworkContext::ClearTrustTokenDataCallback));
+};
+}  // namespace
+
+TEST_F(BrowsingDataRemoverImplTest, ClearsTrustTokens) {
+  MockNetworkContext context;
+  set_network_context_override(&context);
+
+  EXPECT_CALL(context, ClearTrustTokenData(_, _)).WillOnce(RunOnceClosure<1>());
+
+  BlockUntilBrowsingDataRemoved(base::Time(), base::Time::Max(),
+                                BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS,
+                                /*include_protected_origins=*/false);
+}
+
+TEST_F(BrowsingDataRemoverImplTest, PreservesTrustTokens) {
+  StrictMock<MockNetworkContext> context;
+  set_network_context_override(&context);
+
+  // When DATA_TYPE_TRUST_TOKENS isn't cleared, Trust Tokens state shouldn't be.
+  BlockUntilBrowsingDataRemoved(
+      base::Time(), base::Time::Max(),
+      BrowsingDataRemover::DATA_TYPE_CACHE,  // arbitrary non-Trust Tokens type
+      /*include_protected_origins=*/false);
+
+  // (The strict mock will fail the test if its mocked method is called.)
+}
+
+TEST_F(BrowsingDataRemoverImplTest, ClearsTrustTokensForSite) {
+  MockNetworkContext context;
+  set_network_context_override(&context);
+
+  auto expected = network::mojom::ClearDataFilter::New();
+  expected->domains = {"host1.com"};
+
+  EXPECT_CALL(
+      context,
+      ClearTrustTokenData(
+          Truly([&expected](const network::mojom::ClearDataFilterPtr& filter) {
+            return mojo::Equals(filter, expected);
+          }),
+          _))
+      .WillOnce(RunOnceClosure<1>());
+
+  std::unique_ptr<BrowsingDataFilterBuilder> builder(
+      BrowsingDataFilterBuilder::Create(BrowsingDataFilterBuilder::WHITELIST));
+  builder->AddRegisterableDomain("host1.com");
+
+  BlockUntilOriginDataRemoved(base::Time(), base::Time::Max(),
+                              BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS,
+                              std::move(builder));
+}
+
+TEST_F(BrowsingDataRemoverImplTest, ClearsTrustTokensForSiteDespiteTimeRange) {
+  MockNetworkContext context;
+  set_network_context_override(&context);
+
+  auto expected = network::mojom::ClearDataFilter::New();
+  expected->domains = {"host1.com"};
+
+  EXPECT_CALL(
+      context,
+      ClearTrustTokenData(
+          Truly([&expected](const network::mojom::ClearDataFilterPtr& filter) {
+            return mojo::Equals(filter, expected);
+          }),
+          _))
+      .WillOnce(RunOnceClosure<1>());
+
+  std::unique_ptr<BrowsingDataFilterBuilder> builder(
+      BrowsingDataFilterBuilder::Create(BrowsingDataFilterBuilder::WHITELIST));
+  builder->AddRegisterableDomain("host1.com");
+
+  // Since Trust Tokens data is not associated with particular timestamps, we
+  // should observe the same clearing behavior with a non-default time range as
+  // with the default time range.
+  BlockUntilOriginDataRemoved(
+      base::Time(), base::Time() + base::TimeDelta::FromSeconds(1),
+      BrowsingDataRemover::DATA_TYPE_TRUST_TOKENS, std::move(builder));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/browsing_data/browsing_data_test_utils.cc b/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
index c4e6d79215c..126b590ee69 100644
--- a/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
@@ -12,6 +12,7 @@
 #include "base/test/bind_test_util.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "net/cookies/cookie_util.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -37,13 +38,14 @@ void CreateCookieForTest(
   net::CookieOptions options;
   options.set_same_site_cookie_context(cookie_context);
   bool result_out;
+  net::CanonicalCookie cookie(cookie_name, "1", cookie_domain, "/",
+                              base::Time(), base::Time(), base::Time(),
+                              is_cookie_secure, false, same_site,
+                              net::COOKIE_PRIORITY_LOW);
   GetCookieManager(browser_context)
       ->SetCanonicalCookie(
-          net::CanonicalCookie(cookie_name, "1", cookie_domain, "/",
-                               base::Time(), base::Time(), base::Time(),
-                               is_cookie_secure, false, same_site,
-                               net::COOKIE_PRIORITY_LOW),
-          "https", options,
+          cookie, net::cookie_util::SimulatedCookieSource(cookie, "https"),
+          options,
           base::BindLambdaForTesting([&](CookieInclusionStatus result) {
             result_out = result.IsInclude();
             run_loop.Quit();
diff --git a/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc b/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
index 81af7d6e157..ad2efae6b47 100644
--- a/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
+++ b/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
@@ -29,6 +29,7 @@
 #include "content/public/browser/storage_usage_info.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/network_service_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/mock_browsing_data_remover_delegate.h"
@@ -43,7 +44,6 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "storage/browser/quota/quota_settings.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/common/features.h"
@@ -176,7 +176,7 @@ class ClearSiteDataHandlerBrowserTest : public ContentBrowserTest {
 
     base::RunLoop run_loop;
     cookie_manager->SetCanonicalCookie(
-        *cookie, url.scheme(), net::CookieOptions::MakeAllInclusive(),
+        *cookie, url, net::CookieOptions::MakeAllInclusive(),
         base::BindOnce(&ClearSiteDataHandlerBrowserTest::AddCookieCallback,
                        run_loop.QuitClosure()));
     run_loop.Run();
@@ -189,9 +189,9 @@ class ClearSiteDataHandlerBrowserTest : public ContentBrowserTest {
         storage_partition()->GetCookieManagerForBrowserProcess();
     base::RunLoop run_loop;
     net::CookieList cookie_list;
-    cookie_manager->GetAllCookies(base::BindRepeating(
-        &ClearSiteDataHandlerBrowserTest::GetCookiesCallback,
-        run_loop.QuitClosure(), base::Unretained(&cookie_list)));
+    cookie_manager->GetAllCookies(
+        base::BindOnce(&ClearSiteDataHandlerBrowserTest::GetCookiesCallback,
+                       run_loop.QuitClosure(), base::Unretained(&cookie_list)));
     run_loop.Run();
     return cookie_list;
   }
diff --git a/chromium/content/browser/browsing_data/clear_site_data_utils.cc b/chromium/content/browser/browsing_data/clear_site_data_utils.cc
index e69e2162f74..c17c186608f 100644
--- a/chromium/content/browser/browsing_data/clear_site_data_utils.cc
+++ b/chromium/content/browser/browsing_data/clear_site_data_utils.cc
@@ -63,7 +63,7 @@ class SiteDataClearer : public BrowsingDataRemover::Observer {
     // TODO(msramek): What about plugin data?
     if (clear_cookies_) {
       std::string domain = GetDomainAndRegistry(
-          origin_.host(),
+          origin_,
           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
 
       if (domain.empty())
diff --git a/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc b/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
index 7cad567d627..a1b501f0602 100644
--- a/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
+++ b/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc b/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
index b19bed0a287..29b194ea574 100644
--- a/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
+++ b/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/storage_usage_info.h"
 #include "content/public/common/network_service_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "net/dns/mock_host_resolver.h"
diff --git a/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc b/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
index c3e0e348e8f..f7b45327720 100644
--- a/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
@@ -18,6 +18,7 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_storage_partition.h"
 #include "net/cookies/cookie_monster.h"
+#include "net/cookies/cookie_util.h"
 #include "net/url_request/url_request_context.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
@@ -216,12 +217,13 @@ TEST_F(SameSiteDataRemoverImplTest, TestCookieRemovalUnaffectedByParameters) {
   net::CookieOptions options;
   options.set_include_httponly();
   bool result_out = false;
+  net::CanonicalCookie cookie1("TestCookie1", "20", "google.com", "/",
+                               base::Time::Now(), base::Time(), base::Time(),
+                               true, true, net::CookieSameSite::NO_RESTRICTION,
+                               net::COOKIE_PRIORITY_HIGH);
   cookie_manager->SetCanonicalCookie(
-      net::CanonicalCookie("TestCookie1", "20", "google.com", "/",
-                           base::Time::Now(), base::Time(), base::Time(), true,
-                           true, net::CookieSameSite::NO_RESTRICTION,
-                           net::COOKIE_PRIORITY_HIGH),
-      "https", options,
+      cookie1, net::cookie_util::SimulatedCookieSource(cookie1, "https"),
+      options,
       base::BindLambdaForTesting(
           [&](net::CanonicalCookie::CookieInclusionStatus result) {
             result_out = result.IsInclude();
@@ -236,12 +238,13 @@ TEST_F(SameSiteDataRemoverImplTest, TestCookieRemovalUnaffectedByParameters) {
           net::CookieOptions::SameSiteCookieContext::ContextType::
               SAME_SITE_LAX));
   result_out = false;
+  net::CanonicalCookie cookie2("TestCookie2", "10", "gmail.google.com", "/",
+                               base::Time(), base::Time::Max(), base::Time(),
+                               false, true, net::CookieSameSite::LAX_MODE,
+                               net::COOKIE_PRIORITY_HIGH);
   cookie_manager->SetCanonicalCookie(
-      net::CanonicalCookie("TestCookie2", "10", "gmail.google.com", "/",
-                           base::Time(), base::Time::Max(), base::Time(), false,
-                           true, net::CookieSameSite::LAX_MODE,
-                           net::COOKIE_PRIORITY_HIGH),
-      "https", options,
+      cookie2, net::cookie_util::SimulatedCookieSource(cookie2, "https"),
+      options,
       base::BindLambdaForTesting(
           [&](net::CanonicalCookie::CookieInclusionStatus result) {
             result_out = result.IsInclude();
diff --git a/chromium/content/browser/browsing_instance.cc b/chromium/content/browser/browsing_instance.cc
index f49ec7e1456..8da8fc97f14 100644
--- a/chromium/content/browser/browsing_instance.cc
+++ b/chromium/content/browser/browsing_instance.cc
@@ -4,8 +4,8 @@
 
 #include "content/browser/browsing_instance.h"
 
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/public/browser/browser_context.h"
diff --git a/chromium/content/browser/browsing_instance.h b/chromium/content/browser/browsing_instance.h
index 906a1ee4ac5..06f0961e122 100644
--- a/chromium/content/browser/browsing_instance.h
+++ b/chromium/content/browser/browsing_instance.h
@@ -202,7 +202,7 @@ class CONTENT_EXPORT BrowsingInstance final
   // contain every active SiteInstance, because a race exists where two
   // SiteInstances can be assigned to the same site.  This is ok in rare cases.
   // It also does not contain SiteInstances which have not yet been assigned a
-  // site, such as about:blank.  See NavigatorImpl::ShouldAssignSiteForURL.
+  // site, such as about:blank.  See SiteInstance::ShouldAssignSiteForURL.
   // This map only contains instances that map to a single site. The
   // |default_site_instance_|, which associates multiple sites with a single
   // instance, is not contained in this map.
diff --git a/chromium/content/browser/cache_storage/cache_storage.h b/chromium/content/browser/cache_storage/cache_storage.h
index 07eccad6ab7..88382d09383 100644
--- a/chromium/content/browser/cache_storage/cache_storage.h
+++ b/chromium/content/browser/cache_storage/cache_storage.h
@@ -47,6 +47,9 @@ class CONTENT_EXPORT CacheStorage {
   virtual void AddHandleRef() = 0;
   virtual void DropHandleRef() = 0;
 
+  // Explicitly begin initialization if it has not already been triggered.
+  virtual void Init() = 0;
+
   // Get the cache for the given key. If the cache is not found it is
   // created. The CacheStorgeCacheHandle in the callback prolongs the lifetime
   // of the cache. Once all handles to a cache are deleted the cache is deleted.
diff --git a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
index bde0c76d54c..0c34c8b1e29 100644
--- a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
@@ -8,13 +8,12 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "net/base/io_buffer.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
-#include "storage/common/storage_histograms.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 #include "url/origin.h"
 
@@ -102,8 +101,6 @@ void CacheStorageBlobToDiskCache::DidWriteDataToEntry(int expected_bytes,
     RunCallback(false /* success */);
     return;
   }
-  if (rv > 0)
-    storage::RecordBytesWritten("DiskCache.CacheStorage", rv);
   cache_entry_offset_ += rv;
 
   ReadFromBlob();
diff --git a/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
index f94877a0929..3a346bd50cd 100644
--- a/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
@@ -15,10 +15,10 @@
 #include "base/callback_helpers.h"
 #include "base/files/file_path.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/run_loop.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
@@ -676,7 +676,7 @@ class CacheStorageCacheTest : public testing::Test {
         std::vector<std::string>() /* cors_exposed_header_names */,
         nullptr /* side_data_blob */,
         nullptr /* side_data_blob_for_cache_put */,
-        std::vector<network::mojom::ContentSecurityPolicyPtr>(),
+        network::mojom::ParsedHeaders::New(),
         false /* loaded_with_credentials */);
   }
 
@@ -2260,7 +2260,7 @@ TEST_F(CacheStorageCacheTest, VerifyOpaqueSizePadding) {
   EXPECT_NE(opaque_padding, current_padding);
 
   // Now reset opaque side data back to zero.
-  const std::string expected_side_data2 = "";
+  const std::string expected_side_data2;
   scoped_refptr<net::IOBuffer> buffer2 =
       base::MakeRefCounted<net::StringIOBuffer>(expected_side_data2);
   EXPECT_TRUE(WriteSideData(opaque_request->url, response_time, buffer2,
diff --git a/chromium/content/browser/cache_storage/cache_storage_context_impl.cc b/chromium/content/browser/cache_storage/cache_storage_context_impl.cc
index 50c1070934b..599832e97f3 100644
--- a/chromium/content/browser/cache_storage/cache_storage_context_impl.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_context_impl.cc
@@ -257,8 +257,7 @@ void CacheStorageContextImpl::ShutdownOnTaskRunner() {
       special_storage_policy_->HasSessionOnlyOrigins()) {
     cache_manager_->GetAllOriginsUsage(
         CacheStorageOwner::kCacheAPI,
-        // TODO(jsbell): Make this BindOnce.
-        base::BindRepeating(
+        base::BindOnce(
             [](scoped_refptr<CacheStorageManager> cache_manager,
                scoped_refptr<storage::SpecialStoragePolicy>
                    special_storage_policy,
diff --git a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
index bf36f539ca2..73ee5b6d279 100644
--- a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
@@ -503,6 +503,7 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
   CacheStorageImpl(
       CacheStorageDispatcherHost* owner,
       const url::Origin& origin,
+      bool incognito,
       const CrossOriginEmbedderPolicy& cross_origin_embedder_policy,
       mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
           coep_reporter)
@@ -510,9 +511,18 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
         origin_(origin),
         cross_origin_embedder_policy_(cross_origin_embedder_policy),
         coep_reporter_(std::move(coep_reporter)) {
-    // The CacheStorageHandle is empty to start and lazy initialized on first
-    // use via GetOrCreateCacheStorage().  In the future we could eagerly create
-    // the backend when the mojo connection is created.
+    // Eagerly initialize the backend when the mojo connection is bound.
+    //
+    // Note, we only do this for non-incognito mode.  The memory cache mode
+    // will incorrectly report cache file usage and break tests if we eagerly
+    // initialize it here.  Also, eagerly initializing memory cache mode does
+    // not really provide any performance benefit.
+    if (!incognito) {
+      content::CacheStorage* cache_storage = GetOrCreateCacheStorage();
+      if (cache_storage) {
+        cache_storage->Init();
+      }
+    }
   }
 
   ~CacheStorageImpl() override {
@@ -844,8 +854,10 @@ void CacheStorageDispatcherHost::AddReceiver(
     const url::Origin& origin,
     mojo::PendingReceiver<blink::mojom::CacheStorage> receiver) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  auto impl = std::make_unique<CacheStorageImpl>(
-      this, origin, cross_origin_embedder_policy, std::move(coep_reporter));
+  bool incognito = context_ ? context_->is_incognito() : false;
+  auto impl = std::make_unique<CacheStorageImpl>(this, origin, incognito,
+                                                 cross_origin_embedder_policy,
+                                                 std::move(coep_reporter));
   receivers_.Add(std::move(impl), std::move(receiver));
 }
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
index 485b989f988..fb58ce9c866 100644
--- a/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
@@ -668,7 +668,7 @@ class CacheStorageManagerTest : public testing::Test {
         std::vector<std::string>() /* cors_exposed_header_names */,
         nullptr /* side_data_blob */,
         nullptr /* side_data_blob_for_cache_put */,
-        std::vector<network::mojom::ContentSecurityPolicyPtr>(),
+        network::mojom::ParsedHeaders::New(),
         false /* loaded_with_credentials */);
 
     blink::mojom::BatchOperationPtr operation =
@@ -1424,7 +1424,7 @@ TEST_F(CacheStorageManagerTest, TestErrorInitializingCache) {
 
   // Truncate the SimpleCache index to force an error when next opened.
   ASSERT_FALSE(index_path.empty());
-  ASSERT_EQ(5, base::WriteFile(index_path, "hello", 5));
+  ASSERT_TRUE(base::WriteFile(index_path, "hello"));
 
   // The cache_storage index and simple disk_cache index files are written from
   // background threads.  They may be written in unexpected orders due to timing
@@ -1481,12 +1481,8 @@ TEST_F(CacheStorageManagerTest, DISABLED_PutResponseWithExistingFileTest) {
 
   // Create a fake, empty file where the entry previously existed.
   const std::string kFakeData("foobar");
-  EXPECT_EQ(
-      base::WriteFile(entry_file_name, kFakeData.data(), kFakeData.size()),
-      static_cast<int>(kFakeData.size()));
-  EXPECT_EQ(
-      base::WriteFile(stream_2_file_name, kFakeData.data(), kFakeData.size()),
-      static_cast<int>(kFakeData.size()));
+  EXPECT_TRUE(base::WriteFile(entry_file_name, kFakeData));
+  EXPECT_TRUE(base::WriteFile(stream_2_file_name, kFakeData));
 
   // Re-open the cache.
   CreateStorageManager();
@@ -2530,7 +2526,8 @@ class CacheStorageQuotaClientTestP : public CacheStorageQuotaClientTest,
 };
 
 TEST_P(CacheStorageQuotaClientTestP, QuotaID) {
-  EXPECT_EQ(storage::QuotaClient::kServiceWorkerCache, quota_client_->id());
+  EXPECT_EQ(storage::QuotaClientType::kServiceWorkerCache,
+            quota_client_->type());
 }
 
 TEST_P(CacheStorageQuotaClientTestP, QuotaGetOriginUsage) {
diff --git a/chromium/content/browser/cache_storage/cache_storage_quota_client.cc b/chromium/content/browser/cache_storage/cache_storage_quota_client.cc
index 8796d410c05..2f87d3c0000 100644
--- a/chromium/content/browser/cache_storage/cache_storage_quota_client.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_quota_client.cc
@@ -6,6 +6,7 @@
 
 #include "content/browser/cache_storage/cache_storage_manager.h"
 #include "content/public/browser/browser_thread.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 #include "url/origin.h"
 
@@ -18,9 +19,9 @@ CacheStorageQuotaClient::CacheStorageQuotaClient(
 
 CacheStorageQuotaClient::~CacheStorageQuotaClient() = default;
 
-storage::QuotaClient::ID CacheStorageQuotaClient::id() const {
+storage::QuotaClientType CacheStorageQuotaClient::type() const {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  return GetIDFromOwner(owner_);
+  return GetClientTypeFromOwner(owner_);
 }
 
 void CacheStorageQuotaClient::OnQuotaManagerDestroyed() {}
@@ -90,13 +91,13 @@ bool CacheStorageQuotaClient::DoesSupport(
 }
 
 // static
-storage::QuotaClient::ID CacheStorageQuotaClient::GetIDFromOwner(
+storage::QuotaClientType CacheStorageQuotaClient::GetClientTypeFromOwner(
     CacheStorageOwner owner) {
   switch (owner) {
     case CacheStorageOwner::kCacheAPI:
-      return kServiceWorkerCache;
+      return storage::QuotaClientType::kServiceWorkerCache;
     case CacheStorageOwner::kBackgroundFetch:
-      return kBackgroundFetch;
+      return storage::QuotaClientType::kBackgroundFetch;
   }
 }
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_quota_client.h b/chromium/content/browser/cache_storage/cache_storage_quota_client.h
index c5de6a518a0..7719a617e66 100644
--- a/chromium/content/browser/cache_storage/cache_storage_quota_client.h
+++ b/chromium/content/browser/cache_storage/cache_storage_quota_client.h
@@ -9,6 +9,7 @@
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "storage/browser/quota/quota_client.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 #include "url/origin.h"
 
@@ -26,7 +27,7 @@ class CONTENT_EXPORT CacheStorageQuotaClient : public storage::QuotaClient {
                           CacheStorageOwner owner);
 
   // QuotaClient.
-  ID id() const override;
+  storage::QuotaClientType type() const override;
   void OnQuotaManagerDestroyed() override;
   void GetOriginUsage(const url::Origin& origin,
                       blink::mojom::StorageType type,
@@ -43,7 +44,8 @@ class CONTENT_EXPORT CacheStorageQuotaClient : public storage::QuotaClient {
                              base::OnceClosure callback) override;
   bool DoesSupport(blink::mojom::StorageType type) const override;
 
-  static ID GetIDFromOwner(CacheStorageOwner owner);
+  static storage::QuotaClientType GetClientTypeFromOwner(
+      CacheStorageOwner owner);
 
  private:
   ~CacheStorageQuotaClient() override;
diff --git a/chromium/content/browser/cache_storage/cache_storage_scheduler.cc b/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
index 64dbc0d0acb..f156950ce61 100644
--- a/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
@@ -7,9 +7,9 @@
 #include <string>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/feature_list.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
index 1b70bd639e0..bb5e5f07d75 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
@@ -30,6 +30,12 @@ class CrossSequenceCacheStorage::Inner {
       handle_ = manager->OpenCacheStorage(origin, owner);
   }
 
+  void Init() {
+    if (!handle_.value())
+      return;
+    handle_.value()->Init();
+  }
+
   void OpenCache(scoped_refptr<CrossSequenceCacheStorageCache> cache_wrapper,
                  const std::string& cache_name,
                  int64_t trace_id,
@@ -182,6 +188,11 @@ void CrossSequenceCacheStorage::DropHandleRef() {
     self_ref_.reset();
 }
 
+void CrossSequenceCacheStorage::Init() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  inner_.Post(FROM_HERE, &Inner::Init);
+}
+
 void CrossSequenceCacheStorage::OpenCache(const std::string& cache_name,
                                           int64_t trace_id,
                                           CacheAndErrorCallback callback) {
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
index 101fd2cc93c..d4a8a412dcf 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
@@ -37,6 +37,7 @@ class CrossSequenceCacheStorage
   CacheStorageHandle CreateHandle() override;
   void AddHandleRef() override;
   void DropHandleRef() override;
+  void Init() override;
   void OpenCache(const std::string& cache_name,
                  int64_t trace_id,
                  CacheAndErrorCallback callback) override;
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
index 0abdf04f5fa..34097e5bc34 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
@@ -627,6 +627,11 @@ void LegacyCacheStorage::DropHandleRef() {
   }
 }
 
+void LegacyCacheStorage::Init() {
+  if (!initialized_)
+    LazyInit();
+}
+
 void LegacyCacheStorage::OpenCache(const std::string& cache_name,
                                    int64_t trace_id,
                                    CacheAndErrorCallback callback) {
@@ -1159,7 +1164,7 @@ void LegacyCacheStorage::DeleteCacheDidGetSize(
     LegacyCacheStorageCache* doomed_cache,
     int64_t cache_size) {
   quota_manager_proxy_->NotifyStorageModified(
-      CacheStorageQuotaClient::GetIDFromOwner(owner_), origin_,
+      CacheStorageQuotaClient::GetClientTypeFromOwner(owner_), origin_,
       StorageType::kTemporary, -1 * cache_size);
 
   cache_loader_->CleanUpDeletedCache(doomed_cache);
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
index a99de997b43..47b191efc47 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
@@ -82,6 +82,8 @@ class CONTENT_EXPORT LegacyCacheStorage : public CacheStorage,
     DCHECK(!handle_ref_count_);
   }
 
+  void Init() override;
+
   void OpenCache(const std::string& cache_name,
                  int64_t trace_id,
                  CacheAndErrorCallback callback) override;
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
index fe1ac2e9176..55296adaa7c 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
@@ -58,7 +58,6 @@
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/quota/padding_key.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
-#include "storage/common/storage_histograms.h"
 #include "third_party/blink/public/common/cache_storage/cache_storage_utils.h"
 #include "third_party/blink/public/common/fetch/fetch_api_request_headers_map.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
@@ -75,8 +74,6 @@ using ResponseHeaderMap = base::flat_map<std::string, std::string>;
 const size_t kMaxQueryCacheResultBytes =
     1024 * 1024 * 10;  // 10MB query cache limit
 
-const char kRecordBytesLabel[] = "DiskCache.CacheStorage";
-
 // If the way that a cache's padding is calculated changes increment this
 // version.
 //
@@ -292,9 +289,6 @@ void ReadMetadataDidReadMetadata(disk_cache::Entry* entry,
     return;
   }
 
-  if (rv > 0)
-    storage::RecordBytesRead(kRecordBytesLabel, rv);
-
   std::unique_ptr<proto::CacheMetadata> metadata(new proto::CacheMetadata());
 
   if (!metadata->ParseFromArray(buffer->data(), buffer->size())) {
@@ -357,7 +351,7 @@ blink::mojom::FetchAPIResponsePtr CreateResponse(
           metadata.response().cors_exposed_header_names().begin(),
           metadata.response().cors_exposed_header_names().end()),
       nullptr /* side_data_blob */, nullptr /* side_data_blob_for_cache_put */,
-      std::vector<network::mojom::ContentSecurityPolicyPtr>(),
+      network::mojom::ParsedHeaders::New(),
       metadata.response().loaded_with_credentials());
 }
 
@@ -1520,9 +1514,6 @@ void LegacyCacheStorageCache::WriteSideDataDidWrite(
     return;
   }
 
-  if (rv > 0)
-    storage::RecordBytesWritten(kRecordBytesLabel, rv);
-
   if (ShouldPadResourceSize(response.get())) {
     cache_padding_ -= CalculateResponsePaddingInternal(
         response.get(), cache_padding_key_.get(), side_data_size_before_write);
@@ -1775,8 +1766,6 @@ void LegacyCacheStorageCache::PutDidWriteHeaders(
     return;
   }
 
-  if (rv > 0)
-    storage::RecordBytesWritten(kRecordBytesLabel, rv);
   if (ShouldPadResourceSize(*put_context->response)) {
     cache_padding_ += CalculateResponsePadding(*put_context->response,
                                                cache_padding_key_.get(),
@@ -2008,7 +1997,7 @@ void LegacyCacheStorageCache::UpdateCacheSizeGotSize(
   last_reported_size_ = PaddedCacheSize();
 
   quota_manager_proxy_->NotifyStorageModified(
-      CacheStorageQuotaClient::GetIDFromOwner(owner_), origin_,
+      CacheStorageQuotaClient::GetClientTypeFromOwner(owner_), origin_,
       blink::mojom::StorageType::kTemporary, size_delta);
 
   if (cache_storage_)
@@ -2377,8 +2366,6 @@ void LegacyCacheStorageCache::InitGotCacheSize(
     DLOG_IF(ERROR, cache_size_ != cache_size)
         << "Cache size: " << cache_size
         << " does not match size from index: " << cache_size_;
-    UMA_HISTOGRAM_COUNTS_10M("ServiceWorkerCache.IndexSizeDifference",
-                             std::abs(cache_size_ - cache_size));
     if (cache_size_ != cache_size) {
       // We assume that if the sizes match then then cached padding is still
       // correct. If not then we recalculate the padding.
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
index 643c919386c..745cfd72471 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
@@ -60,24 +60,14 @@ void DeleteOriginDidDeleteDir(storage::QuotaClient::DeletionCallback callback,
 // Calculate the sum of all cache sizes in this store, but only if all sizes are
 // known. If one or more sizes are not known then return kSizeUnknown.
 int64_t GetCacheStorageSize(const base::FilePath& base_path,
-                            const base::Time& base_path_time,
                             const base::Time& index_time,
                             const proto::CacheStorageIndex& index) {
-  // If the base path's modified time is newer than the index, then the
-  // contents of a cache must have changed.  The index is stale.
-  if (base_path_time > index_time)
-    return CacheStorage::kSizeUnknown;
-
-  // It should be impossible for the directory containing the index to
-  // have a modified time older than the index's modified time.  Modifying
-  // the index should update the directories time as well.  Therefore we
-  // should be guaranteed that the time is equal here.
-  //
-  // In practice, though, there can be a few microseconds difference on
-  // some operating systems so we can't do an exact DCHECK here.  Instead
-  // we do a fuzzy DCHECK allowing some microseconds difference.
-  DCHECK_LE((index_time - base_path_time).magnitude().InMicroseconds(), 10);
-
+  // Note, do not use the base path time modified to invalidate the index file.
+  // On some platforms the directory modified time will be slightly later than
+  // the last modified time of a file within it.  This means any write to the
+  // index file will also update the directory modify time slightly after
+  // immediately invalidating it.  To avoid this we only look at the cache
+  // directories and not the base directory containing the index itself.
   int64_t storage_size = 0;
   for (int i = 0, max = index.cache_size(); i < max; ++i) {
     const proto::CacheStorageIndex::Cache& cache = index.cache(i);
@@ -186,13 +176,8 @@ void ListOriginsAndLastModifiedOnTaskRunner(
       continue;
     }
 
-    if (!base::GetFileInfo(path, &file_info)) {
-      RecordIndexValidationResult(IndexResult::kPathFileInfoFailed);
-      continue;
-    }
-
-    int64_t storage_size = GetCacheStorageSize(path, file_info.last_modified,
-                                               index_last_modified, index);
+    int64_t storage_size =
+        GetCacheStorageSize(path, index_last_modified, index);
     base::UmaHistogramBoolean("ServiceWorkerCache.UsedIndexFileSize",
                               storage_size != CacheStorage::kSizeUnknown);
 
@@ -512,7 +497,7 @@ void LegacyCacheStorageManager::DeleteOriginDidClose(
   cache_storage.reset();
 
   quota_manager_proxy_->NotifyStorageModified(
-      CacheStorageQuotaClient::GetIDFromOwner(owner), origin,
+      CacheStorageQuotaClient::GetClientTypeFromOwner(owner), origin,
       blink::mojom::StorageType::kTemporary, -1 * origin_size);
 
   if (owner == CacheStorageOwner::kCacheAPI)
diff --git a/chromium/content/browser/child_process_launcher.cc b/chromium/content/browser/child_process_launcher.cc
index 57d627be779..2a99bb00a7f 100644
--- a/chromium/content/browser/child_process_launcher.cc
+++ b/chromium/content/browser/child_process_launcher.cc
@@ -7,11 +7,11 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/clang_profiling_buildflags.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/i18n/icu_util.h"
-#include "base/logging.h"
 #include "base/process/launch.h"
 #include "build/build_config.h"
 #include "content/public/browser/child_process_launcher_utils.h"
@@ -40,7 +40,6 @@ ChildProcessLauncher::ChildProcessLauncher(
     bool terminate_on_shutdown)
     : client_(client),
       starting_(true),
-      start_time_(base::TimeTicks::Now()),
 #if defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) ||  \
     defined(MEMORY_SANITIZER) || defined(THREAD_SANITIZER) || \
     defined(UNDEFINED_SANITIZER) || BUILDFLAG(CLANG_PROFILING)
@@ -118,19 +117,14 @@ ChildProcessTerminationInfo ChildProcessLauncher::GetChildTerminationInfo(
   if (!process_.process.IsValid()) {
     // Make sure to avoid using the default termination status if the process
     // hasn't even started yet.
-    if (IsStarting()) {
+    if (IsStarting())
       termination_info_.status = base::TERMINATION_STATUS_STILL_RUNNING;
-      termination_info_.uptime = base::TimeTicks::Now() - start_time_;
-      DCHECK_LE(base::TimeDelta::FromSeconds(0), termination_info_.uptime);
-    }
 
     // Process doesn't exist, so return the cached termination info.
     return termination_info_;
   }
 
   termination_info_ = helper_->GetTerminationInfo(process_, known_dead);
-  termination_info_.uptime = base::TimeTicks::Now() - start_time_;
-  DCHECK_LE(base::TimeDelta::FromSeconds(0), termination_info_.uptime);
 
   // POSIX: If the process crashed, then the kernel closed the socket for it and
   // so the child has already died by the time we get here. Since
diff --git a/chromium/content/browser/child_process_launcher.h b/chromium/content/browser/child_process_launcher.h
index 05364ef4eac..03b58119f6a 100644
--- a/chromium/content/browser/child_process_launcher.h
+++ b/chromium/content/browser/child_process_launcher.h
@@ -14,7 +14,6 @@
 #include "base/process/kill.h"
 #include "base/process/process.h"
 #include "base/sequence_checker.h"
-#include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/browser/child_process_launcher_helper.h"
 #include "content/common/content_export.h"
@@ -235,7 +234,6 @@ class CONTENT_EXPORT ChildProcessLauncher {
 
   ChildProcessTerminationInfo termination_info_;
   bool starting_;
-  base::TimeTicks start_time_;
 
   // Controls whether the child process should be terminated on browser
   // shutdown. Default behavior is to terminate the child.
diff --git a/chromium/content/browser/child_process_launcher_browsertest.cc b/chromium/content/browser/child_process_launcher_browsertest.cc
index fd50b2c3556..8008dd26d47 100644
--- a/chromium/content/browser/child_process_launcher_browsertest.cc
+++ b/chromium/content/browser/child_process_launcher_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/no_renderer_crashes_assertion.h"
@@ -70,7 +71,7 @@ IN_PROC_BROWSER_TEST_F(ChildProcessLauncherBrowserTest, ChildSpawnFail) {
   NavigationEntry* last_entry =
       shell()->web_contents()->GetController().GetLastCommittedEntry();
   // Make sure we didn't navigate.
-  CHECK(!last_entry);
+  EXPECT_FALSE(last_entry);
 
   // Navigate again and let the process spawn correctly.
   TestNavigationObserver nav_observer2(window->web_contents(), 1);
@@ -78,8 +79,9 @@ IN_PROC_BROWSER_TEST_F(ChildProcessLauncherBrowserTest, ChildSpawnFail) {
   nav_observer2.Wait();
   last_entry = shell()->web_contents()->GetController().GetLastCommittedEntry();
   // Make sure that we navigated to the proper URL.
-  CHECK(last_entry && last_entry->GetPageType() == PAGE_TYPE_NORMAL);
-  CHECK(shell()->web_contents()->GetLastCommittedURL() == url);
+  ASSERT_TRUE(last_entry);
+  EXPECT_EQ(last_entry->GetPageType(), PAGE_TYPE_NORMAL);
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(), url);
 
   // Navigate again, using the same renderer.
   url = GURL("data:text/html,dataurl");
@@ -88,8 +90,9 @@ IN_PROC_BROWSER_TEST_F(ChildProcessLauncherBrowserTest, ChildSpawnFail) {
   nav_observer3.Wait();
   last_entry = shell()->web_contents()->GetController().GetLastCommittedEntry();
   // Make sure that we navigated to the proper URL.
-  CHECK(last_entry && last_entry->GetPageType() == PAGE_TYPE_NORMAL);
-  CHECK(shell()->web_contents()->GetLastCommittedURL() == url);
+  ASSERT_TRUE(last_entry);
+  EXPECT_EQ(last_entry->GetPageType(), PAGE_TYPE_NORMAL);
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(), url);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/child_process_launcher_helper.h b/chromium/content/browser/child_process_launcher_helper.h
index 791efe5344a..e47a53628cd 100644
--- a/chromium/content/browser/child_process_launcher_helper.h
+++ b/chromium/content/browser/child_process_launcher_helper.h
@@ -250,7 +250,7 @@ class ChildProcessLauncherHelper :
 #endif
 
 #if defined(OS_FUCHSIA)
-  service_manager::SandboxPolicyFuchsia sandbox_policy_;
+  std::unique_ptr<service_manager::SandboxPolicyFuchsia> sandbox_policy_;
 #endif
 };
 
diff --git a/chromium/content/browser/child_process_launcher_helper_fuchsia.cc b/chromium/content/browser/child_process_launcher_helper_fuchsia.cc
index 4909cdf3edf..3f48889670d 100644
--- a/chromium/content/browser/child_process_launcher_helper_fuchsia.cc
+++ b/chromium/content/browser/child_process_launcher_helper_fuchsia.cc
@@ -33,6 +33,8 @@ const char* ProcessNameFromSandboxType(
       return "gpu";
     case service_manager::SandboxType::kNetwork:
       return "network";
+    case service_manager::SandboxType::kVideoCapture:
+      return "video-capture";
     default:
       NOTREACHED() << "Unknown sandbox_type.";
       return nullptr;
@@ -66,7 +68,8 @@ bool ChildProcessLauncherHelper::TerminateProcess(const base::Process& process,
 void ChildProcessLauncherHelper::BeforeLaunchOnClientThread() {
   DCHECK(client_task_runner_->RunsTasksInCurrentSequence());
 
-  sandbox_policy_.Initialize(delegate_->GetSandboxType());
+  sandbox_policy_ = std::make_unique<service_manager::SandboxPolicyFuchsia>(
+      delegate_->GetSandboxType());
 }
 
 std::unique_ptr<FileMappedForLaunch>
@@ -82,7 +85,7 @@ bool ChildProcessLauncherHelper::BeforeLaunchOnLauncherThread(
 
   mojo_channel_->PrepareToPassRemoteEndpoint(&options->handles_to_transfer,
                                              command_line());
-  sandbox_policy_.UpdateLaunchOptionsForSandbox(options);
+  sandbox_policy_->UpdateLaunchOptionsForSandbox(options);
 
   // Set process name suffix to make it easier to identify the process.
   const char* process_type =
diff --git a/chromium/content/browser/child_process_security_policy_browsertest.cc b/chromium/content/browser/child_process_security_policy_browsertest.cc
index 93f0f9284ff..b71df65da45 100644
--- a/chromium/content/browser/child_process_security_policy_browsertest.cc
+++ b/chromium/content/browser/child_process_security_policy_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/result_codes.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/child_process_security_policy_impl.cc b/chromium/content/browser/child_process_security_policy_impl.cc
index bcd42e78801..c2b7778788b 100644
--- a/chromium/content/browser/child_process_security_policy_impl.cc
+++ b/chromium/content/browser/child_process_security_policy_impl.cc
@@ -24,6 +24,7 @@
 #include "content/browser/isolated_origin_util.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/webui/url_data_manager_backend.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_or_resource_context.h"
 #include "content/public/browser/browser_thread.h"
@@ -233,8 +234,11 @@ bool ChildProcessSecurityPolicyImpl::Handle::CanReadFileSystemFile(
 
 bool ChildProcessSecurityPolicyImpl::Handle::CanAccessDataForOrigin(
     const GURL& url) {
-  if (child_id_ == ChildProcessHost::kInvalidUniqueID)
+  if (child_id_ == ChildProcessHost::kInvalidUniqueID) {
+    LogCanAccessDataForOriginCrashKeys(
+        "(unknown)", "(unknown)", url.GetOrigin().spec(), "handle_not_valid");
     return false;
+  }
 
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   return policy->CanAccessDataForOrigin(child_id_, url);
@@ -242,8 +246,11 @@ bool ChildProcessSecurityPolicyImpl::Handle::CanAccessDataForOrigin(
 
 bool ChildProcessSecurityPolicyImpl::Handle::CanAccessDataForOrigin(
     const url::Origin& origin) {
-  if (child_id_ == ChildProcessHost::kInvalidUniqueID)
+  if (child_id_ == ChildProcessHost::kInvalidUniqueID) {
+    LogCanAccessDataForOriginCrashKeys(
+        "(unknown)", "(unknown)", origin.GetDebugString(), "handle_not_valid");
     return false;
+  }
 
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   return policy->CanAccessDataForOrigin(child_id_, origin);
@@ -1009,6 +1016,24 @@ bool ChildProcessSecurityPolicyImpl::CanRequestURL(
       return true;
   }
 
+  // If |url| has WebUI scheme, the process must usually be locked, unless
+  // running in single-process mode. Since this is a check whether the process
+  // can request |url|, the check must operate based on scheme because one WebUI
+  // should be able to request subresources from another WebUI of the same
+  // scheme.
+  const auto& webui_schemes = URLDataManagerBackend::GetWebUISchemes();
+  if (!RenderProcessHost::run_renderer_in_process() &&
+      base::Contains(webui_schemes, url.scheme())) {
+    bool should_be_locked =
+        GetContentClient()->browser()->DoesWebUISchemeRequireProcessLock(
+            url.scheme());
+    if (should_be_locked) {
+      const GURL& lock_url = GetOriginLock(child_id);
+      if (lock_url.is_empty() || !lock_url.SchemeIs(url.scheme()))
+        return false;
+    }
+  }
+
   // Also allow URLs destined for ShellExecute and not the browser itself.
   return !GetContentClient()->browser()->IsHandledURL(url);
 }
@@ -1880,7 +1905,7 @@ bool ChildProcessSecurityPolicyImpl::GetMatchingIsolatedOrigin(
   // IsolatedOrigins considers any sub-origin of an isolated origin as also
   // being isolated, with opt-in we will always either return false, or true
   // with result set to |origin|.
-  if (!found && DoesOriginRequestOptInIsolation(isolation_context, origin)) {
+  if (!found && ShouldOriginGetOptInIsolation(isolation_context, origin)) {
     *result = origin;
     found = true;
   }
@@ -1888,38 +1913,118 @@ bool ChildProcessSecurityPolicyImpl::GetMatchingIsolatedOrigin(
   return found;
 }
 
-bool ChildProcessSecurityPolicyImpl::DoesOriginRequestOptInIsolation(
+bool ChildProcessSecurityPolicyImpl::ShouldOriginGetOptInIsolation(
     const IsolationContext& isolation_context,
     const url::Origin& origin) {
-  // IsolationOptIn is only available when OriginPolicy is enabled.
+  // Note: we cannot check the feature flags and early-out here, because the
+  // origin trial might be active (in which case no feature flags are active).
+
   // We only isolate HTTPS, so early-out if we see other schemes.
-  if (!base::FeatureList::IsEnabled(features::kOriginPolicy) ||
-      !origin.GetURL().SchemeIs(url::kHttpsScheme)) {
+  if (!origin.GetURL().SchemeIs(url::kHttpsScheme))
     return false;
-  }
 
   base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
   // See if the same origin exists in the BrowsingInstance already, and if so
   // return its isolation status.
   // There are two cases we're worried about here: (i) we've previously seen the
-  // origin and isolated it, but it's no longer in the global map, in which case
-  // we should continue to isolate it, and TODO(wjmaclean): (ii) we've
-  // previously seen the origin and *not* isolated it, in which case we should
-  // continue to not isolate it.
+  // origin and isolated it, in which case we should continue to isolate it, and
+  // (ii) we've previously seen the origin and *not* isolated it, in which case
+  // we should continue to not isolate it.
   BrowsingInstanceId browsing_instance_id(
       isolation_context.browsing_instance_id());
+
   if (!browsing_instance_id.is_null()) {
-    auto it = origin_isolation_by_browsing_instance_.find(browsing_instance_id);
-    if (it != origin_isolation_by_browsing_instance_.end()) {
-      if (std::find(it->second.begin(), it->second.end(), origin) !=
-          it->second.end()) {
+    // Look for |origin| in the opt-in list.
+    auto it_isolated =
+        origin_isolation_by_browsing_instance_.find(browsing_instance_id);
+    if (it_isolated != origin_isolation_by_browsing_instance_.end()) {
+      if (base::Contains(it_isolated->second, origin))
         return true;
-      }
+    }
+    // Look for |origin| in the non-isolated list.
+    auto it_non_isolated =
+        origin_isolation_non_isolated_by_browsing_instance_.find(
+            browsing_instance_id);
+    if (it_non_isolated !=
+        origin_isolation_non_isolated_by_browsing_instance_.end()) {
+      if (base::Contains(it_non_isolated->second, origin))
+        return false;
     }
   }
 
-  // If |origin| isn't already in BrowserInstance, check the master opt_ins set.
-  return origin_isolation_opt_ins_.contains(origin);
+  // Opt-in origin isolation is specific to (and consistent throughout) a
+  // BrowsingInstance.  There is no global mode for each origin, and instead the
+  // opt-in request comes via the NavigationRequest.  If we haven't already
+  // decided that this origin is isolated or non-isolated above, then base the
+  // decision on that request (which gets stored in the temporary
+  // scoped_isolation_request_origin_ because it's awkward to pass in as a
+  // parameter).
+  // The thread-check is needed since this function can be called from the IO
+  // thread, though it is only safe to access the scoped request on the UI
+  // thread. Calls on the IO thread do not depend on this value for correctness
+  // because they are not adding new origins; they can rely on the maps above.
+  return BrowserThread::CurrentlyOn(BrowserThread::UI) &&
+         scoped_isolation_request_origin_ == origin;
+}
+
+bool ChildProcessSecurityPolicyImpl::HasOriginEverRequestedOptInIsolation(
+    const url::Origin& origin) {
+  base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
+  return base::Contains(origin_isolation_opt_ins_, origin);
+}
+
+void ChildProcessSecurityPolicyImpl::AddNonIsolatedOriginIfNeeded(
+    const IsolationContext& isolation_context,
+    const url::Origin& origin,
+    bool is_global_walk) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  // Origin Policy only exists for HTTPS, and header-based opt-in requests are
+  // also HTTPS-only, so nothing we isolate will be HTTP.
+  if (!origin.GetURL().SchemeIs(url::kHttpsScheme))
+    return;
+
+  BrowsingInstanceId browsing_instance_id(
+      isolation_context.browsing_instance_id());
+  CHECK(!browsing_instance_id.is_null());
+
+  base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
+
+  if (!is_global_walk) {
+    // Commits of origins that have ever requested isolation are tracked in
+    // every BrowsingInstance, to avoid having to do multiple global walks. If
+    // the origin isn't in the list of such origins (i.e., the common case),
+    // return early to avoid unnecessary work, since this is called on every
+    // commit.
+    if (!base::Contains(origin_isolation_opt_ins_, origin))
+      return;
+
+    // If |origin| is already in the opt-in list, then we don't want to add it
+    // to the opt-out list.
+    auto it_opt_in =
+        origin_isolation_by_browsing_instance_.find(browsing_instance_id);
+    if (it_opt_in != origin_isolation_by_browsing_instance_.end() &&
+        base::Contains(it_opt_in->second, origin)) {
+      return;
+    }
+  }
+
+  auto it = origin_isolation_non_isolated_by_browsing_instance_.find(
+      browsing_instance_id);
+  if (it == origin_isolation_non_isolated_by_browsing_instance_.end()) {
+    // We need to create the entry for this BrowsingInstance. Note this
+    // guarantees |origin| isn't already in the list.
+    origin_isolation_non_isolated_by_browsing_instance_.emplace(
+        browsing_instance_id, std::vector<url::Origin>());
+    it = origin_isolation_non_isolated_by_browsing_instance_.find(
+        browsing_instance_id);
+  } else if (base::Contains(it->second, origin)) {
+    // |origin| is already in the list, no need to add it. This can happen if
+    // (i) during the global walk we encounter a page with multiple instances of
+    // |origin| or (ii) if we encounter it again in the FrameTree walk (after
+    // the session history walk).
+    return;
+  }
+  it->second.push_back(origin);
 }
 
 void ChildProcessSecurityPolicyImpl::
@@ -1932,6 +2037,8 @@ void ChildProcessSecurityPolicyImpl::
 
   base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
   origin_isolation_by_browsing_instance_.erase(browsing_instance_id);
+  origin_isolation_non_isolated_by_browsing_instance_.erase(
+      browsing_instance_id);
 }
 
 void ChildProcessSecurityPolicyImpl::AddOptInIsolatedOriginForBrowsingInstance(
@@ -1950,10 +2057,11 @@ void ChildProcessSecurityPolicyImpl::AddOptInIsolatedOriginForBrowsingInstance(
   base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
   auto it = origin_isolation_by_browsing_instance_.find(browsing_instance_id);
   if (it == origin_isolation_by_browsing_instance_.end()) {
-    origin_isolation_by_browsing_instance_.try_emplace(
-        browsing_instance_id, std::vector<url::Origin>());
+    origin_isolation_by_browsing_instance_.emplace(browsing_instance_id,
+                                                   std::vector<url::Origin>());
     it = origin_isolation_by_browsing_instance_.find(browsing_instance_id);
   }
+
   // We only support adding new entries, not modifying existing ones. If at
   // some point in the future we allow isolation status to change during the
   // lifetime of a BrowsingInstance, then this will need to be updated.
@@ -1963,21 +2071,21 @@ void ChildProcessSecurityPolicyImpl::AddOptInIsolatedOriginForBrowsingInstance(
   }
 }
 
-void ChildProcessSecurityPolicyImpl::UpdateOriginIsolationOptInListIfNecessary(
-    const url::Origin& origin,
-    bool requests_isolation) {
-  // Avoid dealing with non-HTTP/HTTPS and other non-valid-for-isolation
-  // origins.
+bool ChildProcessSecurityPolicyImpl::UpdateOriginIsolationOptInListIfNecessary(
+    const url::Origin& origin) {
+  // Avoid dealing with non-HTTPS and other non-valid-for-isolation origins.
   if (!origin.GetURL().SchemeIs(url::kHttpsScheme) ||
       !IsolatedOriginUtil::IsValidIsolatedOrigin(origin)) {
-    return;
+    return false;
   }
 
   base::AutoLock origins_isolation_opt_in_lock(origins_isolation_opt_in_lock_);
-  if (requests_isolation)
-    origin_isolation_opt_ins_.insert(origin);
-  else
-    origin_isolation_opt_ins_.erase(origin);
+
+  if (origin_isolation_opt_ins_.contains(origin))
+    return false;
+
+  origin_isolation_opt_ins_.insert(origin);
+  return true;
 }
 
 void ChildProcessSecurityPolicyImpl::RemoveIsolatedOriginForTesting(
@@ -1993,6 +2101,11 @@ void ChildProcessSecurityPolicyImpl::RemoveIsolatedOriginForTesting(
     isolated_origins_.erase(key);
 }
 
+void ChildProcessSecurityPolicyImpl::ClearIsolatedOriginsForTesting() {
+  base::AutoLock isolated_origins_lock(isolated_origins_lock_);
+  isolated_origins_.clear();
+}
+
 ChildProcessSecurityPolicyImpl::SecurityState*
 ChildProcessSecurityPolicyImpl::GetSecurityState(int child_id) {
   auto itr = security_state_.find(child_id);
@@ -2043,15 +2156,14 @@ ChildProcessSecurityPolicyImpl::ParseIsolatedOrigins(
 // static
 std::string ChildProcessSecurityPolicyImpl::GetKilledProcessOriginLock(
     const SecurityState* security_state) {
-  std::string killed_process_origin_lock;
   if (!security_state)
     return "(child id not found)";
 
-  if (!security_state->GetBrowserOrResourceContext())
-    return "(context is null)";
-
-  if (security_state->origin_lock().is_empty())
-    return "(none)";
+  if (security_state->origin_lock().is_empty()) {
+    return security_state->GetBrowserOrResourceContext()
+               ? "(empty)"
+               : "(empty and null context)";
+  }
 
   return security_state->origin_lock().possibly_invalid_spec();
 }
@@ -2071,6 +2183,33 @@ ChildProcessSecurityPolicyImpl::CreateHandle(int child_id) {
   return Handle(child_id);
 }
 
+// static
+std::unique_ptr<
+    ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest>
+ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest::
+    GetScopedOriginIsolationOptInRequest(const url::Origin& origin_to_isolate) {
+  ChildProcessSecurityPolicyImpl* instance = GetInstance();
+  // Nested calls are not allowed, even for the same origin.
+  CHECK(!instance->scoped_isolation_request_origin_);
+  return base::WrapUnique<ScopedOriginIsolationOptInRequest>(
+      new ScopedOriginIsolationOptInRequest(origin_to_isolate));
+}
+
+ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest::
+    ScopedOriginIsolationOptInRequest(const url::Origin& origin_to_isolate) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  ChildProcessSecurityPolicyImpl* instance = GetInstance();
+  DCHECK(!instance->scoped_isolation_request_origin_);
+  instance->scoped_isolation_request_origin_ = origin_to_isolate;
+}
+
+ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest::
+    ~ScopedOriginIsolationOptInRequest() {
+  ChildProcessSecurityPolicyImpl* instance = GetInstance();
+  DCHECK(instance->scoped_isolation_request_origin_);
+  instance->scoped_isolation_request_origin_ = base::nullopt;
+}
+
 bool ChildProcessSecurityPolicyImpl::AddProcessReference(int child_id) {
   base::AutoLock lock(lock_);
   return AddProcessReferenceLocked(child_id);
diff --git a/chromium/content/browser/child_process_security_policy_impl.h b/chromium/content/browser/child_process_security_policy_impl.h
index 1969a69ecea..f5fa528fe15 100644
--- a/chromium/content/browser/child_process_security_policy_impl.h
+++ b/chromium/content/browser/child_process_security_policy_impl.h
@@ -118,6 +118,35 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
     int child_id_;
   };
 
+  // This scoped class is used to temporarily store an origin requesting
+  // opt-in isolation in scoped_isolation_request_origin_, while the request is
+  // being processed. This is only necessary because it is difficult to plumb
+  // the parameter through the site URL computations that need it, and it is
+  // safe because overlapping and nested occurrences cannot occur. Callers
+  // should stack allocate the result so that the temporary result is
+  // automatically cleared when the result goes out of scope. The stored
+  // scoped_isolation_request_origin_ value is only safe to access from the UI
+  // thread, where this object must be created.
+  class CONTENT_EXPORT ScopedOriginIsolationOptInRequest {
+   public:
+    // This returns a new unique_ptr to ScopedOriginIsolationOptInRequest if
+    // no origin is already scoped for an isolation request, or a null
+    // unique_ptr if |origin_to_isolate| has already been scoped. If
+    // a second call occurs while this is set, this will fail on a CHECK.
+    static std::unique_ptr<ScopedOriginIsolationOptInRequest>
+    GetScopedOriginIsolationOptInRequest(const url::Origin& origin_to_isolate);
+
+    ~ScopedOriginIsolationOptInRequest();
+
+   private:
+    explicit ScopedOriginIsolationOptInRequest(
+        const url::Origin& origin_to_isolate);
+
+    friend class ChildProcessSecurityPolicyImpl;
+
+    DISALLOW_COPY_AND_ASSIGN(ScopedOriginIsolationOptInRequest);
+  };
+
   // Object can only be created through GetInstance() so the constructor is
   // private.
   ~ChildProcessSecurityPolicyImpl() override;
@@ -177,6 +206,7 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   std::vector<url::Origin> GetIsolatedOrigins(
       base::Optional<IsolatedOriginSource> source = base::nullopt,
       BrowserContext* browser_context = nullptr) override;
+  void ClearIsolatedOriginsForTesting() override;
 
   // Identical to the above method, but takes url::Origin as input.
   bool CanAccessDataForOrigin(int child_id, const url::Origin& origin);
@@ -246,19 +276,22 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   // |isolation_context|. It is different from IsIsolatedOrigin() in that it
   // only deals with OriginPolicy isolation status, whereas IsIsolatedOrigin()
   // considers all possible mechanisms for requesting isolation.
-  // It will check for two things: 1) whether |origin|
-  // already has a site instance in the |isolation_context|
-  //    in which case we follow the same policy, or
-  // 2) if it's not currently listed, whether |origin| is listed in the master
-  //    list of origins requesting isolation via an OriginPolicy opt-in.
-  bool DoesOriginRequestOptInIsolation(
-      const IsolationContext& isolation_context,
-      const url::Origin& origin);
-
-  // This function manages updates to the master list of origins requesting
-  // isolation, e.g. via an OriginPolicy.
-  void UpdateOriginIsolationOptInListIfNecessary(const url::Origin& origin,
-                                                 bool requests_isolation);
+  // It will check for two things:
+  // 1) whether |origin| already is assigned to a SiteInstance in the
+  //    |isolation_context| by being tracked in either
+  //    |origin_isolation_non_isolated_by_browsing_instance_| or
+  //    |origin_isolation_by_browsing_instance_|, in which case we follow the
+  //    same policy, or
+  // 2) if it's not currently tracked as described above, whether |origin| is
+  //    currently requesting isolation via |scoped_isolation_request_origin_|,
+  //    as part of an in-progress navigation.
+  bool ShouldOriginGetOptInIsolation(const IsolationContext& isolation_context,
+                                     const url::Origin& origin);
+
+  // This function adds |origin| to the master list of origins that have
+  // ever requested opt-in isolation, either via an OriginPolicy or opt-in
+  // header. Returns true if |origin| is not already in the list.
+  bool UpdateOriginIsolationOptInListIfNecessary(const url::Origin& origin);
 
   // A version of GetMatchingIsolatedOrigin that takes in both the |origin| and
   // the |site_url| that |origin| corresponds to.  |site_url| is the key by
@@ -436,6 +469,19 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   // all policy checks.
   Handle CreateHandle(int child_id);
 
+  // Returns true if we have seen an isolation request for this origin before
+  // in any BrowsingInstance.
+  bool HasOriginEverRequestedOptInIsolation(const url::Origin& origin);
+
+  // Adds |origin| to the non-isolated list for the BrowsingInstance specified
+  // by |isolation_context|, if it's not already in the list. |is_global_walk|
+  // should only be set to true during the global walk that is triggered when
+  // |origin| first requests opt-in isolation, so that the function can skip
+  // safety checks that will be unnecessary during the global walk.
+  void AddNonIsolatedOriginIfNeeded(const IsolationContext& isolation_context,
+                                    const url::Origin& origin,
+                                    bool is_global_walk);
+
  private:
   friend class ChildProcessSecurityPolicyInProcessBrowserTest;
   friend class ChildProcessSecurityPolicyTest;
@@ -701,16 +747,37 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   base::flat_map<GURL, std::vector<IsolatedOriginEntry>> isolated_origins_
       GUARDED_BY(isolated_origins_lock_);
 
-  // Two maps, one to track an up-to-date set of Origins requesting opt-in
-  // isolation, and the other to track the current opt-in status of an Origin
-  // within a BrowsingInstance, so that that status can be made consistent over
-  // the lifetime of the BrowsingInstance.
+  // TODO(wjmaclean): Move these lists into a per-BrowserContext container, to
+  // prevent any record of sites visible in one profile from being visible to
+  // another profile.
   base::Lock origins_isolation_opt_in_lock_;
+  // The set of all origins that have ever requested opt-in isolation. This is
+  // tracked so we know which origins need to be tracked when non-isolated in
+  // any given BrowsingInstance. Origins requesting isolation, if successful,
+  // are marked as isolated via ShouldOriginGetOptInIsolation's checking
+  // |scoped_isolation_request_origin_|.
   base::flat_set<url::Origin> origin_isolation_opt_ins_
       GUARDED_BY(origins_isolation_opt_in_lock_);
+  // A map to track origins that have been isolated within a given
+  // BrowsingInstance.
   base::flat_map<BrowsingInstanceId, std::vector<url::Origin>>
       origin_isolation_by_browsing_instance_
           GUARDED_BY(origins_isolation_opt_in_lock_);
+  // A map to track origins that have been loaded in a BrowsingInstance without
+  // isolation, but that have requested isolation in at least one other
+  // BrowsingInstance. This map makes sure we don't try to isolate the origin
+  // in the associated BrowsingInstance at a later time, in order to keep the
+  // isolation consistent over the lifetime of the BrowsingInstance.
+  base::flat_map<BrowsingInstanceId, std::vector<url::Origin>>
+      origin_isolation_non_isolated_by_browsing_instance_
+          GUARDED_BY(origins_isolation_opt_in_lock_);
+
+  // This origin is set during a call to NavigationRequest::OnResponseStarted
+  // that requests isolation for an origin, via the creation of a
+  // ScopedOriginIsolationOptInRequest object. This value's state is read by
+  // ShouldOriginGetOptInIsolation(), and it is only safe to access on the UI
+  // thread.
+  base::Optional<url::Origin> scoped_isolation_request_origin_;
 
   DISALLOW_COPY_AND_ASSIGN(ChildProcessSecurityPolicyImpl);
 };
diff --git a/chromium/content/browser/client_hints/OWNERS b/chromium/content/browser/client_hints/OWNERS
new file mode 100644
index 00000000000..6f1aa49ea12
--- /dev/null
+++ b/chromium/content/browser/client_hints/OWNERS
@@ -0,0 +1 @@
+file://components/client_hints/OWNERS
diff --git a/chromium/content/browser/client_hints/client_hints.cc b/chromium/content/browser/client_hints/client_hints.cc
index 5a286b3659b..46297743f22 100644
--- a/chromium/content/browser/client_hints/client_hints.cc
+++ b/chromium/content/browser/client_hints/client_hints.cc
@@ -16,16 +16,22 @@
 #include "base/strings/stringprintf.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigator.h"
+#include "content/browser/frame_host/navigator_delegate.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/host_zoom_map.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "net/base/url_util.h"
+#include "net/http/structured_headers.h"
 #include "net/nqe/effective_connection_type.h"
 #include "net/nqe/network_quality_estimator_params.h"
+#include "services/network/public/cpp/client_hints.h"
 #include "services/network/public/cpp/network_quality_tracker.h"
 #include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/device_memory/approximated_device_memory.h"
@@ -36,6 +42,8 @@
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 
+namespace content {
+
 namespace {
 uint8_t randomization_salt = 0;
 
@@ -125,19 +133,19 @@ double GetDeviceScaleFactor() {
 }
 
 // Returns the zoom factor for a given |url|.
-double GetZoomFactor(content::BrowserContext* context, const GURL& url) {
+double GetZoomFactor(BrowserContext* context, const GURL& url) {
 // Android does not have the concept of zooming in like desktop.
 #if defined(OS_ANDROID)
   return 1.0;
 #else
 
-  double zoom_level = content::HostZoomMap::GetDefaultForBrowserContext(context)
+  double zoom_level = HostZoomMap::GetDefaultForBrowserContext(context)
                           ->GetZoomLevelForHostAndScheme(
                               url.scheme(), net::GetHostOrSpecFromURL(url));
 
   if (zoom_level == 0.0) {
     // Get default zoom level.
-    zoom_level = content::HostZoomMap::GetDefaultForBrowserContext(context)
+    zoom_level = HostZoomMap::GetDefaultForBrowserContext(context)
                      ->GetDefaultZoomLevel();
   }
 
@@ -191,7 +199,7 @@ GetWebHoldbackEffectiveConnectionType() {
 }
 
 void SetHeaderToDouble(net::HttpRequestHeaders* headers,
-                       blink::mojom::WebClientHintsType client_hint_type,
+                       network::mojom::WebClientHintsType client_hint_type,
                        double value) {
   headers->SetHeader(
       blink::kClientHintsHeaderMapping[static_cast<int>(client_hint_type)],
@@ -199,7 +207,7 @@ void SetHeaderToDouble(net::HttpRequestHeaders* headers,
 }
 
 void SetHeaderToInt(net::HttpRequestHeaders* headers,
-                    blink::mojom::WebClientHintsType client_hint_type,
+                    network::mojom::WebClientHintsType client_hint_type,
                     double value) {
   headers->SetHeader(
       blink::kClientHintsHeaderMapping[static_cast<int>(client_hint_type)],
@@ -207,36 +215,42 @@ void SetHeaderToInt(net::HttpRequestHeaders* headers,
 }
 
 void SetHeaderToString(net::HttpRequestHeaders* headers,
-                       blink::mojom::WebClientHintsType client_hint_type,
-                       std::string value) {
+                       network::mojom::WebClientHintsType client_hint_type,
+                       const std::string& value) {
   headers->SetHeader(
       blink::kClientHintsHeaderMapping[static_cast<int>(client_hint_type)],
       value);
 }
 
+void RemoveClientHintHeader(network::mojom::WebClientHintsType client_hint_type,
+                            net::HttpRequestHeaders* headers) {
+  headers->RemoveHeader(
+      blink::kClientHintsHeaderMapping[static_cast<int>(client_hint_type)]);
+}
+
 void AddDeviceMemoryHeader(net::HttpRequestHeaders* headers) {
   DCHECK(headers);
   blink::ApproximatedDeviceMemory::Initialize();
   const float device_memory =
       blink::ApproximatedDeviceMemory::GetApproximatedDeviceMemory();
   DCHECK_LT(0.0, device_memory);
-  SetHeaderToDouble(headers, blink::mojom::WebClientHintsType::kDeviceMemory,
+  SetHeaderToDouble(headers, network::mojom::WebClientHintsType::kDeviceMemory,
                     device_memory);
 }
 
 void AddDPRHeader(net::HttpRequestHeaders* headers,
-                  content::BrowserContext* context,
+                  BrowserContext* context,
                   const GURL& url) {
   DCHECK(headers);
   DCHECK(context);
   double device_scale_factor = GetDeviceScaleFactor();
   double zoom_factor = GetZoomFactor(context, url);
-  SetHeaderToDouble(headers, blink::mojom::WebClientHintsType::kDpr,
+  SetHeaderToDouble(headers, network::mojom::WebClientHintsType::kDpr,
                     device_scale_factor * zoom_factor);
 }
 
 void AddViewportWidthHeader(net::HttpRequestHeaders* headers,
-                            content::BrowserContext* context,
+                            BrowserContext* context,
                             const GURL& url) {
   DCHECK(headers);
   DCHECK(context);
@@ -255,7 +269,7 @@ void AddViewportWidthHeader(net::HttpRequestHeaders* headers,
   DCHECK_LT(0, viewport_width);
   // TODO(yoav): Find out why this 0 check is needed...
   if (viewport_width > 0) {
-    SetHeaderToInt(headers, blink::mojom::WebClientHintsType::kViewportWidth,
+    SetHeaderToInt(headers, network::mojom::WebClientHintsType::kViewportWidth,
                    viewport_width);
   }
 }
@@ -278,7 +292,7 @@ void AddRttHeader(net::HttpRequestHeaders* headers,
     http_rtt = net::NetworkQualityEstimatorParams::GetDefaultTypicalHttpRtt(
         net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN);
   }
-  SetHeaderToInt(headers, blink::mojom::WebClientHintsType::kRtt,
+  SetHeaderToInt(headers, network::mojom::WebClientHintsType::kRtt,
                  RoundRtt(url.host(), http_rtt));
 }
 
@@ -304,7 +318,7 @@ void AddDownlinkHeader(net::HttpRequestHeaders* headers,
             net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN);
   }
 
-  SetHeaderToDouble(headers, blink::mojom::WebClientHintsType::kDownlink,
+  SetHeaderToDouble(headers, network::mojom::WebClientHintsType::kDownlink,
                     RoundKbpsToMbps(url.host(), downlink_throughput_kbps));
 }
 
@@ -332,15 +346,15 @@ void AddEctHeader(net::HttpRequestHeaders* headers,
   }
 
   SetHeaderToString(
-      headers, blink::mojom::WebClientHintsType::kEct,
+      headers, network::mojom::WebClientHintsType::kEct,
       blink::kWebEffectiveConnectionTypeMapping[effective_connection_type]);
 }
 
-void AddLangHeader(net::HttpRequestHeaders* headers,
-                   content::ClientHintsControllerDelegate* delegate) {
+void AddLangHeader(net::HttpRequestHeaders* headers, BrowserContext* context) {
   SetHeaderToString(
-      headers, blink::mojom::WebClientHintsType::kLang,
-      blink::SerializeLangClientHint(delegate->GetAcceptLanguageString()));
+      headers, network::mojom::WebClientHintsType::kLang,
+      blink::SerializeLangClientHint(
+          GetContentClient()->browser()->GetAcceptLangs(context)));
 }
 
 bool IsValidURLForClientHints(const GURL& url) {
@@ -353,50 +367,198 @@ bool IsValidURLForClientHints(const GURL& url) {
   return true;
 }
 
-bool UserAgentClientHintEnabled() {
-  return base::FeatureList::IsEnabled(features::kUserAgentClientHint);
-}
-
 void AddUAHeader(net::HttpRequestHeaders* headers,
-                 blink::mojom::WebClientHintsType type,
-                 std::string value) {
+                 network::mojom::WebClientHintsType type,
+                 const std::string& value) {
   SetHeaderToString(headers, type, value);
 }
 
-std::string AddQuotes(std::string str) {
-  return base::StringPrintf("\"%s\"", str.c_str());
-}
-
-std::string AddBrandVersionQuotes(std::string brand, std::string version) {
-  if (version.empty()) {
-    return AddQuotes(brand);
-  }
-  return base::StringPrintf("\"%s\"; v=\"%s\"", brand.c_str(), version.c_str());
+// Use structured headers to escape and quote headers
+std::string SerializeHeaderString(std::string str) {
+  return net::structured_headers::SerializeItem(
+             net::structured_headers::Item(str))
+      .value_or(std::string());
 }
 
 bool IsFeaturePolicyForClientHintsEnabled() {
   return base::FeatureList::IsEnabled(features::kFeaturePolicyForClientHints);
 }
 
-bool ShouldAddClientHint(
-    const blink::WebEnabledClientHints& main_frame_client_hints,
-    bool is_main_frame,
-    bool is_1p_origin,
-    blink::FeaturePolicy* feature_policy,
-    const url::Origin& resource_origin,
-    blink::mojom::WebClientHintsType type,
-    blink::mojom::FeaturePolicyFeature feature) {
-  if (!main_frame_client_hints.IsEnabled(type))
+// Captures the state used in applying client hints.
+struct ClientHintsExtendedData {
+  ClientHintsExtendedData(const GURL& url,
+                          FrameTreeNode* frame_tree_node,
+                          ClientHintsControllerDelegate* delegate)
+      : resource_origin(url::Origin::Create(url)) {
+    // If the current frame is the main frame, the URL wasn't committed yet, so
+    // in order to get the main frame URL, we should use the provided URL
+    // instead. Otherwise, the current frame is an iframe and the main frame URL
+    // was committed, so we can safely get it from it. Similarly, an
+    // in-navigation main frame doesn't yet have a feature policy.
+    RenderFrameHostImpl* main_frame =
+        frame_tree_node->frame_tree()->GetMainFrame();
+    is_main_frame = frame_tree_node->IsMainFrame();
+    if (is_main_frame) {
+      main_frame_url = url;
+      is_1p_origin = true;
+    } else {
+      main_frame_url = main_frame->GetLastCommittedURL();
+      feature_policy = main_frame->feature_policy();
+      is_1p_origin = resource_origin.IsSameOriginWith(
+          main_frame->GetLastCommittedOrigin());
+    }
+
+    delegate->GetAllowedClientHintsFromSource(main_frame_url, &hints);
+  }
+
+  blink::WebEnabledClientHints hints;
+  url::Origin resource_origin;
+  bool is_main_frame = false;
+  GURL main_frame_url;
+  blink::FeaturePolicy* feature_policy = nullptr;
+  bool is_1p_origin = false;
+};
+
+bool ShouldAddClientHint(const ClientHintsExtendedData& data,
+                         network::mojom::WebClientHintsType type) {
+  if (!blink::IsClientHintSentByDefault(type) && !data.hints.IsEnabled(type))
     return false;
-  if (!IsFeaturePolicyForClientHintsEnabled() || is_main_frame)
-    return is_1p_origin;
-  return feature_policy &&
-         feature_policy->IsFeatureEnabledForOrigin(feature, resource_origin);
+  if (!IsFeaturePolicyForClientHintsEnabled() || data.is_main_frame)
+    return data.is_1p_origin;
+  return data.feature_policy &&
+         data.feature_policy->IsFeatureEnabledForOrigin(
+             blink::kClientHintsFeaturePolicyMapping[static_cast<int>(type)],
+             data.resource_origin);
 }
 
-}  // namespace
+bool IsJavascriptEnabled(FrameTreeNode* frame_tree_node) {
+  RenderViewHost* render_view_host =
+      frame_tree_node->current_frame_host()->GetRenderViewHost();
+  return render_view_host->GetWebkitPreferences().javascript_enabled;
+}
 
-namespace content {
+bool ShouldAddClientHints(const GURL& url,
+                          bool javascript_enabled,
+                          ClientHintsControllerDelegate* delegate) {
+  // Client hints should only be enabled when JavaScript is enabled. Platforms
+  // which enable/disable JavaScript on a per-origin basis should implement
+  // IsJavaScriptAllowed to check a given origin. Other platforms (Android
+  // WebView) enable/disable JavaScript on a per-View basis, using the
+  // WebPreferences setting.
+  return IsValidURLForClientHints(url) && delegate->IsJavaScriptAllowed(url) &&
+         javascript_enabled;
+}
+
+// Captures when UpdateNavigationRequestClientUaHeadersImpl() is being called.
+enum class ClientUaHeaderCallType {
+  // The call is happening during creation of the NavigationRequest.
+  kDuringCreation,
+
+  // The call is happening after creation of the NavigationRequest.
+  kAfterCreated,
+};
+
+// Implementation of UpdateNavigationRequestClientUaHeaders().
+void UpdateNavigationRequestClientUaHeadersImpl(
+    const GURL& url,
+    ClientHintsControllerDelegate* delegate,
+    bool override_ua,
+    FrameTreeNode* frame_tree_node,
+    ClientUaHeaderCallType call_type,
+    net::HttpRequestHeaders* headers) {
+  base::Optional<blink::UserAgentMetadata> ua_metadata;
+  bool disable_due_to_custom_ua = false;
+  if (override_ua) {
+    NavigatorDelegate* nav_delegate =
+        frame_tree_node->navigator()->GetDelegate();
+    ua_metadata =
+        nav_delegate ? nav_delegate->GetUserAgentOverride().ua_metadata_override
+                     : base::nullopt;
+    // If a custom UA override is set, but no value is provided for UA client
+    // hints, disable them.
+    disable_due_to_custom_ua = !ua_metadata.has_value();
+  }
+
+  if (devtools_instrumentation::ApplyUserAgentMetadataOverrides(frame_tree_node,
+                                                                &ua_metadata)) {
+    // Likewise, if devtools says to override client hints but provides no
+    // value, disable them. This overwrites previous decision from UI.
+    disable_due_to_custom_ua = !ua_metadata.has_value();
+  }
+
+  if (!disable_due_to_custom_ua) {
+    if (!ua_metadata.has_value())
+      ua_metadata = delegate->GetUserAgentMetadata();
+
+    ClientHintsExtendedData data(url, frame_tree_node, delegate);
+
+    // The `Sec-CH-UA` client hint is attached to all outgoing requests. This is
+    // (intentionally) different than other client hints.
+    // It's barred behind ShouldAddClientHints to make sure it's controlled by
+    // FeaturePolicy.
+    //
+    // https://wicg.github.io/client-hints-infrastructure/#abstract-opdef-append-client-hints-to-request
+    if (ShouldAddClientHint(data, network::mojom::WebClientHintsType::kUA)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUA,
+                  ua_metadata->SerializeBrandVersionList());
+    }
+    // The `Sec-CH-UA-Mobile client hint was also deemed "low entropy" and can
+    // safely be sent with every request. Similarly to UA, ShouldAddClientHints
+    // makes sure it's controlled by FeaturePolicy.
+    if (ShouldAddClientHint(data,
+                            network::mojom::WebClientHintsType::kUAMobile)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUAMobile,
+                  ua_metadata->mobile ? "?1" : "?0");
+    }
+
+    if (ShouldAddClientHint(
+            data, network::mojom::WebClientHintsType::kUAFullVersion)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUAFullVersion,
+                  SerializeHeaderString(ua_metadata->full_version));
+    }
+
+    if (ShouldAddClientHint(data,
+                            network::mojom::WebClientHintsType::kUAArch)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUAArch,
+                  SerializeHeaderString(ua_metadata->architecture));
+    }
+
+    if (ShouldAddClientHint(data,
+                            network::mojom::WebClientHintsType::kUAPlatform)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUAPlatform,
+                  SerializeHeaderString(ua_metadata->platform));
+    }
+
+    if (ShouldAddClientHint(
+            data, network::mojom::WebClientHintsType::kUAPlatformVersion)) {
+      AddUAHeader(headers,
+                  network::mojom::WebClientHintsType::kUAPlatformVersion,
+                  SerializeHeaderString(ua_metadata->platform_version));
+    }
+
+    if (ShouldAddClientHint(data,
+                            network::mojom::WebClientHintsType::kUAModel)) {
+      AddUAHeader(headers, network::mojom::WebClientHintsType::kUAModel,
+                  SerializeHeaderString(ua_metadata->model));
+    }
+  } else if (call_type == ClientUaHeaderCallType::kAfterCreated) {
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUA, headers);
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUAMobile,
+                           headers);
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUAFullVersion,
+                           headers);
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUAArch,
+                           headers);
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUAPlatform,
+                           headers);
+    RemoveClientHintHeader(
+        network::mojom::WebClientHintsType::kUAPlatformVersion, headers);
+    RemoveClientHintHeader(network::mojom::WebClientHintsType::kUAModel,
+                           headers);
+  }
+}
+
+}  // namespace
 
 unsigned long RoundRttForTesting(const std::string& host,
                                  const base::Optional<base::TimeDelta>& rtt) {
@@ -408,11 +570,27 @@ double RoundKbpsToMbpsForTesting(const std::string& host,
   return RoundKbpsToMbps(host, downlink_kbps);
 }
 
+void UpdateNavigationRequestClientUaHeaders(
+    const GURL& url,
+    ClientHintsControllerDelegate* delegate,
+    bool override_ua,
+    FrameTreeNode* frame_tree_node,
+    net::HttpRequestHeaders* headers) {
+  if (!delegate->UserAgentClientHintEnabled() ||
+      !ShouldAddClientHints(url, IsJavascriptEnabled(frame_tree_node),
+                            delegate)) {
+    return;
+  }
+
+  UpdateNavigationRequestClientUaHeadersImpl(
+      url, delegate, override_ua, frame_tree_node,
+      ClientUaHeaderCallType::kAfterCreated, headers);
+}
+
 void AddNavigationRequestClientHintsHeaders(
     const GURL& url,
     net::HttpRequestHeaders* headers,
     BrowserContext* context,
-    bool javascript_enabled,
     ClientHintsControllerDelegate* delegate,
     bool is_ua_override_on,
     FrameTreeNode* frame_tree_node) {
@@ -422,156 +600,46 @@ void AddNavigationRequestClientHintsHeaders(
   DCHECK_EQ(blink::kWebEffectiveConnectionTypeMappingCount,
             static_cast<size_t>(net::EFFECTIVE_CONNECTION_TYPE_LAST));
   DCHECK(context);
-  RenderFrameHostImpl* main_frame =
-      frame_tree_node->frame_tree()->GetMainFrame();
 
-  if (!IsValidURLForClientHints(url))
+  if (!ShouldAddClientHints(url, IsJavascriptEnabled(frame_tree_node),
+                            delegate)) {
     return;
-
-  // Client hints should only be enabled when JavaScript is enabled. Platforms
-  // which enable/disable JavaScript on a per-origin basis should implement
-  // IsJavaScriptAllowed to check a given origin. Other platforms (Android
-  // WebView) enable/disable JavaScript on a per-View basis, using the
-  // WebPreferences setting.
-  if (!delegate->IsJavaScriptAllowed(url) || !javascript_enabled)
-    return;
-
-  blink::WebEnabledClientHints web_client_hints;
-  url::Origin resource_origin = url::Origin::Create(url);
-
-  // If the current frame is the main frame, the URL wasn't committed yet, so in
-  // order to get the main frame URL, we should use the provided URL instead.
-  // Otherwise, the current frame is an iframe and the main frame URL was
-  // committed, so we can safely get it from it. Similarly, an in-navigation
-  // main frame doesn't yet have a feature policy.
-  bool is_main_frame = frame_tree_node->IsMainFrame();
-  GURL main_frame_url;
-  blink::FeaturePolicy* feature_policy;
-  bool is_1p_origin;
-  if (is_main_frame) {
-    main_frame_url = url;
-    feature_policy = nullptr;
-    is_1p_origin = true;
-  } else {
-    main_frame_url = main_frame->GetLastCommittedURL();
-    feature_policy = main_frame->feature_policy();
-    is_1p_origin =
-        resource_origin.IsSameOriginWith(main_frame->GetLastCommittedOrigin());
   }
 
-  delegate->GetAllowedClientHintsFromSource(main_frame_url, &web_client_hints);
-
+  const ClientHintsExtendedData data(url, frame_tree_node, delegate);
 
   // Add Headers
-  if (ShouldAddClientHint(
-          web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-          resource_origin, blink::mojom::WebClientHintsType::kDeviceMemory,
-          blink::mojom::FeaturePolicyFeature::kClientHintDeviceMemory)) {
+  if (ShouldAddClientHint(data,
+                          network::mojom::WebClientHintsType::kDeviceMemory)) {
     AddDeviceMemoryHeader(headers);
   }
-  if (ShouldAddClientHint(web_client_hints, is_main_frame, is_1p_origin,
-                          feature_policy, resource_origin,
-                          blink::mojom::WebClientHintsType::kDpr,
-                          blink::mojom::FeaturePolicyFeature::kClientHintDPR)) {
+  if (ShouldAddClientHint(data, network::mojom::WebClientHintsType::kDpr)) {
     AddDPRHeader(headers, context, url);
   }
-  if (ShouldAddClientHint(
-          web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-          resource_origin, blink::mojom::WebClientHintsType::kViewportWidth,
-          blink::mojom::FeaturePolicyFeature::kClientHintViewportWidth)) {
+  if (ShouldAddClientHint(data,
+                          network::mojom::WebClientHintsType::kViewportWidth)) {
     AddViewportWidthHeader(headers, context, url);
   }
   network::NetworkQualityTracker* network_quality_tracker =
       delegate->GetNetworkQualityTracker();
-  if (ShouldAddClientHint(web_client_hints, is_1p_origin, is_main_frame,
-                          feature_policy, resource_origin,
-                          blink::mojom::WebClientHintsType::kRtt,
-                          blink::mojom::FeaturePolicyFeature::kClientHintRTT)) {
+  if (ShouldAddClientHint(data, network::mojom::WebClientHintsType::kRtt)) {
     AddRttHeader(headers, network_quality_tracker, url);
   }
-  if (ShouldAddClientHint(
-          web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-          resource_origin, blink::mojom::WebClientHintsType::kDownlink,
-          blink::mojom::FeaturePolicyFeature::kClientHintDownlink)) {
+  if (ShouldAddClientHint(data,
+                          network::mojom::WebClientHintsType::kDownlink)) {
     AddDownlinkHeader(headers, network_quality_tracker, url);
   }
-  if (ShouldAddClientHint(web_client_hints, is_main_frame, is_1p_origin,
-                          feature_policy, resource_origin,
-                          blink::mojom::WebClientHintsType::kEct,
-                          blink::mojom::FeaturePolicyFeature::kClientHintECT)) {
+  if (ShouldAddClientHint(data, network::mojom::WebClientHintsType::kEct)) {
     AddEctHeader(headers, network_quality_tracker, url);
   }
-  if (ShouldAddClientHint(
-          web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-          resource_origin, blink::mojom::WebClientHintsType::kLang,
-          blink::mojom::FeaturePolicyFeature::kClientHintLang)) {
-    AddLangHeader(headers, delegate);
+  if (ShouldAddClientHint(data, network::mojom::WebClientHintsType::kLang)) {
+    AddLangHeader(headers, context);
   }
 
-  base::Optional<blink::UserAgentMetadata> ch_ua_override;
-  bool disable_ua_ch_due_to_custom_ua = false;
-  if (is_ua_override_on) {
-    NavigatorDelegate* nav_delegate =
-        frame_tree_node->navigator()->GetDelegate();
-    ch_ua_override =
-        nav_delegate ? nav_delegate->GetUserAgentOverride().ua_metadata_override
-                     : base::nullopt;
-    // If a custom UA override is set, but no value is provided for UA client
-    // hints, disable them.
-    disable_ua_ch_due_to_custom_ua = !ch_ua_override.has_value();
-  }
-
-  if (UserAgentClientHintEnabled() && !disable_ua_ch_due_to_custom_ua) {
-    blink::UserAgentMetadata ua = ch_ua_override.has_value()
-                                      ? std::move(ch_ua_override.value())
-                                      : delegate->GetUserAgentMetadata();
-
-    // The `Sec-CH-UA` client hint is attached to all outgoing requests. The
-    // opt-in controls the header's value, not its presence. This is
-    // (intentionally) different than other client hints.
-    //
-    // https://tools.ietf.org/html/draft-west-ua-client-hints-00#section-2.4
-    //
-    // TODO(morlovich): This should probably be using ShouldAddClientHint,
-    // to check FP?
-    AddUAHeader(headers, blink::mojom::WebClientHintsType::kUA,
-                AddBrandVersionQuotes(ua.brand, ua.major_version));
-    // The `Sec-CH-UA-Mobile client hint was also deemed "low entropy" and can
-    // safely be sent with every request.
-    AddUAHeader(headers, blink::mojom::WebClientHintsType::kUAMobile,
-                ua.mobile ? "?1" : "?0");
-
-    if (ShouldAddClientHint(
-            web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-            resource_origin, blink::mojom::WebClientHintsType::kUAFullVersion,
-            blink::mojom::FeaturePolicyFeature::kClientHintUAFullVersion)) {
-      AddUAHeader(headers, blink::mojom::WebClientHintsType::kUAFullVersion,
-                  AddQuotes(ua.full_version));
-    }
-
-    if (ShouldAddClientHint(
-            web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-            resource_origin, blink::mojom::WebClientHintsType::kUAArch,
-            blink::mojom::FeaturePolicyFeature::kClientHintUAArch)) {
-      AddUAHeader(headers, blink::mojom::WebClientHintsType::kUAArch,
-                  AddQuotes(ua.architecture));
-    }
-
-    if (ShouldAddClientHint(
-            web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-            resource_origin, blink::mojom::WebClientHintsType::kUAPlatform,
-            blink::mojom::FeaturePolicyFeature::kClientHintUAPlatform)) {
-      AddUAHeader(headers, blink::mojom::WebClientHintsType::kUAPlatform,
-                  AddBrandVersionQuotes(ua.platform, ua.platform_version));
-    }
-
-    if (ShouldAddClientHint(
-            web_client_hints, is_main_frame, is_1p_origin, feature_policy,
-            resource_origin, blink::mojom::WebClientHintsType::kUAModel,
-            blink::mojom::FeaturePolicyFeature::kClientHintUAModel)) {
-      AddUAHeader(headers, blink::mojom::WebClientHintsType::kUAModel,
-                  AddQuotes(ua.model));
-    }
+  if (delegate->UserAgentClientHintEnabled()) {
+    UpdateNavigationRequestClientUaHeadersImpl(
+        url, delegate, is_ua_override_on, frame_tree_node,
+        ClientUaHeaderCallType::kDuringCreation, headers);
   }
 
   // Static assert that triggers if a new client hint header is added. If a
@@ -579,8 +647,8 @@ void AddNavigationRequestClientHintsHeaders(
   // If possible, logic should be added above so that the request headers for
   // the newly added client hint can be added to the request.
   static_assert(
-      blink::mojom::WebClientHintsType::kUAFullVersion ==
-          blink::mojom::WebClientHintsType::kMaxValue,
+      network::mojom::WebClientHintsType::kUAPlatformVersion ==
+          network::mojom::WebClientHintsType::kMaxValue,
       "Consider adding client hint request headers from the browser process");
 
   // TODO(crbug.com/735518): If the request is redirected, the client hint
@@ -589,4 +657,51 @@ void AddNavigationRequestClientHintsHeaders(
   // scheme or a change in the origin.
 }
 
+void PersistAcceptCHAfterNagivationRequestRedirect(
+    const GURL& url,
+    const ::network::mojom::ParsedHeadersPtr& headers,
+    BrowserContext* context,
+    ClientHintsControllerDelegate* delegate,
+    FrameTreeNode* frame_tree_node) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(context);
+  DCHECK(headers);
+
+  if (!headers->accept_ch)
+    return;
+
+  if (!IsValidURLForClientHints(url))
+    return;
+
+  // Client hints should only be enabled when JavaScript is enabled. Platforms
+  // which enable/disable JavaScript on a per-origin basis should implement
+  // IsJavaScriptAllowed to check a given origin. Other platforms (Android
+  // WebView) enable/disable JavaScript on a per-View basis, using the
+  // WebPreferences setting.
+  if (!delegate->IsJavaScriptAllowed(url) ||
+      !IsJavascriptEnabled(frame_tree_node)) {
+    return;
+  }
+
+  // Only the main frame should parse accept-CH.
+  if (!frame_tree_node->IsMainFrame())
+    return;
+
+  // TODO(morlovich): No browser-side knowledge on what permit_lang_hints should
+  // be, so this is failing shut for now.
+  base::Optional<std::vector<network::mojom::WebClientHintsType>> parsed =
+      blink::FilterAcceptCH(headers->accept_ch.value(),
+                            false /* permit_lang_hints */,
+                            delegate->UserAgentClientHintEnabled());
+  if (!parsed.has_value())
+    return;
+
+  // JSON cannot store "non-finite" values (i.e. NaN or infinite) so
+  // base::TimeDelta::Max cannot be used. As accept-ch-lifetime will be removed
+  // once the FeaturePolicyForClientHints feature is shipped, a reasonably large
+  // value was chosen instead.
+  delegate->PersistClientHints(url::Origin::Create(url), parsed.value(),
+                               base::TimeDelta::FromDays(1000000));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/client_hints/client_hints.h b/chromium/content/browser/client_hints/client_hints.h
index a7244947cfd..e9344bbb141 100644
--- a/chromium/content/browser/client_hints/client_hints.h
+++ b/chromium/content/browser/client_hints/client_hints.h
@@ -10,6 +10,7 @@
 
 #include "content/public/browser/client_hints_controller_delegate.h"
 #include "net/http/http_request_headers.h"
+#include "services/network/public/mojom/parsed_headers.mojom-forward.h"
 
 class BrowserContext;
 class FrameTreeNode;
@@ -29,15 +30,30 @@ CONTENT_EXPORT double RoundKbpsToMbpsForTesting(
     const std::string& host,
     const base::Optional<int32_t>& downlink_kbps);
 
+// Updates the user agent client hint headers. This is called if the value of
+// |override_ua| changes after the NavigationRequest was created.
+CONTENT_EXPORT void UpdateNavigationRequestClientUaHeaders(
+    const GURL& url,
+    ClientHintsControllerDelegate* delegate,
+    bool override_ua,
+    FrameTreeNode* frame_tree_node,
+    net::HttpRequestHeaders* headers);
+
 CONTENT_EXPORT void AddNavigationRequestClientHintsHeaders(
     const GURL& url,
     net::HttpRequestHeaders* headers,
     BrowserContext* context,
-    bool javascript_enabled,
     ClientHintsControllerDelegate* delegate,
     bool is_ua_override_on,
     FrameTreeNode*);
 
+CONTENT_EXPORT void PersistAcceptCHAfterNagivationRequestRedirect(
+    const GURL& url,
+    const ::network::mojom::ParsedHeadersPtr& headers,
+    BrowserContext* context,
+    ClientHintsControllerDelegate* delegate,
+    FrameTreeNode*);
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_CLIENT_HINTS_CLIENT_HINTS_H_
diff --git a/chromium/content/browser/client_hints/client_hints_unittest.cc b/chromium/content/browser/client_hints/client_hints_unittest.cc
index edefbc2d004..c11eb083c34 100644
--- a/chromium/content/browser/client_hints/client_hints_unittest.cc
+++ b/chromium/content/browser/client_hints/client_hints_unittest.cc
@@ -10,17 +10,7 @@
 
 namespace content {
 
-class ClientHintsTest : public testing::Test {
- public:
-  ClientHintsTest() {}
-
-  ~ClientHintsTest() override {}
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(ClientHintsTest);
-};
-
-TEST_F(ClientHintsTest, RttRoundedOff) {
+TEST(ClientHintsTest, RttRoundedOff) {
   EXPECT_EQ(
       0u, RoundRttForTesting("", base::TimeDelta::FromMilliseconds(1023)) % 50);
   EXPECT_EQ(
@@ -38,7 +28,7 @@ TEST_F(ClientHintsTest, RttRoundedOff) {
               50);
 }
 
-TEST_F(ClientHintsTest, DownlinkRoundedOff) {
+TEST(ClientHintsTest, DownlinkRoundedOff) {
   EXPECT_GE(1,
             static_cast<int>(RoundKbpsToMbpsForTesting("", 102) * 1000) % 50);
   EXPECT_GE(1, static_cast<int>(RoundKbpsToMbpsForTesting("", 12) * 1000) % 50);
@@ -64,7 +54,7 @@ TEST_F(ClientHintsTest, DownlinkRoundedOff) {
 // RTT and the original value may be slightly more than 10% due to rounding off.
 // To handle that, the maximum absolute difference allowed is set to a value
 // slightly larger than 10% of the original metric value.
-TEST_F(ClientHintsTest, FinalRttWithin10PercentValue) {
+TEST(ClientHintsTest, FinalRttWithin10PercentValue) {
   EXPECT_NEAR(98, RoundRttForTesting("", base::TimeDelta::FromMilliseconds(98)),
               100);
   EXPECT_NEAR(1023,
@@ -83,7 +73,7 @@ TEST_F(ClientHintsTest, FinalRttWithin10PercentValue) {
 // of downlink and the original value may be slightly more than 10% due to
 // rounding off. To handle that, the maximum absolute difference allowed is set
 // to a value slightly larger than 10% of the original metric value.
-TEST_F(ClientHintsTest, FinalDownlinkWithin10PercentValue) {
+TEST(ClientHintsTest, FinalDownlinkWithin10PercentValue) {
   EXPECT_NEAR(0.098, RoundKbpsToMbpsForTesting("", 98), 0.1);
   EXPECT_NEAR(1.023, RoundKbpsToMbpsForTesting("", 1023), 0.2);
   EXPECT_NEAR(1.193, RoundKbpsToMbpsForTesting("", 1193), 0.2);
@@ -91,7 +81,7 @@ TEST_F(ClientHintsTest, FinalDownlinkWithin10PercentValue) {
   EXPECT_NEAR(9.999, RoundKbpsToMbpsForTesting("", 9999), 1.2);
 }
 
-TEST_F(ClientHintsTest, RttMaxValue) {
+TEST(ClientHintsTest, RttMaxValue) {
   EXPECT_GE(3000u,
             RoundRttForTesting("", base::TimeDelta::FromMilliseconds(1023)));
   EXPECT_GE(3000u,
@@ -106,7 +96,7 @@ TEST_F(ClientHintsTest, RttMaxValue) {
       0u, RoundRttForTesting("", base::TimeDelta::FromMilliseconds(6023)) % 50);
 }
 
-TEST_F(ClientHintsTest, DownlinkMaxValue) {
+TEST(ClientHintsTest, DownlinkMaxValue) {
   EXPECT_GE(10.0, RoundKbpsToMbpsForTesting("", 102));
   EXPECT_GE(10.0, RoundKbpsToMbpsForTesting("", 2102));
   EXPECT_GE(10.0, RoundKbpsToMbpsForTesting("", 100102));
@@ -118,7 +108,7 @@ TEST_F(ClientHintsTest, DownlinkMaxValue) {
       1, static_cast<int>(RoundKbpsToMbpsForTesting("", 100102) * 1000) % 50);
 }
 
-TEST_F(ClientHintsTest, RttRandomized) {
+TEST(ClientHintsTest, RttRandomized) {
   const int initial_value = RoundRttForTesting(
       "example.com", base::TimeDelta::FromMilliseconds(1023));
   bool network_quality_randomized_by_host = false;
@@ -143,7 +133,7 @@ TEST_F(ClientHintsTest, RttRandomized) {
   }
 }
 
-TEST_F(ClientHintsTest, DownlinkRandomized) {
+TEST(ClientHintsTest, DownlinkRandomized) {
   const int initial_value = RoundKbpsToMbpsForTesting("example.com", 1023);
   bool network_quality_randomized_by_host = false;
   // There is a 1/20 chance that the same random noise is selected for two
diff --git a/chromium/content/browser/code_cache/generated_code_cache.cc b/chromium/content/browser/code_cache/generated_code_cache.cc
index dda24dffef8..dd5c28f9250 100644
--- a/chromium/content/browser/code_cache/generated_code_cache.cc
+++ b/chromium/content/browser/code_cache/generated_code_cache.cc
@@ -4,7 +4,9 @@
 
 #include "content/browser/code_cache/generated_code_cache.h"
 #include "base/bind.h"
+#include "base/feature_list.h"
 #include "base/memory/ptr_util.h"
+#include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "content/public/common/url_constants.h"
@@ -93,6 +95,20 @@ constexpr size_t kSmallDataLimit = 4096;
 // the hash, enabling a two stage lookup.
 constexpr size_t kLargeDataLimit = 64 * 1024;
 
+// crbug.com/936107: This is a study to determine a good size threshold to
+// deduplicate JS and WebAssembly cache entries.
+// TODO(bbudge): Remove this after the study finishes.
+constexpr base::Feature kCodeCacheDeduplicationStudy{
+    "CodeCacheDeduplicationStudy", base::FEATURE_DISABLED_BY_DEFAULT};
+constexpr base::FeatureParam<int> kCodeCacheDeduplicationThreshold{
+    &kCodeCacheDeduplicationStudy, "size", kLargeDataLimit};
+
+size_t GetLargeDataLimit() {
+  // The large data limit should be greater than or equal to kSmallDataLimit.
+  return std::max(kSmallDataLimit, base::saturated_cast<size_t>(
+                                       kCodeCacheDeduplicationThreshold.Get()));
+}
+
 // Checks that the header data in the small buffer is valid. We may read cache
 // entries that were written by a previous version of Chrome which use obsolete
 // formats. These reads should fail and be doomed as soon as possible.
@@ -105,7 +121,7 @@ bool IsValidHeader(scoped_refptr<net::IOBufferWithSize> small_buffer) {
          kDataSizeInBytes);
   if (data_size <= kSmallDataLimit)
     return buffer_size == kHeaderSizeInBytes + data_size;
-  if (data_size <= kLargeDataLimit)
+  if (data_size <= GetLargeDataLimit())
     return buffer_size == kHeaderSizeInBytes;
   return buffer_size == kHeaderSizeInBytes + kSHAKeySizeInBytes;
 }
@@ -353,7 +369,7 @@ void GeneratedCodeCache::WriteEntry(const GURL& url,
     memcpy(small_buffer->data() + kHeaderSizeInBytes, data.data(), data.size());
     // Write 0 bytes and truncate stream 1 to clear any stale data.
     large_buffer = base::MakeRefCounted<BigIOBuffer>(mojo_base::BigBuffer());
-  } else if (data_size <= kLargeDataLimit) {
+  } else if (data_size <= GetLargeDataLimit()) {
     // 2. Large
     // [stream0] response time, size
     // [stream1] data
@@ -737,7 +753,7 @@ void GeneratedCodeCache::ReadComplete(PendingOperation* op) {
         memcpy(data.data(), op->small_buffer()->data() + kHeaderSizeInBytes,
                data_size);
         op->TakeReadCallback().Run(response_time, std::move(data));
-      } else if (data_size <= kLargeDataLimit) {
+      } else if (data_size <= GetLargeDataLimit()) {
         // Large data below the merging threshold. Return the large buffer.
         op->TakeReadCallback().Run(response_time,
                                    op->large_buffer()->TakeBuffer());
diff --git a/chromium/content/browser/compositor/image_transport_factory.cc b/chromium/content/browser/compositor/image_transport_factory.cc
index 8687663cc9a..25ef79a711a 100644
--- a/chromium/content/browser/compositor/image_transport_factory.cc
+++ b/chromium/content/browser/compositor/image_transport_factory.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/compositor/image_transport_factory.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 
 namespace content {
 namespace {
diff --git a/chromium/content/browser/compositor/image_transport_factory_browsertest.cc b/chromium/content/browser/compositor/image_transport_factory_browsertest.cc
index a8c9e9aae4b..020a5d914bb 100644
--- a/chromium/content/browser/compositor/image_transport_factory_browsertest.cc
+++ b/chromium/content/browser/compositor/image_transport_factory_browsertest.cc
@@ -9,6 +9,7 @@
 #include "components/viz/common/gpu/context_lost_observer.h"
 #include "components/viz/common/gpu/context_provider.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "gpu/command_buffer/client/gles2_interface.h"
diff --git a/chromium/content/browser/compositor/viz_process_transport_factory.cc b/chromium/content/browser/compositor/viz_process_transport_factory.cc
index 8e10af98f2b..69e54c41c61 100644
--- a/chromium/content/browser/compositor/viz_process_transport_factory.cc
+++ b/chromium/content/browser/compositor/viz_process_transport_factory.cc
@@ -305,7 +305,7 @@ void VizProcessTransportFactory::DisableGpuCompositing(
     LOG(FATAL) << "Software compositing fallback is unavailable. Goodbye.";
   }
 
-  DLOG(ERROR) << "Switching to software compositing.";
+  DVLOG(1) << "Switching to software compositing.";
 
   is_gpu_compositing_disabled_ = true;
 
@@ -428,6 +428,8 @@ void VizProcessTransportFactory::OnEstablishedGpuChannel(
 
   root_params->use_preferred_interval_for_video =
       features::IsUsingPreferredIntervalForVideo();
+  root_params->num_of_frames_to_toggle_interval =
+      features::NumOfFramesToToggleInterval();
 
   // Connects the viz process end of CompositorFrameSink message pipes. The
   // browser compositor may request a new CompositorFrameSink on context loss,
@@ -453,6 +455,17 @@ void VizProcessTransportFactory::OnEstablishedGpuChannel(
     compositor->SetExternalBeginFrameController(
         compositor_data.external_begin_frame_controller.get());
   }
+
+#if defined(OS_WIN)
+  // Windows using the ANGLE D3D backend for compositing needs to disable swap
+  // on resize to avoid D3D scaling the framebuffer texture. This isn't a
+  // problem with software compositing or ANGLE D3D with direct composition.
+  bool using_angle_d3d_compositing =
+      gpu_compositing && !GpuDataManagerImpl::GetInstance()
+                              ->GetGPUInfo()
+                              .overlay_info.direct_composition;
+  compositor->SetShouldDisableSwapUntilResize(using_angle_d3d_compositing);
+#endif
 }
 
 gpu::ContextResult
diff --git a/chromium/content/browser/contacts/contacts_manager_impl.cc b/chromium/content/browser/contacts/contacts_manager_impl.cc
index 438ddb32364..56a59876af9 100644
--- a/chromium/content/browser/contacts/contacts_manager_impl.cc
+++ b/chromium/content/browser/contacts/contacts_manager_impl.cc
@@ -12,6 +12,7 @@
 #include "build/build_config.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/contacts_picker_properties_requested.h"
+#include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/metrics/public/cpp/metrics_utils.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
@@ -70,7 +71,7 @@ ContactsManagerImpl::ContactsManagerImpl(RenderFrameHostImpl* render_frame_host)
   if (!web_contents || !web_contents->GetTopLevelNativeWindow())
     return;
 
-  source_id_ = web_contents->GetLastCommittedSourceId();
+  source_id_ = render_frame_host->GetPageUkmSourceId();
 }
 
 ContactsManagerImpl::~ContactsManagerImpl() = default;
diff --git a/chromium/content/browser/content_index/content_index_browsertest.cc b/chromium/content/browser/content_index/content_index_browsertest.cc
index b9f6d5680cb..8e1dc192e3f 100644
--- a/chromium/content/browser/content_index/content_index_browsertest.cc
+++ b/chromium/content/browser/content_index/content_index_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/content_service_browsertest.cc b/chromium/content/browser/content_service_browsertest.cc
index 6ef66559728..91947ca29b5 100644
--- a/chromium/content/browser/content_service_browsertest.cc
+++ b/chromium/content/browser/content_service_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "mojo/public/cpp/bindings/remote.h"
diff --git a/chromium/content/browser/context_factory.cc b/chromium/content/browser/context_factory.cc
index 18ca486983f..4f4028efd26 100644
--- a/chromium/content/browser/context_factory.cc
+++ b/chromium/content/browser/context_factory.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/context_factory.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/browser/compositor/image_transport_factory.h"
 
 namespace content {
diff --git a/chromium/content/browser/conversions/BUILD.gn b/chromium/content/browser/conversions/BUILD.gn
new file mode 100644
index 00000000000..6d722613e99
--- /dev/null
+++ b/chromium/content/browser/conversions/BUILD.gn
@@ -0,0 +1,10 @@
+# Copyright 2020 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//mojo/public/tools/bindings/mojom.gni")
+
+mojom("mojo_bindings") {
+  sources = [ "conversion_internals.mojom" ]
+  public_deps = [ "//url/mojom:url_mojom_origin" ]
+}
diff --git a/chromium/content/browser/conversions/OWNERS b/chromium/content/browser/conversions/OWNERS
index 7f1bf1a18d0..b716879726c 100644
--- a/chromium/content/browser/conversions/OWNERS
+++ b/chromium/content/browser/conversions/OWNERS
@@ -1,5 +1,8 @@
 csharrison@chromium.org
 johnidel@chromium.org
 
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+
 # TEAM: privacy-sandbox-dev@chromium.org
 # COMPONENT: Internals>ConversionMeasurement
diff --git a/chromium/content/browser/conversions/conversion_host.cc b/chromium/content/browser/conversions/conversion_host.cc
index ec917fabbb2..0a695271ca4 100644
--- a/chromium/content/browser/conversions/conversion_host.cc
+++ b/chromium/content/browser/conversions/conversion_host.cc
@@ -6,32 +6,180 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check.h"
+#include "base/memory/ptr_util.h"
 #include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
+#include "content/browser/conversions/conversion_page_metrics.h"
 #include "content/browser/conversions/conversion_policy.h"
-#include "content/browser/conversions/storable_conversion.h"
+#include "content/browser/frame_host/frame_tree.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "services/network/public/cpp/is_potentially_trustworthy.h"
+#include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "url/origin.h"
 
 namespace content {
 
-ConversionHost::ConversionHost(WebContents* contents)
-    : web_contents_(contents), receiver_(contents, this) {}
+namespace {
 
-ConversionHost::~ConversionHost() = default;
+// Abstraction that wraps an iterator to a map. When this goes out of the scope,
+// the underlying iterator is erased from the map. This is useful for control
+// flows where map cleanup needs to occur regardless of additional early exit
+// logic.
+template <typename Map>
+class ScopedMapDeleter {
+ public:
+  ScopedMapDeleter(Map* map, const typename Map::key_type& key)
+      : map_(map), it_(map_->find(key)) {}
+  ~ScopedMapDeleter() {
+    if (*this)
+      map_->erase(it_);
+  }
+
+  typename Map::iterator* get() { return &it_; }
+
+  explicit operator bool() const { return it_ != map_->end(); }
+
+ private:
+  Map* map_;
+  typename Map::iterator it_;
+};
+
+}  // namespace
+
+// static
+std::unique_ptr<ConversionHost> ConversionHost::CreateForTesting(
+    WebContents* web_contents,
+    std::unique_ptr<ConversionManager::Provider> conversion_manager_provider) {
+  return base::WrapUnique(
+      new ConversionHost(web_contents, std::move(conversion_manager_provider)));
+}
+
+ConversionHost::ConversionHost(WebContents* web_contents)
+    : ConversionHost(web_contents,
+                     std::make_unique<ConversionManagerProviderImpl>()) {}
+
+ConversionHost::ConversionHost(
+    WebContents* web_contents,
+    std::unique_ptr<ConversionManager::Provider> conversion_manager_provider)
+    : WebContentsObserver(web_contents),
+      conversion_manager_provider_(std::move(conversion_manager_provider)),
+      receiver_(web_contents, this) {
+  // TODO(csharrison): When https://crbug.com/1051334 is resolved, add a DCHECK
+  // that the kConversionMeasurement feature is enabled.
+}
+
+ConversionHost::~ConversionHost() {
+  DCHECK_EQ(0u, navigation_impression_origins_.size());
+}
+
+void ConversionHost::DidStartNavigation(NavigationHandle* navigation_handle) {
+  // Navigations with an impression set should only occur in the main frame.
+  if (!navigation_handle->GetImpression() ||
+      !navigation_handle->IsInMainFrame() ||
+      !conversion_manager_provider_->GetManager(web_contents())) {
+    return;
+  }
+
+  RenderFrameHostImpl* initiator_frame_host =
+      RenderFrameHostImpl::FromID(navigation_handle->GetInitiatorRoutingId());
+
+  // The initiator frame host may be deleted by this point. In that case, ignore
+  // this navigation and drop the impression associated with it.
+  // TODO(https://crbug.com/1056907): Record metrics on how often impressions
+  // are dropped because the initiator is destroyed.
+  if (!initiator_frame_host)
+    return;
+
+  // Look up the initiator root's origin which will be used as the impression
+  // origin. This works because we won't update the origin for the initiator RFH
+  // until we receive confirmation from the renderer that it has committed.
+  // Since frame mutation is all serialized on the Blink main thread, we get an
+  // implicit ordering: a navigation with an impression attached won't be
+  // processed after a navigation commit in the initiator RFH, so reading the
+  // origin off is safe at the start of the navigation.
+  const url::Origin& initiator_root_frame_origin =
+      initiator_frame_host->frame_tree_node()
+          ->frame_tree()
+          ->root()
+          ->current_origin();
+  navigation_impression_origins_.emplace(navigation_handle->GetNavigationId(),
+                                         initiator_root_frame_origin);
+}
+
+void ConversionHost::DidFinishNavigation(NavigationHandle* navigation_handle) {
+  ConversionManager* conversion_manager =
+      conversion_manager_provider_->GetManager(web_contents());
+  if (!conversion_manager) {
+    DCHECK(navigation_impression_origins_.empty());
+    return;
+  }
+
+  ScopedMapDeleter<NavigationImpressionOriginMap> it(
+      &navigation_impression_origins_, navigation_handle->GetNavigationId());
+
+  // If an impression is not associated with a main frame navigation, ignore it.
+  // If the navigation did not commit, committed to a Chrome error page, or was
+  // same document, ignore it. Impressions should never be attached to
+  // same-document navigations but can be the result of a bad renderer.
+  if (!navigation_handle->IsInMainFrame() ||
+      !navigation_handle->HasCommitted() || navigation_handle->IsErrorPage() ||
+      navigation_handle->IsSameDocument()) {
+    return;
+  }
+
+  conversion_page_metrics_ = std::make_unique<ConversionPageMetrics>();
+
+  // If we were not able to access the impression origin, ignore the navigation.
+  if (!it)
+    return;
+  url::Origin impression_origin = std::move((*it.get())->second);
+  DCHECK(navigation_handle->GetImpression());
+  const Impression& impression = *(navigation_handle->GetImpression());
+
+  // If the impression's conversion destination does not match the final top
+  // frame origin of this new navigation ignore it.
+  if (impression.conversion_destination !=
+      navigation_handle->GetRenderFrameHost()->GetLastCommittedOrigin()) {
+    return;
+  }
+
+  // Convert |impression| into a StorableImpression that can be forwarded to
+  // storage. If a reporting origin was not provided, default to the conversion
+  // destination for reporting.
+  const url::Origin& reporting_origin = !impression.reporting_origin
+                                            ? impression_origin
+                                            : *impression.reporting_origin;
+
+  // Conversion measurement is only allowed in secure contexts.
+  if (!network::IsOriginPotentiallyTrustworthy(impression_origin) ||
+      !network::IsOriginPotentiallyTrustworthy(reporting_origin) ||
+      !network::IsOriginPotentiallyTrustworthy(
+          impression.conversion_destination)) {
+    // TODO (1049654): This should log a console error when it occurs.
+    return;
+  }
+
+  base::Time impression_time = base::Time::Now();
+  const ConversionPolicy& policy = conversion_manager->GetConversionPolicy();
+  StorableImpression storable_impression(
+      policy.GetSanitizedImpressionData(impression.impression_data),
+      impression_origin, impression.conversion_destination, reporting_origin,
+      impression_time,
+      policy.GetExpiryTimeForImpression(impression.expiry, impression_time),
+      /*impression_id=*/base::nullopt);
+
+  conversion_manager->HandleImpression(storable_impression);
+}
 
-// TODO(https://crbug.com/1044099): Limit the number of conversion redirects per
-// page-load to a reasonable number.
 void ConversionHost::RegisterConversion(
     blink::mojom::ConversionPtr conversion) {
-  // If there is no conversion manager available, ignore any conversion
-  // registrations.
-  if (!GetManager())
-    return;
   content::RenderFrameHost* render_frame_host =
       receiver_.GetCurrentTargetFrame();
 
@@ -42,6 +190,13 @@ void ConversionHost::RegisterConversion(
     return;
   }
 
+  // If there is no conversion manager available, ignore any conversion
+  // registrations.
+  ConversionManager* conversion_manager =
+      conversion_manager_provider_->GetManager(web_contents());
+  if (!conversion_manager)
+    return;
+
   // Only allow conversion registration on secure pages with a secure conversion
   // redirects.
   if (!network::IsOriginPotentiallyTrustworthy(
@@ -54,12 +209,14 @@ void ConversionHost::RegisterConversion(
   }
 
   StorableConversion storable_conversion(
-      GetManager()->GetConversionPolicy().GetSanitizedConversionData(
+      conversion_manager->GetConversionPolicy().GetSanitizedConversionData(
           conversion->conversion_data),
       render_frame_host->GetLastCommittedOrigin(),
       conversion->reporting_origin);
 
-  GetManager()->HandleConversion(storable_conversion);
+  if (conversion_page_metrics_)
+    conversion_page_metrics_->OnConversion(storable_conversion);
+  conversion_manager->HandleConversion(storable_conversion);
 }
 
 void ConversionHost::SetCurrentTargetFrameForTesting(
@@ -67,11 +224,4 @@ void ConversionHost::SetCurrentTargetFrameForTesting(
   receiver_.SetCurrentTargetFrameForTesting(render_frame_host);
 }
 
-ConversionManager* ConversionHost::GetManager() {
-  return static_cast<StoragePartitionImpl*>(
-             BrowserContext::GetDefaultStoragePartition(
-                 web_contents_->GetBrowserContext()))
-      ->GetConversionManager();
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_host.h b/chromium/content/browser/conversions/conversion_host.h
index 468fa6b5b75..169c08a8042 100644
--- a/chromium/content/browser/conversions/conversion_host.h
+++ b/chromium/content/browser/conversions/conversion_host.h
@@ -5,21 +5,32 @@
 #ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_HOST_H_
 #define CONTENT_BROWSER_CONVERSIONS_CONVERSION_HOST_H_
 
+#include <memory>
+
+#include "base/containers/flat_map.h"
 #include "base/gtest_prod_util.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_contents_receiver_set.h"
 #include "third_party/blink/public/mojom/conversions/conversions.mojom.h"
 
 namespace content {
 
-class ConversionManager;
+class ConversionPageMetrics;
 class RenderFrameHost;
 class WebContents;
 
 // Class responsible for listening to conversion events originating from blink,
 // and verifying that they are valid. Owned by the WebContents. Lifetime is
 // bound to lifetime of the WebContents.
-class CONTENT_EXPORT ConversionHost : public blink::mojom::ConversionHost {
+class CONTENT_EXPORT ConversionHost : public WebContentsObserver,
+                                      public blink::mojom::ConversionHost {
  public:
+  static std::unique_ptr<ConversionHost> CreateForTesting(
+      WebContents* web_contents,
+      std::unique_ptr<ConversionManager::Provider> conversion_manager_provider);
+
   explicit ConversionHost(WebContents* web_contents);
   ConversionHost(const ConversionHost& other) = delete;
   ConversionHost& operator=(const ConversionHost& other) = delete;
@@ -32,17 +43,47 @@ class CONTENT_EXPORT ConversionHost : public blink::mojom::ConversionHost {
   FRIEND_TEST_ALL_PREFIXES(ConversionHostTest,
                            ConversionWithInsecureReportingOrigin_BadMessage);
   FRIEND_TEST_ALL_PREFIXES(ConversionHostTest, ValidConversion_NoBadMessage);
+  FRIEND_TEST_ALL_PREFIXES(ConversionHostTest, PerPageConversionMetrics);
+  FRIEND_TEST_ALL_PREFIXES(ConversionHostTest,
+                           NoManager_NoPerPageConversionMetrics);
+
+  ConversionHost(
+      WebContents* web_contents,
+      std::unique_ptr<ConversionManager::Provider> conversion_manager_provider);
 
   // blink::mojom::ConversionHost:
   void RegisterConversion(blink::mojom::ConversionPtr conversion) override;
 
+  // WebContentsObserver:
+  void DidStartNavigation(NavigationHandle* navigation_handle) override;
+  void DidFinishNavigation(NavigationHandle* navigation_handle) override;
+
   // Sets the target frame on |receiver_|.
   void SetCurrentTargetFrameForTesting(RenderFrameHost* render_frame_host);
 
-  // Gets the manager for this web contents. Can be null.
-  ConversionManager* GetManager();
+  // Map which stores the top-frame origin an impression occurred on for all
+  // navigations with an associated impression, keyed by navigation ID.
+  // Initiator origins are stored at navigation start time to have the best
+  // chance of catching the initiating frame before it has a chance to go away.
+  // Storing the origins at navigation start also prevents cases where a frame
+  // initiates a navigation for itself, causing the frame to be correct but not
+  // representing the frame state at the time the navigation was initiated. They
+  // are stored until DidFinishNavigation, when they can be matched up with an
+  // impression.
+  //
+  // A flat_map is used as the number of ongoing impression navigations is
+  // expected to be very small in a given WebContents.
+  using NavigationImpressionOriginMap = base::flat_map<int64_t, url::Origin>;
+  NavigationImpressionOriginMap navigation_impression_origins_;
+
+  // Gives access to a ConversionManager implementation to forward impressions
+  // and conversion registrations to.
+  std::unique_ptr<ConversionManager::Provider> conversion_manager_provider_;
 
-  WebContents* web_contents_;
+  // Logs metrics per top-level page load. Created for every top level
+  // navigation that commits, as long as there is a ConversionManager.
+  // Excludes the initial about:blank document.
+  std::unique_ptr<ConversionPageMetrics> conversion_page_metrics_;
 
   WebContentsFrameReceiverSet<blink::mojom::ConversionHost> receiver_;
 };
diff --git a/chromium/content/browser/conversions/conversion_host_unittest.cc b/chromium/content/browser/conversions/conversion_host_unittest.cc
index 255587e9365..2769ef893d8 100644
--- a/chromium/content/browser/conversions/conversion_host_unittest.cc
+++ b/chromium/content/browser/conversions/conversion_host_unittest.cc
@@ -6,31 +6,51 @@
 
 #include <memory>
 
+#include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_test_utils.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/test_renderer_host.h"
 #include "content/test/fake_mojo_message_dispatch_context.h"
+#include "content/test/navigation_simulator_impl.h"
 #include "content/test/test_render_frame_host.h"
 #include "content/test/test_web_contents.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/conversions/conversions.mojom.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
 namespace content {
 
+namespace {
+
+const char kConversionUrl[] = "https://b.com";
+
+Impression CreateValidImpression() {
+  Impression result;
+  result.conversion_destination = url::Origin::Create(GURL(kConversionUrl));
+  result.reporting_origin = url::Origin::Create(GURL("https://c.com"));
+  result.impression_data = 1UL;
+  return result;
+}
+
+}  // namespace
+
 class ConversionHostTest : public RenderViewHostTestHarness {
  public:
-  ConversionHostTest() {
-    feature_list_.InitAndEnableFeature(features::kConversionMeasurement);
-  }
+  ConversionHostTest() = default;
 
   void SetUp() override {
     RenderViewHostTestHarness::SetUp();
     static_cast<WebContentsImpl*>(web_contents())
         ->RemoveReceiverSetForTesting(blink::mojom::ConversionHost::Name_);
-    conversion_host_ = std::make_unique<ConversionHost>(web_contents());
+
+    conversion_host_ = ConversionHost::CreateForTesting(
+        web_contents(), std::make_unique<TestManagerProvider>(&test_manager_));
     contents()->GetMainFrame()->InitializeRenderFrameIfNeeded();
   }
 
@@ -40,8 +60,10 @@ class ConversionHostTest : public RenderViewHostTestHarness {
 
   ConversionHost* conversion_host() { return conversion_host_.get(); }
 
+ protected:
+  TestConversionManager test_manager_;
+
  private:
-  base::test::ScopedFeatureList feature_list_;
   std::unique_ptr<ConversionHost> conversion_host_;
 };
 
@@ -64,6 +86,7 @@ TEST_F(ConversionHostTest, ConversionInSubframe_BadMessage) {
   conversion_host()->RegisterConversion(std::move(conversion));
   EXPECT_EQ("blink.mojom.ConversionHost can only be used by the main frame.",
             bad_message_observer.WaitForBadMessage());
+  EXPECT_EQ(0u, test_manager_.num_conversions());
 }
 
 TEST_F(ConversionHostTest, ConversionOnInsecurePage_BadMessage) {
@@ -83,6 +106,7 @@ TEST_F(ConversionHostTest, ConversionOnInsecurePage_BadMessage) {
       "blink.mojom.ConversionHost can only be used in secure contexts with a "
       "secure conversion registration origin.",
       bad_message_observer.WaitForBadMessage());
+  EXPECT_EQ(0u, test_manager_.num_conversions());
 }
 
 TEST_F(ConversionHostTest, ConversionWithInsecureReportingOrigin_BadMessage) {
@@ -101,14 +125,15 @@ TEST_F(ConversionHostTest, ConversionWithInsecureReportingOrigin_BadMessage) {
       "blink.mojom.ConversionHost can only be used in secure contexts with a "
       "secure conversion registration origin.",
       bad_message_observer.WaitForBadMessage());
+  EXPECT_EQ(0u, test_manager_.num_conversions());
 }
 
 TEST_F(ConversionHostTest, ValidConversion_NoBadMessage) {
-  // Create a page with an insecure origin.
+  // Create a page with a secure origin.
   contents()->NavigateAndCommit(GURL("https://www.example.com"));
   conversion_host()->SetCurrentTargetFrameForTesting(main_rfh());
 
-  // Create a fake dispatch context to trigger a bad message in.
+  // Create a fake dispatch context to listen for bad messages.
   FakeMojoMessageDispatchContext fake_dispatch_context;
   mojo::test::BadMessageObserver bad_message_observer;
 
@@ -121,6 +146,213 @@ TEST_F(ConversionHostTest, ValidConversion_NoBadMessage) {
   // triggered.
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(bad_message_observer.got_bad_message());
+  EXPECT_EQ(1u, test_manager_.num_conversions());
+}
+
+TEST_F(ConversionHostTest, PerPageConversionMetrics) {
+  base::HistogramTester histograms;
+
+  contents()->NavigateAndCommit(GURL("https://www.example.com"));
+
+  // Initial document should not log metrics.
+  histograms.ExpectTotalCount("Conversions.RegisteredConversionsPerPage", 0);
+
+  conversion_host()->SetCurrentTargetFrameForTesting(main_rfh());
+  blink::mojom::ConversionPtr conversion = blink::mojom::Conversion::New();
+  conversion->reporting_origin =
+      url::Origin::Create(GURL("https://secure.com"));
+
+  for (size_t i = 0u; i < 8u; i++) {
+    conversion_host()->RegisterConversion(conversion->Clone());
+    EXPECT_EQ(1u, test_manager_.num_conversions());
+    test_manager_.Reset();
+  }
+
+  // Same document navs should not reset the counter.
+  contents()->NavigateAndCommit(GURL("https://www.example.com#hash"));
+  histograms.ExpectTotalCount("Conversions.RegisteredConversionsPerPage", 0);
+
+  // Re-navigating should reset the counter.
+  contents()->NavigateAndCommit(GURL("https://www.example-next.com"));
+  histograms.ExpectUniqueSample("Conversions.RegisteredConversionsPerPage", 8,
+                                1);
+}
+
+TEST_F(ConversionHostTest, NoManager_NoPerPageConversionMetrics) {
+  // Replace the ConversionHost on the WebContents with one that is backed by a
+  // null ConversionManager.
+  static_cast<WebContentsImpl*>(web_contents())
+      ->RemoveReceiverSetForTesting(blink::mojom::ConversionHost::Name_);
+  auto conversion_host = ConversionHost::CreateForTesting(
+      web_contents(), std::make_unique<TestManagerProvider>(nullptr));
+  contents()->NavigateAndCommit(GURL("https://www.example.com"));
+
+  base::HistogramTester histograms;
+  conversion_host->SetCurrentTargetFrameForTesting(main_rfh());
+  blink::mojom::ConversionPtr conversion = blink::mojom::Conversion::New();
+  conversion->reporting_origin =
+      url::Origin::Create(GURL("https://secure.com"));
+  conversion_host->RegisterConversion(std::move(conversion));
+
+  // Navigate again to trigger histogram code.
+  contents()->NavigateAndCommit(GURL("https://www.example-next.com"));
+  histograms.ExpectBucketCount("Conversions.RegisteredConversionsPerPage", 1,
+                               0);
+}
+
+TEST_F(ConversionHostTest, NavigationWithNoImpression_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+  NavigationSimulatorImpl::NavigateAndCommitFromDocument(GURL(kConversionUrl),
+                                                         main_rfh());
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest, ValidImpression_ForwardedToManager) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), main_rfh());
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Commit();
+
+  EXPECT_EQ(1u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest, ImpressionWithNoManagerAvilable_NoCrash) {
+  // Replace the ConversionHost on the WebContents with one that is backed by a
+  // null ConversionManager.
+  static_cast<WebContentsImpl*>(web_contents())
+      ->RemoveReceiverSetForTesting(blink::mojom::ConversionHost::Name_);
+  auto conversion_host = ConversionHost::CreateForTesting(
+      web_contents(), std::make_unique<TestManagerProvider>(nullptr));
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), main_rfh());
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Commit();
+}
+
+TEST_F(ConversionHostTest, ImpressionInSubframe_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+
+  // Create a subframe and use it as a target for the conversion registration
+  // mojo.
+  content::RenderFrameHostTester* rfh_tester =
+      content::RenderFrameHostTester::For(main_rfh());
+  content::RenderFrameHost* subframe = rfh_tester->AppendChild("subframe");
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), subframe);
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Commit();
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+// Test that if we cannot access the initiator frame of the navigation, we
+// ignore the associated impression.
+TEST_F(ConversionHostTest, ImpressionNavigationWithDeadInitiator_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Commit();
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest, ImpressionNavigationCommitsToErrorPage_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), main_rfh());
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Fail(net::ERR_FAILED);
+  navigation->CommitErrorPage();
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest, ImpressionNavigationAborts_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL(kConversionUrl), main_rfh());
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->AbortCommit();
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest,
+       CommittedOriginDiffersFromConversionDesintation_Ignored) {
+  contents()->NavigateAndCommit(GURL("https://secure_impression.com"));
+
+  auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+      GURL("https://different.com"), main_rfh());
+  navigation->SetInitiatorFrame(main_rfh());
+  navigation->set_impression(CreateValidImpression());
+  navigation->Commit();
+
+  EXPECT_EQ(0u, test_manager_.num_impressions());
+}
+
+TEST_F(ConversionHostTest,
+       ImpressionNavigation_OriginTrustworthyChecksPerformed) {
+  const char kLocalHost[] = "http://localhost";
+
+  struct {
+    std::string impression_origin;
+    std::string conversion_origin;
+    std::string reporting_origin;
+    bool impression_expected;
+  } kTestCases[] = {
+      {kLocalHost /* impression_origin */, kLocalHost /* conversion_origin */,
+       kLocalHost /* reporting_origin */, true /* impression_expected */},
+      {"http://127.0.0.1" /* impression_origin */,
+       "http://127.0.0.1" /* conversion_origin */,
+       "http://127.0.0.1" /* reporting_origin */,
+       true /* impression_expected */},
+      {kLocalHost /* impression_origin */, kLocalHost /* conversion_origin */,
+       "http://insecure.com" /* reporting_origin */,
+       false /* impression_expected */},
+      {kLocalHost /* impression_origin */,
+       "http://insecure.com" /* conversion_origin */,
+       kLocalHost /* reporting_origin */, false /* impression_expected */},
+      {"http://insecure.com" /* impression_origin */,
+       kLocalHost /* conversion_origin */, kLocalHost /* reporting_origin */,
+       false /* impression_expected */},
+      {"https://secure.com" /* impression_origin */,
+       "https://secure.com" /* conversion_origin */,
+       "https://secure.com" /* reporting_origin */,
+       true /* impression_expected */},
+  };
+
+  for (const auto& test_case : kTestCases) {
+    contents()->NavigateAndCommit(GURL(test_case.impression_origin));
+    auto navigation = NavigationSimulatorImpl::CreateRendererInitiated(
+        GURL(test_case.conversion_origin), main_rfh());
+
+    Impression impression;
+    impression.conversion_destination =
+        url::Origin::Create(GURL(test_case.conversion_origin));
+    impression.reporting_origin =
+        url::Origin::Create(GURL(test_case.reporting_origin));
+    navigation->set_impression(impression);
+    navigation->SetInitiatorFrame(main_rfh());
+    navigation->Commit();
+
+    EXPECT_EQ(test_case.impression_expected, test_manager_.num_impressions())
+        << "For test case: " << test_case.impression_origin << " | "
+        << test_case.conversion_origin << " | " << test_case.reporting_origin;
+    test_manager_.Reset();
+  }
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_internals.mojom b/chromium/content/browser/conversions/conversion_internals.mojom
new file mode 100644
index 00000000000..8bfdeca562c
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals.mojom
@@ -0,0 +1,54 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module mojom;
+
+import "url/mojom/origin.mojom";
+
+// Struct containing stored data that will be sent in a future conversion
+// report.
+struct WebUIConversionReport {
+  string impression_data;
+  string conversion_data;
+  url.mojom.Origin conversion_origin;
+  url.mojom.Origin reporting_origin;
+  double report_time;
+  int32 attribution_credit;
+};
+
+// Struct representing a stored impression that will be displayed by WebUI.
+struct WebUIImpression {
+  string impression_data;
+  url.mojom.Origin impression_origin;
+  url.mojom.Origin conversion_destination;
+  url.mojom.Origin reporting_origin;
+  double impression_time;
+  double expiry_time;
+};
+
+// Mojo interface used for communication between a WebUI and the storage layer
+// for conversion measurement.
+interface ConversionInternalsHandler {
+  // Returns whether conversion measurement is enabled in the browisng context
+  // the WebUI is in.
+  IsMeasurementEnabled() => (bool enabled);
+
+  // Returns all active impressions that are persisted in storage. This does
+  // not include expired impressions, or impressions that can no longer convert
+  // due to reaching policy limits.
+  GetActiveImpressions() => (array<WebUIImpression> impressions);
+
+  // Returns all reports contained in storage, including those that are actively
+  // being sent.
+  GetPendingReports() => (array<WebUIConversionReport> reports);
+
+  // Sends all stored reports, ignoring delay, returning when the
+  // operation has been completed and all reports have been cleared from
+  // storage.
+  SendPendingReports() => ();
+
+  // Deletes all persisted data for the Conversion API, returning when the
+  // operation has been completed.
+  ClearStorage() => ();
+};
\ No newline at end of file
diff --git a/chromium/content/browser/conversions/conversion_internals_browsertest.cc b/chromium/content/browser/conversions/conversion_internals_browsertest.cc
new file mode 100644
index 00000000000..9f88538a1de
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals_browsertest.cc
@@ -0,0 +1,284 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_internals_ui.h"
+
+#include "base/optional.h"
+#include "base/time/time.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/conversion_test_utils.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_controller.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+
+namespace content {
+
+namespace {
+
+const char kConversionInternalsUrl[] = "chrome://conversion-internals/";
+
+const base::string16 kCompleteTitle = base::ASCIIToUTF16("Complete");
+
+}  // namespace
+
+class ConversionInternalsWebUiBrowserTest : public ContentBrowserTest {
+ public:
+  ConversionInternalsWebUiBrowserTest() = default;
+
+  void ClickRefreshButton() {
+    EXPECT_TRUE(ExecJsInWebUI("document.getElementById('refresh').click();"));
+  }
+
+  // Executing javascript in the WebUI requires using an isolated world in which
+  // to execute the script because WebUI has a default CSP policy denying
+  // "eval()", which is what EvalJs uses under the hood.
+  bool ExecJsInWebUI(std::string script) {
+    return ExecJs(shell()->web_contents()->GetMainFrame(), script,
+                  EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */);
+  }
+
+  void OverrideWebUIConversionManager(ConversionManager* manager) {
+    content::WebUI* web_ui = shell()->web_contents()->GetWebUI();
+
+    // Performs a safe downcast to the concrete ConversionInternalsUI subclass.
+    ConversionInternalsUI* conversion_internals_ui =
+        web_ui ? web_ui->GetController()->GetAs<ConversionInternalsUI>()
+               : nullptr;
+    EXPECT_TRUE(conversion_internals_ui);
+    conversion_internals_ui->SetConversionManagerProviderForTesting(
+        std::make_unique<TestManagerProvider>(manager));
+  }
+
+  // Registers a mutation observer that sets the window title to |title| when
+  // the report table is empty.
+  void SetTitleOnReportsTableEmpty(const base::string16& title) {
+    const std::string kObserveEmptyReportsTableScript = R"(
+    let table = document.getElementById("report-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 1 &&
+          table.children[0].children[0].innerText === "No pending reports.") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+    EXPECT_TRUE(
+        ExecJsInWebUI(JsReplace(kObserveEmptyReportsTableScript, title)));
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       NavigationUrl_ResolvedToWebUI) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  // Execute script to ensure the page has loaded correctly, executing similarly
+  // to ExecJsInWebUI().
+  EXPECT_EQ(
+      true,
+      EvalJs(shell()->web_contents()->GetMainFrame(),
+             "document.body.innerHTML.search('Conversion Internals') >= 0;",
+             EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUIShownWithManager_MeasurementConsideredEnabled) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  OverrideWebUIConversionManager(&manager);
+
+  // Create a mutation observer to wait for the content to render to the dom.
+  // Waiting on calls to TestConversionManager is not sufficient because the
+  // results are returned in promises.
+  std::string wait_script = R"(
+    let status = document.getElementById("feature-status-content");
+    let obs = new MutationObserver(() => {
+      if (status.innerText.trim() === "enabled") {
+        document.title = $1;
+      }
+    });
+    obs.observe(status, {'childList': true, 'characterData': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_F(
+    ConversionInternalsWebUiBrowserTest,
+    WebUIShownWithNoActiveImpression_NoImpressionsDisplayed) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  OverrideWebUIConversionManager(&manager);
+
+  std::string wait_script = R"(
+    let table = document.getElementById("impression-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 1 &&
+          table.children[0].children[0].innerText ===
+          "No active impressions.") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUIShownWithActiveImpression_ImpressionsDisplayed) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  manager.SetActiveImpressionsForWebUI(
+      {ImpressionBuilder(base::Time::Now()).SetData("100").Build(),
+       ImpressionBuilder(base::Time::Now()).Build()});
+  OverrideWebUIConversionManager(&manager);
+
+  std::string wait_script = R"(
+    let table = document.getElementById("impression-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 2 &&
+          table.children[0].children[0].innerText === "0x100") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUIShownWithNoReports_NoReportsDisplayed) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  OverrideWebUIConversionManager(&manager);
+
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  SetTitleOnReportsTableEmpty(kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUIShownWithPendingReports_ReportsDisplayed) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  ConversionReport report(
+      ImpressionBuilder(base::Time::Now()).SetData("100").Build(),
+      "7" /* conversion_data */, base::Time::Now() /* report_time */,
+      1 /* conversion_id */);
+  manager.SetReportsForWebUI({report});
+  OverrideWebUIConversionManager(&manager);
+
+  std::string wait_script = R"(
+    let table = document.getElementById("report-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 1 &&
+          table.children[0].children[1].innerText === "0x7") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUIWithPendingReportsClearStorage_ReportsRemoved) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  ConversionReport report(
+      ImpressionBuilder(base::Time::Now()).SetData("100").Build(),
+      "7" /* conversion_data */, base::Time::Now() /* report_time */,
+      1 /* conversion_id */);
+  manager.SetReportsForWebUI({report});
+  OverrideWebUIConversionManager(&manager);
+
+  std::string wait_script = R"(
+    let table = document.getElementById("report-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 1 &&
+          table.children[0].children[1].innerText === "0x7") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  // Wait for the table to rendered.
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+
+  // Click the clear storage button and expect that the report table is emptied.
+  const base::string16 kDeleteTitle = base::ASCIIToUTF16("Delete");
+  TitleWatcher delete_title_watcher(shell()->web_contents(), kDeleteTitle);
+  SetTitleOnReportsTableEmpty(kDeleteTitle);
+
+  // Click the button.
+  EXPECT_TRUE(ExecJsInWebUI("document.getElementById('clear-data').click();"));
+  EXPECT_EQ(kDeleteTitle, delete_title_watcher.WaitAndGetTitle());
+}
+
+// TODO(johnidel): Use a real ConversionManager here and verify that the reports
+// are actually sent.
+IN_PROC_BROWSER_TEST_F(ConversionInternalsWebUiBrowserTest,
+                       WebUISendReports_ReportsRemoved) {
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kConversionInternalsUrl)));
+
+  TestConversionManager manager;
+  ConversionReport report(
+      ImpressionBuilder(base::Time::Now()).SetData("100").Build(),
+      "7" /* conversion_data */, base::Time::Now() /* report_time */,
+      1 /* conversion_id */);
+  manager.SetReportsForWebUI({report});
+  OverrideWebUIConversionManager(&manager);
+
+  std::string wait_script = R"(
+    let table = document.getElementById("report-table-body");
+    let obs = new MutationObserver(() => {
+      if (table.children.length === 1 &&
+          table.children[0].children[1].innerText === "0x7") {
+        document.title = $1;
+      }
+    });
+    obs.observe(table, {'childList': true});)";
+  EXPECT_TRUE(ExecJsInWebUI(JsReplace(wait_script, kCompleteTitle)));
+
+  // Wait for the table to rendered.
+  TitleWatcher title_watcher(shell()->web_contents(), kCompleteTitle);
+  ClickRefreshButton();
+  EXPECT_EQ(kCompleteTitle, title_watcher.WaitAndGetTitle());
+
+  // Click the send reports button and expect that the report table is emptied.
+  const base::string16 kSentTitle = base::ASCIIToUTF16("Sent");
+  TitleWatcher sent_title_watcher(shell()->web_contents(), kSentTitle);
+  SetTitleOnReportsTableEmpty(kSentTitle);
+
+  EXPECT_TRUE(
+      ExecJsInWebUI("document.getElementById('send-reports').click();"));
+  EXPECT_EQ(kSentTitle, sent_title_watcher.WaitAndGetTitle());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_internals_handler_impl.cc b/chromium/content/browser/conversions/conversion_internals_handler_impl.cc
new file mode 100644
index 00000000000..b1ec072a119
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals_handler_impl.cc
@@ -0,0 +1,129 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_internals_handler_impl.h"
+
+#include <utility>
+#include <vector>
+
+#include "base/bind_helpers.h"
+#include "base/callback.h"
+#include "base/time/time.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/storable_impression.h"
+#include "content/browser/storage_partition_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui.h"
+
+namespace content {
+
+namespace {
+
+void ForwardImpressionsToWebUI(
+    ::mojom::ConversionInternalsHandler::GetActiveImpressionsCallback
+        web_ui_callback,
+    std::vector<StorableImpression> stored_impressions) {
+  std::vector<::mojom::WebUIImpressionPtr> web_ui_impressions;
+  web_ui_impressions.reserve(stored_impressions.size());
+
+  for (const StorableImpression& impression : stored_impressions) {
+    web_ui_impressions.push_back(::mojom::WebUIImpression::New(
+        impression.impression_data(), impression.impression_origin(),
+        impression.conversion_origin(), impression.reporting_origin(),
+        impression.impression_time().ToJsTime(),
+        impression.expiry_time().ToJsTime()));
+  }
+
+  std::move(web_ui_callback).Run(std::move(web_ui_impressions));
+}
+
+void ForwardReportsToWebUI(
+    ::mojom::ConversionInternalsHandler::GetPendingReportsCallback
+        web_ui_callback,
+    std::vector<ConversionReport> stored_reports) {
+  std::vector<::mojom::WebUIConversionReportPtr> web_ui_reports;
+  web_ui_reports.reserve(stored_reports.size());
+
+  for (const ConversionReport& report : stored_reports) {
+    web_ui_reports.push_back(::mojom::WebUIConversionReport::New(
+        report.impression.impression_data(), report.conversion_data,
+        report.impression.conversion_origin(),
+        report.impression.reporting_origin(), report.report_time.ToJsTime(),
+        report.attribution_credit));
+  }
+  std::move(web_ui_callback).Run(std::move(web_ui_reports));
+}
+
+}  // namespace
+
+ConversionInternalsHandlerImpl::ConversionInternalsHandlerImpl(
+    WebUI* web_ui,
+    mojo::PendingReceiver<::mojom::ConversionInternalsHandler> receiver)
+    : web_ui_(web_ui),
+      manager_provider_(std::make_unique<ConversionManagerProviderImpl>()),
+      receiver_(this, std::move(receiver)) {}
+
+ConversionInternalsHandlerImpl::~ConversionInternalsHandlerImpl() = default;
+
+void ConversionInternalsHandlerImpl::IsMeasurementEnabled(
+    ::mojom::ConversionInternalsHandler::IsMeasurementEnabledCallback
+        callback) {
+  bool measurement_enabled =
+      manager_provider_->GetManager(web_ui_->GetWebContents());
+  std::move(callback).Run(measurement_enabled);
+}
+
+void ConversionInternalsHandlerImpl::GetActiveImpressions(
+    ::mojom::ConversionInternalsHandler::GetActiveImpressionsCallback
+        callback) {
+  if (ConversionManager* manager =
+          manager_provider_->GetManager(web_ui_->GetWebContents())) {
+    manager->GetActiveImpressionsForWebUI(
+        base::BindOnce(&ForwardImpressionsToWebUI, std::move(callback)));
+  } else {
+    std::move(callback).Run({});
+  }
+}
+
+void ConversionInternalsHandlerImpl::GetPendingReports(
+    ::mojom::ConversionInternalsHandler::GetPendingReportsCallback callback) {
+  if (ConversionManager* manager =
+          manager_provider_->GetManager(web_ui_->GetWebContents())) {
+    manager->GetReportsForWebUI(
+        base::BindOnce(&ForwardReportsToWebUI, std::move(callback)),
+        base::Time::Max());
+  } else {
+    std::move(callback).Run({});
+  }
+}
+
+void ConversionInternalsHandlerImpl::SendPendingReports(
+    ::mojom::ConversionInternalsHandler::SendPendingReportsCallback callback) {
+  if (ConversionManager* manager =
+          manager_provider_->GetManager(web_ui_->GetWebContents())) {
+    manager->SendReportsForWebUI(std::move(callback));
+  } else {
+    std::move(callback).Run();
+  }
+}
+
+void ConversionInternalsHandlerImpl::ClearStorage(
+    ::mojom::ConversionInternalsHandler::ClearStorageCallback callback) {
+  if (ConversionManager* manager =
+          manager_provider_->GetManager(web_ui_->GetWebContents())) {
+    manager->ClearData(base::Time::Min(), base::Time::Max(),
+                       base::NullCallback(), std::move(callback));
+  } else {
+    std::move(callback).Run();
+  }
+}
+
+void ConversionInternalsHandlerImpl::SetConversionManagerProviderForTesting(
+    std::unique_ptr<ConversionManager::Provider> manager_provider) {
+  manager_provider_ = std::move(manager_provider);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_internals_handler_impl.h b/chromium/content/browser/conversions/conversion_internals_handler_impl.h
new file mode 100644
index 00000000000..76f621308a8
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals_handler_impl.h
@@ -0,0 +1,56 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_HANDLER_IMPL_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_HANDLER_IMPL_H_
+
+#include "content/browser/conversions/conversion_internals.mojom.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+
+namespace content {
+
+class WebUI;
+
+// Implements the mojo endpoint for the Conversion WebUI which proxies calls to
+// the ConversionManager to get information about stored conversion data. Owned
+// by ConversionInternalsUI.
+class ConversionInternalsHandlerImpl
+    : public ::mojom::ConversionInternalsHandler {
+ public:
+  ConversionInternalsHandlerImpl(
+      WebUI* web_ui,
+      mojo::PendingReceiver<::mojom::ConversionInternalsHandler> receiver);
+  ~ConversionInternalsHandlerImpl() override;
+
+  // mojom::ConversionInternalsHandler overrides:
+  void IsMeasurementEnabled(
+      ::mojom::ConversionInternalsHandler::IsMeasurementEnabledCallback
+          callback) override;
+  void GetActiveImpressions(
+      ::mojom::ConversionInternalsHandler::GetActiveImpressionsCallback
+          callback) override;
+  void GetPendingReports(
+      ::mojom::ConversionInternalsHandler::GetPendingReportsCallback callback)
+      override;
+  void SendPendingReports(
+      ::mojom::ConversionInternalsHandler::SendPendingReportsCallback callback)
+      override;
+  void ClearStorage(::mojom::ConversionInternalsHandler::ClearStorageCallback
+                        callback) override;
+
+  void SetConversionManagerProviderForTesting(
+      std::unique_ptr<ConversionManager::Provider> manager_provider);
+
+ private:
+  WebUI* web_ui_;
+  std::unique_ptr<ConversionManager::Provider> manager_provider_;
+
+  mojo::Receiver<::mojom::ConversionInternalsHandler> receiver_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_HANDLER_IMPL_H_
diff --git a/chromium/content/browser/conversions/conversion_internals_ui.cc b/chromium/content/browser/conversions/conversion_internals_ui.cc
new file mode 100644
index 00000000000..20306d5f62c
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals_ui.cc
@@ -0,0 +1,59 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_internals_ui.h"
+
+#include "content/browser/conversions/conversion_internals_handler_impl.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/grit/dev_ui_content_resources.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_data_source.h"
+#include "content/public/common/bindings_policy.h"
+#include "content/public/common/url_constants.h"
+
+namespace content {
+
+ConversionInternalsUI::ConversionInternalsUI(WebUI* web_ui)
+    : WebUIController(web_ui) {
+  // Initialize the UI with no bindings. Mojo bindings will be separately
+  // granted to frames within this WebContents.
+  web_ui->SetBindings(0);
+  WebUIDataSource* source =
+      WebUIDataSource::Create(kChromeUIConversionInternalsHost);
+
+  source->AddResourcePath("conversion_internals.mojom-lite.js",
+                          IDR_CONVERSION_INTERNALS_MOJOM_JS);
+  source->AddResourcePath("conversion_internals.js",
+                          IDR_CONVERSION_INTERNALS_JS);
+  source->AddResourcePath("conversion_internals.css",
+                          IDR_CONVERSION_INTERNALS_CSS);
+  source->SetDefaultResource(IDR_CONVERSION_INTERNALS_HTML);
+  WebUIDataSource::Add(web_ui->GetWebContents()->GetBrowserContext(), source);
+}
+
+WEB_UI_CONTROLLER_TYPE_IMPL(ConversionInternalsUI)
+
+ConversionInternalsUI::~ConversionInternalsUI() = default;
+
+void ConversionInternalsUI::RenderFrameCreated(RenderFrameHost* rfh) {
+  // Enable the JavaScript Mojo bindings in the renderer process, so the JS
+  // code can call the Mojo APIs exposed by this WebUI.
+  static_cast<RenderFrameHostImpl*>(rfh)->EnableMojoJsBindings();
+}
+
+void ConversionInternalsUI::BindInterface(
+    mojo::PendingReceiver<::mojom::ConversionInternalsHandler> receiver) {
+  ui_handler_ = std::make_unique<ConversionInternalsHandlerImpl>(
+      web_ui(), std::move(receiver));
+}
+
+void ConversionInternalsUI::SetConversionManagerProviderForTesting(
+    std::unique_ptr<ConversionManager::Provider> manager_provider) {
+  ui_handler_->SetConversionManagerProviderForTesting(
+      std::move(manager_provider));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_internals_ui.h b/chromium/content/browser/conversions/conversion_internals_ui.h
new file mode 100644
index 00000000000..88fbdf797c3
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_internals_ui.h
@@ -0,0 +1,47 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_UI_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_UI_H_
+
+#include <memory>
+
+#include "content/browser/conversions/conversion_internals.mojom.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/browser/web_ui_controller.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+
+namespace content {
+
+class ConversionInternalsHandlerImpl;
+
+// WebUI which handles serving the chrome://conversion-internals page.
+class CONTENT_EXPORT ConversionInternalsUI : public WebUIController,
+                                             public WebContentsObserver {
+ public:
+  explicit ConversionInternalsUI(WebUI* web_ui);
+  ConversionInternalsUI(const ConversionInternalsUI& other) = delete;
+  ConversionInternalsUI& operator=(const ConversionInternalsUI& other) = delete;
+  ~ConversionInternalsUI() override;
+
+  // WebContentsObserver:
+  void RenderFrameCreated(RenderFrameHost* render_frame_host) override;
+
+  void BindInterface(
+      mojo::PendingReceiver<::mojom::ConversionInternalsHandler> receiver);
+
+  void SetConversionManagerProviderForTesting(
+      std::unique_ptr<ConversionManager::Provider> manager_provider);
+
+ private:
+  std::unique_ptr<ConversionInternalsHandlerImpl> ui_handler_;
+
+  WEB_UI_CONTROLLER_TYPE_DECL();
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_INTERNALS_UI_H_
diff --git a/chromium/content/browser/conversions/conversion_manager.cc b/chromium/content/browser/conversions/conversion_manager.cc
deleted file mode 100644
index 2e358851a61..00000000000
--- a/chromium/content/browser/conversions/conversion_manager.cc
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/conversions/conversion_manager.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/task_runner_util.h"
-#include "base/time/default_clock.h"
-#include "content/browser/conversions/conversion_storage_sql.h"
-
-namespace content {
-
-ConversionManager::ConversionManager(
-    const base::FilePath& user_data_directory,
-    scoped_refptr<base::SequencedTaskRunner> task_runner)
-    : storage_task_runner_(std::move(task_runner)),
-      clock_(base::DefaultClock::GetInstance()),
-      storage_(new ConversionStorageSql(user_data_directory, this, clock_),
-               base::OnTaskRunnerDeleter(storage_task_runner_)),
-      conversion_policy_(std::make_unique<ConversionPolicy>()),
-      weak_factory_(this) {
-  // Unretained is safe because any task to delete |storage_| will be posted
-  // after this one.
-  base::PostTaskAndReplyWithResult(
-      storage_task_runner_.get(), FROM_HERE,
-      base::BindOnce(&ConversionStorage::Initialize,
-                     base::Unretained(storage_.get())),
-      base::BindOnce(&ConversionManager::OnInitCompleted,
-                     weak_factory_.GetWeakPtr()));
-}
-
-ConversionManager::~ConversionManager() = default;
-
-void ConversionManager::HandleConversion(const StorableConversion& conversion) {
-  if (!storage_)
-    return;
-
-  // TODO(https://crbug.com/1043345): Add UMA for the number of conversions we
-  // are logging to storage, and the number of new reports logged to storage.
-  // Unretained is safe because any task to delete |storage_| will be posted
-  // after this one.
-  storage_task_runner_.get()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          base::IgnoreResult(
-              &ConversionStorage::MaybeCreateAndStoreConversionReports),
-          base::Unretained(storage_.get()), conversion));
-}
-
-const ConversionPolicy& ConversionManager::GetConversionPolicy() const {
-  return *conversion_policy_;
-}
-
-void ConversionManager::ProcessNewConversionReports(
-    std::vector<ConversionReport>* reports) {
-  for (ConversionReport& report : *reports) {
-    report.report_time = conversion_policy_->GetReportTimeForConversion(report);
-  }
-
-  conversion_policy_->AssignAttributionCredits(reports);
-}
-
-int ConversionManager::GetMaxConversionsPerImpression() const {
-  return conversion_policy_->GetMaxConversionsPerImpression();
-}
-
-void ConversionManager::OnInitCompleted(bool success) {
-  if (!success)
-    storage_.reset();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_manager.h b/chromium/content/browser/conversions/conversion_manager.h
index fe132c41e2c..ca1e1a041f8 100644
--- a/chromium/content/browser/conversions/conversion_manager.h
+++ b/chromium/content/browser/conversions/conversion_manager.h
@@ -5,68 +5,76 @@
 #ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_MANAGER_H_
 #define CONTENT_BROWSER_CONVERSIONS_CONVERSION_MANAGER_H_
 
-#include <memory>
+#include <vector>
 
-#include "base/files/file_path.h"
-#include "base/macros.h"
-#include "base/memory/scoped_refptr.h"
-#include "base/memory/weak_ptr.h"
-#include "base/sequenced_task_runner.h"
+#include "base/callback.h"
+#include "base/callback_forward.h"
 #include "content/browser/conversions/conversion_policy.h"
-#include "content/browser/conversions/conversion_storage.h"
+#include "content/browser/conversions/conversion_report.h"
 #include "content/browser/conversions/storable_conversion.h"
-
-namespace base {
-class Clock;
-}  // namespace base
+#include "content/browser/conversions/storable_impression.h"
+#include "content/common/content_export.h"
+#include "url/origin.h"
 
 namespace content {
 
-class ConversionStorage;
+class WebContents;
 
-// UI thread class that manages the lifetime of the underlying conversion
-// storage. Owned by the storage partition.
-class ConversionManager : public ConversionStorage::Delegate {
+// Interface that mediates data flow between the network, storage layer, and
+// blink.
+class CONTENT_EXPORT ConversionManager {
  public:
-  // |storage_task_runner| should run with base::TaskPriority::BEST_EFFORT.
-  ConversionManager(
-      const base::FilePath& user_data_directory,
-      scoped_refptr<base::SequencedTaskRunner> storage_task_runner);
-  ConversionManager(const ConversionManager& other) = delete;
-  ConversionManager& operator=(const ConversionManager& other) = delete;
-  ~ConversionManager() override;
+  // Provides access to a ConversionManager implementation. This layer of
+  // abstraction is to allow tests to mock out the ConversionManager without
+  // injecting a manager explicitly.
+  class Provider {
+   public:
+    virtual ~Provider() = default;
+
+    // Gets the ConversionManager that should be used for handling conversions
+    // that occur in the given |web_contents|. Returns nullptr if conversion
+    // measurement is not enabled in the given |web_contents|, e.g. when the
+    // browser context is off the record.
+    virtual ConversionManager* GetManager(WebContents* web_contents) const = 0;
+  };
+  virtual ~ConversionManager() = default;
+
+  // Persists the given |impression| to storage. Called when a navigation
+  // originating from an impression tag finishes.
+  virtual void HandleImpression(const StorableImpression& impression) = 0;
 
   // Process a newly registered conversion. Will create and log any new
   // conversion reports to storage.
-  void HandleConversion(const StorableConversion& conversion);
-
-  const ConversionPolicy& GetConversionPolicy() const;
-
- private:
-  // ConversionStorageDelegate
-  void ProcessNewConversionReports(
-      std::vector<ConversionReport>* reports) override;
-  int GetMaxConversionsPerImpression() const override;
-
-  void OnInitCompleted(bool success);
-
-  // Task runner used to perform operations on |storage_|. Runs with
-  // base::TaskPriority::BEST_EFFORT.
-  scoped_refptr<base::SequencedTaskRunner> storage_task_runner_;
-
-  base::Clock* clock_;
-
-  // ConversionStorage instance which is scoped to lifetime of
-  // |storage_task_runner_|. |storage_| should be accessed by calling
-  // base::PostTask with |storage_task_runner_|, and should not be accessed
-  // directly.
-  std::unique_ptr<ConversionStorage, base::OnTaskRunnerDeleter> storage_;
-
-  // Policy used for controlling API configurations such as reporting and
-  // attribution models. Unique ptr so it can be overridden for testing.
-  std::unique_ptr<ConversionPolicy> conversion_policy_;
-
-  base::WeakPtrFactory<ConversionManager> weak_factory_;
+  virtual void HandleConversion(const StorableConversion& conversion) = 0;
+
+  // Get all impressions that are currently stored in this partition. Used for
+  // populating WebUI.
+  virtual void GetActiveImpressionsForWebUI(
+      base::OnceCallback<void(std::vector<StorableImpression>)> callback) = 0;
+
+  // Get all pending reports that are currently stored in this partition. Used
+  // for populating WebUI.
+  virtual void GetReportsForWebUI(
+      base::OnceCallback<void(std::vector<ConversionReport>)> callback,
+      base::Time max_report_time) = 0;
+
+  // Sends all pending reports immediately, and runs |done| once they have all
+  // been sent.
+  virtual void SendReportsForWebUI(base::OnceClosure done) = 0;
+
+  // Returns the ConversionPolicy that is used to control API policies such
+  // as noise.
+  virtual const ConversionPolicy& GetConversionPolicy() const = 0;
+
+  // Deletes all data in storage for URLs matching |filter|, between
+  // |delete_begin| and |delete_end| time.
+  //
+  // If |filter| is null, then consider all origins in storage as matching.
+  virtual void ClearData(
+      base::Time delete_begin,
+      base::Time delete_end,
+      base::RepeatingCallback<bool(const url::Origin&)> filter,
+      base::OnceClosure done) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_manager_impl.cc b/chromium/content/browser/conversions/conversion_manager_impl.cc
new file mode 100644
index 00000000000..4f3f9ca7e5a
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_manager_impl.cc
@@ -0,0 +1,282 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_manager_impl.h"
+
+#include <utility>
+
+#include "base/barrier_closure.h"
+#include "base/bind.h"
+#include "base/command_line.h"
+#include "base/memory/ptr_util.h"
+#include "base/task_runner_util.h"
+#include "base/time/default_clock.h"
+#include "content/browser/conversions/conversion_reporter_impl.h"
+#include "content/browser/conversions/conversion_storage_delegate_impl.h"
+#include "content/browser/conversions/conversion_storage_sql.h"
+#include "content/browser/storage_partition_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/storage_partition.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/content_switches.h"
+
+namespace content {
+
+const constexpr base::TimeDelta kConversionManagerQueueReportsInterval =
+    base::TimeDelta::FromMinutes(30);
+
+ConversionManager* ConversionManagerProviderImpl::GetManager(
+    WebContents* web_contents) const {
+  return static_cast<StoragePartitionImpl*>(
+             BrowserContext::GetDefaultStoragePartition(
+                 web_contents->GetBrowserContext()))
+      ->GetConversionManager();
+}
+
+// static
+std::unique_ptr<ConversionManagerImpl> ConversionManagerImpl::CreateForTesting(
+    std::unique_ptr<ConversionReporter> reporter,
+    std::unique_ptr<ConversionPolicy> policy,
+    const base::Clock* clock,
+    const base::FilePath& user_data_directory,
+    scoped_refptr<base::SequencedTaskRunner> storage_task_runner) {
+  return base::WrapUnique<ConversionManagerImpl>(new ConversionManagerImpl(
+      std::move(reporter), std::move(policy), clock, user_data_directory,
+      std::move(storage_task_runner)));
+}
+
+ConversionManagerImpl::ConversionManagerImpl(
+    StoragePartition* storage_partition,
+    const base::FilePath& user_data_directory,
+    scoped_refptr<base::SequencedTaskRunner> task_runner)
+    : ConversionManagerImpl(
+          std::make_unique<ConversionReporterImpl>(
+              storage_partition,
+              base::DefaultClock::GetInstance()),
+          std::make_unique<ConversionPolicy>(
+              base::CommandLine::ForCurrentProcess()->HasSwitch(
+                  switches::kConversionsDebugMode)),
+          base::DefaultClock::GetInstance(),
+          user_data_directory,
+          std::move(task_runner)) {}
+
+ConversionManagerImpl::ConversionManagerImpl(
+    std::unique_ptr<ConversionReporter> reporter,
+    std::unique_ptr<ConversionPolicy> policy,
+    const base::Clock* clock,
+    const base::FilePath& user_data_directory,
+    scoped_refptr<base::SequencedTaskRunner> storage_task_runner)
+    : debug_mode_(base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kConversionsDebugMode)),
+      storage_task_runner_(std::move(storage_task_runner)),
+      clock_(clock),
+      reporter_(std::move(reporter)),
+      storage_(new ConversionStorageSql(
+                   user_data_directory,
+                   std::make_unique<ConversionStorageDelegateImpl>(debug_mode_),
+                   clock_),
+               base::OnTaskRunnerDeleter(storage_task_runner_)),
+      conversion_policy_(std::move(policy)),
+      weak_factory_(this) {
+  // Unretained is safe because any task to delete |storage_| will be posted
+  // after this one.
+  base::PostTaskAndReplyWithResult(
+      storage_task_runner_.get(), FROM_HERE,
+      base::BindOnce(&ConversionStorage::Initialize,
+                     base::Unretained(storage_.get())),
+      base::BindOnce(&ConversionManagerImpl::OnInitCompleted,
+                     weak_factory_.GetWeakPtr()));
+}
+
+ConversionManagerImpl::~ConversionManagerImpl() = default;
+
+void ConversionManagerImpl::HandleImpression(
+    const StorableImpression& impression) {
+  if (!storage_)
+    return;
+
+  // Add the impression to storage.
+  storage_task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&ConversionStorage::StoreImpression,
+                                base::Unretained(storage_.get()), impression));
+}
+
+void ConversionManagerImpl::HandleConversion(
+    const StorableConversion& conversion) {
+  if (!storage_)
+    return;
+
+  // TODO(https://crbug.com/1043345): Add UMA for the number of conversions we
+  // are logging to storage, and the number of new reports logged to storage.
+  // Unretained is safe because any task to delete |storage_| will be posted
+  // after this one.
+  storage_task_runner_.get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          base::IgnoreResult(
+              &ConversionStorage::MaybeCreateAndStoreConversionReports),
+          base::Unretained(storage_.get()), conversion));
+
+  // If we are running in debug mode, we should also schedule a task to
+  // gather and send any new reports.
+  if (debug_mode_)
+    GetAndQueueReportsForNextInterval();
+}
+
+void ConversionManagerImpl::GetActiveImpressionsForWebUI(
+    base::OnceCallback<void(std::vector<StorableImpression>)> callback) {
+  // Unretained is safe because any task to delete |storage_| will be posted
+  // after this one because |storage_| uses base::OnTaskRunnerDeleter.
+  base::PostTaskAndReplyWithResult(
+      storage_task_runner_.get(), FROM_HERE,
+      base::BindOnce(&ConversionStorage::GetActiveImpressions,
+                     base::Unretained(storage_.get())),
+      std::move(callback));
+}
+
+void ConversionManagerImpl::GetReportsForWebUI(
+    base::OnceCallback<void(std::vector<ConversionReport>)> callback,
+    base::Time max_report_time) {
+  GetAndHandleReports(std::move(callback), max_report_time);
+}
+
+void ConversionManagerImpl::SendReportsForWebUI(base::OnceClosure done) {
+  GetAndHandleReports(
+      base::BindOnce(&ConversionManagerImpl::HandleReportsSentFromWebUI,
+                     weak_factory_.GetWeakPtr(), std::move(done)),
+      base::Time::Max());
+}
+
+const ConversionPolicy& ConversionManagerImpl::GetConversionPolicy() const {
+  return *conversion_policy_;
+}
+
+void ConversionManagerImpl::ClearData(
+    base::Time delete_begin,
+    base::Time delete_end,
+    base::RepeatingCallback<bool(const url::Origin&)> filter,
+    base::OnceClosure done) {
+  storage_task_runner_->PostTaskAndReply(
+      FROM_HERE,
+      base::BindOnce(&ConversionStorage::ClearData,
+                     base::Unretained(storage_.get()), delete_begin, delete_end,
+                     std::move(filter)),
+      std::move(done));
+}
+
+void ConversionManagerImpl::OnInitCompleted(bool success) {
+  if (!success) {
+    storage_.reset();
+    return;
+  }
+
+  // Once the database is loaded, get all reports that may have expired while
+  // Chrome was not running and handle these specially.
+  GetAndHandleReports(
+      base::BindOnce(&ConversionManagerImpl::HandleReportsExpiredAtStartup,
+                     weak_factory_.GetWeakPtr()),
+      clock_->Now() + kConversionManagerQueueReportsInterval);
+
+  // Start a repeating timer that will fetch reports once every
+  // |kConversionManagerQueueReportsInterval| and add them to |reporter_|.
+  get_and_queue_reports_timer_.Start(
+      FROM_HERE, kConversionManagerQueueReportsInterval, this,
+      &ConversionManagerImpl::GetAndQueueReportsForNextInterval);
+}
+
+void ConversionManagerImpl::GetAndHandleReports(
+    ReportsHandlerFunc handler_function,
+    base::Time max_report_time) {
+  base::PostTaskAndReplyWithResult(
+      storage_task_runner_.get(), FROM_HERE,
+      base::BindOnce(&ConversionStorage::GetConversionsToReport,
+                     base::Unretained(storage_.get()), max_report_time),
+      std::move(handler_function));
+}
+
+void ConversionManagerImpl::GetAndQueueReportsForNextInterval() {
+  // Get all the reports that will be reported in the next interval and them to
+  // the |reporter_|.
+  GetAndHandleReports(base::BindOnce(&ConversionManagerImpl::QueueReports,
+                                     weak_factory_.GetWeakPtr()),
+                      clock_->Now() + kConversionManagerQueueReportsInterval);
+}
+
+void ConversionManagerImpl::QueueReports(
+    std::vector<ConversionReport> reports) {
+  if (!reports.empty()) {
+    // |reporter_| is owned by |this|, so base::Unretained() is safe as the
+    // reporter and callbacks will be deleted first.
+    reporter_->AddReportsToQueue(
+        std::move(reports),
+        base::BindRepeating(&ConversionManagerImpl::OnReportSent,
+                            base::Unretained(this)));
+  }
+}
+
+void ConversionManagerImpl::HandleReportsExpiredAtStartup(
+    std::vector<ConversionReport> reports) {
+  // Add delay to all reports that expired while the browser was not running so
+  // they are not temporally join-able.
+  base::Time current_time = clock_->Now();
+  for (ConversionReport& report : reports) {
+    if (report.report_time > current_time)
+      continue;
+
+    base::Time updated_report_time =
+        conversion_policy_->GetReportTimeForExpiredReportAtStartup(
+            current_time);
+
+    report.extra_delay = updated_report_time - report.report_time;
+    report.report_time = updated_report_time;
+  }
+  QueueReports(std::move(reports));
+}
+
+void ConversionManagerImpl::HandleReportsSentFromWebUI(
+    base::OnceClosure done,
+    std::vector<ConversionReport> reports) {
+  if (reports.empty()) {
+    std::move(done).Run();
+    return;
+  }
+
+  // All reports should be sent immediately.
+  for (ConversionReport& report : reports) {
+    report.report_time = base::Time::Min();
+  }
+
+  // Wraps |done| so that is will run once all of the reports have finished
+  // sending.
+  base::RepeatingClosure all_reports_sent =
+      base::BarrierClosure(reports.size(), std::move(done));
+
+  // |reporter_| is owned by |this|, so base::Unretained() is safe as the
+  // reporter and callbacks will be deleted first.
+  reporter_->AddReportsToQueue(
+      std::move(reports),
+      base::BindRepeating(&ConversionManagerImpl::OnReportSentFromWebUI,
+                          base::Unretained(this), std::move(all_reports_sent)));
+}
+
+void ConversionManagerImpl::OnReportSent(int64_t conversion_id) {
+  storage_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(base::IgnoreResult(&ConversionStorage::DeleteConversion),
+                     base::Unretained(storage_.get()), conversion_id));
+}
+
+void ConversionManagerImpl::OnReportSentFromWebUI(
+    base::OnceClosure reports_sent_barrier,
+    int64_t conversion_id) {
+  // |reports_sent_barrier| is a OnceClosure view of a RepeatingClosure obtained
+  // by base::BarrierClosure().
+  storage_task_runner_->PostTaskAndReply(
+      FROM_HERE,
+      base::BindOnce(base::IgnoreResult(&ConversionStorage::DeleteConversion),
+                     base::Unretained(storage_.get()), conversion_id),
+      std::move(reports_sent_barrier));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_manager_impl.h b/chromium/content/browser/conversions/conversion_manager_impl.h
new file mode 100644
index 00000000000..03bcd94688f
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_manager_impl.h
@@ -0,0 +1,182 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_MANAGER_IMPL_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_MANAGER_IMPL_H_
+
+#include <memory>
+#include <vector>
+
+#include "base/files/file_path.h"
+#include "base/macros.h"
+#include "base/memory/scoped_refptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/sequenced_task_runner.h"
+#include "base/timer/timer.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_policy.h"
+#include "content/browser/conversions/conversion_storage.h"
+
+namespace base {
+class Clock;
+}  // namespace base
+
+namespace content {
+
+// Frequency we pull ConversionReports from storage and queue them to be
+// reported.
+extern CONTENT_EXPORT const base::TimeDelta
+    kConversionManagerQueueReportsInterval;
+
+class ConversionStorage;
+class StoragePartition;
+
+// Provides access to the manager owned by the default StoragePartition.
+class ConversionManagerProviderImpl : public ConversionManager::Provider {
+ public:
+  ConversionManagerProviderImpl() = default;
+  ConversionManagerProviderImpl(const ConversionManagerProviderImpl& other) =
+      delete;
+  ConversionManagerProviderImpl& operator=(
+      const ConversionManagerProviderImpl& other) = delete;
+  ~ConversionManagerProviderImpl() override = default;
+
+  // ConversionManagerProvider:
+  ConversionManager* GetManager(WebContents* web_contents) const override;
+};
+
+// UI thread class that manages the lifetime of the underlying conversion
+// storage. Owned by the storage partition.
+class CONTENT_EXPORT ConversionManagerImpl : public ConversionManager {
+ public:
+  // Interface which manages the ownership, queuing, and sending of pending
+  // conversion reports. Owned by |this|.
+  class ConversionReporter {
+   public:
+    virtual ~ConversionReporter() = default;
+
+    // Adds |reports| to a shared queue of reports that need to be sent. Runs
+    // |report_sent_callback| for every report that is sent, with the associated
+    // |conversion_id| of the report.
+    virtual void AddReportsToQueue(
+        std::vector<ConversionReport> reports,
+        base::RepeatingCallback<void(int64_t)> report_sent_callback) = 0;
+  };
+
+  static std::unique_ptr<ConversionManagerImpl> CreateForTesting(
+      std::unique_ptr<ConversionReporter> reporter,
+      std::unique_ptr<ConversionPolicy> policy,
+      const base::Clock* clock,
+      const base::FilePath& user_data_directory,
+      scoped_refptr<base::SequencedTaskRunner> storage_task_runner);
+
+  // |storage_task_runner| should run with base::TaskPriority::BEST_EFFORT.
+  ConversionManagerImpl(
+      StoragePartition* storage_partition,
+      const base::FilePath& user_data_directory,
+      scoped_refptr<base::SequencedTaskRunner> storage_task_runner);
+  ConversionManagerImpl(const ConversionManagerImpl& other) = delete;
+  ConversionManagerImpl& operator=(const ConversionManagerImpl& other) = delete;
+  ~ConversionManagerImpl() override;
+
+  // ConversionManager:
+  void HandleImpression(const StorableImpression& impression) override;
+  void HandleConversion(const StorableConversion& conversion) override;
+  void GetActiveImpressionsForWebUI(
+      base::OnceCallback<void(std::vector<StorableImpression>)> callback)
+      override;
+  void GetReportsForWebUI(
+      base::OnceCallback<void(std::vector<ConversionReport>)> callback,
+      base::Time max_report_time) override;
+  void SendReportsForWebUI(base::OnceClosure done) override;
+  const ConversionPolicy& GetConversionPolicy() const override;
+  void ClearData(base::Time delete_begin,
+                 base::Time delete_end,
+                 base::RepeatingCallback<bool(const url::Origin&)> filter,
+                 base::OnceClosure done) override;
+
+ private:
+  ConversionManagerImpl(
+      std::unique_ptr<ConversionReporter> reporter,
+      std::unique_ptr<ConversionPolicy> policy,
+      const base::Clock* clock,
+      const base::FilePath& user_data_directory,
+      scoped_refptr<base::SequencedTaskRunner> storage_task_runner);
+
+  void OnInitCompleted(bool success);
+
+  // Retrieves reports from storage whose |report_time| <= |max_report_time|,
+  // and calls |handler_function| on them.
+  using ReportsHandlerFunc =
+      base::OnceCallback<void(std::vector<ConversionReport>)>;
+  void GetAndHandleReports(ReportsHandlerFunc handler_function,
+                           base::Time max_report_time);
+
+  // Get the next set of reports from storage that need to be sent before the
+  // next call from |get_and_queue_reports_timer_|. Adds the reports to
+  // |reporter|.
+  void GetAndQueueReportsForNextInterval();
+
+  // Queue the given |reports| on |reporter_|.
+  void QueueReports(std::vector<ConversionReport> reports);
+
+  void HandleReportsExpiredAtStartup(std::vector<ConversionReport> reports);
+
+  void HandleReportsSentFromWebUI(base::OnceClosure done,
+                                  std::vector<ConversionReport> reports);
+
+  // Notify storage to delete the given |conversion_id| when it's associated
+  // report has been sent.
+  void OnReportSent(int64_t conversion_id);
+
+  // Similar to OnReportSent, but invokes |reports_sent_barrier| when the
+  // report has been removed from storage.
+  void OnReportSentFromWebUI(base::OnceClosure reports_sent_barrier,
+                             int64_t conversion_id);
+
+  // Friend to expose the ConversionStorage and task runner, consider changing
+  // to just expose the storage if it moves to SequenceBound.
+  friend std::vector<ConversionReport> GetConversionsToReportForTesting(
+      ConversionManagerImpl* manager,
+      base::Time max_report_time);
+
+  // Whether the API is running in debug mode, meaning that there should be
+  // no delays or noise added to reports. This is used by end to end tests to
+  // verify functionality without mocking out any implementations.
+  const bool debug_mode_;
+
+  // Task runner used to perform operations on |storage_|. Runs with
+  // base::TaskPriority::BEST_EFFORT.
+  scoped_refptr<base::SequencedTaskRunner> storage_task_runner_;
+
+  const base::Clock* clock_;
+
+  // Timer which administers calls to GetAndQueueReportsForNextInterval().
+  base::RepeatingTimer get_and_queue_reports_timer_;
+
+  // Handle keeping track of conversion reports to send. Reports are fetched
+  // from |storage_| and added to |reporter_| by |get_reports_timer_|.
+  std::unique_ptr<ConversionReporter> reporter_;
+
+  // ConversionStorage instance which is scoped to lifetime of
+  // |storage_task_runner_|. |storage_| should be accessed by calling
+  // base::PostTask with |storage_task_runner_|, and should not be accessed
+  // directly. |storage_| can be null if the storage initialization did not
+  // succeed.
+  //
+  // TODO(https://crbug.com/1066920): This should use base::SequenceBound to
+  // avoid having to call PostTask manually, as well as use base::Unretained on
+  // |storage_|.
+  std::unique_ptr<ConversionStorage, base::OnTaskRunnerDeleter> storage_;
+
+  // Policy used for controlling API configurations such as reporting and
+  // attribution models. Unique ptr so it can be overridden for testing.
+  std::unique_ptr<ConversionPolicy> conversion_policy_;
+
+  base::WeakPtrFactory<ConversionManagerImpl> weak_factory_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_MANAGER_IMPL_H_
diff --git a/chromium/content/browser/conversions/conversion_manager_impl_unittest.cc b/chromium/content/browser/conversions/conversion_manager_impl_unittest.cc
new file mode 100644
index 00000000000..3ca019fd0d1
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_manager_impl_unittest.cc
@@ -0,0 +1,365 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_manager_impl.h"
+
+#include <stdint.h>
+
+#include <memory>
+#include <utility>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/callback_forward.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/run_loop.h"
+#include "base/sequenced_task_runner.h"
+#include "base/test/bind_test_util.h"
+#include "base/time/clock.h"
+#include "base/time/time.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/conversion_test_utils.h"
+#include "content/browser/conversions/storable_conversion.h"
+#include "content/browser/conversions/storable_impression.h"
+#include "content/public/test/browser_task_environment.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+constexpr base::TimeDelta kExpiredReportOffset =
+    base::TimeDelta::FromMinutes(2);
+
+class ConstantStartupDelayPolicy : public ConversionPolicy {
+ public:
+  ConstantStartupDelayPolicy() = default;
+  ~ConstantStartupDelayPolicy() override = default;
+
+  base::Time GetReportTimeForExpiredReportAtStartup(
+      base::Time now) const override {
+    return now + kExpiredReportOffset;
+  }
+};
+
+// Mock reporter that tracks reports being queued by the ConversionManager.
+class TestConversionReporter
+    : public ConversionManagerImpl::ConversionReporter {
+ public:
+  TestConversionReporter() = default;
+  ~TestConversionReporter() override = default;
+
+  // ConversionManagerImpl::ConversionReporter
+  void AddReportsToQueue(
+      std::vector<ConversionReport> reports,
+      base::RepeatingCallback<void(int64_t)> report_sent_callback) override {
+    num_reports_ += reports.size();
+    last_conversion_id_ = *reports.back().conversion_id;
+    last_report_time_ = reports.back().report_time;
+
+    if (should_run_report_sent_callbacks_) {
+      for (const auto& report : reports) {
+        report_sent_callback.Run(*report.conversion_id);
+      }
+    }
+
+    if (quit_closure_ && num_reports_ >= expected_num_reports_)
+      std::move(quit_closure_).Run();
+  }
+
+  void ShouldRunReportSentCallbacks(bool should_run_report_sent_callbacks) {
+    should_run_report_sent_callbacks_ = should_run_report_sent_callbacks;
+  }
+
+  size_t num_reports() { return num_reports_; }
+
+  int64_t last_conversion_id() { return last_conversion_id_; }
+
+  base::Time last_report_time() { return last_report_time_; }
+
+  void WaitForNumReports(size_t expected_num_reports) {
+    if (num_reports_ >= expected_num_reports)
+      return;
+
+    expected_num_reports_ = expected_num_reports;
+    base::RunLoop wait_loop;
+    quit_closure_ = wait_loop.QuitClosure();
+    wait_loop.Run();
+  }
+
+ private:
+  bool should_run_report_sent_callbacks_ = false;
+  size_t expected_num_reports_ = 0u;
+  size_t num_reports_ = 0u;
+  int64_t last_conversion_id_ = 0UL;
+  base::Time last_report_time_;
+  base::OnceClosure quit_closure_;
+};
+
+// Time after impression that a conversion can first be sent. See
+// ConversionStorageDelegateImpl::GetReportTimeForConversion().
+constexpr base::TimeDelta kFirstReportingWindow = base::TimeDelta::FromDays(2);
+
+// Give impressions a sufficiently long expiry.
+constexpr base::TimeDelta kImpressionExpiry = base::TimeDelta::FromDays(30);
+
+}  // namespace
+
+class ConversionManagerImplTest : public testing::Test {
+ public:
+  ConversionManagerImplTest()
+      : task_environment_(base::test::TaskEnvironment::TimeSource::MOCK_TIME) {
+    EXPECT_TRUE(dir_.CreateUniqueTempDir());
+    CreateManager();
+  }
+
+  void CreateManager() {
+    auto reporter = std::make_unique<TestConversionReporter>();
+    test_reporter_ = reporter.get();
+    conversion_manager_ = ConversionManagerImpl::CreateForTesting(
+        std::move(reporter), std::make_unique<ConstantStartupDelayPolicy>(),
+        task_environment_.GetMockClock(), dir_.GetPath(),
+        base::ThreadPool::CreateSequencedTaskRunner({base::MayBlock()}));
+  }
+
+  const base::Clock& clock() { return *task_environment_.GetMockClock(); }
+
+ protected:
+  base::ScopedTempDir dir_;
+  BrowserTaskEnvironment task_environment_;
+  std::unique_ptr<ConversionManagerImpl> conversion_manager_;
+  TestConversionReporter* test_reporter_ = nullptr;
+};
+
+TEST_F(ConversionManagerImplTest, ImpressionRegistered_ReturnedToWebUI) {
+  auto impression = ImpressionBuilder(clock().Now())
+                        .SetExpiry(kImpressionExpiry)
+                        .SetData("100")
+                        .Build();
+  conversion_manager_->HandleImpression(impression);
+
+  base::RunLoop run_loop;
+  auto get_impressions_callback = base::BindLambdaForTesting(
+      [&](std::vector<StorableImpression> impressions) {
+        EXPECT_EQ(1u, impressions.size());
+        EXPECT_TRUE(ImpressionsEqual(impression, impressions.back()));
+        run_loop.Quit();
+      });
+  conversion_manager_->GetActiveImpressionsForWebUI(
+      std::move(get_impressions_callback));
+  run_loop.Run();
+}
+
+TEST_F(ConversionManagerImplTest, ExpiredImpression_NotReturnedToWebUI) {
+  conversion_manager_->HandleImpression(ImpressionBuilder(clock().Now())
+                                            .SetExpiry(kImpressionExpiry)
+                                            .SetData("100")
+                                            .Build());
+  task_environment_.FastForwardBy(2 * kImpressionExpiry);
+
+  base::RunLoop run_loop;
+  auto get_impressions_callback = base::BindLambdaForTesting(
+      [&](std::vector<StorableImpression> impressions) {
+        EXPECT_TRUE(impressions.empty());
+        run_loop.Quit();
+      });
+  conversion_manager_->GetActiveImpressionsForWebUI(
+      std::move(get_impressions_callback));
+  run_loop.Run();
+}
+
+TEST_F(ConversionManagerImplTest, ImpressionConverted_ReportReturnedToWebUI) {
+  auto impression = ImpressionBuilder(clock().Now())
+                        .SetExpiry(kImpressionExpiry)
+                        .SetData("100")
+                        .Build();
+  conversion_manager_->HandleImpression(impression);
+
+  auto conversion = DefaultConversion();
+  conversion_manager_->HandleConversion(conversion);
+
+  ConversionReport expected_report(impression, conversion.conversion_data(),
+                                   clock().Now() + kFirstReportingWindow,
+                                   base::nullopt /* conversion_id */);
+  expected_report.attribution_credit = 100;
+
+  base::RunLoop run_loop;
+  auto reports_callback =
+      base::BindLambdaForTesting([&](std::vector<ConversionReport> reports) {
+        EXPECT_EQ(1u, reports.size());
+        EXPECT_TRUE(ReportsEqual({expected_report}, reports));
+        run_loop.Quit();
+      });
+  conversion_manager_->GetReportsForWebUI(std::move(reports_callback),
+                                          base::Time::Max());
+  run_loop.Run();
+}
+
+TEST_F(ConversionManagerImplTest, ImpressionConverted_ReportQueued) {
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+
+  // Reports are queued in intervals ahead of when they should be
+  // sent. Make sure the report is not queued earlier than this.
+  task_environment_.FastForwardBy(kFirstReportingWindow -
+                                  kConversionManagerQueueReportsInterval -
+                                  base::TimeDelta::FromMinutes(1));
+  EXPECT_EQ(0u, test_reporter_->num_reports());
+
+  task_environment_.FastForwardBy(base::TimeDelta::FromMinutes(1));
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+}
+
+TEST_F(ConversionManagerImplTest, QueuedReportNotSent_QueuedAgain) {
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+  task_environment_.FastForwardBy(kFirstReportingWindow -
+                                  kConversionManagerQueueReportsInterval);
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+
+  // If the report is not sent, it should be added to the queue again.
+  task_environment_.FastForwardBy(kConversionManagerQueueReportsInterval);
+  EXPECT_EQ(2u, test_reporter_->num_reports());
+}
+
+TEST_F(ConversionManagerImplTest, QueuedReportSent_NotQueuedAgain) {
+  test_reporter_->ShouldRunReportSentCallbacks(true);
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+  task_environment_.FastForwardBy(kFirstReportingWindow -
+                                  kConversionManagerQueueReportsInterval);
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+
+  // The report should not be added to the queue again.
+  task_environment_.FastForwardBy(kConversionManagerQueueReportsInterval);
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+}
+
+// Add a conversion to storage and reset the manager to mimic a report being
+// available at startup.
+TEST_F(ConversionManagerImplTest, ExpiredReportsAtStartup_Queued) {
+  // Create a report that will be reported at t= 2 days.
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+
+  // Create another conversion that will be reported at t=
+  // (kFirstReportingWindow + 2 * kConversionManagerQueueReportsInterval).
+  task_environment_.FastForwardBy(2 * kConversionManagerQueueReportsInterval);
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+
+  EXPECT_EQ(0u, test_reporter_->num_reports());
+
+  // Reset the manager to simulate shutdown.
+  conversion_manager_.reset();
+
+  // Fast forward past the expected report time of the first conversion, t =
+  // (kFirstReportingWindow+ 1 minute).
+  task_environment_.FastForwardBy(kFirstReportingWindow -
+                                  (2 * kConversionManagerQueueReportsInterval) +
+                                  base::TimeDelta::FromMinutes(1));
+
+  // Create the manager and check that the first report is queued immediately.
+  CreateManager();
+  test_reporter_->ShouldRunReportSentCallbacks(true);
+  test_reporter_->WaitForNumReports(1);
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+
+  // The second report is still queued at the correct time.
+  task_environment_.FastForwardBy(kConversionManagerQueueReportsInterval);
+  EXPECT_EQ(2u, test_reporter_->num_reports());
+}
+
+// This functionality is tested more thoroughly in the ConversionStorageSql
+// unit tests. Here, just test to make sure the basic control flow is working.
+TEST_F(ConversionManagerImplTest, ClearData) {
+  for (bool match_url : {true, false}) {
+    base::Time start = clock().Now();
+    conversion_manager_->HandleImpression(
+        ImpressionBuilder(start).SetExpiry(kImpressionExpiry).Build());
+    conversion_manager_->HandleConversion(DefaultConversion());
+
+    base::RunLoop run_loop;
+    conversion_manager_->ClearData(
+        start, start + base::TimeDelta::FromMinutes(1),
+        base::BindLambdaForTesting(
+            [match_url](const url::Origin& _) { return match_url; }),
+        run_loop.QuitClosure());
+    run_loop.Run();
+
+    task_environment_.FastForwardBy(kFirstReportingWindow -
+                                    kConversionManagerQueueReportsInterval);
+    size_t expected_reports = match_url ? 0u : 1u;
+    EXPECT_EQ(expected_reports, test_reporter_->num_reports());
+  }
+}
+
+TEST_F(ConversionManagerImplTest, ConversionsSentFromUI_ReportedImmediately) {
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+  EXPECT_EQ(0u, test_reporter_->num_reports());
+
+  conversion_manager_->SendReportsForWebUI(base::DoNothing());
+  task_environment_.FastForwardBy(base::TimeDelta::FromMinutes(0));
+  EXPECT_EQ(2u, test_reporter_->num_reports());
+}
+
+TEST_F(ConversionManagerImplTest, ExpiredReportsAtStartup_Delayed) {
+  // Create a report that will be reported at t= 2 days.
+  base::Time start_time = clock().Now();
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+  EXPECT_EQ(0u, test_reporter_->num_reports());
+
+  // Reset the manager to simulate shutdown.
+  conversion_manager_.reset();
+
+  // Fast forward past the expected report time of the first conversion, t =
+  // (kFirstReportingWindow+ 1 minute).
+  task_environment_.FastForwardBy(kFirstReportingWindow +
+                                  base::TimeDelta::FromMinutes(1));
+
+  CreateManager();
+  test_reporter_->WaitForNumReports(1);
+
+  // Ensure that the expired report is delayed based on the time the browser
+  // started.
+  EXPECT_EQ(start_time + kFirstReportingWindow +
+                base::TimeDelta::FromMinutes(1) + kExpiredReportOffset,
+            test_reporter_->last_report_time());
+}
+
+TEST_F(ConversionManagerImplTest, NonExpiredReportsQueuedAtStartup_NotDelayed) {
+  // Create a report that will be reported at t= 2 days.
+  base::Time start_time = clock().Now();
+  conversion_manager_->HandleImpression(
+      ImpressionBuilder(clock().Now()).SetExpiry(kImpressionExpiry).Build());
+  conversion_manager_->HandleConversion(DefaultConversion());
+  EXPECT_EQ(0u, test_reporter_->num_reports());
+
+  // Reset the manager to simulate shutdown.
+  conversion_manager_.reset();
+
+  // Fast forward just before the expected report time.
+  task_environment_.FastForwardBy(kFirstReportingWindow -
+                                  base::TimeDelta::FromMinutes(1));
+
+  // Ensure that this report does not receive additional delay.
+  CreateManager();
+  test_reporter_->WaitForNumReports(1);
+  EXPECT_EQ(1u, test_reporter_->num_reports());
+  EXPECT_EQ(start_time + kFirstReportingWindow,
+            test_reporter_->last_report_time());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_network_sender_impl.cc b/chromium/content/browser/conversions/conversion_network_sender_impl.cc
new file mode 100644
index 00000000000..d2259fbf15b
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_network_sender_impl.cc
@@ -0,0 +1,177 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_network_sender_impl.h"
+
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/check.h"
+#include "base/metrics/histogram_functions.h"
+#include "base/strings/strcat.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/time/time.h"
+#include "content/public/browser/storage_partition.h"
+#include "net/base/load_flags.h"
+#include "net/base/net_errors.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_response_headers.h"
+#include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/simple_url_loader.h"
+#include "url/gurl.h"
+#include "url/origin.h"
+#include "url/url_canon.h"
+
+namespace content {
+
+namespace {
+
+// These values are persisted to logs. Entries should not be renumbered and
+// numeric values should never be reused.
+enum class Status {
+  kOk = 0,
+  // Corresponds to a non-zero NET_ERROR.
+  kInternalError = 1,
+  // Corresponds to a non-200 HTTP response code from the reporting endpoint.
+  kExternalError = 2,
+  kMaxValue = kExternalError
+};
+
+// Called when a network request is started for |report|, for logging metrics.
+void LogMetricsOnReportSend(ConversionReport* report) {
+  DCHECK(report);
+
+  // Reports sent from the WebUI should not log metrics.
+  if (report->report_time == base::Time::Min())
+    return;
+
+  // Use a large time range to capture users that might not open the browser for
+  // a long time while a conversion report is pending. Revisit this range if it
+  // is non-ideal for real world data.
+  // Add |extra_delay| to the reported time which will include the amount of
+  // time since the report was originally scheduled, for reports at startup
+  // whose |report_time| changes due to additional startup delay.
+  base::Time now = base::Time::Now();
+  base::TimeDelta delay = (now - report->report_time) + report->extra_delay;
+  base::UmaHistogramCustomTimes("Conversions.ExtraReportDelay", delay,
+                                base::TimeDelta::FromSeconds(1),
+                                base::TimeDelta::FromDays(7), /*buckets=*/100);
+
+  // TODO(csharrison): We should thread the conversion time alongside the
+  // ConversionReport to log the effective time since conversion.
+}
+
+GURL GetReportUrl(const content::ConversionReport& report) {
+  url::Replacements<char> replacements;
+  const char kEndpointPath[] = "/.well-known/register-conversion";
+  replacements.SetPath(kEndpointPath, url::Component(0, strlen(kEndpointPath)));
+  std::string query = base::StrCat(
+      {"impression-data=", report.impression.impression_data(),
+       "&conversion-data=", report.conversion_data,
+       "&credit=", base::NumberToString(report.attribution_credit)});
+  replacements.SetQuery(query.c_str(), url::Component(0, query.length()));
+  return report.impression.reporting_origin().GetURL().ReplaceComponents(
+      replacements);
+}
+
+}  // namespace
+
+ConversionNetworkSenderImpl::ConversionNetworkSenderImpl(
+    StoragePartition* storage_partition)
+    : storage_partition_(storage_partition) {}
+
+ConversionNetworkSenderImpl::~ConversionNetworkSenderImpl() = default;
+
+void ConversionNetworkSenderImpl::SendReport(ConversionReport* report,
+                                             ReportSentCallback sent_callback) {
+  // The browser process URLLoaderFactory is not created by default, so don't
+  // create it until it is directly needed.
+  if (!url_loader_factory_) {
+    url_loader_factory_ =
+        storage_partition_->GetURLLoaderFactoryForBrowserProcess();
+  }
+
+  auto resource_request = std::make_unique<network::ResourceRequest>();
+  resource_request->url = GetReportUrl(*report);
+  resource_request->referrer = report->impression.conversion_origin().GetURL();
+  resource_request->method = net::HttpRequestHeaders::kPostMethod;
+  resource_request->credentials_mode = network::mojom::CredentialsMode::kOmit;
+  resource_request->load_flags =
+      net::LOAD_DISABLE_CACHE | net::LOAD_BYPASS_CACHE;
+
+  // TODO(https://crbug.com/1058018): Update the "policy" field in the traffic
+  // annotation when a setting to disable the API is properly
+  // surfaced/implemented.
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("conversion_measurement_report", R"(
+        semantics {
+          sender: "Event-level Conversion Measurement API"
+          description:
+            "The Conversion Measurement API allows sites to measure "
+            "conversions (e.g. purchases) and attribute them to clicked ads, "
+            "without using cross-site persistent identifiers like third party "
+            "cookies."
+          trigger:
+            "When a registered conversion has become eligible for reporting."
+          data:
+            "A high-entropy identifier declared by the site in which the user "
+            "clicked on an impression. A noisy low entropy data value declared "
+            "on the conversion site. A browser generated value that denotes "
+            "if this was the last impression clicked prior to conversion."
+          destination:OTHER
+        }
+        policy {
+          cookies_allowed: NO
+          setting:
+            "This feature cannot be disabled by settings."
+          policy_exception_justification: "Not implemented."
+        })");
+
+  auto simple_url_loader = network::SimpleURLLoader::Create(
+      std::move(resource_request), traffic_annotation);
+  network::SimpleURLLoader* simple_url_loader_ptr = simple_url_loader.get();
+
+  auto it = loaders_in_progress_.insert(loaders_in_progress_.begin(),
+                                        std::move(simple_url_loader));
+  simple_url_loader_ptr->SetTimeoutDuration(base::TimeDelta::FromSeconds(30));
+
+  // Unretained is safe because the URLLoader is owned by |this| and will be
+  // deleted before |this|.
+  simple_url_loader_ptr->DownloadHeadersOnly(
+      url_loader_factory_.get(),
+      base::BindOnce(&ConversionNetworkSenderImpl::OnReportSent,
+                     base::Unretained(this), std::move(it),
+                     std::move(sent_callback)));
+  LogMetricsOnReportSend(report);
+}
+
+void ConversionNetworkSenderImpl::SetURLLoaderFactoryForTesting(
+    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory) {
+  url_loader_factory_ = url_loader_factory;
+}
+
+void ConversionNetworkSenderImpl::OnReportSent(
+    UrlLoaderList::iterator it,
+    ReportSentCallback sent_callback,
+    scoped_refptr<net::HttpResponseHeaders> headers) {
+  network::SimpleURLLoader* loader = it->get();
+
+  // Consider a non-200 HTTP code as a non-internal error.
+  bool internal_ok = loader->NetError() == net::OK ||
+                     loader->NetError() == net::ERR_HTTP_RESPONSE_CODE_FAILURE;
+  bool external_ok = headers && headers->response_code() == net::HTTP_OK;
+  Status status =
+      internal_ok && external_ok
+          ? Status::kOk
+          : !internal_ok ? Status::kInternalError : Status::kExternalError;
+  base::UmaHistogramEnumeration("Conversions.ReportStatus", status);
+
+  loaders_in_progress_.erase(it);
+  std::move(sent_callback).Run();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_network_sender_impl.h b/chromium/content/browser/conversions/conversion_network_sender_impl.h
new file mode 100644
index 00000000000..0dd23717171
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_network_sender_impl.h
@@ -0,0 +1,71 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_NETWORK_SENDER_IMPL_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_NETWORK_SENDER_IMPL_H_
+
+#include <stdint.h>
+#include <list>
+#include <memory>
+
+#include "base/callback.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/conversion_reporter_impl.h"
+#include "content/common/content_export.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+
+namespace network {
+class SimpleURLLoader;
+}  // namespace network
+
+namespace content {
+
+class StoragePartition;
+
+// Implemented a NetworkSender capable of issuing POST requests for complete
+// conversions. Maintains a set of all ongoing UrlLoaders used for posting
+// conversion reports. Created and owned by ConversionReporterImpl.
+class CONTENT_EXPORT ConversionNetworkSenderImpl
+    : public ConversionReporterImpl::NetworkSender {
+ public:
+  explicit ConversionNetworkSenderImpl(StoragePartition* storage_partition);
+  ConversionNetworkSenderImpl(const ConversionNetworkSenderImpl&) = delete;
+  ConversionNetworkSenderImpl& operator=(const ConversionNetworkSenderImpl&) =
+      delete;
+  ~ConversionNetworkSenderImpl() override;
+
+  // Generates a resource request for |report| and creates a new UrlLoader to
+  // send it. A report is only attempted to be sent once, with a timeout of 30
+  // seconds. |report| is destroyed after this call finishes.
+  // |sent_callback| is run after the request finishes, whether or not it
+  // succeeded,
+  void SendReport(ConversionReport* report,
+                  ReportSentCallback sent_callback) override;
+
+  // Tests inject a TestURLLoaderFactory so they can mock the network response.
+  void SetURLLoaderFactoryForTesting(
+      scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
+
+ private:
+  // This is a std::list so that iterators remain valid during modifications.
+  using UrlLoaderList = std::list<std::unique_ptr<network::SimpleURLLoader>>;
+
+  // Called when headers are available for a sent report.
+  void OnReportSent(UrlLoaderList::iterator it,
+                    ReportSentCallback sent_callback,
+                    scoped_refptr<net::HttpResponseHeaders> headers);
+
+  // Reports that are actively being sent.
+  UrlLoaderList loaders_in_progress_;
+
+  // Must outlive |this|.
+  StoragePartition* storage_partition_;
+
+  // Lazily accessed URLLoaderFactory used for network requests.
+  scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_NETWORK_SENDER_IMPL_H_
diff --git a/chromium/content/browser/conversions/conversion_network_sender_impl_unittest.cc b/chromium/content/browser/conversions/conversion_network_sender_impl_unittest.cc
new file mode 100644
index 00000000000..87e0bfc87c1
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_network_sender_impl_unittest.cc
@@ -0,0 +1,252 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_network_sender_impl.h"
+
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/strings/strcat.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/task/post_task.h"
+#include "base/test/metrics/histogram_tester.h"
+#include "base/test/scoped_feature_list.h"
+#include "base/test/simple_test_clock.h"
+#include "content/browser/conversions/conversion_test_utils.h"
+#include "content/browser/storage_partition_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_features.h"
+#include "content/public/test/browser_task_environment.h"
+#include "content/public/test/test_browser_context.h"
+#include "net/base/load_flags.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
+#include "services/network/test/test_url_loader_factory.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+// Gets a report url which matches reports created by GetReport().
+std::string GetReportUrl(std::string impression_data) {
+  return base::StrCat(
+      {"https://report.test/.well-known/register-conversion?impression-data=",
+       impression_data, "&conversion-data=", impression_data, "&credit=0"});
+}
+
+// Create a simple report where impression data/conversion data/conversion id
+// are all the same.
+ConversionReport GetReport(int64_t conversion_id) {
+  return ConversionReport(
+      ImpressionBuilder(base::Time())
+          .SetData(base::NumberToString(conversion_id))
+          .Build(),
+      /*conversion_data=*/base::NumberToString(conversion_id),
+      /*report_time=*/base::Time(),
+      /*conversion_id=*/conversion_id);
+}
+
+}  // namespace
+
+class ConversionNetworkSenderTest : public testing::Test {
+ public:
+  ConversionNetworkSenderTest()
+      : task_environment_(base::test::TaskEnvironment::TimeSource::MOCK_TIME),
+        network_sender_(std::make_unique<ConversionNetworkSenderImpl>(
+            /*sotrage_partition=*/nullptr)),
+        shared_url_loader_factory_(
+            base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
+                &test_url_loader_factory_)) {
+    network_sender_->SetURLLoaderFactoryForTesting(shared_url_loader_factory_);
+  }
+
+  ConversionReporterImpl::NetworkSender::ReportSentCallback GetSentCallback() {
+    return base::BindOnce(&ConversionNetworkSenderTest::OnReportSent,
+                          base::Unretained(this));
+  }
+
+ protected:
+  size_t num_reports_sent_ = 0u;
+
+  // |task_enviorment_| must be initialized first.
+  content::BrowserTaskEnvironment task_environment_;
+
+  // Unique ptr so it can be reset during testing.
+  std::unique_ptr<ConversionNetworkSenderImpl> network_sender_;
+  network::TestURLLoaderFactory test_url_loader_factory_;
+
+ private:
+  void OnReportSent() { num_reports_sent_++; }
+
+  scoped_refptr<network::SharedURLLoaderFactory> shared_url_loader_factory_;
+};
+
+TEST_F(ConversionNetworkSenderTest,
+       ConversionReportReceived_NetworkRequestMade) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, std::move(base::DoNothing()));
+  EXPECT_EQ(1, test_url_loader_factory_.NumPending());
+  EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+      GetReportUrl("1"), ""));
+}
+
+TEST_F(ConversionNetworkSenderTest, ReportSent_CallbackFired) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, GetSentCallback());
+  EXPECT_EQ(1, test_url_loader_factory_.NumPending());
+  EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+      GetReportUrl("1"), ""));
+  EXPECT_EQ(1u, num_reports_sent_);
+}
+
+TEST_F(ConversionNetworkSenderTest, SenderDeletedDuringRequest_NoCrash) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, GetSentCallback());
+  EXPECT_EQ(1, test_url_loader_factory_.NumPending());
+  network_sender_.reset();
+  EXPECT_FALSE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+      GetReportUrl("1"), ""));
+  EXPECT_EQ(0u, num_reports_sent_);
+}
+
+TEST_F(ConversionNetworkSenderTest, ReportRequestHangs_TimesOut) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, GetSentCallback());
+  EXPECT_EQ(1, test_url_loader_factory_.NumPending());
+
+  // The request should time out after 30 seconds.
+  task_environment_.FastForwardBy(base::TimeDelta::FromSeconds(30));
+
+  EXPECT_EQ(0, test_url_loader_factory_.NumPending());
+
+  // Also verify that the sent callback runs if the request times out.
+  EXPECT_EQ(1u, num_reports_sent_);
+}
+
+TEST_F(ConversionNetworkSenderTest, ReportSent_QueryParamsSetCorrectly) {
+  auto impression =
+      ImpressionBuilder(base::Time())
+          .SetData("impression")
+          .SetReportingOrigin(url::Origin::Create(GURL("https://a.com")))
+          .Build();
+  ConversionReport report(impression,
+                          /*conversion_data=*/"conversion",
+                          /*report_time=*/base::Time(),
+                          /*conversion_id=*/1);
+  report.attribution_credit = 50;
+  network_sender_->SendReport(&report, base::DoNothing());
+
+  std::string expected_report_url(
+      "https://a.com/.well-known/"
+      "register-conversion?impression-data=impression&conversion-data="
+      "conversion&credit=50");
+  EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+      expected_report_url, ""));
+}
+
+TEST_F(ConversionNetworkSenderTest, ReportSent_RequestAttributesSet) {
+  auto impression =
+      ImpressionBuilder(base::Time())
+          .SetData("1")
+          .SetReportingOrigin(url::Origin::Create(GURL("https://a.com")))
+          .SetConversionOrigin(url::Origin::Create(GURL("https://b.com")))
+          .Build();
+  ConversionReport report(impression,
+                          /*conversion_data=*/"1",
+                          /*report_time=*/base::Time(),
+                          /*conversion_id=*/1);
+  network_sender_->SendReport(&report, base::DoNothing());
+
+  const network::ResourceRequest* pending_request;
+  std::string expected_report_url(
+      "https://a.com/.well-known/"
+      "register-conversion?impression-data=1&conversion-data=1&credit=0");
+  EXPECT_TRUE(test_url_loader_factory_.IsPending(expected_report_url,
+                                                 &pending_request));
+
+  // Ensure that the request is sent with no credentials.
+  EXPECT_EQ(network::mojom::CredentialsMode::kOmit,
+            pending_request->credentials_mode);
+  EXPECT_EQ("POST", pending_request->method);
+  EXPECT_EQ(GURL("https://b.com"), pending_request->referrer);
+}
+
+TEST_F(ConversionNetworkSenderTest, ReportResultsInHttpError_SentCallbackRuns) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, GetSentCallback());
+  EXPECT_EQ(0u, num_reports_sent_);
+
+  // We should run the sent callback even if there is an http error.
+  EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+      GetReportUrl("1"), "", net::HttpStatusCode::HTTP_BAD_REQUEST));
+  EXPECT_EQ(1u, num_reports_sent_);
+}
+
+TEST_F(ConversionNetworkSenderTest, ManyReports_AllSentSuccessfully) {
+  for (int i = 0; i < 10; i++) {
+    auto report = GetReport(/*conversion_id=*/i);
+    network_sender_->SendReport(&report, GetSentCallback());
+  }
+  EXPECT_EQ(10, test_url_loader_factory_.NumPending());
+
+  // Send reports out of order to guarantee that callback conversion_ids are
+  // properly handled.
+  for (int i = 9; i >= 0; i--) {
+    std::string report_id = base::NumberToString(i);
+
+    EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+        GetReportUrl(report_id), ""));
+  }
+  EXPECT_EQ(10u, num_reports_sent_);
+  EXPECT_EQ(0, test_url_loader_factory_.NumPending());
+}
+
+TEST_F(ConversionNetworkSenderTest, LoadFlags) {
+  auto report = GetReport(/*conversion_id=*/1);
+  network_sender_->SendReport(&report, GetSentCallback());
+  int load_flags =
+      test_url_loader_factory_.GetPendingRequest(0)->request.load_flags;
+  EXPECT_TRUE(load_flags & net::LOAD_BYPASS_CACHE);
+  EXPECT_TRUE(load_flags & net::LOAD_DISABLE_CACHE);
+}
+
+TEST_F(ConversionNetworkSenderTest, ErrorHistogram) {
+  // All OK.
+  {
+    base::HistogramTester histograms;
+    auto report = GetReport(/*conversion_id=*/1);
+    network_sender_->SendReport(&report, GetSentCallback());
+    EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+        GetReportUrl("1"), ""));
+    // kOk = 0.
+    histograms.ExpectUniqueSample("Conversions.ReportStatus", 0, 1);
+  }
+  // Internal error.
+  {
+    base::HistogramTester histograms;
+    auto report = GetReport(/*conversion_id=*/2);
+    network_sender_->SendReport(&report, GetSentCallback());
+    network::URLLoaderCompletionStatus completion_status(net::ERR_FAILED);
+    EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+        GURL(GetReportUrl("2")), completion_status,
+        network::mojom::URLResponseHead::New(), std::string()));
+    // kInternalError = 1.
+    histograms.ExpectUniqueSample("Conversions.ReportStatus", 1, 1);
+  }
+  {
+    base::HistogramTester histograms;
+    auto report = GetReport(/*conversion_id=*/3);
+    network_sender_->SendReport(&report, GetSentCallback());
+    EXPECT_TRUE(test_url_loader_factory_.SimulateResponseForPendingRequest(
+        GetReportUrl("3"), std::string(), net::HTTP_UNAUTHORIZED));
+    // kExternalError = 2.
+    histograms.ExpectUniqueSample("Conversions.ReportStatus", 2, 1);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_page_metrics.cc b/chromium/content/browser/conversions/conversion_page_metrics.cc
new file mode 100644
index 00000000000..616ec324d67
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_page_metrics.cc
@@ -0,0 +1,24 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_page_metrics.h"
+
+#include "base/metrics/histogram_functions.h"
+
+namespace content {
+
+ConversionPageMetrics::ConversionPageMetrics() = default;
+
+ConversionPageMetrics::~ConversionPageMetrics() {
+  // TODO(https://crbug.com/1044099): Consider limiting registrations per page
+  // based on this metric.
+  base::UmaHistogramExactLinear("Conversions.RegisteredConversionsPerPage",
+                                num_conversions_on_current_page_, 100);
+}
+
+void ConversionPageMetrics::OnConversion(const StorableConversion& conversion) {
+  num_conversions_on_current_page_++;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_page_metrics.h b/chromium/content/browser/conversions/conversion_page_metrics.h
new file mode 100644
index 00000000000..bd974b1098e
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_page_metrics.h
@@ -0,0 +1,33 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_PAGE_METRICS_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_PAGE_METRICS_H_
+
+namespace content {
+
+class StorableConversion;
+
+// Keeps track of per-page-load metrics for conversion measurement. Lifetime is
+// scoped to a single page load.
+class ConversionPageMetrics {
+ public:
+  ConversionPageMetrics();
+  ~ConversionPageMetrics();
+
+  ConversionPageMetrics(const ConversionPageMetrics& other) = delete;
+  ConversionPageMetrics& operator=(const ConversionPageMetrics& other) = delete;
+
+  // Called when a conversion is registered.
+  void OnConversion(const StorableConversion& conversion);
+
+ private:
+  // Keeps track of how many conversion registrations there have been on the
+  // current page.
+  int num_conversions_on_current_page_ = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_PAGE_METRICS_H_
diff --git a/chromium/content/browser/conversions/conversion_policy.cc b/chromium/content/browser/conversions/conversion_policy.cc
index d323ccfe3b7..4df9ed74183 100644
--- a/chromium/content/browser/conversions/conversion_policy.cc
+++ b/chromium/content/browser/conversions/conversion_policy.cc
@@ -5,7 +5,6 @@
 #include "content/browser/conversions/conversion_policy.h"
 
 #include "base/format_macros.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/rand_util.h"
 #include "base/strings/stringprintf.h"
@@ -41,97 +40,24 @@ std::unique_ptr<ConversionPolicy> ConversionPolicy::CreateForTesting(
       new ConversionPolicy(std::move(noise_provider)));
 }
 
-ConversionPolicy::ConversionPolicy()
-    : noise_provider_(std::make_unique<NoiseProvider>()) {}
+ConversionPolicy::ConversionPolicy(bool debug_mode)
+    : debug_mode_(debug_mode),
+      noise_provider_(debug_mode ? nullptr
+                                 : std::make_unique<NoiseProvider>()) {}
 
 ConversionPolicy::ConversionPolicy(
     std::unique_ptr<ConversionPolicy::NoiseProvider> noise_provider)
-    : noise_provider_(std::move(noise_provider)) {}
+    : debug_mode_(false), noise_provider_(std::move(noise_provider)) {}
 
 ConversionPolicy::~ConversionPolicy() = default;
 
-base::Time ConversionPolicy::GetReportTimeForConversion(
-    const ConversionReport& report) const {
-  // After the initial impression, a schedule of reporting windows and deadlines
-  // associated with that impression begins. The time between impression time
-  // and impression expiry is split into multiple reporting windows. At the end
-  // of each window, the browser will send all scheduled reports for that
-  // impression.
-  //
-  // Each reporting window has a deadline and only conversions registered before
-  // that deadline are sent in that window. Each deadline is one hour prior to
-  // the window report time. The deadlines relative to impression time are <2
-  // days minus 1 hour, 7 days minus 1 hour, impression expiry>. The impression
-  // expiry window is only used for conversions that occur after the 7 day
-  // deadline. For example, a conversion which happens one hour after an
-  // impression with an expiry of two hours, is still reported in the 2 day
-  // window.
-  constexpr base::TimeDelta kWindowDeadlineOffset =
-      base::TimeDelta::FromHours(1);
-  base::TimeDelta expiry_deadline =
-      report.impression.expiry_time() - report.impression.impression_time();
-  const base::TimeDelta kReportingWindowDeadlines[] = {
-      base::TimeDelta::FromDays(2) - kWindowDeadlineOffset,
-      base::TimeDelta::FromDays(7) - kWindowDeadlineOffset, expiry_deadline};
-
-  base::TimeDelta deadline_to_use;
-
-  // Given a conversion report that was created at |report.report_time|, find
-  // the first applicable reporting window this conversion should be reported
-  // at.
-  for (base::TimeDelta report_window_deadline : kReportingWindowDeadlines) {
-    // If this window is valid for the conversion, use it. |report.report_time|
-    // is roughly ~now, as the conversion time is used as the default value for
-    // newly created reports that have not had a report time set.
-    if (report.impression.impression_time() + report_window_deadline >=
-        report.report_time) {
-      deadline_to_use = report_window_deadline;
-      break;
-    }
-  }
-
-  // Valid conversion reports should always have a valid reporting deadline.
-  DCHECK(!deadline_to_use.is_zero());
-
-  // If the expiry deadline falls after the first window, but before another
-  // window, use it instead. For example, if expiry is at 3 days, we can send
-  // reports at the 2 day deadline and the expiry deadline instead of at the 7
-  // day deadline.
-  if (expiry_deadline > kReportingWindowDeadlines[0] &&
-      expiry_deadline < deadline_to_use) {
-    deadline_to_use = expiry_deadline;
-  }
-
-  return report.impression.impression_time() + deadline_to_use +
-         kWindowDeadlineOffset;
-}
-
-int ConversionPolicy::GetMaxConversionsPerImpression() const {
-  return 3;
-}
-
-void ConversionPolicy::AssignAttributionCredits(
-    std::vector<ConversionReport>* reports) const {
-  DCHECK(!reports->empty());
-  ConversionReport* last_report = &(reports->at(0));
-
-  // Give the latest impression an attribution of 100 and all the rest 0.
-  for (auto& report : *reports) {
-    report.attribution_credit = 0;
-    if (report.impression.impression_time() >
-        last_report->impression.impression_time())
-      last_report = &report;
-  }
-
-  last_report->attribution_credit = 100;
-}
-
 std::string ConversionPolicy::GetSanitizedConversionData(
     uint64_t conversion_data) const {
   // Add noise to the conversion when the value is first sanitized from a
   // conversion registration event. This noised data will be used for all
   // associated impressions that convert.
-  conversion_data = noise_provider_->GetNoisedConversionData(conversion_data);
+  if (noise_provider_)
+    conversion_data = noise_provider_->GetNoisedConversionData(conversion_data);
 
   // Allow at most 3 bits of entropy in conversion data. base::StringPrintf() is
   // used over base::HexEncode() because HexEncode() returns a hex string with
@@ -141,4 +67,38 @@ std::string ConversionPolicy::GetSanitizedConversionData(
                             conversion_data % kMaxAllowedConversionValues);
 }
 
+std::string ConversionPolicy::GetSanitizedImpressionData(
+    uint64_t impression_data) const {
+  // Impression data is allowed the full 64 bits.
+  return base::StringPrintf("%" PRIx64, impression_data);
+}
+
+base::Time ConversionPolicy::GetExpiryTimeForImpression(
+    const base::Optional<base::TimeDelta>& declared_expiry,
+    base::Time impression_time) const {
+  static constexpr base::TimeDelta kDefaultImpressionExpiry =
+      base::TimeDelta::FromDays(30);
+
+  // Default to the maximum expiry time.
+  base::TimeDelta expiry = declared_expiry.value_or(kDefaultImpressionExpiry);
+
+  // If the impression specified its own expiry, clamp it to the maximum.
+  return impression_time + std::min(expiry, kDefaultImpressionExpiry);
+}
+
+base::Time ConversionPolicy::GetReportTimeForExpiredReportAtStartup(
+    base::Time now) const {
+  // Do not use any delay in debug mode.
+  if (debug_mode_)
+    return now;
+
+  // Add uniform random noise in the range of [0, 5 minutes] to the report time.
+  // TODO(https://crbug.com/1075600): This delay is very conservative. Consider
+  // increasing this delay once we can be sure reports are still sent at
+  // reasonable times, and not delayed for many browser sessions due to short
+  // session up-times.
+  return now +
+         base::TimeDelta::FromMilliseconds(base::RandInt(0, 5 * 60 * 1000));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_policy.h b/chromium/content/browser/conversions/conversion_policy.h
index 1a14eac950e..79f86a739ec 100644
--- a/chromium/content/browser/conversions/conversion_policy.h
+++ b/chromium/content/browser/conversions/conversion_policy.h
@@ -10,8 +10,8 @@
 #include <string>
 #include <vector>
 
+#include "base/optional.h"
 #include "base/time/time.h"
-#include "content/browser/conversions/conversion_report.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -36,35 +36,41 @@ class CONTENT_EXPORT ConversionPolicy {
   static std::unique_ptr<ConversionPolicy> CreateForTesting(
       std::unique_ptr<NoiseProvider> noise_provider);
 
-  ConversionPolicy();
+  // |debug_mode| indicates whether the API is currently running in a mode where
+  // it should not use noise.
+  explicit ConversionPolicy(bool debug_mode = false);
   ConversionPolicy(const ConversionPolicy& other) = delete;
   ConversionPolicy& operator=(const ConversionPolicy& other) = delete;
   virtual ~ConversionPolicy();
 
-  // Get the time a conversion report should be sent, by batching reports into
-  // set reporting windows based on their impression time. This strictly delays
-  // the time a report will be sent.
-  virtual base::Time GetReportTimeForConversion(
-      const ConversionReport& report) const;
-
-  // Maximum number of times the an impression is allowed to convert.
-  virtual int GetMaxConversionsPerImpression() const;
-
-  // Given a set of conversion reports for a single conversion registrations,
-  // assigns attribution credits to each one which will be sent at report time.
-  // By default, this performs "last click" attribution which assigns the report
-  // for the most recent impression a credit of 100, and the rest a credit of 0.
-  virtual void AssignAttributionCredits(
-      std::vector<ConversionReport>* reports) const;
-
   // Gets the sanitized conversion data for a conversion. This strips entropy
   // from the provided to data to at most 3 bits of information.
   virtual std::string GetSanitizedConversionData(
       uint64_t conversion_data) const;
 
+  // Gets the sanitized impression data for an impression. Returns the decoded
+  // number as a hexadecimal string.
+  virtual std::string GetSanitizedImpressionData(
+      uint64_t impression_data) const;
+
+  // Returns the expiry time for an impression that is clamped to a maximum
+  // value of 30 days from |impression_time|.
+  virtual base::Time GetExpiryTimeForImpression(
+      const base::Optional<base::TimeDelta>& declared_expiry,
+      base::Time impression_time) const;
+
+  // Delays reports that should have been sent while the browser was not open by
+  // given them a noisy report time to help disassociate them from other
+  // reports.
+  virtual base::Time GetReportTimeForExpiredReportAtStartup(
+      base::Time now) const;
+
  private:
   // For testing only.
-  ConversionPolicy(std::unique_ptr<NoiseProvider> noise_provider);
+  explicit ConversionPolicy(std::unique_ptr<NoiseProvider> noise_provider);
+
+  // Whether the API is running in debug mode. No noise or delay should be used.
+  const bool debug_mode_;
 
   std::unique_ptr<NoiseProvider> noise_provider_;
 };
diff --git a/chromium/content/browser/conversions/conversion_policy_unittest.cc b/chromium/content/browser/conversions/conversion_policy_unittest.cc
index b2e5941da25..15ff3505fb7 100644
--- a/chromium/content/browser/conversions/conversion_policy_unittest.cc
+++ b/chromium/content/browser/conversions/conversion_policy_unittest.cc
@@ -16,17 +16,6 @@ namespace content {
 
 namespace {
 
-constexpr base::TimeDelta kDefaultExpiry = base::TimeDelta::FromDays(30);
-
-ConversionReport GetReport(base::Time impression_time,
-                           base::Time conversion_time,
-                           base::TimeDelta expiry = kDefaultExpiry) {
-  return ConversionReport(
-      ImpressionBuilder(impression_time).SetExpiry(expiry).Build(),
-      /*conversion_data=*/"123", conversion_time,
-      /*conversion_id=*/base::nullopt);
-}
-
 // Fake ConversionNoiseProvider that return un-noised conversion data.
 class EmptyNoiseProvider : public ConversionPolicy::NoiseProvider {
  public:
@@ -59,6 +48,15 @@ TEST_F(ConversionPolicyTest, HighEntropyConversionData_StrippedToLowerBits) {
                      ->GetSanitizedConversionData(conversion_data));
 }
 
+TEST_F(ConversionPolicyTest, SanitizeHighEntropyImpressionData_Unchanged) {
+  uint64_t impression_data = 256LU;
+
+  // The policy should not alter the impression data, and return the hexadecimal
+  // representation.
+  EXPECT_EQ("100",
+            ConversionPolicy().GetSanitizedImpressionData(impression_data));
+}
+
 TEST_F(ConversionPolicyTest, ThreeBitConversionData_Unchanged) {
   std::unique_ptr<ConversionPolicy> policy = ConversionPolicy::CreateForTesting(
       std::make_unique<EmptyNoiseProvider>());
@@ -75,100 +73,37 @@ TEST_F(ConversionPolicyTest, SantizizeConversionData_OutputHasNoise) {
                      ->GetSanitizedConversionData(4UL));
 }
 
-TEST_F(ConversionPolicyTest, ImmediateConversion_FirstWindowUsed) {
-  base::Time impression_time = base::Time::Now();
-  auto report = GetReport(impression_time, /*conversion_time=*/impression_time);
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
-            ConversionPolicy().GetReportTimeForConversion(report));
-}
-
-TEST_F(ConversionPolicyTest, ConversionImmediatelyBeforeWindow_NextWindowUsed) {
-  base::Time impression_time = base::Time::Now();
-  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(2) -
-                               base::TimeDelta::FromMinutes(1);
-  auto report = GetReport(impression_time, conversion_time);
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(7),
-            ConversionPolicy().GetReportTimeForConversion(report));
-}
-
-TEST_F(ConversionPolicyTest, ConversionBeforeWindowDelay_WindowUsed) {
-  base::Time impression_time = base::Time::Now();
-
-  // The deadline for a window is 1 hour before the window. Use a time just
-  // before the deadline.
-  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(2) -
-                               base::TimeDelta::FromMinutes(61);
-  auto report = GetReport(impression_time, conversion_time);
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
-            ConversionPolicy().GetReportTimeForConversion(report));
+// This test will fail flakily if noise is used.
+TEST_F(ConversionPolicyTest, DebugMode_ConversionDataNotNoised) {
+  uint64_t conversion_data = 0UL;
+  for (int i = 0; i < 100; i++) {
+    EXPECT_EQ(base::NumberToString(conversion_data),
+              ConversionPolicy(true /* debug_mode */)
+                  .GetSanitizedConversionData(conversion_data));
+  }
 }
 
-TEST_F(ConversionPolicyTest,
-       ImpressionExpiryBeforeTwoDayWindow_TwoDayWindowUsed) {
+TEST_F(ConversionPolicyTest, NoExpiryForImpression_DefaultUsed) {
   base::Time impression_time = base::Time::Now();
-  base::Time conversion_time = impression_time + base::TimeDelta::FromHours(1);
-
-  // Set the impression to expire before the two day window.
-  auto report = GetReport(impression_time, conversion_time,
-                          /*expiry=*/base::TimeDelta::FromHours(2));
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
-            ConversionPolicy().GetReportTimeForConversion(report));
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(30),
+            ConversionPolicy().GetExpiryTimeForImpression(
+                /*declared_expiry=*/base::nullopt, impression_time));
 }
 
-TEST_F(ConversionPolicyTest,
-       ImpressionExpiryBeforeSevenDayWindow_ExpiryWindowUsed) {
+TEST_F(ConversionPolicyTest, LargeImpressionExpirySpecified_ClampedTo30Days) {
+  constexpr base::TimeDelta declared_expiry = base::TimeDelta::FromDays(60);
   base::Time impression_time = base::Time::Now();
-  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(3);
-
-  // Set the impression to expire before the two day window.
-  auto report = GetReport(impression_time, conversion_time,
-                          /*expiry=*/base::TimeDelta::FromDays(4));
-
-  // The expiry window is reported one hour after expiry time.
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(4) +
-                base::TimeDelta::FromHours(1),
-            ConversionPolicy().GetReportTimeForConversion(report));
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(30),
+            ConversionPolicy().GetExpiryTimeForImpression(declared_expiry,
+                                                          impression_time));
 }
 
-TEST_F(ConversionPolicyTest,
-       ImpressionExpiryAfterSevenDayWindow_ExpiryWindowUsed) {
+TEST_F(ConversionPolicyTest, ImpressionExpirySpecified_ExpiryOverrideDefault) {
+  constexpr base::TimeDelta declared_expiry = base::TimeDelta::FromDays(10);
   base::Time impression_time = base::Time::Now();
-  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(7);
-
-  // Set the impression to expire before the two day window.
-  auto report = GetReport(impression_time, conversion_time,
-                          /*expiry=*/base::TimeDelta::FromDays(9));
-
-  // The expiry window is reported one hour after expiry time.
-  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(9) +
-                base::TimeDelta::FromHours(1),
-            ConversionPolicy().GetReportTimeForConversion(report));
-}
-
-TEST_F(ConversionPolicyTest,
-       SingleReportForConversion_AttributionCreditAssigned) {
-  base::Time now = base::Time::Now();
-  std::vector<ConversionReport> reports = {
-      GetReport(/*impression_time=*/now, /*conversion_time=*/now)};
-  ConversionPolicy().AssignAttributionCredits(&reports);
-  EXPECT_EQ(1u, reports.size());
-  EXPECT_EQ(100, reports[0].attribution_credit);
-}
-
-TEST_F(ConversionPolicyTest, TwoReportsForConversion_LastReceivesCredit) {
-  base::Time now = base::Time::Now();
-  std::vector<ConversionReport> reports = {
-      GetReport(/*impression_time=*/now, /*conversion_time=*/now),
-      GetReport(/*impression_time=*/now + base::TimeDelta::FromHours(100),
-                /*conversion_time=*/now)};
-  ConversionPolicy().AssignAttributionCredits(&reports);
-  EXPECT_EQ(2u, reports.size());
-  EXPECT_EQ(0, reports[0].attribution_credit);
-  EXPECT_EQ(100, reports[1].attribution_credit);
-
-  // Ensure the reports were not rearranged.
-  EXPECT_EQ(now + base::TimeDelta::FromHours(100),
-            reports[1].impression.impression_time());
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(10),
+            ConversionPolicy().GetExpiryTimeForImpression(declared_expiry,
+                                                          impression_time));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_registration_browsertest.cc b/chromium/content/browser/conversions/conversion_registration_browsertest.cc
index 55d40c22149..8b6fce9261d 100644
--- a/chromium/content/browser/conversions/conversion_registration_browsertest.cc
+++ b/chromium/content/browser/conversions/conversion_registration_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/conversions/conversion_host.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -135,6 +136,25 @@ IN_PROC_BROWSER_TEST_F(ConversionRegistrationBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(ConversionRegistrationBrowserTest,
+                       FeaturePolicyDisabled_ConversionNotRegistered) {
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL(
+                   "/page_with_conversion_measurement_disabled.html")));
+  std::unique_ptr<TestConversionHost> host =
+      TestConversionHost::ReplaceAndGetConversionHost(web_contents());
+
+  GURL redirect_url = embedded_test_server()->GetURL(
+      "/server-redirect?" + kWellKnownUrl + "?conversion-data=200");
+  ResourceLoadObserver load_observer(shell());
+  EXPECT_TRUE(ExecJs(web_contents(),
+                     JsReplace("createTrackingPixel($1);", redirect_url)));
+  load_observer.WaitForResourceCompletion(redirect_url);
+
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
+  EXPECT_EQ(0u, host->num_conversions());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionRegistrationBrowserTest,
                        ConversionRegistrationNotRedirect_NotReceived) {
   EXPECT_TRUE(NavigateToURL(
       shell(),
diff --git a/chromium/content/browser/conversions/conversion_report.cc b/chromium/content/browser/conversions/conversion_report.cc
index 8b285ad5791..6d8bbbaf2dc 100644
--- a/chromium/content/browser/conversions/conversion_report.cc
+++ b/chromium/content/browser/conversions/conversion_report.cc
@@ -28,6 +28,7 @@ std::ostream& operator<<(std::ostream& out, const ConversionReport& report) {
       << ", reporting_origin: " << report.impression.reporting_origin()
       << ", conversion_data: " << report.conversion_data
       << ", report_time: " << report.report_time
+      << ", extra_delay: " << report.extra_delay
       << ", attribution_credit: " << report.attribution_credit;
   return out;
 }
diff --git a/chromium/content/browser/conversions/conversion_report.h b/chromium/content/browser/conversions/conversion_report.h
index 64d2e62f0ef..38aa9b4a5a1 100644
--- a/chromium/content/browser/conversions/conversion_report.h
+++ b/chromium/content/browser/conversions/conversion_report.h
@@ -38,6 +38,10 @@ struct CONTENT_EXPORT ConversionReport {
   // The time this conversion report should be sent.
   base::Time report_time;
 
+  // Tracks ephemeral increases to |report_time| for this conversion report, for
+  // the purposes of logging metrics.
+  base::TimeDelta extra_delay;
+
   // The attribution credit assigned to this conversion report. This is derived
   // from the set of all impressions that matched a singular conversion event.
   // This should be in the range 0-100. A set of ConversionReports for one
diff --git a/chromium/content/browser/conversions/conversion_reporter_impl.cc b/chromium/content/browser/conversions/conversion_reporter_impl.cc
new file mode 100644
index 00000000000..3011e2efc51
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_reporter_impl.cc
@@ -0,0 +1,108 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_reporter_impl.h"
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/rand_util.h"
+#include "base/time/clock.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_network_sender_impl.h"
+
+namespace content {
+
+ConversionReporterImpl::ConversionReporterImpl(
+    StoragePartition* storage_partition,
+    const base::Clock* clock)
+    : clock_(clock),
+      network_sender_(
+          std::make_unique<ConversionNetworkSenderImpl>(storage_partition)) {}
+
+ConversionReporterImpl::~ConversionReporterImpl() = default;
+
+void ConversionReporterImpl::AddReportsToQueue(
+    std::vector<ConversionReport> reports,
+    base::RepeatingCallback<void(int64_t)> report_sent_callback) {
+  DCHECK(!reports.empty());
+
+  std::vector<std::unique_ptr<ConversionReport>> swappable_reports;
+  for (ConversionReport& report : reports) {
+    swappable_reports.push_back(
+        std::make_unique<ConversionReport>(std::move(report)));
+  }
+
+  // Shuffle new reports to provide plausible deniability on the ordering of
+  // reports that share the same |report_time|. This is important because
+  // multiple conversions for the same impression share the same report time if
+  // they are within the same reporting window, and we do not want to allow
+  // ordering on their conversion metadata bits.
+  base::RandomShuffle(swappable_reports.begin(), swappable_reports.end());
+
+  for (std::unique_ptr<ConversionReport>& report : swappable_reports) {
+    // If the given report is already being processed, ignore it.
+    bool inserted = conversion_report_callbacks_
+                        .emplace(*(report->conversion_id), report_sent_callback)
+                        .second;
+    if (inserted)
+      report_queue_.push(std::move(report));
+  }
+  MaybeScheduleNextReport();
+}
+
+void ConversionReporterImpl::SetNetworkSenderForTesting(
+    std::unique_ptr<NetworkSender> network_sender) {
+  network_sender_ = std::move(network_sender);
+}
+
+void ConversionReporterImpl::SendNextReport() {
+  // Send the next report and remove it from the queue. Bind the conversion id
+  // to the sent callback so we know which conversion report has finished
+  // sending.
+  network_sender_->SendReport(
+      report_queue_.top().get(),
+      base::BindOnce(&ConversionReporterImpl::OnReportSent,
+                     base::Unretained(this),
+                     *report_queue_.top()->conversion_id));
+  report_queue_.pop();
+  MaybeScheduleNextReport();
+}
+
+void ConversionReporterImpl::MaybeScheduleNextReport() {
+  if (report_queue_.empty())
+    return;
+
+  send_report_timer_.Stop();
+  base::Time current_time = clock_->Now();
+  base::Time report_time = report_queue_.top()->report_time;
+
+  // Start a timer to wait until the next report is ready to be sent. This
+  // purposefully yields the thread for every report that gets scheduled.
+  // Unretained is safe because the task should never actually be posted if the
+  // timer itself is destroyed
+  send_report_timer_.Start(
+      FROM_HERE,
+      (report_time < current_time) ? base::TimeDelta()
+                                   : report_time - current_time,
+      base::BindOnce(&ConversionReporterImpl::SendNextReport,
+                     base::Unretained(this)));
+}
+
+void ConversionReporterImpl::OnReportSent(int64_t conversion_id) {
+  auto it = conversion_report_callbacks_.find(conversion_id);
+  DCHECK(it != conversion_report_callbacks_.end());
+  std::move(it->second).Run(conversion_id);
+  conversion_report_callbacks_.erase(it);
+}
+
+bool ConversionReporterImpl::ReportComparator::operator()(
+    const std::unique_ptr<ConversionReport>& a,
+    const std::unique_ptr<ConversionReport>& b) const {
+  // Returns whether a should appear before b in ordering. Because
+  // std::priority_queue is max priority queue, we used greater then to make a
+  // min priority queue.
+  return a->report_time > b->report_time;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_reporter_impl.h b/chromium/content/browser/conversions/conversion_reporter_impl.h
new file mode 100644
index 00000000000..855a2b3a4f4
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_reporter_impl.h
@@ -0,0 +1,111 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_REPORTER_IMPL_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_REPORTER_IMPL_H_
+
+#include <stdint.h>
+#include <memory>
+#include <queue>
+#include <vector>
+
+#include "base/callback.h"
+#include "base/containers/flat_map.h"
+#include "base/time/time.h"
+#include "base/timer/timer.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/common/content_export.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+
+namespace base {
+class Clock;
+}  // namespace base
+
+namespace content {
+
+class StoragePartition;
+
+// This class is responsible for managing the dispatch of conversion reports to
+// a ConversionReporterImpl::NetworkSender. It maintains a queue of reports and
+// a timer to ensure all reports are sent at the correct time, since the time in
+// which a conversion report is sent is potentially sensitive information.
+// Created and owned by ConversionManager.
+class CONTENT_EXPORT ConversionReporterImpl
+    : public ConversionManagerImpl::ConversionReporter {
+ public:
+  // This class is responsible for sending conversion reports to their
+  // configured endpoints over the network.
+  class NetworkSender {
+   public:
+    virtual ~NetworkSender() = default;
+
+    // Callback used to notify caller that the requested report has been sent.
+    using ReportSentCallback = base::OnceCallback<void()>;
+
+    // Generates and sends a conversion report matching |report|. This should
+    // generate a secure POST quest with no-credentials. Does not persist the
+    // raw pointer.
+    virtual void SendReport(ConversionReport* report,
+                            ReportSentCallback sent_callback) = 0;
+  };
+
+  ConversionReporterImpl(StoragePartition* storage_partition,
+                         const base::Clock* clock);
+  ConversionReporterImpl(const ConversionReporterImpl&) = delete;
+  ConversionReporterImpl& operator=(const ConversionReporterImpl&) = delete;
+  ~ConversionReporterImpl() override;
+
+  // ConversionManagerImpl::ConversionReporter:
+  void AddReportsToQueue(
+      std::vector<ConversionReport> reports,
+      base::RepeatingCallback<void(int64_t)> report_sent_callback) override;
+
+  void SetNetworkSenderForTesting(
+      std::unique_ptr<NetworkSender> network_sender);
+
+ private:
+  void MaybeScheduleNextReport();
+  void SendNextReport();
+
+  // Called when a conversion report sent via NetworkSender::SendReport() has
+  // completed loading.
+  void OnReportSent(int64_t conversion_id);
+
+  // Comparator used to order ConversionReports by their report time, with the
+  // smallest time at the top of |report_queue_|.
+  struct ReportComparator {
+    bool operator()(const std::unique_ptr<ConversionReport>& a,
+                    const std::unique_ptr<ConversionReport>& b) const;
+  };
+
+  // Priority queue which holds reports that are yet to be sent. Reports are
+  // removed from the queue when they are delivered to the NetworkSender.
+  std::priority_queue<std::unique_ptr<ConversionReport>,
+                      std::vector<std::unique_ptr<ConversionReport>>,
+                      ReportComparator>
+      report_queue_;
+
+  // Map of all conversion ids that are currently in |report_queue| or are being
+  // sent by |network_sender_|, and their associated report sent callbacks. The
+  // number of concurrent conversion reports being sent at any time is expected
+  // to be small, so a flat_map is used.
+  base::flat_map<int64_t, base::OnceCallback<void(int64_t)>>
+      conversion_report_callbacks_;
+
+  const base::Clock* clock_;
+
+  // Timer which signals the next report in |report_queue_| should be sent.
+  base::OneShotTimer send_report_timer_;
+
+  // Responsible for issuing requests to network for report that need to be
+  // sent. Calls OnReportSent() when a report has finished sending.
+  //
+  // Should never be nullptr.
+  std::unique_ptr<NetworkSender> network_sender_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_REPORTER_IMPL_H_
diff --git a/chromium/content/browser/conversions/conversion_reporter_impl_unittest.cc b/chromium/content/browser/conversions/conversion_reporter_impl_unittest.cc
new file mode 100644
index 00000000000..a2b030ed8f6
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_reporter_impl_unittest.cc
@@ -0,0 +1,203 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_reporter_impl.h"
+
+#include <stdint.h>
+
+#include "base/bind.h"
+#include "base/sequenced_task_runner.h"
+#include "base/strings/strcat.h"
+#include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
+#include "base/test/simple_test_clock.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_test_utils.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/storage_partition.h"
+#include "content/public/test/browser_task_environment.h"
+#include "content/public/test/test_browser_context.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+// Create a report which should be sent at |report_time|. Impression
+// data/conversion data/conversion id are all the same for simplicity.
+ConversionReport GetReport(base::Time report_time, int64_t conversion_id) {
+  // Construct impressions with a null impression time as it is not used for
+  // reporting.
+  return ConversionReport(ImpressionBuilder(base::Time()).Build(),
+                          /*conversion_data=*/"", report_time,
+                          /*conversion_id=*/conversion_id);
+}
+
+// NetworkSender that keep track of the last sent report id.
+class MockNetworkSender : public ConversionReporterImpl::NetworkSender {
+ public:
+  MockNetworkSender() = default;
+
+  void SendReport(ConversionReport* conversion_report,
+                  ReportSentCallback sent_callback) override {
+    last_sent_report_id_ = *conversion_report->conversion_id;
+    num_reports_sent_++;
+    std::move(sent_callback).Run();
+  }
+
+  int64_t last_sent_report_id() { return last_sent_report_id_; }
+
+  size_t num_reports_sent() { return num_reports_sent_; }
+
+ private:
+  size_t num_reports_sent_ = 0u;
+  int64_t last_sent_report_id_ = -1;
+};
+
+}  // namespace
+
+class ConversionReporterImplTest : public testing::Test {
+ public:
+  ConversionReporterImplTest()
+      : task_environment_(base::test::TaskEnvironment::TimeSource::MOCK_TIME),
+        browser_context_(std::make_unique<TestBrowserContext>()),
+        reporter_(std::make_unique<ConversionReporterImpl>(
+            BrowserContext::GetDefaultStoragePartition(browser_context_.get()),
+            task_environment_.GetMockClock())) {
+    auto network_sender = std::make_unique<MockNetworkSender>();
+    sender_ = network_sender.get();
+    reporter_->SetNetworkSenderForTesting(std::move(network_sender));
+  }
+
+  const base::Clock& clock() { return *task_environment_.GetMockClock(); }
+
+ protected:
+  // |task_enviorment_| must be initialized first.
+  content::BrowserTaskEnvironment task_environment_;
+  std::unique_ptr<TestBrowserContext> browser_context_;
+
+  std::unique_ptr<ConversionReporterImpl> reporter_;
+  MockNetworkSender* sender_;
+};
+
+TEST_F(ConversionReporterImplTest,
+       ReportAddedWithImmediateReportTime_ReportSent) {
+  reporter_->AddReportsToQueue({GetReport(clock().Now(), /*conversion_id=*/1)},
+                               base::BindRepeating([](int64_t conversion_id) {
+                                 EXPECT_EQ(1L, conversion_id);
+                               }));
+
+  // Fast forward by 0, as we yield the thread when a report is scheduled to be
+  // sent.
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(1, sender_->last_sent_report_id());
+}
+
+TEST_F(ConversionReporterImplTest,
+       ReportWithReportTimeBeforeCurrentTime_ReportSent) {
+  reporter_->AddReportsToQueue(
+      {GetReport(clock().Now() - base::TimeDelta::FromHours(10),
+                 /*conversion_id=*/1)},
+      base::BindRepeating(
+          [](int64_t conversion_id) { EXPECT_EQ(1L, conversion_id); }));
+
+  // Fast forward by 0, as we yield the thread when a report is scheduled to be
+  // sent.
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(1, sender_->last_sent_report_id());
+}
+
+TEST_F(ConversionReporterImplTest,
+       ReportWithDelayedReportTime_NotSentUntilDelay) {
+  const base::TimeDelta delay = base::TimeDelta::FromMinutes(30);
+
+  reporter_->AddReportsToQueue(
+      {GetReport(clock().Now() + delay, /*conversion_id=*/1)},
+      base::DoNothing());
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(0u, sender_->num_reports_sent());
+
+  task_environment_.FastForwardBy(delay - base::TimeDelta::FromSeconds(1));
+  EXPECT_EQ(0u, sender_->num_reports_sent());
+
+  task_environment_.FastForwardBy(base::TimeDelta::FromSeconds(1));
+  EXPECT_EQ(1u, sender_->num_reports_sent());
+}
+
+TEST_F(ConversionReporterImplTest, DuplicateReportScheduled_Ignored) {
+  reporter_->AddReportsToQueue(
+      {GetReport(clock().Now() + base::TimeDelta::FromMinutes(1),
+                 /*conversion_id=*/1)},
+      base::DoNothing());
+
+  // A duplicate report should not be scheduled.
+  reporter_->AddReportsToQueue(
+      {GetReport(clock().Now() + base::TimeDelta::FromMinutes(1),
+                 /*conversion_id=*/1)},
+      base::DoNothing());
+  task_environment_.FastForwardBy(base::TimeDelta::FromMinutes(1));
+  EXPECT_EQ(1u, sender_->num_reports_sent());
+}
+
+TEST_F(ConversionReporterImplTest,
+       NewReportWithPreviouslySeenConversionId_Scheduled) {
+  reporter_->AddReportsToQueue({GetReport(clock().Now(), /*conversion_id=*/1)},
+                               base::DoNothing());
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(1u, sender_->num_reports_sent());
+
+  // We should schedule the new report because the previous report has been
+  // sent.
+  reporter_->AddReportsToQueue({GetReport(clock().Now(), /*conversion_id=*/1)},
+                               base::DoNothing());
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(2u, sender_->num_reports_sent());
+}
+
+TEST_F(ConversionReporterImplTest, ManyReportsAddedAtOnce_SentInOrder) {
+  std::vector<ConversionReport> reports;
+  int64_t last_report_id = 0UL;
+  for (int i = 1; i < 10; i++) {
+    reports.push_back(GetReport(clock().Now() + base::TimeDelta::FromMinutes(i),
+                                /*conversion_id=*/i));
+  }
+  reporter_->AddReportsToQueue(
+      reports, base::BindLambdaForTesting([&](int64_t conversion_id) {
+        last_report_id = conversion_id;
+      }));
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(0u, sender_->num_reports_sent());
+
+  for (int i = 1; i < 10; i++) {
+    task_environment_.FastForwardBy(base::TimeDelta::FromMinutes(1));
+
+    EXPECT_EQ(static_cast<size_t>(i), sender_->num_reports_sent());
+    EXPECT_EQ(static_cast<int64_t>(i), sender_->last_sent_report_id());
+    EXPECT_EQ(static_cast<int64_t>(i), last_report_id);
+  }
+}
+
+TEST_F(ConversionReporterImplTest, ManyReportsAddedSeparately_SentInOrder) {
+  int64_t last_report_id = 0;
+  auto report_sent_callback = base::BindLambdaForTesting(
+      [&](int64_t conversion_id) { last_report_id = conversion_id; });
+  for (int i = 1; i < 10; i++) {
+    reporter_->AddReportsToQueue(
+        {GetReport(clock().Now() + base::TimeDelta::FromMinutes(i),
+                   /*conversion_id=*/i)},
+        report_sent_callback);
+  }
+  task_environment_.FastForwardBy(base::TimeDelta());
+  EXPECT_EQ(0u, sender_->num_reports_sent());
+
+  for (int i = 1; i < 10; i++) {
+    task_environment_.FastForwardBy(base::TimeDelta::FromMinutes(1));
+
+    EXPECT_EQ(static_cast<size_t>(i), sender_->num_reports_sent());
+    EXPECT_EQ(static_cast<int64_t>(i), sender_->last_sent_report_id());
+    EXPECT_EQ(static_cast<int64_t>(i), last_report_id);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_storage.h b/chromium/content/browser/conversions/conversion_storage.h
index cfdae6e57ce..1c8feed1ccf 100644
--- a/chromium/content/browser/conversions/conversion_storage.h
+++ b/chromium/content/browser/conversions/conversion_storage.h
@@ -8,10 +8,12 @@
 #include <stdint.h>
 #include <vector>
 
+#include "base/callback.h"
 #include "base/time/time.h"
 #include "content/browser/conversions/conversion_report.h"
 #include "content/browser/conversions/storable_conversion.h"
 #include "content/browser/conversions/storable_impression.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -41,6 +43,21 @@ class ConversionStorage {
     // Impressions will be checked against this limit after they schedule a new
     // report.
     virtual int GetMaxConversionsPerImpression() const = 0;
+
+    // These limits are designed solely to avoid excessive disk / memory usage.
+    // In particular, they do not correspond with any privacy parameters.
+    // TODO(crbug.com/1082754): Consider replacing this functionality (and the
+    // data deletion logic) with the quota system.
+    //
+    // Returns the maximum number of impressions that can be in storage at any
+    // time for an impression top-level origin.
+    virtual int GetMaxImpressionsPerOrigin() const = 0;
+    //  Returns the maximum number of conversions that can be in storage at any
+    //  time for a conversion top-level origin. Note that since reporting
+    //  origins are the actual entities that invoke conversion registration, we
+    //  could consider changing this limit to be keyed by a <conversion origin,
+    //  reporting origin> tuple.
+    virtual int GetMaxConversionsPerOrigin() const = 0;
   };
   virtual ~ConversionStorage() = default;
 
@@ -69,6 +86,13 @@ class ConversionStorage {
   virtual std::vector<ConversionReport> GetConversionsToReport(
       base::Time max_report_time) = 0;
 
+  // Returns all active impressions in storage. Active impressions are all
+  // impressions that can still convert. Impressions that: are past expiry,
+  // reached the conversion limit, or was marked inactive due to having
+  // converted and then superceded by a matching impression should not be
+  // returned.
+  virtual std::vector<StorableImpression> GetActiveImpressions() = 0;
+
   // Deletes all impressions that have expired and have no pending conversion
   // reports. Returns the number of impressions that were deleted.
   virtual int DeleteExpiredImpressions() = 0;
@@ -77,9 +101,18 @@ class ConversionStorage {
   // whether the deletion was successful.
   virtual bool DeleteConversion(int64_t conversion_id) = 0;
 
-  // TODO(johnidel): Add an API to ConversionStorage that removes site data, and
-  // hook it into the data remover. This should be added before the API is
-  // enabled.
+  // Deletes all data in storage for URLs matching |filter|, between
+  // |delete_begin| and |delete_end| time. More specifically, this:
+  // 1. Deletes all impressions within the time range. If any conversion is
+  //    attributed to this impression it is also deleted.
+  // 2. Deletes all conversions within the time range. All impressions
+  //    attributed to the conversion are also deleted.
+  //
+  // Note: if |filter| is null, it means that all Origins should match.
+  virtual void ClearData(
+      base::Time delete_begin,
+      base::Time delete_end,
+      base::RepeatingCallback<bool(const url::Origin& origin)> filter) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_storage_delegate_impl.cc b/chromium/content/browser/conversions/conversion_storage_delegate_impl.cc
new file mode 100644
index 00000000000..6899b7ef7f8
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_storage_delegate_impl.cc
@@ -0,0 +1,110 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_storage_delegate_impl.h"
+
+namespace content {
+
+ConversionStorageDelegateImpl::ConversionStorageDelegateImpl(bool debug_mode)
+    : debug_mode_(debug_mode) {
+  DETACH_FROM_SEQUENCE(sequence_checker_);
+}
+
+void ConversionStorageDelegateImpl::ProcessNewConversionReports(
+    std::vector<ConversionReport>* reports) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(!reports->empty());
+  ConversionReport* last_report = &(reports->at(0));
+
+  // Assign attribution credits to each report that will be sent at report time.
+  // This performs "last click" attribution which assigns the report
+  // for the most recent impression a credit of 100, and the rest a credit of 0.
+  for (ConversionReport& report : *reports) {
+    report.report_time = GetReportTimeForConversion(report);
+
+    report.attribution_credit = 0;
+    if (report.impression.impression_time() >
+        last_report->impression.impression_time())
+      last_report = &report;
+  }
+
+  last_report->attribution_credit = 100;
+}
+
+int ConversionStorageDelegateImpl::GetMaxConversionsPerImpression() const {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  return 3;
+}
+
+int ConversionStorageDelegateImpl::GetMaxImpressionsPerOrigin() const {
+  return 1024;
+}
+
+int ConversionStorageDelegateImpl::GetMaxConversionsPerOrigin() const {
+  return 1024;
+}
+
+base::Time ConversionStorageDelegateImpl::GetReportTimeForConversion(
+    const ConversionReport& report) const {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  //  |report.report_time| is roughly ~now, for newly created conversion
+  //  reports. If in debug mode, the report should be sent immediately.
+  if (debug_mode_)
+    return report.report_time;
+
+  // After the initial impression, a schedule of reporting windows and deadlines
+  // associated with that impression begins. The time between impression time
+  // and impression expiry is split into multiple reporting windows. At the end
+  // of each window, the browser will send all scheduled reports for that
+  // impression.
+  //
+  // Each reporting window has a deadline and only conversions registered before
+  // that deadline are sent in that window. Each deadline is one hour prior to
+  // the window report time. The deadlines relative to impression time are <2
+  // days minus 1 hour, 7 days minus 1 hour, impression expiry>. The impression
+  // expiry window is only used for conversions that occur after the 7 day
+  // deadline. For example, a conversion which happens one hour after an
+  // impression with an expiry of two hours, is still reported in the 2 day
+  // window.
+  constexpr base::TimeDelta kWindowDeadlineOffset =
+      base::TimeDelta::FromHours(1);
+  base::TimeDelta expiry_deadline =
+      report.impression.expiry_time() - report.impression.impression_time();
+  const base::TimeDelta kReportingWindowDeadlines[] = {
+      base::TimeDelta::FromDays(2) - kWindowDeadlineOffset,
+      base::TimeDelta::FromDays(7) - kWindowDeadlineOffset, expiry_deadline};
+
+  base::TimeDelta deadline_to_use;
+
+  // Given a conversion report that was created at |report.report_time|, find
+  // the first applicable reporting window this conversion should be reported
+  // at.
+  for (base::TimeDelta report_window_deadline : kReportingWindowDeadlines) {
+    // If this window is valid for the conversion, use it. |report.report_time|
+    // is roughly ~now, as the conversion time is used as the default value for
+    // newly created reports that have not had a report time set.
+    if (report.impression.impression_time() + report_window_deadline >=
+        report.report_time) {
+      deadline_to_use = report_window_deadline;
+      break;
+    }
+  }
+
+  // Valid conversion reports should always have a valid reporting deadline.
+  DCHECK(!deadline_to_use.is_zero());
+
+  // If the expiry deadline falls after the first window, but before another
+  // window, use it instead. For example, if expiry is at 3 days, we can send
+  // reports at the 2 day deadline and the expiry deadline instead of at the 7
+  // day deadline.
+  if (expiry_deadline > kReportingWindowDeadlines[0] &&
+      expiry_deadline < deadline_to_use) {
+    deadline_to_use = expiry_deadline;
+  }
+
+  return report.impression.impression_time() + deadline_to_use +
+         kWindowDeadlineOffset;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_storage_delegate_impl.h b/chromium/content/browser/conversions/conversion_storage_delegate_impl.h
new file mode 100644
index 00000000000..c0d103a7905
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_storage_delegate_impl.h
@@ -0,0 +1,53 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_STORAGE_DELEGATE_IMPL_H_
+#define CONTENT_BROWSER_CONVERSIONS_CONVERSION_STORAGE_DELEGATE_IMPL_H_
+
+#include "base/sequence_checker.h"
+#include "base/time/time.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/conversion_storage.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Implementation of the storage delegate. This class handles assigning
+// attribution credits and report times to newly created conversion reports. It
+// also controls constants for ConversionStorage. This is owned by
+// ConversionStorageSql, and should only be accessed on the conversions storage
+// task runner.
+class CONTENT_EXPORT ConversionStorageDelegateImpl
+    : public ConversionStorage::Delegate {
+ public:
+  explicit ConversionStorageDelegateImpl(bool debug_mode = false);
+  ConversionStorageDelegateImpl(const ConversionStorageDelegateImpl& other) =
+      delete;
+  ConversionStorageDelegateImpl& operator=(
+      const ConversionStorageDelegateImpl& other) = delete;
+  ~ConversionStorageDelegateImpl() override = default;
+
+  // ConversionStorageDelegate:
+  void ProcessNewConversionReports(
+      std::vector<ConversionReport>* reports) override;
+  int GetMaxConversionsPerImpression() const override;
+  int GetMaxImpressionsPerOrigin() const override;
+  int GetMaxConversionsPerOrigin() const override;
+
+ private:
+  // Get the time a conversion report should be sent, by batching reports into
+  // set reporting windows based on their impression time. This strictly delays
+  // the time a report will be sent.
+  base::Time GetReportTimeForConversion(const ConversionReport& report) const;
+
+  // Whether the API is running in debug mode, meaning that there should be
+  // no delays or noise added to reports.
+  bool debug_mode_ = false;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_STORAGE_DELEGATE_IMPL_H_
diff --git a/chromium/content/browser/conversions/conversion_storage_delegate_impl_unittest.cc b/chromium/content/browser/conversions/conversion_storage_delegate_impl_unittest.cc
new file mode 100644
index 00000000000..bffa131e510
--- /dev/null
+++ b/chromium/content/browser/conversions/conversion_storage_delegate_impl_unittest.cc
@@ -0,0 +1,148 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/conversions/conversion_storage_delegate_impl.h"
+
+#include <vector>
+
+#include "base/optional.h"
+#include "base/time/time.h"
+#include "content/browser/conversions/conversion_report.h"
+#include "content/browser/conversions/conversion_test_utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+constexpr base::TimeDelta kDefaultExpiry = base::TimeDelta::FromDays(30);
+
+ConversionReport GetReport(base::Time impression_time,
+                           base::Time conversion_time,
+                           base::TimeDelta expiry = kDefaultExpiry) {
+  return ConversionReport(
+      ImpressionBuilder(impression_time).SetExpiry(expiry).Build(),
+      /*conversion_data=*/"123", conversion_time,
+      /*conversion_id=*/base::nullopt);
+}
+
+}  // namespace
+
+class ConversionStorageDelegateImplTest : public testing::Test {
+ public:
+  ConversionStorageDelegateImplTest() = default;
+};
+
+TEST_F(ConversionStorageDelegateImplTest, ImmediateConversion_FirstWindowUsed) {
+  base::Time impression_time = base::Time::Now();
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, /*conversion_time=*/impression_time)};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       ConversionImmediatelyBeforeWindow_NextWindowUsed) {
+  base::Time impression_time = base::Time::Now();
+  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(2) -
+                               base::TimeDelta::FromMinutes(1);
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, conversion_time)};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(7),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       ConversionBeforeWindowDelay_WindowUsed) {
+  base::Time impression_time = base::Time::Now();
+
+  // The deadline for a window is 1 hour before the window. Use a time just
+  // before the deadline.
+  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(2) -
+                               base::TimeDelta::FromMinutes(61);
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, conversion_time)};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       ImpressionExpiryBeforeTwoDayWindow_TwoDayWindowUsed) {
+  base::Time impression_time = base::Time::Now();
+  base::Time conversion_time = impression_time + base::TimeDelta::FromHours(1);
+
+  // Set the impression to expire before the two day window.
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, conversion_time,
+                /*expiry=*/base::TimeDelta::FromHours(2))};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(2),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       ImpressionExpiryBeforeSevenDayWindow_ExpiryWindowUsed) {
+  base::Time impression_time = base::Time::Now();
+  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(3);
+
+  // Set the impression to expire before the two day window.
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, conversion_time,
+                /*expiry=*/base::TimeDelta::FromDays(4))};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+
+  // The expiry window is reported one hour after expiry time.
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(4) +
+                base::TimeDelta::FromHours(1),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       ImpressionExpiryAfterSevenDayWindow_ExpiryWindowUsed) {
+  base::Time impression_time = base::Time::Now();
+  base::Time conversion_time = impression_time + base::TimeDelta::FromDays(7);
+
+  // Set the impression to expire before the two day window.
+  std::vector<ConversionReport> reports = {
+      GetReport(impression_time, conversion_time,
+                /*expiry=*/base::TimeDelta::FromDays(9))};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+
+  // The expiry window is reported one hour after expiry time.
+  EXPECT_EQ(impression_time + base::TimeDelta::FromDays(9) +
+                base::TimeDelta::FromHours(1),
+            reports[0].report_time);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       SingleReportForConversion_AttributionCreditAssigned) {
+  base::Time now = base::Time::Now();
+  std::vector<ConversionReport> reports = {
+      GetReport(/*impression_time=*/now, /*conversion_time=*/now)};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(1u, reports.size());
+  EXPECT_EQ(100, reports[0].attribution_credit);
+}
+
+TEST_F(ConversionStorageDelegateImplTest,
+       TwoReportsForConversion_LastReceivesCredit) {
+  base::Time now = base::Time::Now();
+  std::vector<ConversionReport> reports = {
+      GetReport(/*impression_time=*/now, /*conversion_time=*/now),
+      GetReport(/*impression_time=*/now + base::TimeDelta::FromHours(100),
+                /*conversion_time=*/now)};
+  ConversionStorageDelegateImpl().ProcessNewConversionReports(&reports);
+  EXPECT_EQ(2u, reports.size());
+  EXPECT_EQ(0, reports[0].attribution_credit);
+  EXPECT_EQ(100, reports[1].attribution_credit);
+
+  // Ensure the reports were not rearranged.
+  EXPECT_EQ(now + base::TimeDelta::FromHours(100),
+            reports[1].impression.impression_time());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_storage_sql.cc b/chromium/content/browser/conversions/conversion_storage_sql.cc
index 9f8abdbb270..a921f883991 100644
--- a/chromium/content/browser/conversions/conversion_storage_sql.cc
+++ b/chromium/content/browser/conversions/conversion_storage_sql.cc
@@ -8,8 +8,10 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/containers/flat_set.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/optional.h"
 #include "base/time/default_clock.h"
 #include "base/time/time.h"
@@ -28,16 +30,10 @@ const base::FilePath::CharType kDatabaseName[] =
     FILE_PATH_LITERAL("Conversions");
 
 std::string SerializeOrigin(const url::Origin& origin) {
-  // Conversion API is only designed to be used for secure contexts (targets and
-  // reporting endpoints). We should have filtered out bad origins at a higher
-  // layer.
-  //
-  // Because we only allow https origins to use the API, we could potentially
-  // omit the scheme from storage to save 8 bytes per origin. However this would
-  // require maintaining our own serialization logic and also complicates
-  // extending storage to other scheme in the future.
+  // Conversion API is only designed to be used for secure
+  // contexts (targets and reporting endpoints). We should have filtered out bad
+  // origins at a higher layer.
   DCHECK(!origin.opaque());
-  DCHECK_EQ(url::kHttpsScheme, origin.scheme());
   return origin.Serialize();
 }
 
@@ -58,12 +54,13 @@ base::Time DeserializeTime(int64_t microseconds) {
 
 ConversionStorageSql::ConversionStorageSql(
     const base::FilePath& path_to_database_dir,
-    Delegate* delegate,
-    base::Clock* clock)
+    std::unique_ptr<Delegate> delegate,
+    const base::Clock* clock)
     : path_to_database_(path_to_database_dir.Append(kDatabaseName)),
       clock_(clock),
-      delegate_(delegate),
+      delegate_(std::move(delegate)),
       weak_factory_(this) {
+  DCHECK(delegate_);
   DETACH_FROM_SEQUENCE(sequence_checker_);
 }
 
@@ -91,6 +88,19 @@ void ConversionStorageSql::StoreImpression(
     const StorableImpression& impression) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
+  // Cleanup any impression that may be expired by this point. This is done when
+  // an impression is added to prevent additional logic for cleaning the table
+  // while providing a guarantee that the size of the table is proportional to
+  // the number of active impression.
+  DeleteExpiredImpressions();
+
+  // TODO(csharrison): Thread this failure to the caller and report a console
+  // error.
+  const std::string serialized_impression_origin =
+      SerializeOrigin(impression.impression_origin());
+  if (!HasCapacityForStoringImpression(serialized_impression_origin))
+    return;
+
   // Wrap the deactivation and insertion in the same transaction. If the
   // deactivation fails, we do not want to store the new impression as we may
   // return the wrong set of impressions for a conversion.
@@ -98,6 +108,11 @@ void ConversionStorageSql::StoreImpression(
   if (!transaction.Begin())
     return;
 
+  const std::string serialized_conversion_origin =
+      SerializeOrigin(impression.conversion_origin());
+  const std::string serialized_reporting_origin =
+      SerializeOrigin(impression.reporting_origin());
+
   // In the case where we get a new impression for a given <reporting_origin,
   // conversion_origin> we should mark all active, converted impressions with
   // the matching <reporting_origin, conversion_origin> as not active.
@@ -107,10 +122,8 @@ void ConversionStorageSql::StoreImpression(
       "active = 1 AND num_conversions > 0";
   sql::Statement deactivate_statement(db_.GetCachedStatement(
       SQL_FROM_HERE, kDeactivateMatchingConvertedImpressionsSql));
-  deactivate_statement.BindString(
-      0, SerializeOrigin(impression.conversion_origin()));
-  deactivate_statement.BindString(
-      1, SerializeOrigin(impression.reporting_origin()));
+  deactivate_statement.BindString(0, serialized_conversion_origin);
+  deactivate_statement.BindString(1, serialized_reporting_origin);
   deactivate_statement.Run();
 
   const char kInsertImpressionSql[] =
@@ -121,9 +134,9 @@ void ConversionStorageSql::StoreImpression(
   sql::Statement statement(
       db_.GetCachedStatement(SQL_FROM_HERE, kInsertImpressionSql));
   statement.BindString(0, impression.impression_data());
-  statement.BindString(1, SerializeOrigin(impression.impression_origin()));
-  statement.BindString(2, SerializeOrigin(impression.conversion_origin()));
-  statement.BindString(3, SerializeOrigin(impression.reporting_origin()));
+  statement.BindString(1, serialized_impression_origin);
+  statement.BindString(2, serialized_conversion_origin);
+  statement.BindString(3, serialized_reporting_origin);
   statement.BindInt64(4, SerializeTime(impression.impression_time()));
   statement.BindInt64(5, SerializeTime(impression.expiry_time()));
   statement.Run();
@@ -136,7 +149,15 @@ int ConversionStorageSql::MaybeCreateAndStoreConversionReports(
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   const url::Origin& conversion_origin = conversion.conversion_origin();
+  const std::string serialized_conversion_origin =
+      SerializeOrigin(conversion_origin);
+  if (!HasCapacityForStoringConversion(serialized_conversion_origin))
+    return 0;
+
   const url::Origin& reporting_origin = conversion.reporting_origin();
+  DCHECK(!conversion_origin.opaque());
+  DCHECK(!reporting_origin.opaque());
+
   base::Time current_time = clock_->Now();
   int64_t serialized_current_time = SerializeTime(current_time);
 
@@ -151,7 +172,7 @@ int ConversionStorageSql::MaybeCreateAndStoreConversionReports(
 
   sql::Statement statement(
       db_.GetCachedStatement(SQL_FROM_HERE, kGetMatchingImpressionsSql));
-  statement.BindString(0, SerializeOrigin(conversion_origin));
+  statement.BindString(0, serialized_conversion_origin);
   statement.BindString(1, SerializeOrigin(reporting_origin));
   statement.BindInt64(2, serialized_current_time);
 
@@ -162,6 +183,11 @@ int ConversionStorageSql::MaybeCreateAndStoreConversionReports(
     std::string impression_data = statement.ColumnString(1);
     url::Origin impression_origin =
         DeserializeOrigin(statement.ColumnString(2));
+
+    // Skip the report if the impression origin is opaque. This should only
+    // happen if there is some sort of database corruption.
+    if (impression_origin.opaque())
+      continue;
     base::Time impression_time = DeserializeTime(statement.ColumnInt64(3));
     base::Time expiry_time = DeserializeTime(statement.ColumnInt64(4));
 
@@ -274,6 +300,15 @@ std::vector<ConversionReport> ConversionStorageSql::GetConversionsToReport(
     base::Time expiry_time = DeserializeTime(statement.ColumnInt64(9));
     int64_t impression_id = statement.ColumnInt64(10);
 
+    // Ensure origins are valid before continuing. This could happen if there is
+    // database corruption.
+    // TODO(csharrison): This should be an extremely rare occurrence but it
+    // would entail that some records will remain in the DB as vestigial if a
+    // conversion is never sent. We should delete these entries from the DB.
+    if (impression_origin.opaque() || conversion_origin.opaque() ||
+        reporting_origin.opaque())
+      continue;
+
     // Create the impression and ConversionReport objects from the retrieved
     // columns.
     StorableImpression impression(impression_data, impression_origin,
@@ -292,6 +327,37 @@ std::vector<ConversionReport> ConversionStorageSql::GetConversionsToReport(
   return conversions;
 }
 
+std::vector<StorableImpression> ConversionStorageSql::GetActiveImpressions() {
+  const char kGetImpressionsSql[] =
+      "SELECT impression_data, impression_origin, conversion_origin, "
+      "reporting_origin, impression_time, expiry_time, impression_id "
+      "FROM impressions WHERE active = 1 AND expiry_time > ?";
+  sql::Statement statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kGetImpressionsSql));
+  statement.BindInt64(0, SerializeTime(clock_->Now()));
+
+  std::vector<StorableImpression> impressions;
+  while (statement.Step()) {
+    std::string impression_data = statement.ColumnString(0);
+    url::Origin impression_origin =
+        DeserializeOrigin(statement.ColumnString(1));
+    url::Origin conversion_origin =
+        DeserializeOrigin(statement.ColumnString(2));
+    url::Origin reporting_origin = DeserializeOrigin(statement.ColumnString(3));
+    base::Time impression_time = DeserializeTime(statement.ColumnInt64(4));
+    base::Time expiry_time = DeserializeTime(statement.ColumnInt64(5));
+    int64_t impression_id = statement.ColumnInt64(6);
+
+    StorableImpression impression(impression_data, impression_origin,
+                                  conversion_origin, reporting_origin,
+                                  impression_time, expiry_time, impression_id);
+    impressions.push_back(std::move(impression));
+  }
+  if (!statement.Succeeded())
+    return {};
+  return impressions;
+}
+
 int ConversionStorageSql::DeleteExpiredImpressions() {
   // Delete all impressions that have no associated conversions and are past
   // their expiry time. Optimized by |kImpressionExpiryIndexSql|.
@@ -331,10 +397,205 @@ bool ConversionStorageSql::DeleteConversion(int64_t conversion_id) {
   if (!statement.Run())
     return false;
 
-  DCHECK_EQ(1, db_.GetLastChangeCount());
   return db_.GetLastChangeCount() > 0;
 }
 
+void ConversionStorageSql::ClearData(
+    base::Time delete_begin,
+    base::Time delete_end,
+    base::RepeatingCallback<bool(const url::Origin&)> filter) {
+  SCOPED_UMA_HISTOGRAM_TIMER("Conversions.ClearDataTime");
+  if (filter.is_null()) {
+    ClearAllDataInRange(delete_begin, delete_end);
+    return;
+  }
+
+  // TODO(csharrison, johnidel): This query can be split up and optimized by
+  // adding indexes on the impression_time and conversion_time columns.
+  // See this comment for more information:
+  // crrev.com/c/2150071/4/content/browser/conversions/conversion_storage_sql.cc#342
+  const char kScanCandidateData[] =
+      "SELECT C.conversion_id, I.impression_id,"
+      "I.impression_origin, I.conversion_origin, I.reporting_origin "
+      "FROM impressions I LEFT JOIN conversions C ON "
+      "C.impression_id = I.impression_id WHERE"
+      "(I.impression_time BETWEEN ?1 AND ?2) OR"
+      "(C.conversion_time BETWEEN ?1 AND ?2)";
+  sql::Statement statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kScanCandidateData));
+  statement.BindInt64(0, SerializeTime(delete_begin));
+  statement.BindInt64(1, SerializeTime(delete_end));
+
+  std::vector<int64_t> impression_ids_to_delete;
+  std::vector<int64_t> conversion_ids_to_delete;
+  while (statement.Step()) {
+    int64_t conversion_id = statement.ColumnInt64(0);
+    int64_t impression_id = statement.ColumnInt64(1);
+    if (filter.Run(DeserializeOrigin(statement.ColumnString(2))) ||
+        filter.Run(DeserializeOrigin(statement.ColumnString(3))) ||
+        filter.Run(DeserializeOrigin(statement.ColumnString(4)))) {
+      impression_ids_to_delete.push_back(impression_id);
+      if (conversion_id != 0)
+        conversion_ids_to_delete.push_back(conversion_id);
+    }
+  }
+
+  // Since multiple conversions can be associated with a single impression,
+  // |impression_ids_to_delete| may contain duplicates. Remove duplicates by
+  // converting the vector into a flat_set. Internally, this sorts the vector
+  // and then removes duplicates.
+  const base::flat_set<int64_t> unique_impression_ids_to_delete(
+      impression_ids_to_delete);
+
+  // TODO(csharrison, johnidel): Should we consider poisoning the DB if some of
+  // the delete operations fail?
+  if (!statement.Succeeded())
+    return;
+
+  // Delete the data in a transaction to avoid cases where the impression part
+  // of a conversion is deleted without deleting the associated conversion, or
+  // vice versa.
+  sql::Transaction transaction(&db_);
+  if (!transaction.Begin())
+    return;
+
+  for (int64_t impression_id : unique_impression_ids_to_delete) {
+    const char kDeleteImpressionSql[] =
+        "DELETE FROM impressions WHERE impression_id = ?";
+    sql::Statement impression_statement(
+        db_.GetCachedStatement(SQL_FROM_HERE, kDeleteImpressionSql));
+    impression_statement.BindInt64(0, impression_id);
+    if (!impression_statement.Run())
+      return;
+  }
+
+  for (int64_t conversion_id : conversion_ids_to_delete) {
+    const char kDeleteConversionSql[] =
+        "DELETE FROM conversions WHERE conversion_id = ?";
+    sql::Statement conversion_statement(
+        db_.GetCachedStatement(SQL_FROM_HERE, kDeleteConversionSql));
+    conversion_statement.BindInt64(0, conversion_id);
+    if (!conversion_statement.Run())
+      return;
+  }
+
+  // Careful! At this point we can still have some vestigial entries in the DB.
+  // For example, if an impression has two conversions, and one conversion is
+  // deleted, the above logic will delete the impression as well, leaving the
+  // second conversion in limbo (it was not in the deletion time range).
+  // Delete all unattributed conversions here to ensure everything is cleaned
+  // up.
+  for (int64_t impression_id : unique_impression_ids_to_delete) {
+    const char kDeleteVestigialConversionSql[] =
+        "DELETE FROM conversions WHERE impression_id = ?";
+    sql::Statement delete_vestigial_statement(
+        db_.GetCachedStatement(SQL_FROM_HERE, kDeleteVestigialConversionSql));
+    delete_vestigial_statement.BindInt64(0, impression_id);
+    if (!delete_vestigial_statement.Run())
+      return;
+  }
+  transaction.Commit();
+}
+
+void ConversionStorageSql::ClearAllDataInRange(base::Time delete_begin,
+                                               base::Time delete_end) {
+  // Browsing data remover will call this with null |delete_begin|, but also
+  // perform the ClearAllDataAllTime optimization if |delete_begin| is
+  // base::Time::Min().
+  if ((delete_begin.is_null() || delete_begin.is_min()) &&
+      delete_end.is_max()) {
+    ClearAllDataAllTime();
+    return;
+  }
+
+  sql::Transaction transaction(&db_);
+  if (!transaction.Begin())
+    return;
+
+  // Delete all impressions and conversion reports in the given time range.
+  // Note: This should follow the same basic logic in ClearData, with the
+  // assumption that all origins match the filter. This means we can omit a
+  // SELECT statement, and all of the in-memory id management.
+  //
+  // Optimizing these queries are also tough, see this comment for an idea:
+  // http://crrev.com/c/2150071/12/content/browser/conversions/conversion_storage_sql.cc#468
+  const char kDeleteImpressionRangeSql[] =
+      "DELETE FROM impressions WHERE (impression_time BETWEEN ?1 AND ?2) OR "
+      "impression_id in (SELECT impression_id FROM conversions "
+      "WHERE conversion_time BETWEEN ?1 AND ?2)";
+  sql::Statement delete_impressions_statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kDeleteImpressionRangeSql));
+  delete_impressions_statement.BindInt64(0, SerializeTime(delete_begin));
+  delete_impressions_statement.BindInt64(1, SerializeTime(delete_end));
+  if (!delete_impressions_statement.Run())
+    return;
+
+  const char kDeleteConversionRangeSql[] =
+      "DELETE FROM conversions WHERE (conversion_time BETWEEN ? AND ?) "
+      "OR impression_id NOT IN (SELECT impression_id FROM impressions)";
+  sql::Statement delete_conversions_statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kDeleteConversionRangeSql));
+  delete_conversions_statement.BindInt64(0, SerializeTime(delete_begin));
+  delete_conversions_statement.BindInt64(1, SerializeTime(delete_end));
+  if (!delete_conversions_statement.Run())
+    return;
+  transaction.Commit();
+}
+
+void ConversionStorageSql::ClearAllDataAllTime() {
+  sql::Transaction transaction(&db_);
+  if (!transaction.Begin())
+    return;
+  const char kDeleteAllConversionsSql[] = "DELETE FROM conversions";
+  const char kDeleteAllImpressionsSql[] = "DELETE FROM impressions";
+  sql::Statement delete_all_conversions_statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kDeleteAllConversionsSql));
+  sql::Statement delete_all_impressions_statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kDeleteAllImpressionsSql));
+  if (!delete_all_conversions_statement.Run())
+    return;
+  if (!delete_all_impressions_statement.Run())
+    return;
+  transaction.Commit();
+}
+
+bool ConversionStorageSql::HasCapacityForStoringImpression(
+    const std::string& serialized_origin) {
+  // Optimized by impression_origin_idx.
+  const char kCountImpressionsSql[] =
+      "SELECT COUNT(impression_origin) FROM impressions WHERE "
+      "impression_origin = ?";
+  sql::Statement statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kCountImpressionsSql));
+  statement.BindString(0, serialized_origin);
+  if (!statement.Step())
+    return false;
+  int64_t count = statement.ColumnInt64(0);
+  return count < delegate_->GetMaxImpressionsPerOrigin();
+}
+
+bool ConversionStorageSql::HasCapacityForStoringConversion(
+    const std::string& serialized_origin) {
+  // This query should be reasonably optimized via conversion_origin_idx. The
+  // conversion origin is the second column in a multi-column index where the
+  // first column is just a boolean. Therefore the second column in the index
+  // should be very well-sorted.
+  //
+  // Note: to take advantage of this, we need to hint to the query planner that
+  // |active| is a boolean, so include it in the conditional.
+  const char kCountConversionsSql[] =
+      "SELECT COUNT(conversion_id) FROM conversions C JOIN impressions I ON"
+      " I.impression_id = C.impression_id"
+      " WHERE I.conversion_origin = ? AND (active BETWEEN 0 AND 1)";
+  sql::Statement statement(
+      db_.GetCachedStatement(SQL_FROM_HERE, kCountConversionsSql));
+  statement.BindString(0, serialized_origin);
+  if (!statement.Step())
+    return false;
+  int64_t count = statement.ColumnInt64(0);
+  return count < delegate_->GetMaxConversionsPerOrigin();
+}
+
 bool ConversionStorageSql::InitializeSchema() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // TODO(johnidel, csharrison): Many impressions will share a target origin and
@@ -392,6 +653,13 @@ bool ConversionStorageSql::InitializeSchema() {
   if (!db_.Execute(kImpressionExpiryIndexSql))
     return false;
 
+  // Optimizes counting impressions by impression origin.
+  const char kImpressionOriginIndexSql[] =
+      "CREATE INDEX IF NOT EXISTS impression_origin_idx "
+      "ON impressions(impression_origin)";
+  if (!db_.Execute(kImpressionOriginIndexSql))
+    return false;
+
   // All columns in this table are const. |impression_id| is the primary key of
   // a row in the [impressions] table, [impressions.impression_id].
   // |conversion_time| is the time at which the conversion was registered, and
diff --git a/chromium/content/browser/conversions/conversion_storage_sql.h b/chromium/content/browser/conversions/conversion_storage_sql.h
index b6d3cbc11d1..686df2f1658 100644
--- a/chromium/content/browser/conversions/conversion_storage_sql.h
+++ b/chromium/content/browser/conversions/conversion_storage_sql.h
@@ -5,6 +5,9 @@
 #ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_STORAGE_SQL_H_
 #define CONTENT_BROWSER_CONVERSIONS_CONVERSION_STORAGE_SQL_H_
 
+#include <memory>
+#include <vector>
+
 #include "base/files/file_path.h"
 #include "base/memory/weak_ptr.h"
 #include "base/sequence_checker.h"
@@ -26,8 +29,8 @@ namespace content {
 class CONTENT_EXPORT ConversionStorageSql : public ConversionStorage {
  public:
   ConversionStorageSql(const base::FilePath& path_to_database_dir,
-                       Delegate* delegate,
-                       base::Clock* clock);
+                       std::unique_ptr<Delegate> delegate,
+                       const base::Clock* clock);
   ConversionStorageSql(const ConversionStorageSql& other) = delete;
   ConversionStorageSql& operator=(const ConversionStorageSql& other) = delete;
   ~ConversionStorageSql() override;
@@ -40,8 +43,20 @@ class CONTENT_EXPORT ConversionStorageSql : public ConversionStorage {
       const StorableConversion& conversion) override;
   std::vector<ConversionReport> GetConversionsToReport(
       base::Time expiry_time) override;
+  std::vector<StorableImpression> GetActiveImpressions() override;
   int DeleteExpiredImpressions() override;
   bool DeleteConversion(int64_t conversion_id) override;
+  void ClearData(
+      base::Time delete_begin,
+      base::Time delete_end,
+      base::RepeatingCallback<bool(const url::Origin&)> filter) override;
+
+  // Variants of ClearData that assume all Origins match the filter.
+  void ClearAllDataInRange(base::Time delete_begin, base::Time delete_end);
+  void ClearAllDataAllTime();
+
+  bool HasCapacityForStoringImpression(const std::string& serialized_origin);
+  bool HasCapacityForStoringConversion(const std::string& serialized_origin);
 
   bool InitializeSchema();
 
@@ -51,10 +66,9 @@ class CONTENT_EXPORT ConversionStorageSql : public ConversionStorage {
   sql::Database db_;
 
   // Must outlive |this|.
-  base::Clock* const clock_;
+  const base::Clock* clock_;
 
-  // Must outlive |this|.
-  Delegate* const delegate_;
+  std::unique_ptr<Delegate> delegate_;
 
   SEQUENCE_CHECKER(sequence_checker_);
   base::WeakPtrFactory<ConversionStorageSql> weak_factory_;
diff --git a/chromium/content/browser/conversions/conversion_storage_sql_unittest.cc b/chromium/content/browser/conversions/conversion_storage_sql_unittest.cc
index 83179fa46be..ca408b729c3 100644
--- a/chromium/content/browser/conversions/conversion_storage_sql_unittest.cc
+++ b/chromium/content/browser/conversions/conversion_storage_sql_unittest.cc
@@ -4,11 +4,14 @@
 
 #include "content/browser/conversions/conversion_storage_sql.h"
 
+#include <functional>
 #include <memory>
 
+#include "base/bind.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/run_loop.h"
 #include "base/test/simple_test_clock.h"
+#include "base/time/time.h"
 #include "content/browser/conversions/conversion_report.h"
 #include "content/browser/conversions/conversion_test_utils.h"
 #include "content/browser/conversions/storable_conversion.h"
@@ -28,8 +31,10 @@ class ConversionStorageSqlTest : public testing::Test {
 
   void OpenDatabase() {
     storage_.reset();
-    storage_ = std::make_unique<ConversionStorageSql>(temp_directory_.GetPath(),
-                                                      &delegate_, &clock_);
+    auto delegate = std::make_unique<ConfigurableStorageDelegate>();
+    delegate_ = delegate.get();
+    storage_ = std::make_unique<ConversionStorageSql>(
+        temp_directory_.GetPath(), std::move(delegate), &clock_);
     EXPECT_TRUE(storage_->Initialize());
   }
 
@@ -48,11 +53,13 @@ class ConversionStorageSqlTest : public testing::Test {
 
   ConversionStorage* storage() { return storage_.get(); }
 
+  ConfigurableStorageDelegate* delegate() { return delegate_; }
+
  private:
   base::ScopedTempDir temp_directory_;
   std::unique_ptr<ConversionStorage> storage_;
+  ConfigurableStorageDelegate* delegate_ = nullptr;
   base::SimpleTestClock clock_;
-  EmptyStorageDelegate delegate_;
 };
 
 TEST_F(ConversionStorageSqlTest,
@@ -66,8 +73,9 @@ TEST_F(ConversionStorageSqlTest,
   EXPECT_EQ(2u, sql::test::CountSQLTables(&raw_db));
 
   // [conversion_origin_idx], [impression_expiry_idx],
-  // [conversion_report_time_idx], [conversion_impression_id_idx].
-  EXPECT_EQ(4u, sql::test::CountSQLIndices(&raw_db));
+  // [impression_origin_idx], [conversion_report_time_idx],
+  // [conversion_impression_id_idx].
+  EXPECT_EQ(5u, sql::test::CountSQLIndices(&raw_db));
 }
 
 TEST_F(ConversionStorageSqlTest, DatabaseReopened_DataPersisted) {
@@ -100,4 +108,155 @@ TEST_F(ConversionStorageSqlTest, CorruptDatabase_RecoveredOnOpen) {
   EXPECT_TRUE(expecter.SawExpectedErrors());
 }
 
+//  Create an impression with two conversions (C1 and C2). Craft a query that
+//  will target C2, which will in turn delete the impression. We should ensure
+//  that C1 is properly deleted (conversions should not be stored unattributed).
+TEST_F(ConversionStorageSqlTest, ClearDataWithVestigialConversion) {
+  OpenDatabase();
+
+  base::Time start = clock()->Now();
+  auto impression =
+      ImpressionBuilder(start).SetExpiry(base::TimeDelta::FromDays(30)).Build();
+  storage()->StoreImpression(impression);
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  // Use a time range that only intersects the last conversion.
+  storage()->ClearData(clock()->Now(), clock()->Now(),
+                       base::BindRepeating(std::equal_to<url::Origin>(),
+                                           impression.impression_origin()));
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+
+  CloseDatabase();
+
+  // Verify that everything is deleted.
+  sql::Database raw_db;
+  EXPECT_TRUE(raw_db.Open(db_path()));
+
+  size_t conversion_rows;
+  size_t impression_rows;
+  sql::test::CountTableRows(&raw_db, "conversions", &conversion_rows);
+  sql::test::CountTableRows(&raw_db, "impressions", &impression_rows);
+
+  EXPECT_EQ(0u, conversion_rows);
+  EXPECT_EQ(0u, impression_rows);
+}
+
+// Same as the above test, but with a null filter.
+TEST_F(ConversionStorageSqlTest, ClearAllDataWithVestigialConversion) {
+  OpenDatabase();
+
+  base::Time start = clock()->Now();
+  auto impression =
+      ImpressionBuilder(start).SetExpiry(base::TimeDelta::FromDays(30)).Build();
+  storage()->StoreImpression(impression);
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  // Use a time range that only intersects the last conversion.
+  auto null_filter = base::RepeatingCallback<bool(const url::Origin&)>();
+  storage()->ClearData(clock()->Now(), clock()->Now(), null_filter);
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+
+  CloseDatabase();
+
+  // Verify that everything is deleted.
+  sql::Database raw_db;
+  EXPECT_TRUE(raw_db.Open(db_path()));
+
+  size_t conversion_rows;
+  size_t impression_rows;
+  sql::test::CountTableRows(&raw_db, "conversions", &conversion_rows);
+  sql::test::CountTableRows(&raw_db, "impressions", &impression_rows);
+
+  EXPECT_EQ(0u, conversion_rows);
+  EXPECT_EQ(0u, impression_rows);
+}
+
+// The max time range with a null filter should delete everything.
+TEST_F(ConversionStorageSqlTest, DeleteEverything) {
+  OpenDatabase();
+
+  base::Time start = clock()->Now();
+  for (int i = 0; i < 10; i++) {
+    auto impression = ImpressionBuilder(start)
+                          .SetExpiry(base::TimeDelta::FromDays(30))
+                          .Build();
+    storage()->StoreImpression(impression);
+    clock()->Advance(base::TimeDelta::FromDays(1));
+  }
+
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  auto null_filter = base::RepeatingCallback<bool(const url::Origin&)>();
+  storage()->ClearData(base::Time::Min(), base::Time::Max(), null_filter);
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+
+  CloseDatabase();
+
+  // Verify that everything is deleted.
+  sql::Database raw_db;
+  EXPECT_TRUE(raw_db.Open(db_path()));
+
+  size_t conversion_rows;
+  size_t impression_rows;
+  sql::test::CountTableRows(&raw_db, "conversions", &conversion_rows);
+  sql::test::CountTableRows(&raw_db, "impressions", &impression_rows);
+
+  EXPECT_EQ(0u, conversion_rows);
+  EXPECT_EQ(0u, impression_rows);
+}
+
+TEST_F(ConversionStorageSqlTest, MaxImpressionsPerOrigin) {
+  OpenDatabase();
+  delegate()->set_max_impressions_per_origin(2);
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  EXPECT_EQ(
+      2, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  CloseDatabase();
+  sql::Database raw_db;
+  EXPECT_TRUE(raw_db.Open(db_path()));
+  size_t impression_rows;
+  sql::test::CountTableRows(&raw_db, "impressions", &impression_rows);
+  EXPECT_EQ(2u, impression_rows);
+}
+
+TEST_F(ConversionStorageSqlTest, MaxConversionsPerOrigin) {
+  OpenDatabase();
+  delegate()->set_max_conversions_per_origin(2);
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  EXPECT_EQ(
+      0, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  CloseDatabase();
+  sql::Database raw_db;
+  EXPECT_TRUE(raw_db.Open(db_path()));
+  size_t conversion_rows;
+  sql::test::CountTableRows(&raw_db, "conversions", &conversion_rows);
+  EXPECT_EQ(2u, conversion_rows);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_storage_unittest.cc b/chromium/content/browser/conversions/conversion_storage_unittest.cc
index c67a69ef253..b8089b96a06 100644
--- a/chromium/content/browser/conversions/conversion_storage_unittest.cc
+++ b/chromium/content/browser/conversions/conversion_storage_unittest.cc
@@ -4,13 +4,17 @@
 
 #include "content/browser/conversions/conversion_storage.h"
 
+#include <functional>
 #include <list>
 #include <memory>
 #include <tuple>
+#include <utility>
 #include <vector>
 
+#include "base/callback.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/stringprintf.h"
 #include "base/test/simple_test_clock.h"
 #include "content/browser/conversions/conversion_report.h"
 #include "content/browser/conversions/conversion_storage_sql.h"
@@ -33,45 +37,12 @@ const int kReportTime = 5;
 
 using AttributionCredits = std::list<int>;
 
-}  // namespace
-
-// Mock delegate which provides default behavior and delays reports by a fixed
-// time from impression.
-class MockStorageDelegate : public ConversionStorage::Delegate {
- public:
-  MockStorageDelegate() = default;
-  ~MockStorageDelegate() override = default;
-
-  // ConversionStorage::Delegate
-  void ProcessNewConversionReports(
-      std::vector<ConversionReport>* reports) override {
-    for (auto& report : *reports) {
-      report.report_time = report.impression.impression_time() +
-                           base::TimeDelta::FromMilliseconds(kReportTime);
-
-      // If attribution credits were provided, associate them with reports
-      // in order.
-      if (!attribution_credits_.empty()) {
-        report.attribution_credit = attribution_credits_.front();
-        attribution_credits_.pop_front();
-      }
-    }
-  }
-
-  int GetMaxConversionsPerImpression() const override {
-    return kMaxConversions;
-  }
-
-  void AddCredits(AttributionCredits credits) {
-    // Add all credits to our list in order.
-    attribution_credits_.splice(attribution_credits_.end(), credits);
-  }
+base::RepeatingCallback<bool(const url::Origin&)> GetMatcher(
+    const url::Origin& to_delete) {
+  return base::BindRepeating(std::equal_to<url::Origin>(), to_delete);
+}
 
- private:
-  // List of attribution credits the mock delegate should associate with
-  // reports.
-  AttributionCredits attribution_credits_;
-};
+}  // namespace
 
 // Unit test suite for the ConversionStorage interface. All ConversionStorage
 // implementations (including fakes) should be able to re-use this test suite.
@@ -79,8 +50,12 @@ class ConversionStorageTest : public testing::Test {
  public:
   ConversionStorageTest() {
     EXPECT_TRUE(dir_.CreateUniqueTempDir());
-    storage_ = std::make_unique<ConversionStorageSql>(dir_.GetPath(),
-                                                      &delegate_, &clock_);
+    auto delegate = std::make_unique<ConfigurableStorageDelegate>();
+    delegate->set_report_time_ms(kReportTime);
+    delegate->set_max_conversions_per_impression(kMaxConversions);
+    delegate_ = delegate.get();
+    storage_ = std::make_unique<ConversionStorageSql>(
+        dir_.GetPath(), std::move(delegate), &clock_);
     EXPECT_TRUE(storage_->Initialize());
   }
 
@@ -104,20 +79,43 @@ class ConversionStorageTest : public testing::Test {
   }
 
   void AddAttributionCredits(AttributionCredits credits) {
-    delegate_.AddCredits(credits);
+    delegate_->AddCredits(credits);
   }
 
   base::SimpleTestClock* clock() { return &clock_; }
 
   ConversionStorage* storage() { return storage_.get(); }
 
+  ConfigurableStorageDelegate* delegate() { return delegate_; }
+
  private:
-  MockStorageDelegate delegate_;
+  ConfigurableStorageDelegate* delegate_;
   base::SimpleTestClock clock_;
   base::ScopedTempDir dir_;
   std::unique_ptr<ConversionStorage> storage_;
 };
 
+TEST_F(ConversionStorageTest, ImpressionStoredAndRetrieved_ValuesIdentical) {
+  auto impression = ImpressionBuilder(clock()->Now()).Build();
+  storage()->StoreImpression(impression);
+  std::vector<StorableImpression> stored_impressions =
+      storage()->GetActiveImpressions();
+  EXPECT_EQ(1u, stored_impressions.size());
+
+  // Verify that each field was stored as expected.
+  EXPECT_EQ(impression.impression_data(),
+            stored_impressions[0].impression_data());
+  EXPECT_EQ(impression.impression_origin(),
+            stored_impressions[0].impression_origin());
+  EXPECT_EQ(impression.conversion_origin(),
+            stored_impressions[0].conversion_origin());
+  EXPECT_EQ(impression.reporting_origin(),
+            stored_impressions[0].reporting_origin());
+  EXPECT_EQ(impression.impression_time(),
+            stored_impressions[0].impression_time());
+  EXPECT_EQ(impression.expiry_time(), stored_impressions[0].expiry_time());
+}
+
 TEST_F(ConversionStorageTest,
        GetWithNoMatchingImpressions_NoImpressionsReturned) {
   EXPECT_EQ(
@@ -547,4 +545,279 @@ TEST_F(ConversionStorageTest,
   EXPECT_TRUE(ReportsEqual(expected_reports, actual_reports));
 }
 
+TEST_F(ConversionStorageTest, MaxImpressionsPerOrigin) {
+  delegate()->set_max_impressions_per_origin(2);
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  EXPECT_EQ(
+      2, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+}
+
+TEST_F(ConversionStorageTest, MaxConversionsPerOrigin) {
+  delegate()->set_max_conversions_per_origin(2);
+  storage()->StoreImpression(ImpressionBuilder(clock()->Now()).Build());
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  EXPECT_EQ(
+      0, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+}
+
+TEST_F(ConversionStorageTest, ClearDataWithNoMatch_NoDelete) {
+  base::Time now = clock()->Now();
+  auto impression = ImpressionBuilder(now).Build();
+  storage()->StoreImpression(impression);
+  storage()->ClearData(
+      now, now, GetMatcher(url::Origin::Create(GURL("https://no-match.com"))));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+}
+
+TEST_F(ConversionStorageTest, ClearDataOutsideRange_NoDelete) {
+  base::Time now = clock()->Now();
+  auto impression = ImpressionBuilder(now).Build();
+  storage()->StoreImpression(impression);
+
+  storage()->ClearData(now + base::TimeDelta::FromMinutes(10),
+                       now + base::TimeDelta::FromMinutes(20),
+                       GetMatcher(impression.impression_origin()));
+  EXPECT_EQ(
+      1, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+}
+
+TEST_F(ConversionStorageTest, ClearDataImpression) {
+  base::Time now = clock()->Now();
+  {
+    auto impression = ImpressionBuilder(now).Build();
+    storage()->StoreImpression(impression);
+    storage()->ClearData(now, now + base::TimeDelta::FromMinutes(20),
+                         GetMatcher(impression.impression_origin()));
+    EXPECT_EQ(0, storage()->MaybeCreateAndStoreConversionReports(
+                     DefaultConversion()));
+  }
+  {
+    auto impression = ImpressionBuilder(now).Build();
+    storage()->StoreImpression(impression);
+    storage()->ClearData(now, now + base::TimeDelta::FromMinutes(20),
+                         GetMatcher(impression.reporting_origin()));
+    EXPECT_EQ(0, storage()->MaybeCreateAndStoreConversionReports(
+                     DefaultConversion()));
+  }
+  {
+    auto impression = ImpressionBuilder(now).Build();
+    storage()->StoreImpression(impression);
+    storage()->ClearData(now, now + base::TimeDelta::FromMinutes(20),
+                         GetMatcher(impression.conversion_origin()));
+    EXPECT_EQ(0, storage()->MaybeCreateAndStoreConversionReports(
+                     DefaultConversion()));
+  }
+}
+
+TEST_F(ConversionStorageTest, ClearDataImpressionConversion) {
+  base::Time now = clock()->Now();
+  auto impression = ImpressionBuilder(now).Build();
+  auto conversion = DefaultConversion();
+
+  storage()->StoreImpression(impression);
+  EXPECT_EQ(1, storage()->MaybeCreateAndStoreConversionReports(conversion));
+
+  storage()->ClearData(now - base::TimeDelta::FromMinutes(20),
+                       now + base::TimeDelta::FromMinutes(20),
+                       GetMatcher(impression.impression_origin()));
+
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+}
+
+// The null filter should match all origins.
+TEST_F(ConversionStorageTest, ClearDataNullFilter) {
+  base::Time now = clock()->Now();
+
+  for (int i = 0; i < 10; i++) {
+    auto origin =
+        url::Origin::Create(GURL(base::StringPrintf("https://%d.com/", i)));
+    storage()->StoreImpression(ImpressionBuilder(now)
+                                   .SetExpiry(base::TimeDelta::FromDays(30))
+                                   .SetImpressionOrigin(origin)
+                                   .SetReportingOrigin(origin)
+                                   .SetConversionOrigin(origin)
+                                   .Build());
+    clock()->Advance(base::TimeDelta::FromDays(1));
+  }
+
+  // Convert half of them now, half after another day.
+  for (int i = 0; i < 5; i++) {
+    auto origin =
+        url::Origin::Create(GURL(base::StringPrintf("https://%d.com/", i)));
+    StorableConversion conversion("1", origin, origin);
+    EXPECT_EQ(1, storage()->MaybeCreateAndStoreConversionReports(conversion));
+  }
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  for (int i = 5; i < 10; i++) {
+    auto origin =
+        url::Origin::Create(GURL(base::StringPrintf("https://%d.com/", i)));
+    StorableConversion conversion("1", origin, origin);
+    EXPECT_EQ(1, storage()->MaybeCreateAndStoreConversionReports(conversion));
+  }
+
+  auto null_filter = base::RepeatingCallback<bool(const url::Origin&)>();
+  storage()->ClearData(clock()->Now(), clock()->Now(), null_filter);
+  EXPECT_EQ(5u, storage()->GetConversionsToReport(base::Time::Max()).size());
+}
+
+TEST_F(ConversionStorageTest, ClearDataWithImpressionOutsideRange) {
+  base::Time start = clock()->Now();
+  auto impression =
+      ImpressionBuilder(start).SetExpiry(base::TimeDelta::FromDays(30)).Build();
+  auto conversion = DefaultConversion();
+
+  storage()->StoreImpression(impression);
+
+  EXPECT_EQ(1, storage()->MaybeCreateAndStoreConversionReports(conversion));
+  storage()->ClearData(clock()->Now(), clock()->Now(),
+                       GetMatcher(impression.impression_origin()));
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+}
+
+// Deletions with time range between the impression and conversion should not
+// delete anything, unless the time range intersects one of the events.
+TEST_F(ConversionStorageTest, ClearDataRangeBetweenEvents) {
+  base::Time start = clock()->Now();
+  auto impression =
+      ImpressionBuilder(start).SetExpiry(base::TimeDelta::FromDays(30)).Build();
+  auto conversion = DefaultConversion();
+
+  std::vector<ConversionReport> expected_reports = {
+      GetExpectedReport(impression, conversion, 0)};
+
+  storage()->StoreImpression(impression);
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+
+  EXPECT_EQ(1, storage()->MaybeCreateAndStoreConversionReports(conversion));
+
+  storage()->ClearData(start + base::TimeDelta::FromMinutes(1),
+                       start + base::TimeDelta::FromMinutes(10),
+                       GetMatcher(impression.impression_origin()));
+
+  std::vector<ConversionReport> actual_reports =
+      storage()->GetConversionsToReport(base::Time::Max());
+  EXPECT_TRUE(ReportsEqual(expected_reports, actual_reports));
+}
+// Test that only a subset of impressions / conversions are deleted with
+// multiple impressions per conversion, if only a subset of impressions match.
+TEST_F(ConversionStorageTest, ClearDataWithMultiTouch) {
+  base::Time start = clock()->Now();
+  auto impression1 =
+      ImpressionBuilder(start).SetExpiry(base::TimeDelta::FromDays(30)).Build();
+  storage()->StoreImpression(impression1);
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  auto impression2 = ImpressionBuilder(clock()->Now())
+                         .SetExpiry(base::TimeDelta::FromDays(30))
+                         .Build();
+  auto impression3 = ImpressionBuilder(clock()->Now())
+                         .SetExpiry(base::TimeDelta::FromDays(30))
+                         .Build();
+
+  storage()->StoreImpression(impression2);
+  storage()->StoreImpression(impression3);
+
+  EXPECT_EQ(
+      3, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  // Only the first impression should overlap with this time range, but all the
+  // impressions should share the origin.
+  storage()->ClearData(start, start,
+                       GetMatcher(impression1.impression_origin()));
+  EXPECT_EQ(2u, storage()->GetConversionsToReport(base::Time::Max()).size());
+}
+
+// Attribution occurs at conversion time, not report time, so deleted
+// impressions should not adjust credit allocation.
+TEST_F(ConversionStorageTest, ClearData_AttributionUnaffected) {
+  auto impression1 = ImpressionBuilder(clock()->Now())
+                         .SetData("xyz")
+                         .SetExpiry(base::TimeDelta::FromDays(30))
+                         .Build();
+  auto impression2 = ImpressionBuilder(clock()->Now())
+                         .SetData("abc")
+                         .SetExpiry(base::TimeDelta::FromDays(30))
+                         .Build();
+  auto conversion = DefaultConversion();
+  storage()->StoreImpression(impression1);
+  storage()->StoreImpression(impression2);
+  std::vector<ConversionReport> expected_reports = {
+      GetExpectedReport(impression1, conversion, 0),
+      GetExpectedReport(impression2, conversion, 0)};
+
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  auto impression3 = ImpressionBuilder(clock()->Now())
+                         .SetExpiry(base::TimeDelta::FromDays(30))
+                         .Build();
+  storage()->StoreImpression(impression3);
+  base::Time delete_time = clock()->Now();
+  clock()->Advance(base::TimeDelta::FromDays(1));
+
+  AddAttributionCredits({100, 0, 0});
+  EXPECT_EQ(3, storage()->MaybeCreateAndStoreConversionReports(conversion));
+
+  // The last impression should be deleted, but the conversion shouldn't be.
+  storage()->ClearData(delete_time, delete_time,
+                       GetMatcher(impression1.impression_origin()));
+  std::vector<ConversionReport> actual_reports =
+      storage()->GetConversionsToReport(base::Time::Max());
+  EXPECT_TRUE(ReportsEqual(expected_reports, actual_reports));
+}
+
+// The max time range with a null filter should delete everything.
+TEST_F(ConversionStorageTest, DeleteAll) {
+  base::Time start = clock()->Now();
+  for (int i = 0; i < 10; i++) {
+    auto impression = ImpressionBuilder(start)
+                          .SetExpiry(base::TimeDelta::FromDays(30))
+                          .Build();
+    storage()->StoreImpression(impression);
+    clock()->Advance(base::TimeDelta::FromDays(1));
+  }
+
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  auto null_filter = base::RepeatingCallback<bool(const url::Origin&)>();
+  storage()->ClearData(base::Time::Min(), base::Time::Max(), null_filter);
+
+  // Verify that everything is deleted.
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+}
+
+// Same as the above test, but uses base::Time() instead of base::Time::Min()
+// for delete_begin, which should yield the same behavior.
+TEST_F(ConversionStorageTest, DeleteAllNullDeleteBegin) {
+  base::Time start = clock()->Now();
+  for (int i = 0; i < 10; i++) {
+    auto impression = ImpressionBuilder(start)
+                          .SetExpiry(base::TimeDelta::FromDays(30))
+                          .Build();
+    storage()->StoreImpression(impression);
+    clock()->Advance(base::TimeDelta::FromDays(1));
+  }
+
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+  clock()->Advance(base::TimeDelta::FromDays(1));
+  EXPECT_EQ(
+      10, storage()->MaybeCreateAndStoreConversionReports(DefaultConversion()));
+
+  auto null_filter = base::RepeatingCallback<bool(const url::Origin&)>();
+  storage()->ClearData(base::Time(), base::Time::Max(), null_filter);
+
+  // Verify that everything is deleted.
+  EXPECT_TRUE(storage()->GetConversionsToReport(base::Time::Max()).empty());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_test_utils.cc b/chromium/content/browser/conversions/conversion_test_utils.cc
index 7209814154c..10f95f365bf 100644
--- a/chromium/content/browser/conversions/conversion_test_utils.cc
+++ b/chromium/content/browser/conversions/conversion_test_utils.cc
@@ -4,25 +4,121 @@
 
 #include "content/browser/conversions/conversion_test_utils.h"
 
+#include <limits.h>
+
 #include <tuple>
 
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/callback.h"
+#include "base/run_loop.h"
+#include "base/task_runner_util.h"
+#include "base/test/bind_test_util.h"
 #include "url/gurl.h"
 
 namespace content {
 
 namespace {
 
-const char kDefaultImpressionOrigin[] = "https:/impression.test/";
-const char kDefaultConversionOrigin[] = "https:/conversion.test/";
-const char kDefaultReportOrigin[] = "https:/report.test/";
+const char kDefaultImpressionOrigin[] = "https://impression.test/";
+const char kDefaultConversionOrigin[] = "https://conversion.test/";
+const char kDefaultReportOrigin[] = "https://report.test/";
 
 // Default expiry time for impressions for testing.
 const int64_t kExpiryTime = 30;
 
 }  // namespace
 
-int EmptyStorageDelegate::GetMaxConversionsPerImpression() const {
-  return 1;
+ConfigurableStorageDelegate::ConfigurableStorageDelegate() = default;
+ConfigurableStorageDelegate::~ConfigurableStorageDelegate() = default;
+
+void ConfigurableStorageDelegate::ProcessNewConversionReports(
+    std::vector<ConversionReport>* reports) {
+  // Note: reports are ordered by impression time, descending.
+  for (auto& report : *reports) {
+    report.report_time = report.impression.impression_time() +
+                         base::TimeDelta::FromMilliseconds(report_time_ms_);
+
+    // If attribution credits were provided, associate them with reports
+    // in order.
+    if (!attribution_credits_.empty()) {
+      report.attribution_credit = attribution_credits_.front();
+      attribution_credits_.pop_front();
+    }
+  }
+}
+int ConfigurableStorageDelegate::GetMaxConversionsPerImpression() const {
+  return max_conversions_per_impression_;
+}
+int ConfigurableStorageDelegate::GetMaxImpressionsPerOrigin() const {
+  return max_impressions_per_origin_;
+}
+int ConfigurableStorageDelegate::GetMaxConversionsPerOrigin() const {
+  return max_conversions_per_origin_;
+}
+
+ConversionManager* TestManagerProvider::GetManager(
+    WebContents* web_contents) const {
+  return manager_;
+}
+
+TestConversionManager::TestConversionManager() = default;
+
+TestConversionManager::~TestConversionManager() = default;
+
+void TestConversionManager::HandleImpression(
+    const StorableImpression& impression) {
+  num_impressions_++;
+}
+
+void TestConversionManager::HandleConversion(
+    const StorableConversion& conversion) {
+  num_conversions_++;
+}
+
+void TestConversionManager::GetActiveImpressionsForWebUI(
+    base::OnceCallback<void(std::vector<StorableImpression>)> callback) {
+  std::move(callback).Run(impressions_);
+}
+
+void TestConversionManager::GetReportsForWebUI(
+    base::OnceCallback<void(std::vector<ConversionReport>)> callback,
+    base::Time max_report_time) {
+  std::move(callback).Run(reports_);
+}
+
+void TestConversionManager::SendReportsForWebUI(base::OnceClosure done) {
+  reports_.clear();
+  std::move(done).Run();
+}
+
+const ConversionPolicy& TestConversionManager::GetConversionPolicy() const {
+  return policy_;
+}
+
+void TestConversionManager::ClearData(
+    base::Time delete_begin,
+    base::Time delete_end,
+    base::RepeatingCallback<bool(const url::Origin&)> filter,
+    base::OnceClosure done) {
+  impressions_.clear();
+  reports_.clear();
+  std::move(done).Run();
+}
+
+void TestConversionManager::SetActiveImpressionsForWebUI(
+    std::vector<StorableImpression> impressions) {
+  impressions_ = std::move(impressions);
+}
+
+void TestConversionManager::SetReportsForWebUI(
+    std::vector<ConversionReport> reports) {
+  reports_ = std::move(reports);
+}
+
+void TestConversionManager::Reset() {
+  num_impressions_ = 0u;
+  num_conversions_ = 0u;
 }
 
 // Builds an impression with default values. This is done as a builder because
@@ -82,6 +178,23 @@ StorableConversion DefaultConversion() {
   return conversion;
 }
 
+// Custom comparator for StorableImpressions that does not take impression id's
+// into account.
+testing::AssertionResult ImpressionsEqual(const StorableImpression& expected,
+                                          const StorableImpression& actual) {
+  const auto tie = [](const StorableImpression& impression) {
+    return std::make_tuple(
+        impression.impression_data(), impression.impression_origin(),
+        impression.conversion_origin(), impression.reporting_origin(),
+        impression.impression_time(), impression.expiry_time());
+  };
+
+  if (tie(expected) != tie(actual)) {
+    return testing::AssertionFailure();
+  }
+  return testing::AssertionSuccess();
+}
+
 // Custom comparator for comparing two vectors of conversion reports. Does not
 // compare impression and conversion id's as they are set by the underlying
 // sqlite db and should not be tested.
@@ -114,4 +227,23 @@ testing::AssertionResult ReportsEqual(
   return testing::AssertionSuccess();
 }
 
+std::vector<ConversionReport> GetConversionsToReportForTesting(
+    ConversionManagerImpl* manager,
+    base::Time max_report_time) {
+  base::RunLoop run_loop;
+  std::vector<ConversionReport> conversion_reports;
+  base::PostTaskAndReplyWithResult(
+      manager->storage_task_runner_.get(), FROM_HERE,
+      base::BindOnce(&ConversionStorage::GetConversionsToReport,
+                     base::Unretained(manager->storage_.get()),
+                     max_report_time),
+      base::BindOnce(base::BindLambdaForTesting(
+          [&](std::vector<ConversionReport> reports) {
+            conversion_reports = std::move(reports);
+            run_loop.Quit();
+          })));
+  run_loop.Run();
+  return conversion_reports;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/conversions/conversion_test_utils.h b/chromium/content/browser/conversions/conversion_test_utils.h
index 20b0c378cfd..80e569b5cfb 100644
--- a/chromium/content/browser/conversions/conversion_test_utils.h
+++ b/chromium/content/browser/conversions/conversion_test_utils.h
@@ -5,10 +5,15 @@
 #ifndef CONTENT_BROWSER_CONVERSIONS_CONVERSION_TEST_UTILS_H_
 #define CONTENT_BROWSER_CONVERSIONS_CONVERSION_TEST_UTILS_H_
 
+#include <list>
 #include <string>
 #include <vector>
 
+#include "base/memory/scoped_refptr.h"
+#include "base/sequenced_task_runner.h"
 #include "base/time/time.h"
+#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
 #include "content/browser/conversions/conversion_report.h"
 #include "content/browser/conversions/conversion_storage.h"
 #include "content/browser/conversions/storable_conversion.h"
@@ -18,16 +23,105 @@
 
 namespace content {
 
-class EmptyStorageDelegate : public ConversionStorage::Delegate {
+class ConfigurableStorageDelegate : public ConversionStorage::Delegate {
  public:
-  EmptyStorageDelegate() = default;
-  ~EmptyStorageDelegate() override = default;
+  using AttributionCredits = std::list<int>;
+  ConfigurableStorageDelegate();
+  ~ConfigurableStorageDelegate() override;
 
   // ConversionStorage::Delegate
   void ProcessNewConversionReports(
-      std::vector<ConversionReport>* reports) override {}
-
+      std::vector<ConversionReport>* reports) override;
   int GetMaxConversionsPerImpression() const override;
+  int GetMaxImpressionsPerOrigin() const override;
+  int GetMaxConversionsPerOrigin() const override;
+
+  void set_max_conversions_per_impression(int max) {
+    max_conversions_per_impression_ = max;
+  }
+
+  void set_max_impressions_per_origin(int max) {
+    max_impressions_per_origin_ = max;
+  }
+
+  void set_max_conversions_per_origin(int max) {
+    max_conversions_per_origin_ = max;
+  }
+
+  void set_report_time_ms(int report_time_ms) {
+    report_time_ms_ = report_time_ms;
+  }
+
+  void AddCredits(AttributionCredits credits) {
+    // Add all credits to our list in order.
+    attribution_credits_.splice(attribution_credits_.end(), credits);
+  }
+
+ private:
+  int max_conversions_per_impression_ = INT_MAX;
+  int max_impressions_per_origin_ = INT_MAX;
+  int max_conversions_per_origin_ = INT_MAX;
+
+  int report_time_ms_ = 0;
+
+  // List of attribution credits the test delegate should associate with
+  // reports.
+  AttributionCredits attribution_credits_;
+};
+
+// Test manager provider which can be used to inject a fake ConversionManager.
+class TestManagerProvider : public ConversionManager::Provider {
+ public:
+  explicit TestManagerProvider(ConversionManager* manager)
+      : manager_(manager) {}
+  ~TestManagerProvider() override = default;
+
+  ConversionManager* GetManager(WebContents* web_contents) const override;
+
+ private:
+  ConversionManager* manager_ = nullptr;
+};
+
+// Test ConversionManager which can be injected into tests to monitor calls to a
+// ConversionManager instance.
+class TestConversionManager : public ConversionManager {
+ public:
+  TestConversionManager();
+  ~TestConversionManager() override;
+
+  // ConversionManager:
+  void HandleImpression(const StorableImpression& impression) override;
+  void HandleConversion(const StorableConversion& conversion) override;
+  void GetActiveImpressionsForWebUI(
+      base::OnceCallback<void(std::vector<StorableImpression>)> callback)
+      override;
+  void GetReportsForWebUI(
+      base::OnceCallback<void(std::vector<ConversionReport>)> callback,
+      base::Time max_report_time) override;
+  void SendReportsForWebUI(base::OnceClosure done) override;
+  const ConversionPolicy& GetConversionPolicy() const override;
+  void ClearData(base::Time delete_begin,
+                 base::Time delete_end,
+                 base::RepeatingCallback<bool(const url::Origin&)> filter,
+                 base::OnceClosure done) override;
+
+  void SetActiveImpressionsForWebUI(
+      std::vector<StorableImpression> impressions);
+  void SetReportsForWebUI(std::vector<ConversionReport> reports);
+
+  // Resets all counters on this.
+  void Reset();
+
+  size_t num_impressions() const { return num_impressions_; }
+  size_t num_conversions() const { return num_conversions_; }
+
+ private:
+  ConversionPolicy policy_;
+  size_t num_impressions_ = 0;
+  size_t num_conversions_ = 0;
+
+  std::vector<StorableImpression> impressions_;
+  std::vector<ConversionReport> reports_;
 };
 
 // Helper class to construct a StorableImpression for tests using default data.
@@ -35,7 +129,7 @@ class EmptyStorageDelegate : public ConversionStorage::Delegate {
 // builder pattern.
 class ImpressionBuilder {
  public:
-  ImpressionBuilder(base::Time time);
+  explicit ImpressionBuilder(base::Time time);
   ~ImpressionBuilder();
 
   ImpressionBuilder& SetExpiry(base::TimeDelta delta);
@@ -63,10 +157,17 @@ class ImpressionBuilder {
 // impressions created by ImpressionBuilder.
 StorableConversion DefaultConversion();
 
+testing::AssertionResult ImpressionsEqual(const StorableImpression& expected,
+                                          const StorableImpression& actual);
+
 testing::AssertionResult ReportsEqual(
     const std::vector<ConversionReport>& expected,
     const std::vector<ConversionReport>& actual);
 
+std::vector<ConversionReport> GetConversionsToReportForTesting(
+    ConversionManagerImpl* manager,
+    base::Time max_report_time);
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_CONVERSIONS_CONVERSION_TEST_UTILS_H_
diff --git a/chromium/content/browser/conversions/conversions_browsertest.cc b/chromium/content/browser/conversions/conversions_browsertest.cc
new file mode 100644
index 00000000000..dedcf5a42ec
--- /dev/null
+++ b/chromium/content/browser/conversions/conversions_browsertest.cc
@@ -0,0 +1,254 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "base/command_line.h"
+#include "base/test/scoped_feature_list.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/test_navigation_observer.h"
+#include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/controllable_http_response.h"
+#include "net/test/embedded_test_server/default_handlers.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "net/test/embedded_test_server/request_handler_util.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace content {
+
+namespace {
+
+// Waits for the a given |report_url| to be received by the test server. Wraps a
+// ControllableHttpResponse so that it can wait for the server request in a
+// thread-safe manner. Therefore, these must be registered prior to |server|
+// starting.
+struct ExpectedReportWaiter {
+  // ControllableHTTPResponses can only wait for relative urls, so only supply
+  // the path + query.
+  ExpectedReportWaiter(const GURL& report_url, net::EmbeddedTestServer* server)
+      : expected_url(report_url),
+        response(std::make_unique<net::test_server::ControllableHttpResponse>(
+            server,
+            report_url.path() + "?" + report_url.query())) {}
+
+  GURL expected_url;
+  std::unique_ptr<net::test_server::ControllableHttpResponse> response;
+
+  // Returns the url for the HttpRequest handled by |response|. This returns a
+  // URL formatted with the host defined in the headers. This would not match
+  // |expected_url| if the host for report url was not set properly.
+  GURL WaitForRequestUrl() {
+    if (!response->http_request())
+      response->WaitForRequest();
+
+    // The embedded test server resolves all urls to 127.0.0.1, so get the real
+    // request host from the request headers.
+    const net::test_server::HttpRequest& request = *response->http_request();
+    DCHECK(request.headers.find("Host") != request.headers.end());
+    const GURL& request_url = request.GetURL();
+    GURL header_url = GURL("https://" + request.headers.at("Host"));
+    std::string host = header_url.host();
+    GURL::Replacements replace_host;
+    replace_host.SetHostStr(host);
+
+    // Clear the port as it is assigned by the EmbeddedTestServer at runtime.
+    replace_host.SetPortStr("");
+    return request_url.ReplaceComponents(replace_host);
+  }
+};
+
+}  // namespace
+
+class ConversionsBrowserTest : public ContentBrowserTest {
+ public:
+  ConversionsBrowserTest() {
+    feature_list_.InitAndEnableFeature(features::kConversionMeasurement);
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitch(switches::kConversionsDebugMode);
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+
+    https_server_ = std::make_unique<net::EmbeddedTestServer>(
+        net::EmbeddedTestServer::TYPE_HTTPS);
+    https_server_->SetSSLConfig(net::EmbeddedTestServer::CERT_TEST_NAMES);
+    net::test_server::RegisterDefaultHandlers(https_server_.get());
+    https_server_->ServeFilesFromSourceDirectory("content/test/data");
+    SetupCrossSiteRedirector(https_server_.get());
+  }
+
+  WebContents* web_contents() { return shell()->web_contents(); }
+
+  net::EmbeddedTestServer* https_server() { return https_server_.get(); }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+  std::unique_ptr<net::EmbeddedTestServer> https_server_;
+};
+
+IN_PROC_BROWSER_TEST_F(ConversionsBrowserTest,
+                       ImpressionConversion_ReportSent) {
+  // Expected reports must be registered before the server starts.
+  ExpectedReportWaiter expected_report(
+      GURL(
+          "https://a.test/.well-known/"
+          "register-conversion?impression-data=1&conversion-data=7&credit=100"),
+      https_server());
+  ASSERT_TRUE(https_server()->Start());
+
+  GURL impression_url = https_server()->GetURL(
+      "a.test", "/conversions/page_with_impression_creator.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), impression_url));
+
+  // Create an anchor tag with impression attributes and click the link. By
+  // default the target is set to "_top".
+  GURL conversion_url = https_server()->GetURL(
+      "b.test", "/conversions/page_with_conversion_redirect.html");
+  EXPECT_TRUE(
+      ExecJs(web_contents(),
+             JsReplace(R"(
+    createImpressionTag("link" /* id */,
+                        $1 /* url */,
+                        "1" /* impression data */,
+                        $2 /* conversion_destination */);)",
+                       conversion_url, url::Origin::Create(conversion_url))));
+
+  TestNavigationObserver observer(web_contents());
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick('link');"));
+  observer.Wait();
+
+  // Register a conversion with the original page as the reporting origin.
+  EXPECT_TRUE(
+      ExecJs(web_contents(), JsReplace("registerConversionForOrigin(7, $1)",
+                                       url::Origin::Create(impression_url))));
+
+  EXPECT_EQ(expected_report.expected_url, expected_report.WaitForRequestUrl());
+}
+
+IN_PROC_BROWSER_TEST_F(ConversionsBrowserTest,
+                       ImpressionFromCrossOriginSubframe_ReportSent) {
+  ExpectedReportWaiter expected_report(
+      GURL(
+          "https://a.test/.well-known/"
+          "register-conversion?impression-data=1&conversion-data=7&credit=100"),
+      https_server());
+  ASSERT_TRUE(https_server()->Start());
+
+  GURL page_url = https_server()->GetURL("a.test", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+
+  GURL subframe_url = https_server()->GetURL(
+      "c.test", "/conversions/page_with_impression_creator.html");
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    let frame= document.getElementById('test_iframe');
+    frame.setAttribute('allow', 'conversion-measurement');)"));
+  NavigateIframeToURL(web_contents(), "test_iframe", subframe_url);
+  RenderFrameHost* subframe = ChildFrameAt(web_contents()->GetMainFrame(), 0);
+
+  // Create an impression tag in the subframe and target a popup window.
+  GURL conversion_url = https_server()->GetURL(
+      "b.test", "/conversions/page_with_conversion_redirect.html");
+  EXPECT_TRUE(ExecJs(subframe, JsReplace(R"(
+    createImpressionTagWithTarget("link" /* id */,
+                        $1 /* url */,
+                        "1" /* impression data */,
+                        $2 /* conversion_destination */,
+                        "new_frame" /* target */);)",
+                                         conversion_url,
+                                         url::Origin::Create(conversion_url))));
+
+  ShellAddedObserver new_shell_observer;
+  TestNavigationObserver observer(nullptr);
+  observer.StartWatchingNewWebContents();
+  EXPECT_TRUE(ExecJs(subframe, "simulateClick('link');"));
+  WebContents* popup_contents = new_shell_observer.GetShell()->web_contents();
+  observer.Wait();
+
+  // Register a conversion with the original page as the reporting origin.
+  EXPECT_TRUE(
+      ExecJs(popup_contents, JsReplace("registerConversionForOrigin(7, $1)",
+                                       url::Origin::Create(page_url))));
+
+  EXPECT_EQ(expected_report.expected_url, expected_report.WaitForRequestUrl());
+}
+
+IN_PROC_BROWSER_TEST_F(
+    ConversionsBrowserTest,
+    MultipleImpressionsPerConversion_ReportsSentWithAttribution) {
+  std::vector<ExpectedReportWaiter> expected_reports;
+  expected_reports.emplace_back(
+      GURL("https://d.test/.well-known/"
+           "register-conversion?impression-data=1&conversion-data=7&credit=0"),
+      https_server());
+  expected_reports.emplace_back(
+      GURL(
+          "https://d.test/.well-known/"
+          "register-conversion?impression-data=2&conversion-data=7&credit=100"),
+      https_server());
+  ASSERT_TRUE(https_server()->Start());
+
+  GURL first_impression_url = https_server()->GetURL(
+      "a.test", "/conversions/page_with_impression_creator.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), first_impression_url));
+
+  GURL second_impression_url = https_server()->GetURL(
+      "c.test", "/conversions/page_with_impression_creator.html");
+  Shell* shell2 =
+      Shell::CreateNewWindow(shell()->web_contents()->GetBrowserContext(),
+                             GURL(), nullptr, gfx::Size(100, 100));
+  EXPECT_TRUE(NavigateToURL(shell2->web_contents(), second_impression_url));
+
+  // Register impressions from both windows.
+  GURL conversion_url = https_server()->GetURL(
+      "b.test", "/conversions/page_with_conversion_redirect.html");
+  url::Origin reporting_origin =
+      url::Origin::Create(https_server()->GetURL("d.test", "/"));
+  std::string impression_js = R"(
+    createImpressionTagWithReporting("link" /* id */,
+                        $1 /* url */,
+                        $2 /* impression data */,
+                        $3 /* conversion_destination */,
+                        $4 /* reporting_origin */);)";
+
+  TestNavigationObserver first_nav_observer(shell()->web_contents());
+  EXPECT_TRUE(
+      ExecJs(shell(),
+             JsReplace(impression_js, conversion_url, "1" /* impression_data */,
+                       url::Origin::Create(conversion_url), reporting_origin)));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick('link');"));
+  first_nav_observer.Wait();
+
+  TestNavigationObserver second_nav_observer(shell2->web_contents());
+  EXPECT_TRUE(
+      ExecJs(shell2,
+             JsReplace(impression_js, conversion_url, "2" /* impression_data */,
+                       url::Origin::Create(conversion_url), reporting_origin)));
+  EXPECT_TRUE(ExecJs(shell2, "simulateClick('link');"));
+  second_nav_observer.Wait();
+
+  // Register a conversion after both impressions have been registered.
+  EXPECT_TRUE(ExecJs(shell2, JsReplace("registerConversionForOrigin(7, $1)",
+                                       reporting_origin)));
+
+  for (auto& report : expected_reports) {
+    if (!report.response->http_request())
+      report.response->WaitForRequest();
+    EXPECT_EQ(report.expected_url, report.WaitForRequestUrl());
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/impression_declaration_browsertest.cc b/chromium/content/browser/conversions/impression_declaration_browsertest.cc
new file mode 100644
index 00000000000..9e12221ca75
--- /dev/null
+++ b/chromium/content/browser/conversions/impression_declaration_browsertest.cc
@@ -0,0 +1,478 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stdint.h>
+#include <memory>
+
+#include "base/bind.h"
+#include "base/run_loop.h"
+#include "base/test/scoped_feature_list.h"
+#include "base/time/time.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/default_handlers.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// WebContentsObserver that waits until an impression is available on a
+// navigation handle for a finished navigation.
+class ImpressionObserver : public WebContentsObserver {
+ public:
+  explicit ImpressionObserver(WebContents* contents)
+      : WebContentsObserver(contents) {}
+
+  // WebContentsObserver
+  void DidFinishNavigation(NavigationHandle* navigation_handle) override {
+    if (!navigation_handle->GetImpression()) {
+      if (waiting_for_null_impression_)
+        impression_loop_.Quit();
+      return;
+    }
+
+    last_impression_ = *(navigation_handle->GetImpression());
+
+    if (!waiting_for_null_impression_)
+      impression_loop_.Quit();
+  }
+
+  const Impression& last_impression() { return *last_impression_; }
+
+  const Impression& WaitForImpression() {
+    impression_loop_.Run();
+    return last_impression();
+  }
+
+  bool WaitForNavigationWithNoImpression() {
+    waiting_for_null_impression_ = true;
+    impression_loop_.Run();
+    waiting_for_null_impression_ = false;
+    return true;
+  }
+
+ private:
+  base::Optional<Impression> last_impression_;
+  bool waiting_for_null_impression_ = false;
+  base::RunLoop impression_loop_;
+};
+
+class ImpressionDeclarationBrowserTest : public ContentBrowserTest {
+ public:
+  ImpressionDeclarationBrowserTest() {
+    feature_list_.InitAndEnableFeature(features::kConversionMeasurement);
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    embedded_test_server()->ServeFilesFromSourceDirectory(
+        "content/test/data/conversions");
+    embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+    content::SetupCrossSiteRedirector(embedded_test_server());
+    ASSERT_TRUE(embedded_test_server()->Start());
+
+    https_server_ = std::make_unique<net::EmbeddedTestServer>(
+        net::EmbeddedTestServer::TYPE_HTTPS);
+    https_server_->SetSSLConfig(net::EmbeddedTestServer::CERT_TEST_NAMES);
+    net::test_server::RegisterDefaultHandlers(https_server_.get());
+    https_server_->ServeFilesFromSourceDirectory(
+        "content/test/data/conversions");
+    https_server_->ServeFilesFromSourceDirectory("content/test/data");
+    SetupCrossSiteRedirector(https_server_.get());
+    ASSERT_TRUE(https_server_->Start());
+  }
+
+  WebContents* web_contents() { return shell()->web_contents(); }
+
+  net::EmbeddedTestServer* https_server() { return https_server_.get(); }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+  std::unique_ptr<net::EmbeddedTestServer> https_server_;
+};
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionTagClicked_ImpressionReceived) {
+  ImpressionObserver impression_observer(web_contents());
+  GURL page_url =
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+
+  // Create an anchor tag with impression attributes and click the link. By
+  // default the target is set to "_top".
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTagWithReportingAndExpiry("link" /* id */,
+                        "page_with_conversion_redirect.html" /* url */,
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */,
+                        "https://report.com" /* report_origin */,
+                        1000 /* expiry */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  // Wait for the impression to be seen by the observer.
+  Impression last_impression = impression_observer.WaitForImpression();
+
+  // Verify the attributes of the impression are set as expected.
+  EXPECT_EQ(1UL, last_impression.impression_data);
+  EXPECT_EQ(url::Origin::Create(GURL("https://a.com")),
+            last_impression.conversion_destination);
+  EXPECT_EQ(url::Origin::Create(GURL("https://report.com")),
+            last_impression.reporting_origin);
+  EXPECT_EQ(base::TimeDelta::FromMilliseconds(1000), *last_impression.expiry);
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionTagNavigatesRemoteFrame_ImpressionReceived) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ShellAddedObserver new_shell_observer;
+
+  // Create an impression tag with a target frame that does not exist, which
+  // will open a new window to navigate.
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTagWithTarget("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */,
+                        "target" /* target */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  ImpressionObserver impression_observer(
+      new_shell_observer.GetShell()->web_contents());
+
+  // Wait for the impression to be seen by the observer.
+  Impression last_impression = impression_observer.WaitForImpression();
+  EXPECT_EQ(1UL, impression_observer.last_impression().impression_data);
+}
+
+// Test frequently flakes due to timeout. ( https://crbug.com/1084201 )
+IN_PROC_BROWSER_TEST_F(
+    ImpressionDeclarationBrowserTest,
+    DISABLED_ImpressionTagNavigatesExistingRemoteFrame_ImpressionReceived) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  WebContents* initial_web_contents = web_contents();
+
+  ShellAddedObserver new_shell_observer;
+  GURL remote_url = https_server()->GetURL("c.test", "/title1.html");
+  EXPECT_TRUE(ExecJs(web_contents(),
+                     JsReplace("window.open($1, 'target');", remote_url)));
+
+  // Get the new web contents associated with the remote frame.
+  WebContents* remote_web_contents =
+      new_shell_observer.GetShell()->web_contents();
+
+  // Click on the impression and target the existing remote frame.
+  EXPECT_TRUE(ExecJs(initial_web_contents, R"(
+    createImpressionTagWithTarget("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */,
+                        "target" /* target */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  ImpressionObserver impression_observer(remote_web_contents);
+
+  // Wait for the impression to be seen by the observer.
+  Impression last_impression = impression_observer.WaitForImpression();
+  EXPECT_EQ(1UL, impression_observer.last_impression().impression_data);
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionTagWithOutOfBoundData_DefaultedTo0) {
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  // The provided data overflows an unsigned 64 bit int, and should be handled
+  // properly.
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "FFFFFFFFFFFFFFFFFFFFFF" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  // Wait for the impression to be seen by the observer.
+  Impression last_impression = impression_observer.WaitForImpression();
+  EXPECT_EQ(0UL, impression_observer.last_impression().impression_data);
+}
+
+IN_PROC_BROWSER_TEST_F(
+    ImpressionDeclarationBrowserTest,
+    ImpressionTagNavigatesFromMiddleClick_ImpressionReceived) {
+  GURL page_url =
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+
+  ShellAddedObserver new_shell_observer;
+
+  // Create an impression tag that is opened via middle click. This navigates in
+  // a new WebContents.
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateMiddleClick(\'link\');"));
+
+  ImpressionObserver impression_observer(
+      new_shell_observer.GetShell()->web_contents());
+
+  Impression last_impression = impression_observer.WaitForImpression();
+
+  // Verify the attributes of the impression are set as expected.
+  EXPECT_EQ(1UL, last_impression.impression_data);
+}
+
+IN_PROC_BROWSER_TEST_F(
+    ImpressionDeclarationBrowserTest,
+    ImpressionTagNavigatesFromEnterPress_ImpressionReceived) {
+  GURL page_url =
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+
+  // Focus the element, wait for it to receive focus, and simulate an enter
+  // press.
+  base::string16 expected_title = base::ASCIIToUTF16("focused");
+  content::TitleWatcher title_watcher(web_contents(), expected_title);
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    let link = document.getElementById('link');
+    link.addEventListener('focus', function() { document.title = 'focused'; });
+    link.focus();)"));
+  EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+  content::SimulateKeyPress(web_contents(), ui::DomKey::ENTER,
+                            ui::DomCode::ENTER, ui::VKEY_RETURN, false, false,
+                            false, false);
+
+  ImpressionObserver impression_observer(web_contents());
+  Impression last_impression = impression_observer.WaitForImpression();
+
+  // Verify the attributes of the impression are set as expected.
+  EXPECT_EQ(1UL, last_impression.impression_data);
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionOnInsecureSite_NotRegistered) {
+  // Navigate to a page with the non-https server.
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(), embedded_test_server()->GetURL(
+                          "b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_TRUE(impression_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionWithInsecureDestination_NotRegistered) {
+  // Navigate to a page with the non-https server.
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "http://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_TRUE(impression_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionWithInsecureReportingOrigin_NotRegistered) {
+  // Navigate to a page with the non-https server.
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTagWithReportingAndExpiry("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */,
+                        "http://reporting.com" /* report_origin */,
+                        1000 /* expiry */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_TRUE(impression_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionWithFeaturePolicyDisabled_NotRegistered) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL(
+          "b.test", "/page_with_conversion_measurement_disabled.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick('link');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_TRUE(impression_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionInSubframeWithoutFeaturePolicy_NotRegistered) {
+  GURL page_url = https_server()->GetURL("b.test", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+
+  GURL subframe_url =
+      https_server()->GetURL("c.test", "/page_with_impression_creator.html");
+  NavigateIframeToURL(web_contents(), "test_iframe", subframe_url);
+
+  ImpressionObserver impression_observer(web_contents());
+  RenderFrameHost* subframe = ChildFrameAt(web_contents()->GetMainFrame(), 0);
+  EXPECT_TRUE(ExecJs(subframe, R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(subframe, "simulateClick('link');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_TRUE(impression_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionInSubframeWithFeaturePolicy_Registered) {
+  GURL page_url = https_server()->GetURL("b.test", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(web_contents(), page_url));
+  EXPECT_TRUE(ExecJs(shell(), R"(
+     let frame = document.getElementById('test_iframe');
+     frame.setAttribute('allow', 'conversion-measurement');)"));
+
+  GURL subframe_url =
+      https_server()->GetURL("c.test", "/page_with_impression_creator.html");
+  NavigateIframeToURL(web_contents(), "test_iframe", subframe_url);
+
+  ImpressionObserver impression_observer(web_contents());
+  RenderFrameHost* subframe = ChildFrameAt(web_contents()->GetMainFrame(), 0);
+  EXPECT_TRUE(ExecJs(subframe, R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(subframe, "simulateClick('link');"));
+
+  // We should see a null impression on the navigation
+  EXPECT_EQ(1u, impression_observer.WaitForImpression().impression_data);
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       ImpressionNavigationReloads_NoImpression) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+  EXPECT_EQ(1UL, impression_observer.WaitForImpression().impression_data);
+
+  ImpressionObserver reload_observer(web_contents());
+  shell()->Reload();
+
+  // The reload navigation should not have an impression set.
+  EXPECT_TRUE(reload_observer.WaitForNavigationWithNoImpression());
+}
+
+// Same as the above test but via a renderer initiated reload.
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       RendererReloadImpressionNavigation_NoImpression) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), R"(
+    createImpressionTag("link",
+                        "page_with_conversion_redirect.html",
+                        "1" /* impression data */,
+                        "https://a.com" /* conversion_destination */);)"));
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'link\');"));
+  EXPECT_EQ(1UL, impression_observer.WaitForImpression().impression_data);
+
+  ImpressionObserver reload_observer(web_contents());
+  EXPECT_TRUE(ExecJs(web_contents(), "window.location.reload()"));
+
+  // The reload navigation should not have an impression set.
+  EXPECT_TRUE(reload_observer.WaitForNavigationWithNoImpression());
+}
+
+IN_PROC_BROWSER_TEST_F(ImpressionDeclarationBrowserTest,
+                       BackNavigateToImpressionNavigation_NoImpression) {
+  EXPECT_TRUE(NavigateToURL(
+      web_contents(),
+      https_server()->GetURL("b.test", "/page_with_impression_creator.html")));
+
+  ImpressionObserver impression_observer(web_contents());
+
+  // Click the default impression on the page.
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'impression_tag\');"));
+  EXPECT_EQ(1UL, impression_observer.WaitForImpression().impression_data);
+
+  // Navigate away so we can back navigate to the impression's navigated page.
+  EXPECT_TRUE(NavigateToURL(web_contents(), GURL("about:blank")));
+
+  // The back navigation should not have an impression set.
+  ImpressionObserver back_nav_observer(web_contents());
+  shell()->GoBackOrForward(-1);
+  EXPECT_TRUE(back_nav_observer.WaitForNavigationWithNoImpression());
+
+  // Navigate back to the original page and ensure subsequent clicks also log
+  // impressions.
+  ImpressionObserver second_back_nav_observer(web_contents());
+  shell()->GoBackOrForward(-1);
+  EXPECT_TRUE(second_back_nav_observer.WaitForNavigationWithNoImpression());
+
+  // Wait for the page to load and render the impression tag.
+  WaitForLoadStop(web_contents());
+  ImpressionObserver second_impression_observer(web_contents());
+  EXPECT_TRUE(ExecJs(shell(), "simulateClick(\'impression_tag\');"));
+  EXPECT_EQ(1UL,
+            second_impression_observer.WaitForImpression().impression_data);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/conversions/storable_conversion.cc b/chromium/content/browser/conversions/storable_conversion.cc
index d3db20c1a7b..215554be145 100644
--- a/chromium/content/browser/conversions/storable_conversion.cc
+++ b/chromium/content/browser/conversions/storable_conversion.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/conversions/storable_conversion.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/conversions/storable_impression.cc b/chromium/content/browser/conversions/storable_impression.cc
index 0236f690782..ae300e47a7e 100644
--- a/chromium/content/browser/conversions/storable_impression.cc
+++ b/chromium/content/browser/conversions/storable_impression.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/conversions/storable_impression.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/conversions/storable_impression.h b/chromium/content/browser/conversions/storable_impression.h
index ccbc0d9ffa7..e6cea3ffbf5 100644
--- a/chromium/content/browser/conversions/storable_impression.h
+++ b/chromium/content/browser/conversions/storable_impression.h
@@ -56,6 +56,9 @@ class CONTENT_EXPORT StorableImpression {
 
   // If null, an ID has not been assigned yet.
   base::Optional<int64_t> impression_id_;
+
+  // When adding new members, the ImpressionsEqual() testing utility in
+  // conversion_test_utils.h should also be updated.
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc b/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
index c77fe204de4..8906f10e0be 100644
--- a/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
+++ b/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
@@ -22,6 +22,7 @@
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "net/base/features.h"
 #include "net/cookies/cookie_constants.h"
+#include "net/cookies/cookie_util.h"
 #include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
@@ -283,7 +284,8 @@ class CookieStoreManagerTest
     base::RunLoop run_loop;
     bool success = false;
     cookie_manager_->SetCanonicalCookie(
-        cookie, "https", net::CookieOptions::MakeAllInclusive(),
+        cookie, net::cookie_util::SimulatedCookieSource(cookie, "https"),
+        net::CookieOptions::MakeAllInclusive(),
         base::BindLambdaForTesting(
             [&](net::CanonicalCookie::CookieInclusionStatus service_status) {
               success = service_status.IsInclude();
diff --git a/chromium/content/browser/cross_origin_opener_policy_browsertest.cc b/chromium/content/browser/cross_origin_opener_policy_browsertest.cc
index 5d6139cee2f..6fc47dc15c8 100644
--- a/chromium/content/browser/cross_origin_opener_policy_browsertest.cc
+++ b/chromium/content/browser/cross_origin_opener_policy_browsertest.cc
@@ -8,18 +8,38 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
+#include "services/network/public/cpp/cross_origin_opener_policy.h"
 #include "services/network/public/cpp/features.h"
-#include "services/network/public/mojom/cross_origin_opener_policy.mojom.h"
 
 namespace content {
 
 namespace {
 
+network::CrossOriginOpenerPolicy CoopSameOrigin() {
+  network::CrossOriginOpenerPolicy coop;
+  coop.value = network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin;
+  return coop;
+}
+
+network::CrossOriginOpenerPolicy CoopSameOriginAllowPopups() {
+  network::CrossOriginOpenerPolicy coop;
+  coop.value =
+      network::mojom::CrossOriginOpenerPolicyValue::kSameOriginAllowPopups;
+  return coop;
+}
+
+network::CrossOriginOpenerPolicy CoopUnsafeNone() {
+  network::CrossOriginOpenerPolicy coop;
+  // Using the default value.
+  return coop;
+}
+
 class CrossOriginOpenerPolicyBrowserTest : public ContentBrowserTest {
  public:
   CrossOriginOpenerPolicyBrowserTest()
@@ -27,6 +47,7 @@ class CrossOriginOpenerPolicyBrowserTest : public ContentBrowserTest {
     std::vector<base::Feature> features;
     feature_list_.InitWithFeatures(
         {network::features::kCrossOriginOpenerPolicy,
+         network::features::kCrossOriginOpenerPolicyReporting,
          network::features::kCrossOriginEmbedderPolicy},
         {});
     base::CommandLine::ForCurrentProcess()->AppendSwitch(
@@ -69,8 +90,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   RenderFrameHostImpl* main_frame = current_frame_host();
-  main_frame->set_cross_origin_opener_policy(
-      network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+  main_frame->set_cross_origin_opener_policy(CoopSameOrigin());
 
   ShellAddedObserver shell_observer;
   RenderFrameHostImpl* iframe = main_frame->child_at(0)->current_frame_host();
@@ -82,10 +102,8 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
           ->root()
           ->current_frame_host();
 
-  EXPECT_EQ(main_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
-  EXPECT_EQ(popup_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+  EXPECT_EQ(main_frame->cross_origin_opener_policy(), CoopSameOrigin());
+  EXPECT_EQ(popup_frame->cross_origin_opener_policy(), CoopSameOrigin());
 }
 
 IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
@@ -95,8 +113,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   RenderFrameHostImpl* main_frame = current_frame_host();
-  main_frame->set_cross_origin_opener_policy(
-      network::mojom::CrossOriginOpenerPolicy::kSameOriginAllowPopups);
+  main_frame->set_cross_origin_opener_policy(CoopSameOriginAllowPopups());
 
   ShellAddedObserver shell_observer;
   RenderFrameHostImpl* iframe = main_frame->child_at(0)->current_frame_host();
@@ -109,9 +126,9 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
           ->current_frame_host();
 
   EXPECT_EQ(main_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOriginAllowPopups);
+            CoopSameOriginAllowPopups());
   EXPECT_EQ(popup_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOriginAllowPopups);
+            CoopSameOriginAllowPopups());
 }
 
 IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
@@ -121,8 +138,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   RenderFrameHostImpl* main_frame = current_frame_host();
-  main_frame->set_cross_origin_opener_policy(
-      network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+  main_frame->set_cross_origin_opener_policy(CoopSameOrigin());
 
   ShellAddedObserver shell_observer;
   RenderFrameHostImpl* iframe = main_frame->child_at(0)->current_frame_host();
@@ -134,10 +150,8 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
           ->root()
           ->current_frame_host();
 
-  EXPECT_EQ(main_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
-  EXPECT_EQ(popup_frame->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kUnsafeNone);
+  EXPECT_EQ(main_frame->cross_origin_opener_policy(), CoopSameOrigin());
+  EXPECT_EQ(popup_frame->cross_origin_opener_policy(), CoopUnsafeNone());
 }
 
 IN_PROC_BROWSER_TEST_F(
@@ -148,8 +162,7 @@ IN_PROC_BROWSER_TEST_F(
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   RenderFrameHostImpl* main_frame = current_frame_host();
-  main_frame->set_cross_origin_opener_policy(
-      network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+  main_frame->set_cross_origin_opener_policy(CoopSameOrigin());
 
   ShellAddedObserver new_shell_observer;
   RenderFrameHostImpl* iframe = main_frame->child_at(0)->current_frame_host();
@@ -212,7 +225,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
       "a.com", "/cross-origin-opener-policy_csp_sandboxed.html"));
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
   EXPECT_NE(current_frame_host()->active_sandbox_flags(),
-            blink::mojom::WebSandboxFlags::kNone)
+            network::mojom::WebSandboxFlags::kNone)
       << "Document should be sandboxed.";
 
   GURL next_page(https_server()->GetURL(
@@ -229,7 +242,7 @@ class CrossOriginPolicyHeadersObserver : public WebContentsObserver {
   explicit CrossOriginPolicyHeadersObserver(
       WebContents* web_contents,
       network::mojom::CrossOriginEmbedderPolicyValue expected_coep,
-      network::mojom::CrossOriginOpenerPolicy expected_coop)
+      network::CrossOriginOpenerPolicy expected_coop)
       : WebContentsObserver(web_contents),
         expected_coep_(expected_coep),
         expected_coop_(expected_coop) {}
@@ -240,25 +253,27 @@ class CrossOriginPolicyHeadersObserver : public WebContentsObserver {
     // Verify that the COOP/COEP headers were parsed.
     NavigationRequest* navigation_request =
         static_cast<NavigationRequest*>(navigation_handle);
-    CHECK(navigation_request->response()->cross_origin_embedder_policy.value ==
+    CHECK(navigation_request->response()
+              ->parsed_headers->cross_origin_embedder_policy.value ==
           expected_coep_);
-    CHECK(navigation_request->response()->cross_origin_opener_policy ==
-          expected_coop_);
+    CHECK(navigation_request->response()
+              ->parsed_headers->cross_origin_opener_policy == expected_coop_);
   }
 
   void DidFinishNavigation(NavigationHandle* navigation_handle) override {
     // Verify that the COOP/COEP headers were parsed.
     NavigationRequest* navigation_request =
         static_cast<NavigationRequest*>(navigation_handle);
-    CHECK(navigation_request->response()->cross_origin_embedder_policy.value ==
+    CHECK(navigation_request->response()
+              ->parsed_headers->cross_origin_embedder_policy.value ==
           expected_coep_);
-    CHECK(navigation_request->response()->cross_origin_opener_policy ==
-          expected_coop_);
+    CHECK(navigation_request->response()
+              ->parsed_headers->cross_origin_opener_policy == expected_coop_);
   }
 
  private:
   network::mojom::CrossOriginEmbedderPolicyValue expected_coep_;
-  network::mojom::CrossOriginOpenerPolicy expected_coop_;
+  network::CrossOriginOpenerPolicy expected_coop_;
 };
 
 IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
@@ -271,7 +286,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   CrossOriginPolicyHeadersObserver obs(
       web_contents(),
       network::mojom::CrossOriginEmbedderPolicyValue::kRequireCorp,
-      network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+      CoopSameOrigin());
 
   EXPECT_TRUE(
       NavigateToURL(shell(), redirect_initial_page, redirect_final_page));
@@ -290,7 +305,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), coop_page));
   EXPECT_EQ(current_frame_host()->GetSiteInstance(), initial_site_instance);
   EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kUnsafeNone);
+            CoopUnsafeNone());
 }
 
 IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
@@ -317,10 +332,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
   EXPECT_EQ(iframe_rfh->GetLastCommittedURL(), iframe_navigation_url);
   EXPECT_EQ(iframe_rfh->GetSiteInstance(), non_coop_iframe_site_instance);
 
-  // TODO(pmeuleman, ahemery): Don't store COOP on subframes as it will not be
-  // used anyway.
-  EXPECT_EQ(iframe_rfh->cross_origin_opener_policy(),
-            network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+  EXPECT_EQ(iframe_rfh->cross_origin_opener_policy(), CoopUnsafeNone());
 }
 
 IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
@@ -363,7 +375,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+              CoopSameOrigin());
 
     // The COOP page should no longer have any RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -413,7 +425,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+              CoopSameOrigin());
 
     // The COOP page should no longer have any RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -473,7 +485,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kUnsafeNone);
+              CoopUnsafeNone());
 
     // The non COOP page should no longer have any RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -531,7 +543,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kUnsafeNone);
+              CoopUnsafeNone());
 
     // The non COOP page should no longer have any RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -591,7 +603,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_TRUE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+              CoopSameOrigin());
 
     // TODO(pmeuleman): The COOP page should still have RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -649,7 +661,7 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
     EXPECT_TRUE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
         initial_site_instance.get()));
     EXPECT_EQ(current_frame_host()->cross_origin_opener_policy(),
-              network::mojom::CrossOriginOpenerPolicy::kSameOrigin);
+              CoopSameOrigin());
 
     // TODO(pmeuleman): The COOP page should still have RenderFrameHostProxies.
     EXPECT_EQ(web_contents()
@@ -792,6 +804,128 @@ IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
             popup_webcontents->GetMainFrame()->GetProcess());
 }
 
+IN_PROC_BROWSER_TEST_F(CrossOriginOpenerPolicyBrowserTest,
+                       SpeculativeRfhsAndCoop) {
+  GURL non_coop_page(https_server()->GetURL("/title1.html"));
+  GURL coop_page(https_server()->GetURL("/page_with_coop_and_coep.html"));
+
+  // Non-COOP into non-COOP.
+  {
+    // Start on a non COOP page.
+    EXPECT_TRUE(NavigateToURL(shell(), non_coop_page));
+    scoped_refptr<SiteInstance> initial_site_instance(
+        current_frame_host()->GetSiteInstance());
+
+    // Navigate to a non COOP page.
+    TestNavigationManager non_coop_navigation(web_contents(), non_coop_page);
+    shell()->LoadURL(non_coop_page);
+    EXPECT_TRUE(non_coop_navigation.WaitForRequestStart());
+
+    // TODO(ahemery): RenderDocument will always create a Speculative RFH.
+    // Update these expectations to test the speculative RFH's SI relation when
+    // RenderDocument lands.
+    EXPECT_FALSE(web_contents()
+                     ->GetFrameTree()
+                     ->root()
+                     ->render_manager()
+                     ->speculative_frame_host());
+
+    non_coop_navigation.WaitForNavigationFinished();
+
+    EXPECT_TRUE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
+        initial_site_instance.get()));
+    EXPECT_EQ(current_frame_host()->cross_origin_opener_policy().value,
+              network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone);
+  }
+
+  // Non-COOP into COOP.
+  {
+    // Start on a non COOP page.
+    EXPECT_TRUE(NavigateToURL(shell(), non_coop_page));
+    scoped_refptr<SiteInstance> initial_site_instance(
+        current_frame_host()->GetSiteInstance());
+
+    // Navigate to a COOP page.
+    TestNavigationManager coop_navigation(web_contents(), coop_page);
+    shell()->LoadURL(coop_page);
+    EXPECT_TRUE(coop_navigation.WaitForRequestStart());
+
+    // TODO(ahemery): RenderDocument will always create a Speculative RFH.
+    // Update these expectations to test the speculative RFH's SI relation when
+    // RenderDocument lands.
+    EXPECT_FALSE(web_contents()
+                     ->GetFrameTree()
+                     ->root()
+                     ->render_manager()
+                     ->speculative_frame_host());
+
+    coop_navigation.WaitForNavigationFinished();
+
+    EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
+        initial_site_instance.get()));
+    EXPECT_EQ(current_frame_host()->cross_origin_opener_policy().value,
+              network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin);
+  }
+
+  // COOP into non-COOP.
+  {
+    // Start on a COOP page.
+    EXPECT_TRUE(NavigateToURL(shell(), coop_page));
+    scoped_refptr<SiteInstance> initial_site_instance(
+        current_frame_host()->GetSiteInstance());
+
+    // Navigate to a non COOP page.
+    TestNavigationManager non_coop_navigation(web_contents(), non_coop_page);
+    shell()->LoadURL(non_coop_page);
+    EXPECT_TRUE(non_coop_navigation.WaitForRequestStart());
+
+    // TODO(ahemery): RenderDocument will always create a Speculative RFH.
+    // Update these expectations to test the speculative RFH's SI relation when
+    // RenderDocument lands.
+    EXPECT_FALSE(web_contents()
+                     ->GetFrameTree()
+                     ->root()
+                     ->render_manager()
+                     ->speculative_frame_host());
+
+    non_coop_navigation.WaitForNavigationFinished();
+
+    EXPECT_FALSE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
+        initial_site_instance.get()));
+    EXPECT_EQ(current_frame_host()->cross_origin_opener_policy().value,
+              network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone);
+  }
+
+  // COOP into COOP.
+  {
+    // Start on a COOP page.
+    EXPECT_TRUE(NavigateToURL(shell(), coop_page));
+    scoped_refptr<SiteInstance> initial_site_instance(
+        current_frame_host()->GetSiteInstance());
+
+    // Navigate to a COOP page.
+    TestNavigationManager coop_navigation(web_contents(), coop_page);
+    shell()->LoadURL(coop_page);
+    EXPECT_TRUE(coop_navigation.WaitForRequestStart());
+
+    // TODO(ahemery): RenderDocument will always create a Speculative RFH.
+    // Update these expectations to test the speculative RFH's SI relation when
+    // RenderDocument lands.
+    EXPECT_FALSE(web_contents()
+                     ->GetFrameTree()
+                     ->root()
+                     ->render_manager()
+                     ->speculative_frame_host());
+
+    coop_navigation.WaitForNavigationFinished();
+
+    EXPECT_TRUE(current_frame_host()->GetSiteInstance()->IsRelatedSiteInstance(
+        initial_site_instance.get()));
+    EXPECT_EQ(current_frame_host()->cross_origin_opener_policy().value,
+              network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin);
+  }
+}
+
 }  // namespace
 
 }  // namespace content
diff --git a/chromium/content/browser/cross_site_transfer_browsertest.cc b/chromium/content/browser/cross_site_transfer_browsertest.cc
index 70f7e7856ac..5a34f89320e 100644
--- a/chromium/content/browser/cross_site_transfer_browsertest.cc
+++ b/chromium/content/browser/cross_site_transfer_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -287,8 +288,7 @@ IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest, PostWithFileData) {
   std::string file_content("test-file-content");
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-  ASSERT_LT(
-      0, base::WriteFile(file_path, file_content.data(), file_content.size()));
+  ASSERT_TRUE(base::WriteFile(file_path, file_content));
 
   base::RunLoop run_loop;
   // Fill out the form to refer to the test file.
@@ -381,8 +381,7 @@ IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest, MaliciousPostWithFileData) {
   std::string file_content("test-file-content");
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-  ASSERT_LT(
-      0, base::WriteFile(file_path, file_content.data(), file_content.size()));
+  ASSERT_TRUE(base::WriteFile(file_path, file_content));
 
   base::RunLoop run_loop;
   // Fill out the form to refer to the test file.
diff --git a/chromium/content/browser/data_decoder_browsertest.cc b/chromium/content/browser/data_decoder_browsertest.cc
index 697e36cf1f4..d7031e134c1 100644
--- a/chromium/content/browser/data_decoder_browsertest.cc
+++ b/chromium/content/browser/data_decoder_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/macros.h"
 #include "content/public/browser/service_process_host.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/data_decoder/public/cpp/data_decoder.h"
diff --git a/chromium/content/browser/database_browsertest.cc b/chromium/content/browser/database_browsertest.cc
index c29c1e8e72d..dc0d86617f3 100644
--- a/chromium/content/browser/database_browsertest.cc
+++ b/chromium/content/browser/database_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/device_sensors/device_sensor_browsertest.cc b/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
index 58e4edfcec3..2ac11d6d717 100644
--- a/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
+++ b/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
@@ -19,6 +19,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/devtools/BUILD.gn b/chromium/content/browser/devtools/BUILD.gn
index 2cd01cd3c6a..a39fe433f3c 100644
--- a/chromium/content/browser/devtools/BUILD.gn
+++ b/chromium/content/browser/devtools/BUILD.gn
@@ -63,6 +63,8 @@ inspector_protocol_generate("protocol_sources") {
 
   # These are relative to $target_gen_dir.
   outputs = [
+    "protocol/audits.cc",
+    "protocol/audits.h",
     "protocol/background_service.cc",
     "protocol/background_service.h",
     "protocol/base_string_adapter.cc",
@@ -82,6 +84,8 @@ inspector_protocol_generate("protocol_sources") {
     "protocol/inspector.h",
     "protocol/io.cc",
     "protocol/io.h",
+    "protocol/log.cc",
+    "protocol/log.h",
     "protocol/memory.cc",
     "protocol/memory.h",
     "protocol/network.cc",
diff --git a/chromium/content/browser/devtools/devtools_instrumentation.cc b/chromium/content/browser/devtools/devtools_instrumentation.cc
index 91da6cb62a5..27b5e222e96 100644
--- a/chromium/content/browser/devtools/devtools_instrumentation.cc
+++ b/chromium/content/browser/devtools/devtools_instrumentation.cc
@@ -3,12 +3,14 @@
 // found in the LICENSE file.
 #include "content/browser/devtools/devtools_instrumentation.h"
 
+#include "base/strings/stringprintf.h"
 #include "components/download/public/common/download_create_info.h"
 #include "components/download/public/common/download_item.h"
 #include "content/browser/devtools/browser_devtools_agent_host.h"
 #include "content/browser/devtools/devtools_url_loader_interceptor.h"
 #include "content/browser/devtools/protocol/emulation_handler.h"
 #include "content/browser/devtools/protocol/fetch_handler.h"
+#include "content/browser/devtools/protocol/log_handler.h"
 #include "content/browser/devtools/protocol/network_handler.h"
 #include "content/browser/devtools/protocol/page_handler.h"
 #include "content/browser/devtools/protocol/security_handler.h"
@@ -25,6 +27,7 @@
 #include "net/base/load_flags.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/http/http_request_headers.h"
+#include "net/quic/quic_transport_client.h"
 #include "net/ssl/ssl_info.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
@@ -89,7 +92,7 @@ void OnResetNavigationRequest(NavigationRequest* navigation_request) {
   // Traverse frame chain all the way to the top and report to all
   // page handlers that the navigation completed.
   for (FrameTreeNode* node = navigation_request->frame_tree_node(); node;
-       node = node->parent()) {
+       node = FrameTreeNode::From(node->parent())) {
     DispatchToAgents(node, &protocol::PageHandler::NavigationReset,
                      navigation_request);
   }
@@ -213,7 +216,7 @@ std::vector<std::unique_ptr<NavigationThrottle>> CreateNavigationThrottles(
     NavigationHandle* navigation_handle) {
   FrameTreeNode* frame_tree_node =
       NavigationRequest::From(navigation_handle)->frame_tree_node();
-  FrameTreeNode* parent = frame_tree_node->parent();
+  FrameTreeNode* parent = FrameTreeNode::From(frame_tree_node->parent());
   if (!parent) {
     if (WebContentsImpl::FromFrameTreeNode(frame_tree_node)->IsPortal() &&
         WebContentsImpl::FromFrameTreeNode(frame_tree_node)
@@ -282,6 +285,21 @@ void ApplyNetworkRequestOverrides(FrameTreeNode* frame_tree_node,
   begin_params->headers = headers.ToString();
 }
 
+bool ApplyUserAgentMetadataOverrides(
+    FrameTreeNode* frame_tree_node,
+    base::Optional<blink::UserAgentMetadata>* override_out) {
+  DevToolsAgentHostImpl* agent_host =
+      RenderFrameDevToolsAgentHost::GetFor(frame_tree_node);
+  if (!agent_host)
+    return false;
+
+  bool result = false;
+  for (auto* emulation : protocol::EmulationHandler::ForAgentHost(agent_host))
+    result = emulation->ApplyUserAgentMetadataOverrides(override_out) || result;
+
+  return result;
+}
+
 namespace {
 template <typename HandlerType>
 bool MaybeCreateProxyForInterception(
@@ -611,7 +629,7 @@ void OnCorsPreflightRequestCompleted(
 }
 
 namespace {
-blink::mojom::SameSiteCookieIssueDetailsPtr BuildSameSiteCookieIssueDetails(
+std::vector<blink::mojom::SameSiteCookieExclusionReason> BuildExclusionReasons(
     net::CanonicalCookie::CookieInclusionStatus status) {
   std::vector<blink::mojom::SameSiteCookieExclusionReason> exclusion_reasons;
   if (status.HasExclusionReason(
@@ -625,7 +643,11 @@ blink::mojom::SameSiteCookieIssueDetailsPtr BuildSameSiteCookieIssueDetails(
     exclusion_reasons.push_back(blink::mojom::SameSiteCookieExclusionReason::
                                     ExcludeSameSiteNoneInsecure);
   }
+  return exclusion_reasons;
+}
 
+std::vector<blink::mojom::SameSiteCookieWarningReason> BuildWarningReasons(
+    net::CanonicalCookie::CookieInclusionStatus status) {
   std::vector<blink::mojom::SameSiteCookieWarningReason> warning_reasons;
   if (status.HasWarningReason(
           net::CanonicalCookie::CookieInclusionStatus::
@@ -643,64 +665,98 @@ blink::mojom::SameSiteCookieIssueDetailsPtr BuildSameSiteCookieIssueDetails(
     warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
                                   WarnSameSiteUnspecifiedLaxAllowUnsafe);
   }
-  if (status.HasWarningReason(
-          net::CanonicalCookie::CookieInclusionStatus::
-              WARN_SAMESITE_LAX_METHOD_UNSAFE_CROSS_SCHEME_SECURE_URL)) {
-    warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
-                                  WarnSameSiteCrossSchemeSecureUrlMethodUnsafe);
-  }
+
+  // If schemeful messages are disabled, don't add a warning for them.
+  if (!base::FeatureList::IsEnabled(features::kCookieDeprecationMessages))
+    return warning_reasons;
+
+  // There can only be one of the following warnings.
   if (status.HasWarningReason(net::CanonicalCookie::CookieInclusionStatus::
-                                  WARN_SAMESITE_LAX_CROSS_SCHEME_SECURE_URL)) {
+                                  WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE)) {
     warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
-                                  WarnSameSiteCrossSchemeSecureUrlLax);
-  }
-  if (status.HasWarningReason(
-          net::CanonicalCookie::CookieInclusionStatus::
-              WARN_SAMESITE_STRICT_CROSS_SCHEME_SECURE_URL)) {
+                                  WarnSameSiteStrictLaxDowngradeStrict);
+  } else if (status.HasWarningReason(
+                 net::CanonicalCookie::CookieInclusionStatus::
+                     WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE)) {
     warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
-                                  WarnSameSiteCrossSchemeSecureUrlStrict);
-  }
-  if (status.HasWarningReason(
-          net::CanonicalCookie::CookieInclusionStatus::
-              WARN_SAMESITE_LAX_METHOD_UNSAFE_CROSS_SCHEME_INSECURE_URL)) {
-    warning_reasons.push_back(
-        blink::mojom::SameSiteCookieWarningReason::
-            WarnSameSiteCrossSchemeInsecureUrlMethodUnsafe);
-  }
-  if (status.HasWarningReason(
-          net::CanonicalCookie::CookieInclusionStatus::
-              WARN_SAMESITE_LAX_CROSS_SCHEME_INSECURE_URL)) {
+                                  WarnSameSiteStrictCrossDowngradeStrict);
+  } else if (status.HasWarningReason(
+                 net::CanonicalCookie::CookieInclusionStatus::
+                     WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE)) {
     warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
-                                  WarnSameSiteCrossSchemeInsecureUrlLax);
-  }
-  if (status.HasWarningReason(
-          net::CanonicalCookie::CookieInclusionStatus::
-              WARN_SAMESITE_STRICT_CROSS_SCHEME_INSECURE_URL)) {
+                                  WarnSameSiteStrictCrossDowngradeLax);
+  } else if (status.HasWarningReason(
+                 net::CanonicalCookie::CookieInclusionStatus::
+                     WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE)) {
+    warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
+                                  WarnSameSiteLaxCrossDowngradeStrict);
+  } else if (status.HasWarningReason(
+                 net::CanonicalCookie::CookieInclusionStatus::
+                     WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE)) {
     warning_reasons.push_back(blink::mojom::SameSiteCookieWarningReason::
-                                  WarnSameSiteCrossSchemeInsecureUrlStrict);
+                                  WarnSameSiteLaxCrossDowngradeLax);
   }
 
-  return blink::mojom::SameSiteCookieIssueDetails::New(
-      std::move(exclusion_reasons), std::move(warning_reasons));
+  return warning_reasons;
 }
 }  // namespace
 
-void ReportSameSiteCookieIssue(RenderFrameHostImpl* render_frame_host_impl,
-                               const net::CookieWithStatus& excluded_cookie,
-                               const GURL& url,
-                               const GURL& site_for_cookies) {
+void ReportSameSiteCookieIssue(
+    RenderFrameHostImpl* render_frame_host_impl,
+    const net::CookieWithStatus& excluded_cookie,
+    const GURL& url,
+    const net::SiteForCookies& site_for_cookies,
+    blink::mojom::SameSiteCookieOperation operation,
+    const base::Optional<std::string>& devtools_request_id) {
+  blink::mojom::AffectedRequestPtr affected_request;
+  if (devtools_request_id) {
+    // We can report the url here, because if devtools_request_id is set, the
+    // url is the url of the request.
+    affected_request =
+        blink::mojom::AffectedRequest::New(*devtools_request_id, url.spec());
+  }
+  auto affected_cookie = blink::mojom::AffectedCookie::New(
+      excluded_cookie.cookie.Name(), excluded_cookie.cookie.Path(),
+      excluded_cookie.cookie.Domain());
   auto details = blink::mojom::InspectorIssueDetails::New();
+  base::Optional<GURL> optional_site_for_cookies_url;
+  if (!site_for_cookies.IsNull()) {
+    optional_site_for_cookies_url = site_for_cookies.RepresentativeUrl();
+  }
   details->sameSiteCookieIssueDetails =
-      BuildSameSiteCookieIssueDetails(excluded_cookie.status);
-  auto resources = blink::mojom::AffectedResources::New();
-  resources->cookies.push_back(blink::mojom::AffectedCookie::New(
-      excluded_cookie.cookie.Name(), excluded_cookie.cookie.Path(),
-      excluded_cookie.cookie.Domain(), site_for_cookies));
+      blink::mojom::SameSiteCookieIssueDetails::New(
+          std::move(affected_cookie),
+          BuildExclusionReasons(excluded_cookie.status),
+          BuildWarningReasons(excluded_cookie.status), operation,
+          optional_site_for_cookies_url, url, std::move(affected_request));
 
   render_frame_host_impl->AddInspectorIssue(
       blink::mojom::InspectorIssueInfo::New(
           blink::mojom::InspectorIssueCode::kSameSiteCookieIssue,
-          std::move(details), std::move(resources)));
+          std::move(details)));
+}
+
+void OnQuicTransportHandshakeFailed(
+    RenderFrameHostImpl* frame,
+    const GURL& url,
+    const base::Optional<net::QuicTransportError>& error) {
+  FrameTreeNode* ftn = frame->frame_tree_node();
+  if (!ftn)
+    return;
+  std::string text = base::StringPrintf(
+      "Failed to establish a connection to %s", url.spec().c_str());
+  if (error) {
+    text += ": ";
+    text += net::QuicTransportErrorToString(*error);
+  }
+  text += ".";
+  auto entry = protocol::Log::LogEntry::Create()
+                   .SetSource(protocol::Log::LogEntry::SourceEnum::Network)
+                   .SetLevel(protocol::Log::LogEntry::LevelEnum::Error)
+                   .SetText(text)
+                   .SetTimestamp(base::Time::Now().ToDoubleT() * 1000.0)
+                   .Build();
+  DispatchToAgents(ftn, &protocol::LogHandler::EntryAdded, std::move(entry));
 }
 
 }  // namespace devtools_instrumentation
diff --git a/chromium/content/browser/devtools/devtools_instrumentation.h b/chromium/content/browser/devtools/devtools_instrumentation.h
index 35726bdf430..e15c71b22a5 100644
--- a/chromium/content/browser/devtools/devtools_instrumentation.h
+++ b/chromium/content/browser/devtools/devtools_instrumentation.h
@@ -18,6 +18,7 @@
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom-forward.h"
+#include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-forward.h"
 
 class GURL;
 
@@ -25,10 +26,15 @@ namespace base {
 class UnguessableToken;
 }
 
+namespace blink {
+struct UserAgentMetadata;
+}
+
 namespace net {
 class SSLInfo;
 class X509Certificate;
 struct CookieWithStatus;
+struct QuicTransportError;
 }  // namespace net
 
 namespace download {
@@ -54,6 +60,14 @@ void ApplyNetworkRequestOverrides(FrameTreeNode* frame_tree_node,
                                   mojom::BeginNavigationParams* begin_params,
                                   bool* report_raw_headers);
 
+// Returns true if devtools want |*override_out| to be used.
+// (A true return and |*override_out| being nullopt means no user agent client
+//  hints should be sent; a false return means devtools doesn't want to affect
+//  the behavior).
+bool ApplyUserAgentMetadataOverrides(
+    FrameTreeNode* frame_tree_node,
+    base::Optional<blink::UserAgentMetadata>* override_out);
+
 bool WillCreateURLLoaderFactory(
     RenderFrameHostImpl* rfh,
     bool is_navigation,
@@ -158,10 +172,19 @@ void PortalAttached(RenderFrameHostImpl* render_frame_host_impl);
 void PortalDetached(RenderFrameHostImpl* render_frame_host_impl);
 void PortalActivated(RenderFrameHostImpl* render_frame_host_impl);
 
-void ReportSameSiteCookieIssue(RenderFrameHostImpl* render_frame_host_impl,
-                               const net::CookieWithStatus& excluded_cookie,
-                               const GURL& url,
-                               const GURL& site_for_cookies);
+void ReportSameSiteCookieIssue(
+    RenderFrameHostImpl* render_frame_host_impl,
+    const net::CookieWithStatus& excluded_cookie,
+    const GURL& url,
+    const net::SiteForCookies& site_for_cookies,
+    blink::mojom::SameSiteCookieOperation operation,
+    const base::Optional<std::string>& devtools_request_id);
+
+void OnQuicTransportHandshakeFailed(
+    RenderFrameHostImpl* frame_host,
+    const GURL& url,
+    const base::Optional<net::QuicTransportError>& error);
+
 }  // namespace devtools_instrumentation
 
 }  // namespace content
diff --git a/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc b/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
index 50e5b363929..94c329f309b 100644
--- a/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
+++ b/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
@@ -337,9 +337,11 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
   }
 
   // network::mojom::URLLoader methods
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
@@ -893,7 +895,7 @@ Response InterceptionJob::InnerContinueRequest(
     } else {
       // TODO(caseq): report error if other modifications are present.
       state_ = State::kRequestSent;
-      loader_->FollowRedirect({}, {}, base::nullopt);
+      loader_->FollowRedirect({}, {}, {}, base::nullopt);
       return Response::Success();
     }
   }
@@ -902,9 +904,7 @@ Response InterceptionJob::InnerContinueRequest(
     if (modifications->modified_url.isJust()) {
       std::string location = modifications->modified_url.fromJust();
       CancelRequest();
-      auto* headers = response_metadata_->head->headers.get();
-      headers->RemoveHeader("location");
-      headers->AddHeader("location: " + location);
+      response_metadata_->head->headers->SetHeader("location", location);
       GURL redirect_url = create_loader_params_->request.url.Resolve(location);
       if (!redirect_url.is_valid())
         return Response::ServerError("Invalid modified URL");
@@ -1107,7 +1107,7 @@ void InterceptionJob::ProcessSetCookies(const net::HttpResponseHeaders& headers,
           create_loader_params_->request.url,
           create_loader_params_->request.site_for_cookies,
           create_loader_params_->request.request_initiator,
-          (create_loader_params_->request.attach_same_site_cookies ||
+          (create_loader_params_->request.force_ignore_site_for_cookies ||
            should_treat_as_first_party)));
 
   // |this| might be deleted here if |cookies| is empty!
@@ -1117,8 +1117,7 @@ void InterceptionJob::ProcessSetCookies(const net::HttpResponseHeaders& headers,
       base::BarrierClosure(cookies.size(), std::move(callback)));
   for (auto& cookie : cookies) {
     cookie_manager_->SetCanonicalCookie(
-        *cookie, create_loader_params_->request.url.scheme(), options,
-        on_cookie_set);
+        *cookie, create_loader_params_->request.url, options, on_cookie_set);
   }
 }
 
@@ -1256,7 +1255,8 @@ void InterceptionJob::FetchCookies(
       net::cookie_util::ComputeSameSiteContextForRequest(
           request.method, request.url, request.site_for_cookies,
           request.request_initiator,
-          (request.attach_same_site_cookies || should_treat_as_first_party)));
+          (request.force_ignore_site_for_cookies ||
+           should_treat_as_first_party)));
 
   cookie_manager_->GetCookieList(request.url, options, std::move(callback));
 }
@@ -1296,13 +1296,8 @@ void InterceptionJob::Shutdown() {
 void InterceptionJob::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
-  // TODO(arthursonzogni, juncai): This seems to be correctly implemented, but
-  // not used nor tested so far. Add tests and remove this DCHECK to support
-  // this feature if needed. See https://crbug.com/845683.
-  DCHECK(removed_headers.empty())
-      << "Redirect with removed headers is not supported yet. See "
-         "https://crbug.com/845683";
   DCHECK(!new_url.has_value()) << "Redirect with modified url was not "
                                   "supported yet. crbug.com/845683";
   DCHECK(!waiting_for_resolution_);
@@ -1320,6 +1315,10 @@ void InterceptionJob::FollowRedirect(
   net::RedirectUtil::UpdateHttpRequest(request->url, request->method, info,
                                        removed_headers, modified_headers,
                                        &request->headers, &clear_body);
+  request->cors_exempt_headers.MergeFrom(modified_cors_exempt_headers);
+  for (const std::string& name : removed_headers)
+    request->cors_exempt_headers.RemoveHeader(name);
+
   if (clear_body)
     request->request_body = nullptr;
   request->method = info.new_method;
@@ -1342,6 +1341,7 @@ void InterceptionJob::FollowRedirect(
   if (state_ == State::kRedirectReceived) {
     state_ = State::kRequestSent;
     loader_->FollowRedirect(removed_headers, modified_headers,
+                            modified_cors_exempt_headers,
                             base::nullopt /* new_url */);
     return;
   }
diff --git a/chromium/content/browser/devtools/devtools_video_consumer_browsertest.cc b/chromium/content/browser/devtools/devtools_video_consumer_browsertest.cc
index 1bbee3091f8..f9227e57efc 100644
--- a/chromium/content/browser/devtools/devtools_video_consumer_browsertest.cc
+++ b/chromium/content/browser/devtools/devtools_video_consumer_browsertest.cc
@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "content/browser/devtools/devtools_video_consumer.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/devtools/protocol/audits_handler.cc b/chromium/content/browser/devtools/protocol/audits_handler.cc
new file mode 100644
index 00000000000..9f32e63e2f8
--- /dev/null
+++ b/chromium/content/browser/devtools/protocol/audits_handler.cc
@@ -0,0 +1,38 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/devtools/protocol/audits_handler.h"
+
+#include "content/browser/devtools/devtools_agent_host_impl.h"
+
+namespace content {
+namespace protocol {
+
+AuditsHandler::AuditsHandler()
+    : DevToolsDomainHandler(Audits::Metainfo::domainName) {}
+AuditsHandler::~AuditsHandler() = default;
+
+// static
+std::vector<AuditsHandler*> AuditsHandler::ForAgentHost(
+    DevToolsAgentHostImpl* host) {
+  return host->HandlersByName<AuditsHandler>(Audits::Metainfo::domainName);
+}
+
+void AuditsHandler::Wire(UberDispatcher* dispatcher) {
+  frontend_ = std::make_unique<Audits::Frontend>(dispatcher->channel());
+  Audits::Dispatcher::wire(dispatcher, this);
+}
+
+DispatchResponse AuditsHandler::Disable() {
+  enabled_ = false;
+  return Response::FallThrough();
+}
+
+DispatchResponse AuditsHandler::Enable() {
+  enabled_ = true;
+  return Response::FallThrough();
+}
+
+}  // namespace protocol
+}  // namespace content
diff --git a/chromium/content/browser/devtools/protocol/audits_handler.h b/chromium/content/browser/devtools/protocol/audits_handler.h
new file mode 100644
index 00000000000..1d00247954c
--- /dev/null
+++ b/chromium/content/browser/devtools/protocol/audits_handler.h
@@ -0,0 +1,44 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_
+#define CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_
+
+#include "base/macros.h"
+#include "content/browser/devtools/protocol/audits.h"
+#include "content/browser/devtools/protocol/devtools_domain_handler.h"
+#include "mojo/public/cpp/bindings/remote.h"
+
+namespace content {
+
+class DevToolsAgentHostImpl;
+
+namespace protocol {
+
+class AuditsHandler final : public DevToolsDomainHandler,
+                            public Audits::Backend {
+ public:
+  AuditsHandler();
+  ~AuditsHandler() override;
+
+  static std::vector<AuditsHandler*> ForAgentHost(DevToolsAgentHostImpl* host);
+
+  // DevToolsDomainHandler implementation.
+  void Wire(UberDispatcher* dispatcher) override;
+
+  // Audits::Backend implementation.
+  DispatchResponse Disable() override;
+  DispatchResponse Enable() override;
+
+ private:
+  std::unique_ptr<Audits::Frontend> frontend_;
+  bool enabled_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(AuditsHandler);
+};
+
+}  // namespace protocol
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_
diff --git a/chromium/content/browser/devtools/protocol/browser_handler.cc b/chromium/content/browser/devtools/protocol/browser_handler.cc
index 9d11d4342a8..fd8287531b8 100644
--- a/chromium/content/browser/devtools/protocol/browser_handler.cc
+++ b/chromium/content/browser/devtools/protocol/browser_handler.cc
@@ -201,6 +201,8 @@ Response PermissionDescriptorToPermissionType(
     }
   } else if (name == "nfc") {
     *permission_type = PermissionType::NFC;
+  } else if (name == "window-placement") {
+    *permission_type = PermissionType::WINDOW_PLACEMENT;
   } else {
     return Response::InvalidParams("Invalid PermissionDescriptor name: " +
                                    name);
@@ -329,9 +331,9 @@ Response BrowserHandler::FindBrowserContext(
 }
 
 Response BrowserHandler::SetPermission(
-    Maybe<std::string> origin,
     std::unique_ptr<protocol::Browser::PermissionDescriptor> permission,
     const protocol::Browser::PermissionSetting& setting,
+    Maybe<std::string> origin,
     Maybe<std::string> browser_context_id) {
   BrowserContext* browser_context = nullptr;
   Response response = FindBrowserContext(browser_context_id, &browser_context);
@@ -373,9 +375,9 @@ Response BrowserHandler::SetPermission(
 }
 
 Response BrowserHandler::GrantPermissions(
-    Maybe<std::string> origin,
     std::unique_ptr<protocol::Array<protocol::Browser::PermissionType>>
         permissions,
+    Maybe<std::string> origin,
     Maybe<std::string> browser_context_id) {
   BrowserContext* browser_context = nullptr;
   Response response = FindBrowserContext(browser_context_id, &browser_context);
diff --git a/chromium/content/browser/devtools/protocol/browser_handler.h b/chromium/content/browser/devtools/protocol/browser_handler.h
index 01d57a7110e..e46f11d9392 100644
--- a/chromium/content/browser/devtools/protocol/browser_handler.h
+++ b/chromium/content/browser/devtools/protocol/browser_handler.h
@@ -50,15 +50,15 @@ class BrowserHandler : public DevToolsDomainHandler, public Browser::Backend {
       std::unique_ptr<protocol::Array<std::string>>* arguments) override;
 
   Response SetPermission(
-      Maybe<std::string> origin,
       std::unique_ptr<protocol::Browser::PermissionDescriptor> permission,
       const protocol::Browser::PermissionSetting& setting,
+      Maybe<std::string> origin,
       Maybe<std::string> browser_context_id) override;
 
   Response GrantPermissions(
-      Maybe<std::string> origin,
       std::unique_ptr<protocol::Array<protocol::Browser::PermissionType>>
           permissions,
+      Maybe<std::string> origin,
       Maybe<std::string> browser_context_id) override;
 
   Response ResetPermissions(Maybe<std::string> browser_context_id) override;
diff --git a/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index 56fc227af97..c2ae1f64f0b 100644
--- a/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
@@ -24,13 +24,11 @@
 #include "content/browser/devtools/protocol/devtools_download_manager_delegate.h"
 #include "content/browser/devtools/protocol/devtools_protocol_test_support.h"
 #include "content/browser/download/download_manager_impl.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/download_manager.h"
-#include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/javascript_dialog_manager.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
@@ -43,6 +41,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/download_test_observer.h"
@@ -176,12 +175,6 @@ class SitePerProcessDevToolsProtocolTest : public DevToolsProtocolTest {
   }
 };
 
-class TestInterstitialDelegate : public InterstitialPageDelegate {
- private:
-  // InterstitialPageDelegate:
-  std::string GetHTMLContents() override { return "<p>Interstitial</p>"; }
-};
-
 class SyntheticKeyEventTest : public DevToolsProtocolTest {
  protected:
   void SendKeyEvent(const std::string& type,
@@ -263,7 +256,7 @@ IN_PROC_BROWSER_TEST_F(SyntheticKeyEventTest, DISABLED_KeyboardEventAck) {
   auto filter = std::make_unique<InputMsgWatcher>(
       RenderWidgetHostImpl::From(
           shell()->web_contents()->GetRenderViewHost()->GetWidget()),
-      blink::WebInputEvent::kRawKeyDown);
+      blink::WebInputEvent::Type::kRawKeyDown);
 
   SendCommand("Debugger.enable", nullptr);
   SendKeyEvent("rawKeyDown", 0, 13, 13, "Enter", false);
@@ -289,7 +282,7 @@ IN_PROC_BROWSER_TEST_F(SyntheticMouseEventTest, MouseEventAck) {
   auto filter = std::make_unique<InputMsgWatcher>(
       RenderWidgetHostImpl::From(
           shell()->web_contents()->GetRenderViewHost()->GetWidget()),
-      blink::WebInputEvent::kMouseDown);
+      blink::WebInputEvent::Type::kMouseDown);
 
   SendCommand("Debugger.enable", nullptr);
   SendMouseEvent("mousePressed", 15, 15, "left", false);
@@ -1734,23 +1727,6 @@ IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest, TargetDiscovery) {
   EXPECT_TRUE(notifications_.empty());
 }
 
-// Tests that an interstitialShown event is sent when an interstitial is showing
-// on attach.
-IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest, InterstitialShownOnAttach) {
-  TestInterstitialDelegate* delegate = new TestInterstitialDelegate;
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  GURL interstitial_url("https://example.test");
-  InterstitialPageImpl* interstitial = new InterstitialPageImpl(
-      web_contents, static_cast<RenderWidgetHostDelegate*>(web_contents), true,
-      interstitial_url, delegate);
-  interstitial->Show();
-  WaitForInterstitialAttach(web_contents);
-  Attach();
-  SendCommand("Page.enable", nullptr, false);
-  WaitForNotification("Page.interstitialShown", true);
-}
-
 IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest, SetAndGetCookies) {
   ASSERT_TRUE(embedded_test_server()->Start());
   GURL test_url = embedded_test_server()->GetURL("/title1.html");
@@ -2392,15 +2368,11 @@ IN_PROC_BROWSER_TEST_F(DevToolsDownloadContentTest, DefaultDownloadHeadless) {
   ASSERT_EQ(download::DownloadItem::CANCELLED, download->GetState());
 }
 
-// Flakly on ChromeOS https://crbug.com/860312
-#if defined(OS_CHROMEOS)
-#define MAYBE_MultiDownload DISABLED_MultiDownload
-#else
-#define MAYBE_MultiDownload MultiDownload
-#endif
+// Flaky on ChromeOS https://crbug.com/860312
+// Also flaky on Wndows and other platforms: http://crbug.com/1070302
 // Check that downloading multiple (in this case, 2) files does not result in
 // corrupted files.
-IN_PROC_BROWSER_TEST_F(DevToolsDownloadContentTest, MAYBE_MultiDownload) {
+IN_PROC_BROWSER_TEST_F(DevToolsDownloadContentTest, DISABLED_MultiDownload) {
   base::ThreadRestrictions::SetIOAllowed(true);
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
diff --git a/chromium/content/browser/devtools/protocol/emulation_handler.cc b/chromium/content/browser/devtools/protocol/emulation_handler.cc
index aa6f6f83309..470cfa7bd30 100644
--- a/chromium/content/browser/devtools/protocol/emulation_handler.cc
+++ b/chromium/content/browser/devtools/protocol/emulation_handler.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "content/browser/devtools/devtools_agent_host_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
@@ -54,14 +55,24 @@ ui::GestureProviderConfigType TouchEmulationConfigurationToType(
   return result;
 }
 
+bool ValidateClientHintString(const std::string& s) {
+  // Matches definition in structured headers:
+  // https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-17#section-3.3.3
+  for (char c : s) {
+    if (!base::IsAsciiPrintable(c))
+      return false;
+  }
+  return true;
+}
+
 }  // namespace
 
 EmulationHandler::EmulationHandler()
     : DevToolsDomainHandler(Emulation::Metainfo::domainName),
       touch_emulation_enabled_(false),
       device_emulation_enabled_(false),
-      host_(nullptr) {
-}
+      focus_emulation_enabled_(false),
+      host_(nullptr) {}
 
 EmulationHandler::~EmulationHandler() {
 }
@@ -98,6 +109,8 @@ Response EmulationHandler::Disable() {
     device_emulation_enabled_ = false;
     UpdateDeviceEmulationState();
   }
+  if (focus_emulation_enabled_)
+    SetFocusEmulationEnabled(false);
   return Response::Success();
 }
 
@@ -315,7 +328,8 @@ Response EmulationHandler::SetVisibleSize(int width, int height) {
 Response EmulationHandler::SetUserAgentOverride(
     const std::string& user_agent,
     Maybe<std::string> accept_language,
-    Maybe<std::string> platform) {
+    Maybe<std::string> platform,
+    Maybe<Emulation::UserAgentMetadata> ua_metadata_override) {
   if (!user_agent.empty() && !net::HttpUtil::IsValidHeaderValue(user_agent))
     return Response::InvalidParams("Invalid characters found in userAgent");
   std::string accept_lang = accept_language.fromMaybe(std::string());
@@ -326,6 +340,71 @@ Response EmulationHandler::SetUserAgentOverride(
 
   user_agent_ = user_agent;
   accept_language_ = accept_lang;
+
+  user_agent_metadata_ = base::nullopt;
+  if (!ua_metadata_override.isJust())
+    return Response::FallThrough();
+
+  if (user_agent.empty()) {
+    return Response::InvalidParams(
+        "Empty userAgent invalid with userAgentMetadata provided");
+  }
+
+  std::unique_ptr<Emulation::UserAgentMetadata> ua_metadata =
+      ua_metadata_override.takeJust();
+  blink::UserAgentMetadata new_ua_metadata;
+  DCHECK(ua_metadata->GetBrands());
+
+  for (const auto& bv : *ua_metadata->GetBrands()) {
+    blink::UserAgentBrandVersion out_bv;
+    if (!ValidateClientHintString(bv->GetBrand()))
+      return Response::InvalidParams("Invalid brand string");
+    out_bv.brand = bv->GetBrand();
+
+    if (!ValidateClientHintString(bv->GetVersion()))
+      return Response::InvalidParams("Invalid brand version string");
+    out_bv.major_version = bv->GetVersion();
+
+    new_ua_metadata.brand_version_list.push_back(std::move(out_bv));
+  }
+
+  if (!ValidateClientHintString(ua_metadata->GetFullVersion()))
+    return Response::InvalidParams("Invalid full version string");
+  new_ua_metadata.full_version = ua_metadata->GetFullVersion();
+
+  if (!ValidateClientHintString(ua_metadata->GetPlatform()))
+    return Response::InvalidParams("Invalid platform string");
+  new_ua_metadata.platform = ua_metadata->GetPlatform();
+
+  if (!ValidateClientHintString(ua_metadata->GetPlatformVersion()))
+    return Response::InvalidParams("Invalid platform version string");
+  new_ua_metadata.platform_version = ua_metadata->GetPlatformVersion();
+
+  if (!ValidateClientHintString(ua_metadata->GetArchitecture()))
+    return Response::InvalidParams("Invalid architecture string");
+  new_ua_metadata.architecture = ua_metadata->GetArchitecture();
+
+  if (!ValidateClientHintString(ua_metadata->GetModel()))
+    return Response::InvalidParams("Invalid model string");
+  new_ua_metadata.model = ua_metadata->GetModel();
+
+  new_ua_metadata.mobile = ua_metadata->GetMobile();
+
+  // All checks OK, can update user_agent_metadata_.
+  user_agent_metadata_.emplace(std::move(new_ua_metadata));
+  return Response::FallThrough();
+}
+
+Response EmulationHandler::SetFocusEmulationEnabled(bool enabled) {
+  if (enabled == focus_emulation_enabled_)
+    return Response::FallThrough();
+  focus_emulation_enabled_ = enabled;
+  if (enabled) {
+    GetWebContents()->IncrementCapturerCount(gfx::Size(),
+                                             /* stay_hidden */ false);
+  } else {
+    GetWebContents()->DecrementCapturerCount(/* stay_hidden */ false);
+  }
   return Response::FallThrough();
 }
 
@@ -408,5 +487,15 @@ void EmulationHandler::ApplyOverrides(net::HttpRequestHeaders* headers) {
   }
 }
 
+bool EmulationHandler::ApplyUserAgentMetadataOverrides(
+    base::Optional<blink::UserAgentMetadata>* override_out) {
+  // This is conditional on basic user agent override being on; this helps us
+  // emulate a device not sending any UA client hints.
+  if (user_agent_.empty())
+    return false;
+  *override_out = user_agent_metadata_;
+  return true;
+}
+
 }  // namespace protocol
 }  // namespace content
diff --git a/chromium/content/browser/devtools/protocol/emulation_handler.h b/chromium/content/browser/devtools/protocol/emulation_handler.h
index 5890b6797b6..0f1e96586ec 100644
--- a/chromium/content/browser/devtools/protocol/emulation_handler.h
+++ b/chromium/content/browser/devtools/protocol/emulation_handler.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "content/browser/devtools/protocol/devtools_domain_handler.h"
 #include "content/browser/devtools/protocol/emulation.h"
+#include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
 
 namespace net {
@@ -46,9 +47,11 @@ class EmulationHandler : public DevToolsDomainHandler,
       bool enabled,
       Maybe<std::string> configuration) override;
 
-  Response SetUserAgentOverride(const std::string& user_agent,
-                                Maybe<std::string> accept_language,
-                                Maybe<std::string> platform) override;
+  Response SetUserAgentOverride(
+      const std::string& user_agent,
+      Maybe<std::string> accept_language,
+      Maybe<std::string> platform,
+      Maybe<Emulation::UserAgentMetadata> ua_metadata_override) override;
 
   Response CanEmulate(bool* result) override;
   Response SetDeviceMetricsOverride(
@@ -68,12 +71,16 @@ class EmulationHandler : public DevToolsDomainHandler,
 
   Response SetVisibleSize(int width, int height) override;
 
+  Response SetFocusEmulationEnabled(bool) override;
+
   blink::WebDeviceEmulationParams GetDeviceEmulationParams();
   void SetDeviceEmulationParams(const blink::WebDeviceEmulationParams& params);
 
   bool device_emulation_enabled() { return device_emulation_enabled_; }
 
   void ApplyOverrides(net::HttpRequestHeaders* headers);
+  bool ApplyUserAgentMetadataOverrides(
+      base::Optional<blink::UserAgentMetadata>* override_out);
 
  private:
   WebContentsImpl* GetWebContents();
@@ -82,10 +89,15 @@ class EmulationHandler : public DevToolsDomainHandler,
 
   bool touch_emulation_enabled_;
   std::string touch_emulation_configuration_;
-
   bool device_emulation_enabled_;
+  bool focus_emulation_enabled_;
   blink::WebDeviceEmulationParams device_emulation_params_;
   std::string user_agent_;
+
+  // |user_agent_metadata_| is meaningful if |user_agent_| is non-empty.
+  // In that case nullopt will disable sending of client hints, and a
+  // non-nullopt value will be sent.
+  base::Optional<blink::UserAgentMetadata> user_agent_metadata_;
   std::string accept_language_;
 
   RenderFrameHostImpl* host_;
diff --git a/chromium/content/browser/devtools/protocol/fetch_handler.cc b/chromium/content/browser/devtools/protocol/fetch_handler.cc
index a5af86b99b4..433f22ac30f 100644
--- a/chromium/content/browser/devtools/protocol/fetch_handler.cc
+++ b/chromium/content/browser/devtools/protocol/fetch_handler.cc
@@ -315,6 +315,10 @@ void FetchHandler::ContinueWithAuth(
 void FetchHandler::GetResponseBody(
     const String& requestId,
     std::unique_ptr<GetResponseBodyCallback> callback) {
+  if (!interceptor_) {
+    callback->sendFailure(Response::ServerError("Fetch domain is not enabled"));
+    return;
+  }
   auto weapped_callback = std::make_unique<CallbackWrapper<
       GetResponseBodyCallback,
       DevToolsURLLoaderInterceptor::GetResponseBodyForInterceptionCallback,
@@ -325,6 +329,10 @@ void FetchHandler::GetResponseBody(
 void FetchHandler::TakeResponseBodyAsStream(
     const String& requestId,
     std::unique_ptr<TakeResponseBodyAsStreamCallback> callback) {
+  if (!interceptor_) {
+    callback->sendFailure(Response::ServerError("Fetch domain is not enabled"));
+    return;
+  }
   interceptor_->TakeResponseBodyPipe(
       requestId,
       base::BindOnce(&FetchHandler::OnResponseBodyPipeTaken,
diff --git a/chromium/content/browser/devtools/protocol/input_handler.cc b/chromium/content/browser/devtools/protocol/input_handler.cc
index 81ffb1b37e1..2bbaea8f2dd 100644
--- a/chromium/content/browser/devtools/protocol/input_handler.cc
+++ b/chromium/content/browser/devtools/protocol/input_handler.cc
@@ -160,26 +160,26 @@ bool GetMouseEventButton(const std::string& button,
 
 blink::WebInputEvent::Type GetMouseEventType(const std::string& type) {
   if (type == Input::DispatchMouseEvent::TypeEnum::MousePressed)
-    return blink::WebInputEvent::kMouseDown;
+    return blink::WebInputEvent::Type::kMouseDown;
   if (type == Input::DispatchMouseEvent::TypeEnum::MouseReleased)
-    return blink::WebInputEvent::kMouseUp;
+    return blink::WebInputEvent::Type::kMouseUp;
   if (type == Input::DispatchMouseEvent::TypeEnum::MouseMoved)
-    return blink::WebInputEvent::kMouseMove;
+    return blink::WebInputEvent::Type::kMouseMove;
   if (type == Input::DispatchMouseEvent::TypeEnum::MouseWheel)
-    return blink::WebInputEvent::kMouseWheel;
-  return blink::WebInputEvent::kUndefined;
+    return blink::WebInputEvent::Type::kMouseWheel;
+  return blink::WebInputEvent::Type::kUndefined;
 }
 
 blink::WebInputEvent::Type GetTouchEventType(const std::string& type) {
   if (type == Input::DispatchTouchEvent::TypeEnum::TouchStart)
-    return blink::WebInputEvent::kTouchStart;
+    return blink::WebInputEvent::Type::kTouchStart;
   if (type == Input::DispatchTouchEvent::TypeEnum::TouchEnd)
-    return blink::WebInputEvent::kTouchEnd;
+    return blink::WebInputEvent::Type::kTouchEnd;
   if (type == Input::DispatchTouchEvent::TypeEnum::TouchMove)
-    return blink::WebInputEvent::kTouchMove;
+    return blink::WebInputEvent::Type::kTouchMove;
   if (type == Input::DispatchTouchEvent::TypeEnum::TouchCancel)
-    return blink::WebInputEvent::kTouchCancel;
-  return blink::WebInputEvent::kUndefined;
+    return blink::WebInputEvent::Type::kTouchCancel;
+  return blink::WebInputEvent::Type::kUndefined;
 }
 
 blink::WebPointerProperties::PointerType GetPointerType(
@@ -218,23 +218,23 @@ bool GenerateTouchPoints(
       return false;
     event->touches[event->touches_length] = it.second;
     event->touches[event->touches_length].state =
-        type == blink::WebInputEvent::kTouchCancel
-            ? blink::WebTouchPoint::kStateCancelled
-            : blink::WebTouchPoint::kStateStationary;
+        type == blink::WebInputEvent::Type::kTouchCancel
+            ? blink::WebTouchPoint::State::kStateCancelled
+            : blink::WebTouchPoint::State::kStateStationary;
     event->touches_length++;
   }
-  if (type == blink::WebInputEvent::kTouchCancel ||
-      type == blink::WebInputEvent::kTouchEnd) {
-    event->touches[0].state = type == blink::WebInputEvent::kTouchCancel
-                                  ? blink::WebTouchPoint::kStateCancelled
-                                  : blink::WebTouchPoint::kStateReleased;
+  if (type == blink::WebInputEvent::Type::kTouchCancel ||
+      type == blink::WebInputEvent::Type::kTouchEnd) {
+    event->touches[0].state = type == blink::WebInputEvent::Type::kTouchCancel
+                                  ? blink::WebTouchPoint::State::kStateCancelled
+                                  : blink::WebTouchPoint::State::kStateReleased;
     event->SetType(type);
   } else if (points.find(changing.id) == points.end()) {
-    event->touches[0].state = blink::WebTouchPoint::kStatePressed;
-    event->SetType(blink::WebInputEvent::kTouchStart);
+    event->touches[0].state = blink::WebTouchPoint::State::kStatePressed;
+    event->SetType(blink::WebInputEvent::Type::kTouchStart);
   } else {
-    event->touches[0].state = blink::WebTouchPoint::kStateMoved;
-    event->SetType(blink::WebInputEvent::kTouchMove);
+    event->touches[0].state = blink::WebTouchPoint::State::kStateMoved;
+    event->SetType(blink::WebInputEvent::Type::kTouchMove);
   }
   return true;
 }
@@ -350,7 +350,8 @@ class InputHandler::InputInjector
     wheel_event->delta_x = 0;
     wheel_event->delta_y = 0;
     wheel_event->phase = blink::WebMouseWheelEvent::kPhaseEnded;
-    wheel_event->dispatch_type = blink::WebInputEvent::kEventNonBlocking;
+    wheel_event->dispatch_type =
+        blink::WebInputEvent::DispatchType::kEventNonBlocking;
     widget_host_->ForwardWheelEvent(*wheel_event);
   }
 
@@ -416,8 +417,8 @@ class InputHandler::InputInjector
     input_queued_ = true;
   }
 
-  void OnInputEventAck(InputEventAckSource source,
-                       InputEventAckState state,
+  void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                       blink::mojom::InputEventResultState state,
                        const blink::WebInputEvent& event) override {
     if ((event.GetModifiers() & blink::WebInputEvent::kFromDebugger) == 0)
       return;
@@ -431,7 +432,7 @@ class InputHandler::InputInjector
     }
 
     if ((blink::WebInputEvent::IsMouseEventType(event.GetType()) ||
-         event.GetType() == blink::WebInputEvent::kMouseWheel) &&
+         event.GetType() == blink::WebInputEvent::Type::kMouseWheel) &&
         !pending_mouse_callbacks_.empty()) {
       pending_mouse_callbacks_.front()->sendSuccess();
       pending_mouse_callbacks_.pop_front();
@@ -541,13 +542,13 @@ void InputHandler::DispatchKeyEvent(
   blink::WebInputEvent::Type web_event_type;
 
   if (type == Input::DispatchKeyEvent::TypeEnum::KeyDown) {
-    web_event_type = blink::WebInputEvent::kKeyDown;
+    web_event_type = blink::WebInputEvent::Type::kKeyDown;
   } else if (type == Input::DispatchKeyEvent::TypeEnum::KeyUp) {
-    web_event_type = blink::WebInputEvent::kKeyUp;
+    web_event_type = blink::WebInputEvent::Type::kKeyUp;
   } else if (type == Input::DispatchKeyEvent::TypeEnum::Char) {
-    web_event_type = blink::WebInputEvent::kChar;
+    web_event_type = blink::WebInputEvent::Type::kChar;
   } else if (type == Input::DispatchKeyEvent::TypeEnum::RawKeyDown) {
-    web_event_type = blink::WebInputEvent::kRawKeyDown;
+    web_event_type = blink::WebInputEvent::Type::kRawKeyDown;
   } else {
     callback->sendFailure(Response::InvalidParams(
         base::StringPrintf("Unexpected event type '%s'", type.c_str())));
@@ -651,7 +652,7 @@ void InputHandler::DispatchMouseEvent(
     Maybe<std::string> pointer_type,
     std::unique_ptr<DispatchMouseEventCallback> callback) {
   blink::WebInputEvent::Type type = GetMouseEventType(event_type);
-  if (type == blink::WebInputEvent::kUndefined) {
+  if (type == blink::WebInputEvent::Type::kUndefined) {
     callback->sendFailure(Response::InvalidParams(
         base::StringPrintf("Unexpected event type '%s'", event_type.c_str())));
     return;
@@ -675,7 +676,7 @@ void InputHandler::DispatchMouseEvent(
   std::unique_ptr<blink::WebMouseEvent> mouse_event;
   blink::WebMouseWheelEvent* wheel_event = nullptr;
 
-  if (type == blink::WebInputEvent::kMouseWheel) {
+  if (type == blink::WebInputEvent::Type::kMouseWheel) {
     wheel_event = new blink::WebMouseWheelEvent(type, modifiers, timestamp);
     mouse_event.reset(wheel_event);
     if (!delta_x.isJust() || !delta_y.isJust()) {
@@ -686,7 +687,7 @@ void InputHandler::DispatchMouseEvent(
     wheel_event->delta_x = static_cast<float>(-delta_x.fromJust());
     wheel_event->delta_y = static_cast<float>(-delta_y.fromJust());
     wheel_event->phase = blink::WebMouseWheelEvent::kPhaseBegan;
-    wheel_event->dispatch_type = blink::WebInputEvent::kBlocking;
+    wheel_event->dispatch_type = blink::WebInputEvent::DispatchType::kBlocking;
   } else {
     mouse_event.reset(new blink::WebMouseEvent(type, modifiers, timestamp));
   }
@@ -695,16 +696,38 @@ void InputHandler::DispatchMouseEvent(
   mouse_event->click_count = click_count.fromMaybe(0);
   mouse_event->pointer_type = GetPointerType(pointer_type.fromMaybe(""));
 
-  gfx::PointF point;
   RenderWidgetHostImpl* widget_host =
-      FindTargetWidgetHost(CssPixelsToPointF(x, y, page_scale_factor_), &point);
-  if (!widget_host) {
+      host_ ? host_->GetRenderWidgetHost() : nullptr;
+  if (!widget_host || !widget_host->delegate() ||
+      !widget_host->delegate()->GetInputEventRouter() ||
+      !widget_host->GetView()) {
+    callback->sendFailure(Response::InternalError());
+    return;
+  }
+  widget_host->delegate()
+      ->GetInputEventRouter()
+      ->GetRenderWidgetHostAtPointAsynchronously(
+          widget_host->GetView(), CssPixelsToPointF(x, y, page_scale_factor_),
+          base::BindOnce(&InputHandler::OnWidgetForDispatchMouseEvent,
+                         weak_factory_.GetWeakPtr(), std::move(callback),
+                         std::move(mouse_event), wheel_event));
+}
+
+void InputHandler::OnWidgetForDispatchMouseEvent(
+    std::unique_ptr<DispatchMouseEventCallback> callback,
+    std::unique_ptr<blink::WebMouseEvent> mouse_event,
+    blink::WebMouseWheelEvent* wheel_event,
+    base::WeakPtr<RenderWidgetHostViewBase> target,
+    base::Optional<gfx::PointF> point) {
+  if (!target || !point.has_value()) {
     callback->sendFailure(Response::InternalError());
     return;
   }
+  RenderWidgetHostImpl* widget_host =
+      RenderWidgetHostImpl::From(target->GetRenderWidgetHost());
 
-  mouse_event->SetPositionInWidget(point.x(), point.y());
-  mouse_event->SetPositionInScreen(point.x(), point.y());
+  mouse_event->SetPositionInWidget(point->x(), point->y());
+  mouse_event->SetPositionInScreen(point->x(), point->y());
   if (wheel_event) {
     EnsureInjector(widget_host)
         ->InjectWheelEvent(wheel_event, std::move(callback));
@@ -739,7 +762,7 @@ void InputHandler::DispatchWebTouchEvent(
     protocol::Maybe<double> maybe_timestamp,
     std::unique_ptr<DispatchTouchEventCallback> callback) {
   blink::WebInputEvent::Type type = GetTouchEventType(event_type);
-  if (type == blink::WebInputEvent::kUndefined) {
+  if (type == blink::WebInputEvent::Type::kUndefined) {
     callback->sendFailure(Response::InvalidParams(
         base::StringPrintf("Unexpected event type '%s'", event_type.c_str())));
     return;
@@ -750,19 +773,21 @@ void InputHandler::DispatchWebTouchEvent(
       false, 0, 0);
   base::TimeTicks timestamp = GetEventTimeTicks(maybe_timestamp);
 
-  if ((type == blink::WebInputEvent::kTouchStart ||
-       type == blink::WebInputEvent::kTouchMove) &&
+  if ((type == blink::WebInputEvent::Type::kTouchStart ||
+       type == blink::WebInputEvent::Type::kTouchMove) &&
       touch_points->empty()) {
     callback->sendFailure(Response::InvalidParams(
         "TouchStart and TouchMove must have at least one touch point."));
     return;
   }
-  if (type == blink::WebInputEvent::kTouchCancel && !touch_points->empty()) {
+  if (type == blink::WebInputEvent::Type::kTouchCancel &&
+      !touch_points->empty()) {
     callback->sendFailure(
         Response::InvalidParams("TouchCancel must not have any touch points."));
     return;
   }
-  if (type != blink::WebInputEvent::kTouchStart && touch_points_.empty()) {
+  if (type != blink::WebInputEvent::Type::kTouchStart &&
+      touch_points_.empty()) {
     callback->sendFailure(Response::InvalidParams(
         "Must send a TouchStart first to start a new touch."));
     return;
@@ -796,7 +821,7 @@ void InputHandler::DispatchWebTouchEvent(
   bool ok = true;
   for (auto& id_point : points) {
     if (touch_points_.find(id_point.first) != touch_points_.end() &&
-        type == blink::WebInputEvent::kTouchMove &&
+        type == blink::WebInputEvent::Type::kTouchMove &&
         touch_points_[id_point.first].PositionInWidget() ==
             id_point.second.PositionInWidget()) {
       continue;
@@ -805,21 +830,21 @@ void InputHandler::DispatchWebTouchEvent(
     events.emplace_back(type, modifiers, timestamp);
     ok &= GenerateTouchPoints(&events.back(), type, touch_points_,
                               id_point.second);
-    if (type == blink::WebInputEvent::kTouchStart ||
-        type == blink::WebInputEvent::kTouchMove) {
+    if (type == blink::WebInputEvent::Type::kTouchStart ||
+        type == blink::WebInputEvent::Type::kTouchMove) {
       touch_points_[id_point.first] = id_point.second;
-    } else if (type == blink::WebInputEvent::kTouchEnd) {
+    } else if (type == blink::WebInputEvent::Type::kTouchEnd) {
       touch_points_.erase(id_point.first);
     }
   }
 
   if (touch_points->size() == 0 && touch_points_.size() > 0) {
-    if (type == blink::WebInputEvent::kTouchCancel) {
+    if (type == blink::WebInputEvent::Type::kTouchCancel) {
       events.emplace_back(type, modifiers, timestamp);
       ok &= GenerateTouchPoints(&events.back(), type, touch_points_,
                                 touch_points_.begin()->second);
       touch_points_.clear();
-    } else if (type == blink::WebInputEvent::kTouchEnd) {
+    } else if (type == blink::WebInputEvent::Type::kTouchEnd) {
       for (auto it = touch_points_.begin(); it != touch_points_.end();) {
         events.emplace_back(type, modifiers, timestamp);
         ok &= GenerateTouchPoints(&events.back(), type, touch_points_,
@@ -840,20 +865,44 @@ void InputHandler::DispatchWebTouchEvent(
     return;
   }
 
-  gfx::PointF original(events[0].touches[0].PositionInWidget());
-  gfx::PointF transformed;
   RenderWidgetHostImpl* widget_host =
-      FindTargetWidgetHost(original, &transformed);
-  if (!widget_host) {
+      host_ ? host_->GetRenderWidgetHost() : nullptr;
+  if (!widget_host || !widget_host->delegate() ||
+      !widget_host->delegate()->GetInputEventRouter() ||
+      !widget_host->GetView()) {
     callback->sendFailure(Response::InternalError());
     return;
   }
-  gfx::Vector2dF delta = transformed - original;
+
+  gfx::PointF original(events[0].touches[0].PositionInWidget());
+  widget_host->delegate()
+      ->GetInputEventRouter()
+      ->GetRenderWidgetHostAtPointAsynchronously(
+          widget_host->GetView(), original,
+          base::BindOnce(&InputHandler::OnWidgetForDispatchWebTouchEvent,
+                         weak_factory_.GetWeakPtr(), std::move(callback),
+                         std::move(events)));
+}
+
+void InputHandler::OnWidgetForDispatchWebTouchEvent(
+    std::unique_ptr<DispatchTouchEventCallback> callback,
+    std::vector<blink::WebTouchEvent> events,
+    base::WeakPtr<RenderWidgetHostViewBase> target,
+    base::Optional<gfx::PointF> transformed) {
+  if (!target || !transformed.has_value()) {
+    callback->sendFailure(Response::InternalError());
+    return;
+  }
+  RenderWidgetHostImpl* widget_host =
+      RenderWidgetHostImpl::From(target->GetRenderWidgetHost());
+
+  gfx::PointF original(events[0].touches[0].PositionInWidget());
+  gfx::Vector2dF delta = *transformed - original;
   for (size_t i = 0; i < events.size(); i++) {
     events[i].dispatch_type =
-        events[i].GetType() == blink::WebInputEvent::kTouchCancel
-            ? blink::WebInputEvent::kEventNonBlocking
-            : blink::WebInputEvent::kBlocking;
+        events[i].GetType() == blink::WebInputEvent::Type::kTouchCancel
+            ? blink::WebInputEvent::DispatchType::kEventNonBlocking
+            : blink::WebInputEvent::DispatchType::kBlocking;
     events[i].moved_beyond_slop_region = true;
     events[i].unique_touch_event_id = ui::GetNextTouchEventId();
     for (unsigned j = 0; j < events[i].touches_length; j++) {
@@ -1069,14 +1118,14 @@ Response InputHandler::EmulateTouchFromMouseEvent(const std::string& type,
                                                   Maybe<int> click_count) {
   blink::WebInputEvent::Type event_type;
   if (type == Input::EmulateTouchFromMouseEvent::TypeEnum::MouseWheel) {
-    event_type = blink::WebInputEvent::kMouseWheel;
+    event_type = blink::WebInputEvent::Type::kMouseWheel;
     if (!delta_x.isJust() || !delta_y.isJust()) {
       return Response::InvalidParams(
           "'deltaX' and 'deltaY' are expected for mouseWheel event");
     }
   } else {
     event_type = GetMouseEventType(type);
-    if (event_type == blink::WebInputEvent::kUndefined) {
+    if (event_type == blink::WebInputEvent::Type::kUndefined) {
       return Response::InvalidParams(
           base::StringPrintf("Unexpected event type '%s'", type.c_str()));
     }
@@ -1130,7 +1179,8 @@ Response InputHandler::EmulateTouchFromMouseEvent(const std::string& type,
     wheel_event->delta_x = 0;
     wheel_event->delta_y = 0;
     wheel_event->phase = blink::WebMouseWheelEvent::kPhaseEnded;
-    wheel_event->dispatch_type = blink::WebInputEvent::kEventNonBlocking;
+    wheel_event->dispatch_type =
+        blink::WebInputEvent::DispatchType::kEventNonBlocking;
     host_->GetRenderWidgetHost()->ForwardWheelEvent(*wheel_event);
   } else {
     host_->GetRenderWidgetHost()->ForwardMouseEvent(*mouse_event);
@@ -1380,28 +1430,6 @@ InputHandler::InputInjector* InputHandler::EnsureInjector(
   return injector;
 }
 
-RenderWidgetHostImpl* InputHandler::FindTargetWidgetHost(
-    const gfx::PointF& point,
-    gfx::PointF* transformed) {
-  *transformed = point;
-
-  RenderWidgetHostImpl* widget_host =
-      host_ ? host_->GetRenderWidgetHost() : nullptr;
-  if (!widget_host)
-    return nullptr;
-
-  if (!host_->GetParent() && widget_host->delegate() &&
-      widget_host->delegate()->GetInputEventRouter() &&
-      widget_host->GetView()) {
-    widget_host = widget_host->delegate()
-                      ->GetInputEventRouter()
-                      ->GetRenderWidgetHostAtPoint(widget_host->GetView(),
-                                                   point, transformed);
-  }
-
-  return widget_host;
-}
-
 RenderWidgetHostViewBase* InputHandler::GetRootView() {
   if (!host_)
     return nullptr;
diff --git a/chromium/content/browser/devtools/protocol/input_handler.h b/chromium/content/browser/devtools/protocol/input_handler.h
index f4cda9fa1a9..8abc50f6227 100644
--- a/chromium/content/browser/devtools/protocol/input_handler.h
+++ b/chromium/content/browser/devtools/protocol/input_handler.h
@@ -146,6 +146,19 @@ class InputHandler : public DevToolsDomainHandler, public Input::Backend {
       protocol::Maybe<double> timestamp,
       std::unique_ptr<DispatchTouchEventCallback> callback);
 
+  void OnWidgetForDispatchMouseEvent(
+      std::unique_ptr<DispatchMouseEventCallback> callback,
+      std::unique_ptr<blink::WebMouseEvent> mouse_event,
+      blink::WebMouseWheelEvent* wheel_event,
+      base::WeakPtr<RenderWidgetHostViewBase> target,
+      base::Optional<gfx::PointF> point);
+
+  void OnWidgetForDispatchWebTouchEvent(
+      std::unique_ptr<DispatchTouchEventCallback> callback,
+      std::vector<blink::WebTouchEvent> events,
+      base::WeakPtr<RenderWidgetHostViewBase> target,
+      base::Optional<gfx::PointF> point);
+
   SyntheticPointerActionParams PrepareSyntheticPointerActionParams(
       SyntheticPointerActionParams::PointerActionType pointer_action_type,
       int id,
@@ -177,8 +190,6 @@ class InputHandler : public DevToolsDomainHandler, public Input::Backend {
   void ClearInputState();
   bool PointIsWithinContents(gfx::PointF point) const;
   InputInjector* EnsureInjector(RenderWidgetHostImpl* widget_host);
-  RenderWidgetHostImpl* FindTargetWidgetHost(const gfx::PointF& point,
-                                             gfx::PointF* transformed);
 
   RenderWidgetHostViewBase* GetRootView();
 
diff --git a/chromium/content/browser/devtools/protocol/log_handler.cc b/chromium/content/browser/devtools/protocol/log_handler.cc
new file mode 100644
index 00000000000..4fca4ddf95d
--- /dev/null
+++ b/chromium/content/browser/devtools/protocol/log_handler.cc
@@ -0,0 +1,43 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/devtools/protocol/log_handler.h"
+
+#include "content/browser/devtools/devtools_agent_host_impl.h"
+
+namespace content {
+namespace protocol {
+
+LogHandler::LogHandler() : DevToolsDomainHandler(Log::Metainfo::domainName) {}
+LogHandler::~LogHandler() = default;
+
+// static
+std::vector<LogHandler*> LogHandler::ForAgentHost(DevToolsAgentHostImpl* host) {
+  return host->HandlersByName<LogHandler>(Log::Metainfo::domainName);
+}
+
+void LogHandler::Wire(UberDispatcher* dispatcher) {
+  frontend_ = std::make_unique<Log::Frontend>(dispatcher->channel());
+  Log::Dispatcher::wire(dispatcher, this);
+}
+
+DispatchResponse LogHandler::Disable() {
+  enabled_ = false;
+  return Response::FallThrough();
+}
+
+DispatchResponse LogHandler::Enable() {
+  enabled_ = true;
+  return Response::FallThrough();
+}
+
+void LogHandler::EntryAdded(std::unique_ptr<Log::LogEntry> entry) {
+  if (!enabled_) {
+    return;
+  }
+  frontend_->EntryAdded(std::move(entry));
+}
+
+}  // namespace protocol
+}  // namespace content
\ No newline at end of file
diff --git a/chromium/content/browser/devtools/protocol/log_handler.h b/chromium/content/browser/devtools/protocol/log_handler.h
new file mode 100644
index 00000000000..45b54550e1b
--- /dev/null
+++ b/chromium/content/browser/devtools/protocol/log_handler.h
@@ -0,0 +1,46 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_DEVTOOLS_PROTOCOL_LOG_HANDLER_H_
+#define CONTENT_BROWSER_DEVTOOLS_PROTOCOL_LOG_HANDLER_H_
+
+#include "base/macros.h"
+#include "content/browser/devtools/protocol/devtools_domain_handler.h"
+#include "content/browser/devtools/protocol/log.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "third_party/blink/public/mojom/leak_detector/leak_detector.mojom.h"
+
+namespace content {
+
+class DevToolsAgentHostImpl;
+
+namespace protocol {
+
+class LogHandler final : public DevToolsDomainHandler, public Log::Backend {
+ public:
+  LogHandler();
+  ~LogHandler() override;
+
+  static std::vector<LogHandler*> ForAgentHost(DevToolsAgentHostImpl* host);
+
+  // DevToolsDomainHandler implementation.
+  void Wire(UberDispatcher* dispatcher) override;
+
+  // Log::Backend implementation.
+  DispatchResponse Disable() override;
+  DispatchResponse Enable() override;
+
+  void EntryAdded(std::unique_ptr<Log::LogEntry> entry);
+
+ private:
+  std::unique_ptr<Log::Frontend> frontend_;
+  bool enabled_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(LogHandler);
+};
+
+}  // namespace protocol
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_DEVTOOLS_PROTOCOL_LOG_HANDLER_H_
diff --git a/chromium/content/browser/devtools/protocol/native_input_event_builder_mac.mm b/chromium/content/browser/devtools/protocol/native_input_event_builder_mac.mm
index 67aff7235d2..3e608a479c7 100644
--- a/chromium/content/browser/devtools/protocol/native_input_event_builder_mac.mm
+++ b/chromium/content/browser/devtools/protocol/native_input_event_builder_mac.mm
@@ -16,8 +16,8 @@ namespace protocol {
 gfx::NativeEvent NativeInputEventBuilder::CreateEvent(
     const NativeWebKeyboardEvent& event) {
   NSEventType type = NSKeyUp;
-  if (event.GetType() == blink::WebInputEvent::kRawKeyDown ||
-      event.GetType() == blink::WebInputEvent::kKeyDown)
+  if (event.GetType() == blink::WebInputEvent::Type::kRawKeyDown ||
+      event.GetType() == blink::WebInputEvent::Type::kKeyDown)
     type = NSKeyDown;
   const base::char16* textStartAddr = &event.text[0];
   const int textLength =
diff --git a/chromium/content/browser/devtools/protocol/network_handler.cc b/chromium/content/browser/devtools/protocol/network_handler.cc
index b881e126177..4b900c1f83a 100644
--- a/chromium/content/browser/devtools/protocol/network_handler.cc
+++ b/chromium/content/browser/devtools/protocol/network_handler.cc
@@ -54,6 +54,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/origin_util.h"
+#include "content/public/common/referrer.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_errors.h"
@@ -352,34 +353,13 @@ String resourcePriority(net::RequestPriority priority) {
   return Network::ResourcePriorityEnum::Medium;
 }
 
-String referrerPolicy(net::URLRequest::ReferrerPolicy referrer_policy) {
-  switch (referrer_policy) {
-    case net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE:
-      return Network::Request::ReferrerPolicyEnum::NoReferrerWhenDowngrade;
-    case net::URLRequest::
-        REDUCE_REFERRER_GRANULARITY_ON_TRANSITION_CROSS_ORIGIN:
-      return Network::Request::ReferrerPolicyEnum::StrictOriginWhenCrossOrigin;
-    case net::URLRequest::ORIGIN_ONLY_ON_TRANSITION_CROSS_ORIGIN:
-      return Network::Request::ReferrerPolicyEnum::OriginWhenCrossOrigin;
-    case net::URLRequest::NEVER_CLEAR_REFERRER:
-      return Network::Request::ReferrerPolicyEnum::Origin;
-    case net::URLRequest::ORIGIN:
-      return Network::Request::ReferrerPolicyEnum::Origin;
-    case net::URLRequest::NO_REFERRER:
-      return Network::Request::ReferrerPolicyEnum::NoReferrer;
-    default:
-      break;
-  }
-  NOTREACHED();
-  return Network::Request::ReferrerPolicyEnum::NoReferrerWhenDowngrade;
-}
-
 String referrerPolicy(network::mojom::ReferrerPolicy referrer_policy) {
   switch (referrer_policy) {
     case network::mojom::ReferrerPolicy::kAlways:
       return Network::Request::ReferrerPolicyEnum::UnsafeUrl;
     case network::mojom::ReferrerPolicy::kDefault:
-      return referrerPolicy(content::Referrer::GetDefaultReferrerPolicy());
+      return referrerPolicy(Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
+          content::Referrer::GetDefaultReferrerPolicy()));
     case network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade:
       return Network::Request::ReferrerPolicyEnum::NoReferrerWhenDowngrade;
     case network::mojom::ReferrerPolicy::kNever:
@@ -399,6 +379,11 @@ String referrerPolicy(network::mojom::ReferrerPolicy referrer_policy) {
   return Network::Request::ReferrerPolicyEnum::NoReferrerWhenDowngrade;
 }
 
+String referrerPolicy(net::URLRequest::ReferrerPolicy referrer_policy) {
+  return referrerPolicy(
+      Referrer::NetReferrerPolicyToBlinkReferrerPolicy(referrer_policy));
+}
+
 String securityState(const GURL& url, const net::CertStatus& cert_status) {
   if (!url.SchemeIsCryptographic()) {
     // Some origins are considered secure even though they're not cryptographic,
@@ -698,20 +683,22 @@ BuildProtocolBlockedSetCookies(const net::CookieAndLineStatusList& net_list) {
 }
 
 std::unique_ptr<Array<Network::BlockedCookieWithReason>>
-BuildProtocolBlockedCookies(const net::CookieStatusList& net_list) {
-  std::unique_ptr<Array<Network::BlockedCookieWithReason>> protocol_list =
+BuildProtocolAssociatedCookies(const net::CookieStatusList& net_list) {
+  auto protocol_list =
       std::make_unique<Array<Network::BlockedCookieWithReason>>();
 
   for (const net::CookieWithStatus& cookie : net_list) {
     std::unique_ptr<Array<Network::CookieBlockedReason>> blocked_reasons =
         GetProtocolBlockedCookieReason(cookie.status);
-    if (!blocked_reasons->size())
-      continue;
-
-    protocol_list->push_back(Network::BlockedCookieWithReason::Create()
-                                 .SetBlockedReasons(std::move(blocked_reasons))
-                                 .SetCookie(BuildCookie(cookie.cookie))
-                                 .Build());
+    // Note that the condition below is not always true,
+    // as there might be blocked reasons that we do not report.
+    if (blocked_reasons->size() || cookie.status.IsInclude()) {
+      protocol_list->push_back(
+          Network::BlockedCookieWithReason::Create()
+              .SetBlockedReasons(std::move(blocked_reasons))
+              .SetCookie(BuildCookie(cookie.cookie))
+              .Build());
+    }
   }
   return protocol_list;
 }
@@ -1185,7 +1172,8 @@ void NetworkHandler::SetCookie(const std::string& name,
       net::CookieOptions::SameSiteCookieContext::MakeInclusive());
   options.set_include_httponly();
   storage_partition_->GetCookieManagerForBrowserProcess()->SetCanonicalCookie(
-      *cookie, "https", options,
+      *cookie, net::cookie_util::SimulatedCookieSource(*cookie, "https"),
+      options,
       net::cookie_util::AdaptCookieInclusionStatusToBool(base::BindOnce(
           &SetCookieCallback::sendSuccess, std::move(callback))));
 }
@@ -1222,7 +1210,8 @@ void NetworkHandler::SetCookies(
       net::CookieOptions::SameSiteCookieContext::MakeInclusive());
   for (const auto& cookie : net_cookies) {
     cookie_manager->SetCanonicalCookie(
-        *cookie, "https", options,
+        *cookie, net::cookie_util::SimulatedCookieSource(*cookie, "https"),
+        options,
         base::BindOnce(
             [](base::RepeatingClosure callback,
                net::CanonicalCookie::CookieInclusionStatus) { callback.Run(); },
@@ -1545,23 +1534,22 @@ Maybe<String> GetBlockedReasonFor(
     const network::URLLoaderCompletionStatus& status) {
   if (status.blocked_by_response_reason) {
     switch (*status.blocked_by_response_reason) {
-      case network::BlockedByResponseReason::kCoepFrameResourceNeedsCoepHeader:
+      case network::mojom::BlockedByResponseReason::
+          kCoepFrameResourceNeedsCoepHeader:
         return {protocol::Network::BlockedReasonEnum::
                     CoepFrameResourceNeedsCoepHeader};
-      case network::BlockedByResponseReason::
+      case network::mojom::BlockedByResponseReason::
           kCoopSandboxedIFrameCannotNavigateToCoopPage:
         return {protocol::Network::BlockedReasonEnum::
                     CoopSandboxedIframeCannotNavigateToCoopPage};
-      case network::BlockedByResponseReason::
+      case network::mojom::BlockedByResponseReason::
           kCorpNotSameOriginAfterDefaultedToSameOriginByCoep:
         return {protocol::Network::BlockedReasonEnum::
                     CorpNotSameOriginAfterDefaultedToSameOriginByCoep};
-      case network::BlockedByResponseReason::kCorpNotSameOrigin:
+      case network::mojom::BlockedByResponseReason::kCorpNotSameOrigin:
         return {protocol::Network::BlockedReasonEnum::CorpNotSameOrigin};
-        break;
-      case network::BlockedByResponseReason::kCorpNotSameSite:
+      case network::mojom::BlockedByResponseReason::kCorpNotSameSite:
         return {protocol::Network::BlockedReasonEnum::CorpNotSameSite};
-        break;
     }
     NOTREACHED();
   }
@@ -2113,7 +2101,7 @@ void NetworkHandler::OnRequestWillBeSentExtraInfo(
     return;
 
   frontend_->RequestWillBeSentExtraInfo(
-      devtools_request_id, BuildProtocolBlockedCookies(request_cookie_list),
+      devtools_request_id, BuildProtocolAssociatedCookies(request_cookie_list),
       GetRawHeaders(request_headers));
 }
 
diff --git a/chromium/content/browser/devtools/protocol/page_handler.cc b/chromium/content/browser/devtools/protocol/page_handler.cc
index bbed36324d6..b1821434b97 100644
--- a/chromium/content/browser/devtools/protocol/page_handler.cc
+++ b/chromium/content/browser/devtools/protocol/page_handler.cc
@@ -49,6 +49,7 @@
 #include "content/public/common/referrer.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
+#include "net/base/filename_util.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/gfx/codec/jpeg_codec.h"
@@ -548,8 +549,21 @@ void PageHandler::DownloadWillBegin(FrameTreeNode* ftn,
                                     download::DownloadItem* item) {
   if (!enabled_)
     return;
+
+  // The filename the end user sees may differ. This is an attempt to eagerly
+  // determine the filename at the beginning of the download; see
+  // DownloadTargetDeterminer:DownloadTargetDeterminer::Result
+  // and DownloadTargetDeterminer::GenerateFileName in
+  // chrome/browser/download/download_target_determiner.cc
+  // for the more comprehensive logic.
+  const base::string16 likely_filename = net::GetSuggestedFilename(
+      item->GetURL(), item->GetContentDisposition(), std::string(),
+      item->GetSuggestedFilename(), item->GetMimeType(), "download");
+
   frontend_->DownloadWillBegin(ftn->devtools_frame_token().ToString(),
-                               item->GetGuid(), item->GetURL().spec());
+                               item->GetGuid(), item->GetURL().spec(),
+                               base::UTF16ToUTF8(likely_filename));
+
   item->AddObserver(this);
   pending_downloads_.insert(item);
 }
@@ -947,14 +961,14 @@ Response PageHandler::SetDownloadBehavior(const std::string& behavior,
 
 void PageHandler::GetAppManifest(
     std::unique_ptr<GetAppManifestCallback> callback) {
-  WebContentsImpl* web_contents = GetWebContents();
-  if (!web_contents || !web_contents->GetManifestManagerHost()) {
+  if (!host_) {
     callback->sendFailure(Response::ServerError("Cannot retrieve manifest"));
     return;
   }
-  web_contents->GetManifestManagerHost()->RequestManifestDebugInfo(
-      base::BindOnce(&PageHandler::GotManifest, weak_factory_.GetWeakPtr(),
-                     std::move(callback)));
+  ManifestManagerHost::GetOrCreateForCurrentDocument(host_->GetMainFrame())
+      ->RequestManifestDebugInfo(base::BindOnce(&PageHandler::GotManifest,
+                                                weak_factory_.GetWeakPtr(),
+                                                std::move(callback)));
 }
 
 WebContentsImpl* PageHandler::GetWebContents() {
diff --git a/chromium/content/browser/devtools/protocol/service_worker_handler.cc b/chromium/content/browser/devtools/protocol/service_worker_handler.cc
index b209ce33e2e..f370116a67b 100644
--- a/chromium/content/browser/devtools/protocol/service_worker_handler.cc
+++ b/chromium/content/browser/devtools/protocol/service_worker_handler.cc
@@ -32,7 +32,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "third_party/blink/public/mojom/push_messaging/push_messaging_status.mojom.h"
-#include "third_party/blink/public/mojom/service_worker/service_worker_container_type.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "url/gurl.h"
 
@@ -440,14 +439,9 @@ void ServiceWorkerHandler::OnWorkerVersionUpdated(
 
     for (const auto& client : version.clients) {
       if (client.second.type ==
-          blink::mojom::ServiceWorkerContainerType::kForWindow) {
-        // A navigation may not yet be associated with a RenderFrameHost. Use
-        // the |web_contents_getter| instead.
+          blink::mojom::ServiceWorkerClientType::kWindow) {
         WebContents* web_contents =
-            client.second.web_contents_getter
-                ? client.second.web_contents_getter.Run()
-                : WebContents::FromRenderFrameHost(RenderFrameHostImpl::FromID(
-                      client.second.process_id, client.second.route_id));
+            WebContents::FromFrameTreeNodeId(client.second.frame_tree_node_id);
         // There is a possibility that the frame is already deleted
         // because of the thread hopping.
         if (!web_contents)
diff --git a/chromium/content/browser/devtools/protocol/system_info_handler.cc b/chromium/content/browser/devtools/protocol/system_info_handler.cc
index c635c8528a4..98d0e9cf218 100644
--- a/chromium/content/browser/devtools/protocol/system_info_handler.cc
+++ b/chromium/content/browser/devtools/protocol/system_info_handler.cc
@@ -46,11 +46,9 @@ std::unique_ptr<SystemInfo::Size> GfxSizeToSystemInfoSize(
       .Build();
 }
 // Give the GPU process a few seconds to provide GPU info.
-// Linux Debug builds need more time -- see Issue 796437.
+// Linux Debug builds need more time -- see Issue 796437 and 1046598.
 // Windows builds need more time -- see Issue 873112 and 1004472.
-#if (defined(OS_LINUX) && !defined(NDEBUG))
-const int kGPUInfoWatchdogTimeoutMs = 20000;
-#elif defined(OS_WIN)
+#if (defined(OS_LINUX) && !defined(NDEBUG)) || defined(OS_WIN)
 const int kGPUInfoWatchdogTimeoutMs = 30000;
 #else
 const int kGPUInfoWatchdogTimeoutMs = 5000;
@@ -322,16 +320,8 @@ class SystemInfoHandlerGpuObserver : public content::GpuDataManagerObserver {
 
   void ObserverWatchdogCallback() {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
-#if defined(OS_CHROMEOS)
-    // TODO(zmo): CHECK everywhere once https://crbug.com/796386 is fixed.
-    gpu::GpuFeatureInfo gpu_feature_info =
-        gpu::ComputeGpuFeatureInfoWithHardwareAccelerationDisabled();
-    GpuDataManagerImpl::GetInstance()->UpdateGpuFeatureInfo(gpu_feature_info,
-                                                            base::nullopt);
-    UnregisterAndSendResponse();
-#else
-    CHECK(false) << "Gathering system GPU info took more than 5 seconds.";
-#endif
+    CHECK(false) << "Gathering system GPU info took more than "
+                 << (kGPUInfoWatchdogTimeoutMs / 1000) << " seconds.";
   }
 
   void UnregisterAndSendResponse() {
diff --git a/chromium/content/browser/devtools/protocol/tracing_handler.cc b/chromium/content/browser/devtools/protocol/tracing_handler.cc
index ee5335bb600..058e5b1e9ff 100644
--- a/chromium/content/browser/devtools/protocol/tracing_handler.cc
+++ b/chromium/content/browser/devtools/protocol/tracing_handler.cc
@@ -194,9 +194,11 @@ void FillFrameData(base::trace_event::TracedValue* data,
   data->SetString("frame", node->devtools_frame_token().ToString());
   data->SetString("url", url.ReplaceComponents(strip_fragment).spec());
   data->SetString("name", node->frame_name());
-  if (node->parent())
-    data->SetString("parent",
-                    node->parent()->devtools_frame_token().ToString());
+  if (node->parent()) {
+    data->SetString(
+        "parent",
+        node->parent()->frame_tree_node()->devtools_frame_token().ToString());
+  }
   if (frame_host) {
     RenderProcessHost* process_host = frame_host->GetProcess();
     const base::Process& process_handle = process_host->GetProcess();
diff --git a/chromium/content/browser/devtools/protocol/webauthn_handler.cc b/chromium/content/browser/devtools/protocol/webauthn_handler.cc
index e8f45ca2d31..0a543df15d4 100644
--- a/chromium/content/browser/devtools/protocol/webauthn_handler.cc
+++ b/chromium/content/browser/devtools/protocol/webauthn_handler.cc
@@ -66,13 +66,11 @@ std::unique_ptr<WebAuthn::Credential> BuildCredentialFromRegistration(
     const std::pair<const std::vector<uint8_t>,
                     device::VirtualFidoDevice::RegistrationData>&
         registration) {
-  std::vector<uint8_t> private_key;
-  registration.second.private_key->ExportPrivateKey(&private_key);
-
   auto credential =
       WebAuthn::Credential::Create()
           .SetCredentialId(Binary::fromVector(registration.first))
-          .SetPrivateKey(Binary::fromVector(std::move(private_key)))
+          .SetPrivateKey(Binary::fromVector(
+              registration.second.private_key->GetPKCS8PrivateKey()))
           .SetSignCount(registration.second.counter)
           .SetIsResidentCredential(registration.second.is_resident)
           .Build();
diff --git a/chromium/content/browser/devtools/protocol_config.json b/chromium/content/browser/devtools/protocol_config.json
index f9057edea3c..61abf10a52c 100644
--- a/chromium/content/browser/devtools/protocol_config.json
+++ b/chromium/content/browser/devtools/protocol_config.json
@@ -10,6 +10,10 @@
         "export_header": "content/common/content_export.h",
         "options": [
             {
+                "domain": "Audits",
+                "include": ["enable", "disable"]
+            },
+            {
                 "domain": "BackgroundService",
                 "async": ["startObserving"]
             },
@@ -24,7 +28,7 @@
             },
             {
                 "domain": "Emulation",
-                "include": ["setGeolocationOverride", "clearGeolocationOverride", "setEmitTouchEventsForMouse", "canEmulate", "setDeviceMetricsOverride", "clearDeviceMetricsOverride", "setVisibleSize", "setUserAgentOverride"]
+                "include": ["setGeolocationOverride", "clearGeolocationOverride", "setEmitTouchEventsForMouse", "canEmulate", "setDeviceMetricsOverride", "clearDeviceMetricsOverride", "setVisibleSize", "setUserAgentOverride", "setFocusEmulationEnabled"]
             },
             {
                 "domain": "Input",
@@ -39,6 +43,10 @@
                 "exclude": ["resolveBlob"]
             },
             {
+                "domain": "Log",
+                "include": ["LogEntry", "entryAdded", "enable", "disable"]
+            },
+            {
                 "domain": "Memory",
                 "include": ["getBrowserSamplingProfile", "setPressureNotificationsSuppressed", "simulatePressureNotification", "prepareForLeakDetection"],
                 "async": ["prepareForLeakDetection"]
diff --git a/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc b/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
index 61fd3685912..90ea37c62e7 100644
--- a/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
@@ -21,6 +21,7 @@
 #include "content/browser/devtools/devtools_manager.h"
 #include "content/browser/devtools/devtools_renderer_channel.h"
 #include "content/browser/devtools/devtools_session.h"
+#include "content/browser/devtools/protocol/audits_handler.h"
 #include "content/browser/devtools/protocol/background_service_handler.h"
 #include "content/browser/devtools/protocol/browser_handler.h"
 #include "content/browser/devtools/protocol/dom_handler.h"
@@ -29,6 +30,7 @@
 #include "content/browser/devtools/protocol/input_handler.h"
 #include "content/browser/devtools/protocol/inspector_handler.h"
 #include "content/browser/devtools/protocol/io_handler.h"
+#include "content/browser/devtools/protocol/log_handler.h"
 #include "content/browser/devtools/protocol/memory_handler.h"
 #include "content/browser/devtools/protocol/network_handler.h"
 #include "content/browser/devtools/protocol/overlay_handler.h"
@@ -91,12 +93,14 @@ bool ShouldCreateDevToolsForHost(RenderFrameHost* rfh) {
 }
 
 bool ShouldCreateDevToolsForNode(FrameTreeNode* ftn) {
-  return !ftn->parent() || ftn->current_frame_host()->IsCrossProcessSubframe();
+  return !ftn->parent() ||
+         (ftn->current_frame_host() &&
+          ftn->current_frame_host()->IsCrossProcessSubframe());
 }
 
 FrameTreeNode* GetFrameTreeNodeAncestor(FrameTreeNode* frame_tree_node) {
   while (frame_tree_node && !ShouldCreateDevToolsForNode(frame_tree_node))
-    frame_tree_node = frame_tree_node->parent();
+    frame_tree_node = FrameTreeNode::From(frame_tree_node->parent());
   DCHECK(frame_tree_node);
   return frame_tree_node;
 }
@@ -104,8 +108,8 @@ FrameTreeNode* GetFrameTreeNodeAncestor(FrameTreeNode* frame_tree_node) {
 }  // namespace
 
 // static
-scoped_refptr<DevToolsAgentHost>
-DevToolsAgentHost::GetOrCreateFor(WebContents* web_contents) {
+scoped_refptr<DevToolsAgentHost> DevToolsAgentHost::GetOrCreateFor(
+    WebContents* web_contents) {
   FrameTreeNode* node =
       static_cast<WebContentsImpl*>(web_contents)->GetFrameTree()->root();
   // TODO(dgozman): this check should not be necessary. See
@@ -288,6 +292,7 @@ bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
   auto emulation_handler = std::make_unique<protocol::EmulationHandler>();
   protocol::EmulationHandler* emulation_handler_ptr = emulation_handler.get();
 
+  session->AddHandler(std::make_unique<protocol::AuditsHandler>());
   session->AddHandler(std::make_unique<protocol::BackgroundServiceHandler>());
   auto browser_handler = std::make_unique<protocol::BrowserHandler>(
       session->GetClient()->MayWriteLocalFiles());
@@ -338,6 +343,7 @@ bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
     session->AddHandler(std::make_unique<protocol::TracingHandler>(
         frame_tree_node_, GetIOContext()));
   }
+  session->AddHandler(std::make_unique<protocol::LogHandler>());
 #if !defined(OS_ANDROID)
   session->AddHandler(std::make_unique<protocol::WebAuthnHandler>());
 #endif  // !defined(OS_ANDROID)
@@ -660,7 +666,7 @@ void RenderFrameDevToolsAgentHost::ConnectWebContents(WebContents* wc) {
 std::string RenderFrameDevToolsAgentHost::GetParentId() {
   if (IsChildFrame()) {
     FrameTreeNode* frame_tree_node =
-        GetFrameTreeNodeAncestor(frame_tree_node_->parent());
+        GetFrameTreeNodeAncestor(frame_tree_node_->parent()->frame_tree_node());
     return RenderFrameDevToolsAgentHost::GetOrCreateFor(frame_tree_node)
         ->GetId();
   }
diff --git a/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc b/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
index ff9c7f50a0f..40fc2892f7a 100644
--- a/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
+++ b/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/back_forward_cache_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_base.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
diff --git a/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc b/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
index 9b60a82e752..114548c3c0d 100644
--- a/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
+++ b/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/download_manager.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/display_cutout/display_cutout_browsertest.cc b/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
index 0aba238d479..234e7fc9f42 100644
--- a/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
+++ b/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -191,8 +192,7 @@ class DisplayCutoutBrowserTest : public ContentBrowserTest {
         base::StringPrintf("test_file_%d.html", s_test_file_number++));
     {
       base::ScopedAllowBlockingForTesting allow_temp_file_writing;
-      ASSERT_EQ(static_cast<int>(data.length()),
-                base::WriteFile(file_path, data.c_str(), data.length()));
+      ASSERT_TRUE(base::WriteFile(file_path, data));
     }
     GURL url = embedded_test_server()->GetURL(
         "/" + file_path.BaseName().AsUTF8Unsafe());
@@ -308,7 +308,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest, ViewportFit_Fullscreen) {
   // Get the source id for the page and close the |shell|. This will flush any
   // unrecorded UKM metrics.
   ukm::SourceId source_id =
-      web_contents_impl()->GetUkmSourceIdForLastCommittedSource();
+      web_contents_impl()->GetMainFrame()->GetPageUkmSourceId();
   shell()->Close();
 
   // Check UKM metrics are recorded. The first two entries are from loading the
@@ -363,7 +363,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest,
   // Get the source id for the page and close the |shell|. This will flush any
   // unrecorded UKM metrics.
   ukm::SourceId source_id =
-      web_contents_impl()->GetUkmSourceIdForLastCommittedSource();
+      web_contents_impl()->GetMainFrame()->GetPageUkmSourceId();
   shell()->Close();
 
   // Check UKM metrics are recorded.
@@ -386,7 +386,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest, ViewportFit_Noop_Navigate) {
   }
 
   ukm::SourceId source_id =
-      web_contents_impl()->GetUkmSourceIdForLastCommittedSource();
+      web_contents_impl()->GetMainFrame()->GetPageUkmSourceId();
   LoadTestPageWithData("");
 
   // Check UKM metrics are recorded.
@@ -406,7 +406,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest,
   }
 
   ukm::SourceId source_id =
-      web_contents_impl()->GetUkmSourceIdForLastCommittedSource();
+      web_contents_impl()->GetMainFrame()->GetPageUkmSourceId();
   shell()->Close();
 
   // Check UKM metrics are recorded.
diff --git a/chromium/content/browser/display_cutout/display_cutout_host_impl.cc b/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
index 7a266559bc4..f6ee4595ed3 100644
--- a/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
+++ b/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
@@ -71,9 +71,7 @@ void DisplayCutoutHostImpl::DidFinishNavigation(
   // If we finish a main frame navigation and the |WebDisplayMode| is
   // fullscreen then we should make the main frame the current
   // |RenderFrameHost|.
-  RenderWidgetHostImpl* rwh =
-      web_contents_impl_->GetRenderViewHost()->GetWidget();
-  blink::mojom::DisplayMode mode = web_contents_impl_->GetDisplayMode(rwh);
+  blink::mojom::DisplayMode mode = web_contents_impl_->GetDisplayMode();
   if (mode == blink::mojom::DisplayMode::kFullscreen)
     SetCurrentRenderFrameHost(web_contents_impl_->GetMainFrame());
 }
@@ -194,9 +192,12 @@ void DisplayCutoutHostImpl::MaybeQueueUKMEvent(RenderFrameHost* frame) {
 }
 
 void DisplayCutoutHostImpl::RecordPendingUKMEvents() {
+  // TODO(crbug.com/1061899): The code here should take an explicit reference
+  // to the corresponding frame instead of using the current main frame.
+
   for (const auto& event : pending_ukm_events_) {
     ukm::builders::Layout_DisplayCutout_StateChanged builder(
-        web_contents_impl_->GetUkmSourceIdForLastCommittedSource());
+        web_contents_impl_->GetMainFrame()->GetPageUkmSourceId());
     builder.SetIsMainFrame(event.is_main_frame);
     builder.SetViewportFit_Applied(static_cast<int>(event.applied_value));
     builder.SetViewportFit_Supplied(static_cast<int>(event.supplied_value));
diff --git a/chromium/content/browser/do_not_track_browsertest.cc b/chromium/content/browser/do_not_track_browsertest.cc
index 07e7cc074d0..974eaa5e0ac 100644
--- a/chromium/content/browser/do_not_track_browsertest.cc
+++ b/chromium/content/browser/do_not_track_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/dom_storage/dom_storage_browsertest.cc b/chromium/content/browser/dom_storage/dom_storage_browsertest.cc
index 9a9a4432b96..0ce47e6c420 100644
--- a/chromium/content/browser/dom_storage/dom_storage_browsertest.cc
+++ b/chromium/content/browser/dom_storage/dom_storage_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/storage_usage_info.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/dom_storage/session_storage_namespace_impl.cc b/chromium/content/browser/dom_storage/session_storage_namespace_impl.cc
index 61bd695d82e..bc18031e6be 100644
--- a/chromium/content/browser/dom_storage/session_storage_namespace_impl.cc
+++ b/chromium/content/browser/dom_storage/session_storage_namespace_impl.cc
@@ -8,7 +8,6 @@
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/task/post_task.h"
 #include "components/services/storage/public/mojom/session_storage_control.mojom.h"
diff --git a/chromium/content/browser/download/download_browsertest.cc b/chromium/content/browser/download/download_browsertest.cc
index 3ab793e866e..68ca9baebd1 100644
--- a/chromium/content/browser/download/download_browsertest.cc
+++ b/chromium/content/browser/download/download_browsertest.cc
@@ -49,6 +49,7 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/webplugininfo.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -119,9 +120,9 @@ const char kBlogspotSite2[] = "b.blogspot.com";
 
 const char k404Response[] = "HTTP/1.1 404 Not found\r\n\r\n";
 
-void ExpectRequestNetworkIsolationKey(
+void ExpectRequestIsolationInfo(
     const GURL& request_url,
-    const net::NetworkIsolationKey& expected_network_isolation_key,
+    const net::IsolationInfo& expected_isolation_info,
     base::OnceCallback<void()> function) {
   URLLoaderMonitor monitor({request_url});
 
@@ -131,12 +132,11 @@ void ExpectRequestNetworkIsolationKey(
   base::Optional<network::ResourceRequest> request =
       monitor.GetRequestInfo(request_url);
   ASSERT_TRUE(request->trusted_params.has_value());
-  EXPECT_EQ(expected_network_isolation_key,
-            request->trusted_params->network_isolation_key);
+  EXPECT_TRUE(expected_isolation_info.IsEqualForTesting(
+      request->trusted_params->isolation_info));
   // SiteForCookies should be consistent with the NIK.
-  EXPECT_TRUE(net::SiteForCookies::FromOrigin(
-                  *expected_network_isolation_key.GetTopFrameOrigin())
-                  .IsEquivalent(request->site_for_cookies));
+  EXPECT_TRUE(expected_isolation_info.site_for_cookies().IsEquivalent(
+      request->site_for_cookies));
 }
 
 // Implementation of TestContentBrowserClient that overrides
@@ -3582,10 +3582,11 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
       std::string("/download-attribute.html?target=") + download_url.spec());
   GURL final_url = origin_two.GetURL(kOriginTwo, "/download");
   url::Origin final_url_origin = url::Origin::Create(final_url);
-  // The NetworkIsolationKey after the cross-site redirect should be the same as
+  // The IsolationInfo after the cross-site redirect should be the same as
   // if there were a top-level navigation to the final URL.
-  net::NetworkIsolationKey expected_network_isolation_key =
-      net::NetworkIsolationKey(final_url_origin, final_url_origin);
+  net::IsolationInfo expected_isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RedirectMode::kUpdateTopFrame, final_url_origin,
+      final_url_origin, net::SiteForCookies::FromOrigin(final_url_origin));
 
   // <origin_one>/download-attribute.html initiates a download of
   // <origin_one>/ping, which redirects to <origin_two>/download.
@@ -3598,12 +3599,11 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
                                  "application/octet-stream", "Hello"));
   origin_two.StartAcceptingConnections();
 
-  ExpectRequestNetworkIsolationKey(final_url, expected_network_isolation_key,
-                                   base::BindLambdaForTesting([&]() {
-                                     NavigateToCommittedURLAndWaitForDownload(
-                                         shell(), referrer_url,
-                                         download::DownloadItem::COMPLETE);
-                                   }));
+  ExpectRequestIsolationInfo(
+      final_url, expected_isolation_info, base::BindLambdaForTesting([&]() {
+        NavigateToCommittedURLAndWaitForDownload(
+            shell(), referrer_url, download::DownloadItem::COMPLETE);
+      }));
 
   std::vector<download::DownloadItem*> downloads;
   DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
@@ -3808,14 +3808,14 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
 
   // Alt-click the link.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kAltKey,
+      blink::WebInputEvent::Type::kMouseDown, blink::WebInputEvent::kAltKey,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebMouseEvent::Button::kLeft;
   mouse_event.SetPositionInWidget(15, 15);
   mouse_event.click_count = 1;
   shell()->web_contents()->GetRenderViewHost()->GetWidget()->ForwardMouseEvent(
       mouse_event);
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   shell()->web_contents()->GetRenderViewHost()->GetWidget()->ForwardMouseEvent(
       mouse_event);
 
@@ -4053,14 +4053,15 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DuplicateContentDisposition) {
 // navigation path
 // (2) the request resuming an interrupted download.
 IN_PROC_BROWSER_TEST_F(DownloadContentTest,
-                       AnchorDownload_Resume_NetworkIsolationKeyPopulated) {
+                       AnchorDownload_Resume_IsolationInfoPopulated) {
   SetupEnsureNoPendingDownloads();
 
   GURL slow_download_url = embedded_test_server()->GetURL(
       kOriginTwo, SlowDownloadHttpResponse::kKnownSizeUrl);
   url::Origin download_origin = url::Origin::Create(slow_download_url);
-  net::NetworkIsolationKey expected_network_isolation_key =
-      net::NetworkIsolationKey(download_origin, download_origin);
+  net::IsolationInfo expected_isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RedirectMode::kUpdateTopFrame, download_origin,
+      download_origin, net::SiteForCookies::FromOrigin(download_origin));
 
   GURL frame_url = embedded_test_server()->GetURL(
       kOriginTwo,
@@ -4076,8 +4077,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
 
   // Click the <a download> link in the child frame.
   download::DownloadItem* download_item = nullptr;
-  ExpectRequestNetworkIsolationKey(
-      slow_download_url, expected_network_isolation_key,
+  ExpectRequestIsolationInfo(
+      slow_download_url, expected_isolation_info,
       base::BindLambdaForTesting([&]() {
         DownloadInProgressObserver observer(DownloadManagerForShell(shell()));
         EXPECT_TRUE(
@@ -4091,8 +4092,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
       download::DOWNLOAD_INTERRUPT_REASON_NETWORK_FAILED);
   EXPECT_EQ(download::DownloadItem::INTERRUPTED, download_item->GetState());
 
-  ExpectRequestNetworkIsolationKey(
-      slow_download_url, expected_network_isolation_key,
+  ExpectRequestIsolationInfo(
+      slow_download_url, expected_isolation_info,
       base::BindLambdaForTesting([&]() { download_item->Resume(true); }));
 
   EXPECT_EQ(download::DownloadItem::IN_PROGRESS, download_item->GetState());
@@ -4125,10 +4126,11 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
 
   GURL download_url = origin_two.GetURL("/download-test.lib");
   url::Origin download_origin = url::Origin::Create(download_url);
-  // The NetworkIsolationKey of the download should be the same as that of a
-  // top-level navigation to the download.
-  net::NetworkIsolationKey expected_network_isolation_key =
-      net::NetworkIsolationKey(download_origin, download_origin);
+  // The IsolationInfo of the download should be the same as that of a top-level
+  // navigation to the download.
+  net::IsolationInfo expected_isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RedirectMode::kUpdateFrameOnly, download_origin,
+      download_origin, net::SiteForCookies::FromOrigin(download_origin));
 
   GURL frame_url = origin_one.GetURL("/download-attribute.html?target=" +
                                      download_url.spec());
@@ -4138,11 +4140,10 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
   GURL document_url =
       origin_two.GetURL("/iframe-host.html?target=" + frame_url.spec());
   download::DownloadItem* download = nullptr;
-  ExpectRequestNetworkIsolationKey(download_url, expected_network_isolation_key,
-                                   base::BindLambdaForTesting([&]() {
-                                     download = StartDownloadAndReturnItem(
-                                         shell(), document_url);
-                                   }));
+  ExpectRequestIsolationInfo(
+      download_url, expected_isolation_info, base::BindLambdaForTesting([&]() {
+        download = StartDownloadAndReturnItem(shell(), document_url);
+      }));
 
   WaitForCompletion(download);
 
diff --git a/chromium/content/browser/download/download_manager_impl.cc b/chromium/content/browser/download/download_manager_impl.cc
index bedee688dcd..1b5c8387016 100644
--- a/chromium/content/browser/download/download_manager_impl.cc
+++ b/chromium/content/browser/download/download_manager_impl.cc
@@ -385,8 +385,8 @@ void DownloadManagerImpl::GetNextId(GetNextIdCallback callback) {
   if (!is_history_download_id_retrieved_ && id_callbacks_.size() == 1u) {
     if (delegate_) {
       delegate_->GetNextId(
-          base::BindRepeating(&DownloadManagerImpl::OnHistoryNextIdRetrived,
-                              weak_factory_.GetWeakPtr()));
+          base::BindOnce(&DownloadManagerImpl::OnHistoryNextIdRetrived,
+                         weak_factory_.GetWeakPtr()));
     } else {
       OnHistoryNextIdRetrived(download::DownloadItem::kInvalidId);
     }
@@ -448,12 +448,22 @@ bool DownloadManagerImpl::ShouldCompleteDownload(
   return false;
 }
 
-bool DownloadManagerImpl::ShouldOpenFileBasedOnExtension(
+bool DownloadManagerImpl::ShouldAutomaticallyOpenFile(
+    const GURL& url,
+    const base::FilePath& path) {
+  if (!delegate_)
+    return false;
+
+  return delegate_->ShouldAutomaticallyOpenFile(url, path);
+}
+
+bool DownloadManagerImpl::ShouldAutomaticallyOpenFileByPolicy(
+    const GURL& url,
     const base::FilePath& path) {
   if (!delegate_)
     return false;
 
-  return delegate_->ShouldOpenFileBasedOnExtension(path);
+  return delegate_->ShouldAutomaticallyOpenFileByPolicy(url, path);
 }
 
 bool DownloadManagerImpl::ShouldOpenDownload(
@@ -539,7 +549,7 @@ bool DownloadManagerImpl::InterceptDownload(
     return true;
   }
 
-  std::string user_agent = "";
+  std::string user_agent;
   for (const auto& header : info.request_headers) {
     if (header.first == net::HttpRequestHeaders::kUserAgent) {
       user_agent = header.second;
diff --git a/chromium/content/browser/download/download_manager_impl.h b/chromium/content/browser/download/download_manager_impl.h
index 99a548c61f7..27c546126ad 100644
--- a/chromium/content/browser/download/download_manager_impl.h
+++ b/chromium/content/browser/download/download_manager_impl.h
@@ -231,7 +231,10 @@ class CONTENT_EXPORT DownloadManagerImpl
                                DownloadTargetCallback callback) override;
   bool ShouldCompleteDownload(download::DownloadItemImpl* item,
                               base::OnceClosure complete_callback) override;
-  bool ShouldOpenFileBasedOnExtension(const base::FilePath& path) override;
+  bool ShouldAutomaticallyOpenFile(const GURL& url,
+                                   const base::FilePath& path) override;
+  bool ShouldAutomaticallyOpenFileByPolicy(const GURL& url,
+                                           const base::FilePath& path) override;
   bool ShouldOpenDownload(download::DownloadItemImpl* item,
                           ShouldOpenDownloadCallback callback) override;
   void CheckForFileRemoval(download::DownloadItemImpl* download_item) override;
diff --git a/chromium/content/browser/download/drag_download_file_browsertest.cc b/chromium/content/browser/download/drag_download_file_browsertest.cc
index dc93fac88fc..e47b7bed551 100644
--- a/chromium/content/browser/download/drag_download_file_browsertest.cc
+++ b/chromium/content/browser/download/drag_download_file_browsertest.cc
@@ -18,6 +18,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/download_test_observer.h"
diff --git a/chromium/content/browser/download/mhtml_generation_browsertest.cc b/chromium/content/browser/download/mhtml_generation_browsertest.cc
index ebacf9ab77a..ae7665a6720 100644
--- a/chromium/content/browser/download/mhtml_generation_browsertest.cc
+++ b/chromium/content/browser/download/mhtml_generation_browsertest.cc
@@ -31,6 +31,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/mhtml_generation_params.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/download/save_file.cc b/chromium/content/browser/download/save_file.cc
index cbb514a48e9..72331e60fca 100644
--- a/chromium/content/browser/download/save_file.cc
+++ b/chromium/content/browser/download/save_file.cc
@@ -5,7 +5,8 @@
 #include "content/browser/download/save_file.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "components/download/public/common/download_item.h"
 #include "components/download/public/common/download_task_runner.h"
diff --git a/chromium/content/browser/download/save_item.cc b/chromium/content/browser/download/save_item.cc
index cb2a418fe03..9435dfeddd3 100644
--- a/chromium/content/browser/download/save_item.cc
+++ b/chromium/content/browser/download/save_item.cc
@@ -4,7 +4,8 @@
 
 #include "content/browser/download/save_item.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "content/browser/download/save_file.h"
 #include "content/browser/download/save_file_manager.h"
diff --git a/chromium/content/browser/download/save_package.cc b/chromium/content/browser/download/save_package.cc
index 35461d3407f..278d062ad56 100644
--- a/chromium/content/browser/download/save_package.cc
+++ b/chromium/content/browser/download/save_package.cc
@@ -260,8 +260,11 @@ void SavePackage::InternalInit() {
 
   download::RecordSavePackageEvent(download::SAVE_PACKAGE_STARTED);
 
+  // TODO(crbug.com/1061899): The code here should take an explicit reference
+  // to the corresponding frame instead of using the current main frame.
   ukm_source_id_ = static_cast<WebContentsImpl*>(web_contents())
-                       ->GetUkmSourceIdForLastCommittedSource();
+                       ->GetMainFrame()
+                       ->GetPageUkmSourceId();
   ukm_download_id_ = download::GetUniqueDownloadId();
   download::DownloadUkmHelper::RecordDownloadStarted(
       ukm_download_id_, ukm_source_id_, download::DownloadContent::TEXT,
@@ -1135,24 +1138,17 @@ void SavePackage::OnSavableResourceLinksResponse(
     EnqueueSavableResource(container_frame_tree_node_id, u, referrer);
   }
   for (const SavableSubframe& subframe : subframes) {
-    FrameTreeNode* subframe_tree_node =
-        sender->frame_tree_node()->frame_tree()->FindByRoutingID(
-            sender->GetProcess()->GetID(), subframe.routing_id);
+    RenderFrameHostImpl* rfh_subframe = sender->FindAndVerifyChild(
+        subframe.routing_id,
+        bad_message::DWNLD_INVALID_SAVABLE_RESOURCE_LINKS_RESPONSE);
 
-    if (!subframe_tree_node) {
+    if (!rfh_subframe) {
       // crbug.com/541354 - Raciness when saving a dynamically changing page.
       continue;
     }
-    if (subframe_tree_node->parent() != sender->frame_tree_node()) {
-      // Only reachable if the renderer has a bug or has been compromised.
-      ReceivedBadMessage(
-          sender->GetProcess(),
-          bad_message::DWNLD_INVALID_SAVABLE_RESOURCE_LINKS_RESPONSE);
-      continue;
-    }
 
     EnqueueFrame(container_frame_tree_node_id,
-                 subframe_tree_node->frame_tree_node_id(),
+                 rfh_subframe->frame_tree_node()->frame_tree_node_id(),
                  subframe.original_url);
   }
 
diff --git a/chromium/content/browser/download/save_package_browsertest.cc b/chromium/content/browser/download/save_package_browsertest.cc
index 08175b32fb0..ff92feee727 100644
--- a/chromium/content/browser/download/save_package_browsertest.cc
+++ b/chromium/content/browser/download/save_package_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/download_test_observer.h"
diff --git a/chromium/content/browser/eye_dropper_chooser_impl.cc b/chromium/content/browser/eye_dropper_chooser_impl.cc
index b521f8d232f..1fca17b5370 100644
--- a/chromium/content/browser/eye_dropper_chooser_impl.cc
+++ b/chromium/content/browser/eye_dropper_chooser_impl.cc
@@ -5,7 +5,10 @@
 #include "content/browser/eye_dropper_chooser_impl.h"
 
 #include "base/callback.h"
+#include "content/public/browser/eye_dropper.h"
+#include "content/public/browser/eye_dropper_listener.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_delegate.h"
 #include "third_party/blink/public/mojom/choosers/color_chooser.mojom.h"
 
 namespace content {
@@ -23,9 +26,37 @@ EyeDropperChooserImpl::EyeDropperChooserImpl(
     mojo::PendingReceiver<blink::mojom::EyeDropperChooser> receiver)
     : FrameServiceBase(render_frame_host, std::move(receiver)) {}
 
+EyeDropperChooserImpl::~EyeDropperChooserImpl() {
+  if (callback_)
+    std::move(callback_).Run(/*success=*/false, /*color=*/0);
+}
+
 void EyeDropperChooserImpl::Choose(ChooseCallback callback) {
-  // TODO(crbug.com/992297): add browser side support for eye dropper.
-  std::move(callback).Run(false, 0);
+  if (!render_frame_host() || callback_ || eye_dropper_) {
+    std::move(callback).Run(/*success=*/false, /*color=*/0);
+    return;
+  }
+
+  callback_ = std::move(callback);
+  WebContents* web_contents =
+      WebContents::FromRenderFrameHost(render_frame_host());
+  if (WebContentsDelegate* delegate = web_contents->GetDelegate())
+    eye_dropper_ = delegate->OpenEyeDropper(render_frame_host(), this);
+
+  if (!eye_dropper_) {
+    // Color selection wasn't successful since the eye dropper can't be opened.
+    ColorSelectionCanceled();
+  }
+}
+
+void EyeDropperChooserImpl::ColorSelected(SkColor color) {
+  eye_dropper_.reset();
+  std::move(callback_).Run(/*success=*/true, color);
+}
+
+void EyeDropperChooserImpl::ColorSelectionCanceled() {
+  eye_dropper_.reset();
+  std::move(callback_).Run(/*success=*/false, /*color=*/0);
 }
 
-}  // namespace content
\ No newline at end of file
+}  // namespace content
diff --git a/chromium/content/browser/eye_dropper_chooser_impl.h b/chromium/content/browser/eye_dropper_chooser_impl.h
index 79c0a0ebff0..cb3c873789d 100644
--- a/chromium/content/browser/eye_dropper_chooser_impl.h
+++ b/chromium/content/browser/eye_dropper_chooser_impl.h
@@ -5,28 +5,44 @@
 #ifndef CONTENT_BROWSER_EYE_DROPPER_CHOOSER_IMPL_H_
 #define CONTENT_BROWSER_EYE_DROPPER_CHOOSER_IMPL_H_
 
+#include <memory>
+
+#include "content/public/browser/eye_dropper_listener.h"
 #include "content/public/browser/frame_service_base.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/mojom/choosers/color_chooser.mojom.h"
 
 namespace content {
 
+class EyeDropper;
+class EyeDropperListener;
+
 class EyeDropperChooserImpl final
-    : public FrameServiceBase<blink::mojom::EyeDropperChooser> {
+    : public FrameServiceBase<blink::mojom::EyeDropperChooser>,
+      public EyeDropperListener {
  public:
   static void Create(RenderFrameHost*,
                      mojo::PendingReceiver<blink::mojom::EyeDropperChooser>);
 
-  // EyeDropperChooser implementation.
+  // EyeDropperChooser:
   void Choose(ChooseCallback) override;
 
+  // EyeDropperListener:
+  void ColorSelected(SkColor color) override;
+  void ColorSelectionCanceled() override;
+
  private:
   EyeDropperChooserImpl(RenderFrameHost*,
                         mojo::PendingReceiver<blink::mojom::EyeDropperChooser>);
 
+  ~EyeDropperChooserImpl() override;
+
+  ChooseCallback callback_;
+  std::unique_ptr<EyeDropper> eye_dropper_;
+
   DISALLOW_COPY_AND_ASSIGN(EyeDropperChooserImpl);
 };
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_EYE_DROPPER_CHOOSER_IMPL_H_
\ No newline at end of file
+#endif  // CONTENT_BROWSER_EYE_DROPPER_CHOOSER_IMPL_H_
diff --git a/chromium/content/browser/field_trial_synchronizer.cc b/chromium/content/browser/field_trial_synchronizer.cc
index 9d684cfd146..1df74e60baf 100644
--- a/chromium/content/browser/field_trial_synchronizer.cc
+++ b/chromium/content/browser/field_trial_synchronizer.cc
@@ -5,7 +5,7 @@
 #include "content/browser/field_trial_synchronizer.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread.h"
 #include "components/metrics/persistent_system_profile.h"
diff --git a/chromium/content/browser/file_system/file_system_browsertest.cc b/chromium/content/browser/file_system/file_system_browsertest.cc
index 7d20978d64e..5a7136db57a 100644
--- a/chromium/content/browser/file_system/file_system_browsertest.cc
+++ b/chromium/content/browser/file_system/file_system_browsertest.cc
@@ -19,6 +19,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -36,6 +37,10 @@ class FileSystemBrowserTest : public ContentBrowserTest,
  public:
   FileSystemBrowserTest() { is_incognito_ = GetParam(); }
 
+  void SetUpOnMainThread() override {
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
   void SimpleTest(const GURL& test_url) {
     // The test page will perform tests on FileAPI, then navigate to either
     // a #pass or #fail ref.
@@ -71,6 +76,7 @@ INSTANTIATE_TEST_SUITE_P(All, FileSystemBrowserTest, ::testing::Bool());
 class FileSystemBrowserTestWithLowQuota : public FileSystemBrowserTest {
  public:
   void SetUpOnMainThread() override {
+    FileSystemBrowserTest::SetUpOnMainThread();
     SetLowQuota(BrowserContext::GetDefaultStoragePartition(
                     browser()->web_contents()->GetBrowserContext())
                     ->GetQuotaManager());
@@ -100,15 +106,15 @@ INSTANTIATE_TEST_SUITE_P(All,
                          ::testing::Bool());
 
 IN_PROC_BROWSER_TEST_P(FileSystemBrowserTest, RequestTest) {
-  SimpleTest(GetTestUrl("fileapi", "request_test.html"));
+  SimpleTest(embedded_test_server()->GetURL("/fileapi/request_test.html"));
 }
 
 IN_PROC_BROWSER_TEST_P(FileSystemBrowserTest, CreateTest) {
-  SimpleTest(GetTestUrl("fileapi", "create_test.html"));
+  SimpleTest(embedded_test_server()->GetURL("/fileapi/create_test.html"));
 }
 
 IN_PROC_BROWSER_TEST_P(FileSystemBrowserTestWithLowQuota, QuotaTest) {
-  SimpleTest(GetTestUrl("fileapi", "quota_test.html"));
+  SimpleTest(embedded_test_server()->GetURL("/fileapi/quota_test.html"));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/file_system/file_system_manager_impl.cc b/chromium/content/browser/file_system/file_system_manager_impl.cc
index 735ecca900e..5ae73b58c2d 100644
--- a/chromium/content/browser/file_system/file_system_manager_impl.cc
+++ b/chromium/content/browser/file_system/file_system_manager_impl.cc
@@ -7,10 +7,13 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
+#include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/macros.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
+#include "base/notreached.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
@@ -24,6 +27,7 @@
 #include "content/browser/file_system/browser_file_system_helper.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/common/content_features.h"
 #include "ipc/ipc_platform_file.h"
 #include "net/base/mime_util.h"
 #include "storage/browser/blob/blob_data_builder.h"
@@ -212,6 +216,24 @@ void FileSystemManagerImpl::Open(const url::Origin& origin,
                                  blink::mojom::FileSystemType file_system_type,
                                  OpenCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  if (!security_policy_->CanAccessDataForOrigin(process_id_, origin)) {
+    const std::string& scheme =
+        origin.GetTupleOrPrecursorTupleIfOpaque().scheme();
+    bool is_http_based_scheme =
+        (scheme == url::kHttpsScheme) || (scheme == url::kHttpsScheme);
+    UMA_HISTOGRAM_BOOLEAN(
+        "SiteIsolation.FileSystemApi.CanAccessDataForOriginFailure."
+        "IsHttpBasedScheme",
+        is_http_based_scheme);
+
+    if (base::FeatureList::IsEnabled(
+            features::kSiteIsolationEnforcementForFileSystemApi)) {
+      receivers_.ReportBadMessage("FSMI_OPEN_INVALID_ORIGIN");
+      return;
+    }
+  }
+
   if (file_system_type == blink::mojom::FileSystemType::kTemporary) {
     RecordAction(base::UserMetricsAction("OpenFileSystemTemporary"));
   } else if (file_system_type == blink::mojom::FileSystemType::kPersistent) {
@@ -269,8 +291,8 @@ void FileSystemManagerImpl::Move(const GURL& src_path,
 
   operation_runner()->Move(
       src_url, dest_url, storage::FileSystemOperation::OPTION_NONE,
-      base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                     base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::Copy(const GURL& src_path,
@@ -296,8 +318,8 @@ void FileSystemManagerImpl::Copy(const GURL& src_path,
       src_url, dest_url, storage::FileSystemOperation::OPTION_NONE,
       FileSystemOperation::ERROR_BEHAVIOR_ABORT,
       storage::FileSystemOperationRunner::CopyProgressCallback(),
-      base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                     base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::Remove(const GURL& path,
@@ -317,8 +339,8 @@ void FileSystemManagerImpl::Remove(const GURL& path,
 
   operation_runner()->Remove(
       url, recursive,
-      base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                     base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::ReadMetadata(const GURL& path,
@@ -341,8 +363,8 @@ void FileSystemManagerImpl::ReadMetadata(const GURL& path,
       FileSystemOperation::GET_METADATA_FIELD_IS_DIRECTORY |
           FileSystemOperation::GET_METADATA_FIELD_SIZE |
           FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED,
-      base::BindRepeating(&FileSystemManagerImpl::DidGetMetadata, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidGetMetadata, GetWeakPtr(),
+                     base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::Create(const GURL& path,
@@ -365,13 +387,13 @@ void FileSystemManagerImpl::Create(const GURL& path,
   if (is_directory) {
     operation_runner()->CreateDirectory(
         url, exclusive, recursive,
-        base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                            base::Passed(&callback)));
+        base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                       base::Passed(&callback)));
   } else {
     operation_runner()->CreateFile(
         url, exclusive,
-        base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                            base::Passed(&callback)));
+        base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                       base::Passed(&callback)));
   }
 }
 
@@ -392,12 +414,12 @@ void FileSystemManagerImpl::Exists(const GURL& path,
 
   if (is_directory) {
     operation_runner()->DirectoryExists(
-        url, base::BindRepeating(&FileSystemManagerImpl::DidFinish,
-                                 GetWeakPtr(), base::Passed(&callback)));
+        url, base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                            base::Passed(&callback)));
   } else {
     operation_runner()->FileExists(
-        url, base::BindRepeating(&FileSystemManagerImpl::DidFinish,
-                                 GetWeakPtr(), base::Passed(&callback)));
+        url, base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                            base::Passed(&callback)));
   }
 }
 
@@ -531,8 +553,8 @@ void FileSystemManagerImpl::Truncate(
 
   OperationID op_id = operation_runner()->Truncate(
       url, length,
-      base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                     base::Passed(&callback)));
   cancellable_operations_.Add(
       std::make_unique<FileSystemCancellableOperationImpl>(op_id, this),
       std::move(op_receiver));
@@ -555,8 +577,8 @@ void FileSystemManagerImpl::TruncateSync(const GURL& file_path,
 
   operation_runner()->Truncate(
       url, length,
-      base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
-                          base::Passed(&callback)));
+      base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                     base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::CreateSnapshotFile(
@@ -588,12 +610,12 @@ void FileSystemManagerImpl::CreateSnapshotFile(
         FileSystemOperation::GET_METADATA_FIELD_IS_DIRECTORY |
             FileSystemOperation::GET_METADATA_FIELD_SIZE |
             FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED,
-        base::BindRepeating(&FileSystemManagerImpl::DidGetMetadataForStreaming,
-                            GetWeakPtr(), base::Passed(&callback)));
+        base::BindOnce(&FileSystemManagerImpl::DidGetMetadataForStreaming,
+                       GetWeakPtr(), base::Passed(&callback)));
   } else {
     operation_runner()->CreateSnapshotFile(
-        url, base::BindRepeating(&FileSystemManagerImpl::DidCreateSnapshot,
-                                 GetWeakPtr(), base::Passed(&callback), url));
+        url, base::BindOnce(&FileSystemManagerImpl::DidCreateSnapshot,
+                            GetWeakPtr(), base::Passed(&callback), url));
   }
 }
 
@@ -612,8 +634,8 @@ void FileSystemManagerImpl::Cancel(
     FileSystemCancellableOperationImpl::CancelCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   operation_runner()->Cancel(
-      op_id, base::BindRepeating(&FileSystemManagerImpl::DidFinish,
-                                 GetWeakPtr(), base::Passed(&callback)));
+      op_id, base::BindOnce(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
+                            base::Passed(&callback)));
 }
 
 void FileSystemManagerImpl::DidReceiveSnapshotFile(int snapshot_id) {
diff --git a/chromium/content/browser/file_system/file_system_url_loader_factory.cc b/chromium/content/browser/file_system/file_system_url_loader_factory.cc
index b96900d816f..88cd845d06a 100644
--- a/chromium/content/browser/file_system/file_system_url_loader_factory.cc
+++ b/chromium/content/browser/file_system/file_system_url_loader_factory.cc
@@ -104,9 +104,11 @@ class FileSystemEntryURLLoader
       : params_(std::move(params)) {}
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {}
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}
@@ -314,8 +316,8 @@ class FileSystemDirectoryURLLoader : public FileSystemEntryURLLoader {
         entry_url,
         FileSystemOperation::GET_METADATA_FIELD_SIZE |
             FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED,
-        base::BindRepeating(&FileSystemDirectoryURLLoader::DidGetMetadata,
-                            base::AsWeakPtr(this), index));
+        base::BindOnce(&FileSystemDirectoryURLLoader::DidGetMetadata,
+                       base::AsWeakPtr(this), index));
   }
 
   void DidGetMetadata(size_t index,
diff --git a/chromium/content/browser/file_system/file_system_url_loader_factory_browsertest.cc b/chromium/content/browser/file_system/file_system_url_loader_factory_browsertest.cc
index a25a2e773da..774252be05e 100644
--- a/chromium/content/browser/file_system/file_system_url_loader_factory_browsertest.cc
+++ b/chromium/content/browser/file_system/file_system_url_loader_factory_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/browser/file_system/file_system_url_loader_factory.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_utils.h"
@@ -242,9 +243,7 @@ class FileSystemURLLoaderFactoryTest
   void SetUpFileAutoMountContext() {
     const base::FilePath mnt_point = SetUpAutoMountContext();
 
-    ASSERT_EQ(static_cast<int>(sizeof(kTestFileData)) - 1,
-              base::WriteFile(mnt_point.AppendASCII("foo"), kTestFileData,
-                              sizeof(kTestFileData) - 1));
+    ASSERT_TRUE(base::WriteFile(mnt_point.AppendASCII("foo"), kTestFileData));
   }
 
   FileSystemURL CreateURL(const base::FilePath& file_path) {
@@ -283,7 +282,7 @@ class FileSystemURLLoaderFactoryTest
     if (!dir.CreateUniqueTempDir())
       result = base::File::FILE_ERROR_FAILED;
     local_path = dir.GetPath().AppendASCII("tmp");
-    if (buf_size != base::WriteFile(local_path, buf, buf_size))
+    if (!base::WriteFile(local_path, base::StringPiece(buf, buf_size)))
       result = base::File::FILE_ERROR_FAILED;
     EXPECT_EQ(base::File::FILE_OK, result);
 
@@ -605,8 +604,7 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest,
   base::FilePath mnt_point = SetUpAutoMountContext();
   EXPECT_TRUE(base::CreateDirectory(mnt_point));
   EXPECT_TRUE(base::CreateDirectory(mnt_point.AppendASCII("foo")));
-  EXPECT_EQ(10,
-            base::WriteFile(mnt_point.AppendASCII("bar"), "1234567890", 10));
+  EXPECT_TRUE(base::WriteFile(mnt_point.AppendASCII("bar"), "1234567890"));
 
   auto client =
       TestLoad(GURL("filesystem:http://automount/external/mnt_name/"));
diff --git a/chromium/content/browser/file_system/fileapi_browsertest.cc b/chromium/content/browser/file_system/fileapi_browsertest.cc
index 25d5e5c791c..52de174d7af 100644
--- a/chromium/content/browser/file_system/fileapi_browsertest.cc
+++ b/chromium/content/browser/file_system/fileapi_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/path_service.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/find_request_manager.cc b/chromium/content/browser/find_request_manager.cc
index c7f728c0168..102d0d3040d 100644
--- a/chromium/content/browser/find_request_manager.cc
+++ b/chromium/content/browser/find_request_manager.cc
@@ -83,7 +83,7 @@ FrameTreeNode* GetParent(FrameTreeNode* node) {
   if (!node)
     return nullptr;
   if (node->parent())
-    return node->parent();
+    return node->parent()->frame_tree_node();
 
   auto* contents = WebContentsImpl::FromFrameTreeNode(node);
   if (!node->IsMainFrame() || !contents->GetOuterWebContents())
diff --git a/chromium/content/browser/find_request_manager_browsertest.cc b/chromium/content/browser/find_request_manager_browsertest.cc
index e6f273cb4cf..0fe3de7ff2e 100644
--- a/chromium/content/browser/find_request_manager_browsertest.cc
+++ b/chromium/content/browser/find_request_manager_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -23,6 +24,7 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/page/widget.mojom-test-utils.h"
 
 namespace content {
 
@@ -83,10 +85,7 @@ class FindRequestManagerTest : public ContentBrowserTest,
     GURL url(embedded_test_server()->GetURL(
         "b.com", child->current_url().path()));
 
-    TestNavigationObserver observer(shell()->web_contents());
-    NavigateFrameToURL(child, url);
-    EXPECT_EQ(url, observer.last_navigation_url());
-    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_TRUE(NavigateFrameToURL(child, url));
   }
 
   void Find(const std::string& search_text,
@@ -760,18 +759,17 @@ IN_PROC_BROWSER_TEST_F(FindRequestManagerTest, MAYBE(FindMatchRects)) {
 
 namespace {
 
-class ZoomToFindInPageRectMessageFilter : public content::BrowserMessageFilter {
+class ZoomToFindInPageRectMessageFilter
+    : public blink::mojom::FrameWidgetHostInterceptorForTesting {
  public:
-  ZoomToFindInPageRectMessageFilter()
-      : content::BrowserMessageFilter(WidgetMsgStart),
+  ZoomToFindInPageRectMessageFilter(RenderWidgetHostImpl* rwhi)
+      : impl_(rwhi->frame_widget_host_receiver_for_testing().SwapImplForTesting(
+            this)),
         widget_message_seen_(false) {}
+  ~ZoomToFindInPageRectMessageFilter() override {}
 
-  bool OnMessageReceived(const IPC::Message& message) override {
-    IPC_BEGIN_MESSAGE_MAP(ZoomToFindInPageRectMessageFilter, message)
-      IPC_MESSAGE_HANDLER(WidgetHostMsg_ZoomToFindInPageRectInMainFrame,
-                          OnWidgetHostMessage)
-    IPC_END_MESSAGE_MAP()
-    return false;
+  blink::mojom::FrameWidgetHost* GetForwardingInterface() override {
+    return impl_;
   }
 
   void Reset() {
@@ -791,15 +789,14 @@ class ZoomToFindInPageRectMessageFilter : public content::BrowserMessageFilter {
   gfx::Rect& widget_message_rect() { return widget_rect_seen_; }
 
  private:
-  ~ZoomToFindInPageRectMessageFilter() override {}
-
-  void OnWidgetHostMessage(const gfx::Rect& rect_to_zoom) {
+  void ZoomToFindInPageRectInMainFrame(const gfx::Rect& rect_to_zoom) override {
     widget_rect_seen_ = rect_to_zoom;
     widget_message_seen_ = true;
     if (!quit_closure_.is_null())
       std::move(quit_closure_).Run();
   }
 
+  blink::mojom::FrameWidgetHost* impl_;
   gfx::Rect widget_rect_seen_;
   bool widget_message_seen_;
   base::OnceClosure quit_closure_;
@@ -816,16 +813,14 @@ IN_PROC_BROWSER_TEST_P(FindRequestManagerTest, ActivateNearestFindMatch) {
   if (test_with_oopif)
     MakeChildFrameCrossProcess();
 
-  scoped_refptr<ZoomToFindInPageRectMessageFilter> message_filter_root =
-      new ZoomToFindInPageRectMessageFilter();
-  scoped_refptr<ZoomToFindInPageRectMessageFilter> message_filter_child =
-      new ZoomToFindInPageRectMessageFilter();
+  std::unique_ptr<ZoomToFindInPageRectMessageFilter> message_interceptor_child;
 
   if (test_with_oopif) {
     FrameTreeNode* root = contents()->GetFrameTree()->root();
     FrameTreeNode* child = root->child_at(0);
-    child->current_frame_host()->GetProcess()->AddFilter(
-        message_filter_child.get());
+    message_interceptor_child =
+        std::make_unique<ZoomToFindInPageRectMessageFilter>(
+            child->current_frame_host()->GetRenderWidgetHost());
   }
 
   auto default_options = blink::mojom::FindOptions::New();
@@ -855,10 +850,10 @@ IN_PROC_BROWSER_TEST_P(FindRequestManagerTest, ActivateNearestFindMatch) {
     bool is_match_in_oopif = order[i] > 1 && test_with_oopif;
     // Check widget message rect to make sure it matches.
     if (is_match_in_oopif) {
-      message_filter_child->WaitForWidgetHostMessage();
+      message_interceptor_child->WaitForWidgetHostMessage();
       EXPECT_EQ(find_request_manager->GetSelectionRectForTesting(),
-                message_filter_child->widget_message_rect());
-      message_filter_child->Reset();
+                message_interceptor_child->widget_message_rect());
+      message_interceptor_child->Reset();
     }
 
     EXPECT_EQ(order[i] + 1, delegate()->GetFindResults().active_match_ordinal);
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
index f9967d2502b..f23a0db2799 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/browser/devtools/protocol/devtools_protocol_test_support.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
index e590ca10b9a..1f26acc4ce3 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
@@ -5,10 +5,10 @@
 #include "content/browser/font_unique_name_lookup/font_unique_name_lookup.h"
 
 #include "base/android/build_info.h"
+#include "base/check.h"
 #include "base/files/file.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/path_service.h"
@@ -187,7 +187,7 @@ void IndexFile(FT_Library ft_library,
     if (!IsRelevantNameRecord(sfnt_name))
       continue;
 
-    std::string sfnt_name_string = "";
+    std::string sfnt_name_string;
     std::string codepage_name;
     // Codepage names from http://demo.icu-project.org/icu-bin/convexp
     if (sfnt_name.platform_id == TT_PLATFORM_MICROSOFT &&
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.h b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.h
index 0b081044cf9..13375718a60 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.h
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup.h
@@ -127,7 +127,7 @@ class CONTENT_EXPORT FontUniqueNameLookup {
   base::MappedReadOnlyRegion proto_storage_;
 
   base::FilePath cache_directory_;
-  std::string android_build_fingerprint_for_testing_ = "";
+  std::string android_build_fingerprint_for_testing_;
   std::vector<std::string> font_file_paths_for_testing_ =
       std::vector<std::string>();
 
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
index 3e592461b5d..ef6bf6981e0 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
@@ -4,9 +4,9 @@
 
 #include "content/browser/font_unique_name_lookup/font_unique_name_lookup_service.h"
 
+#include "base/check.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/no_destructor.h"
 #include "base/task/post_task.h"
diff --git a/chromium/content/browser/form_controls_browsertest.cc b/chromium/content/browser/form_controls_browsertest.cc
index 051421cab48..22821300f9f 100644
--- a/chromium/content/browser/form_controls_browsertest.cc
+++ b/chromium/content/browser/form_controls_browsertest.cc
@@ -11,6 +11,7 @@
 #include "cc/test/pixel_test_utils.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/frame_host/DEPS b/chromium/content/browser/frame_host/DEPS
index 5bbc64ecae6..59ac961d695 100644
--- a/chromium/content/browser/frame_host/DEPS
+++ b/chromium/content/browser/frame_host/DEPS
@@ -13,6 +13,10 @@ specific_include_rules = {
     "+content/public/browser/web_contents.h",
     "+content/public/browser/web_contents_delegate.h",
   ],
+  ".*file_chooser_impl\.cc": [
+    # TODO(1076947): There is a layer violation to fix in this file.
+    "+content/public/browser/web_contents.h",
+  ],
   ".*interstitial_page_impl\.cc": [
     # TODO(nasko): This should be removed once we remove
     # WebContentsObserver as the method of telling interstitial pages to
diff --git a/chromium/content/browser/frame_host/OWNERS b/chromium/content/browser/frame_host/OWNERS
index b5b20d5fc93..db989f8027d 100644
--- a/chromium/content/browser/frame_host/OWNERS
+++ b/chromium/content/browser/frame_host/OWNERS
@@ -1,6 +1,7 @@
 # COMPONENT: Internals>Sandbox>SiteIsolation
 # TEAM: site-isolation-dev@chromium.org
 
+acolwell@chromium.org
 arthursonzogni@chromium.org
 
 # For surface ID propagation and synchronization
diff --git a/chromium/content/browser/frame_host/ancestor_throttle.cc b/chromium/content/browser/frame_host/ancestor_throttle.cc
index 647d5f629e9..4542a24bbd3 100644
--- a/chromium/content/browser/frame_host/ancestor_throttle.cc
+++ b/chromium/content/browser/frame_host/ancestor_throttle.cc
@@ -22,7 +22,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "net/http/http_response_headers.h"
 #include "services/network/public/cpp/content_security_policy/csp_context.h"
-#include "services/network/public/cpp/features.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "url/origin.h"
 
@@ -107,13 +106,13 @@ class FrameAncestorCSPContext : public network::CSPContext {
  public:
   FrameAncestorCSPContext(
       RenderFrameHostImpl* navigated_frame,
-      std::vector<network::mojom::ContentSecurityPolicyPtr> policies)
+      const std::vector<network::mojom::ContentSecurityPolicyPtr>& policies)
       : navigated_frame_(navigated_frame) {
     // TODO(arthursonzogni): Refactor CSPContext to its original state, it
     // shouldn't own any ContentSecurityPolicies on its own. This should be
     // defined by the implementation instead. Copies could be avoided here.
     for (auto& policy : policies)
-      AddContentSecurityPolicy(std::move(policy));
+      AddContentSecurityPolicy(mojo::Clone(policy));
   }
 
  private:
@@ -226,11 +225,12 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
 
     case HeaderDisposition::SAMEORIGIN: {
       // Block the request when any ancestor is not same-origin.
-      FrameTreeNode* parent = request->frame_tree_node()->parent();
+      RenderFrameHostImpl* parent = request->GetParentFrame();
       url::Origin current_origin =
           url::Origin::Create(navigation_handle()->GetURL());
       while (parent) {
-        if (!parent->current_origin().IsSameOriginWith(current_origin)) {
+        if (!parent->GetLastCommittedOrigin().IsSameOriginWith(
+                current_origin)) {
           RecordXFrameOptionsUsage(XFrameOptionsHistogram::SAMEORIGIN_BLOCKED);
           if (logging == LoggingDisposition::LOG_TO_CONSOLE)
             ConsoleError(disposition);
@@ -239,7 +239,7 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
           // vendors to follow our lead with XFO: SAMEORIGIN processing.
           //
           // https://crbug.com/250309
-          if (parent->frame_tree()->root()->current_origin().IsSameOriginWith(
+          if (parent->GetMainFrame()->GetLastCommittedOrigin().IsSameOriginWith(
                   current_origin)) {
             RecordXFrameOptionsUsage(
                 XFrameOptionsHistogram::SAMEORIGIN_WITH_BAD_ANCESTOR_CHAIN);
@@ -247,7 +247,7 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
 
           return NavigationThrottle::BLOCK_RESPONSE;
         }
-        parent = parent->parent();
+        parent = parent->GetParent();
       }
       RecordXFrameOptionsUsage(XFrameOptionsHistogram::SAMEORIGIN);
       break;
@@ -264,42 +264,13 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
       break;
   }
 
-  // Evaluate whether the navigation should be allowed or blocked based on
-  // existing content-security-policy on the response.
-  if (is_response_check && request->GetResponseHeaders() &&
-      HeadersContainFrameAncestorsCSP(request->GetResponseHeaders(), true) &&
-      base::FeatureList::IsEnabled(
-          network::features::kOutOfBlinkFrameAncestors)) {
-    if (!request->response()->content_security_policy.empty()) {
-      return EvaluateContentSecurityPolicy(
-          mojo::Clone(request->response()->content_security_policy));
-    }
-
-    BrowserContext* browser_context = request->frame_tree_node()
-                                          ->navigator()
-                                          ->GetController()
-                                          ->GetBrowserContext();
-    StoragePartition* partition = BrowserContext::GetStoragePartition(
-        browser_context, request->GetRenderFrameHost()->GetSiteInstance());
-    partition->GetNetworkContext()->ParseContentSecurityPolicy(
-        request->GetURL(), request->response()->headers,
-        base::BindOnce(
-            [](AncestorThrottle* ancestor_throttle, NavigationRequest* request,
-               std::vector<network::mojom::ContentSecurityPolicyPtr>
-                   content_security_policy) {
-              auto result = ancestor_throttle->EvaluateContentSecurityPolicy(
-                  mojo::Clone(content_security_policy));
-              if (result == NavigationThrottle::PROCEED) {
-                ancestor_throttle->Resume();
-              } else {
-                ancestor_throttle->CancelDeferredNavigation(result);
-              }
-            },
-            this, request));
-    return NavigationThrottle::DEFER;
-  }
+  // X-Frame-Option is checked on both redirect and final responses. However,
+  // CSP:Frame-ancestor is checked only for the final response.
+  if (!is_response_check)
+    return NavigationThrottle::PROCEED;
 
-  return NavigationThrottle::PROCEED;
+  return EvaluateContentSecurityPolicy(
+      request->response()->parsed_headers->content_security_policy);
 }
 
 const char* AncestorThrottle::GetNameForLogging() {
@@ -360,7 +331,7 @@ void AncestorThrottle::ConsoleError(HeaderDisposition disposition) {
 
 NavigationThrottle::ThrottleAction
 AncestorThrottle::EvaluateContentSecurityPolicy(
-    std::vector<network::mojom::ContentSecurityPolicyPtr>
+    const std::vector<network::mojom::ContentSecurityPolicyPtr>&
         content_security_policy) {
   // TODO(lfg): If the initiating document is known and correspond to the
   // navigating frame's current document, consider using:
@@ -371,7 +342,7 @@ AncestorThrottle::EvaluateContentSecurityPolicy(
   // reported to the navigating frame.
   FrameAncestorCSPContext csp_context(
       NavigationRequest::From(navigation_handle())->GetRenderFrameHost(),
-      std::move(content_security_policy));
+      content_security_policy);
   csp_context.SetSelf(url::Origin::Create(navigation_handle()->GetURL()));
 
   // Check CSP frame-ancestors against every parent.
diff --git a/chromium/content/browser/frame_host/ancestor_throttle.h b/chromium/content/browser/frame_host/ancestor_throttle.h
index 242cca6fa08..2fdd685f822 100644
--- a/chromium/content/browser/frame_host/ancestor_throttle.h
+++ b/chromium/content/browser/frame_host/ancestor_throttle.h
@@ -58,7 +58,7 @@ class CONTENT_EXPORT AncestorThrottle : public NavigationThrottle {
   void ParseError(const std::string& value, HeaderDisposition disposition);
   void ConsoleError(HeaderDisposition disposition);
   NavigationThrottle::ThrottleAction EvaluateContentSecurityPolicy(
-      std::vector<network::mojom::ContentSecurityPolicyPtr>
+      const std::vector<network::mojom::ContentSecurityPolicyPtr>&
           content_security_policy);
 
   // Parses an 'X-Frame-Options' header. If the result is either CONFLICT
diff --git a/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc b/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc
index 75520c1bdab..1cfaabc82c7 100644
--- a/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc
+++ b/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc
@@ -6,6 +6,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/frame_host/back_forward_cache_impl.cc b/chromium/content/browser/frame_host/back_forward_cache_impl.cc
index fe120a6404b..1120a52463d 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_impl.cc
+++ b/chromium/content/browser/frame_host/back_forward_cache_impl.cc
@@ -95,6 +95,16 @@ bool IsGeolocationSupported() {
   return geolocation_supported.Get();
 }
 
+bool IgnoresOutstandingNetworkRequestForTesting() {
+  if (!DeviceHasEnoughMemoryForBackForwardCache())
+    return false;
+  static constexpr base::FeatureParam<bool>
+      outstanding_network_request_supported(
+          &features::kBackForwardCache,
+          "ignore_outstanding_network_request_for_testing", false);
+  return outstanding_network_request_supported.Get();
+}
+
 // Ignore all features that the page is using and all DisableForRenderFrameHost
 // calls and force all pages to be cached. Should be used only for local testing
 // and debugging -- things will break when this param is used.
@@ -115,11 +125,6 @@ uint64_t GetDisallowedFeatures(RenderFrameHostImpl* rfh) {
       FeatureToBit(WebSchedulerTrackedFeature::kContainsPlugins) |
       FeatureToBit(WebSchedulerTrackedFeature::kDedicatedWorkerOrWorklet) |
       FeatureToBit(
-          WebSchedulerTrackedFeature::kOutstandingNetworkRequestOthers) |
-      FeatureToBit(
-          WebSchedulerTrackedFeature::kOutstandingNetworkRequestFetch) |
-      FeatureToBit(WebSchedulerTrackedFeature::kOutstandingNetworkRequestXHR) |
-      FeatureToBit(
           WebSchedulerTrackedFeature::kOutstandingIndexedDBTransaction) |
       FeatureToBit(
           WebSchedulerTrackedFeature::kRequestedNotificationsPermission) |
@@ -143,7 +148,11 @@ uint64_t GetDisallowedFeatures(RenderFrameHostImpl* rfh) {
       FeatureToBit(WebSchedulerTrackedFeature::kWebHID) |
       FeatureToBit(WebSchedulerTrackedFeature::kWakeLock) |
       FeatureToBit(WebSchedulerTrackedFeature::kWebShare) |
-      FeatureToBit(WebSchedulerTrackedFeature::kWebFileSystem);
+      FeatureToBit(WebSchedulerTrackedFeature::kWebFileSystem) |
+      FeatureToBit(WebSchedulerTrackedFeature::kAppBanner) |
+      FeatureToBit(WebSchedulerTrackedFeature::kPrinting) |
+      FeatureToBit(WebSchedulerTrackedFeature::kWebDatabase) |
+      FeatureToBit(WebSchedulerTrackedFeature::kPictureInPicture);
 
   uint64_t result = kAlwaysDisallowedFeatures;
 
@@ -157,6 +166,15 @@ uint64_t GetDisallowedFeatures(RenderFrameHostImpl* rfh) {
         WebSchedulerTrackedFeature::kRequestedGeolocationPermission);
   }
 
+  if (!IgnoresOutstandingNetworkRequestForTesting()) {
+    result |=
+        FeatureToBit(
+            WebSchedulerTrackedFeature::kOutstandingNetworkRequestOthers) |
+        FeatureToBit(
+            WebSchedulerTrackedFeature::kOutstandingNetworkRequestFetch) |
+        FeatureToBit(WebSchedulerTrackedFeature::kOutstandingNetworkRequestXHR);
+  }
+
   // We do not cache documents which have cache-control: no-store header on
   // their main resource.
   if (!rfh->GetParent()) {
@@ -397,7 +415,7 @@ void BackForwardCacheImpl::StoreEntry(
   }
 #endif
 
-  entry->render_frame_host->EnterBackForwardCache();
+  entry->render_frame_host->DidEnterBackForwardCache();
   entries_.push_front(std::move(entry));
 
   size_t size_limit = cache_size_limit_for_testing_
@@ -442,7 +460,7 @@ std::unique_ptr<BackForwardCacheImpl::Entry> BackForwardCacheImpl::RestoreEntry(
   std::unique_ptr<Entry> entry = std::move(*matching_entry);
   entries_.erase(matching_entry);
   RequestRecordTimeToVisible(entry->render_frame_host.get(), navigation_start);
-  entry->render_frame_host->LeaveBackForwardCache();
+  entry->render_frame_host->WillLeaveBackForwardCache();
 
   RestoreBrowserControlsState(entry->render_frame_host.get());
 
@@ -503,7 +521,7 @@ bool BackForwardCache::EvictIfCached(GlobalFrameRoutingId id,
                                      base::StringPiece reason) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   auto* rfh = RenderFrameHostImpl::FromID(id);
-  if (rfh && rfh->is_in_back_forward_cache()) {
+  if (rfh && rfh->IsInBackForwardCache()) {
     BackForwardCacheCanStoreDocumentResult can_store;
     can_store.NoDueToDisableForRenderFrameHostCalled({reason.as_string()});
     rfh->EvictFromBackForwardCacheWithReasons(can_store);
@@ -521,6 +539,11 @@ void BackForwardCacheImpl::DisableForTesting(DisableForTestingReason reason) {
   DCHECK(entries_.empty());
 }
 
+const std::list<std::unique_ptr<BackForwardCacheImpl::Entry>>&
+BackForwardCacheImpl::GetEntries() {
+  return entries_;
+}
+
 BackForwardCacheImpl::Entry* BackForwardCacheImpl::GetEntry(
     int navigation_entry_id) {
   auto matching_entry = std::find_if(
diff --git a/chromium/content/browser/frame_host/back_forward_cache_impl.h b/chromium/content/browser/frame_host/back_forward_cache_impl.h
index c43e305453c..2628cbea7a3 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_impl.h
+++ b/chromium/content/browser/frame_host/back_forward_cache_impl.h
@@ -169,6 +169,8 @@ class CONTENT_EXPORT BackForwardCacheImpl : public BackForwardCache {
     cache_size_limit_for_testing_ = cache_size_limit_for_testing;
   }
 
+  const std::list<std::unique_ptr<Entry>>& GetEntries();
+
   void DisableForTesting(DisableForTestingReason reason) override;
 
  private:
diff --git a/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc b/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
index b421fb66957..5fd575ffb5d 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
+++ b/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -904,7 +905,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheEnabledMetricsBrowserTest,
   // 2) Navigate to url2.
   EXPECT_TRUE(NavigateToURL(shell(), url2));
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 
   // 3) Go back to url1 and check if the metrics are recorded. Make sure the
   // page is restored from cache.
diff --git a/chromium/content/browser/frame_host/blocked_scheme_navigation_browsertest.cc b/chromium/content/browser/frame_host/blocked_scheme_navigation_browsertest.cc
index e8e865e1b20..14b1b1f2687 100644
--- a/chromium/content/browser/frame_host/blocked_scheme_navigation_browsertest.cc
+++ b/chromium/content/browser/frame_host/blocked_scheme_navigation_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -77,55 +78,43 @@ const char kPDF[] =
 
 enum ExpectedNavigationStatus { NAVIGATION_BLOCKED, NAVIGATION_ALLOWED };
 
-// This class is similar to ConsoleObserverDelegate in that it listens and waits
-// for specific console messages. The difference from ConsoleObserverDelegate is
-// that this class immediately stops waiting if it sees a message matching
-// fail_pattern, instead of waiting for a message matching success_pattern.
-class BlockedURLWarningConsoleObserverDelegate : public WebContentsDelegate {
+// A wrapper around WebContentsConsoleObserver that watches for a success or
+// failure message. This will add a failure if an unexpected message is seen.
+class BlockedURLWarningConsoleObserver {
  public:
   enum Status {
     NO_MESSAGE,
     SAW_SUCCESS_MESSAGE,
     SAW_FAILURE_MESSAGE,
   };
-  BlockedURLWarningConsoleObserverDelegate(WebContents* web_contents,
-                                           const std::string& success_filter,
-                                           const std::string& fail_filter)
-      : web_contents_(web_contents),
+  BlockedURLWarningConsoleObserver(WebContents* web_contents,
+                                   const std::string& success_filter,
+                                   const std::string& fail_filter)
+      : console_observer_(web_contents),
         success_filter_(success_filter),
         fail_filter_(fail_filter),
         status_(NO_MESSAGE) {}
 
-  ~BlockedURLWarningConsoleObserverDelegate() override {}
-
-  // WebContentsDelegate method:
-  bool DidAddMessageToConsole(WebContents* source,
-                              blink::mojom::ConsoleMessageLevel log_level,
-                              const base::string16& message,
-                              int32_t line_no,
-                              const base::string16& source_id) override {
-    DCHECK(source == web_contents_);
-    const std::string ascii_message = base::UTF16ToASCII(message);
-    if (base::MatchPattern(ascii_message, fail_filter_)) {
+  ~BlockedURLWarningConsoleObserver() = default;
+
+  void Wait() {
+    console_observer_.Wait();
+    ASSERT_EQ(1u, console_observer_.messages().size());
+    std::string message = console_observer_.GetMessageAt(0u);
+    if (base::MatchPattern(message, fail_filter_))
       status_ = SAW_FAILURE_MESSAGE;
-      run_loop_.Quit();
-    }
-    if (base::MatchPattern(ascii_message, success_filter_)) {
+    else if (base::MatchPattern(message, success_filter_))
       status_ = SAW_SUCCESS_MESSAGE;
-      run_loop_.Quit();
-    }
-    return false;
+    else
+      ADD_FAILURE() << "Unexpected message: " << message;
   }
 
-  void Wait() { run_loop_.Run(); }
-
   Status status() const { return status_; }
 
  private:
-  WebContents* web_contents_;
+  WebContentsConsoleObserver console_observer_;
   const std::string success_filter_;
   const std::string fail_filter_;
-  base::RunLoop run_loop_;
   Status status_;
 };
 
@@ -373,20 +362,17 @@ class BlockedSchemeNavigationBrowserTest
             ? std::string()
             : base::StringPrintf(kNavigationBlockedMessage, scheme.c_str());
 
-    std::unique_ptr<ConsoleObserverDelegate> console_delegate;
+    base::Optional<WebContentsConsoleObserver> console_observer;
     if (!expected_message.empty()) {
-      console_delegate.reset(new ConsoleObserverDelegate(
-          shell()->web_contents(), expected_message));
-      shell()->web_contents()->SetDelegate(console_delegate.get());
+      console_observer.emplace(shell()->web_contents());
+      console_observer->SetPattern(expected_message);
     }
 
     TestNavigationObserver navigation_observer(shell()->web_contents());
     EXPECT_TRUE(ExecuteScript(rfh, javascript));
 
-    if (console_delegate) {
-      console_delegate->Wait();
-      shell()->web_contents()->SetDelegate(nullptr);
-    }
+    if (console_observer)
+      console_observer->Wait();
 
     switch (expected_navigation_status) {
       case NAVIGATION_ALLOWED:
@@ -523,16 +509,14 @@ class BlockedSchemeNavigationBrowserTest
     // Should see success message, should never see blocked message.
     const std::string blocked_message =
         base::StringPrintf(kNavigationBlockedMessage, scheme.c_str());
-    BlockedURLWarningConsoleObserverDelegate console_delegate(
+    BlockedURLWarningConsoleObserver console_observer(
         shell->web_contents(), kNavigationSuccessfulMessage, blocked_message);
-    shell->web_contents()->SetDelegate(&console_delegate);
 
     TestNavigationObserver navigation_observer(shell->web_contents());
     EXPECT_TRUE(ExecuteScript(rfh, javascript));
-    console_delegate.Wait();
-    EXPECT_EQ(BlockedURLWarningConsoleObserverDelegate::SAW_SUCCESS_MESSAGE,
-              console_delegate.status());
-    shell->web_contents()->SetDelegate(nullptr);
+    console_observer.Wait();
+    EXPECT_EQ(BlockedURLWarningConsoleObserver::SAW_SUCCESS_MESSAGE,
+              console_observer.status());
     navigation_observer.Wait();
 
     // The new page should have the expected scheme.
@@ -554,16 +538,14 @@ class BlockedSchemeNavigationBrowserTest
     // Should see blocked message, should never see success message.
     const std::string blocked_message =
         base::StringPrintf(kNavigationBlockedMessage, scheme.c_str());
-    BlockedURLWarningConsoleObserverDelegate console_delegate(
+    BlockedURLWarningConsoleObserver console_observer(
         shell->web_contents(), kNavigationSuccessfulMessage, blocked_message);
-    shell->web_contents()->SetDelegate(&console_delegate);
 
     TestNavigationObserver navigation_observer(shell->web_contents());
     EXPECT_TRUE(ExecuteScript(rfh, javascript));
-    console_delegate.Wait();
-    EXPECT_EQ(BlockedURLWarningConsoleObserverDelegate::SAW_FAILURE_MESSAGE,
-              console_delegate.status());
-    shell->web_contents()->SetDelegate(nullptr);
+    console_observer.Wait();
+    EXPECT_EQ(BlockedURLWarningConsoleObserver::SAW_FAILURE_MESSAGE,
+              console_observer.status());
 
     // Original page shouldn't navigate away.
     EXPECT_EQ(original_url, shell->web_contents()->GetLastCommittedURL());
@@ -598,14 +580,12 @@ IN_PROC_BROWSER_TEST_P(BlockedSchemeNavigationBrowserTest,
       "<html><script>console.log('NAVIGATION_SUCCESSFUL');</script></html>",
       "text/html"));
   if (IsDataURLTest()) {
-    BlockedURLWarningConsoleObserverDelegate console_delegate(
+    BlockedURLWarningConsoleObserver console_observer(
         shell()->web_contents(), kNavigationSuccessfulMessage,
         GetNavigationBlockedMessage());
 
-    shell()->web_contents()->SetDelegate(&console_delegate);
     EXPECT_TRUE(NavigateToURL(shell(), kUrl));
-    console_delegate.Wait();
-    shell()->web_contents()->SetDelegate(nullptr);
+    console_observer.Wait();
     EXPECT_TRUE(
         shell()->web_contents()->GetLastCommittedURL().SchemeIs(GetParam()));
 
@@ -621,14 +601,12 @@ IN_PROC_BROWSER_TEST_P(BlockedSchemeNavigationBrowserTest,
     Shell* new_shell = new_shell_observer.GetShell();
     WaitForLoadStop(new_shell->web_contents());
 
-    BlockedURLWarningConsoleObserverDelegate console_delegate(
+    BlockedURLWarningConsoleObserver console_observer(
         new_shell->web_contents(), kNavigationSuccessfulMessage,
         GetNavigationBlockedMessage());
-    new_shell->web_contents()->SetDelegate(&console_delegate);
     EXPECT_TRUE(NavigateToURL(new_shell, kUrl));
 
-    console_delegate.Wait();
-    new_shell->web_contents()->SetDelegate(nullptr);
+    console_observer.Wait();
     EXPECT_TRUE(
         new_shell->web_contents()->GetLastCommittedURL().SchemeIs(GetParam()));
   }
diff --git a/chromium/content/browser/frame_host/clipboard_host_impl.cc b/chromium/content/browser/frame_host/clipboard_host_impl.cc
index 7c0e17b89ee..b95bcd1c882 100644
--- a/chromium/content/browser/frame_host/clipboard_host_impl.cc
+++ b/chromium/content/browser/frame_host/clipboard_host_impl.cc
@@ -121,9 +121,8 @@ void ClipboardHostImpl::ReadAvailableTypes(
     ui::ClipboardBuffer clipboard_buffer,
     ReadAvailableTypesCallback callback) {
   std::vector<base::string16> types;
-  bool contains_filenames;
-  clipboard_->ReadAvailableTypes(clipboard_buffer, &types, &contains_filenames);
-  std::move(callback).Run(types, contains_filenames);
+  clipboard_->ReadAvailableTypes(clipboard_buffer, &types);
+  std::move(callback).Run(types);
 }
 
 void ClipboardHostImpl::IsFormatAvailable(blink::mojom::ClipboardFormat format,
diff --git a/chromium/content/browser/frame_host/cookie_utils.cc b/chromium/content/browser/frame_host/cookie_utils.cc
new file mode 100644
index 00000000000..6896e4ccdf8
--- /dev/null
+++ b/chromium/content/browser/frame_host/cookie_utils.cc
@@ -0,0 +1,157 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/frame_host/cookie_utils.h"
+
+#include "content/browser/devtools/devtools_instrumentation.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/cookie_access_details.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
+#include "net/cookies/cookie_util.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
+
+namespace content {
+
+namespace {
+
+void RecordContextDowngradeUKM(
+    RenderFrameHost* rfh,
+    CookieAccessDetails::Type access_type,
+    const net::CanonicalCookie::CookieInclusionStatus& status,
+    const GURL& url) {
+  DCHECK(rfh);
+  ukm::SourceId source_id = rfh->GetPageUkmSourceId();
+
+  if (access_type == CookieAccessDetails::Type::kRead) {
+    ukm::builders::SchemefulSameSiteContextDowngrade(source_id)
+        .SetRequestPerCookie(status.GetBreakingDowngradeMetricsEnumValue(url))
+        .Record(ukm::UkmRecorder::Get());
+  } else {
+    DCHECK(access_type == CookieAccessDetails::Type::kChange);
+    ukm::builders::SchemefulSameSiteContextDowngrade(source_id)
+        .SetResponsePerCookie(status.GetBreakingDowngradeMetricsEnumValue(url))
+        .Record(ukm::UkmRecorder::Get());
+  }
+}
+
+}  // namespace
+
+void SplitCookiesIntoAllowedAndBlocked(
+    const network::mojom::CookieAccessDetailsPtr& cookie_details,
+    CookieAccessDetails* allowed,
+    CookieAccessDetails* blocked) {
+  *allowed =
+      CookieAccessDetails({cookie_details->type,
+                           cookie_details->url,
+                           cookie_details->site_for_cookies.RepresentativeUrl(),
+                           {},
+                           /* blocked_by_policy=*/false});
+  *blocked =
+      CookieAccessDetails({cookie_details->type,
+                           cookie_details->url,
+                           cookie_details->site_for_cookies.RepresentativeUrl(),
+                           {},
+                           /* blocked_by_policy=*/true});
+
+  for (auto& cookie_and_status : cookie_details->cookie_list) {
+    if (cookie_and_status.status.HasExclusionReason(
+            net::CanonicalCookie::CookieInclusionStatus::
+                EXCLUDE_USER_PREFERENCES)) {
+      blocked->cookie_list.push_back(std::move(cookie_and_status.cookie));
+    } else if (cookie_and_status.status.IsInclude()) {
+      allowed->cookie_list.push_back(std::move(cookie_and_status.cookie));
+    }
+  }
+}
+
+void EmitSameSiteCookiesDeprecationWarning(
+    RenderFrameHostImpl* rfh,
+    const network::mojom::CookieAccessDetailsPtr& cookie_details) {
+  RenderFrameHostImpl* root_frame_host = rfh->GetMainFrame();
+
+  if (!root_frame_host->IsCurrent())
+    return;
+
+  bool samesite_treated_as_lax_cookies = false;
+  bool samesite_none_insecure_cookies = false;
+
+  bool messages_disabled_by_cmdline =
+      base::FeatureList::GetInstance()->IsFeatureOverriddenFromCommandLine(
+          features::kCookieDeprecationMessages.name,
+          base::FeatureList::OVERRIDE_DISABLE_FEATURE);
+
+  bool breaking_context_downgrade = false;
+
+  for (const net::CookieWithStatus& excluded_cookie :
+       cookie_details->cookie_list) {
+    std::string cookie_url =
+        net::cookie_util::CookieOriginToURL(excluded_cookie.cookie.Domain(),
+                                            excluded_cookie.cookie.IsSecure())
+            .possibly_invalid_spec();
+
+    if (excluded_cookie.status.ShouldWarn()) {
+      if (excluded_cookie.status.HasWarningReason(
+              net::CanonicalCookie::CookieInclusionStatus::
+                  WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT)) {
+        samesite_treated_as_lax_cookies = true;
+      }
+
+      if (excluded_cookie.status.HasWarningReason(
+              net::CanonicalCookie::CookieInclusionStatus::
+                  WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE)) {
+        samesite_treated_as_lax_cookies = true;
+      }
+
+      if (excluded_cookie.status.HasWarningReason(
+              net::CanonicalCookie::CookieInclusionStatus::
+                  WARN_SAMESITE_NONE_INSECURE)) {
+        samesite_none_insecure_cookies = true;
+      }
+      devtools_instrumentation::ReportSameSiteCookieIssue(
+          root_frame_host, excluded_cookie, cookie_details->url,
+          cookie_details->site_for_cookies,
+          cookie_details->type == CookieAccessDetails::Type::kRead
+              ? blink::mojom::SameSiteCookieOperation::ReadCookie
+              : blink::mojom::SameSiteCookieOperation::SetCookie,
+          cookie_details->devtools_request_id);
+    }
+    if (!messages_disabled_by_cmdline) {
+      root_frame_host->AddSameSiteCookieDeprecationMessage(
+          cookie_url, excluded_cookie.status,
+          net::cookie_util::IsSameSiteByDefaultCookiesEnabled(),
+          net::cookie_util::IsCookiesWithoutSameSiteMustBeSecureEnabled());
+    }
+
+    breaking_context_downgrade = breaking_context_downgrade ||
+                                 excluded_cookie.status.HasDowngradeWarning();
+
+    if (excluded_cookie.status.HasDowngradeWarning()) {
+      // Unlike with UMA, do not record cookies that have no downgrade warning.
+      RecordContextDowngradeUKM(rfh, cookie_details->type,
+                                excluded_cookie.status, cookie_details->url);
+    }
+  }
+
+  // TODO(crbug.com/990439): Do we need separate UseCounter metrics for
+  // Lax-allow-unsafe? We already have histograms in CanonicalCookie.
+  if (samesite_treated_as_lax_cookies) {
+    GetContentClient()->browser()->LogWebFeatureForCurrentPage(
+        rfh, blink::mojom::WebFeature::kCookieNoSameSite);
+  }
+
+  if (samesite_none_insecure_cookies) {
+    GetContentClient()->browser()->LogWebFeatureForCurrentPage(
+        rfh, blink::mojom::WebFeature::kCookieInsecureAndSameSiteNone);
+  }
+
+  if (breaking_context_downgrade) {
+    GetContentClient()->browser()->LogWebFeatureForCurrentPage(
+        rfh, blink::mojom::WebFeature::kSchemefulSameSiteContextDowngrade);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/frame_host/cookie_utils.h b/chromium/content/browser/frame_host/cookie_utils.h
new file mode 100644
index 00000000000..09042230acc
--- /dev/null
+++ b/chromium/content/browser/frame_host/cookie_utils.h
@@ -0,0 +1,27 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_FRAME_HOST_COOKIE_UTILS_H_
+#define CONTENT_BROWSER_FRAME_HOST_COOKIE_UTILS_H_
+
+#include "services/network/public/mojom/cookie_access_observer.mojom.h"
+
+namespace content {
+
+class RenderFrameHostImpl;
+struct CookieAccessDetails;
+
+void SplitCookiesIntoAllowedAndBlocked(
+    const network::mojom::CookieAccessDetailsPtr& cookie_details,
+    CookieAccessDetails* allowed,
+    CookieAccessDetails* blocked);
+
+// TODO(crbug.com/977040): Remove when no longer needed.
+void EmitSameSiteCookiesDeprecationWarning(
+    RenderFrameHostImpl* rfh,
+    const network::mojom::CookieAccessDetailsPtr& cookie_details);
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_FRAME_HOST_COOKIE_UTILS_H_
diff --git a/chromium/content/browser/frame_host/cross_process_frame_connector.cc b/chromium/content/browser/frame_host/cross_process_frame_connector.cc
index a23194f0668..babd12facb8 100644
--- a/chromium/content/browser/frame_host/cross_process_frame_connector.cc
+++ b/chromium/content/browser/frame_host/cross_process_frame_connector.cc
@@ -48,8 +48,15 @@ CrossProcessFrameConnector::CrossProcessFrameConnector(
     RenderFrameProxyHost* frame_proxy_in_parent_renderer)
     : FrameConnectorDelegate(IsUseZoomForDSFEnabled()),
       frame_proxy_in_parent_renderer_(frame_proxy_in_parent_renderer) {
-  current_child_frame_host()->GetRenderWidgetHost()->GetScreenInfo(
-      &screen_info_);
+  // At this point, SetView() has not been called and so the associated RenderWidgetHost doesn't
+  // have a view yet. That means calling GetScreenInfo() on the associated RenderWidgetHost will
+  // just default to the primary display, which may not be appropriate. So instead we call
+  // GetScreenInfo() on the root RenderWidgetHost, which will be guaranteed to be on the correct
+  // display. All subsequent updates to |screen_info_| ultimately come from the root, so it makes
+  // sense to do it here as well.
+  RootRenderFrameHost(current_child_frame_host())
+      ->GetRenderWidgetHost()
+      ->GetScreenInfo(&screen_info_);
 }
 
 CrossProcessFrameConnector::~CrossProcessFrameConnector() {
@@ -130,10 +137,11 @@ void CrossProcessFrameConnector::SetView(RenderWidgetHostViewChildFrame* view) {
 void CrossProcessFrameConnector::RenderProcessGone() {
   has_crashed_ = true;
 
-  FrameTreeNode* node = frame_proxy_in_parent_renderer_->frame_tree_node();
-  int process_id = node->current_frame_host()->GetProcess()->GetID();
-  for (node = node->parent(); node; node = node->parent()) {
-    if (node->current_frame_host()->GetProcess()->GetID() == process_id) {
+  RenderFrameHost* rfh =
+      frame_proxy_in_parent_renderer_->frame_tree_node()->current_frame_host();
+  int process_id = rfh->GetProcess()->GetID();
+  for (rfh = rfh->GetParent(); rfh; rfh = rfh->GetParent()) {
+    if (rfh->GetProcess()->GetID() == process_id) {
       // The crash will be already logged by the ancestor - ignore this crash in
       // the current instance of the CrossProcessFrameConnector.
       is_crash_already_logged_ = true;
@@ -151,21 +159,15 @@ void CrossProcessFrameConnector::RenderProcessGone() {
 }
 
 void CrossProcessFrameConnector::SendIntrinsicSizingInfoToParent(
-    const blink::WebIntrinsicSizingInfo& sizing_info) {
+    blink::mojom::IntrinsicSizingInfoPtr sizing_info) {
   // The width/height should not be negative since gfx::SizeF will clamp
   // negative values to zero.
-  DCHECK((sizing_info.size.width >= 0.f) && (sizing_info.size.height >= 0.f));
-  DCHECK((sizing_info.aspect_ratio.width >= 0.f) &&
-         (sizing_info.aspect_ratio.height >= 0.f));
-
-  auto info = blink::mojom::IntrinsicSizingInfo::New(
-      gfx::SizeF(sizing_info.size.width, sizing_info.size.height),
-      gfx::SizeF(sizing_info.aspect_ratio.width,
-                 sizing_info.aspect_ratio.height),
-      sizing_info.has_width, sizing_info.has_height);
-
+  DCHECK((sizing_info->size.width() >= 0.f) &&
+         (sizing_info->size.height() >= 0.f));
+  DCHECK((sizing_info->aspect_ratio.width() >= 0.f) &&
+         (sizing_info->aspect_ratio.height() >= 0.f));
   frame_proxy_in_parent_renderer_->GetAssociatedRemoteFrame()
-      ->IntrinsicSizingInfoOfChildChanged(std::move(info));
+      ->IntrinsicSizingInfoOfChildChanged(std::move(sizing_info));
 }
 
 void CrossProcessFrameConnector::UpdateCursor(const WebCursor& cursor) {
@@ -211,7 +213,7 @@ bool CrossProcessFrameConnector::TransformPointToCoordSpaceForView(
 
 void CrossProcessFrameConnector::ForwardAckedTouchpadZoomEvent(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   auto* root_view = GetRootRenderWidgetHostView();
   if (!root_view)
     return;
@@ -225,9 +227,9 @@ void CrossProcessFrameConnector::ForwardAckedTouchpadZoomEvent(
 
 bool CrossProcessFrameConnector::BubbleScrollEvent(
     const blink::WebGestureEvent& event) {
-  DCHECK(event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
-         event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-         event.GetType() == blink::WebInputEvent::kGestureScrollEnd);
+  DCHECK(event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin ||
+         event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate ||
+         event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd);
   auto* parent_view = GetParentRenderWidgetHostView();
 
   if (!parent_view)
@@ -426,7 +428,7 @@ void CrossProcessFrameConnector::DidUpdateVisualProperties(
 
 void CrossProcessFrameConnector::DidAckGestureEvent(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   auto* root_view = GetRootRenderWidgetHostView();
   if (!root_view)
     return;
diff --git a/chromium/content/browser/frame_host/cross_process_frame_connector.h b/chromium/content/browser/frame_host/cross_process_frame_connector.h
index f864d98f0ff..e23efd51583 100644
--- a/chromium/content/browser/frame_host/cross_process_frame_connector.h
+++ b/chromium/content/browser/frame_host/cross_process_frame_connector.h
@@ -14,6 +14,7 @@
 #include "content/browser/renderer_host/frame_connector_delegate.h"
 #include "content/common/content_export.h"
 #include "content/common/frame_visual_properties.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom.h"
 
 namespace IPC {
@@ -80,7 +81,7 @@ class CONTENT_EXPORT CrossProcessFrameConnector
   RenderWidgetHostViewBase* GetRootRenderWidgetHostView() override;
   void RenderProcessGone() override;
   void SendIntrinsicSizingInfoToParent(
-      const blink::WebIntrinsicSizingInfo&) override;
+      blink::mojom::IntrinsicSizingInfoPtr) override;
 
   void UpdateCursor(const WebCursor& cursor) override;
   gfx::PointF TransformPointToRootCoordSpace(
@@ -91,8 +92,9 @@ class CONTENT_EXPORT CrossProcessFrameConnector
       RenderWidgetHostViewBase* target_view,
       const viz::SurfaceId& local_surface_id,
       gfx::PointF* transformed_point) override;
-  void ForwardAckedTouchpadZoomEvent(const blink::WebGestureEvent& event,
-                                     InputEventAckState ack_result) override;
+  void ForwardAckedTouchpadZoomEvent(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) override;
   bool BubbleScrollEvent(const blink::WebGestureEvent& event) override;
   bool HasFocus() override;
   void FocusRootView() override;
@@ -111,8 +113,9 @@ class CONTENT_EXPORT CrossProcessFrameConnector
   bool IsSubtreeThrottled() const override;
   void DidUpdateVisualProperties(
       const cc::RenderFrameMetadata& metadata) override;
-  void DidAckGestureEvent(const blink::WebGestureEvent& event,
-                          InputEventAckState ack_result) override;
+  void DidAckGestureEvent(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) override;
 
   // Set the visibility of immediate child views, i.e. views whose parent view
   // is |view_|.
diff --git a/chromium/content/browser/frame_host/embedding_token_browsertest.cc b/chromium/content/browser/frame_host/embedding_token_browsertest.cc
index 5d8f9295c18..e371a638fb9 100644
--- a/chromium/content/browser/frame_host/embedding_token_browsertest.cc
+++ b/chromium/content/browser/frame_host/embedding_token_browsertest.cc
@@ -5,6 +5,8 @@
 #include "base/unguessable_token.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/content_navigation_policy.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -32,6 +34,12 @@ class EmbeddingTokenBrowserTest : public ContentBrowserTest {
     ASSERT_TRUE(embedded_test_server()->Start());
   }
 
+  WebContents* web_contents() { return shell()->web_contents(); }
+
+  RenderFrameHostImpl* top_frame_host() {
+    return static_cast<RenderFrameHostImpl*>(web_contents()->GetMainFrame());
+  }
+
   EmbeddingTokenBrowserTest(const EmbeddingTokenBrowserTest&) = delete;
   EmbeddingTokenBrowserTest& operator=(const EmbeddingTokenBrowserTest&) =
       delete;
@@ -44,23 +52,14 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest, NoEmbeddingTokenOnMainFrame) {
   GURL a_url = embedded_test_server()->GetURL("a.com", "/site_isolation/");
   GURL b_url = embedded_test_server()->GetURL("b.com", "/site_isolation/");
   // Starts without an embedding token.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   // Embedding tokens don't get added to the main frame.
   EXPECT_TRUE(NavigateToURL(shell(), a_url.Resolve("blank.html")));
-  root = static_cast<WebContentsImpl*>(shell()->web_contents())
-             ->GetFrameTree()
-             ->root();
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   EXPECT_TRUE(NavigateToURL(shell(), b_url.Resolve("blank.html")));
-  root = static_cast<WebContentsImpl*>(shell()->web_contents())
-             ->GetFrameTree()
-             ->root();
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 }
 
 IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
@@ -68,34 +67,41 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL(
                    "a.com", "/cross_site_iframe_factory.html?a(b(a),c,a)")));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
 
-  ASSERT_EQ(3U, root->child_count());
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  ASSERT_EQ(3U, top_frame_host()->child_count());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   // Child 0 (b) should have an embedding token.
-  auto child_0_token = root->child_at(0)->GetEmbeddingToken();
+  auto child_0_token =
+      top_frame_host()->child_at(0)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_0_token);
 
   // Child 0 (a) of Child 0 (b) should have an embedding token.
-  ASSERT_EQ(1U, root->child_at(0)->child_count());
-  auto child_0_0_token = root->child_at(0)->child_at(0)->GetEmbeddingToken();
+  ASSERT_EQ(1U, top_frame_host()->child_at(0)->child_count());
+  auto child_0_0_token = top_frame_host()
+                             ->child_at(0)
+                             ->child_at(0)
+                             ->current_frame_host()
+                             ->GetEmbeddingToken();
   ASSERT_TRUE(child_0_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_0_0_token);
   EXPECT_NE(child_0_token, child_0_0_token);
 
   // Child 1 (c) should have an embedding token.
-  auto child_1_token = root->child_at(1)->GetEmbeddingToken();
+  auto child_1_token =
+      top_frame_host()->child_at(1)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(child_1_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_1_token);
   EXPECT_NE(child_0_token, child_1_token);
   EXPECT_NE(child_0_0_token, child_1_token);
 
   // Child 2 (a) shouldn't have an embedding token as it is same site.
-  EXPECT_FALSE(root->child_at(2)->GetEmbeddingToken().has_value());
+  EXPECT_FALSE(top_frame_host()
+                   ->child_at(2)
+                   ->current_frame_host()
+                   ->GetEmbeddingToken()
+                   .has_value());
 
   // TODO(ckitagawa): Somehow assert that the parent and child have matching
   // embedding tokens in parent HTMLOwnerElement and child LocalFrame.
@@ -106,29 +112,27 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL(
                    "a.com", "/cross_site_iframe_factory.html?a(b)")));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
 
-  ASSERT_EQ(1U, root->child_count());
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  ASSERT_EQ(1U, top_frame_host()->child_count());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   // Child 0 (b) should have an embedding token.
-  FrameTreeNode* target = root->child_at(0);
+  RenderFrameHost* target = top_frame_host()->child_at(0)->current_frame_host();
   auto child_0_token = target->GetEmbeddingToken();
   ASSERT_TRUE(child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_0_token);
 
   // Navigate child 0 (b) to another site (cross-process) the token should swap.
   {
-    RenderFrameDeletedObserver deleted_observer(target->current_frame_host());
+    RenderFrameDeletedObserver deleted_observer(target);
     NavigateIframeToURL(shell()->web_contents(), "child-0",
                         embedded_test_server()
                             ->GetURL("c.com", "/site_isolation/")
                             .Resolve("blank.html"));
     deleted_observer.WaitUntilDeleted();
   }
-  auto new_child_0_token = root->child_at(0)->GetEmbeddingToken();
+  auto new_child_0_token =
+      top_frame_host()->child_at(0)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(new_child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), new_child_0_token);
   EXPECT_NE(child_0_token, new_child_0_token);
@@ -142,34 +146,36 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL(
                    "a.com", "/cross_site_iframe_factory.html?a(a)")));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
 
-  ASSERT_EQ(1U, root->child_count());
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  ASSERT_EQ(1U, top_frame_host()->child_count());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
   auto b_url = embedded_test_server()->GetURL("b.com", "/site_isolation/");
   // Navigate child 0 to another site (cross-process) a token should be created.
   {
     RenderFrameDeletedObserver deleted_observer(
-        root->child_at(0)->current_frame_host());
-    NavigateIframeToURL(shell()->web_contents(), "child-0",
-                        b_url.Resolve("blank.html"));
+        top_frame_host()->child_at(0)->current_frame_host());
+    NavigateIframeToURL(web_contents(), "child-0", b_url.Resolve("blank.html"));
     deleted_observer.WaitUntilDeleted();
   }
 
   // Child 0 (b) should have an embedding token.
-  FrameTreeNode* target = root->child_at(0);
-  auto child_0_token = target->GetEmbeddingToken();
+  auto child_0_token =
+      top_frame_host()->child_at(0)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_0_token);
 
   // Navigate child 0 (b) to same origin the token should not swap.
-  NavigateIframeToURL(shell()->web_contents(), "child-0",
-                      b_url.Resolve("valid.html"));
-  auto new_child_0_token = root->child_at(0)->GetEmbeddingToken();
+  NavigateIframeToURL(web_contents(), "child-0", b_url.Resolve("valid.html"));
+  auto new_child_0_token =
+      top_frame_host()->child_at(0)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(new_child_0_token.has_value());
-  EXPECT_EQ(child_0_token, new_child_0_token);
+  // If we are creating a new frame even for same-site navigations then we would
+  // expect a different token.
+  if (CreateNewHostForSameSiteSubframe()) {
+    EXPECT_NE(child_0_token, new_child_0_token);
+  } else {
+    EXPECT_EQ(child_0_token, new_child_0_token);
+  }
 
   // TODO(ckitagawa): Somehow assert that the parent and child have matching
   // embedding tokens in parent HTMLOwnerElement and child LocalFrame.
@@ -180,15 +186,12 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
   auto a_url = embedded_test_server()->GetURL("a.com", "/");
   EXPECT_TRUE(NavigateToURL(
       shell(), a_url.Resolve("cross_site_iframe_factory.html?a(b)")));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
 
-  ASSERT_EQ(1U, root->child_count());
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  ASSERT_EQ(1U, top_frame_host()->child_count());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   // Child 0 (b) should have an embedding token.
-  FrameTreeNode* target = root->child_at(0);
+  RenderFrameHost* target = top_frame_host()->child_at(0)->current_frame_host();
   auto child_0_token = target->GetEmbeddingToken();
   ASSERT_TRUE(child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), child_0_token);
@@ -196,12 +199,16 @@ IN_PROC_BROWSER_TEST_F(EmbeddingTokenBrowserTest,
   // Navigate child 0 (b) to the same site as the main frame. This shouldn't
   // create an embedding token as the child is now local.
   {
-    RenderFrameDeletedObserver deleted_observer(target->current_frame_host());
-    NavigateIframeToURL(shell()->web_contents(), "child-0",
+    RenderFrameDeletedObserver deleted_observer(target);
+    NavigateIframeToURL(web_contents(), "child-0",
                         a_url.Resolve("site_isolation/").Resolve("blank.html"));
     deleted_observer.WaitUntilDeleted();
   }
-  ASSERT_FALSE(root->child_at(0)->GetEmbeddingToken().has_value());
+  ASSERT_FALSE(top_frame_host()
+                   ->child_at(0)
+                   ->current_frame_host()
+                   ->GetEmbeddingToken()
+                   .has_value());
 
   // TODO(ckitagawa): Somehow assert that the parent and child have matching
   // embedding tokens in parent HTMLOwnerElement and child LocalFrame.
@@ -213,29 +220,27 @@ IN_PROC_BROWSER_TEST_F(
   auto a_url = embedded_test_server()->GetURL("a.com", "/");
   EXPECT_TRUE(NavigateToURL(
       shell(), a_url.Resolve("cross_site_iframe_factory.html?a(a)")));
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
 
-  ASSERT_EQ(1U, root->child_count());
-  EXPECT_FALSE(root->GetEmbeddingToken().has_value());
+  ASSERT_EQ(1U, top_frame_host()->child_count());
+  EXPECT_FALSE(top_frame_host()->GetEmbeddingToken().has_value());
 
   // Child shouldn't have an embedding token.
-  FrameTreeNode* target = root->child_at(0);
+  RenderFrameHost* target = top_frame_host()->child_at(0)->current_frame_host();
   auto child_0_token = target->GetEmbeddingToken();
   EXPECT_FALSE(child_0_token.has_value());
 
   // Navigate child 0 to a different site. This should now have an embedding
   // token.
   {
-    RenderFrameDeletedObserver deleted_observer(target->current_frame_host());
-    NavigateIframeToURL(shell()->web_contents(), "child-0",
+    RenderFrameDeletedObserver deleted_observer(target);
+    NavigateIframeToURL(web_contents(), "child-0",
                         embedded_test_server()
                             ->GetURL("b.com", "/site_isolation/")
                             .Resolve("blank.html"));
     deleted_observer.WaitUntilDeleted();
   }
-  auto new_child_0_token = root->child_at(0)->GetEmbeddingToken();
+  auto new_child_0_token =
+      top_frame_host()->child_at(0)->current_frame_host()->GetEmbeddingToken();
   ASSERT_TRUE(new_child_0_token.has_value());
   EXPECT_NE(base::UnguessableToken::Null(), new_child_0_token);
 
diff --git a/chromium/content/browser/frame_host/file_chooser_impl.cc b/chromium/content/browser/frame_host/file_chooser_impl.cc
index 4660d3c0f0b..add104f1de3 100644
--- a/chromium/content/browser/frame_host/file_chooser_impl.cc
+++ b/chromium/content/browser/frame_host/file_chooser_impl.cc
@@ -9,6 +9,7 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
diff --git a/chromium/content/browser/frame_host/frame_tree.cc b/chromium/content/browser/frame_host/frame_tree.cc
index 7b0c02dd01a..100cd8079a0 100644
--- a/chromium/content/browser/frame_host/frame_tree.cc
+++ b/chromium/content/browser/frame_host/frame_tree.cc
@@ -19,7 +19,9 @@
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
+#include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
@@ -106,13 +108,13 @@ FrameTree::FrameTree(Navigator* navigator,
                               nullptr,
                               // The top-level frame must always be in a
                               // document scope.
-                              blink::WebTreeScopeType::kDocument,
+                              blink::mojom::TreeScopeType::kDocument,
                               std::string(),
                               std::string(),
                               false,
                               base::UnguessableToken::Create(),
                               blink::mojom::FrameOwnerProperties(),
-                              blink::FrameOwnerElementType::kNone)),
+                              blink::mojom::FrameOwnerElementType::kNone)),
       focused_frame_tree_node_id_(FrameTreeNode::kFrameTreeNodeInvalidId),
       load_progress_(0.0) {}
 
@@ -174,35 +176,36 @@ FrameTree::NodeRange FrameTree::NodesExceptSubtree(FrameTreeNode* node) {
 }
 
 FrameTreeNode* FrameTree::AddFrame(
-    FrameTreeNode* parent,
+    RenderFrameHostImpl* parent,
     int process_id,
     int new_routing_id,
     mojo::PendingReceiver<service_manager::mojom::InterfaceProvider>
         interface_provider_receiver,
     mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>
         browser_interface_broker_receiver,
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const std::string& frame_name,
     const std::string& frame_unique_name,
     bool is_created_by_script,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const blink::FramePolicy& frame_policy,
     const blink::mojom::FrameOwnerProperties& frame_owner_properties,
     bool was_discarded,
-    blink::FrameOwnerElementType owner_type) {
+    blink::mojom::FrameOwnerElementType owner_type) {
   CHECK_NE(new_routing_id, MSG_ROUTING_NONE);
 
   // A child frame always starts with an initial empty document, which means
   // it is in the same SiteInstance as the parent frame. Ensure that the process
   // which requested a child frame to be added is the same as the process of the
   // parent node.
-  if (parent->current_frame_host()->GetProcess()->GetID() != process_id)
+  if (parent->GetProcess()->GetID() != process_id)
     return nullptr;
 
   std::unique_ptr<FrameTreeNode> new_node = base::WrapUnique(new FrameTreeNode(
-      this, parent->navigator(), parent, scope, frame_name, frame_unique_name,
-      is_created_by_script, devtools_frame_token, frame_owner_properties,
-      owner_type));
+      this, parent->frame_tree_node()->navigator(), parent, scope, frame_name,
+      frame_unique_name, is_created_by_script, devtools_frame_token,
+      frame_owner_properties, owner_type));
 
   // Set sandbox flags and container policy and make them effective immediately,
   // since initial sandbox flags and feature policy should apply to the initial
@@ -219,8 +222,8 @@ FrameTreeNode* FrameTree::AddFrame(
     new_node->set_was_discarded();
 
   // Add the new node to the FrameTree, creating the RenderFrameHost.
-  FrameTreeNode* added_node = parent->current_frame_host()->AddChild(
-      std::move(new_node), process_id, new_routing_id);
+  FrameTreeNode* added_node = parent->AddChild(std::move(new_node), process_id,
+                                               new_routing_id, frame_token);
 
   DCHECK(interface_provider_receiver.is_valid());
   added_node->current_frame_host()->BindInterfaceProviderReceiver(
@@ -234,8 +237,11 @@ FrameTreeNode* FrameTree::AddFrame(
   // same |frame_unique_name|, since we don't remove FrameNavigationEntries if
   // their frames are deleted.  If there is a stale one, remove it to avoid
   // conflicts on future updates.
-  NavigationEntryImpl* last_committed_entry = static_cast<NavigationEntryImpl*>(
-      parent->navigator()->GetController()->GetLastCommittedEntry());
+  NavigationEntryImpl* last_committed_entry =
+      static_cast<NavigationEntryImpl*>(parent->frame_tree_node()
+                                            ->navigator()
+                                            ->GetController()
+                                            ->GetLastCommittedEntry());
   if (last_committed_entry) {
     last_committed_entry->RemoveEntryForFrame(
         added_node, /* only_if_different_position = */ true);
@@ -245,7 +251,7 @@ FrameTreeNode* FrameTree::AddFrame(
   // we can announce the creation of the initial RenderFrame which already
   // exists in the renderer process.
   if (added_node->frame_owner_element_type() !=
-      blink::FrameOwnerElementType::kPortal) {
+      blink::mojom::FrameOwnerElementType::kPortal) {
     // Portals do not have a live RenderFrame in the renderer process.
     added_node->current_frame_host()->SetRenderFrameCreated(true);
   }
@@ -253,13 +259,13 @@ FrameTreeNode* FrameTree::AddFrame(
 }
 
 void FrameTree::RemoveFrame(FrameTreeNode* child) {
-  FrameTreeNode* parent = child->parent();
+  RenderFrameHostImpl* parent = child->parent();
   if (!parent) {
     NOTREACHED() << "Unexpected RemoveFrame call for main frame.";
     return;
   }
 
-  parent->current_frame_host()->RemoveChild(child);
+  parent->RemoveChild(child);
 }
 
 void FrameTree::CreateProxiesForSiteInstance(FrameTreeNode* source,
@@ -486,4 +492,47 @@ void FrameTree::SetPageFocus(SiteInstance* instance, bool is_focused) {
   }
 }
 
+void FrameTree::RegisterExistingOriginToPreventOptInIsolation(
+    const url::Origin& previously_visited_origin,
+    NavigationRequest* navigation_request_to_exclude) {
+  std::unordered_set<SiteInstance*> matching_site_instances;
+
+  // Be sure to visit all RenderFrameHosts associated with this frame that might
+  // have an origin that could script other frames. We skip RenderFrameHosts
+  // that are in the bfcache, assuming there's no way for a frame to join the
+  // BrowsingInstance of a bfcache RFH while it's in the cache.
+  for (auto* frame_tree_node : SubtreeNodes(root())) {
+    auto* frame_host = frame_tree_node->current_frame_host();
+
+    if (previously_visited_origin == frame_host->GetLastCommittedOrigin())
+      matching_site_instances.insert(frame_host->GetSiteInstance());
+
+    if (frame_host->HasCommittingNavigationRequestForOrigin(
+            previously_visited_origin, navigation_request_to_exclude)) {
+      matching_site_instances.insert(frame_host->GetSiteInstance());
+    }
+
+    auto* spec_frame_host =
+        frame_tree_node->render_manager()->speculative_frame_host();
+    if (spec_frame_host &&
+        spec_frame_host->HasCommittingNavigationRequestForOrigin(
+            previously_visited_origin, navigation_request_to_exclude)) {
+      matching_site_instances.insert(spec_frame_host->GetSiteInstance());
+    }
+
+    auto* navigation_request = frame_tree_node->navigation_request();
+    if (navigation_request &&
+        navigation_request != navigation_request_to_exclude &&
+        navigation_request->HasCommittingOrigin(previously_visited_origin)) {
+      matching_site_instances.insert(frame_host->GetSiteInstance());
+    }
+  }
+
+  // Update any SiteInstances found to contain |origin|.
+  for (auto* site_instance : matching_site_instances) {
+    static_cast<SiteInstanceImpl*>(site_instance)
+        ->PreventOptInOriginIsolation(previously_visited_origin);
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/frame_tree.h b/chromium/content/browser/frame_host/frame_tree.h
index 0b44b163b08..b2050b910de 100644
--- a/chromium/content/browser/frame_host/frame_tree.h
+++ b/chromium/content/browser/frame_host/frame_tree.h
@@ -20,7 +20,7 @@
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-forward.h"
 
 namespace blink {
@@ -121,6 +121,10 @@ class CONTENT_EXPORT FrameTree {
   RenderFrameHostManager::Delegate* manager_delegate() {
     return manager_delegate_;
   }
+  const std::unordered_map<int /* SiteInstance ID */, RenderViewHostImpl*>&
+  render_view_hosts() const {
+    return render_view_host_map_;
+  }
 
   // Returns the FrameTreeNode with the given |frame_tree_node_id| if it is part
   // of this FrameTree.
@@ -151,22 +155,23 @@ class CONTENT_EXPORT FrameTree {
   // exposed by the corresponding RenderFrameHost. The caller takes care of
   // sending the client end of the interface down to the RenderFrame.
   FrameTreeNode* AddFrame(
-      FrameTreeNode* parent,
+      RenderFrameHostImpl* parent,
       int process_id,
       int new_routing_id,
       mojo::PendingReceiver<service_manager::mojom::InterfaceProvider>
           interface_provider_receiver,
       mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>
           browser_interface_broker_receiver,
-      blink::WebTreeScopeType scope,
+      blink::mojom::TreeScopeType scope,
       const std::string& frame_name,
       const std::string& frame_unique_name,
       bool is_created_by_script,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const blink::FramePolicy& frame_policy,
       const blink::mojom::FrameOwnerProperties& frame_owner_properties,
       bool was_discarded,
-      blink::FrameOwnerElementType owner_type);
+      blink::mojom::FrameOwnerElementType owner_type);
 
   // Removes a frame from the frame tree. |child|, its children, and objects
   // owned by their RenderFrameHostManagers are immediately deleted. The root
@@ -266,6 +271,14 @@ class CONTENT_EXPORT FrameTree {
   // identified by |instance|.
   void SetPageFocus(SiteInstance* instance, bool is_focused);
 
+  // Walks the current frame tree and registers any origins matching |origin|,
+  // either the last committed origin of a RenderFrameHost or the origin
+  // associated with a NavigationRequest that has been assigned to a
+  // SiteInstance, as not-opted-in for origin isolation.
+  void RegisterExistingOriginToPreventOptInIsolation(
+      const url::Origin& previously_visited_origin,
+      NavigationRequest* navigation_request_to_exclude);
+
  private:
   friend class FrameTreeTest;
   FRIEND_TEST_ALL_PREFIXES(RenderFrameHostImplBrowserTest, RemoveFocusedFrame);
diff --git a/chromium/content/browser/frame_host/frame_tree_browsertest.cc b/chromium/content/browser/frame_host/frame_tree_browsertest.cc
index 925df363eda..16a39458285 100644
--- a/chromium/content/browser/frame_host/frame_tree_browsertest.cc
+++ b/chromium/content/browser/frame_host/frame_tree_browsertest.cc
@@ -18,6 +18,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/origin_util.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -29,7 +30,8 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "url/url_constants.h"
 
@@ -357,7 +359,7 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, NavigateChildToAboutBlank) {
   // initiate the navigation.
   FrameTreeNode* target =
       contents->GetFrameTree()->root()->child_at(0)->child_at(0);
-  FrameTreeNode* initiator = target->parent();
+  FrameTreeNode* initiator = target->parent()->frame_tree_node();
 
   // Give the target a name.
   EXPECT_TRUE(ExecJs(target, "window.name = 'target';"));
@@ -405,7 +407,8 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest,
   // initiate the navigation.
   FrameTreeNode* target =
       contents->GetFrameTree()->root()->child_at(0)->child_at(0);
-  FrameTreeNode* initiator = target->parent()->parent();
+  FrameTreeNode* initiator =
+      target->parent()->frame_tree_node()->parent()->frame_tree_node();
 
   // Give the target a name.
   EXPECT_TRUE(ExecJs(target, "window.name = 'target';"));
@@ -452,7 +455,8 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, NavigateGrandchildToDataUrl) {
   // initiate the navigation.
   FrameTreeNode* target =
       contents->GetFrameTree()->root()->child_at(0)->child_at(0);
-  FrameTreeNode* initiator = target->parent()->parent();
+  FrameTreeNode* initiator =
+      target->parent()->frame_tree_node()->parent()->frame_tree_node();
 
   // Give the target a name.
   EXPECT_TRUE(ExecJs(target, "window.name = 'target';"));
@@ -567,11 +571,11 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForMainFrame) {
 
   // Verify that sandbox flags are set properly for the root FrameTreeNode and
   // RenderFrameHost. Root frame is sandboxed with "allow-scripts".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->active_sandbox_flags());
   EXPECT_EQ(root->active_sandbox_flags(),
             root->current_frame_host()->active_sandbox_flags());
@@ -579,19 +583,19 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForMainFrame) {
   // Verify that child frames inherit sandbox flags from the root. First frame
   // has no explicitly set flags of its own, and should inherit those from the
   // root. Second frame is completely sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -602,10 +606,11 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForMainFrame) {
 
   // Verify that sandbox flags are cleared properly for the root FrameTreeNode
   // and RenderFrameHost.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone, root->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
+            root->active_sandbox_flags());
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->current_frame_host()->active_sandbox_flags());
 }
 
@@ -624,18 +629,18 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForChildFrames) {
   // which resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy(), and
   // third frame has "allow-scripts allow-same-origin".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kOrigin,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kOrigin,
             root->child_at(2)->effective_frame_policy().sandbox_flags);
 
   // Sandboxed frames should set a unique origin unless they have the
@@ -648,7 +653,7 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForChildFrames) {
   // Navigating to a different URL should not clear sandbox flags.
   GURL frame_url(embedded_test_server()->GetURL("/title1.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 }
 
@@ -673,31 +678,32 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest,
   // "allow-orientation-lock", and the framed document is also served with a CSP
   // header which uses "allow-popups" and "allow-pointer-lock". The resulting
   // sandbox for the frame should only have "allow-pointer-lock".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone, root->active_sandbox_flags());
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
+            root->active_sandbox_flags());
   EXPECT_EQ(root->active_sandbox_flags(),
             root->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -707,25 +713,25 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest,
   GURL frame_url(embedded_test_server()->GetURL("/title1.html"));
 
   NavigateFrameToURL(root->child_at(0), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
 
   NavigateFrameToURL(root->child_at(1), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -1178,13 +1184,13 @@ IN_PROC_BROWSER_TEST_F(CrossProcessFrameTreeBrowserTest,
   // flags. Main frame sets allow-popups, allow-pointer-lock and allow-scripts.
   FrameTreeNode* popup_root =
       static_cast<WebContentsImpl*>(new_contents)->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags main_frame_sandbox_flags =
+  network::mojom::WebSandboxFlags main_frame_sandbox_flags =
       root->current_frame_host()->active_sandbox_flags();
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             main_frame_sandbox_flags);
 
   EXPECT_EQ(main_frame_sandbox_flags,
diff --git a/chromium/content/browser/frame_host/frame_tree_node.cc b/chromium/content/browser/frame_host/frame_tree_node.cc
index 2e2e1420440..d4864979d3f 100644
--- a/chromium/content/browser/frame_host/frame_tree_node.cc
+++ b/chromium/content/browser/frame_host/frame_tree_node.cc
@@ -21,6 +21,7 @@
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
+#include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/frame_messages.h"
@@ -29,7 +30,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/navigation_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
 
@@ -95,23 +97,30 @@ FrameTreeNode* FrameTreeNode::GloballyFindByID(int frame_tree_node_id) {
   return it == nodes->end() ? nullptr : it->second;
 }
 
+// static
+FrameTreeNode* FrameTreeNode::From(RenderFrameHost* rfh) {
+  if (!rfh)
+    return nullptr;
+  return static_cast<RenderFrameHostImpl*>(rfh)->frame_tree_node();
+}
+
 FrameTreeNode::FrameTreeNode(
     FrameTree* frame_tree,
     Navigator* navigator,
-    FrameTreeNode* parent,
-    blink::WebTreeScopeType scope,
+    RenderFrameHostImpl* parent,
+    blink::mojom::TreeScopeType scope,
     const std::string& name,
     const std::string& unique_name,
     bool is_created_by_script,
     const base::UnguessableToken& devtools_frame_token,
     const blink::mojom::FrameOwnerProperties& frame_owner_properties,
-    blink::FrameOwnerElementType owner_type)
+    blink::mojom::FrameOwnerElementType owner_type)
     : frame_tree_(frame_tree),
       navigator_(navigator),
       render_manager_(this, frame_tree->manager_delegate()),
       frame_tree_node_id_(next_frame_tree_node_id_++),
       parent_(parent),
-      depth_(parent ? parent->depth_ + 1 : 0u),
+      depth_(parent ? parent->frame_tree_node()->depth_ + 1 : 0u),
       opener_(nullptr),
       original_opener_(nullptr),
       has_committed_real_load_(false),
@@ -134,7 +143,7 @@ FrameTreeNode::FrameTreeNode(
       devtools_frame_token_(devtools_frame_token),
       frame_owner_properties_(frame_owner_properties),
       was_discarded_(false),
-      blame_context_(frame_tree_node_id_, parent) {
+      blame_context_(frame_tree_node_id_, FrameTreeNode::From(parent)) {
   std::pair<FrameTreeNodeIdMap::iterator, bool> result =
       g_frame_tree_node_id_map.Get().insert(
           std::make_pair(frame_tree_node_id_, this));
@@ -231,7 +240,7 @@ void FrameTreeNode::ResetForNavigation() {
 
   // Clear any CSP-set sandbox flags, and the declared feature policy for the
   // frame.
-  UpdateFramePolicyHeaders(blink::mojom::WebSandboxFlags::kNone, {});
+  UpdateFramePolicyHeaders(network::mojom::WebSandboxFlags::kNone, {});
 
   // This frame has had its user activation bits cleared in the renderer
   // before arriving here. We just need to clear them here and in the other
@@ -371,7 +380,8 @@ void FrameTreeNode::SetPendingFramePolicy(blink::FramePolicy frame_policy) {
 
   if (parent()) {
     // Subframes should always inherit their parent's sandbox flags.
-    pending_frame_policy_.sandbox_flags |= parent()->active_sandbox_flags();
+    pending_frame_policy_.sandbox_flags |=
+        parent()->frame_tree_node()->active_sandbox_flags();
     // This is only applied on subframes; container policy and required document
     // policy are not mutable on main frame.
     pending_frame_policy_.container_policy = frame_policy.container_policy;
@@ -579,11 +589,11 @@ void FrameTreeNode::BeforeUnloadCanceled() {
 }
 
 bool FrameTreeNode::NotifyUserActivation() {
-  for (FrameTreeNode* node = this; node; node = node->parent()) {
-    if (!node->user_activation_state_.HasBeenActive() &&
-        node->current_frame_host())
-      node->current_frame_host()->DidReceiveFirstUserActivation();
-    node->user_activation_state_.Activate();
+  for (RenderFrameHostImpl* rfh = current_frame_host(); rfh;
+       rfh = rfh->GetParent()) {
+    if (!rfh->frame_tree_node()->user_activation_state_.HasBeenActive())
+      rfh->DidReceiveFirstUserActivation();
+    rfh->frame_tree_node()->user_activation_state_.Activate();
   }
   replication_state_.has_received_user_gesture = true;
 
@@ -687,7 +697,7 @@ FrameTreeNode* FrameTreeNode::GetSibling(int relative_offset) const {
 }
 
 void FrameTreeNode::UpdateFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::ParsedFeaturePolicy& parsed_header) {
   bool changed = false;
   if (replication_state_.feature_policy_header != parsed_header) {
@@ -696,7 +706,7 @@ void FrameTreeNode::UpdateFramePolicyHeaders(
   }
   // TODO(iclelland): Kill the renderer if sandbox flags is not a subset of the
   // currently effective sandbox flags from the frame. https://crbug.com/740556
-  blink::mojom::WebSandboxFlags updated_flags =
+  network::mojom::WebSandboxFlags updated_flags =
       sandbox_flags | effective_frame_policy().sandbox_flags;
   if (replication_state_.active_sandbox_flags != updated_flags) {
     replication_state_.active_sandbox_flags = updated_flags;
@@ -740,22 +750,6 @@ void FrameTreeNode::SetOpenerFeaturePolicyState(
   }
 }
 
-const base::Optional<base::UnguessableToken>& FrameTreeNode::GetEmbeddingToken()
-    const {
-  return embedding_token_;
-}
-
-void FrameTreeNode::SetEmbeddingToken(
-    const base::Optional<base::UnguessableToken>& embedding_token) {
-  embedding_token_ = embedding_token;
-  if (embedding_token_.has_value()) {
-    // Propagate a non-null embedding token to the parent. Parents will
-    // invalidate their own tokens if a previously remote frame becomes local to
-    // them.
-    render_manager_.SetEmbeddingToken(embedding_token.value());
-  }
-}
-
 void FrameTreeNode::SetAdFrameType(blink::mojom::AdFrameType ad_frame_type) {
   DCHECK_NE(ad_frame_type, blink::mojom::AdFrameType::kNonAd);
   if (replication_state_.ad_frame_type == blink::mojom::AdFrameType::kNonAd) {
diff --git a/chromium/content/browser/frame_host/frame_tree_node.h b/chromium/content/browser/frame_host/frame_tree_node.h
index 89ba68e856e..6df7a88eb74 100644
--- a/chromium/content/browser/frame_host/frame_tree_node.h
+++ b/chromium/content/browser/frame_host/frame_tree_node.h
@@ -20,9 +20,9 @@
 #include "content/common/content_export.h"
 #include "content/common/frame_replication_state.h"
 #include "services/network/public/mojom/content_security_policy.mojom-forward.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/common/frame/user_activation_state.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-forward.h"
@@ -69,19 +69,23 @@ class CONTENT_EXPORT FrameTreeNode {
   // regardless of which FrameTree it is in.
   static FrameTreeNode* GloballyFindByID(int frame_tree_node_id);
 
+  // Returns the FrameTreeNode for the given |rfh|. Same as
+  // rfh->frame_tree_node(), but also supports nullptrs.
+  static FrameTreeNode* From(RenderFrameHost* rfh);
+
   // Callers are are expected to initialize sandbox flags separately after
   // calling the constructor.
   FrameTreeNode(
       FrameTree* frame_tree,
       Navigator* navigator,
-      FrameTreeNode* parent,
-      blink::WebTreeScopeType scope,
+      RenderFrameHostImpl* parent,
+      blink::mojom::TreeScopeType scope,
       const std::string& name,
       const std::string& unique_name,
       bool is_created_by_script,
       const base::UnguessableToken& devtools_frame_token,
       const blink::mojom::FrameOwnerProperties& frame_owner_properties,
-      blink::FrameOwnerElementType owner_type);
+      blink::mojom::FrameOwnerElementType owner_type);
 
   ~FrameTreeNode();
 
@@ -116,7 +120,7 @@ class CONTENT_EXPORT FrameTreeNode {
 
   unsigned int depth() const { return depth_; }
 
-  FrameTreeNode* parent() const { return parent_; }
+  RenderFrameHostImpl* parent() const { return parent_; }
 
   FrameTreeNode* opener() const { return opener_; }
 
@@ -343,7 +347,7 @@ class CONTENT_EXPORT FrameTreeNode {
   // pending_frame_policy() for those. To see the flags which will take effect
   // on navigation (which does not include the CSP-set flags), use
   // effective_frame_policy().
-  blink::mojom::WebSandboxFlags active_sandbox_flags() const {
+  network::mojom::WebSandboxFlags active_sandbox_flags() const {
     return replication_state_.active_sandbox_flags;
   }
 
@@ -354,7 +358,7 @@ class CONTENT_EXPORT FrameTreeNode {
   // will be cleared, and the flags in the pending frame policy will be applied
   // to the frame.
   void UpdateFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::ParsedFeaturePolicy& parsed_header);
 
   // Returns whether the frame received a user gesture.
@@ -399,7 +403,7 @@ class CONTENT_EXPORT FrameTreeNode {
   // will never be reused - this saves memory.
   void PruneChildFrameNavigationEntries(NavigationEntryImpl* entry);
 
-  blink::FrameOwnerElementType frame_owner_element_type() const {
+  blink::mojom::FrameOwnerElementType frame_owner_element_type() const {
     return replication_state_.frame_owner_element_type;
   }
   // Only meaningful to call on a root frame. The value of |feature_state| will
@@ -408,18 +412,6 @@ class CONTENT_EXPORT FrameTreeNode {
   void SetOpenerFeaturePolicyState(
       const blink::FeaturePolicy::FeatureState& feature_state);
 
-  // Returns the embedding token for the frame. A frame is embedded if it is the
-  // child to a parent frame that is cross-process. As such, this will return
-  // base::nullopt for:
-  // - The main frame.
-  // - Child frames that are in the same process as their parent.
-  const base::Optional<base::UnguessableToken>& GetEmbeddingToken() const;
-
-  // Called by NavigationImpl::DidNavigate() on completion of a navigation to
-  // update the embedding token for the frame.
-  void SetEmbeddingToken(
-      const base::Optional<base::UnguessableToken>& embedding_token);
-
   void SetAdFrameType(blink::mojom::AdFrameType ad_frame_type);
 
  private:
@@ -462,8 +454,9 @@ class CONTENT_EXPORT FrameTreeNode {
   // even if the frame does a cross-process navigation.
   const int frame_tree_node_id_;
 
-  // The parent node of this frame. |nullptr| if this node is the root.
-  FrameTreeNode* const parent_;
+  // The RenderFrameHost owning this FrameTreeNode, which cannot change for the
+  // life of this FrameTreeNode. |nullptr| if this node is the root.
+  RenderFrameHostImpl* const parent_;
 
   // Number of edges from this node to the root. 0 if this is the root.
   const unsigned int depth_;
@@ -521,13 +514,6 @@ class CONTENT_EXPORT FrameTreeNode {
   // to look up the FrameTreeNode instance.
   base::UnguessableToken devtools_frame_token_;
 
-  // A token tracking the embedding relationship between a out-of-process
-  // frames. This is only accessible by the renderer for the active
-  // RenderFrameHost and the renderer for the RenderFrameProxyHost from
-  // RenderFrameProxyHostManager::GetProxyToParent(). Should only be set
-  // if the frame is embedded in a parent frame.
-  base::Optional<base::UnguessableToken> embedding_token_;
-
   // Tracks the scrolling and margin properties for this frame.  These
   // properties affect the child renderer but are stored on its parent's
   // frame element.  When this frame's parent dynamically updates these
diff --git a/chromium/content/browser/frame_host/frame_tree_node_blame_context_unittest.cc b/chromium/content/browser/frame_host/frame_tree_node_blame_context_unittest.cc
index ce202add002..02a4159f8b9 100644
--- a/chromium/content/browser/frame_host/frame_tree_node_blame_context_unittest.cc
+++ b/chromium/content/browser/frame_host/frame_tree_node_blame_context_unittest.cc
@@ -98,14 +98,14 @@ class FrameTreeNodeBlameContextTest : public RenderViewHostImplTestHarness {
     for (int child_num = 1; shape[consumption++] == '('; ++child_num) {
       int child_id = self_id * 10 + child_num;
       tree()->AddFrame(
-          node, process_id(), child_id,
+          node->current_frame_host(), process_id(), child_id,
           TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
           TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-          blink::WebTreeScopeType::kDocument, std::string(),
+          blink::mojom::TreeScopeType::kDocument, std::string(),
           base::StringPrintf("uniqueName%d", child_id), false,
-          base::UnguessableToken::Create(), blink::FramePolicy(),
-          blink::mojom::FrameOwnerProperties(), false,
-          blink::FrameOwnerElementType::kIframe);
+          base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+          blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+          blink::mojom::FrameOwnerElementType::kIframe);
       FrameTreeNode* child = node->child_at(child_num - 1);
       consumption += CreateSubframes(child, child_id, shape + consumption);
     }
@@ -153,7 +153,7 @@ TEST_F(FrameTreeNodeBlameContextTest, FrameCreation) {
       snapshot_traced.insert(node);
       std::string parent_id = GetParentNodeID(event);
       EXPECT_FALSE(parent_id.empty());
-      EXPECT_EQ(node->parent(),
+      EXPECT_EQ(node->parent()->frame_tree_node(),
                 tree()->FindByID(strtol(parent_id.c_str(), nullptr, 16)));
     } else {
       EXPECT_EQ(TRACE_EVENT_PHASE_CREATE_OBJECT, event->phase);
diff --git a/chromium/content/browser/frame_host/frame_tree_unittest.cc b/chromium/content/browser/frame_host/frame_tree_unittest.cc
index 8b7b4bad70f..1feeb329e21 100644
--- a/chromium/content/browser/frame_host/frame_tree_unittest.cc
+++ b/chromium/content/browser/frame_host/frame_tree_unittest.cc
@@ -9,7 +9,7 @@
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
-#include "content/browser/frame_host/navigator_impl.h"
+#include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
@@ -168,44 +168,50 @@ TEST_F(FrameTreeTest, Shape) {
   // frame liveness.
   EXPECT_EQ("1: []", GetTreeState(frame_tree));
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Simulate attaching a series of frames to build the frame tree.
-  frame_tree->AddFrame(
-      root, process_id, 14, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      root, process_id, 15, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      root, process_id, 16, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      root->child_at(0), process_id, 244, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName3", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      root->child_at(1), process_id, 255, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, no_children_node, "uniqueName4",
-      false, base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      root->child_at(0), process_id, 245, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName5", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->current_frame_host(), process_id, 14,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName0", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->current_frame_host(), process_id, 15,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName1", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->current_frame_host(), process_id, 16,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName2", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->child_at(0)->current_frame_host(), process_id, 244,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName3", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->child_at(1)->current_frame_host(), process_id, 255,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, no_children_node,
+                       "uniqueName4", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(root->child_at(0)->current_frame_host(), process_id, 245,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName5", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
 
   EXPECT_EQ(
       "1: [14: [244: [], 245: []], "
@@ -214,65 +220,73 @@ TEST_F(FrameTreeTest, Shape) {
       GetTreeState(frame_tree));
 
   FrameTreeNode* child_16 = root->child_at(2);
-  frame_tree->AddFrame(
-      child_16, process_id, 264, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName6", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      child_16, process_id, 265, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName7", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      child_16, process_id, 266, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName8", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      child_16, process_id, 267, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, deep_subtree, "uniqueName9", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(
-      child_16, process_id, 268, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName10", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-
-  FrameTreeNode* child_267 = child_16->child_at(3);
-  frame_tree->AddFrame(
-      child_267, process_id, 365, CreateStubInterfaceProviderReceiver(),
-      CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName11", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(child_267->child_at(0), process_id, 455,
+  frame_tree->AddFrame(child_16->current_frame_host(), process_id, 264,
                        CreateStubInterfaceProviderReceiver(),
                        CreateStubBrowserInterfaceBrokerReceiver(),
-                       blink::WebTreeScopeType::kDocument, std::string(),
-                       "uniqueName12", false, base::UnguessableToken::Create(),
-                       blink::FramePolicy(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName6", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(child_16->current_frame_host(), process_id, 265,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName7", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
                        blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(child_267->child_at(0)->child_at(0), process_id, 555,
+  frame_tree->AddFrame(child_16->current_frame_host(), process_id, 266,
                        CreateStubInterfaceProviderReceiver(),
                        CreateStubBrowserInterfaceBrokerReceiver(),
-                       blink::WebTreeScopeType::kDocument, std::string(),
-                       "uniqueName13", false, base::UnguessableToken::Create(),
-                       blink::FramePolicy(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName8", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
                        blink::mojom::FrameOwnerProperties(), false, kOwnerType);
-  frame_tree->AddFrame(child_267->child_at(0)->child_at(0)->child_at(0),
-                       process_id, 655, CreateStubInterfaceProviderReceiver(),
+  frame_tree->AddFrame(child_16->current_frame_host(), process_id, 267,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, deep_subtree,
+                       "uniqueName9", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(child_16->current_frame_host(), process_id, 268,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName10", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+
+  FrameTreeNode* child_267 = child_16->child_at(3);
+  frame_tree->AddFrame(child_267->current_frame_host(), process_id, 365,
+                       CreateStubInterfaceProviderReceiver(),
+                       CreateStubBrowserInterfaceBrokerReceiver(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName11", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
+                       blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(child_267->child_at(0)->current_frame_host(), process_id,
+                       455, CreateStubInterfaceProviderReceiver(),
                        CreateStubBrowserInterfaceBrokerReceiver(),
-                       blink::WebTreeScopeType::kDocument, std::string(),
-                       "uniqueName14", false, base::UnguessableToken::Create(),
-                       blink::FramePolicy(),
+                       blink::mojom::TreeScopeType::kDocument, std::string(),
+                       "uniqueName12", false, base::UnguessableToken::Create(),
+                       base::UnguessableToken::Create(), blink::FramePolicy(),
                        blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+  frame_tree->AddFrame(
+      child_267->child_at(0)->child_at(0)->current_frame_host(), process_id,
+      555, CreateStubInterfaceProviderReceiver(),
+      CreateStubBrowserInterfaceBrokerReceiver(),
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName13",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
+  frame_tree->AddFrame(
+      child_267->child_at(0)->child_at(0)->child_at(0)->current_frame_host(),
+      process_id, 655, CreateStubInterfaceProviderReceiver(),
+      CreateStubBrowserInterfaceBrokerReceiver(),
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName14",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
 
   // Now that's it's fully built, verify the tree structure is as expected.
   EXPECT_EQ(
@@ -343,25 +357,25 @@ TEST_F(FrameTreeTest, FindFrames) {
   FrameTree* frame_tree = contents()->GetFrameTree();
   FrameTreeNode* root = frame_tree->root();
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   main_test_rfh()->OnCreateChildFrame(
       22, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "child0", "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "child0", "uniqueName0", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       23, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "child1", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "child1", "uniqueName1", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       24, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName2",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   FrameTreeNode* child0 = root->child_at(0);
   FrameTreeNode* child1 = root->child_at(1);
   FrameTreeNode* child2 = root->child_at(2);
@@ -370,9 +384,9 @@ TEST_F(FrameTreeTest, FindFrames) {
   child1->current_frame_host()->OnCreateChildFrame(
       33, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "grandchild", "uniqueName3", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "grandchild", "uniqueName3",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   FrameTreeNode* grandchild = child1->child_at(0);
 
   // Ensure they can be found by FTN id.
@@ -405,28 +419,28 @@ TEST_F(FrameTreeTest, FindFrames) {
 TEST_F(FrameTreeTest, GetSibling) {
   main_test_rfh()->InitializeRenderFrameIfNeeded();
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Add a few child frames to the main frame.
   FrameTree* frame_tree = contents()->GetFrameTree();
   FrameTreeNode* root = frame_tree->root();
   main_test_rfh()->OnCreateChildFrame(
       22, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "child0", "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "child0", "uniqueName0", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       23, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "child1", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "child1", "uniqueName1", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       24, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "child2", "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "child2", "uniqueName2", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   FrameTreeNode* child0 = root->child_at(0);
   FrameTreeNode* child1 = root->child_at(1);
   FrameTreeNode* child2 = root->child_at(2);
@@ -435,9 +449,9 @@ TEST_F(FrameTreeTest, GetSibling) {
   child1->current_frame_host()->OnCreateChildFrame(
       33, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "grandchild", "uniqueName3", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "grandchild", "uniqueName3",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   FrameTreeNode* grandchild = child1->child_at(0);
 
   // Test PreviousSibling().
@@ -465,14 +479,14 @@ TEST_F(FrameTreeTest, ObserverWalksTreeDuringFrameCreation) {
   FrameTree* frame_tree = contents()->GetFrameTree();
   FrameTreeNode* root = frame_tree->root();
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Simulate attaching a series of frames to build the frame tree.
   main_test_rfh()->OnCreateChildFrame(
       14, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName0",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   EXPECT_EQ(
       "RenderFrameHostChanged(new)(14) -> 1: []\n"
       "RenderFrameCreated(14) -> 1: [14: []]",
@@ -480,9 +494,9 @@ TEST_F(FrameTreeTest, ObserverWalksTreeDuringFrameCreation) {
   main_test_rfh()->OnCreateChildFrame(
       18, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   EXPECT_EQ(
       "RenderFrameHostChanged(new)(18) -> 1: [14: []]\n"
       "RenderFrameCreated(18) -> 1: [14: [], 18: []]",
@@ -500,13 +514,13 @@ TEST_F(FrameTreeTest, ObserverWalksTreeAfterCrash) {
   contents()->NavigateAndCommit(GURL("http://www.google.com"));
   EXPECT_EQ("RenderFrameCreated(1) -> 1: []", activity.GetLog());
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   main_test_rfh()->OnCreateChildFrame(
       22, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName0",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   EXPECT_EQ(
       "RenderFrameHostChanged(new)(22) -> 1: []\n"
       "RenderFrameCreated(22) -> 1: [22: []]",
@@ -514,9 +528,9 @@ TEST_F(FrameTreeTest, ObserverWalksTreeAfterCrash) {
   main_test_rfh()->OnCreateChildFrame(
       23, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   EXPECT_EQ(
       "RenderFrameHostChanged(new)(23) -> 1: [22: []]\n"
       "RenderFrameCreated(23) -> 1: [22: [], 23: []]",
@@ -544,12 +558,13 @@ TEST_F(FrameTreeTest, FailAddFrameWithWrongProcessId) {
 
   // Simulate attaching a frame from mismatched process id.
   ASSERT_FALSE(frame_tree->AddFrame(
-      root, process_id + 1, 1, CreateStubInterfaceProviderReceiver(),
+      root->current_frame_host(), process_id + 1, 1,
+      CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false,
-      blink::FrameOwnerElementType::kIframe));
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName0",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      blink::mojom::FrameOwnerElementType::kIframe));
   ASSERT_EQ("1: []", GetTreeState(frame_tree));
 }
 
@@ -561,28 +576,28 @@ TEST_F(FrameTreeTest, ProcessCrashClearsGlobalMap) {
   // Add a couple child frames to the main frame.
   FrameTreeNode* root = contents()->GetFrameTree()->root();
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   main_test_rfh()->OnCreateChildFrame(
       22, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName0",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       23, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
 
   // Add one grandchild frame.
   RenderFrameHostImpl* child1_rfh = root->child_at(0)->current_frame_host();
   child1_rfh->OnCreateChildFrame(
       33, CreateStubInterfaceProviderReceiver(),
       CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName2",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
 
   // Ensure they can be found by id.
   int id1 = root->child_at(0)->frame_tree_node_id();
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl.cc b/chromium/content/browser/frame_host/interstitial_page_impl.cc
deleted file mode 100644
index 72f9b6d5823..00000000000
--- a/chromium/content/browser/frame_host/interstitial_page_impl.cc
+++ /dev/null
@@ -1,1107 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/interstitial_page_impl.h"
-
-#include <map>
-#include <string>
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "base/compiler_specific.h"
-#include "base/location.h"
-#include "base/macros.h"
-#include "base/memory/ptr_util.h"
-#include "base/metrics/user_metrics.h"
-#include "base/single_thread_task_runner.h"
-#include "base/strings/string_util.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/threading/thread.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "base/unguessable_token.h"
-#include "build/build_config.h"
-#include "content/browser/dom_storage/dom_storage_context_wrapper.h"
-#include "content/browser/dom_storage/session_storage_namespace_impl.h"
-#include "content/browser/frame_host/interstitial_page_navigator_impl.h"
-#include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/browser/renderer_host/display_util.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/renderer_host/render_view_host_delegate_view.h"
-#include "content/browser/renderer_host/render_view_host_factory.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
-#include "content/browser/renderer_host/render_widget_host_view_base.h"
-#include "content/browser/renderer_host/text_input_manager.h"
-#include "content/browser/site_instance_impl.h"
-#include "content/browser/web_contents/web_contents_impl.h"
-#include "content/browser/web_contents/web_contents_view.h"
-#include "content/common/buildflags.h"
-#include "content/common/frame_messages.h"
-#include "content/common/view_messages.h"
-#include "content/public/browser/browser_context.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/content_browser_client.h"
-#include "content/public/browser/interstitial_page_delegate.h"
-#include "content/public/browser/invalidate_type.h"
-#include "content/public/browser/keyboard_event_processing_result.h"
-#include "content/public/browser/notification_service.h"
-#include "content/public/browser/notification_source.h"
-#include "content/public/browser/notification_types.h"
-#include "content/public/browser/storage_partition.h"
-#include "content/public/browser/web_contents_delegate.h"
-#include "content/public/common/bindings_policy.h"
-#include "net/base/escape.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "ui/base/page_transition_types.h"
-
-using blink::WebDragOperation;
-using blink::WebDragOperationsMask;
-
-namespace content {
-
-namespace {
-
-const blink::UserAgentOverride& NoUAOverride() {
-  static const base::NoDestructor<blink::UserAgentOverride> no_ua_override;
-  return *no_ua_override;
-}
-
-}  // namespace
-
-class InterstitialPageImpl::InterstitialPageRVHDelegateView
-    : public RenderViewHostDelegateView {
- public:
-  explicit InterstitialPageRVHDelegateView(InterstitialPageImpl* page);
-
-  // RenderViewHostDelegateView implementation:
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void ShowPopupMenu(RenderFrameHost* render_frame_host,
-                     const gfx::Rect& bounds,
-                     int item_height,
-                     double item_font_size,
-                     int selected_item,
-                     const std::vector<MenuItem>& items,
-                     bool right_aligned,
-                     bool allow_multiple_selection) override;
-  void HidePopupMenu() override;
-#endif
-  void StartDragging(const DropData& drop_data,
-                     WebDragOperationsMask operations_allowed,
-                     const gfx::ImageSkia& image,
-                     const gfx::Vector2d& image_offset,
-                     const DragEventSourceInfo& event_info,
-                     RenderWidgetHostImpl* source_rwh) override;
-  void UpdateDragCursor(WebDragOperation operation) override;
-  void GotFocus(RenderWidgetHostImpl* render_widget_host) override;
-  void LostFocus(RenderWidgetHostImpl* render_widget_host) override;
-  void TakeFocus(bool reverse) override;
-  int GetTopControlsHeight() const override;
-  int GetBottomControlsHeight() const override;
-  bool DoBrowserControlsShrinkRendererSize() const override;
-  virtual void OnFindReply(int request_id,
-                           int number_of_matches,
-                           const gfx::Rect& selection_rect,
-                           int active_match_ordinal,
-                           bool final_update);
-
- private:
-  InterstitialPageImpl* interstitial_page_;
-
-  DISALLOW_COPY_AND_ASSIGN(InterstitialPageRVHDelegateView);
-};
-
-// We keep a map of the various blocking pages shown as the UI tests need to
-// be able to retrieve them.
-typedef std::map<WebContents*, InterstitialPageImpl*> InterstitialPageMap;
-static InterstitialPageMap* g_web_contents_to_interstitial_page;
-
-// Initializes g_web_contents_to_interstitial_page in a thread-safe manner.
-// Should be called before accessing g_web_contents_to_interstitial_page.
-static void InitInterstitialPageMap() {
-  if (!g_web_contents_to_interstitial_page)
-    g_web_contents_to_interstitial_page = new InterstitialPageMap;
-}
-
-InterstitialPage* InterstitialPage::Create(WebContents* web_contents,
-                                           bool new_navigation,
-                                           const GURL& url,
-                                           InterstitialPageDelegate* delegate) {
-  return new InterstitialPageImpl(
-      web_contents,
-      static_cast<RenderWidgetHostDelegate*>(
-          static_cast<WebContentsImpl*>(web_contents)),
-      new_navigation, url, delegate);
-}
-
-InterstitialPage* InterstitialPage::GetInterstitialPage(
-    WebContents* web_contents) {
-  InitInterstitialPageMap();
-  InterstitialPageMap::const_iterator iter =
-      g_web_contents_to_interstitial_page->find(web_contents);
-  if (iter == g_web_contents_to_interstitial_page->end())
-    return nullptr;
-
-  return iter->second;
-}
-
-InterstitialPage* InterstitialPage::FromRenderFrameHost(RenderFrameHost* rfh) {
-  if (!rfh)
-    return nullptr;
-  return static_cast<RenderFrameHostImpl*>(rfh)
-      ->delegate()
-      ->GetAsInterstitialPage();
-}
-
-InterstitialPageImpl::InterstitialPageImpl(
-    WebContents* web_contents,
-    RenderWidgetHostDelegate* render_widget_host_delegate,
-    bool new_navigation,
-    const GURL& url,
-    InterstitialPageDelegate* delegate)
-    : underlying_content_observer_(web_contents, this),
-      web_contents_(web_contents),
-      controller_(static_cast<NavigationControllerImpl*>(
-          &web_contents->GetController())),
-      render_widget_host_delegate_(render_widget_host_delegate),
-      url_(url),
-      new_navigation_(new_navigation),
-      should_discard_pending_nav_entry_(new_navigation),
-      enabled_(true),
-      action_taken_(NO_ACTION),
-      render_view_host_(nullptr),
-      // TODO(nasko): The InterstitialPageImpl will need to provide its own
-      // NavigationControllerImpl to the Navigator, which is separate from
-      // the WebContents one, so we can enforce no navigation policy here.
-      // While we get the code to a point to do this, pass NULL for it.
-      // TODO(creis): We will also need to pass delegates for the RVHM as we
-      // start to use it.
-      frame_tree_(std::make_unique<FrameTree>(
-          new InterstitialPageNavigatorImpl(this, controller_),
-          this,
-          this,
-          this,
-          static_cast<WebContentsImpl*>(web_contents))),
-      original_child_id_(
-          web_contents->GetRenderViewHost()->GetProcess()->GetID()),
-      original_rvh_id_(web_contents->GetRenderViewHost()->GetRoutingID()),
-      should_revert_web_contents_title_(false),
-      resource_dispatcher_host_notified_(false),
-      rvh_delegate_view_(new InterstitialPageRVHDelegateView(this)),
-      create_view_(true),
-      pause_throbber_(false),
-      delegate_(delegate) {
-  InitInterstitialPageMap();
-}
-
-InterstitialPageImpl::~InterstitialPageImpl() {
-  // RenderViewHostImpl::RenderWidgetLostFocus() will be eventually executed in
-  // the destructor of FrameTree. It uses InterstitialPageRVHDelegate, which
-  // will be deleted because std::unique_ptr<InterstitialPageRVHDelegateView> is
-  // placed after frame_tree_. See bug http://crbug.com/725594.
-  frame_tree_.reset();
-}
-
-void InterstitialPageImpl::Show() {
-  if (!enabled())
-    return;
-
-  // If an interstitial is already showing or about to be shown, close it before
-  // showing the new one.
-  // Be careful not to take an action on the old interstitial more than once.
-  InterstitialPageMap::const_iterator iter =
-      g_web_contents_to_interstitial_page->find(web_contents_);
-  if (iter != g_web_contents_to_interstitial_page->end()) {
-    InterstitialPageImpl* interstitial = iter->second;
-    if (interstitial->action_taken_ != NO_ACTION) {
-      interstitial->Hide();
-    } else {
-      // If we are currently showing an interstitial page for which we created
-      // a transient entry and a new interstitial is shown as the result of a
-      // new browser initiated navigation, then that transient entry has already
-      // been discarded and a new pending navigation entry created.
-      // So we should not discard that new pending navigation entry.
-      // See http://crbug.com/9791
-      if (new_navigation_ && interstitial->new_navigation_)
-        interstitial->should_discard_pending_nav_entry_ = false;
-      interstitial->DontProceed();
-    }
-  }
-
-  // Block the resource requests for the render view host while it is hidden.
-  TakeActionOnResourceDispatcher(BLOCK);
-  // We need to be notified when the RenderViewHost is destroyed so we can
-  // cancel the blocked requests.  We cannot do that on
-  // NOTIFY_WEB_CONTENTS_DESTROYED as at that point the RenderViewHost has
-  // already been destroyed.
-  widget_observer_.Add(
-      controller_->delegate()->GetRenderViewHost()->GetWidget());
-
-  // Update the g_web_contents_to_interstitial_page map.
-  iter = g_web_contents_to_interstitial_page->find(web_contents_);
-  DCHECK(iter == g_web_contents_to_interstitial_page->end());
-  (*g_web_contents_to_interstitial_page)[web_contents_] = this;
-
-  if (new_navigation_) {
-    std::unique_ptr<NavigationEntryImpl> entry =
-        base::WrapUnique(new NavigationEntryImpl);
-    entry->SetURL(url_);
-    entry->SetVirtualURL(url_);
-    entry->set_page_type(PAGE_TYPE_INTERSTITIAL);
-
-    // Give delegates a chance to set some states on the navigation entry.
-    delegate_->OverrideEntry(entry.get());
-
-    controller_->SetTransientEntry(std::move(entry));
-
-    static_cast<WebContentsImpl*>(web_contents_)
-        ->DidChangeVisibleSecurityState();
-  }
-
-  DCHECK(!render_view_host_);
-  render_view_host_ = CreateRenderViewHost();
-  CreateWebContentsView();
-
-  GURL data_url = GURL("data:text/html;charset=utf-8," +
-                       net::EscapePath(delegate_->GetHTMLContents()));
-  frame_tree_->root()->current_frame_host()->NavigateToInterstitialURL(
-      data_url);
-  frame_tree_->root()->current_frame_host()->UpdateAccessibilityMode();
-
-  notification_registrar_.Add(this, NOTIFICATION_NAV_ENTRY_PENDING,
-                              Source<NavigationController>(controller_));
-}
-
-void InterstitialPageImpl::Hide() {
-  // We may have already been hidden, and are just waiting to be deleted.
-  // We can't check for enabled() here, because some callers have already
-  // called Disable.
-  if (!render_view_host_)
-    return;
-
-  Disable();
-
-  RenderWidgetHostView* old_view =
-      controller_->delegate()->GetRenderViewHost()->GetWidget()->GetView();
-  if (controller_->delegate()->GetInterstitialPage() == this && old_view &&
-      !old_view->IsShowing() && !controller_->delegate()->IsHidden()) {
-    // Show the original RVH since we're going away.  Note it might not exist if
-    // the renderer crashed while the interstitial was showing.
-    // Note that it is important that we don't call Show() if the view is
-    // already showing. That would result in bad things (unparented HWND on
-    // Windows for example) happening.
-    old_view->Show();
-  }
-
-  // Delete this and call Shutdown on the RVH asynchronously, as we may have
-  // been called from a RVH delegate method, and we can't delete the RVH out
-  // from under itself.
-  base::ThreadTaskRunnerHandle::Get()->PostNonNestableTask(
-      FROM_HERE, base::BindOnce(&InterstitialPageImpl::Shutdown,
-                                weak_ptr_factory_.GetWeakPtr()));
-  bool has_focus = render_view_host_->GetWidget()->GetView() &&
-                   render_view_host_->GetWidget()->GetView()->HasFocus();
-  render_view_host_ = nullptr;
-  frame_tree_->root()->current_frame_host()->ResetChildren();
-  controller_->delegate()->DetachInterstitialPage(has_focus);
-  // Let's revert to the original title if necessary.
-  NavigationEntry* entry = controller_->GetVisibleEntry();
-  if (entry && !new_navigation_ && should_revert_web_contents_title_)
-    web_contents_->UpdateTitleForEntry(entry, original_web_contents_title_);
-
-  static_cast<WebContentsImpl*>(web_contents_)->DidChangeVisibleSecurityState();
-
-  auto iter = g_web_contents_to_interstitial_page->find(web_contents_);
-  DCHECK(iter != g_web_contents_to_interstitial_page->end());
-  if (iter != g_web_contents_to_interstitial_page->end())
-    g_web_contents_to_interstitial_page->erase(iter);
-
-  // Clear the WebContents pointer, because it may now be deleted.
-  // This signifies that we are in the process of shutting down.
-  web_contents_ = nullptr;
-}
-
-void InterstitialPageImpl::RenderWidgetHostDestroyed(
-    content::RenderWidgetHost* widget_host) {
-  widget_observer_.Remove(widget_host);
-  if (action_taken_ == NO_ACTION) {
-    // The RenderViewHost is being destroyed (as part of the tab being
-    // closed); make sure we clear the blocked requests.
-    RenderViewHost* rvh = RenderViewHost::From(widget_host);
-    DCHECK(rvh->GetProcess()->GetID() == original_child_id_ &&
-           rvh->GetRoutingID() == original_rvh_id_);
-    TakeActionOnResourceDispatcher(CANCEL);
-  }
-}
-
-void InterstitialPageImpl::Observe(int type,
-                                   const NotificationSource& source,
-                                   const NotificationDetails& details) {
-  switch (type) {
-    case NOTIFICATION_NAV_ENTRY_PENDING:
-      // We are navigating away from the interstitial (the user has typed a URL
-      // in the location bar or clicked a bookmark).  Make sure clicking on the
-      // interstitial will have no effect.  Also cancel any blocked requests
-      // on the ResourceDispatcherHost.  Note that when we get this notification
-      // the RenderViewHost has not yet navigated so we'll unblock the
-      // RenderViewHost before the resource request for the new page we are
-      // navigating arrives in the ResourceDispatcherHost.  This ensures that
-      // request won't be blocked if the same RenderViewHost was used for the
-      // new navigation.
-      Disable();
-      TakeActionOnResourceDispatcher(CANCEL);
-      break;
-    default:
-      NOTREACHED();
-  }
-}
-
-bool InterstitialPageImpl::OnMessageReceived(
-    RenderFrameHostImpl* render_frame_host,
-    const IPC::Message& message) {
-  if (render_frame_host->GetRenderViewHost() != render_view_host_) {
-    DCHECK(!render_view_host_)
-        << "We expect an interstitial page to have only a single RVH";
-    return false;
-  }
-
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(InterstitialPageImpl, message,
-                                   render_frame_host)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DomOperationResponse,
-                        OnDomOperationResponse)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-
-  return handled;
-}
-
-bool InterstitialPageImpl::OnMessageReceived(
-    RenderViewHostImpl* render_view_host,
-    const IPC::Message& message) {
-  return false;
-}
-
-void InterstitialPageImpl::RenderFrameCreated(
-    RenderFrameHost* render_frame_host) {
-  // Note this is only for subframes in the interstitial, the notification for
-  // the main frame happens in RenderViewCreated.
-  controller_->delegate()->RenderFrameForInterstitialPageCreated(
-      render_frame_host);
-}
-
-void InterstitialPageImpl::UpdateTitle(
-    RenderFrameHost* render_frame_host,
-    const base::string16& title,
-    base::i18n::TextDirection title_direction) {
-  if (!enabled())
-    return;
-
-  RenderViewHost* render_view_host = render_frame_host->GetRenderViewHost();
-  DCHECK(render_view_host == render_view_host_);
-  NavigationEntry* entry = controller_->GetVisibleEntry();
-  if (!entry) {
-    // There may be no visible entry if no URL has committed (e.g., after
-    // window.open("")).  InterstitialPages with the new_navigation flag create
-    // a transient NavigationEntry and thus have a visible entry.  However,
-    // interstitials can still be created when there is no visible entry.  For
-    // example, the opener window may inject content into the initial blank
-    // page, which might trigger a SafeBrowsingBlockingPage.
-    return;
-  }
-
-  // If this interstitial is shown on an existing navigation entry, we'll need
-  // to remember its title so we can revert to it when hidden.
-  if (!new_navigation_ && !should_revert_web_contents_title_) {
-    original_web_contents_title_ = entry->GetTitle();
-    should_revert_web_contents_title_ = true;
-  }
-  // TODO(evan): make use of title_direction.
-  // http://code.google.com/p/chromium/issues/detail?id=27094
-  web_contents_->UpdateTitleForEntry(entry, title);
-}
-
-InterstitialPage* InterstitialPageImpl::GetAsInterstitialPage() {
-  return this;
-}
-
-ui::AXMode InterstitialPageImpl::GetAccessibilityMode() {
-  if (web_contents_)
-    return static_cast<WebContentsImpl*>(web_contents_)->GetAccessibilityMode();
-  else
-    return ui::AXMode();
-}
-
-void InterstitialPageImpl::Cut() {
-  auto* input_handler = GetFocusedFrameInputHandler();
-  if (!input_handler)
-    return;
-  input_handler->Cut();
-  RecordAction(base::UserMetricsAction("Cut"));
-}
-
-void InterstitialPageImpl::ExecuteEditCommand(
-    const std::string& command,
-    const base::Optional<base::string16>& value) {
-  auto* input_handler = GetFocusedFrameInputHandler();
-  if (!input_handler)
-    return;
-  input_handler->ExecuteEditCommand(command, value);
-}
-
-void InterstitialPageImpl::Copy() {
-  auto* input_handler = GetFocusedFrameInputHandler();
-  if (!input_handler)
-    return;
-  input_handler->Copy();
-  RecordAction(base::UserMetricsAction("Copy"));
-}
-
-void InterstitialPageImpl::Paste() {
-  auto* input_handler = GetFocusedFrameInputHandler();
-  if (!input_handler)
-    return;
-  input_handler->Paste();
-  RecordAction(base::UserMetricsAction("Paste"));
-}
-
-void InterstitialPageImpl::SelectAll() {
-  auto* input_handler = GetFocusedFrameInputHandler();
-  if (!input_handler)
-    return;
-  input_handler->SelectAll();
-  RecordAction(base::UserMetricsAction("SelectAll"));
-}
-
-RenderViewHostDelegateView* InterstitialPageImpl::GetDelegateView() {
-  return rvh_delegate_view_.get();
-}
-
-WebContents* InterstitialPageImpl::GetWebContents() {
-  return web_contents();
-}
-
-const GURL& InterstitialPageImpl::GetMainFrameLastCommittedURL() {
-  return url_;
-}
-
-void InterstitialPageImpl::RenderViewTerminated(
-    RenderViewHost* render_view_host,
-    base::TerminationStatus status,
-    int error_code) {
-  // Our renderer died. This should not happen in normal cases.
-  // If we haven't already started shutdown, just dismiss the interstitial.
-  // We cannot check for enabled() here, because we may have called Disable
-  // without calling Hide.
-  if (render_view_host_)
-    DontProceed();
-}
-
-void InterstitialPageImpl::DidNavigate(
-    RenderViewHost* render_view_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {
-  // A fast user could have navigated away from the page that triggered the
-  // interstitial while the interstitial was loading, that would have disabled
-  // us. In that case we can dismiss ourselves.
-  if (!enabled()) {
-    DontProceed();
-    return;
-  }
-  if (ui::PageTransitionCoreTypeIs(params.transition,
-                                   ui::PAGE_TRANSITION_AUTO_SUBFRAME)) {
-    // No need to handle navigate message from iframe in the interstitial page.
-    return;
-  }
-
-  // The interstitial is not loading anymore so stop the throbber.
-  pause_throbber_ = true;
-
-  // The RenderViewHost has loaded its contents, we can show it now.
-  if (!controller_->delegate()->IsHidden())
-    render_view_host_->GetWidget()->GetView()->Show();
-  controller_->delegate()->AttachInterstitialPage(this);
-  render_view_host_->GetWidget()->GetView()->OnInterstitialPageAttached();
-
-  RenderWidgetHostView* rwh_view =
-      controller_->delegate()->GetRenderViewHost()->GetWidget()->GetView();
-
-  // The RenderViewHost may already have crashed before we even get here.
-  if (rwh_view) {
-    // If the page has focus, focus the interstitial.
-    if (rwh_view->HasFocus())
-      Focus();
-
-    // Hide the original RVH since we're showing the interstitial instead.
-    rwh_view->Hide();
-  }
-}
-
-WebContents* InterstitialPageImpl::OpenURL(const OpenURLParams& params) {
-  NOTREACHED();
-  return nullptr;
-}
-
-const blink::UserAgentOverride& InterstitialPageImpl::GetUserAgentOverride() {
-  return NoUAOverride();
-}
-
-bool InterstitialPageImpl::ShouldOverrideUserAgentInNewTabs() {
-  return false;
-}
-
-blink::mojom::RendererPreferences InterstitialPageImpl::GetRendererPrefs(
-    BrowserContext* browser_context) const {
-  delegate_->OverrideRendererPrefs(&renderer_preferences_);
-  return renderer_preferences_;
-}
-
-void InterstitialPageImpl::RenderWidgetDeleted(
-    RenderWidgetHostImpl* render_widget_host) {
-  // TODO(creis): Remove this method once we verify the shutdown path is sane.
-  CHECK(!web_contents_);
-}
-
-KeyboardEventProcessingResult InterstitialPageImpl::PreHandleKeyboardEvent(
-    const NativeWebKeyboardEvent& event) {
-  if (!enabled())
-    return KeyboardEventProcessingResult::NOT_HANDLED;
-  return render_widget_host_delegate_->PreHandleKeyboardEvent(event);
-}
-
-bool InterstitialPageImpl::PreHandleMouseEvent(
-    const blink::WebMouseEvent& event) {
-  if (!enabled())
-    return false;
-
-  if (event.GetType() == blink::WebInputEvent::Type::kMouseUp &&
-      event.button == blink::WebPointerProperties::Button::kBack &&
-      controller_->CanGoBack()) {
-    controller_->GoBack();
-    return true;
-  }
-  return false;
-}
-
-bool InterstitialPageImpl::HandleKeyboardEvent(
-    const NativeWebKeyboardEvent& event) {
-  return enabled() && render_widget_host_delegate_->HandleKeyboardEvent(event);
-}
-
-WebContents* InterstitialPageImpl::web_contents() const {
-  return web_contents_;
-}
-
-RenderViewHostImpl* InterstitialPageImpl::CreateRenderViewHost() {
-  if (!enabled())
-    return nullptr;
-
-  // Interstitial pages don't want to share the session storage so we mint a
-  // new one.
-  BrowserContext* browser_context = web_contents()->GetBrowserContext();
-  scoped_refptr<SiteInstance> site_instance =
-      SiteInstance::Create(browser_context);
-  DOMStorageContextWrapper* dom_storage_context =
-      static_cast<DOMStorageContextWrapper*>(
-          BrowserContext::GetStoragePartition(browser_context,
-                                              site_instance.get())
-              ->GetDOMStorageContext());
-  session_storage_namespace_ =
-      SessionStorageNamespaceImpl::Create(dom_storage_context);
-
-  // Use the RenderViewHost from our FrameTree.
-  frame_tree_->root()->render_manager()->InitRoot(
-      site_instance.get(),
-      /*renderer_initiated_creation=*/false);
-  return frame_tree_->root()->current_frame_host()->render_view_host();
-}
-
-WebContentsView* InterstitialPageImpl::CreateWebContentsView() {
-  if (!enabled() || !create_view_)
-    return nullptr;
-  WebContentsView* wcv =
-      static_cast<WebContentsImpl*>(web_contents())->GetView();
-  RenderWidgetHostViewBase* view =
-      wcv->CreateViewForWidget(render_view_host_->GetWidget());
-  render_view_host_->GetWidget()->SetView(view);
-  render_view_host_->GetMainFrame()->AllowBindings(
-      BINDINGS_POLICY_DOM_AUTOMATION);
-
-  render_view_host_->CreateRenderView(MSG_ROUTING_NONE, MSG_ROUTING_NONE,
-                                      base::UnguessableToken::Create(),
-                                      FrameReplicationState(), false);
-  controller_->delegate()->RenderFrameForInterstitialPageCreated(
-      frame_tree_->root()->current_frame_host());
-  view->SetSize(web_contents()->GetContainerBounds().size());
-  // Don't show the interstitial until we have navigated to it.
-  view->Hide();
-  return wcv;
-}
-
-void InterstitialPageImpl::Proceed() {
-  // Don't repeat this if we are already shutting down.  We cannot check for
-  // enabled() here, because we may have called Disable without calling Hide.
-  if (!render_view_host_)
-    return;
-
-  if (action_taken_ != NO_ACTION) {
-    NOTREACHED();
-    return;
-  }
-  Disable();
-  action_taken_ = PROCEED_ACTION;
-
-  // Resumes the throbber, if applicable.
-  pause_throbber_ = false;
-  controller_->delegate()->DidProceedOnInterstitial();
-
-  // If this is a new navigation, the old page is going away, so we cancel any
-  // blocked requests for it.  If it is not a new navigation, then it means the
-  // interstitial was shown as a result of a resource loading in the page.
-  // Since the user wants to proceed, we'll let any blocked request go through.
-  if (new_navigation_)
-    TakeActionOnResourceDispatcher(CANCEL);
-  else
-    TakeActionOnResourceDispatcher(RESUME);
-
-  // No need to hide if we are a new navigation, we'll get hidden when the
-  // navigation is committed.
-  if (!new_navigation_) {
-    Hide();
-    delegate_->OnProceed();
-    return;
-  }
-
-  delegate_->OnProceed();
-}
-
-void InterstitialPageImpl::DontProceed() {
-  // Don't repeat this if we are already shutting down.  We cannot check for
-  // enabled() here, because we may have called Disable without calling Hide.
-  if (!render_view_host_)
-    return;
-  DCHECK(action_taken_ != DONT_PROCEED_ACTION);
-
-  Disable();
-  action_taken_ = DONT_PROCEED_ACTION;
-
-  // If this is a new navigation, we are returning to the original page, so we
-  // resume blocked requests for it.  If it is not a new navigation, then it
-  // means the interstitial was shown as a result of a resource loading in the
-  // page and we won't return to the original page, so we cancel blocked
-  // requests in that case.
-  if (new_navigation_)
-    TakeActionOnResourceDispatcher(RESUME);
-  else
-    TakeActionOnResourceDispatcher(CANCEL);
-
-  if (should_discard_pending_nav_entry_) {
-    // Since no navigation happens we have to discard the transient entry
-    // explicitly.  Note that by calling DiscardNonCommittedEntries() we also
-    // discard the pending entry, which is what we want, since the navigation is
-    // cancelled.
-    controller_->DiscardNonCommittedEntries();
-  }
-
-  Hide();
-  delegate_->OnDontProceed();
-}
-
-void InterstitialPageImpl::CancelForNavigation() {
-  // The user is trying to navigate away.  We should unblock the renderer and
-  // disable the interstitial, but keep it visible until the navigation
-  // completes.
-  Disable();
-  // If this interstitial was shown for a new navigation, allow any navigations
-  // on the original page to resume (e.g., subresource requests, XHRs, etc).
-  // Otherwise, cancel the pending, possibly dangerous navigations.
-  if (new_navigation_)
-    TakeActionOnResourceDispatcher(RESUME);
-  else
-    TakeActionOnResourceDispatcher(CANCEL);
-}
-
-void InterstitialPageImpl::SetSize(const gfx::Size& size) {
-  if (!enabled())
-    return;
-#if !defined(OS_MACOSX)
-  // When a tab is closed, we might be resized after our view was NULLed
-  // (typically if there was an info-bar).
-  if (render_view_host_->GetWidget()->GetView())
-    render_view_host_->GetWidget()->GetView()->SetSize(size);
-#else
-  // TODO(port): Does Mac need to SetSize?
-  NOTIMPLEMENTED();
-#endif
-}
-
-void InterstitialPageImpl::Focus() {
-  // Focus the native window.
-  if (!enabled())
-    return;
-  render_view_host_->GetWidget()->GetView()->Focus();
-}
-
-void InterstitialPageImpl::FocusThroughTabTraversal(bool reverse) {
-  if (!enabled())
-    return;
-  render_view_host_->SetInitialFocus(reverse);
-}
-
-RenderWidgetHostView* InterstitialPageImpl::GetView() {
-  return render_view_host_->GetWidget()->GetView();
-}
-
-RenderFrameHostImpl* InterstitialPageImpl::GetMainFrame() {
-  if (!render_view_host_)
-    return nullptr;
-  return static_cast<RenderFrameHostImpl*>(render_view_host_->GetMainFrame());
-}
-
-InterstitialPageDelegate* InterstitialPageImpl::GetDelegateForTesting() {
-  return delegate_.get();
-}
-
-void InterstitialPageImpl::DontCreateViewForTesting() {
-  create_view_ = false;
-}
-
-RenderFrameHostDelegate* InterstitialPageImpl::CreateNewWindow(
-    RenderFrameHost* opener,
-    const mojom::CreateNewWindowParams& params,
-    bool is_new_browsing_instance,
-    bool has_user_gesture,
-    SessionStorageNamespace* session_storage_namespace) {
-  NOTREACHED() << "InterstitialPage does not support showing popups.";
-  return nullptr;
-}
-
-void InterstitialPageImpl::SetFocusedFrame(FrameTreeNode* node,
-                                           SiteInstance* source) {
-  frame_tree_->SetFocusedFrame(node, source);
-
-  if (web_contents_) {
-    static_cast<WebContentsImpl*>(web_contents_)
-        ->SetAsFocusedWebContentsIfNecessary();
-  }
-}
-
-Visibility InterstitialPageImpl::GetVisibility() {
-  // Interstitials always occlude the underlying web content.
-  return Visibility::OCCLUDED;
-}
-
-void InterstitialPageImpl::CreateNewWidget(
-    int32_t render_process_id,
-    int32_t route_id,
-    mojo::PendingRemote<mojom::Widget> widget,
-    mojo::PendingAssociatedReceiver<blink::mojom::WidgetHost> blink_widget_host,
-    mojo::PendingAssociatedRemote<blink::mojom::Widget> blink_widget) {
-  NOTREACHED() << "InterstitialPage does not support showing drop-downs.";
-}
-
-void InterstitialPageImpl::CreateNewFullscreenWidget(
-    int32_t render_process_id,
-    int32_t route_id,
-    mojo::PendingRemote<mojom::Widget> widget,
-    mojo::PendingAssociatedReceiver<blink::mojom::WidgetHost> blink_widget_host,
-    mojo::PendingAssociatedRemote<blink::mojom::Widget> blink_widget) {
-  NOTREACHED()
-      << "InterstitialPage does not support showing full screen popups.";
-}
-
-void InterstitialPageImpl::ShowCreatedWindow(int process_id,
-                                             int main_frame_widget_route_id,
-                                             WindowOpenDisposition disposition,
-                                             const gfx::Rect& initial_rect,
-                                             bool user_gesture) {
-  NOTREACHED() << "InterstitialPage does not support showing popups.";
-}
-
-void InterstitialPageImpl::ShowCreatedWidget(int process_id,
-                                             int route_id,
-                                             const gfx::Rect& initial_rect) {
-  NOTREACHED() << "InterstitialPage does not support showing drop-downs.";
-}
-
-void InterstitialPageImpl::ShowCreatedFullscreenWidget(int process_id,
-                                                       int route_id) {
-  NOTREACHED()
-      << "InterstitialPage does not support showing full screen popups.";
-}
-
-SessionStorageNamespace* InterstitialPageImpl::GetSessionStorageNamespace(
-    SiteInstance* instance) {
-  return session_storage_namespace_.get();
-}
-
-FrameTree* InterstitialPageImpl::GetFrameTree() {
-  return frame_tree_.get();
-}
-
-void InterstitialPageImpl::Disable() {
-  enabled_ = false;
-
-  // Also let the InterstitialPageNavigatorImpl know.
-  static_cast<InterstitialPageNavigatorImpl*>(frame_tree_->root()->navigator())
-      ->Disable();
-}
-
-void InterstitialPageImpl::Shutdown() {
-  delete this;
-}
-
-void InterstitialPageImpl::OnNavigatingAwayOrTabClosing() {
-  // Notify the RenderWidgetHostView so it can clean up interstitial resources
-  // before the WebContents is fully destroyed.
-  if (render_view_host_ && render_view_host_->GetWidget() &&
-      render_view_host_->GetWidget()->GetView()) {
-    render_view_host_->GetWidget()->GetView()->OnInterstitialPageGoingAway();
-  }
-  if (action_taken_ == NO_ACTION) {
-    // We are navigating away from the interstitial or closing a tab with an
-    // interstitial.  Default to DontProceed(). We don't just call Hide as
-    // subclasses will almost certainly override DontProceed to do some work
-    // (ex: close pending connections).
-    DontProceed();
-  } else {
-    // User decided to proceed and either the navigation was committed or
-    // the tab was closed before that.
-    Hide();
-  }
-}
-
-void InterstitialPageImpl::TakeActionOnResourceDispatcher(
-    ResourceRequestAction action) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  if (action == CANCEL || action == RESUME) {
-    if (resource_dispatcher_host_notified_)
-      return;
-    resource_dispatcher_host_notified_ = true;
-  }
-
-  // The tab might not have a render_view_host if it was closed (in which case,
-  // we have taken care of the blocked requests when processing
-  // NOTIFY_RENDER_WIDGET_HOST_DESTROYED.
-  RenderViewHostImpl* rvh =
-      RenderViewHostImpl::FromID(original_child_id_, original_rvh_id_);
-  if (!rvh)
-    return;
-
-  RenderFrameHostImpl* rfh =
-      static_cast<RenderFrameHostImpl*>(rvh->GetMainFrame());
-  // Note, the RenderViewHost can lose its main frame if a new RenderFrameHost
-  // commits with a new RenderViewHost. Additionally, RenderViewHosts for OOPIF
-  // don't have main frames.
-  if (!rfh)
-    return;
-
-  switch (action) {
-    case BLOCK:
-      rfh->BlockRequestsForFrame();
-      break;
-    case RESUME:
-      rfh->ResumeBlockedRequestsForFrame();
-      break;
-    default:
-      DCHECK_EQ(action, CANCEL);
-      rfh->CancelBlockedRequestsForFrame();
-      break;
-  }
-}
-
-void InterstitialPageImpl::OnDomOperationResponse(
-    RenderFrameHostImpl* source,
-    const std::string& json_string) {
-  std::string json = json_string;
-  // Needed by test code.
-  NotificationService::current()->Notify(NOTIFICATION_DOM_OPERATION_RESPONSE,
-                                         Source<WebContents>(web_contents()),
-                                         Details<std::string>(&json));
-
-  if (!enabled())
-    return;
-  delegate_->CommandReceived(json_string);
-}
-
-InterstitialPageImpl::InterstitialPageRVHDelegateView::
-    InterstitialPageRVHDelegateView(InterstitialPageImpl* page)
-    : interstitial_page_(page) {}
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::ShowPopupMenu(
-    RenderFrameHost* render_frame_host,
-    const gfx::Rect& bounds,
-    int item_height,
-    double item_font_size,
-    int selected_item,
-    const std::vector<MenuItem>& items,
-    bool right_aligned,
-    bool allow_multiple_selection) {
-  NOTREACHED() << "InterstitialPage does not support showing popup menus.";
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::HidePopupMenu() {
-  NOTREACHED() << "InterstitialPage does not support showing popup menus.";
-}
-#endif
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::StartDragging(
-    const DropData& drop_data,
-    WebDragOperationsMask allowed_operations,
-    const gfx::ImageSkia& image,
-    const gfx::Vector2d& image_offset,
-    const DragEventSourceInfo& event_info,
-    RenderWidgetHostImpl* source_rwh) {
-  interstitial_page_->render_view_host_->GetWidget()
-      ->DragSourceSystemDragEnded();
-  DVLOG(1) << "InterstitialPage does not support dragging yet.";
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::UpdateDragCursor(
-    WebDragOperation) {
-  NOTREACHED() << "InterstitialPage does not support dragging yet.";
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::GotFocus(
-    RenderWidgetHostImpl* render_widget_host) {
-  WebContents* web_contents = interstitial_page_->web_contents();
-  if (web_contents) {
-    static_cast<WebContentsImpl*>(web_contents)
-        ->NotifyWebContentsFocused(render_widget_host);
-  }
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::LostFocus(
-    RenderWidgetHostImpl* render_widget_host) {
-  WebContents* web_contents = interstitial_page_->web_contents();
-  if (web_contents) {
-    static_cast<WebContentsImpl*>(web_contents)
-        ->NotifyWebContentsLostFocus(render_widget_host);
-  }
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::TakeFocus(
-    bool reverse) {
-  if (!interstitial_page_->web_contents())
-    return;
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(interstitial_page_->web_contents());
-  if (!web_contents->GetDelegateView())
-    return;
-
-  web_contents->GetDelegateView()->TakeFocus(reverse);
-}
-
-int InterstitialPageImpl::InterstitialPageRVHDelegateView::
-    GetTopControlsHeight() const {
-  if (!interstitial_page_->web_contents())
-    return 0;
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(interstitial_page_->web_contents());
-  if (!web_contents || !web_contents->GetDelegateView())
-    return 0;
-  return web_contents->GetDelegateView()->GetTopControlsHeight();
-}
-
-int InterstitialPageImpl::InterstitialPageRVHDelegateView::
-    GetBottomControlsHeight() const {
-  if (!interstitial_page_->web_contents())
-    return 0;
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(interstitial_page_->web_contents());
-  if (!web_contents || !web_contents->GetDelegateView())
-    return 0;
-  return web_contents->GetDelegateView()->GetBottomControlsHeight();
-}
-
-bool InterstitialPageImpl::InterstitialPageRVHDelegateView::
-    DoBrowserControlsShrinkRendererSize() const {
-  if (!interstitial_page_->web_contents())
-    return false;
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(interstitial_page_->web_contents());
-  if (!web_contents || !web_contents->GetDelegateView())
-    return false;
-  return web_contents->GetDelegateView()->DoBrowserControlsShrinkRendererSize();
-}
-
-void InterstitialPageImpl::InterstitialPageRVHDelegateView::OnFindReply(
-    int request_id,
-    int number_of_matches,
-    const gfx::Rect& selection_rect,
-    int active_match_ordinal,
-    bool final_update) {}
-
-InterstitialPageImpl::UnderlyingContentObserver::UnderlyingContentObserver(
-    WebContents* web_contents,
-    InterstitialPageImpl* interstitial)
-    : WebContentsObserver(web_contents), interstitial_(interstitial) {}
-
-void InterstitialPageImpl::UnderlyingContentObserver::NavigationEntryCommitted(
-    const LoadCommittedDetails& load_details) {
-  interstitial_->OnNavigatingAwayOrTabClosing();
-}
-
-void InterstitialPageImpl::UnderlyingContentObserver::WebContentsDestroyed() {
-  interstitial_->OnNavigatingAwayOrTabClosing();
-}
-
-TextInputManager* InterstitialPageImpl::GetTextInputManager() {
-  return !web_contents_ ? nullptr
-                        : static_cast<WebContentsImpl*>(web_contents_)
-                              ->GetTextInputManager();
-}
-
-RenderWidgetHostInputEventRouter* InterstitialPageImpl::GetInputEventRouter() {
-  WebContentsImpl* web_contents_impl =
-      static_cast<WebContentsImpl*>(web_contents_);
-  if (!web_contents_impl)
-    return nullptr;
-
-  return web_contents_impl->GetInputEventRouter();
-}
-
-BrowserAccessibilityManager*
-InterstitialPageImpl::GetRootBrowserAccessibilityManager() {
-  WebContentsImpl* web_contents_impl =
-      static_cast<WebContentsImpl*>(web_contents_);
-  if (!web_contents_impl)
-    return nullptr;
-
-  return web_contents_impl->GetRootBrowserAccessibilityManager();
-}
-
-BrowserAccessibilityManager*
-InterstitialPageImpl::GetOrCreateRootBrowserAccessibilityManager() {
-  WebContentsImpl* web_contents_impl =
-      static_cast<WebContentsImpl*>(web_contents_);
-  if (!web_contents_impl)
-    return nullptr;
-
-  return web_contents_impl->GetOrCreateRootBrowserAccessibilityManager();
-}
-
-void InterstitialPageImpl::AudioContextPlaybackStarted(RenderFrameHost* host,
-                                                       int context_id) {
-  // Interstitial pages should not be playing any sound via WebAudio
-  NOTREACHED();
-}
-
-void InterstitialPageImpl::AudioContextPlaybackStopped(RenderFrameHost* host,
-                                                       int context_id) {
-  // Interstitial pages should not be playing any sound via WebAudio.
-  NOTREACHED();
-}
-
-mojom::FrameInputHandler* InterstitialPageImpl::GetFocusedFrameInputHandler() {
-  FrameTreeNode* focused_node = frame_tree_->GetFocusedFrame();
-  if (!focused_node)
-    return nullptr;
-
-  return focused_node->current_frame_host()->GetFrameInputHandler();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl.h b/chromium/content/browser/frame_host/interstitial_page_impl.h
deleted file mode 100644
index e645cd75128..00000000000
--- a/chromium/content/browser/frame_host/interstitial_page_impl.h
+++ /dev/null
@@ -1,338 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_IMPL_H_
-#define CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_IMPL_H_
-
-#include <stdint.h>
-
-#include <memory>
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "base/scoped_observer.h"
-#include "build/build_config.h"
-#include "content/browser/frame_host/frame_tree.h"
-#include "content/browser/frame_host/navigator_delegate.h"
-#include "content/browser/frame_host/render_frame_host_delegate.h"
-#include "content/browser/renderer_host/render_view_host_delegate.h"
-#include "content/browser/renderer_host/render_widget_host_delegate.h"
-#include "content/public/browser/interstitial_page.h"
-#include "content/public/browser/notification_observer.h"
-#include "content/public/browser/notification_registrar.h"
-#include "content/public/browser/render_widget_host.h"
-#include "content/public/browser/render_widget_host_observer.h"
-#include "content/public/browser/web_contents_observer.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
-#include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
-#include "url/gurl.h"
-
-namespace content {
-class NavigationControllerImpl;
-class RenderViewHostImpl;
-class RenderWidgetHostView;
-class TextInputManager;
-class WebContentsView;
-
-namespace mojom {
-class CreateNewWindowParams;
-}
-
-enum ResourceRequestAction { BLOCK, RESUME, CANCEL };
-
-class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
-                                            public NotificationObserver,
-                                            public RenderFrameHostDelegate,
-                                            public RenderWidgetHostObserver,
-                                            public RenderViewHostDelegate,
-                                            public RenderWidgetHostDelegate,
-                                            public NavigatorDelegate {
- public:
-  // The different state of actions the user can take in an interstitial.
-  enum ActionState {
-    NO_ACTION,           // No action has been taken yet.
-    PROCEED_ACTION,      // "Proceed" was selected.
-    DONT_PROCEED_ACTION  // "Don't proceed" was selected.
-  };
-
-  InterstitialPageImpl(WebContents* web_contents,
-                       RenderWidgetHostDelegate* render_widget_host_delegate,
-                       bool new_navigation,
-                       const GURL& url,
-                       InterstitialPageDelegate* delegate);
-  ~InterstitialPageImpl() override;
-
-  // InterstitialPage implementation:
-  void Show() override;
-  void Hide() override;
-  void DontProceed() override;
-  void Proceed() override;
-  WebContents* GetWebContents() override;
-  RenderFrameHostImpl* GetMainFrame() override;
-  InterstitialPageDelegate* GetDelegateForTesting() override;
-  void DontCreateViewForTesting() override;
-  void SetSize(const gfx::Size& size) override;
-  void Focus() override;
-
-  // Allows the user to navigate away by disabling the interstitial, canceling
-  // the pending request, and unblocking the hidden renderer.  The interstitial
-  // will stay visible until the navigation completes.
-  void CancelForNavigation();
-
-  // Focus the first (last if reverse is true) element in the interstitial page.
-  // Called when tab traversing.
-  void FocusThroughTabTraversal(bool reverse);
-
-  RenderWidgetHostView* GetView();
-
-  bool pause_throbber() const { return pause_throbber_; }
-
-  // TODO(nasko): This should move to InterstitialPageNavigatorImpl, but in
-  // the meantime make it public, so it can be called directly.
-  void DidNavigate(RenderViewHost* render_view_host,
-                   const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
-
-  // NavigatorDelegate implementation.
-  WebContents* OpenURL(const OpenURLParams& params) override;
-  const blink::UserAgentOverride& GetUserAgentOverride() override;
-  bool ShouldOverrideUserAgentInNewTabs() override;
-
-  // RenderViewHostDelegate implementation:
-  FrameTree* GetFrameTree() override;
-
- protected:
-  // NotificationObserver method:
-  void Observe(int type,
-               const NotificationSource& source,
-               const NotificationDetails& details) override;
-
-  // RenderFrameHostDelegate implementation:
-  bool OnMessageReceived(RenderFrameHostImpl* render_frame_host,
-                         const IPC::Message& message) override;
-  void RenderFrameCreated(RenderFrameHost* render_frame_host) override;
-  void UpdateTitle(RenderFrameHost* render_frame_host,
-                   const base::string16& title,
-                   base::i18n::TextDirection title_direction) override;
-  InterstitialPage* GetAsInterstitialPage() override;
-  ui::AXMode GetAccessibilityMode() override;
-  void ExecuteEditCommand(const std::string& command,
-                          const base::Optional<base::string16>& value) override;
-  void Cut() override;
-  void Copy() override;
-  void Paste() override;
-  void SelectAll() override;
-  RenderFrameHostDelegate* CreateNewWindow(
-      RenderFrameHost* opener,
-      const mojom::CreateNewWindowParams& params,
-      bool is_new_browsing_instance,
-      bool has_user_gesture,
-      SessionStorageNamespace* session_storage_namespace) override;
-  void ShowCreatedWindow(int process_id,
-                         int main_frame_widget_route_id,
-                         WindowOpenDisposition disposition,
-                         const gfx::Rect& initial_rect,
-                         bool user_gesture) override;
-  void SetFocusedFrame(FrameTreeNode* node, SiteInstance* source) override;
-  Visibility GetVisibility() override;
-  void AudioContextPlaybackStarted(RenderFrameHost* host,
-                                   int context_id) override;
-  void AudioContextPlaybackStopped(RenderFrameHost* host,
-                                   int context_id) override;
-  void CreateNewWidget(int32_t render_process_id,
-                       int32_t route_id,
-                       mojo::PendingRemote<mojom::Widget> widget,
-                       mojo::PendingAssociatedReceiver<blink::mojom::WidgetHost>
-                           blink_widget_host,
-                       mojo::PendingAssociatedRemote<blink::mojom::Widget>
-                           blink_widget) override;
-  void CreateNewFullscreenWidget(
-      int32_t render_process_id,
-      int32_t route_id,
-      mojo::PendingRemote<mojom::Widget> widget,
-      mojo::PendingAssociatedReceiver<blink::mojom::WidgetHost>
-          blink_widget_host,
-      mojo::PendingAssociatedRemote<blink::mojom::Widget> blink_widget)
-      override;
-
-  // RenderViewHostDelegate implementation:
-  RenderViewHostDelegateView* GetDelegateView() override;
-  bool OnMessageReceived(RenderViewHostImpl* render_view_host,
-                         const IPC::Message& message) override;
-  const GURL& GetMainFrameLastCommittedURL() override;
-  void RenderViewTerminated(RenderViewHost* render_view_host,
-                            base::TerminationStatus status,
-                            int error_code) override;
-  blink::mojom::RendererPreferences GetRendererPrefs(
-      BrowserContext* browser_context) const override;
-  void ShowCreatedWidget(int process_id,
-                         int route_id,
-                         const gfx::Rect& initial_rect) override;
-  void ShowCreatedFullscreenWidget(int process_id, int route_id) override;
-
-  SessionStorageNamespace* GetSessionStorageNamespace(
-      SiteInstance* instance) override;
-
-  // RenderWidgetHostDelegate implementation:
-  void RenderWidgetDeleted(RenderWidgetHostImpl* render_widget_host) override;
-  KeyboardEventProcessingResult PreHandleKeyboardEvent(
-      const NativeWebKeyboardEvent& event) override;
-  bool PreHandleMouseEvent(const blink::WebMouseEvent& event) override;
-  bool HandleKeyboardEvent(const NativeWebKeyboardEvent& event) override;
-  TextInputManager* GetTextInputManager() override;
-  RenderWidgetHostInputEventRouter* GetInputEventRouter() override;
-  BrowserAccessibilityManager* GetRootBrowserAccessibilityManager() override;
-  BrowserAccessibilityManager* GetOrCreateRootBrowserAccessibilityManager()
-      override;
-
-  bool enabled() const { return enabled_; }
-  WebContents* web_contents() const;
-  const GURL& url() const { return url_; }
-
-  // Creates the WebContentsView that shows the interstitial RVH.
-  // Overriden in unit tests.
-  virtual WebContentsView* CreateWebContentsView();
-
-  // Notification magic.
-  NotificationRegistrar notification_registrar_;
-
- private:
-  class InterstitialPageRVHDelegateView;
-  class UnderlyingContentObserver : public WebContentsObserver {
-   public:
-    UnderlyingContentObserver(WebContents* web_contents,
-                              InterstitialPageImpl* interstitial);
-
-    // WebContentsObserver implementation:
-    void WebContentsDestroyed() override;
-    void NavigationEntryCommitted(
-        const LoadCommittedDetails& load_details) override;
-
-    // This observer does not override OnMessageReceived or otherwise handle
-    // messages from the underlying content, because the interstitial should not
-    // care about them. Messages from the interstitial page (which has its own
-    // FrameTree) arrive through the RenderFrameHostDelegate interface, not
-    // WebContentsObserver.
-
-   private:
-    InterstitialPageImpl* const interstitial_;
-
-    DISALLOW_COPY_AND_ASSIGN(UnderlyingContentObserver);
-  };
-
-  // RenderWidgetHostObserver implementation:
-  void RenderWidgetHostDestroyed(RenderWidgetHost* widget_host) override;
-
-  // Disable the interstitial:
-  // - if it is not yet showing, then it won't be shown.
-  // - any command sent by the RenderViewHost will be ignored.
-  void Disable();
-
-  // Delete ourselves, causing Shutdown on the RVH to be called.
-  void Shutdown();
-
-  void OnNavigatingAwayOrTabClosing();
-
-  // Executes the passed action on the ResourceDispatcher (on the IO thread).
-  // Used to block/resume/cancel requests for the RenderViewHost hidden by this
-  // interstitial.
-  void TakeActionOnResourceDispatcher(ResourceRequestAction action);
-
-  // IPC message handlers.
-  void OnDomOperationResponse(RenderFrameHostImpl* source,
-                              const std::string& json_string);
-
-  // Creates the RenderViewHost containing the interstitial content.
-  RenderViewHostImpl* CreateRenderViewHost();
-
-  // Returns the focused frame's input handler.
-  mojom::FrameInputHandler* GetFocusedFrameInputHandler();
-
-  // Watches the underlying WebContents for reasons to cancel the interstitial.
-  UnderlyingContentObserver underlying_content_observer_;
-
-  // The contents in which we are displayed.  This is valid until Hide is
-  // called, at which point it will be set to NULL because the WebContents
-  // itself may be deleted.
-  WebContents* web_contents_;
-
-  // The NavigationController for the content this page is being displayed over.
-  NavigationControllerImpl* controller_;
-
-  // Delegate for dispatching keyboard events and accessing the native view.
-  RenderWidgetHostDelegate* render_widget_host_delegate_;
-
-  // The URL that is shown when the interstitial is showing.
-  GURL url_;
-
-  // Whether this interstitial is shown as a result of a new navigation (in
-  // which case a transient navigation entry is created).
-  bool new_navigation_;
-
-  // Whether we should discard the pending navigation entry when not proceeding.
-  // This is to deal with cases where |new_navigation_| is true but a new
-  // pending entry was created since this interstitial was shown and we should
-  // not discard it.
-  bool should_discard_pending_nav_entry_;
-
-  // Whether this interstitial is enabled.  See Disable() for more info.
-  bool enabled_;
-
-  // Whether the Proceed or DontProceed methods have been called yet.
-  ActionState action_taken_;
-
-  // The RenderViewHost displaying the interstitial contents.  This is valid
-  // until Hide is called, at which point it will be set to NULL, signifying
-  // that shutdown has started.
-  // TODO(creis): This is now owned by the FrameTree.  We should route things
-  // through the tree's root RenderFrameHost instead.
-  RenderViewHostImpl* render_view_host_;
-
-  // The frame tree structure of the current page.
-  std::unique_ptr<FrameTree> frame_tree_;
-
-  // The IDs for the Render[View|Process]Host hidden by this interstitial.
-  int original_child_id_;
-  int original_rvh_id_;
-
-  // Whether or not we should change the title of the contents when hidden (to
-  // revert it to its original value).
-  bool should_revert_web_contents_title_;
-
-  // Whether the ResourceDispatcherHost has been notified to cancel/resume the
-  // resource requests blocked for the RenderViewHost.
-  bool resource_dispatcher_host_notified_;
-
-  // The original title of the contents that should be reverted to when the
-  // interstitial is hidden.
-  base::string16 original_web_contents_title_;
-
-  // Our RenderViewHostDelegateView, necessary for accelerators to work.
-  std::unique_ptr<InterstitialPageRVHDelegateView> rvh_delegate_view_;
-
-  // Settings passed to the renderer.
-  mutable blink::mojom::RendererPreferences renderer_preferences_;
-
-  bool create_view_;
-
-  // Whether the throbber should be paused. This is true from the moment the
-  // interstitial is shown until the moment the interstitial goes away or the
-  // user chooses to proceed.
-  bool pause_throbber_;
-
-  std::unique_ptr<InterstitialPageDelegate> delegate_;
-
-  scoped_refptr<SessionStorageNamespace> session_storage_namespace_;
-
-  ScopedObserver<RenderWidgetHost, RenderWidgetHostObserver> widget_observer_{
-      this};
-
-  base::WeakPtrFactory<InterstitialPageImpl> weak_ptr_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterstitialPageImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_IMPL_H_
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc b/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc
deleted file mode 100644
index a49ad257f9a..00000000000
--- a/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc
+++ /dev/null
@@ -1,373 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/interstitial_page_impl.h"
-
-#include <tuple>
-
-#include "base/macros.h"
-#include "base/run_loop.h"
-#include "base/strings/utf_string_conversions.h"
-#include "content/browser/web_contents/web_contents_impl.h"
-#include "content/common/frame_messages.h"
-#include "content/public/browser/browser_message_filter.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/interstitial_page_delegate.h"
-#include "content/public/common/navigation_policy.h"
-#include "content/public/test/browser_test_utils.h"
-#include "content/public/test/content_browser_test.h"
-#include "content/public/test/content_browser_test_utils.h"
-#include "content/public/test/test_utils.h"
-#include "content/shell/browser/shell.h"
-#include "ipc/message_filter.h"
-#include "third_party/blink/public/mojom/clipboard/clipboard.mojom.h"
-#include "ui/base/clipboard/clipboard_monitor.h"
-#include "ui/base/clipboard/clipboard_observer.h"
-
-namespace content {
-
-namespace {
-
-class TestInterstitialPageDelegate : public InterstitialPageDelegate {
- private:
-  // InterstitialPageDelegate:
-  std::string GetHTMLContents() override {
-    return "<html>"
-           "<head>"
-           "<script>"
-           "function create_input_and_set_text(text) {"
-           "  var input = document.createElement('input');"
-           "  input.id = 'input';"
-           "  document.body.appendChild(input);"
-           "  document.getElementById('input').value = text;"
-           "  input.addEventListener('input',"
-           "      function() { document.title='TEXT_CHANGED'; });"
-           "}"
-           "function focus_select_input() {"
-           "  document.getElementById('input').select();"
-           "}"
-           "function get_input_text() {"
-           "  window.domAutomationController.send("
-           "      document.getElementById('input').value);"
-           "}"
-           "function get_selection() {"
-           "  window.domAutomationController.send("
-           "      window.getSelection().toString());"
-           "}"
-           "function set_selection_change_listener() {"
-           "  document.addEventListener('selectionchange',"
-           "    function() { document.title='SELECTION_CHANGED'; })"
-           "}"
-           "</script>"
-           "</head>"
-           "<body>original body text</body>"
-           "</html>";
-  }
-};
-
-class ClipboardChangedObserver : ui::ClipboardObserver {
- public:
-  ClipboardChangedObserver() {
-    ui::ClipboardMonitor::GetInstance()->AddObserver(this);
-  }
-
-  ~ClipboardChangedObserver() override {
-    ui::ClipboardMonitor::GetInstance()->RemoveObserver(this);
-  }
-
-  void OnClipboardDataChanged() override {
-    DCHECK(!quit_closure_.is_null());
-    std::move(quit_closure_).Run();
-  }
-
-  void WaitForWriteCommit() {
-    base::RunLoop run_loop;
-    quit_closure_ = run_loop.QuitClosure();
-    run_loop.Run();
-  }
-
- private:
-  base::OnceClosure quit_closure_;
-};
-
-}  // namespace
-
-class InterstitialPageImplTest : public ContentBrowserTest {
- public:
-  InterstitialPageImplTest() {}
-
-  ~InterstitialPageImplTest() override {}
-
- protected:
-  void SetUpInterstitialPage() {
-    WebContentsImpl* web_contents =
-        static_cast<WebContentsImpl*>(shell()->web_contents());
-
-    // Create the interstitial page.
-    TestInterstitialPageDelegate* interstitial_delegate =
-        new TestInterstitialPageDelegate;
-    GURL url("http://interstitial");
-    interstitial_.reset(new InterstitialPageImpl(
-        web_contents, static_cast<RenderWidgetHostDelegate*>(web_contents),
-        true, url, interstitial_delegate));
-    interstitial_->Show();
-    WaitForInterstitialAttach(web_contents);
-
-    // Focus the interstitial frame
-    FrameTree* frame_tree =
-        static_cast<RenderViewHostDelegate*>(interstitial_.get())
-            ->GetFrameTree();
-    static_cast<RenderFrameHostDelegate*>(interstitial_.get())
-        ->SetFocusedFrame(frame_tree->root(),
-                          frame_tree->GetMainFrame()->GetSiteInstance());
-
-    // Wait until page loads completely.
-    ASSERT_TRUE(WaitForRenderFrameReady(interstitial_->GetMainFrame()));
-  }
-
-  void TearDownInterstitialPage() {
-    // Close the interstitial.
-    interstitial_->DontProceed();
-    WaitForInterstitialDetach(shell()->web_contents());
-    interstitial_.reset();
-  }
-
-  InterstitialPageImpl* interstitial() { return interstitial_.get(); }
-
-  bool FocusInputAndSelectText() {
-    return ExecuteScript(interstitial_->GetMainFrame(), "focus_select_input()");
-  }
-
-  bool GetInputText(std::string* input_text) {
-    return ExecuteScriptAndExtractString(interstitial_->GetMainFrame(),
-                                         "get_input_text()", input_text);
-  }
-
-  bool GetSelection(std::string* input_text) {
-    return ExecuteScriptAndExtractString(interstitial_->GetMainFrame(),
-                                         "get_selection()", input_text);
-  }
-
-  bool CreateInputAndSetText(const std::string& text) {
-    return ExecuteScript(interstitial_->GetMainFrame(),
-                         "create_input_and_set_text('" + text + "')");
-  }
-
-  bool SetSelectionChangeListener() {
-    return ExecuteScript(interstitial_->GetMainFrame(),
-                         "set_selection_change_listener()");
-  }
-
-  void PerformCut() {
-    ClipboardChangedObserver clipboard_observer;
-    const base::string16 expected_title = base::UTF8ToUTF16("TEXT_CHANGED");
-    content::TitleWatcher title_watcher(shell()->web_contents(),
-                                        expected_title);
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(interstitial_->GetMainFrame());
-    rfh->GetRenderWidgetHost()->delegate()->Cut();
-    clipboard_observer.WaitForWriteCommit();
-    EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
-  }
-
-  void PerformCopy() {
-    ClipboardChangedObserver clipboard_observer;
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(interstitial_->GetMainFrame());
-    rfh->GetRenderWidgetHost()->delegate()->Copy();
-    clipboard_observer.WaitForWriteCommit();
-  }
-
-  void PerformPaste() {
-    const base::string16 expected_title = base::UTF8ToUTF16("TEXT_CHANGED");
-    content::TitleWatcher title_watcher(shell()->web_contents(),
-                                        expected_title);
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(interstitial_->GetMainFrame());
-    rfh->GetRenderWidgetHost()->delegate()->Paste();
-    EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
-  }
-
-  void PerformSelectAll() {
-    const base::string16 expected_title =
-        base::UTF8ToUTF16("SELECTION_CHANGED");
-    content::TitleWatcher title_watcher(shell()->web_contents(),
-                                        expected_title);
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(interstitial_->GetMainFrame());
-    rfh->GetRenderWidgetHost()->delegate()->SelectAll();
-    EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
-  }
-
-  void PerformBack() {
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(interstitial_->GetMainFrame());
-    rfh->GetRenderWidgetHost()->ForwardMouseEvent(blink::WebMouseEvent(
-        blink::WebInputEvent::Type::kMouseUp, gfx::PointF(), gfx::PointF(),
-        blink::WebPointerProperties::Button::kBack, 0, 0,
-        base::TimeTicks::Now()));
-  }
-
- private:
-  std::unique_ptr<InterstitialPageImpl> interstitial_;
-
-  DISALLOW_COPY_AND_ASSIGN(InterstitialPageImplTest);
-};
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, Cut) {
-  BrowserTestClipboardScope clipboard;
-  SetUpInterstitialPage();
-
-  ASSERT_TRUE(CreateInputAndSetText("text-to-cut"));
-  ASSERT_TRUE(FocusInputAndSelectText());
-
-  PerformCut();
-  std::string clipboard_text;
-  clipboard.GetText(&clipboard_text);
-  EXPECT_EQ("text-to-cut", clipboard_text);
-
-  std::string input_text;
-  ASSERT_TRUE(GetInputText(&input_text));
-  EXPECT_EQ(std::string(), input_text);
-
-  TearDownInterstitialPage();
-}
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, Copy) {
-  BrowserTestClipboardScope clipboard;
-  SetUpInterstitialPage();
-
-  ASSERT_TRUE(CreateInputAndSetText("text-to-copy"));
-  ASSERT_TRUE(FocusInputAndSelectText());
-
-  PerformCopy();
-  std::string clipboard_text;
-  clipboard.GetText(&clipboard_text);
-  EXPECT_EQ("text-to-copy", clipboard_text);
-
-  std::string input_text;
-  ASSERT_TRUE(GetInputText(&input_text));
-  EXPECT_EQ("text-to-copy", input_text);
-
-  TearDownInterstitialPage();
-}
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, Paste) {
-  BrowserTestClipboardScope clipboard;
-  SetUpInterstitialPage();
-
-  clipboard.SetText("text-to-paste");
-
-  ASSERT_TRUE(CreateInputAndSetText(std::string()));
-  ASSERT_TRUE(FocusInputAndSelectText());
-
-  PerformPaste();
-
-  std::string input_text;
-  ASSERT_TRUE(GetInputText(&input_text));
-  EXPECT_EQ("text-to-paste", input_text);
-
-  TearDownInterstitialPage();
-}
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, SelectAll) {
-  SetUpInterstitialPage();
-  ASSERT_TRUE(SetSelectionChangeListener());
-
-  std::string input_text;
-  ASSERT_TRUE(GetSelection(&input_text));
-  EXPECT_EQ(std::string(), input_text);
-
-  PerformSelectAll();
-
-  ASSERT_TRUE(GetSelection(&input_text));
-  EXPECT_EQ("original body text", input_text);
-
-  TearDownInterstitialPage();
-}
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, FocusAfterDetaching) {
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-
-  // Load something into the WebContents.
-  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
-
-  // Blur the main frame.
-  web_contents->GetMainFrame()->GetRenderWidgetHost()->Blur();
-  EXPECT_FALSE(
-      web_contents->GetMainFrame()->GetRenderWidgetHost()->is_focused());
-
-  // Setup the interstitial and focus it.
-  SetUpInterstitialPage();
-  interstitial()->GetView()->GetRenderWidgetHost()->Focus();
-  EXPECT_TRUE(web_contents->ShowingInterstitialPage());
-  EXPECT_TRUE(static_cast<RenderWidgetHostImpl*>(
-                  interstitial()->GetView()->GetRenderWidgetHost())
-                  ->is_focused());
-
-  // Tear down interstitial.
-  TearDownInterstitialPage();
-
-  // Since the interstitial was focused, the main frame should be now focused
-  // after the interstitial teardown.
-  EXPECT_TRUE(web_contents->GetRenderViewHost()->GetWidget()->is_focused());
-}
-
-// Ensure that we don't show the underlying RenderWidgetHostView if a subframe
-// commits in the original page while an interstitial is showing.
-// See https://crbug.com/729105.
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, UnderlyingSubframeCommit) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-
-  // Load an initial page and inject an iframe that won't commit yet.
-  WebContentsImpl* web_contents =
-      static_cast<WebContentsImpl*>(shell()->web_contents());
-  GURL main_url(embedded_test_server()->GetURL("/title1.html"));
-  GURL slow_url(embedded_test_server()->GetURL("/title2.html"));
-  EXPECT_TRUE(NavigateToURL(shell(), main_url));
-  TestNavigationManager subframe_delayer(web_contents, slow_url);
-  {
-    std::string script =
-        "var iframe = document.createElement('iframe');"
-        "iframe.src = '" +
-        slow_url.spec() +
-        "';"
-        "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecuteScript(web_contents->GetMainFrame(), script));
-  }
-  EXPECT_TRUE(subframe_delayer.WaitForRequestStart());
-
-  // Show an interstitial. The underlying RenderWidgetHostView should not be
-  // showing.
-  SetUpInterstitialPage();
-  EXPECT_FALSE(web_contents->GetMainFrame()->GetView()->IsShowing());
-  EXPECT_TRUE(web_contents->GetMainFrame()->GetRenderWidgetHost()->is_hidden());
-
-  // Allow the subframe to commit.
-  subframe_delayer.WaitForNavigationFinished();
-
-  // The underlying RenderWidgetHostView should still not be showing.
-  EXPECT_FALSE(web_contents->GetMainFrame()->GetView()->IsShowing());
-  EXPECT_TRUE(web_contents->GetMainFrame()->GetRenderWidgetHost()->is_hidden());
-
-  TearDownInterstitialPage();
-}
-
-IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, BackMouseButton) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-
-  // Load something into the WebContents.
-  EXPECT_TRUE(NavigateToURL(
-      shell(), GURL(embedded_test_server()->GetURL("/title1.html"))));
-  SetUpInterstitialPage();
-
-  EXPECT_TRUE(shell()->web_contents()->ShowingInterstitialPage());
-  PerformBack();
-  EXPECT_FALSE(shell()->web_contents()->ShowingInterstitialPage());
-
-  TearDownInterstitialPage();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.cc b/chromium/content/browser/frame_host/interstitial_page_navigator_impl.cc
deleted file mode 100644
index ef977b6ee77..00000000000
--- a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.cc
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/interstitial_page_navigator_impl.h"
-
-#include "content/browser/frame_host/interstitial_page_impl.h"
-#include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigator_delegate.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
-
-namespace content {
-
-InterstitialPageNavigatorImpl::InterstitialPageNavigatorImpl(
-    InterstitialPageImpl* interstitial,
-    NavigationControllerImpl* navigation_controller)
-    : interstitial_(interstitial),
-      controller_(navigation_controller),
-      enabled_(true) {}
-
-InterstitialPageNavigatorImpl::~InterstitialPageNavigatorImpl() {}
-
-NavigatorDelegate* InterstitialPageNavigatorImpl::GetDelegate() {
-  return interstitial_;
-}
-
-NavigationController* InterstitialPageNavigatorImpl::GetController() {
-  return controller_;
-}
-
-void InterstitialPageNavigatorImpl::DidNavigate(
-    RenderFrameHostImpl* render_frame_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& input_params,
-    std::unique_ptr<NavigationRequest> navigation_request,
-    bool was_within_same_document) {
-  // Do not proceed if the interstitial itself has been disabled.
-  if (!enabled_)
-    return;
-
-  navigation_request->DidCommitNavigation(input_params, true, false, GURL(),
-                                          NAVIGATION_TYPE_NEW_PAGE);
-  navigation_request.reset();
-
-  // TODO(nasko): Move implementation here, but for the time being call out
-  // to the interstitial page code.
-  interstitial_->DidNavigate(render_frame_host->render_view_host(),
-                             input_params);
-}
-
-void InterstitialPageNavigatorImpl::Disable() {
-  enabled_ = false;
-
-  // This is no longer safe to access.
-  controller_ = nullptr;
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h b/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h
deleted file mode 100644
index 15479820fff..00000000000
--- a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_NAVIGATOR_IMPL_H_
-#define CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_NAVIGATOR_IMPL_H_
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/navigator.h"
-#include "content/common/content_export.h"
-
-namespace content {
-
-class NavigationControllerImpl;
-class InterstitialPageImpl;
-
-// Navigator implementation specific to InterstitialPageImpl. It allows only one
-// navigation to commit, since interstitial pages are not allowed to navigate.
-class CONTENT_EXPORT InterstitialPageNavigatorImpl : public Navigator {
- public:
-  InterstitialPageNavigatorImpl(
-      InterstitialPageImpl* interstitial,
-      NavigationControllerImpl* navigation_controller);
-
-  // Navigator implementation.
-  NavigatorDelegate* GetDelegate() override;
-  NavigationController* GetController() override;
-  void DidNavigate(
-      RenderFrameHostImpl* render_frame_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& input_params,
-      std::unique_ptr<NavigationRequest> navigation_request,
-      bool was_within_same_document) override;
-
-  // Disables any further action when the interstitial page is preparing to
-  // delete itself.
-  void Disable();
-
- private:
-  ~InterstitialPageNavigatorImpl() override;
-
-  // The InterstitialPage with which this navigator object is associated.
-  // Non owned pointer.
-  InterstitialPageImpl* interstitial_;
-
-  // The NavigationController associated with this navigator.
-  NavigationControllerImpl* controller_;
-
-  // Whether this interstitial is still enabled.  Becomes false when the
-  // interstitial page is asychronously deleting itself.
-  bool enabled_;
-
-  DISALLOW_COPY_AND_ASSIGN(InterstitialPageNavigatorImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_INTERSTITIAL_PAGE_NAVIGATOR_IMPL_H_
diff --git a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
index b401e4410c3..f2fc465d812 100644
--- a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
+++ b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
@@ -131,10 +131,10 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
   NavigationRequest* request = NavigationRequest::From(navigation_handle());
   FrameTreeNode* node = request->frame_tree_node();
 
-  // Find the parent node where mixed content is characterized, if any.
-  FrameTreeNode* mixed_content_node =
+  // Find the parent frame where mixed content is characterized, if any.
+  RenderFrameHostImpl* mixed_content_frame =
       InWhichFrameIsContentMixed(node, request->GetURL());
-  if (!mixed_content_node) {
+  if (!mixed_content_frame) {
     MaybeSendBlinkFeatureUsageReport();
     return false;
   }
@@ -149,12 +149,13 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
   // intentionally skip the client/embedder checks in order to prevent degrading
   // the site's security UI.
   bool block_all_mixed_content =
-      (mixed_content_node->current_replication_state().insecure_request_policy &
+      (mixed_content_frame->frame_tree_node()
+           ->current_replication_state()
+           .insecure_request_policy &
        blink::mojom::InsecureRequestPolicy::kBlockAllMixedContent) !=
       blink::mojom::InsecureRequestPolicy::kLeaveInsecureRequestsAlone;
-  const WebPreferences& prefs = mixed_content_node->current_frame_host()
-                                    ->render_view_host()
-                                    ->GetWebkitPreferences();
+  const WebPreferences& prefs =
+      mixed_content_frame->render_view_host()->GetWebkitPreferences();
   bool strict_mode =
       prefs.strict_mixed_content_checking || block_all_mixed_content;
 
@@ -203,13 +204,15 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
       bool should_ask_delegate =
           !strict_mode && (!prefs.strictly_block_blockable_mixed_content ||
                            prefs.allow_running_insecure_content);
-      allowed = should_ask_delegate &&
-                frame_host_delegate->ShouldAllowRunningInsecureContent(
-                    navigation_handle()->GetWebContents(),
-                    prefs.allow_running_insecure_content,
-                    mixed_content_node->current_origin(), request->GetURL());
+      allowed =
+          should_ask_delegate &&
+          frame_host_delegate->ShouldAllowRunningInsecureContent(
+              navigation_handle()->GetWebContents(),
+              prefs.allow_running_insecure_content,
+              mixed_content_frame->GetLastCommittedOrigin(), request->GetURL());
       if (allowed) {
-        const GURL& origin_url = mixed_content_node->current_origin().GetURL();
+        const GURL& origin_url =
+            mixed_content_frame->GetLastCommittedOrigin().GetURL();
         frame_host_delegate->DidRunInsecureContent(origin_url,
                                                    request->GetURL());
         mixed_content_features_.insert(
@@ -229,7 +232,8 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
       break;
   };
 
-  UpdateRendererOnMixedContentFound(request, mixed_content_node->current_url(),
+  UpdateRendererOnMixedContentFound(request,
+                                    mixed_content_frame->GetLastCommittedURL(),
                                     allowed, for_redirect);
   MaybeSendBlinkFeatureUsageReport();
 
@@ -238,7 +242,7 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
 
 // This method mirrors MixedContentChecker::inWhichFrameIsContentMixed but is
 // implemented in a different form that seems more appropriate here.
-FrameTreeNode* MixedContentNavigationThrottle::InWhichFrameIsContentMixed(
+RenderFrameHostImpl* MixedContentNavigationThrottle::InWhichFrameIsContentMixed(
     FrameTreeNode* node,
     const GURL& url) {
   // Main frame navigations cannot be mixed content.
@@ -254,42 +258,45 @@ FrameTreeNode* MixedContentNavigationThrottle::InWhichFrameIsContentMixed(
   // should get to the same results. Especially where isMixedContent calls
   // exist, here they are partially fulfilled here  and partially replaced by
   // DoesOriginSchemeRestrictMixedContent.
-  FrameTreeNode* mixed_content_node = nullptr;
-  FrameTreeNode* root = node->frame_tree()->root();
-  FrameTreeNode* parent = node->parent();
+  RenderFrameHostImpl* mixed_content_frame = nullptr;
+  RenderFrameHostImpl* root = node->parent()->GetMainFrame();
+  RenderFrameHostImpl* parent = node->parent();
   if (!IsUrlPotentiallySecure(url)) {
     // TODO(carlosk): we might need to check more than just the immediate parent
     // and the root. See https://crbug.com/623486.
 
     // Checks if the root and then the immediate parent frames' origins are
     // secure.
-    if (DoesOriginSchemeRestrictMixedContent(root->current_origin()))
-      mixed_content_node = root;
-    else if (DoesOriginSchemeRestrictMixedContent(parent->current_origin()))
-      mixed_content_node = parent;
+    if (DoesOriginSchemeRestrictMixedContent(root->GetLastCommittedOrigin()))
+      mixed_content_frame = root;
+    else if (DoesOriginSchemeRestrictMixedContent(
+                 parent->GetLastCommittedOrigin())) {
+      mixed_content_frame = parent;
+    }
   }
 
   // Note: The code below should behave the same way as the two calls to
   // measureStricterVersionOfIsMixedContent from inside
   // MixedContentChecker::inWhichFrameIs.
-  if (mixed_content_node) {
+  if (mixed_content_frame) {
     // We're currently only checking for mixed content in `https://*` contexts.
     // What about other "secure" contexts the SchemeRegistry knows about? We'll
     // use this method to measure the occurrence of non-webby mixed content to
     // make sure we're not breaking the world without realizing it.
-    if (mixed_content_node->current_origin().scheme() != url::kHttpsScheme) {
+    if (mixed_content_frame->GetLastCommittedOrigin().scheme() !=
+        url::kHttpsScheme) {
       mixed_content_features_.insert(
           blink::mojom::WebFeature::
               kMixedContentInNonHTTPSFrameThatRestrictsMixedContent);
     }
   } else if (!IsOriginSecure(url) &&
-             (IsSecureScheme(root->current_origin().scheme()) ||
-              IsSecureScheme(parent->current_origin().scheme()))) {
+             (IsSecureScheme(root->GetLastCommittedOrigin().scheme()) ||
+              IsSecureScheme(parent->GetLastCommittedOrigin().scheme()))) {
     mixed_content_features_.insert(
         blink::mojom::WebFeature::
             kMixedContentInSecureFrameThatDoesNotRestrictMixedContent);
   }
-  return mixed_content_node;
+  return mixed_content_frame;
 }
 
 void MixedContentNavigationThrottle::MaybeSendBlinkFeatureUsageReport() {
diff --git a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.h b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.h
index f2131465c38..7b63165dc98 100644
--- a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.h
+++ b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.h
@@ -9,6 +9,7 @@
 
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
@@ -50,8 +51,8 @@ class MixedContentNavigationThrottle : public NavigationThrottle {
 
   // Returns the parent frame where mixed content exists for the provided data
   // or nullptr if there is no mixed content.
-  FrameTreeNode* InWhichFrameIsContentMixed(FrameTreeNode* node,
-                                            const GURL& url);
+  RenderFrameHostImpl* InWhichFrameIsContentMixed(FrameTreeNode* node,
+                                                  const GURL& url);
 
   // Updates the renderer about any Blink feature usage.
   void MaybeSendBlinkFeatureUsageReport();
diff --git a/chromium/content/browser/frame_host/navigation_controller_delegate.h b/chromium/content/browser/frame_host/navigation_controller_delegate.h
index 27035e892f2..75696c1c297 100644
--- a/chromium/content/browser/frame_host/navigation_controller_delegate.h
+++ b/chromium/content/browser/frame_host/navigation_controller_delegate.h
@@ -17,9 +17,6 @@ namespace content {
 
 struct LoadCommittedDetails;
 class FrameTree;
-class InterstitialPage;
-class InterstitialPageImpl;
-class RenderFrameHost;
 class RenderViewHost;
 class WebContents;
 
@@ -33,7 +30,6 @@ class NavigationControllerDelegate {
 
   // Duplicates of WebContents methods.
   virtual RenderViewHost* GetRenderViewHost() = 0;
-  virtual InterstitialPage* GetInterstitialPage() = 0;
   virtual const std::string& GetContentsMimeType() = 0;
   virtual void NotifyNavigationStateChanged(InvalidateTypes changed_flags) = 0;
   virtual void Stop() = 0;
@@ -64,14 +60,7 @@ class NavigationControllerDelegate {
   // embedder for NavigationController will be a WebContents object.
   virtual WebContents* GetWebContents() = 0;
 
-  // Methods needed by InterstitialPageImpl.
   virtual bool IsHidden() = 0;
-  virtual void RenderFrameForInterstitialPageCreated(
-      RenderFrameHost* render_frame_host) = 0;
-  virtual void AttachInterstitialPage(
-      InterstitialPageImpl* interstitial_page) = 0;
-  virtual void DidProceedOnInterstitial() = 0;
-  virtual void DetachInterstitialPage(bool has_focus) = 0;
 
   virtual void UpdateOverridingUserAgent() = 0;
 };
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl.cc b/chromium/content/browser/frame_host/navigation_controller_impl.cc
index f950552abbe..005d9dcf49a 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl.cc
@@ -54,10 +54,11 @@
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/frame_host/debug_urls.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
+#include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
+#include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_package/web_bundle_navigation_info.h"
 #include "content/common/content_constants_internal.h"
@@ -268,6 +269,18 @@ bool IsValidURLForNavigation(bool is_main_frame,
     return false;
   }
 
+  // Reject renderer debug URLs because they should have been handled before
+  // we get to this point. This check handles renderer debug URLs
+  // that are inside a view-source: URL (e.g. view-source:chrome://kill) and
+  // provides defense-in-depth if a renderer debug URL manages to get here via
+  // some other path. We want to reject the navigation here so it doesn't
+  // violate assumptions in downstream code.
+  if (IsRendererDebugURL(dest_url)) {
+    LOG(WARNING) << "Refusing to load renderer debug URL: "
+                 << dest_url.possibly_invalid_spec();
+    return false;
+  }
+
   return true;
 }
 
@@ -413,7 +426,7 @@ bool DoesSandboxNavigationStayWithinSubtree(
     // sandboxed frame's subtree by walking up the tree looking for the
     // sandboxed frame.
     for (auto* frame = item->frame_tree_node(); frame;
-         frame = frame->parent()) {
+         frame = FrameTreeNode::From(frame->parent())) {
       if (frame->frame_tree_node_id() == sandbox_frame_tree_node_id) {
         within_subtree = true;
         break;
@@ -681,6 +694,23 @@ NavigationEntryImpl* NavigationControllerImpl::GetEntryWithUniqueID(
   return (index != -1) ? entries_[index].get() : nullptr;
 }
 
+void NavigationControllerImpl::RegisterExistingOriginToPreventOptInIsolation(
+    const url::Origin& origin) {
+  for (int i = 0; i < GetEntryCount(); i++) {
+    auto* entry = GetEntryAtIndex(i);
+    entry->RegisterExistingOriginToPreventOptInIsolation(origin);
+  }
+  if (entry_replaced_by_post_commit_error_) {
+    // It's possible we could come back to this entry if the error
+    // page/interstitial goes away.
+    entry_replaced_by_post_commit_error_
+        ->RegisterExistingOriginToPreventOptInIsolation(origin);
+  }
+  // TODO(wjmaclean): Register pending commit NavigationRequests rather than
+  // visiting pending_entry_, which lacks a committed origin. This will be done
+  // in https://chromium-review.googlesource.com/c/chromium/src/+/2136703.
+}
+
 void NavigationControllerImpl::SetPendingEntry(
     std::unique_ptr<NavigationEntryImpl> entry) {
   DiscardNonCommittedEntries();
@@ -749,7 +779,7 @@ bool NavigationControllerImpl::CanViewSource() {
                                !media::IsSupportedMediaMimeType(mime_type);
   NavigationEntry* visible_entry = GetVisibleEntry();
   return visible_entry && !visible_entry->IsViewSourceMode() &&
-         is_viewable_mime_type && !delegate_->GetInterstitialPage();
+         is_viewable_mime_type;
 }
 
 int NavigationControllerImpl::GetLastCommittedEntryIndex() {
@@ -1206,6 +1236,15 @@ bool NavigationControllerImpl::RendererDidNavigate(
   details->is_main_frame = !rfh->GetParent();
   details->http_status_code = params.http_status_code;
 
+  // If the NavigationRequest was created without a NavigationEntry and
+  // SetIsOverridingUserAgent() was called, it needs to be applied to the
+  // NavigationEntry now.
+  if (!navigation_request->nav_entry_id() &&
+      navigation_request->was_set_overriding_user_agent_called()) {
+    active_entry->SetIsOverridingUserAgent(
+        navigation_request->entry_overrides_ua());
+  }
+
   NotifyNavigationEntryCommitted(details);
 
   if (active_entry->GetURL().SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
@@ -1525,9 +1564,9 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     last_committed_entry_index_ = pending_entry_index_;
   }
 
-  SetShouldSkipOnBackForwardUIIfNeeded(rfh, replace_entry,
-                                       previous_document_was_activated,
-                                       request->IsRendererInitiated());
+  SetShouldSkipOnBackForwardUIIfNeeded(
+      rfh, replace_entry, previous_document_was_activated,
+      request->IsRendererInitiated(), request->GetPreviousPageUkmSourceId());
 
   InsertOrReplaceEntry(std::move(new_entry), replace_entry,
                        !request->post_commit_error_page_html().empty());
@@ -1807,9 +1846,9 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
           std::move(frame_entry), is_same_document, rfh->frame_tree_node(),
           delegate_->GetFrameTree()->root());
 
-  SetShouldSkipOnBackForwardUIIfNeeded(rfh, replace_entry,
-                                       previous_document_was_activated,
-                                       request->IsRendererInitiated());
+  SetShouldSkipOnBackForwardUIIfNeeded(
+      rfh, replace_entry, previous_document_was_activated,
+      request->IsRendererInitiated(), request->GetPreviousPageUkmSourceId());
 
   // TODO(creis): Update this to add the frame_entry if we can't find the one
   // to replace, which can happen due to a unique name change. See
@@ -2214,6 +2253,7 @@ void NavigationControllerImpl::GoToOffsetInSandboxedFrame(
 void NavigationControllerImpl::NavigateFromFrameProxy(
     RenderFrameHostImpl* render_frame_host,
     const GURL& url,
+    const GlobalFrameRoutingId& initiator_routing_id,
     const base::Optional<url::Origin>& initiator_origin,
     bool is_renderer_initiated,
     SiteInstance* source_site_instance,
@@ -2224,7 +2264,8 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
     const std::string& method,
     scoped_refptr<network::ResourceRequestBody> post_body,
     const std::string& extra_headers,
-    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {
+    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
+    const base::Optional<Impression>& impression) {
   if (is_renderer_initiated)
     DCHECK(initiator_origin.has_value());
 
@@ -2303,6 +2344,7 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
   }
 
   LoadURLParams params(url);
+  params.initiator_routing_id = initiator_routing_id;
   params.initiator_origin = initiator_origin;
   params.source_site_instance = source_site_instance;
   params.load_type = method == "POST" ? LOAD_TYPE_HTTP_POST : LOAD_TYPE_DEFAULT;
@@ -2328,6 +2370,7 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
   /* params.input_start: skip */
   params.was_activated = mojom::WasActivatedOption::kUnknown;
   /* params.reload_type: skip */
+  params.impression = impression;
 
   std::unique_ptr<NavigationRequest> request =
       CreateNavigationRequestFromLoadParams(
@@ -2623,19 +2666,6 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
       pending_entry_->GetTransitionType() & ui::PAGE_TRANSITION_FORWARD_BACK) {
     delegate_->Stop();
 
-    // If an interstitial page is showing, we want to close it to get back to
-    // what was showing before.
-    //
-    // There are two ways to get the interstitial page given a WebContents.
-    // Because WebContents::GetInterstitialPage() returns null between the
-    // interstitial's Show() method being called and the interstitial becoming
-    // visible, while InterstitialPage::GetInterstitialPage() returns the
-    // interstitial during that time, use the latter.
-    InterstitialPage* interstitial =
-        InterstitialPage::GetInterstitialPage(GetWebContents());
-    if (interstitial)
-      interstitial->DontProceed();
-
     DiscardNonCommittedEntries();
     return;
   }
@@ -2706,16 +2736,6 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
     }
   }
 
-  // If an interstitial page is showing, the previous renderer is blocked and
-  // cannot make new requests.  Unblock (and disable) it to allow this
-  // navigation to succeed.  The interstitial will stay visible until the
-  // resulting DidNavigate.
-  // TODO(clamy): See if this can be removed. See https://crbug.com/849250.
-  if (delegate_->GetInterstitialPage()) {
-    static_cast<InterstitialPageImpl*>(delegate_->GetInterstitialPage())
-        ->CancelForNavigation();
-  }
-
   // This call does not support re-entrancy.  See http://crbug.com/347742.
   CHECK(!in_navigate_to_pending_entry_);
   in_navigate_to_pending_entry_ = true;
@@ -2942,15 +2962,6 @@ void NavigationControllerImpl::NavigateWithoutEntry(
   ValidateRequestMatchesEntry(request.get(), pending_entry_);
 #endif
 
-  // If an interstitial page is showing, the previous renderer is blocked and
-  // cannot make new requests.  Unblock (and disable) it to allow this
-  // navigation to succeed.  The interstitial will stay visible until the
-  // resulting DidNavigate.
-  if (delegate_->GetInterstitialPage()) {
-    static_cast<InterstitialPageImpl*>(delegate_->GetInterstitialPage())
-        ->CancelForNavigation();
-  }
-
   // This call does not support re-entrancy.  See http://crbug.com/347742.
   CHECK(!in_navigate_to_pending_entry_);
   in_navigate_to_pending_entry_ = true;
@@ -2977,8 +2988,7 @@ void NavigationControllerImpl::HandleRendererDebugURL(
       DiscardNonCommittedEntries();
       return;
     }
-    frame_tree_node->render_manager()->InitializeRenderFrameIfNecessary(
-        frame_tree_node->current_frame_host());
+    frame_tree_node->render_manager()->InitializeRenderFrameForImmediateUse();
   }
   frame_tree_node->current_frame_host()->HandleRendererDebugURL(url);
 }
@@ -3241,9 +3251,10 @@ NavigationControllerImpl::CreateNavigationRequestFromLoadParams(
 
   auto navigation_request = NavigationRequest::CreateBrowserInitiated(
       node, std::move(common_params), std::move(commit_params),
-      !params.is_renderer_initiated, extra_headers_crlf, frame_entry, entry,
-      request_body,
-      params.navigation_ui_data ? params.navigation_ui_data->Clone() : nullptr);
+      !params.is_renderer_initiated, params.initiator_routing_id,
+      extra_headers_crlf, frame_entry, entry, request_body,
+      params.navigation_ui_data ? params.navigation_ui_data->Clone() : nullptr,
+      params.impression);
   navigation_request->set_from_download_cross_origin_redirect(
       params.from_download_cross_origin_redirect);
   return navigation_request;
@@ -3351,8 +3362,10 @@ NavigationControllerImpl::CreateNavigationRequestFromEntry(
 
   return NavigationRequest::CreateBrowserInitiated(
       frame_tree_node, std::move(common_params), std::move(commit_params),
-      !entry->is_renderer_initiated(), entry->extra_headers(), frame_entry,
-      entry, request_body, nullptr /* navigation_ui_data */);
+      !entry->is_renderer_initiated(),
+      GlobalFrameRoutingId() /* initiator_routing_id */, entry->extra_headers(),
+      frame_entry, entry, request_body, nullptr /* navigation_ui_data */,
+      base::nullopt /* impression */);
 }
 
 void NavigationControllerImpl::NotifyNavigationEntryCommitted(
@@ -3434,9 +3447,11 @@ void NavigationControllerImpl::LoadPostCommitErrorPage(
   std::unique_ptr<NavigationRequest> navigation_request =
       NavigationRequest::CreateBrowserInitiated(
           node, std::move(common_params), std::move(commit_params),
-          true /* browser_initiated */, "" /* extra_headers */,
-          nullptr /* frame_entry */, nullptr /* entry */,
-          nullptr /* post_body */, nullptr /* navigation_ui_data */);
+          true /* browser_initiated */,
+          GlobalFrameRoutingId() /* initiator_routing_id */,
+          "" /* extra_headers */, nullptr /* frame_entry */,
+          nullptr /* entry */, nullptr /* post_body */,
+          nullptr /* navigation_ui_data */, base::nullopt /* impression */);
   navigation_request->set_post_commit_error_page_html(error_page_html);
   navigation_request->set_net_error(error);
   node->CreatedNavigationRequest(std::move(navigation_request));
@@ -3544,7 +3559,8 @@ void NavigationControllerImpl::SetShouldSkipOnBackForwardUIIfNeeded(
     RenderFrameHostImpl* rfh,
     bool replace_entry,
     bool previous_document_was_activated,
-    bool is_renderer_initiated) {
+    bool is_renderer_initiated,
+    ukm::SourceId previous_page_load_ukm_source_id) {
   // Note that for a subframe, previous_document_was_activated is true if the
   // gesture happened in any subframe (propagated to main frame) or in the main
   // frame itself.
@@ -3563,15 +3579,10 @@ void NavigationControllerImpl::SetShouldSkipOnBackForwardUIIfNeeded(
   UMA_HISTOGRAM_BOOLEAN("Navigation.BackForward.SetShouldSkipOnBackForwardUI",
                         true);
 
-  // Log UKM with the URL we are navigating away from. Note that
-  // GetUkmSourceIdForLastCommittedSource looks into the WebContents to get
-  // the last committed source. Since WebContents has not yet been updated
-  // with the current URL being committed, this should give the correct source
-  // even though |rfh| here belongs to the current navigation.
-  ukm::SourceId source_id =
-      rfh->delegate()->GetUkmSourceIdForLastCommittedSource();
-  ukm::builders::HistoryManipulationIntervention(source_id).Record(
-      ukm::UkmRecorder::Get());
+  // Log UKM with the URL we are navigating away from.
+  ukm::builders::HistoryManipulationIntervention(
+      previous_page_load_ukm_source_id)
+      .Record(ukm::UkmRecorder::Get());
 }
 
 void NavigationControllerImpl::SetSkippableForSameDocumentEntries(
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl.h b/chromium/content/browser/frame_host/navigation_controller_impl.h
index 00ab09d3d71..e7ec7e7e204 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl.h
+++ b/chromium/content/browser/frame_host/navigation_controller_impl.h
@@ -154,6 +154,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   void NavigateFromFrameProxy(
       RenderFrameHostImpl* render_frame_host,
       const GURL& url,
+      const GlobalFrameRoutingId& initiator_routing_id,
       const base::Optional<url::Origin>& initiator_origin,
       bool is_renderer_initiated,
       SiteInstance* source_site_instance,
@@ -164,7 +165,8 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
       const std::string& method,
       scoped_refptr<network::ResourceRequestBody> post_body,
       const std::string& extra_headers,
-      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory);
+      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
+      const base::Optional<Impression>& impression);
 
   // Whether this is the initial navigation in an unmodified new tab.  In this
   // case, we know there is no content displayed in the page.
@@ -203,6 +205,16 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // For use by WebContentsImpl ------------------------------------------------
 
+  // Visit all FrameNavigationEntries and register any instances of |origin| as
+  // non-isolated with their respective BrowsingInstances. This is important
+  // when |origin| requests isolation, so that we only do so in
+  // BrowsingInstances that haven't seen it before.
+  // TODO(crbug.com/1062719): Ensure that all origin instances are tracked,
+  // since currently NavigationEntries and FrameNavigationEntries may be missing
+  // for some active frames, or in pending navigations. This will be fixed when
+  // https://chromium-review.googlesource.com/c/chromium/src/+/2136703 lands.
+  void RegisterExistingOriginToPreventOptInIsolation(const url::Origin& origin);
+
   // Allow renderer-initiated navigations to create a pending entry when the
   // provisional load starts.
   void SetPendingEntry(std::unique_ptr<NavigationEntryImpl> entry);
@@ -533,7 +545,8 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
       RenderFrameHostImpl* rfh,
       bool replace_entry,
       bool previous_document_was_activated,
-      bool is_renderer_initiated);
+      bool is_renderer_initiated,
+      ukm::SourceId previous_page_load_ukm_source_id);
 
   // This function sets all same document entries with the same value
   // of skippable flag. This is to avoid back button abuse by inserting
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 8ba4e1442d3..df0eef5387b 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -53,6 +53,7 @@
 #include "content/public/common/screen_info.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -126,6 +127,10 @@ class NavigationControllerBrowserTest : public ContentBrowserTest {
         "internals.runtimeFlags.fractionalScrollOffsetsEnabled";
     return EvalJs(shell(), script).ExtractBool();
   }
+
+  WebContentsImpl* contents() const {
+    return static_cast<WebContentsImpl*>(shell()->web_contents());
+  }
 };
 
 // Base class for tests that need to supply modifications to EmbeddedTestServer
@@ -883,7 +888,7 @@ class LoadCommittedCapturer : public WebContentsObserver {
     // Don't pay attention to pending delete RenderFrameHosts in the main frame,
     // which might happen in a race if a cross-process navigation happens
     // quickly.
-    if (!rfh->is_active()) {
+    if (rfh->IsPendingDeletion()) {
       DLOG(INFO) << "Skipping pending delete RFH: "
                  << rfh->GetSiteInstance()->GetSiteURL();
       return;
@@ -8650,7 +8655,7 @@ IN_PROC_BROWSER_TEST_F(
   EXPECT_EQ("\"done\"", message);
 
   // |frame| is now pending deletion.
-  EXPECT_FALSE(static_cast<RenderFrameHostImpl*>(frame)->is_active());
+  EXPECT_TRUE(static_cast<RenderFrameHostImpl*>(frame)->IsPendingDeletion());
 
   std::string error_html = "Error page";
   DidStartNavigationObserver did_start_navigation_observer(
@@ -10474,4 +10479,122 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTestNoServer,
   EXPECT_EQ(PAGE_TYPE_ERROR, entry->GetPageType());
 }
 
+// Test for a navigation that is
+// 1) initiated by a cross-site frame
+// 2) same-document
+// 3) to a http URL with port 0.
+// This is the scenario behind https://crbug.com/1065532.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       SameDocumentNavigationToHttpPortZero) {
+  GURL page_url(embedded_test_server()->GetURL(
+      "foo.com", "/navigation_controller/simple_page_1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
+
+  // Inject a HTTP subframe.
+  const char kSubframeScriptTemplate[] = R"(
+      var iframe = document.createElement('iframe');
+      iframe.src = $1;
+      document.body.appendChild(iframe);
+  )";
+  GURL subframe_initial_url =
+      embedded_test_server()->GetURL("another-site.com", "/title2.html");
+  {
+    TestNavigationObserver subframe_injection_observer(shell()->web_contents(),
+                                                       1);
+    ASSERT_TRUE(ExecJs(
+        shell(), JsReplace(kSubframeScriptTemplate, subframe_initial_url)));
+    subframe_injection_observer.WaitForNavigationFinished();
+    ASSERT_TRUE(subframe_injection_observer.last_navigation_succeeded());
+  }
+
+  // From the main page initiate a navigation of the cross-site subframe to a
+  // http URL that has port=0.  Note that this is valid port according to the
+  // URL spec (https://url.spec.whatwg.org/#port-state).
+  //
+  // Before the fix for SchemeHostPort's handling of port=0 the 2nd iteration
+  // below would produce a browser process CHECK/crash:
+  // - Iteration #1: The navigation will error out (because nothing is listening
+  //   on port zero in the test case).  Since
+  //   RenderFrameHostImpl::FailedNavigation doesn't call
+  //   GetOriginForURLLoaderFactory, this iteration wouldn't trigger a crash.
+  // - Iteration #2: The navigation will be treated as a same-document
+  //   navigation, because |old_url| and |new_url| will be considered the same
+  //   when inspected by GetNavigationType in navigation_controller_impl.cc.
+  //   This will trigger a call to GetOriginForURLLoaderFactory which will
+  //   crash if port=0 confuses url::Origin::Resolve.  It is unclear if treating
+  //   the 2nd iteration as same-document should be considered a bug (see also
+  //   https://crbug.com/1065532#c4).
+  //
+  // After the fix for SchemeHostPort's handling of port=0, both iterations
+  // would trigger a CANNOT_COMMIT_ORIGIN kill (see below).
+  GURL::Replacements replace_port_and_ref;
+  replace_port_and_ref.SetPortStr("0");
+  replace_port_and_ref.SetRefStr("someRef");
+  GURL subframe_ref_url =
+      subframe_initial_url.ReplaceComponents(replace_port_and_ref);
+  // Doing 2 iterations, to test the same-document navigation case as outlined
+  // in the big comment above.  This test coverage will be important if we ever
+  // fix the renderer kill that started happening after fixing SchemeHostPort's
+  // handling of port=0..
+  for (int i = 0; i < 2; i++) {
+    SCOPED_TRACE(::testing::Message() << "Navigation #" << i);
+
+    // TODO(lukasza): https://crbug.com/1065532: blink::KURL and
+    // blink::SecurityOrigin treat port=0 as an invalid port, which leads to
+    // committing an origin with port=80 rather than port=0 which leads to a
+    // CANNOT_COMMIT_ORIGIN renderer kill.  This is bad, but not as bad as a
+    // browser crash from the bug, so let's keep things this way going forward.
+    ASSERT_EQ(2u, shell()->web_contents()->GetAllFrames().size());
+    RenderProcessHostBadIpcMessageWaiter bad_ipc_waiter(
+        shell()->web_contents()->GetAllFrames()[1]->GetProcess());
+
+    TestNavigationObserver subframe_ref_observer(shell()->web_contents(), 1);
+    ASSERT_TRUE(
+        ExecJs(shell(), JsReplace("document.querySelector('iframe').src = $1;",
+                                  subframe_ref_url)));
+
+#if 1
+    // TODO(lukasza): https://crbug.com/1065532: blink::KURL and
+    // blink::SecurityOrigin treat port=0 as an invalid port [...]
+    // (see the same comment above).
+    EXPECT_EQ(bad_message::RFH_INVALID_ORIGIN_ON_COMMIT, bad_ipc_waiter.Wait());
+    if (!AreAllSitesIsolatedForTesting()) {
+      // Without site-per-process the main frame and the subframe are hosted in
+      // the same (killed) renderer process, which makes it difficult to
+      // continue the test after the first kill.
+      return;
+    }
+#else
+    subframe_ref_url.WaitForNavigationFinished();
+#endif
+  }
+}
+
+// Navigating a subframe to the same URL should not generate a history entry.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       NoHistoryOnNavigationToSameUrl) {
+  {
+    GURL frame_url = embedded_test_server()->GetURL(
+        "a.com", "/cross_site_iframe_factory.html?a(a)");
+
+    ASSERT_TRUE(NavigateToURL(shell(), frame_url));
+    FrameTreeNode* child = contents()->GetFrameTree()->root()->child_at(0);
+    GURL child_url = child->current_url();
+    int entry_count = contents()->GetController().GetEntryCount();
+    ASSERT_TRUE(NavigateFrameToURL(child, child_url));
+    EXPECT_EQ(entry_count, contents()->GetController().GetEntryCount());
+  }
+  {
+    GURL frame_url = embedded_test_server()->GetURL(
+        "a.com", "/cross_site_iframe_factory.html?a(b)");
+
+    ASSERT_TRUE(NavigateToURL(shell(), frame_url));
+    FrameTreeNode* child = contents()->GetFrameTree()->root()->child_at(0);
+    GURL child_url = child->current_url();
+    int entry_count = contents()->GetController().GetEntryCount();
+    ASSERT_TRUE(NavigateFrameToURL(child, child_url));
+    EXPECT_EQ(entry_count, contents()->GetController().GetEntryCount());
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc b/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
index 58365f21e71..ea263eebfa0 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -27,9 +27,10 @@
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
-#include "content/browser/frame_host/navigator_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/browser/webui/content_web_ui_controller_factory.h"
+#include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/render_view_host.h"
@@ -158,15 +159,12 @@ class NavigationControllerTest : public RenderViewHostImplTestHarness,
     WebContents* web_contents = RenderViewHostImplTestHarness::web_contents();
     ASSERT_TRUE(web_contents);  // The WebContents should be created by now.
     WebContentsObserver::Observe(web_contents);
-  }
 
-  // WebContentsObserver:
-  void DidStartNavigationToPendingEntry(const GURL& url,
-                                        ReloadType reload_type) override {
-    navigated_url_ = url;
-    last_reload_type_ = reload_type;
+    WebUIControllerFactory::RegisterFactory(
+        ContentWebUIControllerFactory::GetInstance());
   }
 
+  // WebContentsObserver:
   void NavigationEntryCommitted(
       const LoadCommittedDetails& load_details) override {
     navigation_entry_committed_counter_++;
@@ -186,8 +184,6 @@ class NavigationControllerTest : public RenderViewHostImplTestHarness,
     navigation_entries_deleted_counter_++;
   }
 
-  const GURL& navigated_url() const { return navigated_url_; }
-
   NavigationControllerImpl& controller_impl() {
     return static_cast<NavigationControllerImpl&>(controller());
   }
@@ -218,13 +214,11 @@ class NavigationControllerTest : public RenderViewHostImplTestHarness,
   FrameTreeNode* root_ftn() { return contents()->GetFrameTree()->root(); }
 
  protected:
-  GURL navigated_url_;
   size_t navigation_entry_committed_counter_ = 0;
   size_t navigation_entry_changed_counter_ = 0;
   size_t navigation_list_pruned_counter_ = 0;
   size_t navigation_entries_deleted_counter_ = 0;
   PrunedDetails last_navigation_entry_pruned_details_;
-  ReloadType last_reload_type_;
 };
 
 class TestWebContentsDelegate : public WebContentsDelegate {
@@ -905,23 +899,13 @@ TEST_F(NavigationControllerTest, LoadURL_PrivilegedPending) {
   NavigationControllerImpl& controller = controller_impl();
 
   // First make some history, starting with a privileged URL.
-  const GURL kExistingURL1("chrome://privileged");
-  auto navigation =
-      NavigationSimulator::CreateBrowserInitiated(kExistingURL1, contents());
-  navigation->Start();
-  navigation->ReadyToCommit();
-  // Pretend it has bindings so we can tell if we incorrectly copy it. This has
-  // to be done after ReadyToCommit, otherwise we won't use the current RFH to
-  // commit since its bindings don't match the URL.
-  EXPECT_EQ(0, main_test_rfh()->GetEnabledBindings());
-  main_test_rfh()->AllowBindings(BINDINGS_POLICY_MOJO_WEB_UI);
-  EXPECT_EQ(BINDINGS_POLICY_MOJO_WEB_UI, main_test_rfh()->GetEnabledBindings());
-  navigation->Commit();
+  const GURL kExistingURL1("chrome://gpu");
+  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), kExistingURL1);
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
-  EXPECT_EQ(BINDINGS_POLICY_MOJO_WEB_UI, controller.GetLastCommittedEntry()
-                                             ->GetFrameEntry(root_ftn())
-                                             ->bindings());
+  EXPECT_EQ(BINDINGS_POLICY_WEB_UI, controller.GetLastCommittedEntry()
+                                        ->GetFrameEntry(root_ftn())
+                                        ->bindings());
   // Simulate a user gesture so that the above entry is not marked to be skipped
   // on back.
   main_test_rfh()->frame_tree_node()->UpdateUserActivationState(
@@ -946,7 +930,7 @@ TEST_F(NavigationControllerTest, LoadURL_PrivilegedPending) {
   EXPECT_EQ(0, controller.GetPendingEntryIndex());
   EXPECT_EQ(1, controller.GetLastCommittedEntryIndex());
   EXPECT_EQ(
-      BINDINGS_POLICY_MOJO_WEB_UI,
+      BINDINGS_POLICY_WEB_UI,
       controller.GetPendingEntry()->GetFrameEntry(root_ftn())->bindings());
 
   // Before that commits, do a new navigation.
@@ -1163,55 +1147,6 @@ TEST_F(NavigationControllerTest, LoadURL_RedirectAbortDoesntShowPendingURL) {
   contents()->SetDelegate(nullptr);
 }
 
-// Ensure that NavigationEntries track which bindings their RenderViewHost had
-// at the time they committed.  http://crbug.com/173672.
-TEST_F(NavigationControllerTest, LoadURL_WithBindings) {
-  NavigationControllerImpl& controller = controller_impl();
-  std::vector<GURL> url_chain;
-
-  const GURL url1("http://foo1");
-  const GURL url2("http://foo2");
-
-  // Navigate to a first, unprivileged URL.
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(controller.GetEntryCount(), 1);
-  EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(0, controller.GetLastCommittedEntry()
-                   ->GetFrameEntry(root_ftn())
-                   ->bindings());
-
-  // Manually increase the number of active frames in the SiteInstance
-  // that orig_rfh belongs to, to prevent it from being destroyed when
-  // it gets swapped out, so that we can reuse orig_rfh when the
-  // controller goes back.
-  main_test_rfh()->GetSiteInstance()->IncrementActiveFrameCount();
-
-  // Navigate to a second URL, simulate the beforeunload ack for the cross-site
-  // transition, and set bindings on the pending RenderFrameHost to simulate a
-  // privileged url.
-  auto navigation =
-      NavigationSimulator::CreateBrowserInitiated(url2, contents());
-  navigation->ReadyToCommit();
-  TestRenderFrameHost* new_rfh = contents()->GetPendingMainFrame();
-  new_rfh->AllowBindings(BINDINGS_POLICY_WEB_UI);
-  navigation->Commit();
-
-  // The second load should be committed, and bindings should be remembered.
-  EXPECT_EQ(controller.GetEntryCount(), 2);
-  EXPECT_EQ(1, controller.GetLastCommittedEntryIndex());
-  EXPECT_TRUE(controller.CanGoBack());
-  EXPECT_EQ(1, controller.GetLastCommittedEntry()
-                   ->GetFrameEntry(root_ftn())
-                   ->bindings());
-
-  // Going back, the first entry should still appear unprivileged.
-  NavigationSimulator::GoBack(contents());
-  EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(0, controller.GetLastCommittedEntry()
-                   ->GetFrameEntry(root_ftn())
-                   ->bindings());
-}
-
 TEST_F(NavigationControllerTest, Reload) {
   NavigationControllerImpl& controller = controller_impl();
 
@@ -1352,7 +1287,6 @@ TEST_F(NavigationControllerTest, ReloadOriginalRequestURL) {
   EXPECT_EQ(0U, navigation_list_pruned_counter_);
 
   // The reload is pending.  The request should point to the original URL.
-  EXPECT_EQ(original_url, navigated_url());
   EXPECT_EQ(controller.GetEntryCount(), 1);
   EXPECT_EQ(controller.GetLastCommittedEntryIndex(), 0);
   EXPECT_EQ(controller.GetPendingEntryIndex(), 0);
@@ -1981,16 +1915,16 @@ TEST_F(NavigationControllerTest, AutoSubframe) {
   NavigationSimulator::NavigateAndCommitFromDocument(url1, main_test_rfh());
   EXPECT_EQ(1U, navigation_entry_committed_counter_);
   navigation_entry_committed_counter_ = 0;
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Add a subframe and navigate it.
   std::string unique_name0("uniqueName0");
   main_test_rfh()->OnCreateChildFrame(
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name0, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name0,
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   const GURL url2("http://foo/2");
@@ -2026,9 +1960,9 @@ TEST_F(NavigationControllerTest, AutoSubframe) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name1, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name1,
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   TestRenderFrameHost* subframe2 = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(1)->current_frame_host());
   const GURL url3("http://foo/3");
@@ -2064,9 +1998,9 @@ TEST_F(NavigationControllerTest, AutoSubframe) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name2, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name2,
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   TestRenderFrameHost* subframe3 =
       static_cast<TestRenderFrameHost*>(contents()
                                             ->GetFrameTree()
@@ -2120,10 +2054,10 @@ TEST_F(NavigationControllerTest, BackSubframe) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name, false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   FrameTreeNode* subframe = contents()->GetFrameTree()->root()->child_at(0);
   TestRenderFrameHost* subframe_rfh =
       static_cast<TestRenderFrameHost*>(subframe->current_frame_host());
@@ -3057,7 +2991,7 @@ TEST_F(NavigationControllerTest, ShowBrowserURLAfterFailUntilModified) {
 
   // Suppose it aborts before committing, if it's a 204 or download or due to a
   // stop or a new navigation from the user.  The URL should remain visible.
-  static_cast<NavigatorImpl*>(main_test_rfh()->frame_tree_node()->navigator())
+  static_cast<Navigator*>(main_test_rfh()->frame_tree_node()->navigator())
       ->CancelNavigation(main_test_rfh()->frame_tree_node());
   EXPECT_EQ(url, controller.GetVisibleEntry()->GetURL());
 
@@ -3355,10 +3289,10 @@ TEST_F(NavigationControllerTest, SameSubframe) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name, false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   const GURL subframe_url("http://www.google.com/#");
@@ -3523,10 +3457,10 @@ TEST_F(NavigationControllerTest, SubframeWhilePending) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name, false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   const GURL url1_sub("http://foo/subframe");
@@ -4587,79 +4521,6 @@ TEST_F(NavigationControllerTest, StaleNavigationsResurrected) {
   EXPECT_EQ(url_b, controller.GetEntryAtIndex(2)->GetURL());
 }
 
-// Tests that successive navigations with intermittent duplicate navigations
-// are correctly marked as reload in the navigation controller.
-// We test the cases where in a navigation is pending/comitted before the new
-// navigation is initiated.
-// http://crbug.com/664319
-TEST_F(NavigationControllerTest, MultipleNavigationsAndReload) {
-  NavigationControllerImpl& controller = controller_impl();
-
-  GURL initial_url("http://www.google.com");
-  GURL url_1("http://foo.com");
-  GURL url_2("http://foo2.com");
-
-  // Test 1.
-  // A normal navigation to initial_url should not be marked as a reload.
-  auto navigation1 =
-      NavigationSimulator::CreateBrowserInitiated(initial_url, contents());
-  navigation1->Start();
-  EXPECT_EQ(initial_url, controller.GetVisibleEntry()->GetURL());
-  navigation1->Commit();
-  EXPECT_EQ(ReloadType::NONE, last_reload_type_);
-
-  // Test 2.
-  // A navigation to initial_url with the navigation commit delayed should be
-  // marked as a reload.
-  auto navigation2 =
-      NavigationSimulator::CreateBrowserInitiated(initial_url, contents());
-  navigation2->Start();
-  EXPECT_EQ(initial_url, controller.GetVisibleEntry()->GetURL());
-  navigation2->ReadyToCommit();
-  EXPECT_EQ(initial_url, controller.GetVisibleEntry()->GetURL());
-  EXPECT_EQ(ReloadType::NORMAL, last_reload_type_);
-
-  // Test 3.
-  // A navigation to url_1 while the navigation to intial_url is still pending
-  // should not be marked as a reload.
-  auto navigation3 =
-      NavigationSimulator::CreateBrowserInitiated(url_1, contents());
-  navigation3->Start();
-  EXPECT_EQ(url_1, controller.GetVisibleEntry()->GetURL());
-  EXPECT_EQ(ReloadType::NONE, last_reload_type_);
-
-  // Test 4.
-  // A navigation to url_1 while the previous navigation to url_1 is pending
-  // should not be marked as reload. Even though the URL is the same as the
-  // previous navigation, the previous navigation did not commit. We can only
-  // reload navigations that committed. See https://crbug.com/809040.
-  auto navigation4 =
-      NavigationSimulator::CreateBrowserInitiated(url_1, contents());
-  navigation4->Start();
-  EXPECT_EQ(url_1, controller.GetVisibleEntry()->GetURL());
-  EXPECT_EQ(ReloadType::NONE, last_reload_type_);
-
-  navigation2->Commit();
-
-  // Test 5
-  // A navigation to url_2 followed by a navigation to the previously pending
-  // url_1 should not be marked as a reload.
-  auto navigation5 =
-      NavigationSimulator::CreateBrowserInitiated(url_2, contents());
-  navigation5->Start();
-  EXPECT_EQ(url_2, controller.GetVisibleEntry()->GetURL());
-  EXPECT_EQ(ReloadType::NONE, last_reload_type_);
-
-  controller.LoadURL(url_1, Referrer(), ui::PAGE_TRANSITION_TYPED,
-                     std::string());
-  auto navigation6 =
-      NavigationSimulator::CreateBrowserInitiated(url_1, contents());
-  navigation6->ReadyToCommit();
-  EXPECT_EQ(url_1, controller.GetVisibleEntry()->GetURL());
-  EXPECT_EQ(ReloadType::NONE, last_reload_type_);
-  navigation6->Commit();
-}
-
 // Test to ensure that the pending entry index is updated when a transient entry
 // is inserted or removed.
 TEST_F(NavigationControllerTest, PendingEntryIndexUpdatedWithTransient) {
@@ -4784,10 +4645,10 @@ TEST_F(NavigationControllerTest, SubFrameNavigationUIData) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name, false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   const GURL subframe_url("http://foo1/subframe");
@@ -4837,11 +4698,12 @@ TEST_F(NavigationControllerTest, NoURLRewriteForSubframes) {
   FrameTreeNode* subframe_node =
       main_test_rfh()->frame_tree_node()->child_at(0);
   controller_impl().NavigateFromFrameProxy(
-      subframe_node->current_frame_host(), kSrcDoc, url::Origin::Create(kUrl2),
-      true /* is_renderer_initiated */, main_test_rfh()->GetSiteInstance(),
-      Referrer(), ui::PAGE_TRANSITION_LINK,
+      subframe_node->current_frame_host(), kSrcDoc,
+      GlobalFrameRoutingId() /* initiator_routing_id */,
+      url::Origin::Create(kUrl2), true /* is_renderer_initiated */,
+      main_test_rfh()->GetSiteInstance(), Referrer(), ui::PAGE_TRANSITION_LINK,
       false /* should_replace_current_entry */, NavigationDownloadPolicy(),
-      "GET", nullptr, "", nullptr);
+      "GET", nullptr, "", nullptr, base::nullopt);
 
   // Clean up the handler.
   BrowserURLHandlerImpl::GetInstance()->SetFixupHandlerForTesting(nullptr);
@@ -4873,10 +4735,12 @@ TEST_F(NavigationControllerTest,
   // replacement.
   const bool should_replace_current_entry = true;
   other_controller.NavigateFromFrameProxy(
-      frame, other_contents_url, url::Origin::Create(main_url),
-      true /* is_renderer_initiated */, main_test_rfh()->GetSiteInstance(),
-      Referrer(), ui::PAGE_TRANSITION_LINK, should_replace_current_entry,
-      NavigationDownloadPolicy(), "GET", nullptr, "", nullptr);
+      frame, other_contents_url,
+      GlobalFrameRoutingId() /* initiator_routing_id */,
+      url::Origin::Create(main_url), true /* is_renderer_initiated */,
+      main_test_rfh()->GetSiteInstance(), Referrer(), ui::PAGE_TRANSITION_LINK,
+      should_replace_current_entry, NavigationDownloadPolicy(), "GET", nullptr,
+      "", nullptr, base::nullopt);
   NavigationRequest* request = node->navigation_request();
   ASSERT_TRUE(request);
 
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl.cc b/chromium/content/browser/frame_host/navigation_entry_impl.cc
index 647ee38e007..6be77fe8508 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl.cc
+++ b/chromium/content/browser/frame_host/navigation_entry_impl.cc
@@ -162,7 +162,7 @@ void RecursivelyGenerateFrameState(
 // ancestor chain is detected, otherwise true.
 bool InSameTreePosition(FrameTreeNode* frame_tree_node,
                         NavigationEntryImpl::TreeNode* node) {
-  FrameTreeNode* ftn = frame_tree_node->parent();
+  FrameTreeNode* ftn = FrameTreeNode::From(frame_tree_node->parent());
   NavigationEntryImpl::TreeNode* current_node = node->parent;
   while (ftn && current_node) {
     if (!current_node->MatchesFrame(ftn))
@@ -173,7 +173,7 @@ bool InSameTreePosition(FrameTreeNode* frame_tree_node,
       return false;
     }
 
-    ftn = ftn->parent();
+    ftn = FrameTreeNode::From(ftn->parent());
     current_node = current_node->parent;
   }
   return true;
@@ -221,8 +221,27 @@ void RecursivelyInitRestoredTreeNode(BrowserContext* browser_context,
     RecursivelyInitRestoredTreeNode(browser_context, child.get());
 }
 
+void RegisterOriginsRecursive(NavigationEntryImpl::TreeNode* node,
+                              const url::Origin& origin) {
+  if (node->frame_entry->committed_origin().has_value()) {
+    const url::Origin node_origin =
+        node->frame_entry->committed_origin().value();
+    SiteInstanceImpl* site_instance = node->frame_entry->site_instance();
+    if (site_instance && origin == node_origin)
+      site_instance->PreventOptInOriginIsolation(node_origin);
+  }
+
+  for (auto& child : node->children)
+    RegisterOriginsRecursive(child.get(), origin);
+}
+
 }  // namespace
 
+void NavigationEntryImpl::RegisterExistingOriginToPreventOptInIsolation(
+    const url::Origin& origin) {
+  return RegisterOriginsRecursive(root_node(), origin);
+}
+
 NavigationEntryImpl::TreeNode::TreeNode(
     TreeNode* parent,
     scoped_refptr<FrameNavigationEntry> frame_entry)
@@ -524,6 +543,11 @@ const base::string16& NavigationEntryImpl::GetTitleForDisplay() {
     base::string16::size_type slashpos = title.rfind('/', lastpos);
     if (slashpos != base::string16::npos)
       title = title.substr(slashpos + 1);
+
+  } else if (GetURL().SchemeIs(kChromeUIUntrustedScheme)) {
+    // For chrome-untrusted:// URLs, leave title blank until the page loads.
+    title = base::string16();
+
   } else if (base::i18n::StringContainsStrongRTLChars(title)) {
     // Wrap the URL in an LTR embedding for proper handling of RTL characters.
     // (RFC 3987 Section 4.1 states that "Bidirectional IRIs MUST be rendered in
@@ -604,8 +628,8 @@ const GURL& NavigationEntryImpl::GetOriginalRequestURL() {
   return original_request_url_;
 }
 
-void NavigationEntryImpl::SetIsOverridingUserAgent(bool override) {
-  is_overriding_user_agent_ = override;
+void NavigationEntryImpl::SetIsOverridingUserAgent(bool override_ua) {
+  is_overriding_user_agent_ = override_ua;
 }
 
 bool NavigationEntryImpl::GetIsOverridingUserAgent() {
@@ -883,7 +907,7 @@ void NavigationEntryImpl::AddOrUpdateFrameEntry(
   // We should already have a TreeNode for the parent node by the time this node
   // commits.  Find it first.
   NavigationEntryImpl::TreeNode* parent_node =
-      GetTreeNode(frame_tree_node->parent());
+      GetTreeNode(FrameTreeNode::From(frame_tree_node->parent()));
   if (!parent_node) {
     // The renderer should not send a commit for a subframe before its parent.
     // TODO(creis): Kill the renderer if we get here.
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl.h b/chromium/content/browser/frame_host/navigation_entry_impl.h
index 101011ba1ae..ac969a4f025 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl.h
+++ b/chromium/content/browser/frame_host/navigation_entry_impl.h
@@ -31,6 +31,7 @@
 #include "content/public/browser/ssl_status.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/previews_state.h"
+#include "net/base/isolation_info.h"
 #include "url/origin.h"
 
 namespace content {
@@ -129,7 +130,7 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   SSLStatus& GetSSL() override;
   void SetOriginalRequestURL(const GURL& original_url) override;
   const GURL& GetOriginalRequestURL() override;
-  void SetIsOverridingUserAgent(bool override) override;
+  void SetIsOverridingUserAgent(bool override_ua) override;
   bool GetIsOverridingUserAgent() override;
   void SetTimestamp(base::Time timestamp) override;
   base::Time GetTimestamp() override;
@@ -250,6 +251,10 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   base::flat_map<std::string, bool> GetSubframeUniqueNames(
       FrameTreeNode* frame_tree_node) const;
 
+  // Walks the tree of FrameNavigationEntries to find entries with |origin| so
+  // their isolation status can be registered.
+  void RegisterExistingOriginToPreventOptInIsolation(const url::Origin& origin);
+
   // Removes any subframe FrameNavigationEntries that match the unique name of
   // |frame_tree_node|, and all of their children. There should be at most one,
   // since collisions are avoided but leave old FrameNavigationEntries in the
@@ -366,14 +371,12 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
     has_user_gesture_ = has_user_gesture;
   }
 
-  void set_network_isolation_key(
-      const net::NetworkIsolationKey& network_isolation_key) {
-    network_isolation_key_ = network_isolation_key;
+  void set_isolation_info(const net::IsolationInfo& isolation_info) {
+    isolation_info_ = isolation_info;
   }
 
-  const base::Optional<net::NetworkIsolationKey>& network_isolation_key()
-      const {
-    return network_isolation_key_;
+  const base::Optional<net::IsolationInfo>& isolation_info() const {
+    return isolation_info_;
   }
 
   // Stores a record of the what was committed in this NavigationEntry's main
@@ -506,11 +509,11 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   // for a pending navigation. Defaults to false.
   bool ssl_error_;
 
-  // The network isolation key for this NavigationEntry. If provided, this
-  // determines the network isolation key to be used when navigating to this
-  // NavigationEntry; otherwise, the key is determined based on the navigating
-  // frame and top frame origins.  For example, this is used for view-source.
-  base::Optional<net::NetworkIsolationKey> network_isolation_key_;
+  // The net::IsolationInfo for this NavigationEntry. If provided, this
+  // determines the IsolationInfo to be used when navigating to this
+  // NavigationEntry; otherwise, it is determined based on the navigating frame
+  // and top frame origins. For example, this is used for view-source.
+  base::Optional<net::IsolationInfo> isolation_info_;
 
   // Stores information about the entry prior to being replaced (e.g.
   // history.replaceState()). It is preserved after commit (session sync for
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc b/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
index 9ba008760f8..9316a03dd2f 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
@@ -156,6 +156,10 @@ TEST_F(NavigationEntryTest, NavigationEntryURLs) {
   EXPECT_EQ(ASCIIToUTF16("bar baz.txt?x=foo/bar?y=baz/boo"),
             entry1_->GetTitleForDisplay());
 
+  // For chrome-untrusted:// URLs, title is blank.
+  entry1_->SetURL(GURL("chrome-untrusted://terminal/html/terminal.html"));
+  EXPECT_EQ(base::string16(), entry1_->GetTitleForDisplay());
+
   // Title affects GetTitleForDisplay
   entry1_->SetTitle(ASCIIToUTF16("Google"));
   EXPECT_EQ(ASCIIToUTF16("Google"), entry1_->GetTitleForDisplay());
diff --git a/chromium/content/browser/frame_host/navigation_request.cc b/chromium/content/browser/frame_host/navigation_request.cc
index f0b9f963426..baf19ee3bae 100644
--- a/chromium/content/browser/frame_host/navigation_request.cc
+++ b/chromium/content/browser/frame_host/navigation_request.cc
@@ -6,9 +6,11 @@
 
 #include <utility>
 
+#include "base/auto_reset.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/debug/alias.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
 #include "base/memory/ptr_util.h"
@@ -30,6 +32,7 @@
 #include "content/browser/client_hints/client_hints.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/download/download_manager_impl.h"
+#include "content/browser/frame_host/cookie_utils.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ -37,7 +40,7 @@
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/frame_host/navigator.h"
-#include "content/browser/frame_host/navigator_impl.h"
+#include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/origin_policy_throttle.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/loader/browser_initiated_resource_request.h"
@@ -48,6 +51,7 @@
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
+#include "content/browser/scoped_active_url.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_main_resource_handle.h"
 #include "content/browser/site_instance_impl.h"
@@ -94,15 +98,19 @@
 #include "net/http/http_request_headers.h"
 #include "net/http/http_status_code.h"
 #include "net/url_request/redirect_info.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/content_security_policy/content_security_policy.h"
 #include "services/network/public/cpp/cross_origin_resource_policy.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
+#include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
@@ -216,11 +224,11 @@ void UpdateLoadFlagsWithCacheFlags(int* load_flags,
 }
 
 // TODO(clamy): This should be function in FrameTreeNode.
-bool IsSecureFrame(FrameTreeNode* frame) {
+bool IsSecureFrame(RenderFrameHostImpl* frame) {
   while (frame) {
-    if (!IsPotentiallyTrustworthyOrigin(frame->current_origin()))
+    if (!IsPotentiallyTrustworthyOrigin(frame->GetLastCommittedOrigin()))
       return false;
-    frame = frame->parent();
+    frame = frame->GetParent();
   }
   return true;
 }
@@ -252,17 +260,17 @@ bool NeedsHTTPOrigin(net::HttpRequestHeaders* headers,
 
 // TODO(clamy): This should match what's happening in
 // blink::FrameFetchContext::addAdditionalRequestHeaders.
-void AddAdditionalRequestHeaders(net::HttpRequestHeaders* headers,
-                                 const GURL& url,
-                                 mojom::NavigationType navigation_type,
-                                 ui::PageTransition transition,
-                                 BrowserContext* browser_context,
-                                 const std::string& method,
-                                 const std::string user_agent_override,
-                                 bool has_user_gesture,
-                                 base::Optional<url::Origin> initiator_origin,
-                                 blink::mojom::Referrer* referrer,
-                                 FrameTreeNode* frame_tree_node) {
+void AddAdditionalRequestHeaders(
+    net::HttpRequestHeaders* headers,
+    const GURL& url,
+    mojom::NavigationType navigation_type,
+    ui::PageTransition transition,
+    BrowserContext* browser_context,
+    const std::string& method,
+    const std::string& user_agent_override,
+    const base::Optional<url::Origin>& initiator_origin,
+    blink::mojom::Referrer* referrer,
+    FrameTreeNode* frame_tree_node) {
   if (!url.SchemeIsHTTPOrHTTPS())
     return;
 
@@ -334,11 +342,11 @@ bool ShouldPropagateUserActivation(const url::Origin& previous_origin,
 
   std::string previous_domain =
       net::registry_controlled_domains::GetDomainAndRegistry(
-          previous_origin.host(),
+          previous_origin,
           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   std::string new_domain =
       net::registry_controlled_domains::GetDomainAndRegistry(
-          new_origin.host(),
+          new_origin,
           net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   return !previous_domain.empty() && previous_domain == new_domain;
 }
@@ -544,7 +552,7 @@ int64_t CreateUniqueHandleID() {
   return ++unique_id_counter;
 }
 
-// Given an net::IPAddress and a set of headers, this function calculates the
+// Given an net::IPAddress and a CSP set, this function calculates the
 // IPAddressSpace which should be associated with the document this navigation
 // eventually commits into.
 //
@@ -557,35 +565,22 @@ int64_t CreateUniqueHandleID() {
 // some cases), but safe, as `kUnknown` is treated the same as `kPublic`.
 network::mojom::IPAddressSpace CalculateIPAddressSpace(
     const net::IPAddress& ip,
-    net::HttpResponseHeaders* headers) {
+    const std::vector<network::mojom::ContentSecurityPolicyPtr>& csp_policies) {
   // First, check whether the response forces itself into a public address space
   // as per https://wicg.github.io/cors-rfc1918/#csp.
-  bool must_treat_as_public_address = false;
-  std::string csp_value;
-  if (headers &&
-      headers->GetNormalizedHeader("content-security-policy", &csp_value)) {
-    // A content-security-policy is a semicolon-separated list of directives.
-    for (const auto& directive :
-         base::SplitStringPiece(csp_value, ";", base::TRIM_WHITESPACE,
-                                base::SPLIT_WANT_NONEMPTY)) {
-      if (base::EqualsCaseInsensitiveASCII("treat-as-public-address",
-                                           directive)) {
-        must_treat_as_public_address = true;
-      }
-    }
-  }
-
-  if (must_treat_as_public_address)
+  if (network::ShouldTreatAsPublicAddress(csp_policies))
     return network::mojom::IPAddressSpace::kPublic;
 
   // Otherwise, calculate the address space via the provided IP address.
-  if (!ip.IsValid()) {
+  if (!ip.IsValid())
     return network::mojom::IPAddressSpace::kUnknown;
-  } else if (ip.IsLoopback()) {
+
+  if (ip.IsLoopback())
     return network::mojom::IPAddressSpace::kLocal;
-  } else if (!ip.IsPubliclyRoutable()) {
+
+  if (!ip.IsPubliclyRoutable())
     return network::mojom::IPAddressSpace::kPrivate;
-  }
+
   return network::mojom::IPAddressSpace::kPublic;
 }
 
@@ -674,16 +669,19 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::CommitNavigationParamsPtr commit_params,
     bool browser_initiated,
+    const GlobalFrameRoutingId& initiator_routing_id,
     const std::string& extra_headers,
     FrameNavigationEntry* frame_entry,
     NavigationEntryImpl* entry,
     const scoped_refptr<network::ResourceRequestBody>& post_body,
-    std::unique_ptr<NavigationUIData> navigation_ui_data) {
+    std::unique_ptr<NavigationUIData> navigation_ui_data,
+    const base::Optional<Impression>& impression) {
   // TODO(arthursonzogni): Form submission with the "GET" method is possible.
   // This is not currently handled here.
   bool is_form_submission = !!post_body;
 
   auto navigation_params = mojom::BeginNavigationParams::New(
+      initiator_routing_id.frame_routing_id /* initiator_routing_id */,
       extra_headers, net::LOAD_NORMAL, false /* skip_service_worker */,
       blink::mojom::RequestContextType::LOCATION,
       network::mojom::RequestDestination::kDocument,
@@ -692,7 +690,8 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
       std::string() /* searchable_form_encoding */,
       GURL() /* client_side_redirect_url */,
       base::nullopt /* devtools_initiator_info */,
-      false /* attach_same_site_cookies */, nullptr /* trust_token_params */);
+      false /* force_ignore_site_for_cookies */,
+      nullptr /* trust_token_params */, impression);
 
   // Shift-Reload forces bypassing caches and service workers.
   if (common_params->navigation_type ==
@@ -726,6 +725,8 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
         frame_entry->blob_url_loader_factory();
   }
 
+  navigation_request->initiator_routing_id_ = initiator_routing_id;
+
   if (navigation_request->common_params().url.SchemeIsBlob() &&
       !navigation_request->blob_url_loader_factory_) {
     // If this navigation entry came from session history then the blob factory
@@ -821,6 +822,14 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateRendererInitiated(
       std::move(prefetched_signed_exchange_cache);
   navigation_request->web_bundle_handle_tracker_ =
       std::move(web_bundle_handle_tracker);
+
+  // CreateRendererInitiated() should only be triggered when the navigation is
+  // initiated by a frame in the same process.
+  // TODO(https://crbug.com/1074464): Find a way to DCHECK that the routing ID
+  // is from the current RFH.
+  navigation_request->initiator_routing_id_ = GlobalFrameRoutingId(
+      frame_tree_node->current_frame_host()->GetProcess()->GetID(),
+      navigation_request->begin_params()->initiator_routing_id);
   return navigation_request;
 }
 
@@ -828,9 +837,8 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateRendererInitiated(
 std::unique_ptr<NavigationRequest> NavigationRequest::CreateForCommit(
     FrameTreeNode* frame_tree_node,
     RenderFrameHostImpl* render_frame_host,
-    NavigationEntryImpl* entry,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-    bool is_renderer_initiated,
+    std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter,
     bool is_same_document) {
   // TODO(clamy): Improve the *NavigationParams and *CommitParams to avoid
   // copying so many parameters here.
@@ -886,13 +894,14 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateForCommit(
       mojom::BeginNavigationParams::New();
   std::unique_ptr<NavigationRequest> navigation_request(new NavigationRequest(
       frame_tree_node, std::move(common_params), std::move(begin_params),
-      std::move(commit_params), !is_renderer_initiated,
+      std::move(commit_params), false /* browser_initiated */,
       false /* from_begin_navigation */, true /* is_for_commit */,
-      entry ? entry->GetFrameEntry(frame_tree_node) : nullptr, entry,
+      nullptr /* frame_navigation_entry */, nullptr /* navitation_entry */,
       nullptr /* navigation_ui_data */, mojo::NullAssociatedRemote(),
       mojo::NullRemote(), nullptr /* rfh_restored_from_back_forward_cache */));
 
   navigation_request->render_frame_host_ = render_frame_host;
+  navigation_request->coep_reporter_ = std::move(coep_reporter);
   navigation_request->StartNavigation(true);
   DCHECK(navigation_request->IsNavigationStarted());
 
@@ -914,6 +923,7 @@ NavigationRequest::NavigationRequest(
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     RenderFrameHostImpl* rfh_restored_from_back_forward_cache)
     : frame_tree_node_(frame_tree_node),
+      is_for_commit_(is_for_commit),
       common_params_(std::move(common_params)),
       begin_params_(std::move(begin_params)),
       commit_params_(std::move(commit_params)),
@@ -943,8 +953,7 @@ NavigationRequest::NavigationRequest(
       frame_tree_node_->frame_tree_node_id(), "url",
       common_params_->url.possibly_invalid_spec());
   TRACE_EVENT_NESTABLE_ASYNC_BEGIN0("navigation", "Initializing", this);
-  NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
-      frame_tree_node_->navigator()->GetController());
+  NavigationControllerImpl* controller = GetNavigationController();
 
   if (frame_entry) {
     frame_entry_item_sequence_number_ = frame_entry->item_sequence_number();
@@ -988,7 +997,7 @@ NavigationRequest::NavigationRequest(
       if (common_params_->is_history_navigation_in_new_child_frame)
         SetSourceSiteInstanceToInitiatorIfNeeded();
     }
-    network_isolation_key_ = entry->network_isolation_key();
+    isolation_info_ = entry->isolation_info();
     is_view_source_ = entry->IsViewSourceMode();
 
     // Ensure that we always have a |source_site_instance_| for navigations
@@ -1020,6 +1029,9 @@ NavigationRequest::NavigationRequest(
       frame_tree_node->current_frame_host()->GetProcess()->GetID(),
       frame_tree_node->current_frame_host()->GetRoutingID());
 
+  previous_page_load_ukm_source_id_ =
+      frame_tree_node_->current_frame_host()->GetPageUkmSourceId();
+
   // Update the load flags with cache information.
   UpdateLoadFlagsWithCacheFlags(&begin_params_->load_flags,
                                 common_params_->navigation_type,
@@ -1043,17 +1055,8 @@ NavigationRequest::NavigationRequest(
     // go away, by creating a ref to it.
     if (entry == controller->GetPendingEntry())
       pending_entry_ref_ = controller->ReferencePendingEntry();
-  }
 
-  entry_overrides_ua_ = (entry && entry->GetIsOverridingUserAgent());
-  bool is_overriding_ua =
-      commit_params_->is_overriding_user_agent || entry_overrides_ua_;
-  std::string user_agent_override;
-  if (is_overriding_ua) {
-    user_agent_override = frame_tree_node_->navigator()
-                              ->GetDelegate()
-                              ->GetUserAgentOverride()
-                              .ua_string_override;
+    entry_overrides_ua_ = entry->GetIsOverridingUserAgent();
   }
 
   net::HttpRequestHeaders headers;
@@ -1065,14 +1068,9 @@ NavigationRequest::NavigationRequest(
         browser_context->GetClientHintsControllerDelegate();
     if (client_hints_delegate) {
       net::HttpRequestHeaders client_hints_headers;
-      RenderViewHost* render_view_host =
-          frame_tree_node->current_frame_host()->GetRenderViewHost();
-      const bool javascript_enabled =
-          render_view_host->GetWebkitPreferences().javascript_enabled;
       AddNavigationRequestClientHintsHeaders(
           common_params_->url, &client_hints_headers, browser_context,
-          javascript_enabled, client_hints_delegate, is_overriding_ua,
-          frame_tree_node_);
+          client_hints_delegate, IsOverridingUserAgent(), frame_tree_node_);
       headers.MergeFrom(client_hints_headers);
     }
 
@@ -1080,9 +1078,9 @@ NavigationRequest::NavigationRequest(
     AddAdditionalRequestHeaders(
         &headers, common_params_->url, common_params_->navigation_type,
         common_params_->transition, controller->GetBrowserContext(),
-        common_params_->method, user_agent_override,
-        common_params_->has_user_gesture, common_params_->initiator_origin,
-        common_params_->referrer.get(), frame_tree_node);
+        common_params_->method, GetUserAgentOverride(),
+        common_params_->initiator_origin, common_params_->referrer.get(),
+        frame_tree_node);
 
     if (begin_params_->is_form_submission) {
       if (browser_initiated_ && !commit_params_->post_content_type.empty()) {
@@ -1113,6 +1111,16 @@ NavigationRequest::NavigationRequest(
 }
 
 NavigationRequest::~NavigationRequest() {
+#if DCHECK_IS_ON()
+  // If |is_safe_to_delete_| is false, it means |this| is being deleted at an
+  // unexpected time, more specifically a time that is likely to lead to
+  // crashing when the stack unwinds (use after free). The typical scenario for
+  // this is calling to the delegate when the delegate is not expected to make
+  // any sort of state change. For example, when the delegate is informed that a
+  // navigation has started the delegate is not expected to call Stop().
+  DCHECK(is_safe_to_delete_);
+#endif
+
   // Close the last child event. Tracing no longer outputs the end event name,
   // so we can simply pass an empty string here.
   TRACE_EVENT_NESTABLE_ASYNC_END0("navigation", "", this);
@@ -1120,7 +1128,7 @@ NavigationRequest::~NavigationRequest() {
   if (loading_mem_tracker_)
     loading_mem_tracker_->Cancel();
   ResetExpectedProcess();
-  if (state_ >= WILL_START_NAVIGATION && state_ < READY_TO_COMMIT) {
+  if (state_ >= WILL_START_NAVIGATION && !HasCommitted()) {
     devtools_instrumentation::OnNavigationRequestFailed(
         *this, network::URLLoaderCompletionStatus(net::ERR_ABORTED));
   }
@@ -1267,8 +1275,13 @@ void NavigationRequest::BeginNavigation() {
     // Select an appropriate RenderFrameHost.
     render_frame_host_ =
         frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
-    NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
-        render_frame_host_, common_params_->url);
+    if (!Navigator::CheckWebUIRendererDoesNotDisplayNormalURL(
+            render_frame_host_, common_params_->url,
+            /* is_renderer_initiated_check */ false)) {
+      // TODO(nasko): Convert this to CHECK once it is confirmed that it does
+      // not happen in reality.
+      base::debug::DumpWithoutCrashing();
+    }
 
     ReadyToCommitNavigation(false /* is_error */);
     CommitNavigation();
@@ -1327,9 +1340,6 @@ void NavigationRequest::StartNavigation(bool is_for_commit) {
   if (!is_for_commit)
     redirect_chain_.push_back(common_params_->url);
 
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(begin_params_->headers);
-
   // Mirrors the logic in RenderFrameImpl::SendDidCommitProvisionalLoad.
   if (common_params_->transition & ui::PAGE_TRANSITION_CLIENT_REDIRECT) {
     // If the page contained a client redirect (meta refresh,
@@ -1347,7 +1357,6 @@ void NavigationRequest::StartNavigation(bool is_for_commit) {
   state_ = WILL_START_REQUEST;
   navigation_handle_id_ = CreateUniqueHandleID();
 
-  request_headers_ = std::move(headers);
   modified_request_headers_.Clear();
   removed_request_headers_.clear();
 
@@ -1371,7 +1380,14 @@ void NavigationRequest::StartNavigation(bool is_for_commit) {
     EnterChildTraceEvent("Same document", this);
   }
 
-  GetDelegate()->DidStartNavigation(this);
+  {
+#if DCHECK_IS_ON()
+    DCHECK(is_safe_to_delete_);
+    base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
+#endif
+    base::AutoReset<bool> resetter2(&ua_change_requires_reload_, false);
+    GetDelegate()->DidStartNavigation(this);
+  }
 
   // The previous call to DidStartNavigation could have cancelled this request
   // synchronously.
@@ -1492,6 +1508,24 @@ NavigationRequest::TakeCoepReporter() {
   return std::move(coep_reporter_);
 }
 
+ukm::SourceId NavigationRequest::GetPreviousPageUkmSourceId() {
+  return previous_page_load_ukm_source_id_;
+}
+
+NavigationEntry* NavigationRequest::GetNavigationEntry() {
+  if (nav_entry_id_ == 0)
+    return nullptr;
+
+  NavigationControllerImpl* controller = GetNavigationController();
+  NavigationEntry* entry = controller->GetEntryWithUniqueID(nav_entry_id_);
+  if (entry)
+    return entry;
+  return (controller->GetPendingEntry() &&
+          controller->GetPendingEntry()->GetUniqueID() == nav_entry_id_)
+             ? controller->GetPendingEntry()
+             : nullptr;
+}
+
 void NavigationRequest::OnRequestRedirected(
     const net::RedirectInfo& redirect_info,
     network::mojom::URLResponseHeadPtr response_head) {
@@ -1500,6 +1534,8 @@ void NavigationRequest::OnRequestRedirected(
   // Sanity check - this can only be set at commit time.
   DCHECK(!auth_challenge_info_);
 
+  DCHECK(response_head);
+  DCHECK(response_head->parsed_headers);
   response_head_ = std::move(response_head);
   ssl_info_ = response_head_->ssl_info;
 
@@ -1594,6 +1630,12 @@ void NavigationRequest::OnRequestRedirected(
   if (redirect_info.new_method != "POST")
     common_params_->post_data.reset();
 
+  // Record the first request start time and response start time.
+  if (first_request_start_.is_null())
+    first_request_start_ = response_head_->load_timing.send_start;
+  if (first_response_start_.is_null())
+    first_response_start_ = response_head_->load_timing.receive_headers_start;
+
   // Mark time for the Navigation Timing API.
   if (commit_params_->navigation_timing->redirect_start.is_null()) {
     commit_params_->navigation_timing->redirect_start =
@@ -1692,32 +1734,83 @@ void NavigationRequest::OnRequestRedirected(
   WillRedirectRequest(common_params_->referrer->url, expected_process);
 }
 
-void NavigationRequest::CheckForOriginPolicyIsolationOptIn(
-    const GURL& url,
-    const network::mojom::URLResponseHead* response) {
-  // IsolationOptIn is only available when OriginPolicy is enabled.
-  if (!base::FeatureList::IsEnabled(features::kOriginPolicy))
+void NavigationRequest::CheckForIsolationOptIn(const GURL& url) {
+  if (IsOptInIsolationRequested(url) == OptInIsolationCheckResult::NONE)
     return;
 
-  bool requests_origin_isolation = false;
-  if (response && response->origin_policy) {
-    const network::OriginPolicy& origin_policy =
-        response->origin_policy.value();
-    // For now, we'll take the presence of any isolation_optin_hints value
-    // as an indication to opt-in.
-    requests_origin_isolation =
-        origin_policy.state == network::OriginPolicyState::kLoaded &&
-        origin_policy.contents->isolation_optin_hints.has_value();
-  }
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   url::Origin origin = url::Origin::Create(url);
-  // We need to update the master list even if |requests_origin_isolation| is
-  // false, since we need to maintain the master opt-in list according to the
-  // most recently seen OriginPolicy.
-  // TODO(wjmaclean): when we start to support versioning for OriginPolicies,
-  // will we need to key the master list accordingly?
-  policy->UpdateOriginIsolationOptInListIfNecessary(origin,
-                                                    requests_origin_isolation);
+  if (policy->UpdateOriginIsolationOptInListIfNecessary(origin)) {
+    // This is a new request for isolating |origin|. Do a global walk of session
+    // history to find any existing instances of |origin|, so that those
+    // existing BrowsingInstances can avoid isolating it (which could break
+    // cross-frame scripting). Only new BrowsingInstances and ones that have not
+    // seen |origin| before will isolate it.
+    // We don't always have a value for render_frame_host_ at this point, so we
+    // map the global-walk call onto NavigatorDelegate to get it into
+    // WebContents. We definitely need to do the global walk prior to deciding
+    // on the render_frame_host_ to commit to.
+    // We must exclude ourselves from the global walk otherwise we may mark our
+    // origin as non-opt-in before it gets the change to register itself as
+    // opted-in.
+    frame_tree_node_->navigator()
+        ->GetDelegate()
+        ->RegisterExistingOriginToPreventOptInIsolation(
+            origin, this /* navigation_request_to_exclude */);
+  }
+}
+
+bool NavigationRequest::HasCommittingOrigin(const url::Origin& origin) {
+  // We are only interested in checking requests that have been assigned a
+  // SiteInstance.
+  if (state() < WILL_PROCESS_RESPONSE)
+    return false;
+
+  // This origin conversion won't be correct for about:blank, but origin
+  // isolation shouldn't need to care about that case because a previous
+  // instance of the origin would already have determined its isolation status
+  // in that BrowsingInstance.
+  // TODO(https://crbug.com/888079): Use the computed origin here just to be
+  // safe.
+  return origin == url::Origin::Create(GetURL());
+}
+
+NavigationRequest::OptInIsolationCheckResult
+NavigationRequest::IsOptInIsolationRequested(const GURL& url) {
+  if (!response())
+    return OptInIsolationCheckResult::NONE;
+
+  // For now we only check for the presence of hints; we do not yet act on the
+  // specific hints.
+  const bool requests_via_origin_policy =
+      base::FeatureList::IsEnabled(features::kOriginPolicy) &&
+      response()->origin_policy &&
+      response()->origin_policy->state == network::OriginPolicyState::kLoaded &&
+      response()->origin_policy->contents->isolation_optin_hints.has_value();
+
+  if (requests_via_origin_policy)
+    return OptInIsolationCheckResult::ORIGIN_POLICY;
+
+  // The header can be enabled via either a command-line flag or an origin
+  // trial.
+  blink::TrialTokenValidator validator;
+  const bool header_is_enabled =
+      base::FeatureList::IsEnabled(features::kOriginIsolationHeader) ||
+      (response()->headers && validator.RequestEnablesFeature(
+                                  url, response()->headers.get(),
+                                  "OriginIsolationHeader", base::Time::Now()));
+
+  // TODO(https://crbug.com/1066930): For now we just check the presence of the
+  // header; we do not parse/validate it. When we do, that will have to be
+  // outside the browser process.
+  const bool requests_via_header =
+      header_is_enabled && response()->headers &&
+      response()->headers->HasHeader("origin-isolation");
+
+  if (requests_via_header)
+    return OptInIsolationCheckResult::HEADER;
+
+  return OptInIsolationCheckResult::NONE;
 }
 
 void NavigationRequest::OnResponseStarted(
@@ -1742,6 +1835,7 @@ void NavigationRequest::OnResponseStarted(
 
   DCHECK(IsNavigationStarted());
   DCHECK(response_head);
+  DCHECK(response_head->parsed_headers);
   EnterChildTraceEvent("OnResponseStarted", this);
   state_ = WILL_PROCESS_RESPONSE;
   response_head_ = std::move(response_head);
@@ -1749,6 +1843,36 @@ void NavigationRequest::OnResponseStarted(
   ssl_info_ = response_head_->ssl_info;
   auth_challenge_info_ = response_head_->auth_challenge_info;
 
+  // If origin isolation opt-in is being requested, set temporary state on
+  // ChildProcessSecurityPolicy that allows it to know the origin is requesting
+  // isolation without having to plumb it through all the calls that might get
+  // to ShouldOriginGetOptInIsolation. This is set in OnResponseStarted when
+  // headers are available to detect isolation requests, and early in the method
+  // to ensure all relevant calls will have the state available.
+  using ScopedOriginIsolationOptInRequest =
+      ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest;
+  std::unique_ptr<ScopedOriginIsolationOptInRequest>
+      scoped_origin_isolation_opt_in_request;
+  OptInIsolationCheckResult opt_in_isolation =
+      IsOptInIsolationRequested(GetURL());
+  if (opt_in_isolation != OptInIsolationCheckResult::NONE) {
+    // This origin conversion won't be correct for about:blank, but origin
+    // isolation shouldn't need to care about that case because a previous
+    // instance of the origin would already have determined its isolation status
+    // in that BrowsingInstance.
+    // TODO(https://crbug.com/888079): Use the computed origin here just to be
+    // safe.
+    url::Origin origin_to_isolate(url::Origin::Create(GetURL()));
+    scoped_origin_isolation_opt_in_request =
+        ScopedOriginIsolationOptInRequest::GetScopedOriginIsolationOptInRequest(
+            origin_to_isolate);
+  }
+
+  // The navigation may have encountered an origin policy or Origin-Isolation
+  // header that requests isolation for the url's origin. Before we pick the
+  // renderer, make sure we update the origin-isolation opt-ins appropriately.
+  CheckForIsolationOptIn(GetURL());
+
   // Check if the response should be sent to a renderer.
   response_should_be_rendered_ =
       !is_download && (!response_head_->headers.get() ||
@@ -1766,6 +1890,13 @@ void NavigationRequest::OnResponseStarted(
           ? base::make_optional(appcache_handle_->appcache_host_id())
           : base::nullopt;
 
+  // Record the first request start time and first response start time. Skip if
+  // the timings are already recorded for redirection etc.
+  if (first_request_start_.is_null())
+    first_request_start_ = response_head_->load_timing.send_start;
+  if (first_response_start_.is_null())
+    first_response_start_ = response_head_->load_timing.receive_headers_start;
+
   // Update fetch start timing. While NavigationRequest updates fetch start
   // timing for redirects, it's not aware of service worker interception so
   // fetch start timing could happen earlier than worker start timing. Use
@@ -1826,7 +1957,7 @@ void NavigationRequest::OnResponseStarted(
   }
 
   auto cross_origin_embedder_policy =
-      response_head_->cross_origin_embedder_policy;
+      response_head_->parsed_headers->cross_origin_embedder_policy;
   if (base::FeatureList::IsEnabled(
           network::features::kCrossOriginEmbedderPolicy)) {
     // https://mikewest.github.io/corpp/#process-navigation-response
@@ -1841,7 +1972,10 @@ void NavigationRequest::OnResponseStarted(
       // Some special URLs not loaded using the network are inheriting the
       // Cross-Origin-Embedder-Policy header from their parent.
       const bool has_allowed_scheme =
-          url.SchemeIsBlob() || url.SchemeIs(url::kDataScheme);
+          url.SchemeIsBlob() || url.SchemeIs(url::kDataScheme) ||
+          GetContentClient()
+              ->browser()
+              ->ShouldInheritCrossOriginEmbedderPolicyImplicitly(url);
       if (parent_coep.value == kRequireCorp && has_allowed_scheme) {
         cross_origin_embedder_policy.value = kRequireCorp;
       }
@@ -1860,7 +1994,7 @@ void NavigationRequest::OnResponseStarted(
                                                /*report_only=*/false);
         }
         OnRequestFailedInternal(network::URLLoaderCompletionStatus(
-                                    network::BlockedByResponseReason::
+                                    network::mojom::BlockedByResponseReason::
                                         kCoepFrameResourceNeedsCoepHeader),
                                 false /* skip_throttles */,
                                 base::nullopt /* error_page_content */,
@@ -1875,10 +2009,10 @@ void NavigationRequest::OnResponseStarted(
   if (base::FeatureList::IsEnabled(
           network::features::kCrossOriginOpenerPolicy)) {
     // The Cross-Origin-Opener-Policy header should be ignored if delivered in
-    // insecure contexts.
-    if (!IsOriginSecure(common_params_->url)) {
-      response_head_->cross_origin_opener_policy =
-          network::mojom::CrossOriginOpenerPolicy::kUnsafeNone;
+    // insecure contexts, and non-top level documents.
+    if (!IsOriginSecure(common_params_->url) || !IsInMainFrame()) {
+      response_head_->parsed_headers->cross_origin_opener_policy =
+          network::CrossOriginOpenerPolicy();
     }
 
     // Popups with a sandboxing flag, inherited from their opener, are not
@@ -1886,13 +2020,13 @@ void NavigationRequest::OnResponseStarted(
     // is not "unsafe-none". This ensures a COOP document does not inherit any
     // property from an opener.
     // https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e
-    if (response_head_->cross_origin_opener_policy !=
-            network::mojom::CrossOriginOpenerPolicy::kUnsafeNone &&
+    if (response_head_->parsed_headers->cross_origin_opener_policy.value !=
+            network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone &&
         (frame_tree_node_->pending_frame_policy().sandbox_flags !=
-         blink::mojom::WebSandboxFlags::kNone)) {
+         network::mojom::WebSandboxFlags::kNone)) {
       OnRequestFailedInternal(
           network::URLLoaderCompletionStatus(
-              network::BlockedByResponseReason::
+              network::mojom::BlockedByResponseReason::
                   kCoopSandboxedIFrameCannotNavigateToCoopPage),
           false /* skip_throttles */, base::nullopt /* error_page_content */,
           false /* collapse_frame */);
@@ -1902,20 +2036,12 @@ void NavigationRequest::OnResponseStarted(
     }
   }
 
-  // The navigation may have encountered an OriginPolicy that requests isolation
-  // for the url's origin. Before we pick the renderer, make sure we update the
-  // master list for origin-isolation opt-ins.
-  CheckForOriginPolicyIsolationOptIn(common_params().url, response());
-
   // Select an appropriate renderer to commit the navigation.
   if (IsServedFromBackForwardCache()) {
-    NavigationControllerImpl* controller =
-        static_cast<NavigationControllerImpl*>(
-            frame_tree_node_->navigator()->GetController());
+    NavigationControllerImpl* controller = GetNavigationController();
     render_frame_host_ = controller->GetBackForwardCache()
                              .GetEntry(nav_entry_id_)
                              ->render_frame_host.get();
-
     // The only time GetEntry can return nullptr here, is if the document was
     // evicted from the BackForwardCache since this navigation started.
     //
@@ -1926,21 +2052,32 @@ void NavigationRequest::OnResponseStarted(
   } else if (response_should_be_rendered_) {
     render_frame_host_ =
         frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
-    NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
-        render_frame_host_, common_params_->url);
+
+    if (!Navigator::CheckWebUIRendererDoesNotDisplayNormalURL(
+            render_frame_host_, common_params_->url,
+            /* is_renderer_initiated_check */ false)) {
+      // TODO(nasko): Convert this to CHECK once it is confirmed that it does
+      // not happen in reality.
+      base::debug::DumpWithoutCrashing();
+    }
   } else {
     render_frame_host_ = nullptr;
   }
   DCHECK(render_frame_host_ || !response_should_be_rendered_);
 
-  // TODO(pmeuleman, ahemery): Only set COOP and COEP values on RenderFrameHost
-  // when the navigation commits. In the meantime, keep them in
-  // NavigationRequest.
   if (render_frame_host_) {
+    if (opt_in_isolation == OptInIsolationCheckResult::HEADER) {
+      GetContentClient()->browser()->LogWebFeatureForCurrentPage(
+          render_frame_host_, blink::mojom::WebFeature::kOriginIsolationHeader);
+    }
+
+    // TODO(pmeuleman, ahemery): Only set COOP and COEP values on
+    // RenderFrameHost when the navigation commits. In the meantime, keep them
+    // in NavigationRequest.
     render_frame_host_->set_cross_origin_embedder_policy(
         cross_origin_embedder_policy);
     render_frame_host_->set_cross_origin_opener_policy(
-        response_head_->cross_origin_opener_policy);
+        response_head_->parsed_headers->cross_origin_opener_policy);
   }
   client_security_state_->cross_origin_embedder_policy =
       cross_origin_embedder_policy;
@@ -1997,12 +2134,26 @@ void NavigationRequest::OnResponseStarted(
     // will prevent other sites from incorrectly reusing this process. See
     // https://crbug.com/738634.
     SiteInstanceImpl* instance = render_frame_host_->GetSiteInstance();
+    const IsolationContext& isolation_context = instance->GetIsolationContext();
     if (!instance->HasSite() &&
         SiteInstanceImpl::DoesSiteRequireDedicatedProcess(
-            instance->GetIsolationContext(), common_params_->url)) {
+            isolation_context, common_params_->url)) {
       instance->ConvertToDefaultOrSetSite(common_params_->url);
     }
 
+    // If this navigation request didn't opt-in to origin isolation, we need
+    // to check here in case the origin has previously requested isolation and
+    // should be marked as opted-out in this SiteInstance. At this point we know
+    // that |render_frame_host_|'s SiteInstance has been finalized, so it's safe
+    // to use it here to get the correct |IsolationContext|.
+    // TODO(wjmaclean): this won't handle cases like about:blank (where it
+    // inherits an origin we care about).  We plan to compute the origin
+    // before commit time (https://crbug.com/888079), which may make it
+    // possible to compute the right origin here.
+    ChildProcessSecurityPolicyImpl::GetInstance()->AddNonIsolatedOriginIfNeeded(
+        isolation_context, url::Origin::Create(common_params().url),
+        false /* is_global_walk */);
+
     // Replace the SiteInstance of the previously committed entry if it's for a
     // url that doesn't require a site assignment, since this new commit is
     // assigning an incompatible site to the previous SiteInstance. This ensures
@@ -2167,8 +2318,13 @@ void NavigationRequest::OnRequestFailedInternal(
   // to be committed in a WebUI process as shown in https://crbug.com/944086.
   if (SiteIsolationPolicy::IsErrorPageIsolationEnabled(
           frame_tree_node_->IsMainFrame())) {
-    NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
-        render_frame_host_, common_params_->url);
+    if (!Navigator::CheckWebUIRendererDoesNotDisplayNormalURL(
+            render_frame_host_, common_params_->url,
+            /* is_renderer_initiated_check */ false)) {
+      // TODO(nasko): Convert this to CHECK once it is confirmed that it does
+      // not happen in reality.
+      base::debug::DumpWithoutCrashing();
+    }
   }
 
   has_stale_copy_in_cache_ = status.exists_in_cache;
@@ -2207,6 +2363,19 @@ void NavigationRequest::OnRequestStarted(base::TimeTicks timestamp) {
   frame_tree_node_->navigator()->LogResourceRequestTime(timestamp,
                                                         common_params_->url);
 }
+namespace {
+
+void OnServiceWorkerAccessedThreadSafeWrapper(
+    base::WeakPtr<NavigationRequest> navigation,
+    const GURL& scope,
+    AllowServiceWorkerResult allowed) {
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&NavigationRequest::OnServiceWorkerAccessed, navigation,
+                     scope, allowed));
+}
+
+}  // namespace
 
 void NavigationRequest::OnStartChecksComplete(
     NavigationThrottle::ThrottleCheckResult result) {
@@ -2278,14 +2447,16 @@ void NavigationRequest::OnStartChecksComplete(
   // for this frame.
   bool can_create_service_worker =
       (frame_tree_node_->pending_frame_policy().sandbox_flags &
-       blink::mojom::WebSandboxFlags::kOrigin) !=
-      blink::mojom::WebSandboxFlags::kOrigin;
+       network::mojom::WebSandboxFlags::kOrigin) !=
+      network::mojom::WebSandboxFlags::kOrigin;
   if (can_create_service_worker) {
     ServiceWorkerContextWrapper* service_worker_context =
         static_cast<ServiceWorkerContextWrapper*>(
             partition->GetServiceWorkerContext());
     service_worker_handle_ = std::make_unique<ServiceWorkerMainResourceHandle>(
-        service_worker_context);
+        service_worker_context,
+        base::BindRepeating(&OnServiceWorkerAccessedThreadSafeWrapper,
+                            weak_factory_.GetWeakPtr()));
   }
 
   if (IsSchemeSupportedForAppCache(common_params_->url)) {
@@ -2341,12 +2512,9 @@ void NavigationRequest::OnStartChecksComplete(
   // Mark the fetch_start (Navigation Timing API).
   commit_params_->navigation_timing->fetch_start = base::TimeTicks::Now();
 
-  net::SiteForCookies site_for_cookies =
-      frame_tree_node_->current_frame_host()
-          ->ComputeSiteForCookiesForNavigation(common_params_->url);
   bool parent_is_main_frame = !frame_tree_node_->parent()
                                   ? false
-                                  : frame_tree_node_->parent()->IsMainFrame();
+                                  : frame_tree_node_->parent()->is_main_frame();
 
   std::unique_ptr<NavigationUIData> navigation_ui_data;
   if (navigation_ui_data_)
@@ -2370,12 +2538,14 @@ void NavigationRequest::OnStartChecksComplete(
   std::vector<std::unique_ptr<NavigationLoaderInterceptor>> interceptor;
   if (web_bundle_handle_)
     interceptor.push_back(web_bundle_handle_->TakeInterceptor());
+  net::HttpRequestHeaders cors_exempt_headers;
+  std::swap(cors_exempt_headers, cors_exempt_request_headers_);
   loader_ = NavigationURLLoader::Create(
       browser_context, partition,
       std::make_unique<NavigationRequestInfo>(
-          common_params_->Clone(), begin_params_.Clone(), site_for_cookies,
-          GetNetworkIsolationKey(), frame_tree_node_->IsMainFrame(),
-          parent_is_main_frame, IsSecureFrame(frame_tree_node_->parent()),
+          common_params_->Clone(), begin_params_.Clone(), GetIsolationInfo(),
+          frame_tree_node_->IsMainFrame(), parent_is_main_frame,
+          IsSecureFrame(frame_tree_node_->parent()),
           frame_tree_node_->frame_tree_node_id(),
           starting_site_instance_->IsGuest(), report_raw_headers,
           navigating_frame_host->GetVisibilityState() ==
@@ -2384,14 +2554,22 @@ void NavigationRequest::OnStartChecksComplete(
           blob_url_loader_factory_ ? blob_url_loader_factory_->Clone()
                                    : nullptr,
           devtools_navigation_token(), frame_tree_node_->devtools_frame_token(),
-          OriginPolicyThrottle::ShouldRequestOriginPolicy(common_params_->url)),
+          OriginPolicyThrottle::ShouldRequestOriginPolicy(common_params_->url),
+          std::move(cors_exempt_headers)),
       std::move(navigation_ui_data), service_worker_handle_.get(),
       appcache_handle_.get(), std::move(prefetched_signed_exchange_cache_),
-      this, IsServedFromBackForwardCache(), std::move(interceptor));
+      this, IsServedFromBackForwardCache(), CreateCookieAccessObserver(),
+      std::move(interceptor));
 
   DCHECK(!render_frame_host_);
 }
 
+void NavigationRequest::OnServiceWorkerAccessed(
+    const GURL& scope,
+    AllowServiceWorkerResult allowed) {
+  GetDelegate()->OnServiceWorkerAccessed(this, scope, allowed);
+}
+
 void NavigationRequest::OnRedirectChecksComplete(
     NavigationThrottle::ThrottleCheckResult result) {
   DCHECK(result.action() != NavigationThrottle::DEFER);
@@ -2431,28 +2609,35 @@ void NavigationRequest::OnRedirectChecksComplete(
 
   net::HttpRequestHeaders modified_headers = TakeModifiedRequestHeaders();
   std::vector<std::string> removed_headers = TakeRemovedRequestHeaders();
+  // Removes all Client Hints from the request, that were passed on from the
+  // previous one.
+  for (size_t i = 0; i < blink::kClientHintsMappingsCount; ++i)
+    removed_headers.push_back(blink::kClientHintsHeaderMapping[i]);
 
+  // Add any required Client Hints to the current request.
   BrowserContext* browser_context =
       frame_tree_node_->navigator()->GetController()->GetBrowserContext();
   ClientHintsControllerDelegate* client_hints_delegate =
       browser_context->GetClientHintsControllerDelegate();
   if (client_hints_delegate) {
     net::HttpRequestHeaders client_hints_extra_headers;
-    RenderViewHost* render_view_host =
-        frame_tree_node_->current_frame_host()->GetRenderViewHost();
-    const bool javascript_enabled =
-        render_view_host->GetWebkitPreferences().javascript_enabled;
+    PersistAcceptCHAfterNagivationRequestRedirect(
+        commit_params_->redirects.back(),
+        commit_params_->redirect_response.back()->parsed_headers,
+        browser_context, client_hints_delegate, frame_tree_node_);
     AddNavigationRequestClientHintsHeaders(
         common_params_->url, &client_hints_extra_headers, browser_context,
-        javascript_enabled, client_hints_delegate,
+        client_hints_delegate,
         commit_params_->is_overriding_user_agent || entry_overrides_ua_,
         frame_tree_node_);
     modified_headers.MergeFrom(client_hints_extra_headers);
   }
 
-  loader_->FollowRedirect(std::move(removed_headers),
-                          std::move(modified_headers),
-                          common_params_->previews_state);
+  net::HttpRequestHeaders cors_exempt_headers;
+  std::swap(cors_exempt_headers, cors_exempt_request_headers_);
+  loader_->FollowRedirect(
+      std::move(removed_headers), std::move(modified_headers),
+      std::move(cors_exempt_headers), common_params_->previews_state);
 }
 
 void NavigationRequest::OnFailureChecksComplete(
@@ -2477,7 +2662,7 @@ void NavigationRequest::OnFailureChecksComplete(
     CHECK_EQ(ShouldKeepErrorPageInCurrentProcess(old_net_error),
              ShouldKeepErrorPageInCurrentProcess(net_error_))
         << " Unsupported error code change in WillFailRequest(): from "
-        << net_error_ << " to " << result.net_error_code();
+        << old_net_error << " to " << net_error_;
   }
 
   CommitErrorPage(result.error_page_content());
@@ -2507,8 +2692,7 @@ void NavigationRequest::OnWillProcessResponseChecksComplete(
       resource_request->transition_type = common_params_->transition;
       resource_request->trusted_params =
           network::ResourceRequest::TrustedParams();
-      resource_request->trusted_params->network_isolation_key =
-          GetNetworkIsolationKey();
+      resource_request->trusted_params->isolation_info = GetIsolationInfo();
 
       BrowserContext* browser_context =
           frame_tree_node_->navigator()->GetController()->GetBrowserContext();
@@ -2627,10 +2811,7 @@ void NavigationRequest::CommitNavigation() {
   DCHECK(!IsRendererDebugURL(common_params_->url));
 
   if (IsServedFromBackForwardCache()) {
-    NavigationControllerImpl* controller =
-        static_cast<NavigationControllerImpl*>(
-            frame_tree_node_->navigator()->GetController());
-
+    NavigationControllerImpl* controller = GetNavigationController();
     std::unique_ptr<BackForwardCacheImpl::Entry> restored_bfcache_entry =
         controller->GetBackForwardCache().RestoreEntry(nav_entry_id_,
                                                        NavigationStart());
@@ -2777,8 +2958,7 @@ void NavigationRequest::RenderProcessHostDestroyed(RenderProcessHost* host) {
 
 void NavigationRequest::RenderProcessExited(
     RenderProcessHost* host,
-    const ChildProcessTerminationInfo& info) {
-}
+    const ChildProcessTerminationInfo& info) {}
 
 void NavigationRequest::UpdateSiteURL(
     RenderProcessHost* post_redirect_process) {
@@ -2872,9 +3052,7 @@ net::Error NavigationRequest::CheckContentSecurityPolicy(
     return net::OK;
   }
 
-  FrameTreeNode* parent_ftn = frame_tree_node()->parent();
-  RenderFrameHostImpl* parent =
-      parent_ftn ? parent_ftn->current_frame_host() : nullptr;
+  RenderFrameHostImpl* parent = frame_tree_node()->parent();
   if (!parent &&
       frame_tree_node()
           ->current_frame_host()
@@ -2942,9 +3120,9 @@ NavigationRequest::CheckCredentialedSubresource() const {
 
   // Relative URLs on top-level pages that were loaded with embedded credentials
   // should load correctly.
-  FrameTreeNode* parent_ftn = frame_tree_node_->parent();
-  DCHECK(parent_ftn);
-  const GURL& parent_url = parent_ftn->current_url();
+  RenderFrameHostImpl* parent = frame_tree_node_->parent();
+  DCHECK(parent);
+  const GURL& parent_url = parent->GetLastCommittedURL();
   if (url::Origin::Create(parent_url)
           .IsSameOriginWith(url::Origin::Create(common_params_->url)) &&
       parent_url.username() == common_params_->url.username() &&
@@ -2953,8 +3131,6 @@ NavigationRequest::CheckCredentialedSubresource() const {
   }
 
   // Warn the user about the request being blocked.
-  RenderFrameHostImpl* parent = parent_ftn->current_frame_host();
-  DCHECK(parent);
   const char* console_message =
       "Subresource requests whose URLs contain embedded credentials (e.g. "
       "`https://user:pass@host/`) are blocked. See "
@@ -2976,15 +3152,13 @@ NavigationRequest::CheckLegacyProtocolInSubresource() const {
   if (!ShouldTreatURLSchemeAsLegacy(common_params_->url))
     return LegacyProtocolInSubresourceCheckResult::ALLOW_REQUEST;
 
-  FrameTreeNode* parent_ftn = frame_tree_node_->parent();
-  DCHECK(parent_ftn);
-  const GURL& parent_url = parent_ftn->current_url();
+  RenderFrameHostImpl* parent = frame_tree_node_->parent();
+  DCHECK(parent);
+  const GURL& parent_url = parent->GetLastCommittedURL();
   if (ShouldTreatURLSchemeAsLegacy(parent_url))
     return LegacyProtocolInSubresourceCheckResult::ALLOW_REQUEST;
 
   // Warn the user about the request being blocked.
-  RenderFrameHostImpl* parent = parent_ftn->current_frame_host();
-  DCHECK(parent);
   const char* console_message =
       "Subresource requests using legacy protocols (like `ftp:`) are blocked. "
       "Please deliver web-accessible resources over modern protocols like "
@@ -3177,8 +3351,13 @@ void NavigationRequest::OnWillRedirectRequestProcessed(
   processing_navigation_throttle_ = false;
   if (result.action() == NavigationThrottle::PROCEED) {
     // Notify the delegate that a redirect was encountered and will be followed.
-    if (GetDelegate())
+    if (GetDelegate()) {
+#if DCHECK_IS_ON()
+      DCHECK(is_safe_to_delete_);
+      base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
+#endif
       GetDelegate()->DidRedirectNavigation(this);
+    }
   } else {
     state_ = CANCELING;
   }
@@ -3224,11 +3403,19 @@ void NavigationRequest::OnWillProcessResponseProcessed(
   DCHECK(processing_navigation_throttle_);
   processing_navigation_throttle_ = false;
   if (result.action() == NavigationThrottle::PROCEED) {
+    base::WeakPtr<NavigationRequest> weak_self(weak_factory_.GetWeakPtr());
+
     // If the navigation is done processing the response, then it's ready to
     // commit. Inform observers that the navigation is now ready to commit,
     // unless it is not set to commit (204/205s/downloads).
     if (render_frame_host_)
       ReadyToCommitNavigation(false);
+
+    // The call above might block on showing a user dialog. The interaction of
+    // the user with this dialog might result in the WebContents owning this
+    // NavigationRequest to be destroyed. Return if this is the case.
+    if (!weak_self)
+      return;
   } else {
     state_ = CANCELING;
   }
@@ -3434,9 +3621,9 @@ bool NavigationRequest::IsSelfReferentialURL() {
   // We allow one level of self-reference because some sites depend on that,
   // but we don't allow more than one.
   bool found_self_reference = false;
-  for (const FrameTreeNode* node = frame_tree_node()->parent(); node;
-       node = node->parent()) {
-    if (node->current_url().EqualsIgnoringRef(common_params_->url)) {
+  for (RenderFrameHost* rfh = frame_tree_node()->parent(); rfh;
+       rfh = rfh->GetParent()) {
+    if (rfh->GetLastCommittedURL().EqualsIgnoringRef(common_params_->url)) {
       if (found_self_reference)
         return true;
       found_self_reference = true;
@@ -3576,11 +3763,13 @@ void NavigationRequest::ReadyToCommitNavigation(bool is_error) {
   ready_to_commit_time_ = base::TimeTicks::Now();
   RestartCommitTimeout();
 
-  // https://wicg.github.io/cors-rfc1918/#address-space
   if (!IsSameDocument()) {
+    // https://wicg.github.io/cors-rfc1918/#address-space
+    const std::vector<network::mojom::ContentSecurityPolicyPtr> empty_csp;
     network::mojom::IPAddressSpace ip_address_space = CalculateIPAddressSpace(
         GetSocketAddress().address(),
-        response_head_ ? response_head_->headers.get() : nullptr);
+        response_head_ ? response_head_->parsed_headers->content_security_policy
+                       : empty_csp);
     commit_params_->ip_address_space = ip_address_space;
     client_security_state_->ip_address_space = ip_address_space;
   }
@@ -3605,8 +3794,13 @@ void NavigationRequest::ReadyToCommitNavigation(bool is_error) {
 
   SetExpectedProcess(render_frame_host_->GetProcess());
 
-  if (!IsSameDocument())
+  if (!IsSameDocument()) {
+#if DCHECK_IS_ON()
+    DCHECK(is_safe_to_delete_);
+    base::AutoReset<bool> resetter(&is_safe_to_delete_, false);
+#endif
     GetDelegate()->ReadyToCommitNavigation(this);
+  }
 }
 
 std::unique_ptr<AppCacheNavigationHandle>
@@ -3647,8 +3841,8 @@ void NavigationRequest::RestartCommitTimeout() {
   if (!renderer_host->IsBlocked()) {
     commit_timeout_timer_.Start(
         FROM_HERE, g_commit_timeout,
-        base::BindRepeating(&NavigationRequest::OnCommitTimeout,
-                            weak_factory_.GetWeakPtr()));
+        base::BindOnce(&NavigationRequest::OnCommitTimeout,
+                       weak_factory_.GetWeakPtr()));
   }
 }
 
@@ -3703,6 +3897,13 @@ void NavigationRequest::SetRequestHeader(const std::string& header_name,
   modified_request_headers_.SetHeader(header_name, header_value);
 }
 
+void NavigationRequest::SetCorsExemptRequestHeader(
+    const std::string& header_name,
+    const std::string& header_value) {
+  DCHECK(state_ == WILL_START_REQUEST || state_ == WILL_REDIRECT_REQUEST);
+  cors_exempt_request_headers_.SetHeader(header_name, header_value);
+}
+
 const net::HttpResponseHeaders* NavigationRequest::GetResponseHeaders() {
   if (response_headers_for_testing_)
     return response_headers_for_testing_.get();
@@ -3777,13 +3978,12 @@ bool NavigationRequest::IsInMainFrame() {
 }
 
 RenderFrameHostImpl* NavigationRequest::GetParentFrame() {
-  return IsInMainFrame() ? nullptr
-                         : frame_tree_node()->parent()->current_frame_host();
+  return IsInMainFrame() ? nullptr : frame_tree_node()->parent();
 }
 
 bool NavigationRequest::IsParentMainFrame() {
-  FrameTreeNode* parent = frame_tree_node()->parent();
-  return parent && parent->IsMainFrame();
+  RenderFrameHostImpl* parent = frame_tree_node()->parent();
+  return parent && parent->is_main_frame();
 }
 
 int NavigationRequest::GetFrameTreeNodeId() {
@@ -3834,6 +4034,14 @@ base::TimeTicks NavigationRequest::NavigationInputStart() {
   return common_params().input_start;
 }
 
+base::TimeTicks NavigationRequest::FirstRequestStart() {
+  return first_request_start_;
+}
+
+base::TimeTicks NavigationRequest::FirstResponseStart() {
+  return first_response_start_;
+}
+
 bool NavigationRequest::IsPost() {
   return common_params().method == "POST";
 }
@@ -3874,7 +4082,11 @@ RenderFrameHostImpl* NavigationRequest::GetRenderFrameHost() {
 }
 
 const net::HttpRequestHeaders& NavigationRequest::GetRequestHeaders() {
-  return request_headers_;
+  if (!request_headers_) {
+    request_headers_.emplace();
+    request_headers_->AddHeadersFromString(begin_params_->headers);
+  }
+  return *request_headers_;
 }
 
 const base::Optional<net::SSLInfo>& NavigationRequest::GetSSLInfo() {
@@ -3890,22 +4102,14 @@ net::ResolveErrorInfo NavigationRequest::GetResolveErrorInfo() {
   return resolve_error_info_;
 }
 
-net::NetworkIsolationKey NavigationRequest::GetNetworkIsolationKey() {
-  if (network_isolation_key_)
-    return network_isolation_key_.value();
+net::IsolationInfo NavigationRequest::GetIsolationInfo() {
+  if (isolation_info_)
+    return isolation_info_.value();
 
-  // If this is a top-frame navigation, then use the origin of the url (and
-  // update it as redirects happen). If this is a subframe navigation, get the
-  // URL from the top frame.
   // TODO(crbug.com/979296): Consider changing this code to copy an origin
   // instead of creating one from a URL which lacks opacity information.
-  url::Origin frame_origin = url::Origin::Create(common_params_->url);
-  url::Origin top_frame_origin =
-      frame_tree_node_->IsMainFrame()
-          ? frame_origin
-          : frame_tree_node_->frame_tree()->root()->current_origin();
-
-  return net::NetworkIsolationKey(top_frame_origin, frame_origin);
+  return frame_tree_node_->current_frame_host()
+      ->ComputeIsolationInfoForNavigation(common_params_->url);
 }
 
 bool NavigationRequest::HasSubframeNavigationEntryCommitted() {
@@ -3974,6 +4178,14 @@ const std::string& NavigationRequest::GetHrefTranslate() {
   return common_params().href_translate;
 }
 
+const base::Optional<Impression>& NavigationRequest::GetImpression() {
+  return begin_params()->impression;
+}
+
+const GlobalFrameRoutingId& NavigationRequest::GetInitiatorRoutingId() {
+  return initiator_routing_id_;
+}
+
 const base::Optional<url::Origin>& NavigationRequest::GetInitiatorOrigin() {
   return common_params().initiator_origin;
 }
@@ -3998,6 +4210,54 @@ bool NavigationRequest::IsServedFromBackForwardCache() {
   return rfh_restored_from_back_forward_cache_ != nullptr;
 }
 
+void NavigationRequest::SetIsOverridingUserAgent(bool override_ua) {
+  // Only add specific headers when creating a NavigationRequest before the
+  // network request is made, not at commit time.
+  if (is_for_commit_)
+    return;
+
+  was_set_overriding_user_agent_called_ = true;
+
+  // Don't early out if entry_overrides_ua_ == override_ua as the user-agent
+  // may have changed.
+
+  // This code assumes it is only called from DidStartNavigation().
+  DCHECK(!ua_change_requires_reload_);
+
+  entry_overrides_ua_ = override_ua;
+  NavigationEntry* entry = GetNavigationEntry();
+  // A NavigationEntry may not have been created yet.
+  if (entry)
+    entry->SetIsOverridingUserAgent(override_ua);
+
+  commit_params_->is_overriding_user_agent = entry_overrides_ua_;
+
+  net::HttpRequestHeaders headers;
+  headers.AddHeadersFromString(begin_params_->headers);
+  auto user_agent_override = GetUserAgentOverride();
+  headers.SetHeader(net::HttpRequestHeaders::kUserAgent,
+                    user_agent_override.empty()
+                        ? GetContentClient()->browser()->GetUserAgent()
+                        : user_agent_override);
+  BrowserContext* browser_context =
+      frame_tree_node_->navigator()->GetController()->GetBrowserContext();
+  ClientHintsControllerDelegate* client_hints_delegate =
+      browser_context->GetClientHintsControllerDelegate();
+  if (client_hints_delegate) {
+    UpdateNavigationRequestClientUaHeaders(
+        common_params_->url, client_hints_delegate, entry_overrides_ua_,
+        frame_tree_node_, &headers);
+  }
+  begin_params_->headers = headers.ToString();
+  // |request_headers_| comes from |begin_params_|. Clear |request_headers_| now
+  // so that if |request_headers_| are needed, they will be updated.
+  request_headers_.reset();
+}
+
+bool NavigationRequest::GetIsOverridingUserAgent() {
+  return entry_overrides_ua_;
+}
+
 // static
 NavigationRequest* NavigationRequest::From(NavigationHandle* handle) {
   return static_cast<NavigationRequest*>(handle);
@@ -4051,8 +4311,7 @@ void NavigationRequest::RestartBackForwardCachedNavigationImpl() {
   CHECK(rfh);
   CHECK_EQ(rfh->frame_tree_node()->navigation_request(), this);
 
-  NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
-      rfh->frame_tree_node()->navigator()->GetController());
+  NavigationControllerImpl* controller = GetNavigationController();
   int nav_index = controller->GetEntryIndexWithUniqueID(nav_entry_id());
 
   // If the NavigationEntry was deleted, do not do anything.
@@ -4068,7 +4327,7 @@ void NavigationRequest::ForceEnableOriginTrials(
   commit_params_->force_enabled_origin_trials = trials;
 }
 
-base::Optional<network::BlockedByResponseReason>
+base::Optional<network::mojom::BlockedByResponseReason>
 NavigationRequest::IsBlockedByCorp() {
   if (!base::FeatureList::IsEnabled(
           network::features::kCrossOriginEmbedderPolicy)) {
@@ -4097,4 +4356,51 @@ NavigationRequest::TakePeakGpuMemoryTracker() {
   return std::move(loading_mem_tracker_);
 }
 
+std::string NavigationRequest::GetUserAgentOverride() {
+  return IsOverridingUserAgent() ? frame_tree_node_->navigator()
+                                       ->GetDelegate()
+                                       ->GetUserAgentOverride()
+                                       .ua_string_override
+                                 : std::string();
+}
+
+NavigationControllerImpl* NavigationRequest::GetNavigationController() {
+  return static_cast<NavigationControllerImpl*>(
+      frame_tree_node_->navigator()->GetController());
+}
+
+mojo::PendingRemote<network::mojom::CookieAccessObserver>
+NavigationRequest::CreateCookieAccessObserver() {
+  mojo::PendingRemote<network::mojom::CookieAccessObserver> remote;
+  cookie_observers_.Add(this, remote.InitWithNewPipeAndPassReceiver());
+  return remote;
+}
+
+void NavigationRequest::OnCookiesAccessed(
+    network::mojom::CookieAccessDetailsPtr details) {
+  // TODO(721329): We should not send information to the current frame about
+  // (potentially unrelated) ongoing navigation, but at the moment we don't
+  // have another way to add messages to DevTools console.
+  EmitSameSiteCookiesDeprecationWarning(frame_tree_node()->current_frame_host(),
+                                        details);
+
+  CookieAccessDetails allowed;
+  CookieAccessDetails blocked;
+  SplitCookiesIntoAllowedAndBlocked(details, &allowed, &blocked);
+  if (!allowed.cookie_list.empty())
+    GetDelegate()->OnCookiesAccessed(this, allowed);
+  if (!blocked.cookie_list.empty())
+    GetDelegate()->OnCookiesAccessed(this, blocked);
+}
+
+void NavigationRequest::Clone(
+    mojo::PendingReceiver<network::mojom::CookieAccessObserver> observer) {
+  cookie_observers_.Add(this, std::move(observer));
+}
+
+std::vector<mojo::PendingReceiver<network::mojom::CookieAccessObserver>>
+NavigationRequest::TakeCookieObservers() {
+  return cookie_observers_.TakeReceivers();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_request.h b/chromium/content/browser/frame_host/navigation_request.h
index 5e47c91a5f5..cd7ee0d77bb 100644
--- a/chromium/content/browser/frame_host/navigation_request.h
+++ b/chromium/content/browser/frame_host/navigation_request.h
@@ -27,12 +27,14 @@
 #include "content/common/content_export.h"
 #include "content/common/navigation_params.h"
 #include "content/common/navigation_params.mojom.h"
+#include "content/public/browser/allow_service_worker_result.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/navigation_type.h"
 #include "content/public/browser/peak_gpu_memory_tracker.h"
 #include "content/public/browser/render_process_host_observer.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/previews_state.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
@@ -40,8 +42,9 @@
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/proxy_server.h"
 #include "net/dns/public/resolve_error_info.h"
-#include "services/network/public/cpp/blocked_by_response_reason.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/origin_policy.h"
+#include "services/network/public/mojom/blocked_by_response_reason.mojom-shared.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/scoped_java_ref.h"
@@ -80,7 +83,8 @@ class CONTENT_EXPORT NavigationRequest
     : public NavigationHandle,
       public NavigationURLLoaderDelegate,
       public NavigationThrottleRunner::Delegate,
-      private RenderProcessHostObserver {
+      private RenderProcessHostObserver,
+      private network::mojom::CookieAccessObserver {
  public:
   // Keeps track of the various stages of a NavigationRequest.
   enum NavigationState {
@@ -154,11 +158,13 @@ class CONTENT_EXPORT NavigationRequest
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
       bool browser_initiated,
+      const GlobalFrameRoutingId& initiator_routing_id,
       const std::string& extra_headers,
       FrameNavigationEntry* frame_entry,
       NavigationEntryImpl* entry,
       const scoped_refptr<network::ResourceRequestBody>& post_body,
-      std::unique_ptr<NavigationUIData> navigation_ui_data);
+      std::unique_ptr<NavigationUIData> navigation_ui_data,
+      const base::Optional<Impression>& impression);
 
   // Creates a request for a renderer-intiated navigation.
   // Note: |body| is sent to the IO thread when calling BeginNavigation, and
@@ -189,15 +195,27 @@ class CONTENT_EXPORT NavigationRequest
   static std::unique_ptr<NavigationRequest> CreateForCommit(
       FrameTreeNode* frame_tree_node,
       RenderFrameHostImpl* render_frame_host,
-      NavigationEntryImpl* entry,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      bool is_renderer_initiated,
+      std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter,
       bool is_same_document);
 
   static NavigationRequest* From(NavigationHandle* handle);
 
   ~NavigationRequest() override;
 
+  // Returns true if this request's URL matches |origin| and the request state
+  // is at (or past) WILL_PROCESS_RESPONSE.
+  bool HasCommittingOrigin(const url::Origin& origin);
+
+  // Returns whether and how this navigation request is requesting opt-in
+  // origin-isolation.
+  enum class OptInIsolationCheckResult {
+    NONE,          // no isolation requested
+    HEADER,        // requested using the Origin-Isolation header
+    ORIGIN_POLICY  // requested using origin policy
+  };
+  OptInIsolationCheckResult IsOptInIsolationRequested(const GURL& url);
+
   // NavigationHandle implementation:
   int64_t GetNavigationId() override;
   const GURL& GetURL() override;
@@ -212,6 +230,8 @@ class CONTENT_EXPORT NavigationRequest
   RenderFrameHostImpl* GetParentFrame() override;
   base::TimeTicks NavigationStart() override;
   base::TimeTicks NavigationInputStart() override;
+  base::TimeTicks FirstRequestStart() override;
+  base::TimeTicks FirstResponseStart() override;
   bool IsPost() override;
   const blink::mojom::Referrer& GetReferrer() override;
   bool HasUserGesture() override;
@@ -232,12 +252,14 @@ class CONTENT_EXPORT NavigationRequest
   void RemoveRequestHeader(const std::string& header_name) override;
   void SetRequestHeader(const std::string& header_name,
                         const std::string& header_value) override;
+  void SetCorsExemptRequestHeader(const std::string& header_name,
+                                  const std::string& header_value) override;
   const net::HttpResponseHeaders* GetResponseHeaders() override;
   net::HttpResponseInfo::ConnectionInfo GetConnectionInfo() override;
   const base::Optional<net::SSLInfo>& GetSSLInfo() override;
   const base::Optional<net::AuthChallengeInfo>& GetAuthChallengeInfo() override;
   net::ResolveErrorInfo GetResolveErrorInfo() override;
-  net::NetworkIsolationKey GetNetworkIsolationKey() override;
+  net::IsolationInfo GetIsolationInfo() override;
   void RegisterThrottleForTesting(
       std::unique_ptr<NavigationThrottle> navigation_throttle) override;
   bool IsDeferredForTesting() override;
@@ -256,6 +278,8 @@ class CONTENT_EXPORT NavigationRequest
   bool WasResponseCached() override;
   const net::ProxyServer& GetProxyServer() override;
   const std::string& GetHrefTranslate() override;
+  const base::Optional<Impression>& GetImpression() override;
+  const GlobalFrameRoutingId& GetInitiatorRoutingId() override;
   const base::Optional<url::Origin>& GetInitiatorOrigin() override;
   bool IsSameProcess() override;
   int GetNavigationEntryOffset() override;
@@ -263,6 +287,8 @@ class CONTENT_EXPORT NavigationRequest
       mojom::TransferrableURLLoaderPtr transferrable_loader) override;
   GlobalFrameRoutingId GetPreviousRenderFrameHostId() override;
   bool IsServedFromBackForwardCache() override;
+  void SetIsOverridingUserAgent(bool override_ua) override;
+  bool GetIsOverridingUserAgent() override;
 
   // Called on the UI thread by the Navigator to start the navigation.
   // The NavigationRequest can be deleted while BeginNavigation() is called.
@@ -349,6 +375,12 @@ class CONTENT_EXPORT NavigationRequest
 
   int nav_entry_id() const { return nav_entry_id_; }
 
+  bool was_set_overriding_user_agent_called() const {
+    return was_set_overriding_user_agent_called_;
+  }
+
+  bool entry_overrides_ua() const { return entry_overrides_ua_; }
+
   // For automation driver-initiated navigations over the devtools protocol,
   // |devtools_navigation_token_| is used to tag the navigation. This navigation
   // token is then sent into the renderer and lands on the DocumentLoader. That
@@ -552,6 +584,8 @@ class CONTENT_EXPORT NavigationRequest
     return require_coop_browsing_instance_swap_;
   }
 
+  bool ua_change_requires_reload() const { return ua_change_requires_reload_; }
+
   void set_require_coop_browsing_instance_swap() {
     require_coop_browsing_instance_swap_ = true;
   }
@@ -561,6 +595,25 @@ class CONTENT_EXPORT NavigationRequest
 
   std::unique_ptr<CrossOriginEmbedderPolicyReporter> TakeCoepReporter();
 
+  // Returns UKM SourceId for the page we are navigating away from.
+  // Equal to GetRenderFrameHost()->GetPageUkmSourceId() for subframe
+  // and same-document navigations and to
+  // RenderFrameHost::FromID(GetPreviousRenderFrameHostId())
+  //     ->GetPageUkmSourceId() for main-frame cross-document navigations.
+  ukm::SourceId GetPreviousPageUkmSourceId();
+
+  // Returns the NavigationEntry associated with this, which may be null.
+  NavigationEntry* GetNavigationEntry();
+
+  void OnServiceWorkerAccessed(const GURL& scope,
+                               AllowServiceWorkerResult allowed);
+
+  // Take all cookie observers associated with this navigation.
+  // Typically this is called when navigation commits to move these observers to
+  // the committed document.
+  std::vector<mojo::PendingReceiver<network::mojom::CookieAccessObserver>>
+  TakeCookieObservers() WARN_UNUSED_RESULT;
+
  private:
   friend class NavigationRequestTest;
 
@@ -580,12 +633,10 @@ class CONTENT_EXPORT NavigationRequest
           navigation_initiator,
       RenderFrameHostImpl* rfh_restored_from_back_forward_cache);
 
-  // Checks if the OriginPolicy in a NavigationRequest's response contains a
-  // request to isolate the url's origin, and if so registers it with the global
-  // origin isolation map.
-  void CheckForOriginPolicyIsolationOptIn(
-      const GURL& url,
-      const network::mojom::URLResponseHead* response);
+  // Checks if the response requests an isolated origin (using either origin
+  // policy or the Origin-Isolation header), and if so opts in the origin to be
+  // isolated.
+  void CheckForIsolationOptIn(const GURL& url);
 
   // NavigationURLLoaderDelegate implementation.
   void OnRequestRedirected(
@@ -883,10 +934,33 @@ class CONTENT_EXPORT NavigationRequest
 
   void CreateCoepReporter(StoragePartition* storage_partition);
 
-  base::Optional<network::BlockedByResponseReason> IsBlockedByCorp();
+  base::Optional<network::mojom::BlockedByResponseReason> IsBlockedByCorp();
+
+  bool IsOverridingUserAgent() const {
+    return commit_params_->is_overriding_user_agent || entry_overrides_ua_;
+  }
+
+  // Returns the user-agent override, or an empty string if one isn't set.
+  std::string GetUserAgentOverride();
+
+  mojo::PendingRemote<network::mojom::CookieAccessObserver>
+  CreateCookieAccessObserver();
+
+  // network::mojom::CookieAccessObserver:
+  void OnCookiesAccessed(
+      network::mojom::CookieAccessDetailsPtr details) override;
+  void Clone(mojo::PendingReceiver<network::mojom::CookieAccessObserver>
+                 observer) override;
+
+  // Convenience function to return the NavigationControllerImpl this
+  // NavigationRequest is in.
+  NavigationControllerImpl* GetNavigationController();
 
   FrameTreeNode* frame_tree_node_;
 
+  // Value of |is_for_commit| supplied to the constructor.
+  const bool is_for_commit_;
+
   // Invariant: At least one of |loader_| or |render_frame_host_| is null.
   RenderFrameHostImpl* render_frame_host_ = nullptr;
 
@@ -901,7 +975,9 @@ class CONTENT_EXPORT NavigationRequest
   // be set in CreatedNavigationRequest.
   // Note: |browser_initiated_| and |common_params_| may be mutated by
   // ContentBrowserClient::OverrideNavigationParams at StartNavigation time
-  // (i.e. before we actually kick off the navigation).
+  // (i.e. before we actually kick off the navigation). |browser_initiated|
+  // will always be true for history navigations, even if they began in the
+  // renderer using the history API.
   mojom::CommonNavigationParamsPtr common_params_;
   mojom::BeginNavigationParamsPtr begin_params_;
   mojom::CommitNavigationParamsPtr commit_params_;
@@ -937,6 +1013,9 @@ class CONTENT_EXPORT NavigationRequest
   int nav_entry_id_ = 0;
   bool entry_overrides_ua_ = false;
 
+  // Set to true if SetIsOverridingUserAgent() is called.
+  bool was_set_overriding_user_agent_called_ = false;
+
   scoped_refptr<SiteInstanceImpl> starting_site_instance_;
 
   // Whether the navigation should be sent to a renderer a process. This is
@@ -1074,6 +1153,29 @@ class CONTENT_EXPORT NavigationRequest
   // is enabled or TrustableWebBundleFileUrl switch is set.
   std::unique_ptr<WebBundleHandleTracker> web_bundle_handle_tracker_;
 
+  // The time the first HTTP request was sent. This is filled with
+  // net::LoadTimingInfo::send_start during navigation.
+  //
+  // In some cases, this can be the time an internal request started that did
+  // not go to the networking layer. For example,
+  // - Service Worker: the time the fetch event was ready to be dispatched, see
+  //   content::ServiceWorkerNavigationLoader::DidPrepareFetchEvent()).
+  // - HSTS: the time the internal redirect was handled.
+  // - Signed Exchange: the time the SXG was handled.
+  base::TimeTicks first_request_start_;
+
+  // The time the headers of the first HTTP response were received. This is
+  // filled with net::LoadTimingInfo::receive_headers_start on the first HTTP
+  // response during navigation.
+  //
+  // In some cases, this can be the time an internal response was received that
+  // did not come from the networking layer. For example,
+  // - Service Worker: the time the response from the service worker was
+  //   received, see content::ServiceWorkerNavigationLoader::StartResponse().
+  // - HSTS: the time the internal redirect was handled.
+  // - Signed Exchange: the time the SXG was handled.
+  base::TimeTicks first_response_start_;
+
   // The time this navigation was ready to commit.
   base::TimeTicks ready_to_commit_time_;
 
@@ -1130,16 +1232,22 @@ class CONTENT_EXPORT NavigationRequest
   std::unique_ptr<base::CallbackList<void(bool)>::Subscription>
       render_process_blocked_state_changed_subscription_;
 
-  // The headers used for the request.
-  net::HttpRequestHeaders request_headers_;
+  // The headers used for the request. The value of this comes from
+  // |begin_params_->headers|. If not set, it needs to be calculated.
+  base::Optional<net::HttpRequestHeaders> request_headers_;
 
   // Used to update the request's headers. When modified during the navigation
   // start, the headers will be applied to the initial network request. When
   // modified during a redirect, the headers will be applied to the redirected
   // request.
-  std::vector<std::string> removed_request_headers_;
   net::HttpRequestHeaders modified_request_headers_;
 
+  net::HttpRequestHeaders cors_exempt_request_headers_;
+
+  // Set of headers to remove during the redirect phase. This can only be
+  // modified during the redirect phase.
+  std::vector<std::string> removed_request_headers_;
+
   // Allows to override response_headers_ in tests.
   // TODO(clamy): Clean this up once the architecture of unit tests is better.
   scoped_refptr<net::HttpResponseHeaders> response_headers_for_testing_;
@@ -1154,13 +1262,20 @@ class CONTENT_EXPORT NavigationRequest
   int64_t frame_entry_item_sequence_number_ = -1;
   int64_t frame_entry_document_sequence_number_ = -1;
 
-  // If non-empty, it represents the network isolation key explicitly asked to
-  // be used for this NavigationRequest.
-  base::Optional<net::NetworkIsolationKey> network_isolation_key_;
+  // If non-empty, it represents the IsolationInfo explicitly asked to be used
+  // for this NavigationRequest.
+  base::Optional<net::IsolationInfo> isolation_info_;
 
   // This is used to store the current_frame_host id at request creation time.
   GlobalFrameRoutingId previous_render_frame_host_id_;
 
+  // Routing id of the frame host that initiated the navigation, derived from
+  // |begin_params()->initiator_routing_id|. This is best effort: it is only
+  // defined for some renderer-initiated navigations (e.g., not drag and drop).
+  // The frame with the corresponding routing ID may have been deleted before
+  // the navigation begins.
+  GlobalFrameRoutingId initiator_routing_id_;
+
   // This tracks a connection between the current pending entry and this
   // request, such that the pending entry can be discarded if no requests are
   // left referencing it.
@@ -1198,6 +1313,21 @@ class CONTENT_EXPORT NavigationRequest
   // one. Implement the behavior.
   bool require_coop_browsing_instance_swap_ = false;
 
+#if DCHECK_IS_ON()
+  bool is_safe_to_delete_ = true;
+#endif
+
+  // UKM source associated with the page we are navigated away from.
+  ukm::SourceId previous_page_load_ukm_source_id_ = ukm::kInvalidSourceId;
+
+  // If true, changes to the user-agent override require a reload. If false, a
+  // reload is not necessary.
+  bool ua_change_requires_reload_ = true;
+
+  // Observers listening to cookie access notifications for the network requests
+  // made by this navigation.
+  mojo::ReceiverSet<network::mojom::CookieAccessObserver> cookie_observers_;
+
   base::WeakPtrFactory<NavigationRequest> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(NavigationRequest);
diff --git a/chromium/content/browser/frame_host/navigation_request_browsertest.cc b/chromium/content/browser/frame_host/navigation_request_browsertest.cc
index 0572d5bd058..3f274d6f23c 100644
--- a/chromium/content/browser/frame_host/navigation_request_browsertest.cc
+++ b/chromium/content/browser/frame_host/navigation_request_browsertest.cc
@@ -23,6 +23,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/frame_host/navigation_request_info.cc b/chromium/content/browser/frame_host/navigation_request_info.cc
index fa3b6ddd300..5b738f8f39c 100644
--- a/chromium/content/browser/frame_host/navigation_request_info.cc
+++ b/chromium/content/browser/frame_host/navigation_request_info.cc
@@ -9,8 +9,7 @@ namespace content {
 NavigationRequestInfo::NavigationRequestInfo(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::BeginNavigationParamsPtr begin_params,
-    const net::SiteForCookies& site_for_cookies,
-    const net::NetworkIsolationKey& network_isolation_key,
+    const net::IsolationInfo& isolation_info,
     bool is_main_frame,
     bool parent_is_main_frame,
     bool are_ancestors_secure,
@@ -23,11 +22,11 @@ NavigationRequestInfo::NavigationRequestInfo(
         blob_url_loader_factory,
     const base::UnguessableToken& devtools_navigation_token,
     const base::UnguessableToken& devtools_frame_token,
-    bool obey_origin_policy)
+    bool obey_origin_policy,
+    net::HttpRequestHeaders cors_exempt_headers)
     : common_params(std::move(common_params)),
       begin_params(std::move(begin_params)),
-      site_for_cookies(site_for_cookies),
-      network_isolation_key(network_isolation_key),
+      isolation_info(isolation_info),
       is_main_frame(is_main_frame),
       parent_is_main_frame(parent_is_main_frame),
       are_ancestors_secure(are_ancestors_secure),
@@ -39,7 +38,8 @@ NavigationRequestInfo::NavigationRequestInfo(
       blob_url_loader_factory(std::move(blob_url_loader_factory)),
       devtools_navigation_token(devtools_navigation_token),
       devtools_frame_token(devtools_frame_token),
-      obey_origin_policy(obey_origin_policy) {}
+      obey_origin_policy(obey_origin_policy),
+      cors_exempt_headers(std::move(cors_exempt_headers)) {}
 
 NavigationRequestInfo::~NavigationRequestInfo() {}
 
diff --git a/chromium/content/browser/frame_host/navigation_request_info.h b/chromium/content/browser/frame_host/navigation_request_info.h
index ab18c001264..6e8dd530d24 100644
--- a/chromium/content/browser/frame_host/navigation_request_info.h
+++ b/chromium/content/browser/frame_host/navigation_request_info.h
@@ -13,6 +13,8 @@
 #include "content/common/navigation_params.h"
 #include "content/common/navigation_params.mojom.h"
 #include "content/public/common/referrer.h"
+#include "net/base/isolation_info.h"
+#include "net/http/http_request_headers.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -25,8 +27,7 @@ namespace content {
 struct CONTENT_EXPORT NavigationRequestInfo {
   NavigationRequestInfo(mojom::CommonNavigationParamsPtr common_params,
                         mojom::BeginNavigationParamsPtr begin_params,
-                        const net::SiteForCookies& site_for_cookies,
-                        const net::NetworkIsolationKey& network_isolation_key,
+                        const net::IsolationInfo& isolation_info,
                         bool is_main_frame,
                         bool parent_is_main_frame,
                         bool are_ancestors_secure,
@@ -39,20 +40,21 @@ struct CONTENT_EXPORT NavigationRequestInfo {
                             blob_url_loader_factory,
                         const base::UnguessableToken& devtools_navigation_token,
                         const base::UnguessableToken& devtools_frame_token,
-                        bool obey_origin_policy);
+                        bool obey_origin_policy,
+                        net::HttpRequestHeaders cors_exempt_headers);
   NavigationRequestInfo(const NavigationRequestInfo& other) = delete;
   ~NavigationRequestInfo();
 
   mojom::CommonNavigationParamsPtr common_params;
   mojom::BeginNavigationParamsPtr begin_params;
 
-  // Used to check which URLs (if any) are third-party for purposes of cookie
-  // blocking policy.
-  const net::SiteForCookies site_for_cookies;
-
-  // Navigation resource requests will be keyed using |network_isolation_key|
-  // for accessing shared network resources like the http cache.
-  const net::NetworkIsolationKey network_isolation_key;
+  // Contains information used to prevent sharing information from a navigation
+  // request across first party contexts. In particular, tracks the
+  // SiteForCookies, which controls what site's SameSite cookies may be set,
+  // NetworkIsolationKey, which is used to restrict sharing of network
+  // resources, and how to update them across redirects, which is different for
+  // main frames and subresources.
+  const net::IsolationInfo isolation_info;
 
   const bool is_main_frame;
   const bool parent_is_main_frame;
@@ -85,6 +87,8 @@ struct CONTENT_EXPORT NavigationRequestInfo {
   // policy, if necessary, and attach it to the ResourceResponseHead.
   // Spec: https://wicg.github.io/origin-policy/
   const bool obey_origin_policy;
+
+  const net::HttpRequestHeaders cors_exempt_headers;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_request_unittest.cc b/chromium/content/browser/frame_host/navigation_request_unittest.cc
index 3c36298b955..3a5e2050e47 100644
--- a/chromium/content/browser/frame_host/navigation_request_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_request_unittest.cc
@@ -195,7 +195,10 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
     request_ = NavigationRequest::CreateBrowserInitiated(
         main_test_rfh()->frame_tree_node(), std::move(common_params),
         CreateCommitNavigationParams(), false /* browser-initiated */,
-        std::string(), nullptr, nullptr, nullptr, nullptr);
+        GlobalFrameRoutingId() /* initiator_routing_id */,
+        std::string() /* extra_headers */, nullptr /* frame_entry */,
+        nullptr /* entry */, nullptr /* post_body */,
+        nullptr /* navigation_ui_data */, base::nullopt /* impression */);
     request_->StartNavigation(true);
   }
 
diff --git a/chromium/content/browser/frame_host/navigation_throttle_runner.cc b/chromium/content/browser/frame_host/navigation_throttle_runner.cc
index ee1e24c73e1..078b04462cd 100644
--- a/chromium/content/browser/frame_host/navigation_throttle_runner.cc
+++ b/chromium/content/browser/frame_host/navigation_throttle_runner.cc
@@ -12,7 +12,6 @@
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/origin_policy_throttle.h"
-#include "content/browser/frame_host/webui_navigation_throttle.h"
 #include "content/browser/portal/portal_navigation_throttle.h"
 #include "content/public/browser/navigation_handle.h"
 
@@ -98,9 +97,6 @@ void NavigationThrottleRunner::RegisterNavigationThrottles() {
 
   throttles_ = request->GetDelegate()->CreateThrottlesForNavigation(request);
 
-  // Enforce rules for WebUI navigations.
-  AddThrottle(WebUINavigationThrottle::CreateThrottleForNavigation(request));
-
   // Check for renderer-inititated main frame navigations to blocked URL schemes
   // (data, filesystem). This is done early as it may block the main frame
   // navigation altogether.
diff --git a/chromium/content/browser/frame_host/navigator.cc b/chromium/content/browser/frame_host/navigator.cc
index c07ed77e77d..e052b64302d 100644
--- a/chromium/content/browser/frame_host/navigator.cc
+++ b/chromium/content/browser/frame_host/navigator.cc
@@ -1,31 +1,594 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
+// Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigator.h"
 
+#include <utility>
+
+#include "base/check_op.h"
+#include "base/debug/dump_without_crashing.h"
+#include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
+#include "base/strings/string_util.h"
 #include "base/time/time.h"
+#include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/frame_host/debug_urls.h"
+#include "content/browser/frame_host/frame_tree.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/navigation_controller_impl.h"
+#include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
+#include "content/browser/frame_host/navigation_request_info.h"
+#include "content/browser/frame_host/navigator_delegate.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
+#include "content/browser/site_instance_impl.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 #include "content/browser/web_package/web_bundle_handle_tracker.h"
+#include "content/browser/webui/web_ui_controller_factory_registry.h"
+#include "content/browser/webui/web_ui_impl.h"
+#include "content/common/frame_messages.h"
+#include "content/common/navigation_params.h"
+#include "content/common/navigation_params_utils.h"
+#include "content/common/page_messages.h"
+#include "content/common/view_messages.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/global_request_id.h"
+#include "content/public/browser/invalidate_type.h"
+#include "content/public/browser/navigation_controller.h"
+#include "content/public/browser/navigation_details.h"
+#include "content/public/browser/page_navigator.h"
+#include "content/public/browser/render_view_host.h"
+#include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_constants.h"
+#include "content/public/common/navigation_policy.h"
+#include "content/public/common/url_utils.h"
+#include "net/base/net_errors.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "url/gurl.h"
+#include "url/url_util.h"
 
 namespace content {
 
+struct Navigator::NavigationMetricsData {
+  NavigationMetricsData(base::TimeTicks start_time,
+                        GURL url,
+                        RestoreType restore_type)
+      : start_time_(start_time), url_(url) {
+    is_restoring_from_last_session_ =
+        (restore_type == RestoreType::LAST_SESSION_EXITED_CLEANLY ||
+         restore_type == RestoreType::LAST_SESSION_CRASHED);
+  }
+
+  base::TimeTicks start_time_;
+  GURL url_;
+  bool is_restoring_from_last_session_;
+  base::TimeTicks url_job_start_time_;
+  base::TimeDelta before_unload_delay_;
+};
+
+Navigator::Navigator(NavigationControllerImpl* navigation_controller,
+                     NavigatorDelegate* delegate)
+    : controller_(navigation_controller), delegate_(delegate) {}
+
+Navigator::~Navigator() = default;
+
+// static
+bool Navigator::CheckWebUIRendererDoesNotDisplayNormalURL(
+    RenderFrameHostImpl* render_frame_host,
+    const GURL& url,
+    bool is_renderer_initiated_check) {
+  // In single process mode, everything runs in the same process, so the checks
+  // below are irrelevant.
+  if (RenderProcessHost::run_renderer_in_process())
+    return true;
+
+  ChildProcessSecurityPolicyImpl* security_policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+  GURL process_lock_url =
+      security_policy->GetOriginLock(render_frame_host->GetProcess()->GetID());
+
+  // In the case of error page process, any URL is allowed to commit.
+  if (process_lock_url == GURL(kUnreachableWebDataURL))
+    return true;
+
+  bool frame_has_bindings = ((render_frame_host->GetEnabledBindings() &
+                              kWebUIBindingsPolicyMask) != 0);
+  bool is_allowed_in_web_ui_renderer =
+      WebUIControllerFactoryRegistry::GetInstance()->IsURLAcceptableForWebUI(
+          render_frame_host->GetProcess()->GetBrowserContext(), url);
+
+  // Embedders might disable locking for WebUI URLs, which is bad idea, however
+  // this method should take this into account.
+  bool should_lock_to_origin = SiteInstanceImpl::ShouldLockToOrigin(
+      render_frame_host->GetSiteInstance()->GetIsolationContext(), url,
+      render_frame_host->GetSiteInstance()->IsGuest());
+
+  // If the |render_frame_host| has any WebUI bindings, disallow URLs that are
+  // not allowed in a WebUI renderer process.
+  if (frame_has_bindings) {
+    // The process itself must have WebUI bit in the security policy.
+    // Otherwise it indicates that there is a bug in browser process logic and
+    // the browser process must be terminated.
+    // TODO(nasko): Convert to CHECK() once it is confirmed this is not
+    // violated in reality.
+    if (!security_policy->HasWebUIBindings(
+            render_frame_host->GetProcess()->GetID())) {
+      base::debug::DumpWithoutCrashing();
+    }
+
+    // Check whether the process must be locked and if so that the process lock
+    // is indeed in place.
+    if (should_lock_to_origin && process_lock_url.is_empty())
+      return false;
+
+    // There must be a WebUI on the frame.
+    if (!render_frame_host->web_ui())
+      return false;
+
+    // The |url| must be allowed in a WebUI process if the frame has WebUI.
+    if (!is_allowed_in_web_ui_renderer) {
+      // If this method is called in response to IPC message from the renderer
+      // process, it should be terminated, otherwise it is a bug in the
+      // navigation logic and the browser process should be terminated to avoid
+      // exposing users to security issues.
+      if (is_renderer_initiated_check)
+        return false;
+
+      CHECK(false);
+    }
+  }
+
+  // If |url| is one that is allowed in WebUI renderer process, ensure that its
+  // origin is either opaque or matches the origin of the process lock.
+  if (is_allowed_in_web_ui_renderer) {
+    url::Origin url_origin = url::Origin::Create(url.GetOrigin());
+
+    // Verify |url| matches the origin of the process lock, if one is in place.
+    if (should_lock_to_origin) {
+      url::Origin process_lock_origin = url::Origin::Create(process_lock_url);
+      if (!url_origin.opaque() && process_lock_origin != url_origin)
+        return false;
+    }
+  }
+
+  return true;
+}
+
+// A renderer-initiated navigation should be ignored iff a) there is an ongoing
+// request b) which is browser initiated and c) the renderer request is not
+// user-initiated.
+// static
+bool Navigator::ShouldIgnoreIncomingRendererRequest(
+    const NavigationRequest* ongoing_navigation_request,
+    bool has_user_gesture) {
+  return ongoing_navigation_request &&
+         ongoing_navigation_request->browser_initiated() && !has_user_gesture;
+}
+
 NavigatorDelegate* Navigator::GetDelegate() {
-  return nullptr;
+  return delegate_;
 }
 
 NavigationController* Navigator::GetController() {
-  return nullptr;
+  return controller_;
+}
+
+void Navigator::DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
+                                     const GURL& url,
+                                     int error_code) {
+  if (delegate_) {
+    delegate_->DidFailLoadWithError(render_frame_host, url, error_code);
+  }
 }
 
 bool Navigator::StartHistoryNavigationInNewSubframe(
     RenderFrameHostImpl* render_frame_host,
     mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client) {
-  return false;
+  return controller_->StartHistoryNavigationInNewSubframe(render_frame_host,
+                                                          navigation_client);
+}
+
+void Navigator::DidNavigate(
+    RenderFrameHostImpl* render_frame_host,
+    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    std::unique_ptr<NavigationRequest> navigation_request,
+    bool was_within_same_document) {
+  DCHECK(navigation_request);
+  FrameTreeNode* frame_tree_node = render_frame_host->frame_tree_node();
+  FrameTree* frame_tree = frame_tree_node->frame_tree();
+
+  bool is_same_document_navigation = controller_->IsURLSameDocumentNavigation(
+      params.url, params.origin, was_within_same_document, render_frame_host);
+
+  // If a frame claims the navigation was same-document, it must be the current
+  // frame, not a pending one.
+  if (is_same_document_navigation &&
+      render_frame_host !=
+          frame_tree_node->render_manager()->current_frame_host()) {
+    bad_message::ReceivedBadMessage(render_frame_host->GetProcess(),
+                                    bad_message::NI_IN_PAGE_NAVIGATION);
+    is_same_document_navigation = false;
+  }
+
+  if (ui::PageTransitionIsMainFrame(params.transition)) {
+    if (delegate_) {
+      // Run tasks that must execute just before the commit.
+      delegate_->DidNavigateMainFramePreCommit(is_same_document_navigation);
+    }
+  }
+
+  // For browser initiated navigation and same document navigation, frame policy
+  // in commit_params is nullopt and should use fallback value instead.
+  const blink::FramePolicy pending_frame_policy =
+      navigation_request->commit_params().frame_policy.value_or(
+          frame_tree_node->pending_frame_policy());
+
+  // DidNavigateFrame() must be called before replicating the new origin and
+  // other properties to proxies.  This is because it destroys the subframes of
+  // the frame we're navigating from, which might trigger those subframes to
+  // run unload handlers.  Those unload handlers should still see the old
+  // frame's origin.  See https://crbug.com/825283.
+  frame_tree_node->render_manager()->DidNavigateFrame(
+      render_frame_host, params.gesture == NavigationGestureUser,
+      is_same_document_navigation,
+      navigation_request
+          ->require_coop_browsing_instance_swap() /* clear_proxies_on_commit */,
+      pending_frame_policy);
+
+  // Save the new page's origin and other properties, and replicate them to
+  // proxies, including the proxy created in DidNavigateFrame() to replace the
+  // old frame in cross-process navigation cases.
+  frame_tree_node->SetCurrentOrigin(
+      params.origin, params.has_potentially_trustworthy_unique_origin);
+  frame_tree_node->SetInsecureRequestPolicy(params.insecure_request_policy);
+  frame_tree_node->SetInsecureNavigationsSet(params.insecure_navigations_set);
+
+  // Save the activation status of the previous page here before it gets reset
+  // in FrameTreeNode::ResetForNavigation.
+  bool previous_document_was_activated =
+      frame_tree->root()->HasStickyUserActivation();
+
+  if (!is_same_document_navigation) {
+    // Navigating to a new location means a new, fresh set of http headers
+    // and/or <meta> elements - we need to reset CSP and Feature Policy.
+    render_frame_host->ResetContentSecurityPolicies();
+    frame_tree_node->ResetForNavigation();
+
+    // Save the new document's embedding token and propagate to any parent
+    // document that embeds it. A token is only assigned to cross-process
+    // child frames.
+    render_frame_host->SetEmbeddingToken(params.embedding_token);
+  }
+
+  // Update the site of the SiteInstance if it doesn't have one yet, unless
+  // assigning a site is not necessary for this URL. In that case, the
+  // SiteInstance can still be considered unused until a navigation to a real
+  // page.
+  SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
+  if (!site_instance->HasSite() &&
+      SiteInstanceImpl::ShouldAssignSiteForURL(params.url)) {
+    site_instance->ConvertToDefaultOrSetSite(params.url);
+  }
+
+  // Need to update MIME type here because it's referred to in
+  // UpdateNavigationCommands() called by RendererDidNavigate() to
+  // determine whether or not to enable the encoding menu.
+  // It's updated only for the main frame. For a subframe,
+  // RenderView::UpdateURL does not set params.contents_mime_type.
+  // (see http://code.google.com/p/chromium/issues/detail?id=2929 )
+  // TODO(jungshik): Add a test for the encoding menu to avoid
+  // regressing it again.
+  // TODO(nasko): Verify the correctness of the above comment, since some of the
+  // code doesn't exist anymore. Also, move this code in the
+  // PageTransitionIsMainFrame code block above.
+  if (ui::PageTransitionIsMainFrame(params.transition) && delegate_)
+    delegate_->SetMainFrameMimeType(params.contents_mime_type);
+
+  int old_entry_count = controller_->GetEntryCount();
+  LoadCommittedDetails details;
+  bool did_navigate = controller_->RendererDidNavigate(
+      render_frame_host, params, &details, is_same_document_navigation,
+      previous_document_was_activated, navigation_request.get());
+
+  // If the history length and/or offset changed, update other renderers in the
+  // FrameTree.
+  if (old_entry_count != controller_->GetEntryCount() ||
+      details.previous_entry_index !=
+          controller_->GetLastCommittedEntryIndex()) {
+    frame_tree->root()->render_manager()->SendPageMessage(
+        new PageMsg_SetHistoryOffsetAndLength(
+            MSG_ROUTING_NONE, controller_->GetLastCommittedEntryIndex(),
+            controller_->GetEntryCount()),
+        site_instance);
+  }
+
+  render_frame_host->DidNavigate(params, is_same_document_navigation);
+
+  // Send notification about committed provisional loads. This notification is
+  // different from the NAV_ENTRY_COMMITTED notification which doesn't include
+  // the actual URL navigated to and isn't sent for AUTO_SUBFRAME navigations.
+  if (details.type != NAVIGATION_TYPE_NAV_IGNORE && delegate_) {
+    DCHECK_EQ(!render_frame_host->GetParent(),
+              did_navigate ? details.is_main_frame : false);
+    navigation_request->DidCommitNavigation(params, did_navigate,
+                                            details.did_replace_entry,
+                                            details.previous_url, details.type);
+    navigation_request.reset();
+  }
+
+  if (!did_navigate)
+    return;  // No navigation happened.
+
+  // DO NOT ADD MORE STUFF TO THIS FUNCTION! Your component should either listen
+  // for the appropriate notification (best) or you can add it to
+  // DidNavigateMainFramePostCommit / DidNavigateAnyFramePostCommit (only if
+  // necessary, please).
+
+  // TODO(carlosk): Move this out.
+  RecordNavigationMetrics(details, params, site_instance);
+
+  // Run post-commit tasks.
+  if (delegate_) {
+    if (details.is_main_frame) {
+      delegate_->DidNavigateMainFramePostCommit(render_frame_host, details,
+                                                params);
+    }
+
+    delegate_->DidNavigateAnyFramePostCommit(render_frame_host, details,
+                                             params);
+  }
+}
+
+void Navigator::Navigate(std::unique_ptr<NavigationRequest> request,
+                         ReloadType reload_type,
+                         RestoreType restore_type) {
+  TRACE_EVENT0("browser,navigation", "Navigator::Navigate");
+  TRACE_EVENT_INSTANT_WITH_TIMESTAMP0(
+      "navigation,rail", "NavigationTiming navigationStart",
+      TRACE_EVENT_SCOPE_GLOBAL, request->common_params().navigation_start);
+
+  // Save destination url, as it is needed for
+  // DidStartNavigationToPendingEntry and request could be destroyed after
+  // BeginNavigation below.
+  GURL dest_url = request->common_params().url;
+  FrameTreeNode* frame_tree_node = request->frame_tree_node();
+
+  navigation_data_.reset(
+      new NavigationMetricsData(request->common_params().navigation_start,
+                                request->common_params().url, restore_type));
+
+  // Check if the BeforeUnload event needs to execute before assigning the
+  // NavigationRequest to the FrameTreeNode. Assigning it to the FrameTreeNode
+  // has the side effect of initializing the current RenderFrameHost, which will
+  // return that it should execute the BeforeUnload event (even though we don't
+  // need to wait for it in the case of a brand new RenderFrameHost).
+  //
+  // We don't want to dispatch a beforeunload handler if
+  // is_history_navigation_in_new_child is true. This indicates a newly created
+  // child frame which does not have a beforeunload handler.
+  bool should_dispatch_beforeunload =
+      !NavigationTypeUtils::IsSameDocument(
+          request->common_params().navigation_type) &&
+      !request->common_params().is_history_navigation_in_new_child_frame &&
+      frame_tree_node->current_frame_host()->ShouldDispatchBeforeUnload(
+          false /* check_subframes_only */);
+
+  int nav_entry_id = request->nav_entry_id();
+  bool is_pending_entry =
+      controller_->GetPendingEntry() &&
+      (nav_entry_id == controller_->GetPendingEntry()->GetUniqueID());
+  frame_tree_node->CreatedNavigationRequest(std::move(request));
+  DCHECK(frame_tree_node->navigation_request());
+
+  // Have the current renderer execute its beforeunload event if needed. If it
+  // is not needed then NavigationRequest::BeginNavigation should be directly
+  // called instead.
+  if (should_dispatch_beforeunload) {
+    frame_tree_node->navigation_request()->SetWaitingForRendererResponse();
+    frame_tree_node->current_frame_host()->DispatchBeforeUnload(
+        RenderFrameHostImpl::BeforeUnloadType::BROWSER_INITIATED_NAVIGATION,
+        reload_type != ReloadType::NONE);
+  } else {
+    frame_tree_node->navigation_request()->BeginNavigation();
+    // WARNING: The NavigationRequest might have been destroyed in
+    // BeginNavigation(). Do not use |frame_tree_node->navigation_request()|
+    // after this point without null checking it first.
+  }
+
+  // Make sure no code called via RFH::Navigate clears the pending entry.
+  if (is_pending_entry)
+    CHECK_EQ(nav_entry_id, controller_->GetPendingEntry()->GetUniqueID());
+}
+
+void Navigator::RequestOpenURL(
+    RenderFrameHostImpl* render_frame_host,
+    const GURL& url,
+    const GlobalFrameRoutingId& initiator_routing_id,
+    const base::Optional<url::Origin>& initiator_origin,
+    const scoped_refptr<network::ResourceRequestBody>& post_body,
+    const std::string& extra_headers,
+    const Referrer& referrer,
+    WindowOpenDisposition disposition,
+    bool should_replace_current_entry,
+    bool user_gesture,
+    blink::TriggeringEventInfo triggering_event_info,
+    const std::string& href_translate,
+    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
+    const base::Optional<Impression>& impression) {
+  // Note: This can be called for subframes (even when OOPIFs are not possible)
+  // if the disposition calls for a different window.
+
+  // Only the current RenderFrameHost should be sending an OpenURL request.
+  // Pending RenderFrameHost should know where it is navigating and pending
+  // deletion RenderFrameHost shouldn't be trying to navigate.
+  if (render_frame_host !=
+      render_frame_host->frame_tree_node()->current_frame_host()) {
+    return;
+  }
+
+  SiteInstance* current_site_instance = render_frame_host->GetSiteInstance();
+
+  // TODO(creis): Pass the redirect_chain into this method to support client
+  // redirects.  http://crbug.com/311721.
+  std::vector<GURL> redirect_chain;
+
+  int frame_tree_node_id = -1;
+
+  // Send the navigation to the current FrameTreeNode if it's destined for a
+  // subframe in the current tab.  We'll assume it's for the main frame
+  // (possibly of a new or different WebContents) otherwise.
+  if (disposition == WindowOpenDisposition::CURRENT_TAB &&
+      render_frame_host->GetParent()) {
+    frame_tree_node_id =
+        render_frame_host->frame_tree_node()->frame_tree_node_id();
+  }
+
+  OpenURLParams params(url, referrer, frame_tree_node_id, disposition,
+                       ui::PAGE_TRANSITION_LINK,
+                       true /* is_renderer_initiated */);
+  params.post_data = post_body;
+  params.extra_headers = extra_headers;
+  if (redirect_chain.size() > 0)
+    params.redirect_chain = redirect_chain;
+  params.should_replace_current_entry = should_replace_current_entry;
+  params.user_gesture = user_gesture;
+  params.triggering_event_info = triggering_event_info;
+  params.initiator_origin = initiator_origin;
+  params.initiator_routing_id = initiator_routing_id;
+
+  // RequestOpenURL is used only for local frames, so we can get here only if
+  // the navigation is initiated by a frame in the same SiteInstance as this
+  // frame.  Note that navigations on RenderFrameProxies do not use
+  // RequestOpenURL and go through NavigateFromFrameProxy instead.
+  params.source_site_instance = current_site_instance;
+
+  params.source_render_frame_id = render_frame_host->GetRoutingID();
+  params.source_render_process_id = render_frame_host->GetProcess()->GetID();
+
+  if (render_frame_host->web_ui()) {
+    // Note that we hide the referrer for Web UI pages. We don't really want
+    // web sites to see a referrer of "chrome://blah" (and some chrome: URLs
+    // might have search terms or other stuff we don't want to send to the
+    // site), so we send no referrer.
+    params.referrer = Referrer();
+
+    // Navigations in Web UI pages count as browser-initiated navigations.
+    params.is_renderer_initiated = false;
+  }
+
+  params.blob_url_loader_factory = std::move(blob_url_loader_factory);
+  params.href_translate = href_translate;
+  params.impression = impression;
+
+  if (delegate_)
+    delegate_->OpenURL(params);
+}
+
+void Navigator::NavigateFromFrameProxy(
+    RenderFrameHostImpl* render_frame_host,
+    const GURL& url,
+    const GlobalFrameRoutingId& initiator_routing_id,
+    const url::Origin& initiator_origin,
+    SiteInstance* source_site_instance,
+    const Referrer& referrer,
+    ui::PageTransition page_transition,
+    bool should_replace_current_entry,
+    NavigationDownloadPolicy download_policy,
+    const std::string& method,
+    scoped_refptr<network::ResourceRequestBody> post_body,
+    const std::string& extra_headers,
+    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
+    bool has_user_gesture,
+    const base::Optional<Impression>& impression) {
+  // |method != "POST"| should imply absence of |post_body|.
+  if (method != "POST" && post_body) {
+    NOTREACHED();
+    post_body = nullptr;
+  }
+
+  // Allow the delegate to cancel the transfer.
+  if (!delegate_->ShouldTransferNavigation(
+          render_frame_host->frame_tree_node()->IsMainFrame()))
+    return;
+
+  // TODO(creis): Determine if this transfer started as a browser-initiated
+  // navigation.  See https://crbug.com/495161.
+  bool is_renderer_initiated = true;
+  Referrer referrer_to_use(referrer);
+  if (render_frame_host->web_ui()) {
+    // Note that we hide the referrer for Web UI pages. We don't really want
+    // web sites to see a referrer of "chrome://blah" (and some chrome: URLs
+    // might have search terms or other stuff we don't want to send to the
+    // site), so we send no referrer.
+    referrer_to_use = Referrer();
+
+    // Navigations in Web UI pages count as browser-initiated navigations.
+    is_renderer_initiated = false;
+  }
+
+  if (is_renderer_initiated &&
+      ShouldIgnoreIncomingRendererRequest(
+          render_frame_host->frame_tree_node()->navigation_request(),
+          has_user_gesture)) {
+    return;
+  }
+
+  controller_->NavigateFromFrameProxy(
+      render_frame_host, url, initiator_routing_id, initiator_origin,
+      is_renderer_initiated, source_site_instance, referrer_to_use,
+      page_transition, should_replace_current_entry, download_policy, method,
+      post_body, extra_headers, std::move(blob_url_loader_factory), impression);
 }
 
-base::TimeTicks Navigator::GetCurrentLoadStart() {
-  return base::TimeTicks::Now();
+void Navigator::BeforeUnloadCompleted(FrameTreeNode* frame_tree_node,
+                                      bool proceed,
+                                      const base::TimeTicks& proceed_time) {
+  DCHECK(frame_tree_node);
+
+  NavigationRequest* navigation_request = frame_tree_node->navigation_request();
+
+  // The NavigationRequest may have been canceled while the renderer was
+  // executing the BeforeUnload event.
+  if (!navigation_request)
+    return;
+
+  // If the user chose not to proceed, cancel the ongoing navigation.
+  // Note: it might be a new navigation, and not the one that triggered the
+  // sending of the BeforeUnload IPC in the first place. However, the
+  // BeforeUnload where the user asked not to proceed will have taken place
+  // after the navigation started. The last user input should be respected, and
+  // the navigation cancelled anyway.
+  if (!proceed) {
+    CancelNavigation(frame_tree_node);
+    return;
+  }
+
+  // The browser-initiated NavigationRequest that triggered the sending of the
+  // BeforeUnload IPC might have been replaced by a renderer-initiated one while
+  // the BeforeUnload event executed in the renderer. In that case, the request
+  // will already have begun, so there is no need to start it again.
+  if (navigation_request->state() >
+      NavigationRequest::WAITING_FOR_RENDERER_RESPONSE) {
+    DCHECK(navigation_request->from_begin_navigation());
+    return;
+  }
+
+  // Update the navigation start: it should be when it was determined that the
+  // navigation will proceed.
+  navigation_request->set_navigation_start_time(proceed_time);
+
+  DCHECK_EQ(NavigationRequest::WAITING_FOR_RENDERER_RESPONSE,
+            navigation_request->state());
+
+  // Send the request to the IO thread.
+  navigation_request->BeginNavigation();
+  // DO NOT USE |navigation_request| BEYOND THIS POINT. It might have been
+  // destroyed in BeginNavigation().
+  // See https://crbug.com/770157.
 }
 
 void Navigator::OnBeginNavigation(
@@ -37,6 +600,239 @@ void Navigator::OnBeginNavigation(
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     scoped_refptr<PrefetchedSignedExchangeCache>
         prefetched_signed_exchange_cache,
-    std::unique_ptr<WebBundleHandleTracker> web_bundle_handle_tracker) {}
+    std::unique_ptr<WebBundleHandleTracker> web_bundle_handle_tracker) {
+  // TODO(clamy): the url sent by the renderer should be validated with
+  // FilterURL.
+  // This is a renderer-initiated navigation.
+  DCHECK(frame_tree_node);
+
+  if (common_params->is_history_navigation_in_new_child_frame) {
+    // Try to find a FrameNavigationEntry that matches this frame instead, based
+    // on the frame's unique name.  If this can't be found, fall back to the
+    // default path below.
+    if (frame_tree_node->navigator()->StartHistoryNavigationInNewSubframe(
+            frame_tree_node->current_frame_host(), &navigation_client)) {
+      return;
+    }
+  }
+
+  NavigationRequest* ongoing_navigation_request =
+      frame_tree_node->navigation_request();
+
+  // Client redirects during the initial history navigation of a child frame
+  // should take precedence over the history navigation (despite being renderer-
+  // initiated).  See https://crbug.com/348447 and https://crbug.com/691168.
+  if (ongoing_navigation_request &&
+      ongoing_navigation_request->common_params()
+          .is_history_navigation_in_new_child_frame) {
+    // Preemptively clear this local pointer before deleting the request.
+    ongoing_navigation_request = nullptr;
+    frame_tree_node->ResetNavigationRequest(false);
+  }
+
+  // Verify this navigation has precedence.
+  if (ShouldIgnoreIncomingRendererRequest(ongoing_navigation_request,
+                                          common_params->has_user_gesture)) {
+    return;
+  }
+
+  NavigationEntryImpl* navigation_entry =
+      GetNavigationEntryForRendererInitiatedNavigation(*common_params,
+                                                       frame_tree_node);
+  const bool override_user_agent =
+      delegate_ &&
+      delegate_->ShouldOverrideUserAgentForRendererInitiatedNavigation();
+  frame_tree_node->CreatedNavigationRequest(
+      NavigationRequest::CreateRendererInitiated(
+          frame_tree_node, navigation_entry, std::move(common_params),
+          std::move(begin_params), controller_->GetLastCommittedEntryIndex(),
+          controller_->GetEntryCount(), override_user_agent,
+          std::move(blob_url_loader_factory), std::move(navigation_client),
+          std::move(navigation_initiator),
+          std::move(prefetched_signed_exchange_cache),
+          std::move(web_bundle_handle_tracker)));
+  NavigationRequest* navigation_request = frame_tree_node->navigation_request();
+
+  // This frame has already run beforeunload before it sent this IPC.  See if
+  // any of its cross-process subframes also need to run beforeunload.  If so,
+  // delay the navigation until beforeunload completion callbacks are invoked on
+  // those frames.
+  DCHECK(!NavigationTypeUtils::IsSameDocument(
+      navigation_request->common_params().navigation_type));
+  bool should_dispatch_beforeunload =
+      frame_tree_node->current_frame_host()->ShouldDispatchBeforeUnload(
+          true /* check_subframes_only */);
+  if (should_dispatch_beforeunload) {
+    frame_tree_node->navigation_request()->SetWaitingForRendererResponse();
+    frame_tree_node->current_frame_host()->DispatchBeforeUnload(
+        RenderFrameHostImpl::BeforeUnloadType::RENDERER_INITIATED_NAVIGATION,
+        NavigationTypeUtils::IsReload(
+            navigation_request->common_params().navigation_type));
+    return;
+  }
+
+  // For main frames, NavigationHandle will be created after the call to
+  // |DidStartMainFrameNavigation|, so it receives the most up to date pending
+  // entry from the NavigationController.
+  navigation_request->BeginNavigation();
+  // DO NOT USE |navigation_request| BEYOND THIS POINT. It might have been
+  // destroyed in BeginNavigation().
+  // See https://crbug.com/770157.
+}
+
+void Navigator::RestartNavigationAsCrossDocument(
+    std::unique_ptr<NavigationRequest> navigation_request) {
+  FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
+  // Don't restart the navigation if there is already another ongoing navigation
+  // in the FrameTreeNode.
+  if (frame_tree_node->navigation_request())
+    return;
+
+  navigation_request->ResetForCrossDocumentRestart();
+  frame_tree_node->CreatedNavigationRequest(std::move(navigation_request));
+  frame_tree_node->navigation_request()->BeginNavigation();
+  // DO NOT USE THE NAVIGATION REQUEST BEYOND THIS POINT. It might have been
+  // destroyed in BeginNavigation().
+  // See https://crbug.com/770157.
+}
+
+void Navigator::CancelNavigation(FrameTreeNode* frame_tree_node) {
+  if (frame_tree_node->navigation_request())
+    frame_tree_node->navigation_request()->set_net_error(net::ERR_ABORTED);
+  frame_tree_node->ResetNavigationRequest(false);
+  if (frame_tree_node->IsMainFrame())
+    navigation_data_.reset();
+}
+
+void Navigator::LogResourceRequestTime(base::TimeTicks timestamp,
+                                       const GURL& url) {
+  if (navigation_data_ && navigation_data_->url_ == url) {
+    navigation_data_->url_job_start_time_ = timestamp;
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToURLJobStart",
+        navigation_data_->url_job_start_time_ - navigation_data_->start_time_);
+  }
+}
+
+void Navigator::LogBeforeUnloadTime(
+    const base::TimeTicks& renderer_before_unload_start_time,
+    const base::TimeTicks& renderer_before_unload_end_time) {
+  // Only stores the beforeunload delay if we're tracking a browser initiated
+  // navigation and it happened later than the navigation request.
+  if (navigation_data_ &&
+      renderer_before_unload_start_time > navigation_data_->start_time_) {
+    navigation_data_->before_unload_delay_ =
+        renderer_before_unload_end_time - renderer_before_unload_start_time;
+  }
+}
+
+void Navigator::RecordNavigationMetrics(
+    const LoadCommittedDetails& details,
+    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+    SiteInstance* site_instance) {
+  DCHECK(site_instance->HasProcess());
+
+  if (!details.is_main_frame || !navigation_data_ ||
+      navigation_data_->url_job_start_time_.is_null() ||
+      navigation_data_->url_ != params.original_request_url) {
+    return;
+  }
+
+  base::TimeDelta time_to_commit =
+      base::TimeTicks::Now() - navigation_data_->start_time_;
+  UMA_HISTOGRAM_TIMES("Navigation.TimeToCommit", time_to_commit);
+
+  time_to_commit -= navigation_data_->before_unload_delay_;
+  base::TimeDelta time_to_network = navigation_data_->url_job_start_time_ -
+                                    navigation_data_->start_time_ -
+                                    navigation_data_->before_unload_delay_;
+  if (navigation_data_->is_restoring_from_last_session_) {
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToCommit_SessionRestored_BeforeUnloadDiscounted",
+        time_to_commit);
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToURLJobStart_SessionRestored_BeforeUnloadDiscounted",
+        time_to_network);
+    navigation_data_.reset();
+    return;
+  }
+  bool navigation_created_new_renderer_process =
+      site_instance->GetProcess()->GetInitTimeForNavigationMetrics() >
+      navigation_data_->start_time_;
+  if (navigation_created_new_renderer_process) {
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToCommit_NewRenderer_BeforeUnloadDiscounted",
+        time_to_commit);
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToURLJobStart_NewRenderer_BeforeUnloadDiscounted",
+        time_to_network);
+  } else {
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToCommit_ExistingRenderer_BeforeUnloadDiscounted",
+        time_to_commit);
+    UMA_HISTOGRAM_TIMES(
+        "Navigation.TimeToURLJobStart_ExistingRenderer_BeforeUnloadDiscounted",
+        time_to_network);
+  }
+  navigation_data_.reset();
+}
+
+NavigationEntryImpl*
+Navigator::GetNavigationEntryForRendererInitiatedNavigation(
+    const mojom::CommonNavigationParams& common_params,
+    FrameTreeNode* frame_tree_node) {
+  if (!frame_tree_node->IsMainFrame())
+    return nullptr;
+
+  // If there is no browser-initiated pending entry for this navigation and it
+  // is not for the error URL, create a pending entry and ensure the address bar
+  // updates accordingly.  We don't know the referrer or extra headers at this
+  // point, but the referrer will be set properly upon commit.  This does not
+  // set the SiteInstance for the pending entry, because it may change
+  // before the URL commits.
+  NavigationEntryImpl* pending_entry = controller_->GetPendingEntry();
+  bool has_browser_initiated_pending_entry =
+      pending_entry && !pending_entry->is_renderer_initiated();
+  if (has_browser_initiated_pending_entry)
+    return nullptr;
+
+  // A pending navigation entry is created in OnBeginNavigation(). The renderer
+  // sends a provisional load notification after that. We don't want to create
+  // a duplicate navigation entry here.
+  bool renderer_provisional_load_to_pending_url =
+      pending_entry && pending_entry->is_renderer_initiated() &&
+      (pending_entry->GetURL() == common_params.url);
+  if (renderer_provisional_load_to_pending_url)
+    return nullptr;
+
+  // If there is a transient entry, creating a new pending entry will result
+  // in deleting it, which leads to inconsistent state.
+  bool has_transient_entry = !!controller_->GetTransientEntry();
+  if (has_transient_entry)
+    return nullptr;
+
+  // Since GetNavigationEntryForRendererInitiatedNavigation is called from
+  // OnBeginNavigation, we can assume that no frame proxies are involved and
+  // therefore that |current_site_instance| is also the |source_site_instance|.
+  SiteInstance* current_site_instance =
+      frame_tree_node->current_frame_host()->GetSiteInstance();
+  SiteInstance* source_site_instance = current_site_instance;
+
+  std::unique_ptr<NavigationEntryImpl> entry =
+      NavigationEntryImpl::FromNavigationEntry(
+          NavigationControllerImpl::CreateNavigationEntry(
+              common_params.url, content::Referrer(),
+              common_params.initiator_origin, source_site_instance,
+              ui::PAGE_TRANSITION_LINK, true /* is_renderer_initiated */,
+              std::string() /* extra_headers */,
+              controller_->GetBrowserContext(),
+              nullptr /* blob_url_loader_factory */));
+
+  controller_->SetPendingEntry(std::move(entry));
+  if (delegate_)
+    delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);
+
+  return controller_->GetPendingEntry();
+}
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator.h b/chromium/content/browser/frame_host/navigator.h
index 6b2a90ea274..19ce4447f95 100644
--- a/chromium/content/browser/frame_host/navigator.h
+++ b/chromium/content/browser/frame_host/navigator.h
@@ -5,17 +5,21 @@
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_H_
 
+#include <memory>
+
+#include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/time/time.h"
-#include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/navigator_delegate.h"
 #include "content/common/content_export.h"
-#include "content/common/frame_messages.h"
+#include "content/common/navigation_client.mojom.h"
+#include "content/common/navigation_params.h"
 #include "content/common/navigation_params.mojom.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/common/impression.h"
+#include "content/public/common/previews_state.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
+#include "third_party/blink/public/mojom/frame/navigation_initiator.mojom.h"
 #include "ui/base/window_open_disposition.h"
 
 class GURL;
@@ -33,31 +37,58 @@ namespace content {
 
 class FrameNavigationEntry;
 class FrameTreeNode;
+class NavigationControllerImpl;
+class NavigatorDelegate;
+class NavigationEntryImpl;
+class NavigationRequest;
 class PrefetchedSignedExchangeCache;
 class RenderFrameHostImpl;
 class WebBundleHandleTracker;
+struct LoadCommittedDetails;
 
-// Implementations of this interface are responsible for performing navigations
-// in a node of the FrameTree. Its lifetime is bound to all FrameTreeNode
-// objects that are using it and will be released once all nodes that use it are
-// freed. The Navigator is bound to a single frame tree and cannot be used by
-// multiple instances of FrameTree.
+// Navigator is responsible for performing navigations in a node of the
+// FrameTree. Its lifetime is bound to all FrameTreeNode objects that are using
+// it and will be released once all nodes that use it are freed. The Navigator
+// is bound to a single frame tree and cannot be used by multiple instances of
+// FrameTree.
 // TODO(nasko): Move all navigation methods, such as didStartProvisionalLoad
 // from WebContentsImpl to this interface.
 class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
  public:
+  Navigator(NavigationControllerImpl* navigation_controller,
+            NavigatorDelegate* delegate);
+
+  // This method verifies that a navigation to |url| doesn't commit into a WebUI
+  // process if it is not allowed to. Callers of this method should take one of
+  // two actions if the method returns false:
+  // * When called from browser process logic (e.g. NavigationRequest), this
+  //   indicates issues with the navigation logic and the browser process must
+  //   be terminated to avoid security issues.
+  // * If the codepath is processing an IPC message from a renderer process,
+  //   then the renderer process is misbehaving and must be terminated.
+  // TODO(nasko): Remove the is_renderer_initiated_check parameter when callers
+  // of this method are migrated to use CHECK instead of DumpWithoutCrashing.
+  static WARN_UNUSED_RESULT bool CheckWebUIRendererDoesNotDisplayNormalURL(
+      RenderFrameHostImpl* render_frame_host,
+      const GURL& url,
+      bool is_renderer_initiated_check);
+
+  static bool ShouldIgnoreIncomingRendererRequest(
+      const NavigationRequest* ongoing_navigation_request,
+      bool has_user_gesture);
+
   // Returns the delegate of this Navigator.
-  virtual NavigatorDelegate* GetDelegate();
+  NavigatorDelegate* GetDelegate();
 
   // Returns the NavigationController associated with this Navigator.
-  virtual NavigationController* GetController();
+  NavigationController* GetController();
 
   // Notifications coming from the RenderFrameHosts ----------------------------
 
   // The RenderFrameHostImpl has failed to load the document.
-  virtual void DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
-                                    const GURL& url,
-                                    int error_code) {}
+  void DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
+                            const GURL& url,
+                            int error_code);
 
   // The RenderFrameHostImpl has committed a navigation. The Navigator is
   // responsible for resetting |navigation_request| at the end of this method
@@ -67,17 +98,16 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
   // same-page navigation commits while another navigation is ongoing. The
   // Navigator should use the NavigationRequest provided by this method and not
   // attempt to access the RenderFrameHost's NavigationsRequests.
-  virtual void DidNavigate(
-      RenderFrameHostImpl* render_frame_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      std::unique_ptr<NavigationRequest> navigation_request,
-      bool was_within_same_document) {}
+  void DidNavigate(RenderFrameHostImpl* render_frame_host,
+                   const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+                   std::unique_ptr<NavigationRequest> navigation_request,
+                   bool was_within_same_document);
 
   // Called on a newly created subframe during a history navigation. The browser
   // process looks up the corresponding FrameNavigationEntry for the new frame
   // navigates it in the correct process. Returns false if the
   // FrameNavigationEntry can't be found or the navigation fails.
-  virtual bool StartHistoryNavigationInNewSubframe(
+  bool StartHistoryNavigationInNewSubframe(
       RenderFrameHostImpl* render_frame_host,
       mojo::PendingAssociatedRemote<mojom::NavigationClient>*
           navigation_client);
@@ -88,17 +118,16 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
   // |navigation_request|. The NavigationController should be called back with
   // RendererDidNavigate on success or DiscardPendingEntry on failure. The
   // callbacks should be called in a future iteration of the message loop.
-  virtual void Navigate(std::unique_ptr<NavigationRequest> request,
-                        ReloadType reload_type,
-                        RestoreType restore_type) {}
-
-  virtual base::TimeTicks GetCurrentLoadStart();
+  void Navigate(std::unique_ptr<NavigationRequest> request,
+                ReloadType reload_type,
+                RestoreType restore_type);
 
   // The RenderFrameHostImpl has received a request to open a URL with the
   // specified |disposition|.
-  virtual void RequestOpenURL(
+  void RequestOpenURL(
       RenderFrameHostImpl* render_frame_host,
       const GURL& url,
+      const GlobalFrameRoutingId& initiator_routing_id,
       const base::Optional<url::Origin>& initiator_origin,
       const scoped_refptr<network::ResourceRequestBody>& post_body,
       const std::string& extra_headers,
@@ -108,14 +137,16 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       bool user_gesture,
       blink::TriggeringEventInfo triggering_event_info,
       const std::string& href_translate,
-      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {}
+      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
+      const base::Optional<Impression>& impression);
 
   // Called when a document requests a navigation in another document through a
   // RenderFrameProxy. If |method| is "POST", then |post_body| needs to specify
   // the request body, otherwise |post_body| should be null.
-  virtual void NavigateFromFrameProxy(
+  void NavigateFromFrameProxy(
       RenderFrameHostImpl* render_frame_host,
       const GURL& url,
+      const GlobalFrameRoutingId& initiator_routing_id,
       const url::Origin& initiator_origin,
       SiteInstance* source_site_instance,
       const Referrer& referrer,
@@ -126,19 +157,20 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       scoped_refptr<network::ResourceRequestBody> post_body,
       const std::string& extra_headers,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      bool has_user_gesture) {}
+      bool has_user_gesture,
+      const base::Optional<Impression>& impression);
 
   // Called after BeforeUnloadCompleted callback is invoked from the renderer.
   // If |frame_tree_node| has a NavigationRequest waiting for the renderer
   // response, then the request is either started or canceled, depending on the
   // value of |proceed|.
-  virtual void BeforeUnloadCompleted(FrameTreeNode* frame_tree_node,
-                                     bool proceed,
-                                     const base::TimeTicks& proceed_time) {}
+  void BeforeUnloadCompleted(FrameTreeNode* frame_tree_node,
+                             bool proceed,
+                             const base::TimeTicks& proceed_time);
 
   // Used to start a new renderer-initiated navigation, following a
   // BeginNavigation IPC from the renderer.
-  virtual void OnBeginNavigation(
+  void OnBeginNavigation(
       FrameTreeNode* frame_tree_node,
       mojom::CommonNavigationParamsPtr common_params,
       mojom::BeginNavigationParamsPtr begin_params,
@@ -152,29 +184,59 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
 
   // Used to restart a navigation that was thought to be same-document in
   // cross-document mode.
-  virtual void RestartNavigationAsCrossDocument(
-      std::unique_ptr<NavigationRequest> navigation_request) {}
+  void RestartNavigationAsCrossDocument(
+      std::unique_ptr<NavigationRequest> navigation_request);
 
   // Cancel a NavigationRequest for |frame_tree_node|.
-  virtual void CancelNavigation(FrameTreeNode* frame_tree_node) {}
+  void CancelNavigation(FrameTreeNode* frame_tree_node);
 
   // Called when the network stack started handling the navigation request
   // so that the |timestamp| when it happened can be recorded into an histogram.
   // The |url| is used to verify we're tracking the correct navigation.
   // TODO(carlosk): Remove the URL parameter and rename this method to better
   // suit naming conventions.
-  virtual void LogResourceRequestTime(base::TimeTicks timestamp,
-                                      const GURL& url) {}
+  void LogResourceRequestTime(base::TimeTicks timestamp, const GURL& url);
 
   // Called to record the time it took to execute the before unload hook for the
   // current navigation.
-  virtual void LogBeforeUnloadTime(
+  void LogBeforeUnloadTime(
       const base::TimeTicks& renderer_before_unload_start_time,
-      const base::TimeTicks& renderer_before_unload_end_time) {}
+      const base::TimeTicks& renderer_before_unload_end_time);
 
- protected:
+ private:
   friend class base::RefCounted<Navigator>;
-  virtual ~Navigator() {}
+  friend class NavigatorTestWithBrowserSideNavigation;
+
+  // Holds data used to track browser side navigation metrics.
+  struct NavigationMetricsData;
+
+  ~Navigator();
+
+  void RecordNavigationMetrics(
+      const LoadCommittedDetails& details,
+      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+      SiteInstance* site_instance);
+
+  // Called when a renderer initiated navigation has started. Returns the
+  // pending NavigationEntry to be used. Either null or a new one owned
+  // NavigationController.
+  NavigationEntryImpl* GetNavigationEntryForRendererInitiatedNavigation(
+      const mojom::CommonNavigationParams& common_params,
+      FrameTreeNode* frame_tree_node);
+
+  // The NavigationController that will keep track of session history for all
+  // RenderFrameHost objects using this Navigator.
+  // TODO(nasko): Move ownership of the NavigationController from
+  // WebContentsImpl to this class.
+  NavigationControllerImpl* controller_;
+
+  // Used to notify the object embedding this Navigator about navigation
+  // events. Can be nullptr in tests.
+  NavigatorDelegate* delegate_;
+
+  std::unique_ptr<Navigator::NavigationMetricsData> navigation_data_;
+
+  DISALLOW_COPY_AND_ASSIGN(Navigator);
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator_delegate.cc b/chromium/content/browser/frame_host/navigator_delegate.cc
deleted file mode 100644
index 143f5041900..00000000000
--- a/chromium/content/browser/frame_host/navigator_delegate.cc
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/navigator_delegate.h"
-
-namespace content {
-
-bool NavigatorDelegate::CanOverscrollContent() const {
-  return false;
-}
-
-bool NavigatorDelegate::ShouldOverrideUserAgentInNewTabs() {
-  return false;
-}
-
-bool NavigatorDelegate::ShouldTransferNavigation(
-    bool is_main_frame_navigation) {
-  return true;
-}
-
-std::vector<std::unique_ptr<NavigationThrottle>>
-NavigatorDelegate::CreateThrottlesForNavigation(
-    NavigationHandle* navigation_handle) {
-  return std::vector<std::unique_ptr<NavigationThrottle>>();
-}
-
-std::unique_ptr<NavigationUIData> NavigatorDelegate::GetNavigationUIData(
-    NavigationHandle* navigation_handle) {
-  return nullptr;
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator_delegate.h b/chromium/content/browser/frame_host/navigator_delegate.h
index f036fe2dbb1..6ee41979d7d 100644
--- a/chromium/content/browser/frame_host/navigator_delegate.h
+++ b/chromium/content/browser/frame_host/navigator_delegate.h
@@ -5,14 +5,13 @@
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_DELEGATE_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_DELEGATE_H_
 
-#include "base/strings/string16.h"
+#include "content/public/browser/allow_service_worker_result.h"
+#include "content/public/browser/cookie_access_details.h"
 #include "content/public/browser/invalidate_type.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/browser/reload_type.h"
-#include "ui/base/page_transition_types.h"
-#include "ui/base/window_open_disposition.h"
 
 class GURL;
 struct FrameHostMsg_DidCommitProvisionalLoad_Params;
@@ -25,6 +24,7 @@ namespace content {
 
 class FrameTreeNode;
 class NavigationHandle;
+class NavigationRequest;
 class RenderFrameHostImpl;
 struct LoadCommittedDetails;
 struct OpenURLParams;
@@ -35,18 +35,18 @@ class CONTENT_EXPORT NavigatorDelegate {
  public:
   // Called when a navigation started. The same NavigationHandle will be
   // provided for events related to the same navigation.
-  virtual void DidStartNavigation(NavigationHandle* navigation_handle) {}
+  virtual void DidStartNavigation(NavigationHandle* navigation_handle) = 0;
 
   // Called when a navigation was redirected.
-  virtual void DidRedirectNavigation(NavigationHandle* navigation_handle) {}
+  virtual void DidRedirectNavigation(NavigationHandle* navigation_handle) = 0;
 
   // Called when the navigation is about to be committed in a renderer.
-  virtual void ReadyToCommitNavigation(NavigationHandle* navigation_handle) {}
+  virtual void ReadyToCommitNavigation(NavigationHandle* navigation_handle) = 0;
 
   // Called when the navigation finished: it was either committed or canceled
   // before commit.  Note that |navigation_handle| will be destroyed at the end
   // of this call.
-  virtual void DidFinishNavigation(NavigationHandle* navigation_handle) {}
+  virtual void DidFinishNavigation(NavigationHandle* navigation_handle) = 0;
 
   // TODO(clamy): all methods below that are related to navigation
   // events should go away in favor of the ones above.
@@ -54,11 +54,12 @@ class CONTENT_EXPORT NavigatorDelegate {
   // Document load in |render_frame_host| failed.
   virtual void DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
                                     const GURL& url,
-                                    int error_code) {}
+                                    int error_code) = 0;
 
   // Handles post-navigation tasks in navigation BEFORE the entry has been
   // committed to the NavigationController.
-  virtual void DidNavigateMainFramePreCommit(bool navigation_is_within_page) {}
+  virtual void DidNavigateMainFramePreCommit(
+      bool navigation_is_within_page) = 0;
 
   // Handles post-navigation tasks in navigation AFTER the entry has been
   // committed to the NavigationController. Note that the NavigationEntry is
@@ -67,24 +68,19 @@ class CONTENT_EXPORT NavigatorDelegate {
   virtual void DidNavigateMainFramePostCommit(
       RenderFrameHostImpl* render_frame_host,
       const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {}
+      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) = 0;
   virtual void DidNavigateAnyFramePostCommit(
       RenderFrameHostImpl* render_frame_host,
       const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) {}
+      const FrameHostMsg_DidCommitProvisionalLoad_Params& params) = 0;
 
-  virtual void SetMainFrameMimeType(const std::string& mime_type) {}
-  virtual bool CanOverscrollContent() const;
+  virtual void SetMainFrameMimeType(const std::string& mime_type) = 0;
+  virtual bool CanOverscrollContent() const = 0;
 
   // Notification to the Navigator embedder that navigation state has
   // changed. This method corresponds to
   // WebContents::NotifyNavigationStateChanged.
-  virtual void NotifyChangedNavigationState(InvalidateTypes changed_flags) {}
-
-  // Notifies the Navigator embedder that a navigation to the pending
-  // NavigationEntry has started in the browser process.
-  virtual void DidStartNavigationToPendingEntry(const GURL& url,
-                                                ReloadType reload_type) {}
+  virtual void NotifyChangedNavigationState(InvalidateTypes changed_flags) = 0;
 
   // Opens a URL with the given parameters. See PageNavigator::OpenURL, which
   // this is an alias of.
@@ -92,41 +88,61 @@ class CONTENT_EXPORT NavigatorDelegate {
 
   // Returns whether to continue a navigation that needs to transfer to a
   // different process between the load start and commit.
-  virtual bool ShouldTransferNavigation(bool is_main_frame_navigation);
+  virtual bool ShouldTransferNavigation(bool is_main_frame_navigation) = 0;
 
   // Returns the overridden user agent string if it's set.
   virtual const blink::UserAgentOverride& GetUserAgentOverride() = 0;
 
-  // Returns whether we should override the user agent in new tabs, e.g., for
-  // Android Webview's popup window when current entry.
-  virtual bool ShouldOverrideUserAgentInNewTabs() = 0;
+  // Returns the value to use for NavigationEntry::IsOverridingUserAgent() for
+  // a renderer initiated navigation.
+  virtual bool ShouldOverrideUserAgentForRendererInitiatedNavigation() = 0;
 
   // A RenderFrameHost in the specified |frame_tree_node| started loading a new
   // document. This correponds to Blink's notion of the throbber starting.
   // |to_different_document| will be true unless the load is a fragment
   // navigation, or triggered by history.pushState/replaceState.
   virtual void DidStartLoading(FrameTreeNode* frame_tree_node,
-                               bool to_different_document) {}
+                               bool to_different_document) = 0;
 
   // A document stopped loading. This corresponds to Blink's notion of the
   // throbber stopping.
-  virtual void DidStopLoading() {}
+  virtual void DidStopLoading() = 0;
 
   // The load progress was changed.
-  virtual void DidChangeLoadProgress() {}
+  virtual void DidChangeLoadProgress() = 0;
 
   // Returns the NavigationThrottles to add to this navigation. Normally these
   // are defined by the content/ embedder, except in the case of interstitials
   // where no NavigationThrottles are added to the navigation.
   virtual std::vector<std::unique_ptr<NavigationThrottle>>
-  CreateThrottlesForNavigation(NavigationHandle* navigation_handle);
+  CreateThrottlesForNavigation(NavigationHandle* navigation_handle) = 0;
 
   // Called at the start of the navigation to get opaque data the embedder
   // wants to see passed to the corresponding URLRequest on the IO thread.
   // In the case of a navigation to an interstitial, no call will be made to the
   // embedder and |nullptr| is returned.
   virtual std::unique_ptr<NavigationUIData> GetNavigationUIData(
-      NavigationHandle* navigation_handle);
+      NavigationHandle* navigation_handle) = 0;
+
+  // Called when a navigation accessed ServiceWorker to check if it should be
+  // handled by the ServiceWorker or not.
+  virtual void OnServiceWorkerAccessed(NavigationHandle* navigation,
+                                       const GURL& scope,
+                                       AllowServiceWorkerResult allowed) = 0;
+
+  // Called when a network request issued by this navigation set or read a
+  // cookie.
+  virtual void OnCookiesAccessed(NavigationHandle* navigation,
+                                 const CookieAccessDetails& details) = 0;
+
+  // Does a global walk of the session history and all committed/pending-commit
+  // origins, and registers origins that match |origin| to their respective
+  // BrowsingInstances. |navigation_request_to_exclude| allows the
+  // NavigationRequest that initiates this process to avoid marking itself as
+  // non-opted-in before it gets the chance to opt-in.
+  virtual void RegisterExistingOriginToPreventOptInIsolation(
+      const url::Origin& origin,
+      NavigationRequest* navigation_request_to_exclude) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator_impl.cc b/chromium/content/browser/frame_host/navigator_impl.cc
deleted file mode 100644
index 32e9963bc22..00000000000
--- a/chromium/content/browser/frame_host/navigator_impl.cc
+++ /dev/null
@@ -1,783 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/navigator_impl.h"
-
-#include <utility>
-
-#include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/strings/string_util.h"
-#include "base/time/time.h"
-#include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/debug_urls.h"
-#include "content/browser/frame_host/frame_tree.h"
-#include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/navigation_request_info.h"
-#include "content/browser/frame_host/navigator_delegate.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
-#include "content/browser/site_instance_impl.h"
-#include "content/browser/web_package/prefetched_signed_exchange_cache.h"
-#include "content/browser/web_package/web_bundle_handle_tracker.h"
-#include "content/browser/webui/web_ui_controller_factory_registry.h"
-#include "content/browser/webui/web_ui_impl.h"
-#include "content/common/frame_messages.h"
-#include "content/common/navigation_params.h"
-#include "content/common/navigation_params_utils.h"
-#include "content/common/page_messages.h"
-#include "content/common/view_messages.h"
-#include "content/public/browser/browser_context.h"
-#include "content/public/browser/content_browser_client.h"
-#include "content/public/browser/global_request_id.h"
-#include "content/public/browser/invalidate_type.h"
-#include "content/public/browser/navigation_controller.h"
-#include "content/public/browser/navigation_details.h"
-#include "content/public/browser/page_navigator.h"
-#include "content/public/browser/render_view_host.h"
-#include "content/public/common/bindings_policy.h"
-#include "content/public/common/content_client.h"
-#include "content/public/common/content_constants.h"
-#include "content/public/common/navigation_policy.h"
-#include "content/public/common/url_utils.h"
-#include "net/base/net_errors.h"
-#include "services/network/public/mojom/url_loader_factory.mojom.h"
-#include "url/gurl.h"
-#include "url/url_util.h"
-
-namespace content {
-
-struct NavigatorImpl::NavigationMetricsData {
-  NavigationMetricsData(base::TimeTicks start_time,
-                        GURL url,
-                        RestoreType restore_type)
-      : start_time_(start_time), url_(url) {
-    is_restoring_from_last_session_ =
-        (restore_type == RestoreType::LAST_SESSION_EXITED_CLEANLY ||
-         restore_type == RestoreType::LAST_SESSION_CRASHED);
-  }
-
-  base::TimeTicks start_time_;
-  GURL url_;
-  bool is_restoring_from_last_session_;
-  base::TimeTicks url_job_start_time_;
-  base::TimeDelta before_unload_delay_;
-};
-
-NavigatorImpl::NavigatorImpl(NavigationControllerImpl* navigation_controller,
-                             NavigatorDelegate* delegate)
-    : controller_(navigation_controller), delegate_(delegate) {}
-
-NavigatorImpl::~NavigatorImpl() {}
-
-// static
-void NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
-    RenderFrameHostImpl* render_frame_host,
-    const GURL& url) {
-  int enabled_bindings = render_frame_host->GetEnabledBindings();
-  bool is_allowed_in_web_ui_renderer =
-      WebUIControllerFactoryRegistry::GetInstance()->IsURLAcceptableForWebUI(
-          render_frame_host->frame_tree_node()
-              ->navigator()
-              ->GetController()
-              ->GetBrowserContext(),
-          url);
-  if ((enabled_bindings & kWebUIBindingsPolicyMask) &&
-      !is_allowed_in_web_ui_renderer) {
-    // Log the URL to help us diagnose any future failures of this CHECK.
-    FrameTreeNode* root_node =
-        render_frame_host->frame_tree_node()->frame_tree()->root();
-    GetContentClient()->SetActiveURL(
-        url, root_node->current_url().possibly_invalid_spec());
-    CHECK(0);
-  }
-}
-
-// A renderer-initiated navigation should be ignored iff a) there is an ongoing
-// request b) which is browser initiated and c) the renderer request is not
-// user-initiated.
-// static
-bool NavigatorImpl::ShouldIgnoreIncomingRendererRequest(
-    const NavigationRequest* ongoing_navigation_request,
-    bool has_user_gesture) {
-  return ongoing_navigation_request &&
-         ongoing_navigation_request->browser_initiated() && !has_user_gesture;
-}
-
-NavigatorDelegate* NavigatorImpl::GetDelegate() {
-  return delegate_;
-}
-
-NavigationController* NavigatorImpl::GetController() {
-  return controller_;
-}
-
-void NavigatorImpl::DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
-                                         const GURL& url,
-                                         int error_code) {
-  if (delegate_) {
-    delegate_->DidFailLoadWithError(render_frame_host, url, error_code);
-  }
-}
-
-bool NavigatorImpl::StartHistoryNavigationInNewSubframe(
-    RenderFrameHostImpl* render_frame_host,
-    mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client) {
-  return controller_->StartHistoryNavigationInNewSubframe(render_frame_host,
-                                                          navigation_client);
-}
-
-void NavigatorImpl::DidNavigate(
-    RenderFrameHostImpl* render_frame_host,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-    std::unique_ptr<NavigationRequest> navigation_request,
-    bool was_within_same_document) {
-  DCHECK(navigation_request);
-  FrameTreeNode* frame_tree_node = render_frame_host->frame_tree_node();
-  FrameTree* frame_tree = frame_tree_node->frame_tree();
-
-  bool is_same_document_navigation = controller_->IsURLSameDocumentNavigation(
-      params.url, params.origin, was_within_same_document, render_frame_host);
-
-  // If a frame claims the navigation was same-document, it must be the current
-  // frame, not a pending one.
-  if (is_same_document_navigation &&
-      render_frame_host !=
-          frame_tree_node->render_manager()->current_frame_host()) {
-    bad_message::ReceivedBadMessage(render_frame_host->GetProcess(),
-                                    bad_message::NI_IN_PAGE_NAVIGATION);
-    is_same_document_navigation = false;
-  }
-
-  if (ui::PageTransitionIsMainFrame(params.transition)) {
-    if (delegate_) {
-      // Run tasks that must execute just before the commit.
-      delegate_->DidNavigateMainFramePreCommit(is_same_document_navigation);
-    }
-  }
-
-  // For browser initiated navigation and same document navigation, frame policy
-  // in commit_params is nullopt and should use fallback value instead.
-  const blink::FramePolicy pending_frame_policy =
-      navigation_request->commit_params().frame_policy.value_or(
-          frame_tree_node->pending_frame_policy());
-
-  // DidNavigateFrame() must be called before replicating the new origin and
-  // other properties to proxies.  This is because it destroys the subframes of
-  // the frame we're navigating from, which might trigger those subframes to
-  // run unload handlers.  Those unload handlers should still see the old
-  // frame's origin.  See https://crbug.com/825283.
-  frame_tree_node->render_manager()->DidNavigateFrame(
-      render_frame_host, params.gesture == NavigationGestureUser,
-      is_same_document_navigation,
-      navigation_request
-          ->require_coop_browsing_instance_swap() /* clear_proxies_on_commit */,
-      pending_frame_policy);
-
-  // Save the new page's origin and other properties, and replicate them to
-  // proxies, including the proxy created in DidNavigateFrame() to replace the
-  // old frame in cross-process navigation cases.
-  frame_tree_node->SetCurrentOrigin(
-      params.origin, params.has_potentially_trustworthy_unique_origin);
-  frame_tree_node->SetInsecureRequestPolicy(params.insecure_request_policy);
-  frame_tree_node->SetInsecureNavigationsSet(params.insecure_navigations_set);
-
-  // Save the activation status of the previous page here before it gets reset
-  // in FrameTreeNode::ResetForNavigation.
-  bool previous_document_was_activated =
-      frame_tree->root()->HasStickyUserActivation();
-
-  if (!is_same_document_navigation) {
-    // Navigating to a new location means a new, fresh set of http headers
-    // and/or <meta> elements - we need to reset CSP and Feature Policy.
-    render_frame_host->ResetContentSecurityPolicies();
-    frame_tree_node->ResetForNavigation();
-
-    // Save the new page's embedding token and propagate to any frames that
-    // embed it.
-    // - A token will have a value if it is a cross-origin frame.
-    // - An empty token will occur for;
-    //   - main frames
-    //   - a previously out-of-process frame that navigated to be same-process
-    //     as its parent
-    frame_tree_node->SetEmbeddingToken(params.embedding_token);
-  }
-
-  // Update the site of the SiteInstance if it doesn't have one yet, unless
-  // assigning a site is not necessary for this URL. In that case, the
-  // SiteInstance can still be considered unused until a navigation to a real
-  // page.
-  SiteInstanceImpl* site_instance = render_frame_host->GetSiteInstance();
-  if (!site_instance->HasSite() &&
-      SiteInstanceImpl::ShouldAssignSiteForURL(params.url)) {
-    site_instance->ConvertToDefaultOrSetSite(params.url);
-  }
-
-  // Need to update MIME type here because it's referred to in
-  // UpdateNavigationCommands() called by RendererDidNavigate() to
-  // determine whether or not to enable the encoding menu.
-  // It's updated only for the main frame. For a subframe,
-  // RenderView::UpdateURL does not set params.contents_mime_type.
-  // (see http://code.google.com/p/chromium/issues/detail?id=2929 )
-  // TODO(jungshik): Add a test for the encoding menu to avoid
-  // regressing it again.
-  // TODO(nasko): Verify the correctness of the above comment, since some of the
-  // code doesn't exist anymore. Also, move this code in the
-  // PageTransitionIsMainFrame code block above.
-  if (ui::PageTransitionIsMainFrame(params.transition) && delegate_)
-    delegate_->SetMainFrameMimeType(params.contents_mime_type);
-
-  int old_entry_count = controller_->GetEntryCount();
-  LoadCommittedDetails details;
-  bool did_navigate = controller_->RendererDidNavigate(
-      render_frame_host, params, &details, is_same_document_navigation,
-      previous_document_was_activated, navigation_request.get());
-
-  // If the history length and/or offset changed, update other renderers in the
-  // FrameTree.
-  if (old_entry_count != controller_->GetEntryCount() ||
-      details.previous_entry_index !=
-          controller_->GetLastCommittedEntryIndex()) {
-    frame_tree->root()->render_manager()->SendPageMessage(
-        new PageMsg_SetHistoryOffsetAndLength(
-            MSG_ROUTING_NONE, controller_->GetLastCommittedEntryIndex(),
-            controller_->GetEntryCount()),
-        site_instance);
-  }
-
-  render_frame_host->DidNavigate(params, is_same_document_navigation);
-
-  // Send notification about committed provisional loads. This notification is
-  // different from the NAV_ENTRY_COMMITTED notification which doesn't include
-  // the actual URL navigated to and isn't sent for AUTO_SUBFRAME navigations.
-  if (details.type != NAVIGATION_TYPE_NAV_IGNORE && delegate_) {
-    DCHECK_EQ(!render_frame_host->GetParent(),
-              did_navigate ? details.is_main_frame : false);
-    navigation_request->DidCommitNavigation(params, did_navigate,
-                                            details.did_replace_entry,
-                                            details.previous_url, details.type);
-    navigation_request.reset();
-  }
-
-  if (!did_navigate)
-    return;  // No navigation happened.
-
-  // DO NOT ADD MORE STUFF TO THIS FUNCTION! Your component should either listen
-  // for the appropriate notification (best) or you can add it to
-  // DidNavigateMainFramePostCommit / DidNavigateAnyFramePostCommit (only if
-  // necessary, please).
-
-  // TODO(carlosk): Move this out.
-  RecordNavigationMetrics(details, params, site_instance);
-
-  // Run post-commit tasks.
-  if (delegate_) {
-    if (details.is_main_frame) {
-      delegate_->DidNavigateMainFramePostCommit(render_frame_host, details,
-                                                params);
-    }
-
-    delegate_->DidNavigateAnyFramePostCommit(render_frame_host, details,
-                                             params);
-  }
-}
-
-void NavigatorImpl::Navigate(std::unique_ptr<NavigationRequest> request,
-                             ReloadType reload_type,
-                             RestoreType restore_type) {
-  TRACE_EVENT0("browser,navigation", "NavigatorImpl::Navigate");
-  TRACE_EVENT_INSTANT_WITH_TIMESTAMP0(
-      "navigation,rail", "NavigationTiming navigationStart",
-      TRACE_EVENT_SCOPE_GLOBAL, request->common_params().navigation_start);
-
-  // Save destination url, as it is needed for
-  // DidStartNavigationToPendingEntry and request could be destroyed after
-  // BeginNavigation below.
-  GURL dest_url = request->common_params().url;
-  FrameTreeNode* frame_tree_node = request->frame_tree_node();
-
-  navigation_data_.reset(new NavigationMetricsData(
-      request->common_params().navigation_start, dest_url, restore_type));
-
-  // Check if the BeforeUnload event needs to execute before assigning the
-  // NavigationRequest to the FrameTreeNode. Assigning it to the FrameTreeNode
-  // has the side effect of initializing the current RenderFrameHost, which will
-  // return that it should execute the BeforeUnload event (even though we don't
-  // need to wait for it in the case of a brand new RenderFrameHost).
-  //
-  // We don't want to dispatch a beforeunload handler if
-  // is_history_navigation_in_new_child is true. This indicates a newly created
-  // child frame which does not have a beforeunload handler.
-  bool should_dispatch_beforeunload =
-      !NavigationTypeUtils::IsSameDocument(
-          request->common_params().navigation_type) &&
-      !request->common_params().is_history_navigation_in_new_child_frame &&
-      frame_tree_node->current_frame_host()->ShouldDispatchBeforeUnload(
-          false /* check_subframes_only */);
-
-  int nav_entry_id = request->nav_entry_id();
-  bool is_pending_entry =
-      controller_->GetPendingEntry() &&
-      (nav_entry_id == controller_->GetPendingEntry()->GetUniqueID());
-  frame_tree_node->CreatedNavigationRequest(std::move(request));
-  DCHECK(frame_tree_node->navigation_request());
-
-  // Have the current renderer execute its beforeunload event if needed. If it
-  // is not needed then NavigationRequest::BeginNavigation should be directly
-  // called instead.
-  if (should_dispatch_beforeunload) {
-    frame_tree_node->navigation_request()->SetWaitingForRendererResponse();
-    frame_tree_node->current_frame_host()->DispatchBeforeUnload(
-        RenderFrameHostImpl::BeforeUnloadType::BROWSER_INITIATED_NAVIGATION,
-        reload_type != ReloadType::NONE);
-  } else {
-    frame_tree_node->navigation_request()->BeginNavigation();
-    // WARNING: The NavigationRequest might have been destroyed in
-    // BeginNavigation(). Do not use |frame_tree_node->navigation_request()|
-    // after this point without null checking it first.
-  }
-
-  // Make sure no code called via RFH::Navigate clears the pending entry.
-  if (is_pending_entry)
-    CHECK_EQ(nav_entry_id, controller_->GetPendingEntry()->GetUniqueID());
-
-  // Notify observers about navigation.
-  if (delegate_ && is_pending_entry)
-    delegate_->DidStartNavigationToPendingEntry(dest_url, reload_type);
-}
-
-void NavigatorImpl::RequestOpenURL(
-    RenderFrameHostImpl* render_frame_host,
-    const GURL& url,
-    const base::Optional<url::Origin>& initiator_origin,
-    const scoped_refptr<network::ResourceRequestBody>& post_body,
-    const std::string& extra_headers,
-    const Referrer& referrer,
-    WindowOpenDisposition disposition,
-    bool should_replace_current_entry,
-    bool user_gesture,
-    blink::TriggeringEventInfo triggering_event_info,
-    const std::string& href_translate,
-    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {
-  // Note: This can be called for subframes (even when OOPIFs are not possible)
-  // if the disposition calls for a different window.
-
-  // Only the current RenderFrameHost should be sending an OpenURL request.
-  // Pending RenderFrameHost should know where it is navigating and pending
-  // deletion RenderFrameHost shouldn't be trying to navigate.
-  if (render_frame_host !=
-      render_frame_host->frame_tree_node()->current_frame_host()) {
-    return;
-  }
-
-  SiteInstance* current_site_instance = render_frame_host->GetSiteInstance();
-
-  // TODO(creis): Pass the redirect_chain into this method to support client
-  // redirects.  http://crbug.com/311721.
-  std::vector<GURL> redirect_chain;
-
-  int frame_tree_node_id = -1;
-
-  // Send the navigation to the current FrameTreeNode if it's destined for a
-  // subframe in the current tab.  We'll assume it's for the main frame
-  // (possibly of a new or different WebContents) otherwise.
-  if (disposition == WindowOpenDisposition::CURRENT_TAB &&
-      render_frame_host->GetParent()) {
-    frame_tree_node_id =
-        render_frame_host->frame_tree_node()->frame_tree_node_id();
-  }
-
-  OpenURLParams params(url, referrer, frame_tree_node_id, disposition,
-                       ui::PAGE_TRANSITION_LINK,
-                       true /* is_renderer_initiated */);
-  params.post_data = post_body;
-  params.extra_headers = extra_headers;
-  if (redirect_chain.size() > 0)
-    params.redirect_chain = redirect_chain;
-  params.should_replace_current_entry = should_replace_current_entry;
-  params.user_gesture = user_gesture;
-  params.triggering_event_info = triggering_event_info;
-  params.initiator_origin = initiator_origin;
-
-  // RequestOpenURL is used only for local frames, so we can get here only if
-  // the navigation is initiated by a frame in the same SiteInstance as this
-  // frame.  Note that navigations on RenderFrameProxies do not use
-  // RequestOpenURL and go through NavigateFromFrameProxy instead.
-  params.source_site_instance = current_site_instance;
-
-  params.source_render_frame_id = render_frame_host->GetRoutingID();
-  params.source_render_process_id = render_frame_host->GetProcess()->GetID();
-
-  if (render_frame_host->web_ui()) {
-    // Note that we hide the referrer for Web UI pages. We don't really want
-    // web sites to see a referrer of "chrome://blah" (and some chrome: URLs
-    // might have search terms or other stuff we don't want to send to the
-    // site), so we send no referrer.
-    params.referrer = Referrer();
-
-    // Navigations in Web UI pages count as browser-initiated navigations.
-    params.is_renderer_initiated = false;
-  }
-
-  params.blob_url_loader_factory = std::move(blob_url_loader_factory);
-  params.href_translate = href_translate;
-
-  if (delegate_)
-    delegate_->OpenURL(params);
-}
-
-void NavigatorImpl::NavigateFromFrameProxy(
-    RenderFrameHostImpl* render_frame_host,
-    const GURL& url,
-    const url::Origin& initiator_origin,
-    SiteInstance* source_site_instance,
-    const Referrer& referrer,
-    ui::PageTransition page_transition,
-    bool should_replace_current_entry,
-    NavigationDownloadPolicy download_policy,
-    const std::string& method,
-    scoped_refptr<network::ResourceRequestBody> post_body,
-    const std::string& extra_headers,
-    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    bool has_user_gesture) {
-  // |method != "POST"| should imply absence of |post_body|.
-  if (method != "POST" && post_body) {
-    NOTREACHED();
-    post_body = nullptr;
-  }
-
-  // Allow the delegate to cancel the transfer.
-  if (!delegate_->ShouldTransferNavigation(
-          render_frame_host->frame_tree_node()->IsMainFrame()))
-    return;
-
-  // TODO(creis): Determine if this transfer started as a browser-initiated
-  // navigation.  See https://crbug.com/495161.
-  bool is_renderer_initiated = true;
-  Referrer referrer_to_use(referrer);
-  if (render_frame_host->web_ui()) {
-    // Note that we hide the referrer for Web UI pages. We don't really want
-    // web sites to see a referrer of "chrome://blah" (and some chrome: URLs
-    // might have search terms or other stuff we don't want to send to the
-    // site), so we send no referrer.
-    referrer_to_use = Referrer();
-
-    // Navigations in Web UI pages count as browser-initiated navigations.
-    is_renderer_initiated = false;
-  }
-
-  if (is_renderer_initiated &&
-      ShouldIgnoreIncomingRendererRequest(
-          render_frame_host->frame_tree_node()->navigation_request(),
-          has_user_gesture)) {
-    return;
-  }
-
-  controller_->NavigateFromFrameProxy(
-      render_frame_host, url, initiator_origin, is_renderer_initiated,
-      source_site_instance, referrer_to_use, page_transition,
-      should_replace_current_entry, download_policy, method, post_body,
-      extra_headers, std::move(blob_url_loader_factory));
-}
-
-void NavigatorImpl::BeforeUnloadCompleted(FrameTreeNode* frame_tree_node,
-                                          bool proceed,
-                                          const base::TimeTicks& proceed_time) {
-  DCHECK(frame_tree_node);
-
-  NavigationRequest* navigation_request = frame_tree_node->navigation_request();
-
-  // The NavigationRequest may have been canceled while the renderer was
-  // executing the BeforeUnload event.
-  if (!navigation_request)
-    return;
-
-  // If the user chose not to proceed, cancel the ongoing navigation.
-  // Note: it might be a new navigation, and not the one that triggered the
-  // sending of the BeforeUnload IPC in the first place. However, the
-  // BeforeUnload where the user asked not to proceed will have taken place
-  // after the navigation started. The last user input shoud be respected, and
-  // the navigation cancelled anyway.
-  if (!proceed) {
-    CancelNavigation(frame_tree_node);
-    return;
-  }
-
-  // The browser-initiated NavigationRequest that triggered the sending of the
-  // BeforeUnload IPC might have been replaced by a renderer-initiated one while
-  // the BeforeUnload event executed in the renderer. In that case, the request
-  // will already have begun, so there is no need to start it again.
-  if (navigation_request->state() >
-      NavigationRequest::WAITING_FOR_RENDERER_RESPONSE) {
-    DCHECK(navigation_request->from_begin_navigation());
-    return;
-  }
-
-  // Update the navigation start: it should be when it was determined that the
-  // navigation will proceed.
-  navigation_request->set_navigation_start_time(proceed_time);
-
-  DCHECK_EQ(NavigationRequest::WAITING_FOR_RENDERER_RESPONSE,
-            navigation_request->state());
-
-  // Send the request to the IO thread.
-  navigation_request->BeginNavigation();
-  // DO NOT USE |navigation_request| BEYOND THIS POINT. It might have been
-  // destroyed in BeginNavigation().
-  // See https://crbug.com/770157.
-}
-
-void NavigatorImpl::OnBeginNavigation(
-    FrameTreeNode* frame_tree_node,
-    mojom::CommonNavigationParamsPtr common_params,
-    mojom::BeginNavigationParamsPtr begin_params,
-    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
-    mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
-    scoped_refptr<PrefetchedSignedExchangeCache>
-        prefetched_signed_exchange_cache,
-    std::unique_ptr<WebBundleHandleTracker> web_bundle_handle_tracker) {
-  // TODO(clamy): the url sent by the renderer should be validated with
-  // FilterURL.
-  // This is a renderer-initiated navigation.
-  DCHECK(frame_tree_node);
-
-  if (common_params->is_history_navigation_in_new_child_frame) {
-    // Try to find a FrameNavigationEntry that matches this frame instead, based
-    // on the frame's unique name.  If this can't be found, fall back to the
-    // default path below.
-    if (frame_tree_node->navigator()->StartHistoryNavigationInNewSubframe(
-            frame_tree_node->current_frame_host(), &navigation_client)) {
-      return;
-    }
-  }
-
-  NavigationRequest* ongoing_navigation_request =
-      frame_tree_node->navigation_request();
-
-  // Client redirects during the initial history navigation of a child frame
-  // should take precedence over the history navigation (despite being renderer-
-  // initiated).  See https://crbug.com/348447 and https://crbug.com/691168.
-  if (ongoing_navigation_request &&
-      ongoing_navigation_request->common_params()
-          .is_history_navigation_in_new_child_frame) {
-    // Preemptively clear this local pointer before deleting the request.
-    ongoing_navigation_request = nullptr;
-    frame_tree_node->ResetNavigationRequest(false);
-  }
-
-  // Verify this navigation has precedence.
-  if (ShouldIgnoreIncomingRendererRequest(ongoing_navigation_request,
-                                          common_params->has_user_gesture)) {
-    return;
-  }
-
-  NavigationEntryImpl* navigation_entry =
-      GetNavigationEntryForRendererInitiatedNavigation(*common_params,
-                                                       frame_tree_node);
-  NavigationEntryImpl* current_entry = controller_->GetLastCommittedEntry();
-  // Only consult the delegate for override state if there is no current entry,
-  // since that state should only apply to newly created tabs (and not cases
-  // where the NavigationEntry recorded the state).
-  bool override_user_agent =
-      current_entry
-          ? current_entry->GetIsOverridingUserAgent()
-          : delegate_ && delegate_->ShouldOverrideUserAgentInNewTabs();
-  frame_tree_node->CreatedNavigationRequest(
-      NavigationRequest::CreateRendererInitiated(
-          frame_tree_node, navigation_entry, std::move(common_params),
-          std::move(begin_params), controller_->GetLastCommittedEntryIndex(),
-          controller_->GetEntryCount(), override_user_agent,
-          std::move(blob_url_loader_factory), std::move(navigation_client),
-          std::move(navigation_initiator),
-          std::move(prefetched_signed_exchange_cache),
-          std::move(web_bundle_handle_tracker)));
-  NavigationRequest* navigation_request = frame_tree_node->navigation_request();
-
-  // This frame has already run beforeunload before it sent this IPC.  See if
-  // any of its cross-process subframes also need to run beforeunload.  If so,
-  // delay the navigation until beforeunload completion callbacks are invoked on
-  // those frames.
-  DCHECK(!NavigationTypeUtils::IsSameDocument(
-      navigation_request->common_params().navigation_type));
-  bool should_dispatch_beforeunload =
-      frame_tree_node->current_frame_host()->ShouldDispatchBeforeUnload(
-          true /* check_subframes_only */);
-  if (should_dispatch_beforeunload) {
-    frame_tree_node->navigation_request()->SetWaitingForRendererResponse();
-    frame_tree_node->current_frame_host()->DispatchBeforeUnload(
-        RenderFrameHostImpl::BeforeUnloadType::RENDERER_INITIATED_NAVIGATION,
-        NavigationTypeUtils::IsReload(
-            navigation_request->common_params().navigation_type));
-    return;
-  }
-
-  // For main frames, NavigationHandle will be created after the call to
-  // |DidStartMainFrameNavigation|, so it receives the most up to date pending
-  // entry from the NavigationController.
-  navigation_request->BeginNavigation();
-  // DO NOT USE |navigation_request| BEYOND THIS POINT. It might have been
-  // destroyed in BeginNavigation().
-  // See https://crbug.com/770157.
-}
-
-void NavigatorImpl::RestartNavigationAsCrossDocument(
-    std::unique_ptr<NavigationRequest> navigation_request) {
-  FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
-  // Don't restart the navigation if there is already another ongoing navigation
-  // in the FrameTreeNode.
-  if (frame_tree_node->navigation_request())
-    return;
-
-  navigation_request->ResetForCrossDocumentRestart();
-  frame_tree_node->CreatedNavigationRequest(std::move(navigation_request));
-  frame_tree_node->navigation_request()->BeginNavigation();
-  // DO NOT USE THE NAVIGATION REQUEST BEYOND THIS POINT. It might have been
-  // destroyed in BeginNavigation().
-  // See https://crbug.com/770157.
-}
-
-void NavigatorImpl::CancelNavigation(FrameTreeNode* frame_tree_node) {
-  if (frame_tree_node->navigation_request())
-    frame_tree_node->navigation_request()->set_net_error(net::ERR_ABORTED);
-  frame_tree_node->ResetNavigationRequest(false);
-  if (frame_tree_node->IsMainFrame())
-    navigation_data_.reset();
-}
-
-void NavigatorImpl::LogResourceRequestTime(base::TimeTicks timestamp,
-                                           const GURL& url) {
-  if (navigation_data_ && navigation_data_->url_ == url) {
-    navigation_data_->url_job_start_time_ = timestamp;
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToURLJobStart",
-        navigation_data_->url_job_start_time_ - navigation_data_->start_time_);
-  }
-}
-
-void NavigatorImpl::LogBeforeUnloadTime(
-    const base::TimeTicks& renderer_before_unload_start_time,
-    const base::TimeTicks& renderer_before_unload_end_time) {
-  // Only stores the beforeunload delay if we're tracking a browser initiated
-  // navigation and it happened later than the navigation request.
-  if (navigation_data_ &&
-      renderer_before_unload_start_time > navigation_data_->start_time_) {
-    navigation_data_->before_unload_delay_ =
-        renderer_before_unload_end_time - renderer_before_unload_start_time;
-  }
-}
-
-void NavigatorImpl::RecordNavigationMetrics(
-    const LoadCommittedDetails& details,
-    const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-    SiteInstance* site_instance) {
-  DCHECK(site_instance->HasProcess());
-
-  if (!details.is_main_frame || !navigation_data_ ||
-      navigation_data_->url_job_start_time_.is_null() ||
-      navigation_data_->url_ != params.original_request_url) {
-    return;
-  }
-
-  base::TimeDelta time_to_commit =
-      base::TimeTicks::Now() - navigation_data_->start_time_;
-  UMA_HISTOGRAM_TIMES("Navigation.TimeToCommit", time_to_commit);
-
-  time_to_commit -= navigation_data_->before_unload_delay_;
-  base::TimeDelta time_to_network = navigation_data_->url_job_start_time_ -
-                                    navigation_data_->start_time_ -
-                                    navigation_data_->before_unload_delay_;
-  if (navigation_data_->is_restoring_from_last_session_) {
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToCommit_SessionRestored_BeforeUnloadDiscounted",
-        time_to_commit);
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToURLJobStart_SessionRestored_BeforeUnloadDiscounted",
-        time_to_network);
-    navigation_data_.reset();
-    return;
-  }
-  bool navigation_created_new_renderer_process =
-      site_instance->GetProcess()->GetInitTimeForNavigationMetrics() >
-      navigation_data_->start_time_;
-  if (navigation_created_new_renderer_process) {
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToCommit_NewRenderer_BeforeUnloadDiscounted",
-        time_to_commit);
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToURLJobStart_NewRenderer_BeforeUnloadDiscounted",
-        time_to_network);
-  } else {
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToCommit_ExistingRenderer_BeforeUnloadDiscounted",
-        time_to_commit);
-    UMA_HISTOGRAM_TIMES(
-        "Navigation.TimeToURLJobStart_ExistingRenderer_BeforeUnloadDiscounted",
-        time_to_network);
-  }
-  navigation_data_.reset();
-}
-
-NavigationEntryImpl*
-NavigatorImpl::GetNavigationEntryForRendererInitiatedNavigation(
-    const mojom::CommonNavigationParams& common_params,
-    FrameTreeNode* frame_tree_node) {
-  if (!frame_tree_node->IsMainFrame())
-    return nullptr;
-
-  // If there is no browser-initiated pending entry for this navigation and it
-  // is not for the error URL, create a pending entry and ensure the address bar
-  // updates accordingly.  We don't know the referrer or extra headers at this
-  // point, but the referrer will be set properly upon commit.  This does not
-  // set the SiteInstance for the pending entry, because it may change
-  // before the URL commits.
-  NavigationEntryImpl* pending_entry = controller_->GetPendingEntry();
-  bool has_browser_initiated_pending_entry =
-      pending_entry && !pending_entry->is_renderer_initiated();
-  if (has_browser_initiated_pending_entry)
-    return nullptr;
-
-  // A pending navigation entry is created in OnBeginNavigation(). The renderer
-  // sends a provisional load notification after that. We don't want to create
-  // a duplicate navigation entry here.
-  bool renderer_provisional_load_to_pending_url =
-      pending_entry && pending_entry->is_renderer_initiated() &&
-      (pending_entry->GetURL() == common_params.url);
-  if (renderer_provisional_load_to_pending_url)
-    return nullptr;
-
-  // If there is a transient entry, creating a new pending entry will result
-  // in deleting it, which leads to inconsistent state.
-  bool has_transient_entry = !!controller_->GetTransientEntry();
-  if (has_transient_entry)
-    return nullptr;
-
-  // Since GetNavigationEntryForRendererInitiatedNavigation is called from
-  // OnBeginNavigation, we can assume that no frame proxies are involved and
-  // therefore that |current_site_instance| is also the |source_site_instance|.
-  SiteInstance* current_site_instance =
-      frame_tree_node->current_frame_host()->GetSiteInstance();
-  SiteInstance* source_site_instance = current_site_instance;
-
-  std::unique_ptr<NavigationEntryImpl> entry =
-      NavigationEntryImpl::FromNavigationEntry(
-          NavigationControllerImpl::CreateNavigationEntry(
-              common_params.url, content::Referrer(),
-              common_params.initiator_origin, source_site_instance,
-              ui::PAGE_TRANSITION_LINK, true /* is_renderer_initiated */,
-              std::string() /* extra_headers */,
-              controller_->GetBrowserContext(),
-              nullptr /* blob_url_loader_factory */));
-
-  controller_->SetPendingEntry(std::move(entry));
-  if (delegate_)
-    delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);
-
-  return controller_->GetPendingEntry();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator_impl.h b/chromium/content/browser/frame_host/navigator_impl.h
deleted file mode 100644
index 2ef3971195c..00000000000
--- a/chromium/content/browser/frame_host/navigator_impl.h
+++ /dev/null
@@ -1,150 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_IMPL_H_
-#define CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_IMPL_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/time/time.h"
-#include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigator.h"
-#include "content/common/content_export.h"
-#include "content/common/navigation_params.h"
-#include "content/common/navigation_params.mojom.h"
-#include "content/public/common/previews_state.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
-#include "url/gurl.h"
-
-class GURL;
-
-namespace content {
-
-class NavigationControllerImpl;
-class NavigatorDelegate;
-struct LoadCommittedDetails;
-
-// This class is an implementation of Navigator, responsible for managing
-// navigations in regular browser tabs.
-class CONTENT_EXPORT NavigatorImpl : public Navigator {
- public:
-  NavigatorImpl(NavigationControllerImpl* navigation_controller,
-                NavigatorDelegate* delegate);
-
-  static void CheckWebUIRendererDoesNotDisplayNormalURL(
-      RenderFrameHostImpl* render_frame_host,
-      const GURL& url);
-
-  static bool ShouldIgnoreIncomingRendererRequest(
-      const NavigationRequest* ongoing_navigation_request,
-      bool has_user_gesture);
-
-  // Navigator implementation.
-  NavigatorDelegate* GetDelegate() override;
-  NavigationController* GetController() override;
-  void DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
-                            const GURL& url,
-                            int error_code) override;
-  void DidNavigate(RenderFrameHostImpl* render_frame_host,
-                   const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-                   std::unique_ptr<NavigationRequest> navigation_request,
-                   bool was_within_same_document) override;
-  bool StartHistoryNavigationInNewSubframe(
-      RenderFrameHostImpl* render_frame_host,
-      mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client)
-      override;
-  void Navigate(std::unique_ptr<NavigationRequest> request,
-                ReloadType reload_type,
-                RestoreType restore_type) override;
-  void RequestOpenURL(
-      RenderFrameHostImpl* render_frame_host,
-      const GURL& url,
-      const base::Optional<url::Origin>& initiator_origin,
-      const scoped_refptr<network::ResourceRequestBody>& post_body,
-      const std::string& extra_headers,
-      const Referrer& referrer,
-      WindowOpenDisposition disposition,
-      bool should_replace_current_entry,
-      bool user_gesture,
-      blink::TriggeringEventInfo triggering_event_info,
-      const std::string& href_translate,
-      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory)
-      override;
-  void NavigateFromFrameProxy(
-      RenderFrameHostImpl* render_frame_host,
-      const GURL& url,
-      const url::Origin& initiator_origin,
-      SiteInstance* source_site_instance,
-      const Referrer& referrer,
-      ui::PageTransition page_transition,
-      bool should_replace_current_entry,
-      NavigationDownloadPolicy download_policy,
-      const std::string& method,
-      scoped_refptr<network::ResourceRequestBody> post_body,
-      const std::string& extra_headers,
-      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      bool has_user_gesture) override;
-  void BeforeUnloadCompleted(FrameTreeNode* frame_tree_node,
-                             bool proceed,
-                             const base::TimeTicks& proceed_time) override;
-  void OnBeginNavigation(
-      FrameTreeNode* frame_tree_node,
-      mojom::CommonNavigationParamsPtr common_params,
-      mojom::BeginNavigationParamsPtr begin_params,
-      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
-      mojo::PendingRemote<blink::mojom::NavigationInitiator>
-          navigation_initiator,
-      scoped_refptr<PrefetchedSignedExchangeCache>
-          prefetched_signed_exchange_cache,
-      std::unique_ptr<WebBundleHandleTracker> web_bundle_handle_tracker)
-      override;
-  void RestartNavigationAsCrossDocument(
-      std::unique_ptr<NavigationRequest> navigation_request) override;
-  void LogResourceRequestTime(base::TimeTicks timestamp,
-                              const GURL& url) override;
-  void LogBeforeUnloadTime(
-      const base::TimeTicks& renderer_before_unload_start_time,
-      const base::TimeTicks& renderer_before_unload_end_time) override;
-  void CancelNavigation(FrameTreeNode* frame_tree_node) override;
-
- private:
-  // Holds data used to track browser side navigation metrics.
-  struct NavigationMetricsData;
-
-  friend class NavigatorTestWithBrowserSideNavigation;
-  ~NavigatorImpl() override;
-
-  void RecordNavigationMetrics(
-      const LoadCommittedDetails& details,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      SiteInstance* site_instance);
-
-  // Called when a renderer initiated navigation has started. Returns the
-  // pending NavigationEntry to be used. Either null or a new one owned
-  // NavigationController.
-  NavigationEntryImpl* GetNavigationEntryForRendererInitiatedNavigation(
-      const mojom::CommonNavigationParams& common_params,
-      FrameTreeNode* frame_tree_node);
-
-  // The NavigationController that will keep track of session history for all
-  // RenderFrameHost objects using this NavigatorImpl.
-  // TODO(nasko): Move ownership of the NavigationController from
-  // WebContentsImpl to this class.
-  NavigationControllerImpl* controller_;
-
-  // Used to notify the object embedding this Navigator about navigation
-  // events. Can be NULL in tests.
-  NavigatorDelegate* delegate_;
-
-  std::unique_ptr<NavigatorImpl::NavigationMetricsData> navigation_data_;
-
-  DISALLOW_COPY_AND_ASSIGN(NavigatorImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_IMPL_H_
diff --git a/chromium/content/browser/frame_host/navigator_impl_unittest.cc b/chromium/content/browser/frame_host/navigator_unittest.cc
index 2bcdd544538..0d819dc2d49 100644
--- a/chromium/content/browser/frame_host/navigator_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigator_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/frame_host/navigator_impl.h"
+#include "content/browser/frame_host/navigator.h"
 
 #include <stdint.h>
 
@@ -99,7 +99,9 @@ TEST_F(NavigatorTest, SimpleBrowserInitiatedNavigationFromNonLiveRenderer) {
 
   // Commit the navigation.
   navigation->Commit();
-  EXPECT_TRUE(main_test_rfh()->is_active());
+  EXPECT_TRUE(main_test_rfh()->IsCurrent());
+  EXPECT_EQ(main_test_rfh()->lifecycle_state(),
+            RenderFrameHostImpl::LifecycleState::kActive);
   if (AreDefaultSiteInstancesEnabled()) {
     EXPECT_TRUE(main_test_rfh()->GetSiteInstance()->IsDefaultSiteInstance());
   } else {
@@ -156,7 +158,7 @@ TEST_F(NavigatorTest, SimpleRendererInitiatedSameSiteNavigation) {
 
   // Commit the navigation.
   navigation->Commit();
-  EXPECT_TRUE(main_test_rfh()->is_active());
+  EXPECT_TRUE(main_test_rfh()->IsCurrent());
   if (AreDefaultSiteInstancesEnabled()) {
     EXPECT_TRUE(main_test_rfh()->GetSiteInstance()->IsDefaultSiteInstance());
   } else {
@@ -210,7 +212,7 @@ TEST_F(NavigatorTest, SimpleRendererInitiatedCrossSiteNavigation) {
 
   // Commit the navigation.
   navigation->Commit();
-  EXPECT_TRUE(main_test_rfh()->is_active());
+  EXPECT_TRUE(main_test_rfh()->IsCurrent());
   EXPECT_EQ(kUrl2, contents()->GetLastCommittedURL());
   EXPECT_FALSE(GetSpeculativeRenderFrameHost(node));
 
@@ -288,13 +290,13 @@ TEST_F(NavigatorTest, BeginNavigation) {
   EXPECT_EQ(NavigationRequest::WILL_START_REQUEST, subframe_request->state());
   EXPECT_EQ(kUrl2, subframe_request->common_params().url);
   EXPECT_EQ(kUrl2, subframe_loader->request_info()->common_params->url);
-  // First party for cookies url should be that of the main frame.
-  EXPECT_TRUE(subframe_loader->request_info()->site_for_cookies.IsEquivalent(
-      net::SiteForCookies::FromUrl(kUrl1)));
+  EXPECT_TRUE(
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateFrameOnly,
+          url::Origin::Create(kUrl1), url::Origin::Create(kUrl2),
+          net::SiteForCookies::FromUrl(kUrl1))
+          .IsEqualForTesting(subframe_loader->request_info()->isolation_info));
 
-  EXPECT_EQ(net::NetworkIsolationKey(url::Origin::Create(kUrl1),
-                                     url::Origin::Create(kUrl2)),
-            subframe_loader->request_info()->network_isolation_key);
   EXPECT_FALSE(subframe_loader->request_info()->is_main_frame);
   EXPECT_TRUE(subframe_loader->request_info()->parent_is_main_frame);
   EXPECT_TRUE(subframe_request->browser_initiated());
@@ -329,8 +331,12 @@ TEST_F(NavigatorTest, BeginNavigation) {
       GetLoaderForNavigationRequest(main_request);
   EXPECT_EQ(kUrl3, main_request->common_params().url);
   EXPECT_EQ(kUrl3, main_loader->request_info()->common_params->url);
-  EXPECT_TRUE(main_loader->request_info()->site_for_cookies.IsEquivalent(
-      net::SiteForCookies::FromUrl(kUrl3)));
+  EXPECT_TRUE(
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateTopFrame,
+          url::Origin::Create(kUrl3), url::Origin::Create(kUrl3),
+          net::SiteForCookies::FromUrl(kUrl3))
+          .IsEqualForTesting(main_loader->request_info()->isolation_info));
   EXPECT_TRUE(main_loader->request_info()->is_main_frame);
   EXPECT_FALSE(main_loader->request_info()->parent_is_main_frame);
   EXPECT_TRUE(main_request->browser_initiated());
@@ -1055,7 +1061,7 @@ TEST_F(NavigatorTest, SiteInstanceDescriptionConversion) {
   // current one.
   GURL kUrlSameSiteAs1("http://www.a.com/foo");
   {
-    SiteInstanceDescriptor descriptor(browser_context(), kUrlSameSiteAs1,
+    SiteInstanceDescriptor descriptor(kUrlSameSiteAs1,
                                       SiteInstanceRelation::RELATED);
     scoped_refptr<SiteInstance> converted_instance =
         ConvertToSiteInstance(rfhm, descriptor, nullptr);
@@ -1067,7 +1073,7 @@ TEST_F(NavigatorTest, SiteInstanceDescriptionConversion) {
   GURL kUrlSameSiteAs2("http://www.b.com/foo");
   scoped_refptr<SiteInstance> related_instance;
   {
-    SiteInstanceDescriptor descriptor(browser_context(), kUrlSameSiteAs2,
+    SiteInstanceDescriptor descriptor(kUrlSameSiteAs2,
                                       SiteInstanceRelation::RELATED);
     related_instance = ConvertToSiteInstance(rfhm, descriptor, nullptr);
     // If kUrlSameSiteAs2 requires a dedicated process on this platform, this
@@ -1091,7 +1097,7 @@ TEST_F(NavigatorTest, SiteInstanceDescriptionConversion) {
   // 5) Convert a descriptor of an unrelated instance with the same site as the
   // current one, several times, with and without candidate sites.
   {
-    SiteInstanceDescriptor descriptor(browser_context(), kUrlSameSiteAs1,
+    SiteInstanceDescriptor descriptor(kUrlSameSiteAs1,
                                       SiteInstanceRelation::UNRELATED);
     scoped_refptr<SiteInstance> converted_instance_1 =
         ConvertToSiteInstance(rfhm, descriptor, nullptr);
@@ -1129,7 +1135,7 @@ TEST_F(NavigatorTest, SiteInstanceDescriptionConversion) {
   // 6) Convert a descriptor of an unrelated instance with the same site of
   // related_instance and using it as a candidate.
   {
-    SiteInstanceDescriptor descriptor(browser_context(), kUrlSameSiteAs2,
+    SiteInstanceDescriptor descriptor(kUrlSameSiteAs2,
                                       SiteInstanceRelation::UNRELATED);
     scoped_refptr<SiteInstance> converted_instance_1 =
         ConvertToSiteInstance(rfhm, descriptor, related_instance.get());
diff --git a/chromium/content/browser/frame_host/popup_menu_helper_mac.h b/chromium/content/browser/frame_host/popup_menu_helper_mac.h
index 837455ffcb1..e2eb22769c0 100644
--- a/chromium/content/browser/frame_host/popup_menu_helper_mac.h
+++ b/chromium/content/browser/frame_host/popup_menu_helper_mac.h
@@ -15,6 +15,9 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_observer.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "ui/gfx/geometry/rect.h"
 
 #ifdef __OBJC__
@@ -32,7 +35,6 @@ namespace content {
 class RenderFrameHost;
 class RenderFrameHostImpl;
 class RenderWidgetHostViewMac;
-struct MenuItem;
 
 class PopupMenuHelper : public RenderWidgetHostObserver {
  public:
@@ -44,7 +46,10 @@ class PopupMenuHelper : public RenderWidgetHostObserver {
   // Creates a PopupMenuHelper that will notify |render_frame_host| when a user
   // selects or cancels the popup. |delegate| is notified when the menu is
   // closed.
-  PopupMenuHelper(Delegate* delegate, RenderFrameHost* render_frame_host);
+  PopupMenuHelper(
+      Delegate* delegate,
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client);
   ~PopupMenuHelper() override;
   void Hide();
 
@@ -54,7 +59,7 @@ class PopupMenuHelper : public RenderWidgetHostObserver {
                      int item_height,
                      double item_font_size,
                      int selected_item,
-                     const std::vector<MenuItem>& items,
+                     std::vector<blink::mojom::MenuItemPtr> items,
                      bool right_aligned,
                      bool allow_multiple_selection);
 
@@ -74,6 +79,7 @@ class PopupMenuHelper : public RenderWidgetHostObserver {
 
   ScopedObserver<RenderWidgetHost, RenderWidgetHostObserver> observer_{this};
   base::WeakPtr<RenderFrameHostImpl> render_frame_host_;
+  mojo::Remote<blink::mojom::PopupMenuClient> popup_client_;
   WebMenuRunner* menu_runner_ = nil;
   bool popup_was_hidden_ = false;
 
diff --git a/chromium/content/browser/frame_host/popup_menu_helper_mac.mm b/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
index 8060f37947f..66c8b3bd980 100644
--- a/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
+++ b/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
@@ -8,11 +8,11 @@
 #import "base/mac/scoped_sending_event.h"
 #include "base/message_loop/message_loop_current.h"
 #import "base/message_loop/message_pump_mac.h"
+#import "content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
-#import "content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h"
 #include "content/browser/renderer_host/render_widget_host_view_mac.h"
 #include "content/browser/renderer_host/webmenurunner_mac.h"
 #import "ui/base/cocoa/base_view.h"
@@ -25,14 +25,20 @@ bool g_allow_showing_popup_menus = true;
 
 }  // namespace
 
-PopupMenuHelper::PopupMenuHelper(Delegate* delegate,
-                                 RenderFrameHost* render_frame_host)
+PopupMenuHelper::PopupMenuHelper(
+    Delegate* delegate,
+    RenderFrameHost* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client)
     : delegate_(delegate),
       render_frame_host_(
-          static_cast<RenderFrameHostImpl*>(render_frame_host)->GetWeakPtr()) {
+          static_cast<RenderFrameHostImpl*>(render_frame_host)->GetWeakPtr()),
+      popup_client_(std::move(popup_client)) {
   RenderWidgetHost* widget_host =
       render_frame_host->GetRenderViewHost()->GetWidget();
   observer_.Add(widget_host);
+
+  popup_client_.set_disconnect_handler(
+      base::BindOnce(&PopupMenuHelper::Hide, weak_ptr_factory_.GetWeakPtr()));
 }
 
 PopupMenuHelper::~PopupMenuHelper() {
@@ -44,7 +50,7 @@ void PopupMenuHelper::ShowPopupMenu(
     int item_height,
     double item_font_size,
     int selected_item,
-    const std::vector<MenuItem>& items,
+    std::vector<blink::mojom::MenuItemPtr> items,
     bool right_aligned,
     bool allow_multiple_selection) {
   // Only single selection list boxes show a popup on Mac.
@@ -101,11 +107,16 @@ void PopupMenuHelper::ShowPopupMenu(
 
   // The RenderFrameHost may be deleted while running the menu, or it may have
   // requested the close. Don't notify in these cases.
-  if (render_frame_host_ && !popup_was_hidden_) {
-    if ([runner menuItemWasChosen])
-      render_frame_host_->DidSelectPopupMenuItem([runner indexOfSelectedItem]);
-    else
-      render_frame_host_->DidCancelPopupMenu();
+  if (popup_client_ && !popup_was_hidden_) {
+    if ([runner menuItemWasChosen]) {
+      int index = [runner indexOfSelectedItem];
+      if (index < 0)
+        popup_client_->DidCancel();
+      else
+        popup_client_->DidAcceptIndices({index});
+    } else {
+      popup_client_->DidCancel();
+    }
   }
 
   delegate_->OnMenuClosed();  // May delete |this|.
@@ -123,6 +134,7 @@ void PopupMenuHelper::Hide() {
   if (menu_runner_)
     [menu_runner_ hide];
   popup_was_hidden_ = true;
+  popup_client_.reset();
 }
 
 // static
diff --git a/chromium/content/browser/frame_host/raw_clipboard_host_impl.cc b/chromium/content/browser/frame_host/raw_clipboard_host_impl.cc
index 5f0815e02a8..85d2fdfbfb7 100644
--- a/chromium/content/browser/frame_host/raw_clipboard_host_impl.cc
+++ b/chromium/content/browser/frame_host/raw_clipboard_host_impl.cc
@@ -5,6 +5,7 @@
 #include "content/browser/frame_host/raw_clipboard_host_impl.h"
 
 #include "base/bind.h"
+#include "base/i18n/number_formatting.h"
 #include "content/browser/frame_host/clipboard_host_impl.h"
 #include "content/browser/permissions/permission_controller_impl.h"
 #include "content/public/browser/render_frame_host.h"
@@ -15,6 +16,7 @@
 #include "third_party/blink/public/mojom/clipboard/raw_clipboard.mojom.h"
 #include "third_party/blink/public/mojom/permissions/permission_status.mojom-shared.h"
 #include "ui/base/clipboard/clipboard.h"
+#include "ui/base/clipboard/clipboard_format_type.h"
 #include "ui/base/clipboard/scoped_clipboard_writer.h"
 
 namespace content {
@@ -24,26 +26,35 @@ void RawClipboardHostImpl::Create(
     mojo::PendingReceiver<blink::mojom::RawClipboardHost> receiver) {
   DCHECK(render_frame_host);
 
-  PermissionControllerImpl* permission_controller =
-      PermissionControllerImpl::FromBrowserContext(
-          render_frame_host->GetProcess()->GetBrowserContext());
-
   // Feature flags and permission should already be checked in the renderer
   // process, but recheck in the browser process in case of a hijacked renderer.
   if (!base::FeatureList::IsEnabled(blink::features::kRawClipboard)) {
-    mojo::ReportBadMessage("Raw Clipboard is not enabled");
+    mojo::ReportBadMessage("Raw Clipboard is not enabled.");
+    return;
+  }
+
+  // Renderer process should already check for user activation before sending
+  // this request. Double check in case of compromised renderer.
+  if (!render_frame_host->HasTransientUserActivation()) {
+    // mojo::ReportBadMessage() is not appropriate here, because user
+    // activation may expire after the renderer check but before the browser
+    // check.
     return;
   }
 
+  PermissionControllerImpl* permission_controller =
+      PermissionControllerImpl::FromBrowserContext(
+          render_frame_host->GetProcess()->GetBrowserContext());
+
   blink::mojom::PermissionStatus status =
       permission_controller->GetPermissionStatusForFrame(
           PermissionType::CLIPBOARD_READ_WRITE, render_frame_host,
           render_frame_host->GetLastCommittedOrigin().GetURL());
 
   if (status != blink::mojom::PermissionStatus::GRANTED) {
-    // This may be hit by a race condition, where permission is denied after
-    // the renderer check, but before the browser check. It may also be hit by
-    // a compromised renderer.
+    // mojo::ReportBadMessage() is not appropriate here because the permission
+    // may be granted after the renderer check, but revoked before the browser
+    // check.
     return;
   }
 
@@ -51,7 +62,7 @@ void RawClipboardHostImpl::Create(
   // loops. Use manual memory management instead of SelfOwnedReceiver<T> which
   // synchronously destroys on failure and can result in some unfortunate
   // use-after-frees after the nested message loops exit.
-  auto* host = new RawClipboardHostImpl(std::move(receiver));
+  auto* host = new RawClipboardHostImpl(std::move(receiver), render_frame_host);
   host->receiver_.set_disconnect_handler(base::BindOnce(
       [](RawClipboardHostImpl* host) {
         base::SequencedTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, host);
@@ -64,22 +75,57 @@ RawClipboardHostImpl::~RawClipboardHostImpl() {
 }
 
 RawClipboardHostImpl::RawClipboardHostImpl(
-    mojo::PendingReceiver<blink::mojom::RawClipboardHost> receiver)
+    mojo::PendingReceiver<blink::mojom::RawClipboardHost> receiver,
+    RenderFrameHost* render_frame_host)
     : receiver_(this, std::move(receiver)),
       clipboard_(ui::Clipboard::GetForCurrentThread()),
       clipboard_writer_(
-          new ui::ScopedClipboardWriter(ui::ClipboardBuffer::kCopyPaste)) {}
+          new ui::ScopedClipboardWriter(ui::ClipboardBuffer::kCopyPaste)),
+      render_frame_host_(render_frame_host) {
+  DCHECK(render_frame_host);
+}
 
 void RawClipboardHostImpl::ReadAvailableFormatNames(
     ReadAvailableFormatNamesCallback callback) {
+  if (!HasTransientUserActivation())
+    return;
   std::vector<base::string16> raw_types =
       clipboard_->ReadAvailablePlatformSpecificFormatNames(
           ui::ClipboardBuffer::kCopyPaste);
   std::move(callback).Run(raw_types);
 }
 
+void RawClipboardHostImpl::Read(const base::string16& format,
+                                ReadCallback callback) {
+  if (!HasTransientUserActivation())
+    return;
+  if (format.size() >= kMaxFormatSize) {
+    receiver_.ReportBadMessage("Requested format string length too long.");
+    return;
+  }
+
+  std::string result;
+  clipboard_->ReadData(
+      ui::ClipboardFormatType::GetType(base::UTF16ToUTF8(format)), &result);
+  base::span<const uint8_t> span(
+      reinterpret_cast<const uint8_t*>(result.data()), result.size());
+  mojo_base::BigBuffer buffer = mojo_base::BigBuffer(span);
+  std::move(callback).Run(std::move(buffer));
+}
+
 void RawClipboardHostImpl::Write(const base::string16& format,
                                  mojo_base::BigBuffer data) {
+  if (!HasTransientUserActivation())
+    return;
+  if (format.size() >= kMaxFormatSize) {
+    receiver_.ReportBadMessage("Target format string length too long.");
+    return;
+  }
+  if (data.size() >= kMaxDataSize) {
+    receiver_.ReportBadMessage("Write data too large.");
+    return;
+  }
+
   // Windows / X11 clipboards enter an unrecoverable state after registering
   // some amount of unique formats, and there's no way to un-register these
   // formats. For these clipboards, use a conservative limit to avoid
@@ -109,4 +155,12 @@ void RawClipboardHostImpl::CommitWrite() {
       new ui::ScopedClipboardWriter(ui::ClipboardBuffer::kCopyPaste));
 }
 
+bool RawClipboardHostImpl::HasTransientUserActivation() const {
+  // Renderer process should already check for user activation before sending
+  // this request. Double check in case of compromised renderer.
+  // mojo::ReportBadMessage() is not appropriate here, because user activation
+  // may expire after the renderer check but before the browser check.
+  return render_frame_host_->HasTransientUserActivation();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/raw_clipboard_host_impl.h b/chromium/content/browser/frame_host/raw_clipboard_host_impl.h
index 013def7c199..e305a596927 100644
--- a/chromium/content/browser/frame_host/raw_clipboard_host_impl.h
+++ b/chromium/content/browser/frame_host/raw_clipboard_host_impl.h
@@ -19,6 +19,9 @@ namespace content {
 
 class RenderFrameHost;
 
+// Instances destroy themselves when the blink::mojom::RawClipboardHost is
+// disconnected, and this can only be used on the frame and sequence it's
+// created on.
 class CONTENT_EXPORT RawClipboardHostImpl
     : public blink::mojom::RawClipboardHost {
  public:
@@ -30,18 +33,26 @@ class CONTENT_EXPORT RawClipboardHostImpl
   ~RawClipboardHostImpl() override;
 
  private:
-  explicit RawClipboardHostImpl(
-      mojo::PendingReceiver<blink::mojom::RawClipboardHost> receiver);
+  RawClipboardHostImpl(
+      mojo::PendingReceiver<blink::mojom::RawClipboardHost> receiver,
+      RenderFrameHost* render_frame_host);
 
   // mojom::RawClipboardHost.
   void ReadAvailableFormatNames(
       ReadAvailableFormatNamesCallback callback) override;
-  void Write(const base::string16&, mojo_base::BigBuffer) override;
+  void Read(const base::string16& format, ReadCallback callback) override;
+  void Write(const base::string16& format, mojo_base::BigBuffer data) override;
   void CommitWrite() override;
 
+  bool HasTransientUserActivation() const;
+
   mojo::Receiver<blink::mojom::RawClipboardHost> receiver_;
   ui::Clipboard* const clipboard_;  // Not owned.
   std::unique_ptr<ui::ScopedClipboardWriter> clipboard_writer_;
+  // Not owned. Raw pointer usage is safe here because RawClipboardHostImpl is
+  // per-frame, so |render_frame_host_| is guaranteed to outlive the
+  // RawClipboardHostImpl.
+  RenderFrameHost* const render_frame_host_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_document_host_browsertest.cc b/chromium/content/browser/frame_host/render_document_host_browsertest.cc
index 06c188525ef..6df22334aad 100644
--- a/chromium/content/browser/frame_host/render_document_host_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_document_host_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/content_navigation_policy.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/frame_host/render_document_host_user_data_browsertest.cc b/chromium/content/browser/frame_host/render_document_host_user_data_browsertest.cc
new file mode 100644
index 00000000000..09dff784251
--- /dev/null
+++ b/chromium/content/browser/frame_host/render_document_host_user_data_browsertest.cc
@@ -0,0 +1,565 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/render_document_host_user_data.h"
+
+#include "base/command_line.h"
+#include "base/memory/weak_ptr.h"
+#include "base/test/bind_test_util.h"
+#include "base/test/scoped_feature_list.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/navigation_request.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/site_isolation_policy.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/navigation_handle_observer.h"
+#include "content/public/test/render_frame_host_test_support.h"
+#include "content/public/test/test_navigation_observer.h"
+#include "content/public/test/test_navigation_throttle.h"
+#include "content/public/test/test_navigation_throttle_inserter.h"
+#include "content/public/test/test_utils.h"
+#include "content/public/test/url_loader_interceptor.h"
+#include "content/shell/browser/shell.h"
+#include "content/test/content_browser_test_utils_internal.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/url_request/url_request_failed_job.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace content {
+
+namespace {
+
+int next_id = 0;
+
+// Example class which inherits the RenderDocumentHostUserData, all the data is
+// associated to the lifetime of the document.
+class Data : public RenderDocumentHostUserData<Data> {
+ public:
+  ~Data() override = default;
+
+  base::WeakPtr<Data> GetWeakPtr() { return weak_ptr_factory_.GetWeakPtr(); }
+
+  int unique_id() { return unique_id_; }
+
+ private:
+  explicit Data(RenderFrameHost* render_frame_host) { unique_id_ = ++next_id; }
+
+  friend class content::RenderDocumentHostUserData<Data>;
+
+  int unique_id_;
+
+  base::WeakPtrFactory<Data> weak_ptr_factory_{this};
+
+  RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL();
+};
+
+RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(Data)
+
+}  // namespace
+
+class RenderDocumentHostUserDataTest : public ContentBrowserTest {
+ public:
+  ~RenderDocumentHostUserDataTest() override = default;
+
+ protected:
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    ContentBrowserTest::SetUpOnMainThread();
+  }
+
+  WebContentsImpl* web_contents() const {
+    return static_cast<WebContentsImpl*>(shell()->web_contents());
+  }
+
+  RenderFrameHostImpl* top_frame_host() {
+    return web_contents()->GetFrameTree()->root()->current_frame_host();
+  }
+};
+
+// Test basic functionality of RenderDocumentHostUserData.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
+                       GetCreateAndDeleteForCurrentDocument) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+
+  // 2) Get the Data associated with this RenderFrameHost. It should be null
+  // before creation.
+  Data* data = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_FALSE(data);
+
+  // 3) Create Data and check that GetForCurrentDocument shouldn't return null
+  // now.
+  Data::CreateForCurrentDocument(rfh_a);
+  base::WeakPtr<Data> created_data =
+      Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  EXPECT_TRUE(created_data);
+
+  // 4) Delete Data and check that GetForCurrentDocument should return null.
+  Data::DeleteForCurrentDocument(rfh_a);
+  EXPECT_FALSE(created_data);
+  EXPECT_FALSE(Data::GetForCurrentDocument(rfh_a));
+}
+
+// Tests that RenderDocumentHostUserData objects are different for each
+// RenderFrameHost in FrameTree when there are multiple frames.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
+                       CheckForMultipleRFHsInFrameTree) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+
+  // 1) Navigate to a(b).
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+
+  // 2) Create RenderDocumentHostUserData associated with both RenderFrameHosts
+  // a and b.
+  Data::CreateForCurrentDocument(rfh_a);
+  Data* data_a = Data::GetForCurrentDocument(rfh_a);
+  Data::CreateForCurrentDocument(rfh_b);
+  Data* data_b = Data::GetForCurrentDocument(rfh_b);
+  EXPECT_TRUE(data_a);
+  EXPECT_TRUE(data_b);
+
+  // 3) Check that RDHUD objects for both RenderFrameHost a and b have different
+  // unique_id's.
+  EXPECT_NE(data_a->unique_id(), data_b->unique_id());
+}
+
+// Tests that RenderDocumentHostUserData objects are cleared when the renderer
+// process crashes even when having RenderFrameHost that still exists.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, CheckForCrashedFrame) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+
+  // 2) Create RenderDocumentHostUserData associated with A.
+  Data::CreateForCurrentDocument(rfh_a);
+  base::WeakPtr<Data> data = Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  EXPECT_TRUE(data);
+
+  // 3) Make the renderer crash.
+  RenderProcessHost* renderer_process = rfh_a->GetProcess();
+  RenderProcessHostWatcher crash_observer(
+      renderer_process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  renderer_process->Shutdown(0);
+  crash_observer.Wait();
+
+  // 4) Check if the RDHUD object is deleted after renderer process crashes even
+  // when RFH is around.
+  EXPECT_EQ(top_frame_host(), rfh_a);
+  EXPECT_FALSE(rfh_a->IsRenderFrameLive());
+  EXPECT_FALSE(data);
+}
+
+// Tests that RenderDocumentHostUserData object is created for speculative
+// RenderFrameHost and check if they point to same object before and after
+// commit.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
+                       CheckIDsForSpeculativeRFHBeforeAndAfterCommit) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title2.html"));
+
+  // Isolate "b.com" so we are guaranteed to get a different process
+  // for navigations to this origin on Android. Doing this ensures that a
+  // speculative RenderFrameHost is used.
+  IsolateOriginsForTesting(embedded_test_server(), shell()->web_contents(),
+                           {"b.com"});
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+
+  // 2) Start navigation to B, but don't commit yet.
+  TestNavigationManager manager(shell()->web_contents(), url_b);
+  shell()->LoadURL(url_b);
+  EXPECT_TRUE(manager.WaitForRequestStart());
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  RenderFrameHostImpl* pending_rfh =
+      root->render_manager()->speculative_frame_host();
+  NavigationRequest* navigation_request = root->navigation_request();
+  EXPECT_EQ(navigation_request->associated_site_instance_type(),
+            NavigationRequest::AssociatedSiteInstanceType::SPECULATIVE);
+  EXPECT_TRUE(pending_rfh);
+
+  // 3) While there is a speculative RenderFrameHost in the root FrameTreeNode,
+  // get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(pending_rfh);
+  Data* data_before_commit = Data::GetForCurrentDocument(pending_rfh);
+  EXPECT_TRUE(data_before_commit);
+
+  // 4) Let the navigation finish and make sure it is succeeded.
+  manager.WaitForNavigationFinished();
+  EXPECT_EQ(url_b, web_contents()->GetMainFrame()->GetLastCommittedURL());
+
+  RenderFrameHostImpl* rfh_b = top_frame_host();
+  EXPECT_EQ(pending_rfh, rfh_b);
+  Data* data_after_commit = Data::GetForCurrentDocument(rfh_b);
+  EXPECT_TRUE(data_after_commit);
+
+  // 5) Check |data_before_commit| and |data_after_commit| have same ID.
+  EXPECT_EQ(data_before_commit->unique_id(), data_after_commit->unique_id());
+}
+
+// Tests that RenderDocumentHostUserData object is deleted when the speculative
+// RenderFrameHost gets deleted before being able to commit.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, SpeculativeRFHDeleted) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  GURL url_c(embedded_test_server()->GetURL("c.com", "/hung"));
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+
+  // 1) Initial state: A(B).
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = web_contents()->GetMainFrame();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+
+  // RFH B has an unload handler.
+  auto detach_filter_b = base::MakeRefCounted<DropMessageFilter>(
+      FrameMsgStart, FrameHostMsg_Detach::ID);
+  rfh_b->GetProcess()->AddFilter(detach_filter_b.get());
+  EXPECT_TRUE(ExecJs(rfh_b, "onunload=function(){}"));
+
+  // 2) Navigation from B to C. The server is slow to respond.
+  TestNavigationManager navigation_observer(web_contents(), url_c);
+  EXPECT_TRUE(ExecJs(rfh_b, JsReplace("location.href=$1;", url_c)));
+  EXPECT_TRUE(navigation_observer.WaitForRequestStart());
+  RenderFrameHostImpl* pending_rfh_c =
+      rfh_b->frame_tree_node()->render_manager()->speculative_frame_host();
+
+  // 3) While there is a speculative RenderFrameHost get the Data associated
+  // with it.
+  Data::CreateForCurrentDocument(pending_rfh_c);
+  base::WeakPtr<Data> data =
+      Data::GetForCurrentDocument(pending_rfh_c)->GetWeakPtr();
+  EXPECT_TRUE(data);
+
+  // 4) Delete the speculative RenderFrameHost by navigating from a
+  // RenderFrameHost in pending deletion.
+  RenderFrameDeletedObserver delete_speculative_c(pending_rfh_c);
+  EXPECT_TRUE(
+      ExecJs(rfh_a, JsReplace("document.querySelector('iframe').remove();")));
+  delete_speculative_c.WaitUntilDeleted();
+  EXPECT_TRUE(delete_speculative_c.deleted());
+
+  // 5) Once the speculative RenderFrameHost is deleted, the associated
+  // RenderDocumentHostUserData should be deleted.
+  EXPECT_FALSE(data);
+}
+
+// Tests that RenderDocumentHostUserData is cleared when the RenderFrameHost is
+// deleted.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, RenderFrameHostDeleted) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+
+  // 1) Navigate to a(b).
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  // 2) Get the Data associated with the rfh_b and check the data gets cleared
+  // on RenderFrameHost deletion.
+  Data::CreateForCurrentDocument(rfh_b);
+  base::WeakPtr<Data> data = Data::GetForCurrentDocument(rfh_b)->GetWeakPtr();
+  EXPECT_TRUE(data);
+
+  // 3) Detach the child frame.
+  EXPECT_TRUE(ExecJs(root, "document.querySelector('iframe').remove()"));
+
+  // 4) Once the RenderFrameHost is deleted, the associated
+  // RenderDocumentHostUserData should be deleted.
+  delete_observer_rfh_b.WaitUntilDeleted();
+  EXPECT_FALSE(data);
+}
+
+// Tests that RenderDocumentHostUserData object is not cleared when the
+// RenderFrameHost is in pending deletion state for both main frame and sub
+// frame.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
+                       CheckInPendingDeletionState) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+  std::string onunload_script = "window.onunload = function(){ while(1); }";
+  GURL url_ab(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  GURL url_c(embedded_test_server()->GetURL("c.com", "/title1.html"));
+
+  // 1) Navigate to A(B).
+  EXPECT_TRUE(NavigateToURL(shell(), url_ab));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+
+  // 2) Act as if there is a slow unload handler on rfh_a and rfh_b.
+  LeaveInPendingDeletionState(rfh_a);
+  rfh_b->SetSubframeUnloadTimeoutForTesting(base::TimeDelta::FromSeconds(30));
+  auto detach_filter = base::MakeRefCounted<DropMessageFilter>(
+      FrameMsgStart, FrameHostMsg_Detach::ID);
+  rfh_b->GetProcess()->AddFilter(detach_filter.get());
+  EXPECT_TRUE(ExecuteScript(rfh_b->frame_tree_node(), onunload_script));
+
+  // 3) Create RDHUD object for both rfh_a and rfh_b before running unload
+  // handlers.
+  Data::CreateForCurrentDocument(rfh_a);
+  Data::CreateForCurrentDocument(rfh_b);
+
+  base::WeakPtr<Data> data_a = Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  base::WeakPtr<Data> data_b = Data::GetForCurrentDocument(rfh_b)->GetWeakPtr();
+  EXPECT_TRUE(data_a);
+  EXPECT_TRUE(data_b);
+
+  // 4) Navigate from A(B) to C.
+  EXPECT_TRUE(NavigateToURL(shell(), url_c));
+
+  // 5) Check RDHUD objects |data_a| and |data_b| are not cleared when rfh_a and
+  // rfh_b are in pending deletion state.
+  EXPECT_EQ(rfh_a->lifecycle_state(),
+            RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers);
+  EXPECT_EQ(rfh_b->lifecycle_state(),
+            RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers);
+  EXPECT_TRUE(data_a);
+  EXPECT_TRUE(data_b);
+
+  EXPECT_FALSE(rfh_a->IsCurrent());
+  EXPECT_FALSE(rfh_b->IsCurrent());
+}
+
+// Tests that RenderDocumentHostUserData associated with RenderFrameHost is not
+// cleared on same document navigation.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
+                       CommitSameDocumentNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_a2(embedded_test_server()->GetURL("a.com", "/title1.html#2"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+
+  // 2) Get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(rfh_a);
+  Data* data = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data);
+
+  // 3) Navigate to A#2 (same document navigation).
+  EXPECT_TRUE(ExecJs(shell(), JsReplace("location = $1", url_a2.spec())));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(url_a2, web_contents()->GetMainFrame()->GetLastCommittedURL());
+
+  // 4) Check if the RDHUD objects are pointing to the same instance after
+  // navigation.
+  Data* data2 = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data2);
+  EXPECT_EQ(data->unique_id(), data2->unique_id());
+}
+
+// Tests that RenderDocumentHostUserData object is not cleared when navigation
+// is cancelled.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, CancelledNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+
+  // 2) Get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(rfh_a);
+  Data* data = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data);
+
+  // 3) Cancel all navigation attempts.
+  TestNavigationThrottleInserter throttle_inserter(
+      shell()->web_contents(),
+      base::BindLambdaForTesting(
+          [&](NavigationHandle* handle) -> std::unique_ptr<NavigationThrottle> {
+            auto throttle = std::make_unique<TestNavigationThrottle>(handle);
+            throttle->SetResponse(TestNavigationThrottle::WILL_START_REQUEST,
+                                  TestNavigationThrottle::SYNCHRONOUS,
+                                  NavigationThrottle::CANCEL_AND_IGNORE);
+            return throttle;
+          }));
+
+  // 4) Try navigating to B.
+  EXPECT_FALSE(NavigateToURL(shell(), url_b));
+
+  // 5) We should still be showing page A.
+  EXPECT_EQ(rfh_a, top_frame_host());
+
+  // 6) The data shouldn't be cleared in the case of cancelled navigations and
+  // should be pointing to the same instances.
+  Data* data2 = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data2);
+  EXPECT_EQ(data->unique_id(), data2->unique_id());
+}
+
+// Tests that RenderDocumentHostUserData object is cleared when a failed
+// navigation results in an error page.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, FailedNavigation) {
+  // This test is only valid if error page isolation is enabled.
+  if (!SiteIsolationPolicy::IsErrorPageIsolationEnabled(true))
+    return;
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL error_url(embedded_test_server()->GetURL("/close-socket"));
+  std::unique_ptr<URLLoaderInterceptor> url_interceptor =
+      URLLoaderInterceptor::SetupRequestFailForURL(error_url,
+                                                   net::ERR_DNS_TIMED_OUT);
+
+  // 1) Start with a successful navigation to a document.
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Get the Data associated with RenderFrameHost associated with url.
+  Data::CreateForCurrentDocument(rfh_a);
+  base::WeakPtr<Data> data = Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  EXPECT_TRUE(data);
+
+  // 3) Browser-initiated navigation to an error page.
+  NavigationHandleObserver observer(shell()->web_contents(), error_url);
+  EXPECT_FALSE(NavigateToURL(shell(), error_url));
+  EXPECT_TRUE(observer.is_error());
+  EXPECT_EQ(net::ERR_DNS_TIMED_OUT, observer.net_error_code());
+
+  // 4) The associated RenderDocumentHostUserData object should be deleted.
+  delete_observer_rfh_a.WaitUntilDeleted();
+  EXPECT_FALSE(data);
+}
+
+// Tests that RenderDocumentHostUserData object is cleared when it is neither a
+// same document navigation nor when it is stored in back-forward cache after
+// navigating away.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, CrossSiteNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(rfh_a);
+  base::WeakPtr<Data> data = Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  EXPECT_TRUE(data);
+
+  // 3) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_NE(rfh_a, top_frame_host());
+
+  // 4) Both rfh_a and RDHUD should be deleted.
+  delete_observer_rfh_a.WaitUntilDeleted();
+  EXPECT_FALSE(data);
+}
+
+// Tests that RenderDocumentHostUserData object is cleared on performing same
+// site navigation.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest, SameSiteNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a1(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_a2(embedded_test_server()->GetURL("a.com", "/title2.html"));
+
+  // 1) Navigate to A1.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a1));
+  RenderFrameHostImpl* rfh_a1 = top_frame_host();
+
+  // 2) Get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(rfh_a1);
+  base::WeakPtr<Data> data = Data::GetForCurrentDocument(rfh_a1)->GetWeakPtr();
+
+  EXPECT_TRUE(data);
+
+  // 3) Navigate to A2.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a2));
+  EXPECT_EQ(rfh_a1, top_frame_host());
+
+  // 4) The associated RenderDocumentHostUserData should be deleted.
+  EXPECT_FALSE(data);
+}
+
+// Test RenderDocumentHostUserData with BackForwardCache feature enabled.
+class RenderDocumentHostUserDataWithBackForwardCacheTest
+    : public RenderDocumentHostUserDataTest {
+ public:
+  RenderDocumentHostUserDataWithBackForwardCacheTest() {
+    scoped_feature_list_.InitAndEnableFeatureWithParameters(
+        features::kBackForwardCache,
+        {
+            // Set a very long TTL before expiration (longer than the test
+            // timeout) so tests that are expecting deletion don't pass when
+            // they shouldn't.
+            {"TimeToLiveInBackForwardCacheInSeconds", "3600"},
+        });
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
+// Tests that RenderDocumentHostUserData object is not cleared on storing and
+// restoring a page from back-forward cache.
+IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataWithBackForwardCacheTest,
+                       BackForwardCacheNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = top_frame_host();
+
+  // 2) Get the Data associated with this RenderFrameHost.
+  Data::CreateForCurrentDocument(rfh_a);
+  Data* data = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data);
+
+  //  3) Navigate to B. A should be stored in back-forward cache.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
+
+  // 4) Data associated with document shouldn't have been cleared on navigating
+  // away with BackForwardCache.
+  data = Data::GetForCurrentDocument(rfh_a);
+  EXPECT_TRUE(data);
+
+  // 5) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  Data* data_after_restore =
+      Data::GetForCurrentDocument(web_contents()->GetMainFrame());
+  EXPECT_TRUE(data);
+
+  // 6) Both the instances of Data before and after restore should point to the
+  // same object and make sure they aren't null.
+  EXPECT_EQ(data_after_restore->unique_id(), data->unique_id());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_android.cc b/chromium/content/browser/frame_host/render_frame_host_android.cc
index 0be7ea9fef5..b1bcb43fb5c 100644
--- a/chromium/content/browser/frame_host/render_frame_host_android.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_android.cc
@@ -10,7 +10,7 @@
 #include "base/android/jni_string.h"
 #include "base/android/unguessable_token_android.h"
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/android/content_jni_headers/RenderFrameHostImpl_jni.h"
@@ -149,19 +149,23 @@ jboolean RenderFrameHostAndroid::IsProcessBlocked(
 jint RenderFrameHostAndroid::PerformGetAssertionWebAuthSecurityChecks(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>&,
-    const base::android::JavaParamRef<jstring>& relying_party_id) const {
+    const base::android::JavaParamRef<jstring>& relying_party_id,
+    const base::android::JavaParamRef<jobject>& effective_origin) const {
+  url::Origin origin = url::Origin::FromJavaObject(effective_origin);
   return static_cast<int32_t>(
       render_frame_host_->PerformGetAssertionWebAuthSecurityChecks(
-          ConvertJavaStringToUTF8(env, relying_party_id)));
+          ConvertJavaStringToUTF8(env, relying_party_id), origin));
 }
 
 jint RenderFrameHostAndroid::PerformMakeCredentialWebAuthSecurityChecks(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>&,
-    const base::android::JavaParamRef<jstring>& relying_party_id) const {
+    const base::android::JavaParamRef<jstring>& relying_party_id,
+    const base::android::JavaParamRef<jobject>& effective_origin) const {
+  url::Origin origin = url::Origin::FromJavaObject(effective_origin);
   return static_cast<int32_t>(
       render_frame_host_->PerformMakeCredentialWebAuthSecurityChecks(
-          ConvertJavaStringToUTF8(env, relying_party_id)));
+          ConvertJavaStringToUTF8(env, relying_party_id), origin));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_android.h b/chromium/content/browser/frame_host/render_frame_host_android.h
index 3de7a87d4b0..fdea7884d01 100644
--- a/chromium/content/browser/frame_host/render_frame_host_android.h
+++ b/chromium/content/browser/frame_host/render_frame_host_android.h
@@ -72,12 +72,14 @@ class RenderFrameHostAndroid : public base::SupportsUserData::Data {
   jint PerformGetAssertionWebAuthSecurityChecks(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>&,
-      const base::android::JavaParamRef<jstring>&) const;
+      const base::android::JavaParamRef<jstring>&,
+      const base::android::JavaParamRef<jobject>&) const;
 
   jint PerformMakeCredentialWebAuthSecurityChecks(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>&,
-      const base::android::JavaParamRef<jstring>&) const;
+      const base::android::JavaParamRef<jstring>&,
+      const base::android::JavaParamRef<jobject>&) const;
 
   RenderFrameHostImpl* render_frame_host() const { return render_frame_host_; }
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_delegate.cc b/chromium/content/browser/frame_host/render_frame_host_delegate.cc
index 4cd3417d9bb..b6a4bd21bf5 100644
--- a/chromium/content/browser/frame_host/render_frame_host_delegate.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_delegate.cc
@@ -56,10 +56,6 @@ WebContents* RenderFrameHostDelegate::GetAsWebContents() {
   return nullptr;
 }
 
-InterstitialPage* RenderFrameHostDelegate::GetAsInterstitialPage() {
-  return nullptr;
-}
-
 void RenderFrameHostDelegate::RequestMediaAccessPermission(
     const MediaStreamRequest& request,
     MediaResponseCallback callback) {
@@ -161,11 +157,6 @@ Visibility RenderFrameHostDelegate::GetVisibility() {
   return Visibility::HIDDEN;
 }
 
-ukm::SourceId RenderFrameHostDelegate::GetUkmSourceIdForLastCommittedSource()
-    const {
-  return ukm::kInvalidSourceId;
-}
-
 ukm::SourceId RenderFrameHostDelegate::
     GetUkmSourceIdForLastCommittedSourceIncludingSameDocument() const {
   return ukm::kInvalidSourceId;
@@ -198,4 +189,17 @@ bool RenderFrameHostDelegate::HasSeenRecentScreenOrientationChange() {
   return false;
 }
 
+bool RenderFrameHostDelegate::ShowPopupMenu(
+    RenderFrameHostImpl* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+    const gfx::Rect& bounds,
+    int32_t item_height,
+    double font_size,
+    int32_t selected_item,
+    std::vector<blink::mojom::MenuItemPtr>* menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
+  return false;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_delegate.h b/chromium/content/browser/frame_host/render_frame_host_delegate.h
index 1179a5588f3..f20bbc780e7 100644
--- a/chromium/content/browser/frame_host/render_frame_host_delegate.h
+++ b/chromium/content/browser/frame_host/render_frame_host_delegate.h
@@ -27,6 +27,7 @@
 #include "content/public/common/javascript_dialog_type.h"
 #include "media/mojo/services/media_metrics_provider.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/http/http_response_headers.h"
@@ -34,9 +35,11 @@
 #include "services/device/public/mojom/wake_lock.mojom.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame.mojom-forward.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_mode.h"
@@ -79,7 +82,6 @@ class ClipboardFormatType;
 
 namespace content {
 class FrameTreeNode;
-class InterstitialPage;
 class PageState;
 class RenderFrameHostImpl;
 class SessionStorageNamespace;
@@ -248,10 +250,6 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   // not a WebContents, returns NULL.
   virtual WebContents* GetAsWebContents();
 
-  // Returns this object cast to an InterstitialPage if it is one. Returns
-  // nullptr otherwise.
-  virtual InterstitialPage* GetAsInterstitialPage();
-
   // The render frame has requested access to media devices listed in
   // |request|, and the client should grant or deny that permission by
   // calling |callback|.
@@ -483,15 +481,6 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   virtual Visibility GetVisibility();
 
   // Get the UKM source ID for current content from the last committed
-  // cross-document navigation. This is for providing data about the
-  // content to the URL-keyed metrics service. Use this method if UKM events
-  // should be attributed to the navigation that led to the creation of this
-  // document, that is, attribute events following navigations within the same
-  // document to the same source. Note: This is also exposed by the
-  // RenderWidgetHostDelegate class.
-  virtual ukm::SourceId GetUkmSourceIdForLastCommittedSource() const;
-
-  // Get the UKM source ID for current content from the last committed
   // navigation, either a cross-document or same-document navigation. This is
   // for providing data about the content to the URL-keyed metrics service.
   // Use this method if UKM events should be attributed to the latest
@@ -567,6 +556,10 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   virtual void OnPageScaleFactorChanged(RenderFrameHostImpl* source,
                                         float page_scale_factor) {}
 
+  virtual void OnTextAutosizerPageInfoChanged(
+      RenderFrameHostImpl* source,
+      blink::mojom::TextAutosizerPageInfoPtr page_info) {}
+
   // Return true if we have seen a recent orientation change, which is used to
   // decide if we should consume user activation when entering fullscreen.
   virtual bool HasSeenRecentScreenOrientationChange();
@@ -592,6 +585,35 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
           blink_widget_host,
       mojo::PendingAssociatedRemote<blink::mojom::Widget> blink_widget) {}
 
+  // Return true if the popup is shown through WebContentsObserver.
+  // BrowserPluginGuest for the guest WebContents will show the popup on Mac,
+  // then, we should skip to show the popup at RenderViewHostDelegateView.
+  virtual bool ShowPopupMenu(
+      RenderFrameHostImpl* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+      const gfx::Rect& bounds,
+      int32_t item_height,
+      double font_size,
+      int32_t selected_item,
+      std::vector<blink::mojom::MenuItemPtr>* menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection);
+
+  virtual void DidLoadResourceFromMemoryCache(
+      RenderFrameHostImpl* source,
+      const GURL& url,
+      const std::string& http_request,
+      const std::string& mime_type,
+      network::mojom::RequestDestination request_destination) {}
+
+  // Called when the renderer sends a response via DomAutomationController.
+  // For example, `window.domAutomationController.send(foo())` sends the result
+  // of foo() here.
+  virtual void DomOperationResponse(const std::string& json_string) {}
+
+  virtual void OnCookiesAccessed(RenderFrameHostImpl* render_frame_host,
+                                 const CookieAccessDetails& details) {}
+
  protected:
   virtual ~RenderFrameHostDelegate() = default;
 };
diff --git a/chromium/content/browser/frame_host/render_frame_host_factory.cc b/chromium/content/browser/frame_host/render_frame_host_factory.cc
index 38a64d03ff8..30098821951 100644
--- a/chromium/content/browser/frame_host/render_frame_host_factory.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_factory.cc
@@ -4,10 +4,9 @@
 
 #include "content/browser/frame_host/render_frame_host_factory.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ptr_util.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 
 namespace content {
@@ -23,15 +22,18 @@ std::unique_ptr<RenderFrameHostImpl> RenderFrameHostFactory::Create(
     FrameTree* frame_tree,
     FrameTreeNode* frame_tree_node,
     int32_t routing_id,
-    bool renderer_initiated_creation) {
+    const base::UnguessableToken& frame_token,
+    bool renderer_initiated_creation,
+    RenderFrameHostImpl::LifecycleState lifecycle_state) {
   if (factory_) {
     return factory_->CreateRenderFrameHost(
         site_instance, std::move(render_view_host), delegate, frame_tree,
-        frame_tree_node, routing_id, renderer_initiated_creation);
+        frame_tree_node, routing_id, frame_token, renderer_initiated_creation);
   }
   return base::WrapUnique(new RenderFrameHostImpl(
       site_instance, std::move(render_view_host), delegate, frame_tree,
-      frame_tree_node, routing_id, renderer_initiated_creation));
+      frame_tree_node, routing_id, frame_token, renderer_initiated_creation,
+      lifecycle_state));
 }
 
 // static
diff --git a/chromium/content/browser/frame_host/render_frame_host_factory.h b/chromium/content/browser/frame_host/render_frame_host_factory.h
index 44363a7a967..8860c676374 100644
--- a/chromium/content/browser/frame_host/render_frame_host_factory.h
+++ b/chromium/content/browser/frame_host/render_frame_host_factory.h
@@ -11,6 +11,8 @@
 
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
+#include "base/unguessable_token.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/common/content_export.h"
 
 namespace content {
@@ -18,7 +20,6 @@ namespace content {
 class FrameTree;
 class FrameTreeNode;
 class RenderFrameHostDelegate;
-class RenderFrameHostImpl;
 class RenderViewHostImpl;
 class SiteInstance;
 
@@ -36,7 +37,9 @@ class CONTENT_EXPORT RenderFrameHostFactory {
       FrameTree* frame_tree,
       FrameTreeNode* frame_tree_node,
       int32_t routing_id,
-      bool renderer_initiated_creation);
+      const base::UnguessableToken& frame_token,
+      bool renderer_initiated_creation,
+      RenderFrameHostImpl::LifecycleState lifecycle_state);
 
   // Returns true if there is currently a globally-registered factory.
   static bool has_factory() { return !!factory_; }
@@ -54,6 +57,7 @@ class CONTENT_EXPORT RenderFrameHostFactory {
       FrameTree* frame_tree,
       FrameTreeNode* frame_tree_node,
       int32_t routing_id,
+      const base::UnguessableToken& frame_token,
       bool renderer_initiated_creation) = 0;
 
   // Registers a factory to be called when new RenderFrameHostImpls are created.
diff --git a/chromium/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc b/chromium/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
index 2fdfc526490..cecab23e41f 100644
--- a/chromium/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
@@ -11,7 +11,6 @@
 #include "content/test/test_render_frame_host.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -34,12 +33,6 @@ class RenderFrameHostFeaturePolicyTest
   static const blink::mojom::FeaturePolicyFeature kDefaultSelfFeature =
       blink::mojom::FeaturePolicyFeature::kGeolocation;
 
-  const blink::PolicyValue sample_double_value =
-      blink::PolicyValue(2.5, blink::mojom::PolicyValueType::kDecDouble);
-  const blink::PolicyValue min_double_value =
-      blink::PolicyValue(2.0, blink::mojom::PolicyValueType::kDecDouble);
-  const blink::PolicyValue sample_bool_value = blink::PolicyValue(true);
-
   RenderFrameHost* GetMainRFH(const char* origin) {
     RenderFrameHost* result = web_contents()->GetMainFrame();
     RenderFrameHostTester::For(result)->InitializeRenderFrameIfNeeded();
@@ -57,26 +50,24 @@ class RenderFrameHostFeaturePolicyTest
 
   // The header policy should only be set once on page load, so we refresh the
   // page to simulate that.
-  void RefreshPageAndSetHeaderPolicy(
-      RenderFrameHost** rfh,
-      blink::mojom::FeaturePolicyFeature feature,
-      const std::map<std::string, blink::PolicyValue>& values) {
+  void RefreshPageAndSetHeaderPolicy(RenderFrameHost** rfh,
+                                     blink::mojom::FeaturePolicyFeature feature,
+                                     const std::vector<std::string>& origins) {
     RenderFrameHost* current = *rfh;
     SimulateNavigation(&current, current->GetLastCommittedURL());
     static_cast<TestRenderFrameHost*>(current)->DidSetFramePolicyHeaders(
-        blink::mojom::WebSandboxFlags::kNone, CreateFPHeader(feature, values),
-        {} /* document_policy_header */);
+        network::mojom::WebSandboxFlags::kNone,
+        CreateFPHeader(feature, origins), {} /* document_policy_header */);
     *rfh = current;
   }
 
-  void SetContainerPolicy(
-      RenderFrameHost* parent,
-      RenderFrameHost* child,
-      blink::mojom::FeaturePolicyFeature feature,
-      const std::map<std::string, blink::PolicyValue>& values) {
+  void SetContainerPolicy(RenderFrameHost* parent,
+                          RenderFrameHost* child,
+                          blink::mojom::FeaturePolicyFeature feature,
+                          const std::vector<std::string>& origins) {
     static_cast<TestRenderFrameHost*>(parent)->OnDidChangeFramePolicy(
-        child->GetRoutingID(), {blink::mojom::WebSandboxFlags::kNone,
-                                CreateFPHeader(feature, values),
+        child->GetRoutingID(), {network::mojom::WebSandboxFlags::kNone,
+                                CreateFPHeader(feature, origins),
                                 {} /* required_document_policy */});
   }
 
@@ -90,12 +81,11 @@ class RenderFrameHostFeaturePolicyTest
  private:
   blink::ParsedFeaturePolicy CreateFPHeader(
       blink::mojom::FeaturePolicyFeature feature,
-      const std::map<std::string, blink::PolicyValue>& values) {
+      const std::vector<std::string>& origins) {
     blink::ParsedFeaturePolicy result(1);
     result[0].feature = feature;
-    for (auto const& value : values)
-      result[0].values.insert(std::pair<url::Origin, blink::PolicyValue>(
-          url::Origin::Create(GURL(value.first)), value.second));
+    for (auto const& origin : origins)
+      result[0].allowed_origins.push_back(url::Origin::Create(GURL(origin)));
     return result;
   }
 };
@@ -115,8 +105,7 @@ TEST_F(RenderFrameHostFeaturePolicyTest, HeaderPolicy) {
 
   // Enable the feature for the child in the parent frame.
   RefreshPageAndSetHeaderPolicy(&parent, kDefaultSelfFeature,
-                                {{std::string(kOrigin1), sample_bool_value},
-                                 {std::string(kOrigin2), sample_bool_value}});
+                                {std::string(kOrigin1), std::string(kOrigin2)});
 
   // Create the child.
   RenderFrameHost* child = AddChildRFH(parent, kOrigin2);
@@ -127,14 +116,14 @@ TEST_F(RenderFrameHostFeaturePolicyTest, HeaderPolicy) {
   // Set an empty allowlist in the child to test that the policies combine
   // correctly.
   RefreshPageAndSetHeaderPolicy(&child, kDefaultSelfFeature,
-                                std::map<std::string, blink::PolicyValue>());
+                                std::vector<std::string>());
 
   EXPECT_TRUE(parent->IsFeatureEnabled(kDefaultSelfFeature));
   EXPECT_FALSE(child->IsFeatureEnabled(kDefaultSelfFeature));
 
   // Re-enable the feature in the child.
   RefreshPageAndSetHeaderPolicy(&child, kDefaultSelfFeature,
-                                {{std::string(kOrigin2), sample_bool_value}});
+                                {std::string(kOrigin2)});
   EXPECT_TRUE(child->IsFeatureEnabled(kDefaultSelfFeature));
 
   // Navigate the child. Check that the feature is disabled.
@@ -149,8 +138,7 @@ TEST_F(RenderFrameHostFeaturePolicyTest, ContainerPolicy) {
   // Set a container policy on origin 3 to give it the feature. It should not
   // be enabled because container policy will only take effect after navigation.
   SetContainerPolicy(parent, child, kDefaultSelfFeature,
-                     {{std::string(kOrigin2), sample_bool_value},
-                      {std::string(kOrigin3), sample_bool_value}});
+                     {std::string(kOrigin2), std::string(kOrigin3)});
   EXPECT_FALSE(child->IsFeatureEnabled(kDefaultSelfFeature));
 
   // Navigate the child so that the container policy takes effect.
@@ -167,12 +155,11 @@ TEST_F(RenderFrameHostFeaturePolicyTest, HeaderAndContainerPolicy) {
 
   // Set a header policy and container policy. Check that they both take effect.
   RefreshPageAndSetHeaderPolicy(&parent, kDefaultSelfFeature,
-                                {{std::string(kOrigin1), sample_bool_value},
-                                 {std::string(kOrigin2), sample_bool_value}});
+                                {std::string(kOrigin1), std::string(kOrigin2)});
 
   RenderFrameHost* child = AddChildRFH(parent, kOrigin2);
   SetContainerPolicy(parent, child, kDefaultSelfFeature,
-                     {{std::string(kOrigin3), sample_bool_value}});
+                     {std::string(kOrigin3)});
 
   // The feature should be enabled in kOrigin2, kOrigin3 but not kOrigin4.
   EXPECT_TRUE(child->IsFeatureEnabled(kDefaultSelfFeature));
@@ -184,10 +171,10 @@ TEST_F(RenderFrameHostFeaturePolicyTest, HeaderAndContainerPolicy) {
   // Change the header policy to turn off the feature. It should be disabled in
   // all children.
   RefreshPageAndSetHeaderPolicy(&parent, kDefaultSelfFeature,
-                                std::map<std::string, blink::PolicyValue>());
+                                std::vector<std::string>());
   child = AddChildRFH(parent, kOrigin2);
   SetContainerPolicy(parent, child, kDefaultSelfFeature,
-                     {{std::string(kOrigin3), sample_bool_value}});
+                     {std::string(kOrigin3)});
 
   SimulateNavigation(&child, GURL(kOrigin2));
   EXPECT_FALSE(child->IsFeatureEnabled(kDefaultSelfFeature));
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.cc b/chromium/content/browser/frame_host/render_frame_host_impl.cc
index b1ea181a908..115673d129d 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.cc
@@ -39,6 +39,7 @@
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
+#include "content/browser/bad_message.h"
 #include "content/browser/bluetooth/web_bluetooth_service_impl.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ -51,6 +52,7 @@
 #include "content/browser/file_system/file_system_manager_impl.h"
 #include "content/browser/file_system/file_system_url_loader_factory.h"
 #include "content/browser/frame_host/back_forward_cache_impl.h"
+#include "content/browser/frame_host/cookie_utils.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/file_chooser_impl.h"
@@ -62,7 +64,6 @@
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
-#include "content/browser/frame_host/navigator_impl.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/generic_sensor/sensor_provider_proxy_impl.h"
@@ -74,6 +75,7 @@
 #include "content/browser/loader/navigation_url_loader_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
 #include "content/browser/log_console_message.h"
+#include "content/browser/manifest/manifest_manager_host.h"
 #include "content/browser/media/capture/audio_mirroring_manager.h"
 #include "content/browser/media/media_interface_proxy.h"
 #include "content/browser/media/webaudio/audio_context_manager_impl.h"
@@ -99,6 +101,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/scoped_active_url.h"
+#include "content/browser/screen_enumeration/screen_enumeration_impl.h"
 #include "content/browser/service_worker/service_worker_container_host.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_object_host.h"
@@ -144,6 +147,7 @@
 #include "content/public/browser/context_menu_params.h"
 #include "content/public/browser/download_manager.h"
 #include "content/public/browser/global_routing_id.h"
+#include "content/public/browser/idle_manager.h"
 #include "content/public/browser/media_player_watch_time.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/permission_type.h"
@@ -164,7 +168,6 @@
 #include "content/public/common/origin_util.h"
 #include "content/public/common/page_visibility_state.h"
 #include "content/public/common/referrer_type_converters.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/common/three_d_api_types.h"
 #include "content/public/common/url_constants.h"
@@ -176,7 +179,6 @@
 #include "media/learning/common/value.h"
 #include "media/media_buildflags.h"
 #include "media/mojo/mojom/remoting.mojom.h"
-#include "media/mojo/services/media_interface_provider.h"
 #include "media/mojo/services/video_decode_perf_history.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
@@ -187,9 +189,14 @@
 #include "services/device/public/mojom/sensor_provider.mojom.h"
 #include "services/device/public/mojom/wake_lock.mojom.h"
 #include "services/device/public/mojom/wake_lock_context.mojom.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/is_potentially_trustworthy.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
+#include "services/network/public/mojom/cookie_access_observer.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "storage/browser/blob/blob_storage_context.h"
@@ -206,6 +213,8 @@
 #include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "third_party/blink/public/mojom/frame/media_player_action.mojom.h"
@@ -247,6 +256,28 @@ using base::TimeDelta;
 
 namespace content {
 
+struct RenderFrameHostOrProxy {
+  RenderFrameHostImpl* const frame;
+  RenderFrameProxyHost* const proxy;
+
+  RenderFrameHostOrProxy(RenderFrameHostImpl* frame,
+                         RenderFrameProxyHost* proxy)
+      : frame(frame), proxy(proxy) {
+    DCHECK(!frame || !proxy)
+        << "Both frame and proxy can't be non-null at the same time";
+  }
+
+  explicit operator bool() { return frame || proxy; }
+
+  FrameTreeNode* GetFrameTreeNode() {
+    if (frame)
+      return frame->frame_tree_node();
+    if (proxy)
+      return proxy->frame_tree_node();
+    return nullptr;
+  }
+};
+
 namespace {
 
 #if defined(OS_ANDROID)
@@ -405,13 +436,32 @@ void ForEachFrame(RenderFrameHostImpl* root_frame_host,
   }
 }
 
-void LookupRenderFrameHostOrProxy(int process_id,
-                                  int routing_id,
-                                  RenderFrameHostImpl** rfh,
-                                  RenderFrameProxyHost** rfph) {
-  *rfh = RenderFrameHostImpl::FromID(process_id, routing_id);
-  if (*rfh == nullptr)
-    *rfph = RenderFrameProxyHost::FromID(process_id, routing_id);
+RenderFrameHostOrProxy LookupRenderFrameHostOrProxy(int process_id,
+                                                    int routing_id) {
+  RenderFrameHostImpl* rfh =
+      RenderFrameHostImpl::FromID(process_id, routing_id);
+  RenderFrameProxyHost* proxy = nullptr;
+  if (!rfh)
+    proxy = RenderFrameProxyHost::FromID(process_id, routing_id);
+  return RenderFrameHostOrProxy(rfh, proxy);
+}
+
+RenderFrameHostOrProxy LookupRenderFrameHostOrProxy(
+    int process_id,
+    const base::UnguessableToken& frame_token) {
+  auto it = g_token_frame_map.Get().find(frame_token);
+  RenderFrameHostImpl* rfh = nullptr;
+  RenderFrameProxyHost* proxy = nullptr;
+  if (it != g_token_frame_map.Get().end()) {
+    // The check against |process_id| isn't strictly necessary, but represents
+    // an extra level of protection against a renderer trying to force a frame
+    // token.
+    rfh =
+        process_id == it->second->GetProcess()->GetID() ? it->second : nullptr;
+  } else {
+    proxy = RenderFrameProxyHost::FromFrameToken(process_id, frame_token);
+  }
+  return RenderFrameHostOrProxy(rfh, proxy);
 }
 
 // Takes the lower 31 bits of the metric-name-hash of a Mojo interface |name|.
@@ -431,6 +481,12 @@ void LogRendererKillCrashKeys(const GURL& site_url) {
                                  site_url.possibly_invalid_spec());
 }
 
+void LogCanCommitOriginAndUrlFailureReason(const std::string& failure_reason) {
+  static auto* failure_reason_key = base::debug::AllocateCrashKeyString(
+      "rfhi_can_commit_failure_reason", base::debug::CrashKeySize::Size64);
+  base::debug::SetCrashKeyString(failure_reason_key, failure_reason);
+}
+
 url::Origin GetOriginForURLLoaderFactoryUnchecked(
     NavigationRequest* navigation_request) {
   // Return a safe opaque origin when there is no |navigation_request| (e.g.
@@ -556,13 +612,13 @@ const uint32_t kMaxCookieSameSiteDeprecationUrls = 20;
 
 void RecordCrossOriginIsolationMetrics(RenderFrameHostImpl* rfh) {
   ContentBrowserClient* client = GetContentClient()->browser();
-  if (rfh->cross_origin_opener_policy() ==
-      network::mojom::CrossOriginOpenerPolicy::kSameOrigin) {
+  if (rfh->cross_origin_opener_policy().value ==
+      network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin) {
     client->LogWebFeatureForCurrentPage(
         rfh, blink::mojom::WebFeature::kCrossOriginOpenerPolicySameOrigin);
   }
-  if (rfh->cross_origin_opener_policy() ==
-      network::mojom::CrossOriginOpenerPolicy::kSameOriginAllowPopups) {
+  if (rfh->cross_origin_opener_policy().value ==
+      network::mojom::CrossOriginOpenerPolicyValue::kSameOriginAllowPopups) {
     client->LogWebFeatureForCurrentPage(
         rfh, blink::mojom::WebFeature::
                  kCrossOriginOpenerPolicySameOriginAllowPopups);
@@ -574,8 +630,8 @@ void RecordCrossOriginIsolationMetrics(RenderFrameHostImpl* rfh) {
         rfh, blink::mojom::WebFeature::kCrossOriginEmbedderPolicyRequireCorp);
   }
 
-  if ((rfh->cross_origin_opener_policy() ==
-       network::mojom::CrossOriginOpenerPolicy::kSameOrigin) &&
+  if ((rfh->cross_origin_opener_policy().value ==
+       network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin) &&
       (rfh->cross_origin_embedder_policy().value ==
        network::mojom::CrossOriginEmbedderPolicyValue::kRequireCorp)) {
     client->LogWebFeatureForCurrentPage(
@@ -583,6 +639,26 @@ void RecordCrossOriginIsolationMetrics(RenderFrameHostImpl* rfh) {
   }
 }
 
+// Subframe navigations can optionally have associated Trust Tokens operations
+// (https://github.com/wicg/trust-token-api). If the operation's type is
+// "redemption" or "signing" (as opposed to "issuance"), the parent's frame
+// needs to have the trust-token-redemption Feature Policy feature enabled.
+bool ParentNeedsTrustTokenFeaturePolicy(
+    const mojom::BeginNavigationParams& begin_params) {
+  if (!begin_params.trust_token_params)
+    return false;
+
+  switch (begin_params.trust_token_params->type) {
+    case network::mojom::TrustTokenOperationType::kRedemption:
+    case network::mojom::TrustTokenOperationType::kSigning:
+      return true;
+    case network::mojom::TrustTokenOperationType::kIssuance:
+      return false;
+  }
+  NOTREACHED();
+  return false;
+}
+
 }  // namespace
 
 bool CreateNewHostForCrashedFrame() {
@@ -718,17 +794,16 @@ RenderFrameHostImpl::RenderFrameHostImpl(
     FrameTree* frame_tree,
     FrameTreeNode* frame_tree_node,
     int32_t routing_id,
-    bool renderer_initiated_creation)
+    const base::UnguessableToken& frame_token,
+    bool renderer_initiated_creation,
+    LifecycleState lifecycle_state)
     : render_view_host_(std::move(render_view_host)),
       delegate_(delegate),
       site_instance_(static_cast<SiteInstanceImpl*>(site_instance)),
       process_(site_instance->GetProcess()),
       frame_tree_(frame_tree),
       frame_tree_node_(frame_tree_node),
-      // If it has a parent, that parent must have a RFH.
-      parent_(frame_tree_node_->parent()
-                  ? frame_tree_node_->parent()->current_frame_host()
-                  : nullptr),
+      parent_(frame_tree_node_->parent()),
       routing_id_(routing_id),
       is_waiting_for_unload_ack_(false),
       render_frame_created_(false),
@@ -754,14 +829,18 @@ RenderFrameHostImpl::RenderFrameHostImpl(
           nullptr,
           base::OnTaskRunnerDeleter(base::CreateSequencedTaskRunner(
               {ServiceWorkerContext::GetCoreThreadId()}))),
-      active_sandbox_flags_(blink::mojom::WebSandboxFlags::kNone),
+      active_sandbox_flags_(network::mojom::WebSandboxFlags::kNone),
+      frame_token_(frame_token),
       keep_alive_timeout_(base::TimeDelta::FromSeconds(30)),
       subframe_unload_timeout_(base::TimeDelta::FromMilliseconds(
           RenderViewHostImpl::kUnloadTimeoutMS)),
       commit_callback_interceptor_(nullptr),
       media_device_id_salt_base_(
-          BrowserContext::CreateRandomMediaDeviceIDSalt()) {
+          BrowserContext::CreateRandomMediaDeviceIDSalt()),
+      lifecycle_state_(lifecycle_state) {
   DCHECK(delegate_);
+  DCHECK(lifecycle_state_ == LifecycleState::kSpeculative ||
+         lifecycle_state_ == LifecycleState::kActive);
 
   GetProcess()->AddRoute(routing_id_, this);
   g_routing_id_frame_map.Get().emplace(
@@ -771,12 +850,11 @@ RenderFrameHostImpl::RenderFrameHostImpl(
   process_->AddObserver(this);
   GetSiteInstance()->IncrementActiveFrameCount();
 
-  if (frame_tree_node_->parent()) {
+  if (parent_) {
     cross_origin_embedder_policy_ = parent_->cross_origin_embedder_policy();
 
     // New child frames should inherit the nav_entry_id of their parent.
-    set_nav_entry_id(
-        frame_tree_node_->parent()->current_frame_host()->nav_entry_id());
+    set_nav_entry_id(parent_->nav_entry_id());
   }
 
   SetUpMojoIfNeeded();
@@ -825,7 +903,7 @@ RenderFrameHostImpl::RenderFrameHostImpl(
 #endif  // defined(OS_ANDROID)
     }
 
-    if (!frame_tree_node_->parent())
+    if (is_main_frame())
       GetLocalRenderWidgetHost()->SetIntersectsViewport(true);
     GetLocalRenderWidgetHost()->SetFrameDepth(frame_tree_node_->depth());
     GetLocalRenderWidgetHost()->SetFrameInputHandler(
@@ -845,9 +923,9 @@ RenderFrameHostImpl::RenderFrameHostImpl(
   // of the parent (in case of a new iframe) or the opener (in case of a new
   // window). This is necessary to correctly enforce CSP during the initial
   // navigation.
-  FrameTreeNode* frame_owner = frame_tree_node_->parent()
-                                   ? frame_tree_node_->parent()
-                                   : frame_tree_node_->opener();
+  FrameTreeNode* frame_owner =
+      frame_tree_node_->parent() ? frame_tree_node_->parent()->frame_tree_node()
+                                 : frame_tree_node_->opener();
   if (frame_owner)
     CSPContext::SetSelf(frame_owner->current_origin());
 }
@@ -904,24 +982,24 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
   //    main RenderFrame.
   // 2. The RenderFrame can be unloaded. In this case, the browser sends a
   //    UnfreezableFrameMsg_Unload for the RenderFrame to replace itself with a
-  //    RenderFrameProxy and release its associated resources. |unload_state_|
-  //    is advanced to UnloadState::InProgress to track that this IPC is in
-  //    flight.
+  //    RenderFrameProxy and release its associated resources.
+  //    |lifecycle_state_| is advanced to LifeCycleState::kRunningUnloadHandlers
+  //    to track that this IPC is in flight.
   // 3. The RenderFrame can be detached, as part of removing a subtree (due to
   //    navigation, unload, or DOM mutation). In this case, the browser sends
   //    a UnfreezableFrameMsg_Delete for the RenderFrame to detach itself and
   //    release its associated resources. If the subframe contains an unload
-  //    handler, |unload_state_| is advanced to UnloadState::InProgress to track
-  //    that the detach is in progress; otherwise, it is advanced directly to
-  //    UnloadState::Completed.
+  //    handler, |lifecycle_state_| is advanced to
+  //    LifeCycleState::kRunningUnloadHandlers to track that the detach is in
+  //    progress; otherwise, it is advanced directly to
+  //    LifeCycleState::kReadyToBeDeleted.
   //
   // The browser side gives the renderer a small timeout to finish processing
   // unload / detach messages. When the timeout expires, the RFH will be
   // removed regardless of whether or not the renderer acknowledged that it
   // completed the work, to avoid indefinitely leaking browser-side state. To
   // avoid leaks, ~RenderFrameHostImpl still validates that the appropriate
-  // cleanup IPC was sent to the renderer, by checking that |unload_state_| !=
-  // UnloadState::NotRun.
+  // cleanup IPC was sent to the renderer, by checking IsPendingDeletion().
   //
   // TODO(dcheng): Due to how frame detach is signalled today, there are some
   // bugs in this area. In particular, subtree detach is reported from the
@@ -1017,17 +1095,17 @@ void RenderFrameHostImpl::AudioContextPlaybackStopped(int audio_context_id) {
 }
 
 // The current frame went into the BackForwardCache.
-void RenderFrameHostImpl::EnterBackForwardCache() {
+void RenderFrameHostImpl::DidEnterBackForwardCache() {
   TRACE_EVENT0("navigation", "RenderFrameHostImpl::EnterBackForwardCache");
   DCHECK(IsBackForwardCacheEnabled());
-  DCHECK(!is_in_back_forward_cache_);
-  is_in_back_forward_cache_ = true;
+  DCHECK_EQ(lifecycle_state_, LifecycleState::kActive);
+  SetLifecycleState(LifecycleState::kInBackForwardCache);
   // Pages in the back-forward cache are automatically evicted after a certain
   // time.
   if (!GetParent())
     StartBackForwardCacheEvictionTimer();
   for (auto& child : children_)
-    child->current_frame_host()->EnterBackForwardCache();
+    child->current_frame_host()->DidEnterBackForwardCache();
 
   if (service_worker_container_hosts_.empty())
     return;
@@ -1047,15 +1125,14 @@ void RenderFrameHostImpl::EnterBackForwardCache() {
 }
 
 // The frame as been restored from the BackForwardCache.
-void RenderFrameHostImpl::LeaveBackForwardCache() {
+void RenderFrameHostImpl::WillLeaveBackForwardCache() {
   TRACE_EVENT0("navigation", "RenderFrameHostImpl::LeaveBackForwardCache");
   DCHECK(IsBackForwardCacheEnabled());
-  DCHECK(is_in_back_forward_cache_);
-  is_in_back_forward_cache_ = false;
+  DCHECK_EQ(lifecycle_state_, LifecycleState::kInBackForwardCache);
   if (back_forward_cache_eviction_timer_.IsRunning())
     back_forward_cache_eviction_timer_.Stop();
   for (auto& child : children_)
-    child->current_frame_host()->LeaveBackForwardCache();
+    child->current_frame_host()->WillLeaveBackForwardCache();
 
   if (service_worker_container_hosts_.empty())
     return;
@@ -1080,7 +1157,7 @@ RenderFrameHostImpl::TakeLastCommitParams() {
 }
 
 void RenderFrameHostImpl::StartBackForwardCacheEvictionTimer() {
-  DCHECK(is_in_back_forward_cache_);
+  DCHECK(IsInBackForwardCache());
   base::TimeDelta evict_after =
       BackForwardCacheImpl::GetTimeToLiveInBackForwardCache();
   NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
@@ -1136,6 +1213,8 @@ void RenderFrameHostImpl::OnPortalActivated(
                   kRejectedDueToPredecessorNavigation:
               case blink::mojom::PortalActivateResult::
                   kRejectedDueToPortalNotReady:
+              case blink::mojom::PortalActivateResult::
+                  kRejectedDueToErrorInPortal:
               case blink::mojom::PortalActivateResult::kDisconnected:
               case blink::mojom::PortalActivateResult::kAbortedDueToBug:
                 // The renderer is misbehaving.
@@ -1227,9 +1306,7 @@ base::UnguessableToken RenderFrameHostImpl::GetDevToolsFrameToken() {
 
 base::Optional<base::UnguessableToken>
 RenderFrameHostImpl::GetEmbeddingToken() {
-  if (!IsCurrent())
-    return base::nullopt;
-  return frame_tree_node_->GetEmbeddingToken();
+  return embedding_token_;
 }
 
 const std::string& RenderFrameHostImpl::GetFrameName() {
@@ -1263,7 +1340,14 @@ const url::Origin& RenderFrameHostImpl::GetLastCommittedOrigin() {
 }
 
 const net::NetworkIsolationKey& RenderFrameHostImpl::GetNetworkIsolationKey() {
-  return network_isolation_key_;
+  DCHECK(!isolation_info_.IsEmpty());
+  return isolation_info_.network_isolation_key();
+}
+
+const net::IsolationInfo&
+RenderFrameHostImpl::GetIsolationInfoForSubresources() {
+  DCHECK(!isolation_info_.IsEmpty());
+  return isolation_info_;
 }
 
 void RenderFrameHostImpl::GetCanonicalUrlForSharing(
@@ -1358,7 +1442,7 @@ void RenderFrameHostImpl::MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
   }
 }
 
-bool RenderFrameHostImpl::IsSandboxed(blink::mojom::WebSandboxFlags flags) {
+bool RenderFrameHostImpl::IsSandboxed(network::mojom::WebSandboxFlags flags) {
   if (base::FeatureList::IsEnabled(features::kFeaturePolicyForSandbox)) {
     blink::mojom::FeaturePolicyFeature feature =
         blink::FeaturePolicy::FeatureForSandboxFlag(flags);
@@ -1561,15 +1645,9 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeOpener, OnDidChangeOpener)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeFramePolicy,
                         OnDidChangeFramePolicy)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeFrameOwnerProperties,
-                        OnDidChangeFrameOwnerProperties)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStopLoading, OnDidStopLoading)
     IPC_MESSAGE_HANDLER(FrameHostMsg_SelectionChanged, OnSelectionChanged)
     IPC_MESSAGE_HANDLER(FrameHostMsg_FrameDidCallFocus, OnFrameDidCallFocus)
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_HidePopup, OnHidePopup)
-#endif
   IPC_END_MESSAGE_MAP()
 
   // No further actions here, since we may have been deleted.
@@ -1606,7 +1684,7 @@ void RenderFrameHostImpl::AccessibilityPerformAction(
   render_accessibility_->PerformAction(action_data);
 }
 
-bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
+bool RenderFrameHostImpl::AccessibilityViewHasFocus() {
   if (!is_active())
     return false;
 
@@ -1625,7 +1703,7 @@ void RenderFrameHostImpl::AccessibilityViewSetFocus() {
     view->Focus();
 }
 
-gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
+gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() {
   if (!is_active())
     return gfx::Rect();
 
@@ -1635,7 +1713,7 @@ gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
   return gfx::Rect();
 }
 
-float RenderFrameHostImpl::AccessibilityGetDeviceScaleFactor() const {
+float RenderFrameHostImpl::AccessibilityGetDeviceScaleFactor() {
   if (!is_active())
     return 1.0f;
 
@@ -1671,7 +1749,7 @@ RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
   // Only the main frame's current frame host is connected to the native
   // widget tree for accessibility, so return null if this is queried on
   // any other frame.
-  if (!is_active() || frame_tree_node()->parent() || !IsCurrent())
+  if (!is_active() || !is_main_frame() || !IsCurrent())
     return gfx::kNullAcceleratedWidget;
 
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
@@ -1711,7 +1789,7 @@ WebContents* RenderFrameHostImpl::AccessibilityWebContents() {
   return delegate()->GetAsWebContents();
 }
 
-bool RenderFrameHostImpl::AccessibilityIsMainFrame() const {
+bool RenderFrameHostImpl::AccessibilityIsMainFrame() {
   if (!is_active())
     return false;
   return frame_tree_node()->IsMainFrame();
@@ -1761,10 +1839,10 @@ void RenderFrameHostImpl::RenderProcessExited(
   has_before_unload_handler_ = false;
   has_unload_handler_ = false;
 
-  if (unload_state_ != UnloadState::NotRun) {
+  if (IsPendingDeletion()) {
     // If the process has died, we don't need to wait for the ACK. Complete the
     // deletion immediately.
-    unload_state_ = UnloadState::Completed;
+    SetLifecycleState(LifecycleState::kReadyToBeDeleted);
     DCHECK(children_.empty());
     PendingDeletionCheckCompleted();
     // |this| is deleted. Don't add any more code at this point in the function.
@@ -1785,7 +1863,7 @@ void RenderFrameHostImpl::RenderProcessGone(
     const ChildProcessTerminationInfo& info) {
   DCHECK_EQ(site_instance_.get(), site_instance);
 
-  if (is_in_back_forward_cache_) {
+  if (IsInBackForwardCache()) {
     EvictFromBackForwardCacheWithReason(
         info.status == base::TERMINATION_STATUS_PROCESS_CRASHED
             ? BackForwardCacheMetrics::NotRestoredReason::
@@ -1918,6 +1996,7 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
   params->parent_routing_id = parent_routing_id;
   params->previous_sibling_routing_id = previous_sibling_routing_id;
   params->replication_state = frame_tree_node()->current_replication_state();
+  params->frame_token = frame_token_;
   params->devtools_frame_token = frame_tree_node()->devtools_frame_token();
 
   // Normally, the replication state contains effective frame policy, excluding
@@ -2004,7 +2083,7 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
 }
 
 void RenderFrameHostImpl::DeleteRenderFrame(FrameDeleteIntention intent) {
-  if (unload_state_ != UnloadState::NotRun)
+  if (IsPendingDeletion())
     return;
 
   if (render_frame_created_) {
@@ -2029,8 +2108,10 @@ void RenderFrameHostImpl::DeleteRenderFrame(FrameDeleteIntention intent) {
     }
   }
 
-  unload_state_ =
-      has_unload_handler() ? UnloadState::InProgress : UnloadState::Completed;
+  LifecycleState lifecycle_state = has_unload_handler()
+                                       ? LifecycleState::kRunningUnloadHandlers
+                                       : LifecycleState::kReadyToBeDeleted;
+  SetLifecycleState(lifecycle_state);
 }
 
 void RenderFrameHostImpl::SetRenderFrameCreated(bool created) {
@@ -2080,6 +2161,15 @@ void RenderFrameHostImpl::SetRenderFrameCreated(bool created) {
       GetRemoteAssociatedInterfaces()->GetInterface(&frame_bindings_control_);
     frame_bindings_control_->AllowBindings(enabled_bindings_);
   }
+
+  // Clear all the user data associated with this RenderFrameHost in case if
+  // the renderer crashes and the RenderFrameHost still stays alive.
+  if (!created)
+    document_associated_data_.ClearAllUserData();
+}
+
+void RenderFrameHostImpl::SwapIn() {
+  GetNavigationControl()->SwapIn();
 }
 
 void RenderFrameHostImpl::Init() {
@@ -2096,8 +2186,7 @@ void RenderFrameHostImpl::Init() {
         std::move(pending_navigate_->navigation_client),
         std::move(pending_navigate_->navigation_initiator),
         EnsurePrefetchedSignedExchangeCache(),
-        web_bundle_handle_ ? web_bundle_handle_->MaybeCreateTracker()
-                           : nullptr);
+        MaybeCreateWebBundleHandleTracker());
     pending_navigate_.reset();
   }
 }
@@ -2141,19 +2230,20 @@ void RenderFrameHostImpl::OnCreateChildFrame(
         new_interface_provider_provider_receiver,
     mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>
         browser_interface_broker_receiver,
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const std::string& frame_name,
     const std::string& frame_unique_name,
     bool is_created_by_script,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const blink::FramePolicy& frame_policy,
     const blink::mojom::FrameOwnerProperties& frame_owner_properties,
-    const blink::FrameOwnerElementType owner_type) {
+    const blink::mojom::FrameOwnerElementType owner_type) {
   // TODO(lukasza): Call ReceivedBadMessage when |frame_unique_name| is empty.
   DCHECK(!frame_unique_name.empty());
   DCHECK(new_interface_provider_provider_receiver.is_valid());
   DCHECK(browser_interface_broker_receiver.is_valid());
-  if (owner_type == blink::FrameOwnerElementType::kNone) {
+  if (owner_type == blink::mojom::FrameOwnerElementType::kNone) {
     // Any child frame must have a HTMLFrameOwnerElement in its parent document
     // and therefore the corresponding type of kNone (specific to main frames)
     // is invalid.
@@ -2172,11 +2262,11 @@ void RenderFrameHostImpl::OnCreateChildFrame(
   // |browser_interface_broker_receiver| and |devtools_frame_token| were
   // generated on the browser's IO thread and not taken from the renderer
   // process.
-  frame_tree_->AddFrame(frame_tree_node_, GetProcess()->GetID(), new_routing_id,
+  frame_tree_->AddFrame(this, GetProcess()->GetID(), new_routing_id,
                         std::move(new_interface_provider_provider_receiver),
                         std::move(browser_interface_broker_receiver), scope,
                         frame_name, frame_unique_name, is_created_by_script,
-                        devtools_frame_token, frame_policy,
+                        frame_token, devtools_frame_token, frame_policy,
                         frame_owner_properties, was_discarded_, owner_type);
 }
 
@@ -2242,97 +2332,99 @@ const url::Origin& RenderFrameHostImpl::ComputeTopFrameOrigin(
   return host->GetLastCommittedOrigin();
 }
 
-net::SiteForCookies RenderFrameHostImpl::ComputeSiteForCookiesForNavigation(
+net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoForNavigation(
     const GURL& destination) const {
-  // For top-level navigation, |site_for_cookies| will always be the destination
-  // URL.
-  if (frame_tree_node_->IsMainFrame())
-    return net::SiteForCookies::FromUrl(destination);
-
-  // Check if everything above the frame being navigated is consistent. It's OK
-  // to skip checking the frame itself since it will be validated against
-  // |site_for_cookies| anyway.
-  return ComputeSiteForCookiesInternal(parent_,
-                                       destination.SchemeIsCryptographic());
+  net::IsolationInfo::RedirectMode redirect_mode =
+      frame_tree_node_->IsMainFrame()
+          ? net::IsolationInfo::RedirectMode::kUpdateTopFrame
+          : net::IsolationInfo::RedirectMode::kUpdateFrameOnly;
+  return ComputeIsolationInfoInternal(url::Origin::Create(destination),
+                                      redirect_mode);
 }
 
 net::SiteForCookies RenderFrameHostImpl::ComputeSiteForCookies() {
-  return ComputeSiteForCookiesInternal(
-      this, GetLastCommittedURL().SchemeIsCryptographic());
+  return isolation_info_.site_for_cookies();
 }
 
-net::SiteForCookies RenderFrameHostImpl::ComputeSiteForCookiesInternal(
-    const RenderFrameHostImpl* render_frame_host,
-    bool is_origin_secure) const {
-#if defined(OS_ANDROID)
-  // On Android, a base URL can be set for the frame. If this the case, it is
-  // the URL to use for cookies.
-  NavigationEntry* last_committed_entry =
-      frame_tree_node_->navigator()->GetController()->GetLastCommittedEntry();
-  if (last_committed_entry &&
-      !last_committed_entry->GetBaseURLForDataURL().is_empty()) {
-    return net::SiteForCookies::FromUrl(
-        last_committed_entry->GetBaseURLForDataURL());
-  }
-#endif
+net::IsolationInfo RenderFrameHostImpl::ComputeIsolationInfoInternal(
+    const url::Origin& frame_origin,
+    net::IsolationInfo::RedirectMode redirect_mode) const {
+  url::Origin top_frame_origin = ComputeTopFrameOrigin(frame_origin);
 
-  const url::Origin& top_document_origin =
-      ComputeTopFrameOrigin(render_frame_host->last_committed_origin_);
-  net::SiteForCookies candidate =
-      net::SiteForCookies::FromOrigin(top_document_origin);
+  net::SiteForCookies candidate_site_for_cookies =
+      net::SiteForCookies::FromOrigin(top_frame_origin);
 
   if (GetContentClient()
           ->browser()
           ->ShouldTreatURLSchemeAsFirstPartyWhenTopLevel(
-              top_document_origin.scheme(), is_origin_secure)) {
-    return candidate;
+              top_frame_origin.scheme(),
+              GURL::SchemeIsCryptographic(frame_origin.scheme()))) {
+    return net::IsolationInfo::Create(redirect_mode, top_frame_origin,
+                                      frame_origin, candidate_site_for_cookies);
   }
 
-  // Make sure every ancestors are same-domain with the main document. Otherwise
-  // this will be a 3rd party cookie.
-  for (const RenderFrameHostImpl* rfh = render_frame_host; rfh;
+  // Make sure all ancestors have origins consistent with the candidate
+  // SiteForCookies of the main document. Otherwise, SameSite cookies may not be
+  // used. For frame requests, it's OK to skip checking the frame itself since
+  // each request will be validated against |site_for_cookies| anyway.
+  for (const RenderFrameHostImpl* rfh = this->parent_; rfh;
        rfh = rfh->parent_) {
-    if (!candidate.IsEquivalent(
+    if (!candidate_site_for_cookies.IsEquivalent(
             net::SiteForCookies::FromOrigin(rfh->last_committed_origin_))) {
-      return net::SiteForCookies();
+      return net::IsolationInfo::Create(redirect_mode, top_frame_origin,
+                                        frame_origin, net::SiteForCookies());
     }
+    candidate_site_for_cookies.MarkIfCrossScheme(rfh->last_committed_origin_);
+  }
+
+  // If |redirect_mode| is kUpdateNothing, then IsolationInfo is being computed
+  // for subresource requests. In that case, also need to check the
+  // SiteForCookies against the frame origin.
+  if (redirect_mode == net::IsolationInfo::RedirectMode::kUpdateNothing &&
+      !candidate_site_for_cookies.IsEquivalent(
+          net::SiteForCookies::FromOrigin(frame_origin))) {
+    return net::IsolationInfo::Create(redirect_mode, top_frame_origin,
+                                      frame_origin, net::SiteForCookies());
   }
 
-  return candidate;
+  return net::IsolationInfo::Create(redirect_mode, top_frame_origin,
+                                    frame_origin, candidate_site_for_cookies);
 }
 
-void RenderFrameHostImpl::SetOriginAndNetworkIsolationKeyOfNewFrame(
+void RenderFrameHostImpl::SetOriginAndIsolationInfoOfNewFrame(
     const url::Origin& new_frame_creator) {
   // This method should only be called for *new* frames, that haven't committed
   // a navigation yet.
   DCHECK(!has_committed_any_navigation_);
   DCHECK(GetLastCommittedOrigin().opaque());
-  DCHECK(network_isolation_key_.IsEmpty());
+  DCHECK(isolation_info_.IsEmpty());
 
   // Calculate and set |new_frame_origin|.
   bool new_frame_should_be_sandboxed =
-      blink::mojom::WebSandboxFlags::kOrigin ==
+      network::mojom::WebSandboxFlags::kOrigin ==
       (frame_tree_node()->active_sandbox_flags() &
-       blink::mojom::WebSandboxFlags::kOrigin);
+       network::mojom::WebSandboxFlags::kOrigin);
   url::Origin new_frame_origin = new_frame_should_be_sandboxed
                                      ? new_frame_creator.DeriveNewOpaqueOrigin()
                                      : new_frame_creator;
-  network_isolation_key_ = net::NetworkIsolationKey(
-      ComputeTopFrameOrigin(new_frame_origin), new_frame_origin);
+  isolation_info_ = ComputeIsolationInfoInternal(
+      new_frame_origin, net::IsolationInfo::RedirectMode::kUpdateNothing);
   SetLastCommittedOrigin(new_frame_origin);
 }
 
 FrameTreeNode* RenderFrameHostImpl::AddChild(
     std::unique_ptr<FrameTreeNode> child,
     int process_id,
-    int frame_routing_id) {
+    int frame_routing_id,
+    const base::UnguessableToken& frame_token) {
   // Child frame must always be created in the same process as the parent.
   CHECK_EQ(process_id, GetProcess()->GetID());
 
   // Initialize the RenderFrameHost for the new node.  We always create child
   // frames in the same SiteInstance as the current frame, and they can swap to
   // a different one if they navigate away.
-  child->render_manager()->InitChild(GetSiteInstance(), frame_routing_id);
+  child->render_manager()->InitChild(GetSiteInstance(), frame_routing_id,
+                                     frame_token);
 
   // Other renderer processes in this BrowsingInstance may need to find out
   // about the new frame.  Create a proxy for the child frame in all
@@ -2341,10 +2433,9 @@ FrameTreeNode* RenderFrameHostImpl::AddChild(
   frame_tree_node_->render_manager()->CreateProxiesForChildFrame(child.get());
 
   // When the child is added, it hasn't committed any navigation yet - its
-  // initial empty document should inherit the origin and network isolation key
-  // of its parent (the origin may change after the first commit). See also
-  // https://crbug.com/932067.
-  child->current_frame_host()->SetOriginAndNetworkIsolationKeyOfNewFrame(
+  // initial empty document should inherit the origin of its parent (the origin
+  // may change after the first commit). See also https://crbug.com/932067.
+  child->current_frame_host()->SetOriginAndIsolationInfoOfNewFrame(
       GetLastCommittedOrigin());
 
   children_.push_back(std::move(child));
@@ -2417,17 +2508,23 @@ void RenderFrameHostImpl::OnDetach() {
     return;
   }
 
-  if (unload_state_ != UnloadState::NotRun) {
+  if (IsPendingDeletion()) {
     // The frame is pending deletion. FrameHostMsg_Detach is used to confirm
-    // its unload handlers ran.
-    unload_state_ = UnloadState::Completed;
+    // its unload handlers ran. Note that it is possible for a frame to already
+    // be in kReadyToBeDeleted. This happens when this RenderFrameHost is
+    // pending deletion and is waiting on one of its children to run its unload
+    // handler. While running it, it can request its parent to detach itself.
+    // See test: SitePerProcessBrowserTest.PartialUnloadHandler.
+    if (lifecycle_state_ != LifecycleState::kReadyToBeDeleted)
+      SetLifecycleState(LifecycleState::kReadyToBeDeleted);
     PendingDeletionCheckCompleted();  // Can delete |this|.
     return;
   }
 
   // This frame is being removed by the renderer, and it has already executed
   // its unload handler.
-  unload_state_ = UnloadState::Completed;
+  SetLifecycleState(LifecycleState::kReadyToBeDeleted);
+
   // Before completing the removal, we still need to wait for all of its
   // descendant frames to execute unload handlers. Start executing those
   // handlers now.
@@ -2495,11 +2592,12 @@ void RenderFrameHostImpl::OnOpenURL(const FrameHostMsg_OpenURL_Params& params) {
                validated_url.possibly_invalid_spec());
 
   frame_tree_node_->navigator()->RequestOpenURL(
-      this, validated_url, params.initiator_origin, params.post_body,
-      params.extra_headers, params.referrer, params.disposition,
-      params.should_replace_current_entry, params.user_gesture,
-      params.triggering_event_info, params.href_translate,
-      std::move(blob_url_loader_factory));
+      this, validated_url,
+      GlobalFrameRoutingId(GetProcess()->GetID(), params.initiator_routing_id),
+      params.initiator_origin, params.post_body, params.extra_headers,
+      params.referrer, params.disposition, params.should_replace_current_entry,
+      params.user_gesture, params.triggering_event_info, params.href_translate,
+      std::move(blob_url_loader_factory), params.impression);
 }
 
 void RenderFrameHostImpl::CancelInitialHistoryLoad() {
@@ -2564,6 +2662,22 @@ void RenderFrameHostImpl::DidCommitBackForwardCacheNavigation(
   OnDidStopLoading();
 }
 
+void RenderFrameHostImpl::SetEmbeddingToken(
+    const base::Optional<base::UnguessableToken>& embedding_token) {
+  embedding_token_ = embedding_token;
+  if (!embedding_token_.has_value())
+    return;
+
+  // Only non-null tokens are propagated to the parent document. The token is
+  // automatically reset in the parent document when the child document is
+  // navigated cross-origin.
+  RenderFrameProxyHost* proxy_to_parent =
+      frame_tree_node()->render_manager()->GetProxyToParent();
+  DCHECK(proxy_to_parent);
+  proxy_to_parent->GetAssociatedRemoteFrame()->SetEmbeddingToken(
+      embedding_token_.value());
+}
+
 void RenderFrameHostImpl::DidCommitPerNavigationMojoInterfaceNavigation(
     NavigationRequest* committing_navigation_request,
     std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params> params,
@@ -2692,7 +2806,7 @@ void RenderFrameHostImpl::Unload(RenderFrameProxyHost* proxy, bool is_loading) {
 
   // If this RenderFrameHost is already pending deletion, it must have already
   // gone through this, therefore just return.
-  if (unload_state_ != UnloadState::NotRun) {
+  if (IsPendingDeletion()) {
     NOTREACHED() << "RFH should be in default state when calling Unload.";
     return;
   }
@@ -2707,11 +2821,12 @@ void RenderFrameHostImpl::Unload(RenderFrameProxyHost* proxy, bool is_loading) {
   is_waiting_for_unload_ack_ = true;
 
   if (proxy) {
-    unload_state_ = UnloadState::InProgress;
+    SetLifecycleState(LifecycleState::kRunningUnloadHandlers);
     if (IsRenderFrameLive()) {
       Send(new UnfreezableFrameMsg_Unload(
           routing_id_, proxy->GetRoutingID(), is_loading,
-          proxy->frame_tree_node()->current_replication_state()));
+          proxy->frame_tree_node()->current_replication_state(),
+          proxy->GetFrameToken()));
       // Remember that a RenderFrameProxy was created as part of processing the
       // Unload message above.
       proxy->SetRenderFrameProxyCreated(true);
@@ -2724,7 +2839,7 @@ void RenderFrameHostImpl::Unload(RenderFrameProxyHost* proxy, bool is_loading) {
     // The unload handlers already ran for this document during the
     // local<->local swap. Hence, there is no need to send
     // UnfreezableFrameMsg_Unload here. It can be marked at completed.
-    unload_state_ = UnloadState::Completed;
+    SetLifecycleState(LifecycleState::kReadyToBeDeleted);
   }
 
   if (web_ui())
@@ -2743,7 +2858,7 @@ void RenderFrameHostImpl::Unload(RenderFrameProxyHost* proxy, bool is_loading) {
 }
 
 void RenderFrameHostImpl::DetachFromProxy() {
-  if (unload_state_ != UnloadState::NotRun)
+  if (IsPendingDeletion())
     return;
 
   // Start pending deletion on this frame and its children.
@@ -2921,8 +3036,8 @@ void RenderFrameHostImpl::OnUnloadACK() {
   if (do_not_delete_for_testing_)
     return;
 
-  DCHECK_EQ(UnloadState::InProgress, unload_state_);
-  unload_state_ = UnloadState::Completed;
+  DCHECK_EQ(LifecycleState::kRunningUnloadHandlers, lifecycle_state_);
+  SetLifecycleState(LifecycleState::kReadyToBeDeleted);
   PendingDeletionCheckCompleted();  // Can delete |this|.
 }
 
@@ -2957,8 +3072,9 @@ void RenderFrameHostImpl::OnContextMenu(
   // Validate the URLs in |params|.  If the renderer can't request the URLs
   // directly, don't show them in the context menu.
   ContextMenuParams validated_params(params);
-  validated_params.frame_url = GetLastCommittedURL();
   validated_params.page_url = GetMainFrame()->GetLastCommittedURL();
+  if (GetParent())  // Only populate |frame_url| for subframes.
+    validated_params.frame_url = GetLastCommittedURL();
 
   // We don't validate |unfiltered_link_url| so that this field can be used
   // when users want to copy the original link URL.
@@ -3161,6 +3277,11 @@ void RenderFrameHostImpl::ContentsPreferredSizeChanged(
   render_view_host_->OnDidContentsPreferredSizeChange(pref_size);
 }
 
+void RenderFrameHostImpl::TextAutosizerPageInfoChanged(
+    blink::mojom::TextAutosizerPageInfoPtr page_info) {
+  delegate_->OnTextAutosizerPageInfoChanged(this, std::move(page_info));
+}
+
 void RenderFrameHostImpl::UpdateFaviconURL(
     std::vector<blink::mojom::FaviconURLPtr> favicon_urls) {
   delegate_->UpdateFaviconURL(this, std::move(favicon_urls));
@@ -3235,6 +3356,24 @@ void RenderFrameHostImpl::ReportNoBinderForInterface(const std::string& error) {
   broker_receiver_.ReportBadMessage(error + " for the frame/document scope");
 }
 
+ukm::SourceId RenderFrameHostImpl::GetPageUkmSourceId() {
+  int64_t navigation_id =
+      GetMainFrame()->last_committed_cross_document_navigation_id_;
+  if (navigation_id == -1)
+    return ukm::kInvalidSourceId;
+  return ukm::ConvertToSourceId(navigation_id,
+                                ukm::SourceIdType::NAVIGATION_ID);
+}
+
+BrowserContext* RenderFrameHostImpl::GetBrowserContext() {
+  return GetProcess()->GetBrowserContext();
+}
+
+StoragePartition* RenderFrameHostImpl::GetStoragePartition() {
+  return BrowserContext::GetStoragePartition(GetBrowserContext(),
+                                             GetSiteInstance());
+}
+
 void RenderFrameHostImpl::RequestTextSurroundingSelection(
     blink::mojom::LocalFrame::GetTextSurroundingSelectionCallback callback,
     int max_length) {
@@ -3243,11 +3382,37 @@ void RenderFrameHostImpl::RequestTextSurroundingSelection(
                                                          std::move(callback));
 }
 
+bool RenderFrameHostImpl::HasCommittingNavigationRequestForOrigin(
+    const url::Origin& origin,
+    NavigationRequest* navigation_request_to_exclude) {
+  if (navigation_request_ &&
+      navigation_request_.get() != navigation_request_to_exclude &&
+      navigation_request_->HasCommittingOrigin(origin)) {
+    return true;
+  }
+
+  for (const auto& it : navigation_requests_) {
+    NavigationRequest* request = it.first;
+    if (request != navigation_request_to_exclude &&
+        request->HasCommittingOrigin(origin)) {
+      return true;
+    }
+  }
+
+  // Note: this function excludes |same_document_navigation_request_|, which
+  // should be ok since these cannot change the origin.
+  return false;
+}
+
 void RenderFrameHostImpl::SendInterventionReport(const std::string& id,
                                                  const std::string& message) {
   GetAssociatedLocalFrame()->SendInterventionReport(id, message);
 }
 
+WebUI* RenderFrameHostImpl::GetWebUI() {
+  return web_ui();
+}
+
 void RenderFrameHostImpl::AllowBindings(int bindings_flags) {
   // Never grant any bindings to browser plugin guests.
   if (GetProcess()->IsForGuestsOnly()) {
@@ -3326,18 +3491,8 @@ void RenderFrameHostImpl::DoNotDeleteForTesting() {
 
 bool RenderFrameHostImpl::IsFeatureEnabled(
     blink::mojom::FeaturePolicyFeature feature) {
-  blink::mojom::PolicyValueType feature_type =
-      feature_policy_->GetFeatureList().at(feature).second;
-  return IsFeatureEnabled(
-      feature, blink::PolicyValue::CreateMaxPolicyValue(feature_type));
-}
-
-bool RenderFrameHostImpl::IsFeatureEnabled(
-    blink::mojom::FeaturePolicyFeature feature,
-    blink::PolicyValue threshold_value) {
-  return feature_policy_ &&
-         feature_policy_->IsFeatureEnabledForOrigin(
-             feature, GetLastCommittedOrigin(), threshold_value);
+  return feature_policy_ && feature_policy_->IsFeatureEnabledForOrigin(
+                                feature, GetLastCommittedOrigin());
 }
 
 bool RenderFrameHostImpl::IsFeatureEnabled(
@@ -3418,7 +3573,8 @@ void RenderFrameHostImpl::UpdateSubresourceLoaderFactories() {
       std::move(subresource_loader_factories));
 }
 
-blink::FrameOwnerElementType RenderFrameHostImpl::GetFrameOwnerElementType() {
+blink::mojom::FrameOwnerElementType
+RenderFrameHostImpl::GetFrameOwnerElementType() {
   return frame_tree_node_->frame_owner_element_type();
 }
 
@@ -3453,7 +3609,7 @@ void RenderFrameHostImpl::DidChangeName(const std::string& name,
 }
 
 void RenderFrameHostImpl::DidSetFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::ParsedFeaturePolicy& feature_policy_header,
     const blink::DocumentPolicy::FeatureState& document_policy_header) {
   if (!is_active())
@@ -3507,18 +3663,48 @@ void RenderFrameHostImpl::EnforceInsecureNavigationsSet(
   frame_tree_node()->SetInsecureNavigationsSet(set);
 }
 
-FrameTreeNode* RenderFrameHostImpl::FindAndVerifyChild(
+RenderFrameHostImpl* RenderFrameHostImpl::FindAndVerifyChild(
     int32_t child_frame_routing_id,
     bad_message::BadMessageReason reason) {
-  FrameTreeNode* child = frame_tree_node()->frame_tree()->FindByRoutingID(
+  auto child_frame_or_proxy = LookupRenderFrameHostOrProxy(
       GetProcess()->GetID(), child_frame_routing_id);
+  return FindAndVerifyChildInternal(child_frame_or_proxy, reason);
+}
+
+RenderFrameHostImpl* RenderFrameHostImpl::FindAndVerifyChild(
+    const base::UnguessableToken& child_frame_token,
+    bad_message::BadMessageReason reason) {
+  auto child_frame_or_proxy =
+      LookupRenderFrameHostOrProxy(GetProcess()->GetID(), child_frame_token);
+  return FindAndVerifyChildInternal(child_frame_or_proxy, reason);
+}
+
+RenderFrameHostImpl* RenderFrameHostImpl::FindAndVerifyChildInternal(
+    RenderFrameHostOrProxy child_frame_or_proxy,
+    bad_message::BadMessageReason reason) {
   // A race can result in |child| to be nullptr. Avoid killing the renderer in
   // that case.
-  if (child && child->parent() != frame_tree_node()) {
+  if (!child_frame_or_proxy)
+    return nullptr;
+
+  if (child_frame_or_proxy.GetFrameTreeNode()->frame_tree() !=
+      frame_tree_node()->frame_tree()) {
+    // Ignore the cases when the child lives in a different frame tree.
+    // This is possible when we create a proxy for inner WebContents (e.g.
+    // for portals) so the |child_frame_or_proxy| points to the root frame
+    // of the nested WebContents, which is in a different tree.
+    // TODO(altimin, lfg): Reconsider what the correct behaviour here should be.
+    return nullptr;
+  }
+
+  if (child_frame_or_proxy.GetFrameTreeNode()->parent() != this) {
     bad_message::ReceivedBadMessage(GetProcess(), reason);
     return nullptr;
   }
-  return child;
+  return child_frame_or_proxy.proxy
+             ? child_frame_or_proxy.proxy->frame_tree_node()
+                   ->current_frame_host()
+             : child_frame_or_proxy.frame;
 }
 
 void RenderFrameHostImpl::OnDidChangeFramePolicy(
@@ -3527,46 +3713,21 @@ void RenderFrameHostImpl::OnDidChangeFramePolicy(
   // Ensure that a frame can only update sandbox flags or feature policy for its
   // immediate children.  If this is not the case, the renderer is considered
   // malicious and is killed.
-  FrameTreeNode* child = FindAndVerifyChild(
+  RenderFrameHostImpl* child = FindAndVerifyChild(
       // TODO(iclelland): Rename this message
       frame_routing_id, bad_message::RFH_SANDBOX_FLAGS);
   if (!child)
     return;
 
-  child->SetPendingFramePolicy(frame_policy);
+  child->frame_tree_node()->SetPendingFramePolicy(frame_policy);
 
   // Notify the RenderFrame if it lives in a different process from its parent.
   // The frame's proxies in other processes also need to learn about the updated
   // flags and policy, but these notifications are sent later in
   // RenderFrameHostManager::CommitPendingFramePolicy(), when the frame
   // navigates and the new policies take effect.
-  RenderFrameHost* child_rfh = child->current_frame_host();
-  if (child_rfh->GetSiteInstance() != GetSiteInstance()) {
-    static_cast<RenderFrameHostImpl*>(child_rfh)
-        ->GetAssociatedLocalFrame()
-        ->DidUpdateFramePolicy(frame_policy);
-  }
-}
-
-void RenderFrameHostImpl::OnDidChangeFrameOwnerProperties(
-    int32_t frame_routing_id,
-    const blink::mojom::FrameOwnerProperties& properties) {
-  FrameTreeNode* child =
-      FindAndVerifyChild(frame_routing_id, bad_message::RFH_OWNER_PROPERTY);
-  if (!child)
-    return;
-
-  bool has_display_none_property_changed =
-      properties.is_display_none !=
-      child->frame_owner_properties().is_display_none;
-
-  child->set_frame_owner_properties(properties);
-
-  child->render_manager()->OnDidUpdateFrameOwnerProperties(properties);
-  if (has_display_none_property_changed) {
-    delegate_->DidChangeDisplayState(
-        child->current_frame_host(),
-        properties.is_display_none /* is_display_none */);
+  if (child->GetSiteInstance() != GetSiteInstance()) {
+    child->GetAssociatedLocalFrame()->DidUpdateFramePolicy(frame_policy);
   }
 }
 
@@ -3574,7 +3735,7 @@ void RenderFrameHostImpl::UpdateTitle(
     const base::Optional<::base::string16>& title,
     base::i18n::TextDirection title_direction) {
   // This message should only be sent for top-level frames.
-  if (frame_tree_node_->parent())
+  if (!is_main_frame())
     return;
 
   base::string16 received_title;
@@ -3857,18 +4018,18 @@ void RenderFrameHostImpl::EvictFromBackForwardCacheWithReasons(
   if (is_evicted_from_back_forward_cache_)
     return;
 
-  bool in_back_forward_cache = is_in_back_forward_cache();
+  bool in_back_forward_cache = IsInBackForwardCache();
 
   RenderFrameHostImpl* top_document = this;
   while (top_document->parent_) {
     top_document = top_document->parent_;
-    DCHECK_EQ(top_document->is_in_back_forward_cache(), in_back_forward_cache);
+    DCHECK_EQ(top_document->IsInBackForwardCache(), in_back_forward_cache);
   }
 
   // TODO(hajimehoshi): Record the 'race condition' by JavaScript execution when
-  // |is_in_back_forward_cache()| is false.
+  // |in_back_forward_cache| is false.
   BackForwardCacheMetrics* metrics = top_document->GetBackForwardCacheMetrics();
-  if (is_in_back_forward_cache() && metrics)
+  if (in_back_forward_cache && metrics)
     metrics->MarkNotRestoredWithReason(can_store);
 
   if (!in_back_forward_cache) {
@@ -3982,15 +4143,15 @@ void RenderFrameHostImpl::EnterFullscreen(
   // necessary changes to the other two ancestors.
   std::set<SiteInstance*> notified_instances;
   notified_instances.insert(GetSiteInstance());
-  for (FrameTreeNode* node = frame_tree_node_; node->parent();
-       node = node->parent()) {
-    SiteInstance* parent_site_instance =
-        node->parent()->current_frame_host()->GetSiteInstance();
+  for (RenderFrameHostImpl* rfh = this; rfh->GetParent();
+       rfh = rfh->GetParent()) {
+    SiteInstance* parent_site_instance = rfh->GetParent()->GetSiteInstance();
     if (base::Contains(notified_instances, parent_site_instance))
       continue;
 
     RenderFrameProxyHost* child_proxy =
-        node->render_manager()->GetRenderFrameProxyHost(parent_site_instance);
+        rfh->frame_tree_node()->render_manager()->GetRenderFrameProxyHost(
+            parent_site_instance);
     child_proxy->GetAssociatedRemoteFrame()->WillEnterFullscreen();
     notified_instances.insert(parent_site_instance);
   }
@@ -4161,7 +4322,7 @@ void RenderFrameHostImpl::OnFrameDidCallFocus() {
 void RenderFrameHostImpl::RenderFallbackContentInParentProcess() {
   bool is_object_type =
       frame_tree_node()->current_replication_state().frame_owner_element_type ==
-      blink::FrameOwnerElementType::kObject;
+      blink::mojom::FrameOwnerElementType::kObject;
   if (!is_object_type) {
     // Only object elements are expected to render their own fallback content
     // and since the owner type is set at the creation time of the
@@ -4185,32 +4346,69 @@ void RenderFrameHostImpl::RenderFallbackContentInParentProcess() {
   }
 }
 
+void RenderFrameHostImpl::ShowPopupMenu(
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+    const gfx::Rect& bounds,
+    int32_t item_height,
+    double font_size,
+    int32_t selected_item,
+    std::vector<blink::mojom::MenuItemPtr> menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void RenderFrameHostImpl::OnShowPopup(
-    const FrameHostMsg_ShowPopup_Params& params) {
-  RenderViewHostDelegateView* view =
-      render_view_host_->delegate_->GetDelegateView();
-  if (view) {
-    gfx::Point original_point(params.bounds.x(), params.bounds.y());
-    gfx::Point transformed_point =
-        static_cast<RenderWidgetHostViewBase*>(GetView())
-            ->TransformPointToRootCoordSpace(original_point);
-    gfx::Rect transformed_bounds(transformed_point.x(), transformed_point.y(),
-                                 params.bounds.width(), params.bounds.height());
-    view->ShowPopupMenu(this, transformed_bounds, params.item_height,
-                        params.item_font_size, params.selected_item,
-                        params.popup_items, params.right_aligned,
-                        params.allow_multiple_selection);
-  }
-}
-
-void RenderFrameHostImpl::OnHidePopup() {
-  RenderViewHostDelegateView* view =
-      render_view_host_->delegate_->GetDelegateView();
-  if (view)
-    view->HidePopupMenu();
-}
+  if (delegate()->ShowPopupMenu(this, &popup_client, bounds, item_height,
+                                font_size, selected_item, &menu_items,
+                                right_aligned, allow_multiple_selection)) {
+    return;
+  }
+
+  auto* view = render_view_host()->delegate_->GetDelegateView();
+  if (!view)
+    return;
+
+  gfx::Point original_point(bounds.x(), bounds.y());
+  gfx::Point transformed_point =
+      static_cast<RenderWidgetHostViewBase*>(GetView())
+          ->TransformPointToRootCoordSpace(original_point);
+  gfx::Rect transformed_bounds(transformed_point.x(), transformed_point.y(),
+                               bounds.width(), bounds.height());
+  view->ShowPopupMenu(this, std::move(popup_client), transformed_bounds,
+                      item_height, font_size, selected_item,
+                      std::move(menu_items), right_aligned,
+                      allow_multiple_selection);
 #endif
+}
+
+void RenderFrameHostImpl::DidLoadResourceFromMemoryCache(
+    const GURL& url,
+    const std::string& http_method,
+    const std::string& mime_type,
+    network::mojom::RequestDestination request_destination) {
+  delegate_->DidLoadResourceFromMemoryCache(this, url, http_method, mime_type,
+                                            request_destination);
+}
+
+void RenderFrameHostImpl::DidChangeFrameOwnerProperties(
+    const base::UnguessableToken& child_frame_token,
+    blink::mojom::FrameOwnerPropertiesPtr properties) {
+  auto* child =
+      FindAndVerifyChild(child_frame_token, bad_message::RFH_OWNER_PROPERTY);
+  if (!child)
+    return;
+
+  bool has_display_none_property_changed =
+      properties->is_display_none !=
+      child->frame_tree_node()->frame_owner_properties().is_display_none;
+
+  child->frame_tree_node()->set_frame_owner_properties(*properties);
+
+  child->frame_tree_node()->render_manager()->OnDidUpdateFrameOwnerProperties(
+      *properties);
+  if (has_display_none_property_changed) {
+    delegate_->DidChangeDisplayState(
+        child, properties->is_display_none /* is_display_none */);
+  }
+}
 
 void RenderFrameHostImpl::BindInterfaceProviderReceiver(
     mojo::PendingReceiver<service_manager::mojom::InterfaceProvider>
@@ -4232,6 +4430,13 @@ void RenderFrameHostImpl::BindBrowserInterfaceBrokerReceiver(
   broker_receiver_.SetFilter(std::make_unique<ActiveURLMessageFilter>(this));
 }
 
+void RenderFrameHostImpl::BindDomOperationControllerHostReceiver(
+    mojo::PendingAssociatedReceiver<mojom::DomAutomationControllerHost>
+        receiver) {
+  DCHECK(receiver.is_valid());
+  dom_automation_controller_receiver_.Bind(std::move(receiver));
+}
+
 void RenderFrameHostImpl::SetKeepAliveTimeoutForTesting(
     base::TimeDelta timeout) {
   keep_alive_timeout_ = timeout;
@@ -4252,21 +4457,22 @@ void RenderFrameHostImpl::RequestOverlayRoutingToken(
   std::move(callback).Run(frame_token_);
 }
 
+void RenderFrameHostImpl::DomOperationResponse(const std::string& json_string) {
+  delegate_->DomOperationResponse(json_string);
+}
+
 std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
 RenderFrameHostImpl::CreateCrossOriginPrefetchLoaderFactoryBundle() {
-  DCHECK(base::FeatureList::IsEnabled(
-      network::features::kPrefetchMainResourceNetworkIsolationKey));
-
   network::mojom::URLLoaderFactoryParamsPtr factory_params =
       URLLoaderFactoryParamsHelper::CreateForPrefetch(
           this, mojo::Clone(last_committed_client_security_state_));
 
   mojo::PendingRemote<network::mojom::URLLoaderFactory> pending_default_factory;
   bool bypass_redirect_checks = false;
-  // Passing a nullopt NetworkIsolationKey ensures the factory is not
-  // initialized with a NetworkIsolationKey. This is necessary for a
-  // cross-origin prefetch factory because the factory must use the
-  // NetworkIsolationKey provided by requests going through it.
+  // Passing an empty IsolationInfo ensures the factory is not initialized with
+  // a IsolationInfo. This is necessary for a cross-origin prefetch factory
+  // because the factory must use the value provided by requests going through
+  // it.
   bypass_redirect_checks = CreateNetworkServiceDefaultFactoryAndObserve(
       std::move(factory_params),
       pending_default_factory.InitWithNewPipeAndPassReceiver());
@@ -4371,8 +4577,7 @@ void RenderFrameHostImpl::CreateNewWindow(
         dom_storage_context, params->session_storage_namespace_id);
   }
 
-  network::mojom::CrossOriginOpenerPolicy popup_coop =
-      network::mojom::CrossOriginOpenerPolicy::kUnsafeNone;
+  network::CrossOriginOpenerPolicy popup_coop;
   network::CrossOriginEmbedderPolicy popup_coep;
   if (base::FeatureList::IsEnabled(
           network::features::kCrossOriginOpenerPolicy)) {
@@ -4389,8 +4594,8 @@ void RenderFrameHostImpl::CreateNewWindow(
       // The documents are cross origin, leave COOP of the popup to the default
       // unsafe-none.
       // Then set the popup to noopener if the top level COOP is same origin.
-      if (top_level_opener->cross_origin_opener_policy() ==
-          network::mojom::CrossOriginOpenerPolicy::kSameOrigin) {
+      if (top_level_opener->cross_origin_opener_policy().value ==
+          network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin) {
         params->opener_suppressed = true;
         // The frame name should not be forwarded to a noopener popup.
         // TODO(https://crbug.com/1060691) This should be applied to all
@@ -4432,16 +4637,14 @@ void RenderFrameHostImpl::CreateNewWindow(
   RenderFrameHostImpl* main_frame = new_window->GetMainFrame();
 
   // When the popup is created, it hasn't committed any navigation yet - its
-  // initial empty document should inherit the origin and network isolation key
-  // of its opener (the origin may change after the first commit). See also
-  // https://crbug.com/932067.
+  // initial empty document should inherit the origin of its opener (the origin
+  // may change after the first commit). See also https://crbug.com/932067.
   //
   // Note that that origin of the new frame might depend on sandbox flags.
   // Checking sandbox flags of the new frame should be safe at this point,
   // because the flags should be already inherited by the CreateNewWindow call
   // above.
-  main_frame->SetOriginAndNetworkIsolationKeyOfNewFrame(
-      GetLastCommittedOrigin());
+  main_frame->SetOriginAndIsolationInfoOfNewFrame(GetLastCommittedOrigin());
   main_frame->cross_origin_opener_policy_ = popup_coop;
   main_frame->cross_origin_embedder_policy_ = popup_coep;
 
@@ -4500,7 +4703,7 @@ void RenderFrameHostImpl::CreateNewWindow(
       devtools_instrumentation::ShouldWaitForDebuggerInWindowOpen();
   mojom::CreateNewWindowReplyPtr reply = mojom::CreateNewWindowReply::New(
       main_frame->GetRenderViewHost()->GetRoutingID(),
-      main_frame->GetRoutingID(),
+      main_frame->GetRoutingID(), main_frame->frame_token(),
       main_frame->GetLocalRenderWidgetHost()->GetRoutingID(), visual_properties,
       std::move(blink_frame_widget_host),
       std::move(blink_frame_widget_receiver), std::move(blink_widget_host),
@@ -4528,7 +4731,7 @@ void RenderFrameHostImpl::CreatePortal(
   }
 
   // We don't support attaching a portal inside a nested browsing context.
-  if (frame_tree_node()->parent()) {
+  if (!is_main_frame()) {
     mojo::ReportBadMessage(
         "RFHI::CreatePortal called in a nested browsing context");
     frame_host_associated_receiver_.reset();
@@ -4558,7 +4761,7 @@ void RenderFrameHostImpl::CreatePortal(
   DCHECK(initial_replicated_state.origin.opaque());
 
   std::move(callback).Run(proxy_host->GetRoutingID(), initial_replicated_state,
-                          (*it)->portal_token(),
+                          proxy_host->GetFrameToken(), (*it)->portal_token(),
                           (*it)->GetDevToolsFrameToken());
 }
 
@@ -4580,7 +4783,7 @@ void RenderFrameHostImpl::AdoptPortal(
                                                  ->GetRenderWidgetHostView())
           ->GetFrameSinkId(),
       proxy_host->frame_tree_node()->current_replication_state(),
-      portal->GetDevToolsFrameToken());
+      proxy_host->GetFrameToken(), portal->GetDevToolsFrameToken());
 }
 
 void RenderFrameHostImpl::CreateNewWidget(
@@ -4652,6 +4855,25 @@ void RenderFrameHostImpl::BeginNavigation(
   if (!VerifyBeginNavigationCommonParams(GetSiteInstance(), &*validated_params))
     return;
 
+  // If the request is bearing Trust Tokens parameters:
+  // - it must not be a main-frame navigation, and
+  // - for certain Trust Tokens operations, the frame's parent needs the
+  // trust-token-redemption Feature Policy feature.
+  if (begin_params->trust_token_params && !GetParent()) {
+    mojo::ReportBadMessage("RFHI: Trust Token params in main frame nav");
+    return;
+  }
+  if (begin_params->trust_token_params &&
+      ParentNeedsTrustTokenFeaturePolicy(*begin_params)) {
+    RenderFrameHostImpl* parent = GetParent();
+    if (!parent->IsFeatureEnabled(
+            blink::mojom::FeaturePolicyFeature::kTrustTokenRedemption)) {
+      mojo::ReportBadMessage(
+          "RFHI: Mandatory Trust Tokens Feature Policy feature is absent");
+      return;
+    }
+  }
+
   GetProcess()->FilterURL(true, &begin_params->searchable_form_url);
 
   // If the request was for a blob URL, but the validated URL is no longer a
@@ -4695,7 +4917,7 @@ void RenderFrameHostImpl::BeginNavigation(
       frame_tree_node(), std::move(validated_params), std::move(begin_params),
       std::move(blob_url_loader_factory), std::move(navigation_client),
       std::move(navigation_initiator), EnsurePrefetchedSignedExchangeCache(),
-      web_bundle_handle_ ? web_bundle_handle_->MaybeCreateTracker() : nullptr);
+      MaybeCreateWebBundleHandleTracker());
 }
 
 void RenderFrameHostImpl::SubresourceResponseStarted(
@@ -4825,13 +5047,6 @@ void RenderFrameHostImpl::HandleAXLocationChanges(
   }
 }
 
-void RenderFrameHostImpl::RegisterMojoInterfaces() {
-  file_system_manager_.reset(new FileSystemManagerImpl(
-      GetProcess()->GetID(),
-      GetProcess()->GetStoragePartition()->GetFileSystemContext(),
-      ChromeBlobStorageContext::GetFor(GetProcess()->GetBrowserContext())));
-}
-
 media::MediaMetricsProvider::RecordAggregateWatchTimeCallback
 RenderFrameHostImpl::GetRecordAggregateWatchTimeCallback() {
   return delegate_->GetRecordAggregateWatchTimeCallback();
@@ -4865,12 +5080,18 @@ CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
   }
 
   // Renderer-debug URLs can never be committed.
-  if (IsRendererDebugURL(url))
+  if (IsRendererDebugURL(url)) {
+    LogCanCommitOriginAndUrlFailureReason("is_renderer_debug_url");
     return CanCommitStatus::CANNOT_COMMIT_URL;
+  }
 
-  // TODO(creis): We should also check for WebUI pages here.  Also, when the
-  // out-of-process iframes implementation is ready, we should check for
-  // cross-site URLs that are not allowed to commit in this process.
+  // Verify that if this RenderFrameHost is for a WebUI it is not committing a
+  // URL which is not allowed in a WebUI process.
+  if (!Navigator::CheckWebUIRendererDoesNotDisplayNormalURL(
+          this, url,
+          /* is_renderer_initiated_check */ true)) {
+    return CanCommitStatus::CANNOT_COMMIT_URL;
+  }
 
   // MHTML subframes can supply URLs at commit time that do not match the
   // process lock. For example, it can be either "cid:..." or arbitrary URL at
@@ -4890,20 +5111,26 @@ CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
           base::debug::AllocateCrashKeyString(
               "oopif_in_mhtml_page", base::debug::CrashKeySize::Size32),
           is_mhtml_document() ? "is_mhtml_doc" : "not_mhtml_doc");
+      LogCanCommitOriginAndUrlFailureReason("oopif_in_mhtml_page");
       return CanCommitStatus::CANNOT_COMMIT_URL;
     }
   }
 
   // Give the client a chance to disallow URLs from committing.
-  if (!GetContentClient()->browser()->CanCommitURL(GetProcess(), url))
+  if (!GetContentClient()->browser()->CanCommitURL(GetProcess(), url)) {
+    LogCanCommitOriginAndUrlFailureReason(
+        "content_client_disallowed_commit_url");
     return CanCommitStatus::CANNOT_COMMIT_URL;
+  }
 
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   const CanCommitStatus can_commit_status = policy->CanCommitOriginAndUrl(
       GetProcess()->GetID(), GetSiteInstance()->GetIsolationContext(), origin,
       url);
-  if (can_commit_status != CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL)
+  if (can_commit_status != CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL) {
+    LogCanCommitOriginAndUrlFailureReason("cpspi_disallowed_commit");
     return can_commit_status;
+  }
 
   const auto origin_tuple_or_precursor_tuple =
       origin.GetTupleOrPrecursorTupleIfOpaque();
@@ -4913,8 +5140,11 @@ CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
     // about:blank, data, and blob URLs.
 
     // Renderer-debug URLs can never be committed.
-    if (IsRendererDebugURL(origin_tuple_or_precursor_tuple.GetURL()))
+    if (IsRendererDebugURL(origin_tuple_or_precursor_tuple.GetURL())) {
+      LogCanCommitOriginAndUrlFailureReason(
+          "origin_or_precursor_is_renderer_debug_url");
       return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
+    }
 
     // Give the client a chance to disallow origin URLs from committing.
     // TODO(acolwell): Fix this code to work with opaque origins. Currently
@@ -4922,6 +5152,8 @@ CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
     // the commit to fail. These need to be investigated.
     if (!origin.opaque() && !GetContentClient()->browser()->CanCommitURL(
                                 GetProcess(), origin.GetURL())) {
+      LogCanCommitOriginAndUrlFailureReason(
+          "content_client_disallowed_commit_origin");
       return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
     }
   }
@@ -4958,7 +5190,7 @@ void RenderFrameHostImpl::NavigateToInterstitialURL(const GURL& data_url) {
 void RenderFrameHostImpl::Stop() {
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::Stop", "frame_tree_node",
                frame_tree_node_->frame_tree_node_id());
-  Send(new FrameMsg_Stop(routing_id_));
+  GetAssociatedLocalFrame()->StopLoading();
 }
 
 void RenderFrameHostImpl::DispatchBeforeUnload(BeforeUnloadType type,
@@ -5164,12 +5396,12 @@ void RenderFrameHostImpl::SetBeforeUnloadTimeoutDelayForTesting(
 void RenderFrameHostImpl::StartPendingDeletionOnSubtree() {
   ResetNavigationsForPendingDeletion();
 
-  DCHECK_NE(UnloadState::NotRun, unload_state_);
+  DCHECK(IsPendingDeletion());
   for (std::unique_ptr<FrameTreeNode>& child_frame : children_) {
     for (FrameTreeNode* node :
          frame_tree_node_->frame_tree()->SubtreeNodes(child_frame.get())) {
       RenderFrameHostImpl* child = node->current_frame_host();
-      if (child->unload_state_ != UnloadState::NotRun)
+      if (child->IsPendingDeletion())
         continue;
 
       // Blink handles deletion of all same-process descendants, running their
@@ -5183,9 +5415,10 @@ void RenderFrameHostImpl::StartPendingDeletionOnSubtree() {
 
       local_ancestor->DeleteRenderFrame(FrameDeleteIntention::kNotMainFrame);
       if (local_ancestor != child) {
-        child->unload_state_ = child->has_unload_handler()
-                                   ? UnloadState::InProgress
-                                   : UnloadState::Completed;
+        LifecycleState child_lifecycle_state =
+            child->has_unload_handler() ? LifecycleState::kRunningUnloadHandlers
+                                        : LifecycleState::kReadyToBeDeleted;
+        child->SetLifecycleState(child_lifecycle_state);
       }
 
       node->frame_tree()->FrameUnloading(node);
@@ -5194,7 +5427,8 @@ void RenderFrameHostImpl::StartPendingDeletionOnSubtree() {
 }
 
 void RenderFrameHostImpl::PendingDeletionCheckCompleted() {
-  if (unload_state_ == UnloadState::Completed && children_.empty()) {
+  if (lifecycle_state_ == LifecycleState::kReadyToBeDeleted &&
+      children_.empty()) {
     if (is_waiting_for_unload_ack_)
       OnUnloaded();
     else
@@ -5227,7 +5461,7 @@ void RenderFrameHostImpl::ResetNavigationsForPendingDeletion() {
 }
 
 void RenderFrameHostImpl::OnUnloadTimeout() {
-  DCHECK_NE(unload_state_, UnloadState::NotRun);
+  DCHECK(IsPendingDeletion());
   parent_->RemoveChild(frame_tree_node_);
 }
 
@@ -5256,11 +5490,12 @@ void RenderFrameHostImpl::AdvanceFocus(blink::mojom::FocusType type,
                                        RenderFrameProxyHost* source_proxy) {
   DCHECK(!source_proxy ||
          (source_proxy->GetProcess()->GetID() == GetProcess()->GetID()));
-  int32_t source_proxy_routing_id = MSG_ROUTING_NONE;
+
+  base::Optional<base::UnguessableToken> frame_token;
   if (source_proxy)
-    source_proxy_routing_id = source_proxy->GetRoutingID();
-  Send(
-      new FrameMsg_AdvanceFocus(GetRoutingID(), type, source_proxy_routing_id));
+    frame_token = source_proxy->GetFrameToken();
+
+  GetAssociatedLocalFrame()->AdvanceFocusInFrame(type, frame_token);
 }
 
 void RenderFrameHostImpl::JavaScriptDialogClosed(
@@ -5398,16 +5633,16 @@ void RenderFrameHostImpl::CommitNavigation(
   url::Origin main_world_origin_for_url_loader_factory =
       GetOriginForURLLoaderFactory(navigation_request);
 
-  // Network isolation key should be filled before the URLLoaderFactory for
+  // IsolationInfo should be filled before the URLLoaderFactory for
   // sub-resources is created. Only update for cross document navigations since
   // for opaque origin same document navigations, a new origin should not be
   // created as that would be different from the original.
   if (!is_same_document) {
-    network_isolation_key_ = net::NetworkIsolationKey(
-        ComputeTopFrameOrigin(main_world_origin_for_url_loader_factory),
-        main_world_origin_for_url_loader_factory);
+    isolation_info_ = ComputeIsolationInfoInternal(
+        main_world_origin_for_url_loader_factory,
+        net::IsolationInfo::RedirectMode::kUpdateNothing);
   }
-  DCHECK(network_isolation_key_.IsFullyPopulated());
+  DCHECK(!isolation_info_.IsEmpty());
 
   if (navigation_request && navigation_request->appcache_handle()) {
     // AppCache may create a subresource URLLoaderFactory later, so make sure it
@@ -5821,6 +6056,7 @@ void RenderFrameHostImpl::FailedNavigation(
   // TODO(lukasza): https://crbug.com/888079: Use this origin when committing
   // later on.
   url::Origin origin = url::Origin();
+  isolation_info_ = net::IsolationInfo::CreateTransient();
 
   std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
       subresource_loader_factories;
@@ -5866,14 +6102,21 @@ void RenderFrameHostImpl::HandleRendererDebugURL(const GURL& url) {
   }
 
   GetNavigationControl()->HandleRendererDebugURL(url);
+
+  // Ensure that the renderer process is marked as used after processing a
+  // renderer debug URL, since this process is now unsafe to be reused by sites
+  // that require a dedicated process.  Usually this happens at ready-to-commit
+  // (NavigationRequest::OnResponseStarted) time for regular navigations, but
+  // renderer debug URLs don't go through that path.  This matters for initial
+  // navigations to renderer debug URLs.  See https://crbug.com/1074108.
+  GetProcess()->SetIsUsed();
 }
 
 void RenderFrameHostImpl::SetUpMojoIfNeeded() {
-  if (registry_.get())
+  if (associated_registry_.get())
     return;
 
   associated_registry_ = std::make_unique<blink::AssociatedInterfaceRegistry>();
-  registry_ = std::make_unique<service_manager::BinderRegistry>();
 
   auto bind_frame_host_receiver =
       [](RenderFrameHostImpl* impl,
@@ -5912,6 +6155,15 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
               std::make_unique<ActiveURLMessageFilter>(impl));
         },
         base::Unretained(this)));
+
+    associated_registry_->AddInterface(base::BindRepeating(
+        [](RenderFrameHostImpl* impl,
+           mojo::PendingAssociatedReceiver<
+               blink::mojom::ManifestUrlChangeObserver> receiver) {
+          ManifestManagerHost::GetOrCreateForCurrentDocument(impl)
+              ->BindObserver(std::move(receiver));
+        },
+        base::Unretained(this)));
   }
 
   associated_registry_->AddInterface(base::BindRepeating(
@@ -5922,7 +6174,21 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
       },
       base::Unretained(this)));
 
-  RegisterMojoInterfaces();
+  // TODO(crbug.com/1047354): How to avoid binding if the
+  // BINDINGS_POLICY_DOM_AUTOMATION policy is not set?
+  associated_registry_->AddInterface(base::BindRepeating(
+      [](RenderFrameHostImpl* impl,
+         mojo::PendingAssociatedReceiver<mojom::DomAutomationControllerHost>
+             receiver) {
+        impl->BindDomOperationControllerHostReceiver(std::move(receiver));
+      },
+      base::Unretained(this)));
+
+  file_system_manager_.reset(new FileSystemManagerImpl(
+      GetProcess()->GetID(),
+      GetProcess()->GetStoragePartition()->GetFileSystemContext(),
+      ChromeBlobStorageContext::GetFor(GetProcess()->GetBrowserContext())));
+
   mojo::PendingRemote<mojom::FrameFactory> frame_factory;
   GetProcess()->BindReceiver(frame_factory.InitWithNewPipeAndPassReceiver());
   mojo::Remote<mojom::FrameFactory>(std::move(frame_factory))
@@ -5943,8 +6209,6 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
 }
 
 void RenderFrameHostImpl::InvalidateMojoConnection() {
-  registry_.reset();
-
   frame_.reset();
   frame_bindings_control_.reset();
   frame_host_associated_receiver_.reset();
@@ -6186,9 +6450,8 @@ RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
   RenderWidgetHostViewBase* view = GetViewForAccessibility();
   if (view && !browser_accessibility_manager_ &&
       !no_create_browser_accessibility_manager_for_testing_) {
-    bool is_root_frame = !frame_tree_node()->parent();
     browser_accessibility_manager_.reset(
-        view->CreateBrowserAccessibilityManager(this, is_root_frame));
+        view->CreateBrowserAccessibilityManager(this, is_main_frame()));
   }
   return browser_accessibility_manager_.get();
 }
@@ -6263,32 +6526,6 @@ RenderFrameHostImpl* RenderFrameHostImpl::GetMainFrame() {
   return main_frame;
 }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-
-void RenderFrameHostImpl::DidSelectPopupMenuItem(int selected_index) {
-  Send(new FrameMsg_SelectPopupMenuItem(routing_id_, selected_index));
-}
-
-void RenderFrameHostImpl::DidCancelPopupMenu() {
-  Send(new FrameMsg_SelectPopupMenuItem(routing_id_, -1));
-}
-
-#else
-
-void RenderFrameHostImpl::DidSelectPopupMenuItems(
-    const std::vector<int>& selected_indices) {
-  Send(new FrameMsg_SelectPopupMenuItems(routing_id_, false, selected_indices));
-}
-
-void RenderFrameHostImpl::DidCancelPopupMenu() {
-  Send(
-      new FrameMsg_SelectPopupMenuItems(routing_id_, true, std::vector<int>()));
-}
-
-#endif
-#endif
-
 bool RenderFrameHostImpl::CanAccessFilesOfPageState(const PageState& state) {
   return ChildProcessSecurityPolicyImpl::GetInstance()->CanReadAllFiles(
       GetProcess()->GetID(), state.GetReferencedFiles());
@@ -6478,14 +6715,9 @@ bool RenderFrameHostImpl::CanExecuteJavaScript() {
 // static
 int RenderFrameHost::GetFrameTreeNodeIdForRoutingId(int process_id,
                                                     int routing_id) {
-  RenderFrameHostImpl* rfh = nullptr;
-  RenderFrameProxyHost* rfph = nullptr;
-  LookupRenderFrameHostOrProxy(process_id, routing_id, &rfh, &rfph);
-  if (rfh) {
-    return rfh->GetFrameTreeNodeId();
-  } else if (rfph) {
-    return rfph->frame_tree_node()->frame_tree_node_id();
-  }
+  auto frame_or_proxy = LookupRenderFrameHostOrProxy(process_id, routing_id);
+  if (frame_or_proxy)
+    return frame_or_proxy.GetFrameTreeNode()->frame_tree_node_id();
   return kNoFrameTreeNodeId;
 }
 
@@ -6500,17 +6732,16 @@ RenderFrameHost* RenderFrameHost::FromPlaceholderId(
 }
 
 ui::AXTreeID RenderFrameHostImpl::RoutingIDToAXTreeID(int routing_id) {
-  RenderFrameHostImpl* rfh = nullptr;
-  RenderFrameProxyHost* rfph = nullptr;
-  LookupRenderFrameHostOrProxy(GetProcess()->GetID(), routing_id, &rfh, &rfph);
-  if (rfph) {
-    rfh = rfph->frame_tree_node()->current_frame_host();
+  auto frame_or_proxy =
+      LookupRenderFrameHostOrProxy(GetProcess()->GetID(), routing_id);
+  if (frame_or_proxy.frame)
+    return frame_or_proxy.frame->GetAXTreeID();
+  if (frame_or_proxy.proxy) {
+    return frame_or_proxy.proxy->frame_tree_node()
+        ->current_frame_host()
+        ->GetAXTreeID();
   }
-
-  if (!rfh)
-    return ui::AXTreeIDUnknown();
-
-  return rfh->GetAXTreeID();
+  return ui::AXTreeIDUnknown();
 }
 
 void RenderFrameHostImpl::AXContentNodeDataToAXNodeData(
@@ -6522,6 +6753,8 @@ void RenderFrameHostImpl::AXContentNodeDataToAXNodeData(
   // Map content-specific's |child_routing_id| attribute to a generic attribute
   // with a global AXTreeID.
   if (src.child_routing_id != MSG_ROUTING_NONE) {
+    DCHECK_EQ(dst->child_ids.size(), 0U)
+        << "A node should not have both children and a child tree.";
     dst->string_attributes.push_back(
         std::make_pair(ax::mojom::StringAttribute::kChildTreeId,
                        RoutingIDToAXTreeID(src.child_routing_id).ToString()));
@@ -6544,7 +6777,7 @@ void RenderFrameHostImpl::AXContentTreeDataToAXTreeData(ui::AXTreeData* dst) {
     dst->parent_tree_id = browser_plugin_embedder_ax_tree_id_;
 
   // If this is not the root frame tree node, we're done.
-  if (frame_tree_node()->parent())
+  if (!is_main_frame())
     return;
 
   // For the root frame tree node, also store the AXTreeID of the focused frame.
@@ -6566,13 +6799,12 @@ void RenderFrameHostImpl::RequestAXHitTestCallback(
 
   // A child frame was found while hit testing on this frame, and so we need to
   // request a new hit test over such child frame now.
-  RenderFrameHostImpl* child_frame = nullptr;
-  RenderFrameProxyHost* rfph = nullptr;
-  LookupRenderFrameHostOrProxy(
-      GetProcess()->GetID(), child_frame_hit_test_info->child_frame_routing_id,
-      &child_frame, &rfph);
-  if (rfph)
-    child_frame = rfph->frame_tree_node()->current_frame_host();
+  auto frame_or_proxy = LookupRenderFrameHostOrProxy(
+      GetProcess()->GetID(), child_frame_hit_test_info->child_frame_routing_id);
+  RenderFrameHostImpl* child_frame =
+      frame_or_proxy.proxy
+          ? frame_or_proxy.proxy->frame_tree_node()->current_frame_host()
+          : frame_or_proxy.frame;
 
   if (!child_frame || !child_frame->is_active())
     return;
@@ -6703,6 +6935,13 @@ void RenderFrameHostImpl::GetFeatureObserver(
   feature_observer_->GetFeatureObserver(std::move(receiver));
 }
 
+void RenderFrameHostImpl::BindScreenEnumerationReceiver(
+    mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver) {
+  if (!screen_enumeration_impl_)
+    screen_enumeration_impl_ = std::make_unique<ScreenEnumerationImpl>(this);
+  screen_enumeration_impl_->Bind(std::move(receiver));
+}
+
 void RenderFrameHostImpl::BindMediaInterfaceFactoryReceiver(
     mojo::PendingReceiver<media::mojom::InterfaceFactory> receiver) {
   DCHECK(!media_interface_proxy_);
@@ -6776,19 +7015,19 @@ void RenderFrameHostImpl::BindMediaRemoterFactoryReceiver(
 
 void RenderFrameHostImpl::CreateWebSocketConnector(
     mojo::PendingReceiver<blink::mojom::WebSocketConnector> receiver) {
-  mojo::MakeSelfOwnedReceiver(
-      std::make_unique<WebSocketConnectorImpl>(
-          GetProcess()->GetID(), routing_id_, last_committed_origin_,
-          network_isolation_key_),
-      std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(std::make_unique<WebSocketConnectorImpl>(
+                                  GetProcess()->GetID(), routing_id_,
+                                  last_committed_origin_, isolation_info_),
+                              std::move(receiver));
 }
 
 void RenderFrameHostImpl::CreateQuicTransportConnector(
     mojo::PendingReceiver<blink::mojom::QuicTransportConnector> receiver) {
-  mojo::MakeSelfOwnedReceiver(std::make_unique<QuicTransportConnectorImpl>(
-                                  GetProcess()->GetID(), last_committed_origin_,
-                                  network_isolation_key_),
-                              std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<QuicTransportConnectorImpl>(
+          GetProcess()->GetID(), weak_ptr_factory_.GetWeakPtr(),
+          last_committed_origin_, isolation_info_.network_isolation_key()),
+      std::move(receiver));
 }
 
 void RenderFrameHostImpl::CreateNotificationService(
@@ -6871,7 +7110,8 @@ void RenderFrameHostImpl::GetIdleManager(
   }
   static_cast<StoragePartitionImpl*>(GetProcess()->GetStoragePartition())
       ->GetIdleManager()
-      ->CreateService(std::move(receiver));
+      ->CreateService(std::move(receiver),
+                      GetMainFrame()->GetLastCommittedOrigin());
 }
 
 void RenderFrameHostImpl::GetPresentationService(
@@ -6945,19 +7185,57 @@ void RenderFrameHostImpl::BindSmsReceiverReceiver(
     mojo::ReportBadMessage("Must have the same origin as the top-level frame.");
     return;
   }
-  auto* fetcher = SmsFetcher::Get(GetProcess()->GetBrowserContext(),
-                                  weak_ptr_factory_.GetWeakPtr());
+  auto* fetcher = SmsFetcher::Get(GetProcess()->GetBrowserContext());
   SmsService::Create(fetcher, this, std::move(receiver));
 }
 
 void RenderFrameHostImpl::BindRestrictedCookieManager(
     mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver) {
-  GetProcess()->GetStoragePartition()->CreateRestrictedCookieManager(
-      network::mojom::RestrictedCookieManagerRole::SCRIPT,
-      GetLastCommittedOrigin(), ComputeSiteForCookies(),
-      ComputeTopFrameOrigin(GetLastCommittedOrigin()),
-      /* is_service_worker = */ false, GetProcess()->GetID(), routing_id(),
-      std::move(receiver));
+  static_cast<StoragePartitionImpl*>(GetProcess()->GetStoragePartition())
+      ->CreateRestrictedCookieManager(
+          network::mojom::RestrictedCookieManagerRole::SCRIPT,
+          GetLastCommittedOrigin(), isolation_info_.site_for_cookies(),
+          ComputeTopFrameOrigin(GetLastCommittedOrigin()),
+          /* is_service_worker = */ false, GetProcess()->GetID(), routing_id(),
+          std::move(receiver), CreateCookieAccessObserver());
+}
+
+void RenderFrameHostImpl::BindHasTrustTokensAnswerer(
+    mojo::PendingReceiver<network::mojom::HasTrustTokensAnswerer> receiver) {
+  auto top_frame_origin = ComputeTopFrameOrigin(GetLastCommittedOrigin());
+
+  // A check at the callsite in the renderer ensures a correctly functioning
+  // renderer will only request this Mojo handle if the top-frame origin is
+  // potentially trustworthy and has scheme HTTP or HTTPS.
+  if ((top_frame_origin.scheme() != url::kHttpScheme &&
+       top_frame_origin.scheme() != url::kHttpsScheme) ||
+      !network::IsOriginPotentiallyTrustworthy(top_frame_origin)) {
+    mojo::ReportBadMessage(
+        "Attempted to get a HasTrustTokensAnswerer for a non-trustworthy or "
+        "non-HTTP/HTTPS top-frame origin.");
+    return;
+  }
+
+  // This is enforced in benign renderers by the [SecureContext] IDL
+  // attribute on Document::hasTrustToken.
+  if (!network::IsOriginPotentiallyTrustworthy(GetLastCommittedOrigin())) {
+    mojo::ReportBadMessage(
+        "Attempted to get a HasTrustTokensAnswerer from an insecure context.");
+    return;
+  }
+
+  // This is enforced in benign renderers by the RuntimeEnabled=TrustTokens IDL
+  // attribute (the base::Feature's value is tied to the
+  // RuntimeEnabledFeature's).
+  if (!base::FeatureList::IsEnabled(network::features::kTrustTokens)) {
+    mojo::ReportBadMessage(
+        "Attempted to get a HasTrustTokensAnswerer with Trust Tokens "
+        "disabled.");
+    return;
+  }
+
+  GetProcess()->GetStoragePartition()->CreateHasTrustTokensAnswerer(
+      std::move(receiver), ComputeTopFrameOrigin(GetLastCommittedOrigin()));
 }
 
 void RenderFrameHostImpl::GetInterface(
@@ -6966,14 +7244,10 @@ void RenderFrameHostImpl::GetInterface(
   // Requests are serviced on |document_scoped_interface_provider_receiver_|. It
   // is therefore safe to assume that every incoming interface request is coming
   // from the currently active document in the corresponding RenderFrame.
-  if (!registry_ ||
-      !registry_->TryBindInterface(interface_name, &interface_pipe)) {
-    delegate_->OnInterfaceRequest(this, interface_name, &interface_pipe);
-    if (interface_pipe.is_valid()) {
-      GetContentClient()->browser()->BindInterfaceRequestFromFrame(
-          this, interface_name, std::move(interface_pipe));
-    }
-  }
+  // NOTE: this way of acquiring interfaces has been replaced with
+  // BrowserInterfaceBroker (see https://crbug.com/718652). The code below is
+  // left to support the CastWebContentsImpl use case.
+  delegate_->OnInterfaceRequest(this, interface_name, &interface_pipe);
 }
 
 void RenderFrameHostImpl::CreateAppCacheBackend(
@@ -7058,12 +7332,6 @@ void RenderFrameHostImpl::GetAuthenticator(
 #endif  // !defined(OS_ANDROID)
 }
 
-void RenderFrameHostImpl::GetCredentialManager(
-    mojo::PendingReceiver<blink::mojom::CredentialManager> receiver) {
-  GetContentClient()->browser()->BindCredentialManagerReceiver(
-      this, std::move(receiver));
-}
-
 void RenderFrameHostImpl::GetPushMessaging(
     mojo::PendingReceiver<blink::mojom::PushMessaging> receiver) {
   if (!push_messaging_manager_) {
@@ -7096,13 +7364,19 @@ void RenderFrameHostImpl::GetVirtualAuthenticatorManager(
 std::unique_ptr<NavigationRequest>
 RenderFrameHostImpl::CreateNavigationRequestForCommit(
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-    bool is_same_document,
-    NavigationEntryImpl* entry_for_request) {
-  bool is_renderer_initiated =
-      entry_for_request ? entry_for_request->is_renderer_initiated() : true;
-  return NavigationRequest::CreateForCommit(
-      frame_tree_node_, this, entry_for_request, params, is_renderer_initiated,
-      is_same_document);
+    bool is_same_document) {
+  std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter;
+  // We don't switch the COEP reporter on same-document navigations, so create
+  // one only for cross-document navigations.
+  if (!is_same_document) {
+    coep_reporter = std::make_unique<CrossOriginEmbedderPolicyReporter>(
+        process_->GetStoragePartition(), params.url,
+        cross_origin_embedder_policy_.reporting_endpoint,
+        cross_origin_embedder_policy_.report_only_reporting_endpoint);
+  }
+  return NavigationRequest::CreateForCommit(frame_tree_node_, this, params,
+                                            std::move(coep_reporter),
+                                            is_same_document);
 }
 
 bool RenderFrameHostImpl::NavigationRequestWasIntendedForPendingEntry(
@@ -7423,7 +7697,7 @@ bool RenderFrameHostImpl::ValidateDidCommitParams(
 
 void RenderFrameHostImpl::UpdateSiteURL(const GURL& url,
                                         bool url_is_unreachable) {
-  if (url_is_unreachable || delegate_->GetAsInterstitialPage()) {
+  if (url_is_unreachable) {
     SetLastCommittedSiteUrl(GURL());
   } else {
     SetLastCommittedSiteUrl(url);
@@ -7459,18 +7733,11 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
     // same-document navigations.
     is_commit_allowed_to_proceed |= is_same_document_navigation;
 
-    // 3) Transient interstitial page commits will not have a matching
-    // NavigationRequest.
-    // TODO(clamy): Enforce having a NavigationRequest for data URLs when
-    // committed interstitials have launched or interstitials create
-    // NavigationRequests.
-    is_commit_allowed_to_proceed |= !!delegate_->GetAsInterstitialPage();
-
-    // 4) Error pages implementations in Chrome can commit twice.
+    // 3) Error pages implementations in Chrome can commit twice.
     // TODO(clamy): Fix this.
     is_commit_allowed_to_proceed |= params->url_is_unreachable;
 
-    // 5) Special case for DOMSerializerBrowsertests which are implemented
+    // 4) Special case for DOMSerializerBrowsertests which are implemented
     // entirely renderer-side and unlike normal RenderView based tests load
     // file URLs instead of data URLs.
     // TODO(clamy): Rework the tests to remove this exception.
@@ -7515,8 +7782,8 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
   // one in order to properly issue DidFinishNavigation calls to
   // WebContentsObservers.
   if (!navigation_request) {
-    navigation_request = CreateNavigationRequestForCommit(
-        *params, is_same_document_navigation, nullptr);
+    navigation_request =
+        CreateNavigationRequestForCommit(*params, is_same_document_navigation);
   }
 
   DCHECK(navigation_request);
@@ -7548,10 +7815,25 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
   accessibility_reset_count_ = 0;
   appcache_handle_ = navigation_request->TakeAppCacheHandle();
 
-  if (navigation_request->IsInMainFrame() &&
-      !navigation_request->IsSameDocument() &&
+  if (!is_same_document_navigation &&
       !navigation_request->IsServedFromBackForwardCache()) {
-    render_view_host_->ResetPerPageState();
+    if (navigation_request->IsInMainFrame()) {
+      render_view_host_->ResetPerPageState();
+    }
+    last_committed_cross_document_navigation_id_ =
+        navigation_request->GetNavigationId();
+
+    if (IsCurrent()) {
+      // Clear all the user data associated with the non speculative
+      // RenderFrameHost when the navigation is a cross-document navigation not
+      // served from the back-forward cache.
+      document_associated_data_.ClearAllUserData();
+    }
+
+    // Continue observing the events for the committed navigation.
+    for (auto& receiver : navigation_request->TakeCookieObservers()) {
+      cookie_observers_.Add(this, std::move(receiver));
+    }
   }
 
   // If we still have a PeakGpuMemoryTracker, then the loading it was observing
@@ -7567,6 +7849,18 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
       navigation_request->TakeClientSecurityState();
   std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter =
       navigation_request->TakeCoepReporter();
+  if (coep_reporter) {
+    mojo::PendingRemote<blink::mojom::ReportingObserver> remote;
+    mojo::PendingReceiver<blink::mojom::ReportingObserver> receiver =
+        remote.InitWithNewPipeAndPassReceiver();
+    coep_reporter->BindObserver(std::move(remote));
+    // As some tests overrides the associated frame after commit, do not
+    // call GetAssociatedLocalFrame now.
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&RenderFrameHostImpl::BindReportingObserver,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(receiver)));
+  }
 
   frame_tree_node()->navigator()->DidNavigate(this, *params,
                                               std::move(navigation_request),
@@ -7808,8 +8102,9 @@ void RenderFrameHostImpl::DidCommitNavigation(
   // If we're waiting for a cross-site beforeunload completion callback from
   // this renderer and we receive a Navigate message from the main frame, then
   // the renderer was navigating already and sent it before hearing the
-  // FrameMsg_Stop message. Treat this as an implicit beforeunload completion
-  // callback to allow the pending navigation to continue.
+  // blink::mojom::LocalFrame::StopLoading() message. Treat this as an implicit
+  // beforeunload completion callback to allow the pending navigation to
+  // continue.
   if (is_waiting_for_beforeunload_completion_ &&
       unload_ack_is_for_navigation_ && !GetParent()) {
     base::TimeTicks approx_renderer_start_time = send_before_unload_start_time_;
@@ -7941,7 +8236,7 @@ void RenderFrameHostImpl::SendBeforeUnload(
 void RenderFrameHostImpl::AddServiceWorkerContainerHost(
     const std::string& uuid,
     base::WeakPtr<content::ServiceWorkerContainerHost> host) {
-  if (is_in_back_forward_cache_) {
+  if (IsInBackForwardCache()) {
     // RenderFrameHost entered BackForwardCache before adding
     // ServiceWorkerContainerHost. In this case, evict the entry from the cache.
     EvictFromBackForwardCacheWithReason(
@@ -7987,14 +8282,15 @@ bool RenderFrameHostImpl::MaybeInterceptCommitCallback(
   return true;
 }
 
-void RenderFrameHostImpl::PostMessageEvent(int32_t source_routing_id,
-                                           const base::string16& source_origin,
-                                           const base::string16& target_origin,
-                                           blink::TransferableMessage message) {
+void RenderFrameHostImpl::PostMessageEvent(
+    const base::Optional<base::UnguessableToken>& source_token,
+    const base::string16& source_origin,
+    const base::string16& target_origin,
+    blink::TransferableMessage message) {
   DCHECK(render_frame_created_);
 
-  GetNavigationControl()->PostMessageEvent(source_routing_id, source_origin,
-                                           target_origin, std::move(message));
+  GetAssociatedLocalFrame()->PostMessageEvent(
+      source_token, source_origin, target_origin, std::move(message));
 }
 
 bool RenderFrameHostImpl::IsTestRenderFrameHost() const {
@@ -8015,6 +8311,21 @@ void RenderFrameHostImpl::ClearPrefetchedSignedExchangeCache() {
     prefetched_signed_exchange_cache_->Clear();
 }
 
+std::unique_ptr<WebBundleHandleTracker>
+RenderFrameHostImpl::MaybeCreateWebBundleHandleTracker() {
+  if (web_bundle_handle_)
+    return web_bundle_handle_->MaybeCreateTracker();
+  FrameTreeNode* frame_owner =
+      frame_tree_node_->parent() ? frame_tree_node_->parent()->frame_tree_node()
+                                 : frame_tree_node_->opener();
+  if (!frame_owner)
+    return nullptr;
+  RenderFrameHostImpl* frame_owner_host = frame_owner->current_frame_host();
+  if (!frame_owner_host->web_bundle_handle_)
+    return nullptr;
+  return frame_owner_host->web_bundle_handle_->MaybeCreateTracker();
+}
+
 RenderWidgetHostImpl* RenderFrameHostImpl::GetLocalRenderWidgetHost() const {
   if (!parent_)
     return render_view_host_->GetWidget();
@@ -8033,7 +8344,7 @@ void RenderFrameHostImpl::EnsureDescendantsAreUnloading() {
       RenderFrameHostImpl* child = subframe->current_frame_host();
       // Every child is expected to be pending deletion. If it isn't the
       // case, their FrameTreeNode is immediately removed from the tree.
-      if (child->unload_state_ == UnloadState::NotRun)
+      if (!child->IsPendingDeletion())
         rfhs_to_be_checked.push_back(child);
       else
         parents_to_be_checked.push_back(child);
@@ -8264,7 +8575,7 @@ void RenderFrameHostImpl::LogCannotCommitUrlCrashKeys(
 }
 
 void RenderFrameHostImpl::MaybeEvictFromBackForwardCache() {
-  if (!is_in_back_forward_cache_)
+  if (!IsInBackForwardCache())
     return;
 
   RenderFrameHostImpl* top_document = this;
@@ -8392,17 +8703,20 @@ void RenderFrameHostImpl::UpdateAdFrameType(
 
 blink::mojom::AuthenticatorStatus
 RenderFrameHostImpl::PerformGetAssertionWebAuthSecurityChecks(
-    const std::string& relying_party_id) {
+    const std::string& relying_party_id,
+    const url::Origin& effective_origin) {
   bool is_cross_origin;
   blink::mojom::AuthenticatorStatus status =
       GetWebAuthRequestSecurityChecker()->ValidateAncestorOrigins(
-          GetLastCommittedOrigin(), &is_cross_origin);
+          effective_origin,
+          WebAuthRequestSecurityChecker::RequestType::kGetAssertion,
+          &is_cross_origin);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     return status;
   }
 
   status = GetWebAuthRequestSecurityChecker()->ValidateDomainAndRelyingPartyID(
-      GetLastCommittedOrigin(), relying_party_id);
+      effective_origin, relying_party_id);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     return status;
   }
@@ -8412,17 +8726,20 @@ RenderFrameHostImpl::PerformGetAssertionWebAuthSecurityChecks(
 
 blink::mojom::AuthenticatorStatus
 RenderFrameHostImpl::PerformMakeCredentialWebAuthSecurityChecks(
-    const std::string& relying_party_id) {
+    const std::string& relying_party_id,
+    const url::Origin& effective_origin) {
   bool is_cross_origin;
   blink::mojom::AuthenticatorStatus status =
       GetWebAuthRequestSecurityChecker()->ValidateAncestorOrigins(
-          GetLastCommittedOrigin(), &is_cross_origin);
+          effective_origin,
+          WebAuthRequestSecurityChecker::RequestType::kMakeCredential,
+          &is_cross_origin);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     return status;
   }
 
   status = GetWebAuthRequestSecurityChecker()->ValidateDomainAndRelyingPartyID(
-      GetLastCommittedOrigin(), relying_party_id);
+      effective_origin, relying_party_id);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     return status;
   }
@@ -8462,4 +8779,87 @@ RenderFrameHostImpl::GetWebAuthRequestSecurityChecker() {
   return webauth_request_security_checker_;
 }
 
+bool RenderFrameHostImpl::IsInBackForwardCache() {
+  return lifecycle_state_ == LifecycleState::kInBackForwardCache;
+}
+
+bool RenderFrameHostImpl::IsPendingDeletion() {
+  return lifecycle_state_ == LifecycleState::kRunningUnloadHandlers ||
+         lifecycle_state_ == LifecycleState::kReadyToBeDeleted;
+}
+
+void RenderFrameHostImpl::SetLifecycleStateToActive() {
+  // If the RenderFrameHost is restored from BackForwardCache, update states of
+  // all the children to kActive. This is called from
+  // RenderFrameHostManager::SetRenderFrameHost which happens after commit.
+  if (IsInBackForwardCache()) {
+    for (auto& child : children_) {
+      DCHECK_EQ(child->current_frame_host()->lifecycle_state_,
+                LifecycleState::kInBackForwardCache);
+      child->current_frame_host()->SetLifecycleStateToActive();
+    }
+  }
+
+  SetLifecycleState(LifecycleState::kActive);
+}
+
+void RenderFrameHostImpl::SetLifecycleState(LifecycleState state) {
+  // Cross-verify that |lifecycle_state_| transition happens correctly.
+  switch (state) {
+    case LifecycleState::kSpeculative:
+      // RenderFrameHost is only set speculative during its creation and no
+      // transitions happen to this state during its lifetime.
+      NOTREACHED();
+      break;
+    case LifecycleState::kActive:
+      DCHECK(lifecycle_state_ == LifecycleState::kSpeculative ||
+             lifecycle_state_ == LifecycleState::kInBackForwardCache)
+          << "Unexpected LifeCycleState " << int(lifecycle_state_);
+      break;
+    case LifecycleState::kInBackForwardCache:
+      DCHECK_EQ(lifecycle_state_, LifecycleState::kActive)
+          << "Unexpected LifeCycleState " << int(lifecycle_state_);
+      break;
+    case LifecycleState::kRunningUnloadHandlers:
+      DCHECK_EQ(lifecycle_state_, LifecycleState::kActive)
+          << "Unexpected LifeCycleState " << int(lifecycle_state_);
+      break;
+    case LifecycleState::kReadyToBeDeleted:
+      DCHECK_NE(lifecycle_state_, LifecycleState::kReadyToBeDeleted)
+          << "Unexpected LifeCycleState " << int(lifecycle_state_);
+      break;
+  }
+  lifecycle_state_ = state;
+}
+
+void RenderFrameHostImpl::BindReportingObserver(
+    mojo::PendingReceiver<blink::mojom::ReportingObserver> receiver) {
+  GetAssociatedLocalFrame()->BindReportingObserver(std::move(receiver));
+}
+
+mojo::PendingRemote<network::mojom::CookieAccessObserver>
+RenderFrameHostImpl::CreateCookieAccessObserver() {
+  mojo::PendingRemote<network::mojom::CookieAccessObserver> remote;
+  cookie_observers_.Add(this, remote.InitWithNewPipeAndPassReceiver());
+  return remote;
+}
+
+void RenderFrameHostImpl::Clone(
+    mojo::PendingReceiver<network::mojom::CookieAccessObserver> observer) {
+  cookie_observers_.Add(this, std::move(observer));
+}
+
+void RenderFrameHostImpl::OnCookiesAccessed(
+    network::mojom::CookieAccessDetailsPtr details) {
+  EmitSameSiteCookiesDeprecationWarning(this, details);
+
+  CookieAccessDetails allowed;
+  CookieAccessDetails blocked;
+  SplitCookiesIntoAllowedAndBlocked(details, &allowed, &blocked);
+  if (!allowed.cookie_list.empty())
+    delegate_->OnCookiesAccessed(this, allowed);
+  if (!blocked.cookie_list.empty())
+    delegate_->OnCookiesAccessed(this, blocked);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.h b/chromium/content/browser/frame_host/render_frame_host_impl.h
index 7ddd4d26f91..513fca6f861 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.h
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.h
@@ -46,6 +46,7 @@
 #include "content/common/ax_content_node_data.h"
 #include "content/common/buildflags.h"
 #include "content/common/content_export.h"
+#include "content/common/dom_automation_controller.mojom.h"
 #include "content/common/frame.mojom.h"
 #include "content/common/frame_delete_intention.h"
 #include "content/common/frame_replication_state.h"
@@ -74,6 +75,7 @@
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
+#include "net/base/isolation_info.h"
 #include "net/base/network_isolation_key.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/http/http_response_headers.h"
@@ -81,15 +83,17 @@
 #include "services/device/public/mojom/wake_lock_context.mojom.h"
 #include "services/network/public/cpp/content_security_policy/csp_context.h"
 #include "services/network/public/cpp/cross_origin_embedder_policy.h"
+#include "services/network/public/cpp/cross_origin_opener_policy.h"
+#include "services/network/public/mojom/fetch_api.mojom-forward.h"
 #include "services/network/public/mojom/network_context.mojom.h"
-#include "services/service_manager/public/cpp/binder_registry.h"
+#include "services/network/public/mojom/trust_tokens.mojom.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "services/viz/public/mojom/hit_test/input_target_client.mojom.h"
 #include "third_party/blink/public/common/feature_policy/document_policy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "third_party/blink/public/mojom/commit_result/commit_result.mojom.h"
 #include "third_party/blink/public/mojom/contacts/contacts_manager.mojom.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
@@ -97,9 +101,12 @@
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom.h"
-#include "third_party/blink/public/mojom/frame/frame.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame.mojom-forward.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-forward.h"
 #include "third_party/blink/public/mojom/frame/navigation_initiator.mojom.h"
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom-forward.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
 #include "third_party/blink/public/mojom/image_downloader/image_downloader.mojom.h"
@@ -112,6 +119,7 @@
 #include "third_party/blink/public/mojom/permissions/permission.mojom.h"
 #include "third_party/blink/public/mojom/portal/portal.mojom-forward.h"
 #include "third_party/blink/public/mojom/presentation/presentation.mojom.h"
+#include "third_party/blink/public/mojom/screen_enumeration/screen_enumeration.mojom-forward.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-forward.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
@@ -124,7 +132,6 @@
 #include "third_party/blink/public/mojom/websockets/websocket_connector.mojom.h"
 #include "third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom.h"
 #include "third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_action_handler.h"
 #include "ui/accessibility/ax_event.h"
@@ -146,9 +153,6 @@
 
 class GURL;
 struct FrameHostMsg_OpenURL_Params;
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-struct FrameHostMsg_ShowPopup_Params;
-#endif
 
 namespace blink {
 class AssociatedInterfaceProvider;
@@ -160,7 +164,7 @@ namespace mojom {
 class CacheStorage;
 class GeolocationService;
 class WebUsbService;
-}
+}  // namespace mojom
 }  // namespace blink
 
 namespace gfx {
@@ -200,6 +204,7 @@ class RenderViewHostImpl;
 class RenderWidgetHostImpl;
 class RenderWidgetHostView;
 class RenderWidgetHostViewBase;
+class ScreenEnumerationImpl;
 class SensorProviderProxyImpl;
 class SerialService;
 class SpeechSynthesisImpl;
@@ -207,8 +212,10 @@ class TimeoutMonitor;
 class WebAuthRequestSecurityChecker;
 class WebBluetoothServiceImpl;
 class WebBundleHandle;
+class WebBundleHandleTracker;
 struct UntrustworthyContextMenuParams;
 struct PendingNavigation;
+struct RenderFrameHostOrProxy;
 struct ResourceTimingInfo;
 struct SubresourceLoaderParams;
 
@@ -227,6 +234,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       public base::SupportsUserData,
       public mojom::FrameHost,
       public mojom::RenderAccessibilityHost,
+      public mojom::DomAutomationControllerHost,
       public BrowserAccessibilityDelegate,
       public RenderProcessHostObserver,
       public SiteInstanceImpl::Observer,
@@ -234,7 +242,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
       public blink::mojom::LocalFrameHost,
       public network::CSPContext,
       public blink::mojom::LocalMainFrameHost,
-      public ui::AXActionHandler {
+      public ui::AXActionHandler,
+      public network::mojom::CookieAccessObserver {
  public:
   using AXTreeSnapshotCallback =
       base::OnceCallback<void(const ui::AXTreeUpdate&)>;
@@ -283,6 +292,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   const GURL& GetLastCommittedURL() override;
   const url::Origin& GetLastCommittedOrigin() override;
   const net::NetworkIsolationKey& GetNetworkIsolationKey() override;
+  const net::IsolationInfo& GetIsolationInfoForSubresources() override;
   gfx::NativeView GetNativeView() override;
   void AddMessageToConsole(blink::mojom::ConsoleMessageLevel level,
                            const std::string& message) override;
@@ -317,6 +327,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       int max_length) override;
   void SendInterventionReport(const std::string& id,
                               const std::string& message) override;
+  WebUI* GetWebUI() override;
   void AllowBindings(int binding_flags) override;
   int GetEnabledBindings() override;
   void SetWebUIProperty(const std::string& name,
@@ -326,8 +337,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   bool GetSuddenTerminationDisablerState(
       blink::mojom::SuddenTerminationDisablerType disabler_type) override;
   bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature) override;
-  bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature,
-                        blink::PolicyValue threshold_value) override;
   bool IsFeatureEnabled(blink::mojom::DocumentPolicyFeature feature) override;
   bool IsFeatureEnabled(blink::mojom::DocumentPolicyFeature feature,
                         blink::PolicyValue threshold_value) override;
@@ -343,12 +352,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
       base::flat_set<url::Origin> isolated_world_origins,
       bool push_to_renderer_now) override;
-  bool IsSandboxed(blink::mojom::WebSandboxFlags flags) override;
+  bool IsSandboxed(network::mojom::WebSandboxFlags flags) override;
   void FlushNetworkAndNavigationInterfacesForTesting() override;
   void PrepareForInnerWebContentsAttach(
       PrepareForInnerWebContentsAttachCallback callback) override;
   void UpdateSubresourceLoaderFactories() override;
-  blink::FrameOwnerElementType GetFrameOwnerElementType() override;
+  blink::mojom::FrameOwnerElementType GetFrameOwnerElementType() override;
   bool HasTransientUserActivation() override;
   void UpdateBrowserControlsState(BrowserControlsState constraints,
                                   BrowserControlsState current,
@@ -357,10 +366,16 @@ class CONTENT_EXPORT RenderFrameHostImpl
   bool IsDOMContentLoaded() override;
   void UpdateAdFrameType(blink::mojom::AdFrameType ad_frame_type) override;
   blink::mojom::AuthenticatorStatus PerformGetAssertionWebAuthSecurityChecks(
-      const std::string& relying_party_id) override;
+      const std::string& relying_party_id,
+      const url::Origin& effective_origin) override;
   blink::mojom::AuthenticatorStatus PerformMakeCredentialWebAuthSecurityChecks(
-      const std::string& relying_party_id) override;
+      const std::string& relying_party_id,
+      const url::Origin& effective_origin) override;
   void SetIsXrOverlaySetup() override;
+  bool IsInBackForwardCache() override;
+  ukm::SourceId GetPageUkmSourceId() override;
+  StoragePartition* GetStoragePartition() override;
+  BrowserContext* GetBrowserContext() override;
 
   // Determines if a clipboard paste using |data| of type |data_type| is allowed
   // in this renderer frame.  The implementation delegates to
@@ -389,17 +404,17 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // BrowserAccessibilityDelegate
   void AccessibilityPerformAction(const ui::AXActionData& data) override;
-  bool AccessibilityViewHasFocus() const override;
+  bool AccessibilityViewHasFocus() override;
   void AccessibilityViewSetFocus() override;
-  gfx::Rect AccessibilityGetViewBounds() const override;
-  float AccessibilityGetDeviceScaleFactor() const override;
+  gfx::Rect AccessibilityGetViewBounds() override;
+  float AccessibilityGetDeviceScaleFactor() override;
   void AccessibilityFatalError() override;
   gfx::AcceleratedWidget AccessibilityGetAcceleratedWidget() override;
   gfx::NativeViewAccessible AccessibilityGetNativeViewAccessible() override;
   gfx::NativeViewAccessible AccessibilityGetNativeViewAccessibleForWindow()
       override;
   WebContents* AccessibilityWebContents() override;
-  bool AccessibilityIsMainFrame() const override;
+  bool AccessibilityIsMainFrame() override;
 
   // RenderProcessHostObserver implementation.
   void RenderProcessExited(RenderProcessHost* host,
@@ -454,17 +469,17 @@ class CONTENT_EXPORT RenderFrameHostImpl
   int routing_id() const { return routing_id_; }
 
   // Called when this frame has added a child. This is a continuation of an IPC
-  // that was partially handled on the IO thread (to allocate |new_routing_id|
-  // and |devtools_frame_token|), and is forwarded here. The renderer has
-  // already been told to create a RenderFrame with the specified ID values.
-  // |interface_provider_receiver| is the receiver end of the InterfaceProvider
-  // interface that the RenderFrameHost corresponding to the child frame should
-  // bind to expose services to the renderer process. The caller takes care of
-  // sending down the client end of the pipe to the child RenderFrame to use.
-  // |browser_interface_broker_receiver| is the receiver end of
-  // BrowserInterfaceBroker interface in the child frame. RenderFrameHost should
-  // bind this receiver to expose services to the renderer process. The caller
-  // takes care of sending down the client end of the pipe to the child
+  // that was partially handled on the IO thread (to allocate |new_routing_id|,
+  // |frame_token| and |devtools_frame_token|), and is forwarded here. The
+  // renderer has already been told to create a RenderFrame with the specified
+  // ID values. |interface_provider_receiver| is the receiver end of the
+  // InterfaceProvider interface that the RenderFrameHost corresponding to the
+  // child frame should bind to expose services to the renderer process. The
+  // caller takes care of sending down the client end of the pipe to the child
+  // RenderFrame to use. |browser_interface_broker_receiver| is the receiver end
+  // of BrowserInterfaceBroker interface in the child frame. RenderFrameHost
+  // should bind this receiver to expose services to the renderer process. The
+  // caller takes care of sending down the client end of the pipe to the child
   // RenderFrame to use.
   void OnCreateChildFrame(
       int new_routing_id,
@@ -472,17 +487,18 @@ class CONTENT_EXPORT RenderFrameHostImpl
           interface_provider_receiver,
       mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>
           browser_interface_broker_receiver,
-      blink::WebTreeScopeType scope,
+      blink::mojom::TreeScopeType scope,
       const std::string& frame_name,
       const std::string& frame_unique_name,
       bool is_created_by_script,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const blink::FramePolicy& frame_policy,
       const blink::mojom::FrameOwnerProperties& frame_owner_properties,
-      blink::FrameOwnerElementType owner_type);
+      blink::mojom::FrameOwnerElementType owner_type);
 
   // Update this frame's state at the appropriate time when a navigation
-  // commits. This is called by NavigatorImpl::DidNavigate as a helper, in the
+  // commits. This is called by Navigator::DidNavigate as a helper, in the
   // midst of a DidCommitProvisionalLoad call.
   void DidNavigate(const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
                    bool is_same_document_navigation);
@@ -498,7 +514,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   FrameTreeNode* child_at(size_t index) const { return children_[index].get(); }
   FrameTreeNode* AddChild(std::unique_ptr<FrameTreeNode> child,
                           int process_id,
-                          int frame_routing_id);
+                          int frame_routing_id,
+                          const base::UnguessableToken& frame_token);
   void RemoveChild(FrameTreeNode* child);
   void ResetChildren();
 
@@ -522,9 +539,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   const url::Origin& ComputeTopFrameOrigin(
       const url::Origin& frame_origin) const;
 
-  // Computes site_for_cookies to be used when navigating this frame to
-  // |destination|.
-  net::SiteForCookies ComputeSiteForCookiesForNavigation(
+  // Computes the IsolationInfo this frame to |destination|.
+  net::IsolationInfo ComputeIsolationInfoForNavigation(
       const GURL& destination) const;
 
   // Computes site_for_cookies for this frame. A non-empty result denotes which
@@ -555,6 +571,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // will have the JS bindings enabled.
   void EnableMojoJsBindings();
 
+  // Returns true if this is a main RenderFrameHost. True if and only if this
+  // RenderFrameHost doesn't have a parent.
+  bool is_main_frame() const { return !parent_; }
+
   // Returns this RenderFrameHost's loading state. This method is only used by
   // FrameTreeNode. The proper way to check whether a frame is loading is to
   // call FrameTreeNode::IsLoading.
@@ -594,6 +614,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // commit in this RenderFrameHost.
   bool HasPendingCommitNavigation() const;
 
+  // Return true if Unload() was called on the frame or one of its ancestors.
+  // If true, this corresponds either to unload handlers running for this
+  // RenderFrameHost (LifecycleState::kRunningUnloadHandlers) or when this
+  // RenderFrameHost is ready to be deleted (LifecycleState::kReadyToBeDeleted).
+  bool IsPendingDeletion();
+
   // A NavigationRequest for a pending cross-document navigation in this frame,
   // if any. This is cleared when the navigation commits.
   NavigationRequest* navigation_request() { return navigation_request_.get(); }
@@ -658,9 +684,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // This method returns true from the time this RenderFrameHost is created
   // until it is pending deletion. Pending deletion starts when Unload() is
   // called on the frame or one of its ancestors.
-  // BackForwardCache: Returns false when the frame is in the BackForwardCache.
+  // Returns false when the frame is in the BackForwardCache.
+  // TODO(https://crbug.com/1073449): Replace all occurrences of is_active.
   bool is_active() const {
-    return unload_state_ == UnloadState::NotRun && !is_in_back_forward_cache_;
+    return lifecycle_state_ == LifecycleState::kActive ||
+           lifecycle_state_ == LifecycleState::kSpeculative;
   }
 
   // Navigates to an interstitial page represented by the provided data URL.
@@ -669,6 +697,63 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Stop the load in progress.
   void Stop();
 
+  // Defines different states the RenderFrameHost can be in during its lifetime
+  // i.e., from point of creation to deletion.
+  enum class LifecycleState {
+    // This state corresponds to when a speculative RenderFrameHost is created
+    // for an ongoing navigation (to new URL) but hasn't been swapped in the
+    // frame tree yet, mainly created for performance optimization. The frame
+    // can only be created in this state and no transitions happen to this
+    // state.
+    //
+    // Transitions from this state happen to either kActive (when navigation
+    // commits) or kReadyToBeDeleted (when the navigation redirects
+    // or gets cancelled). Note that the term speculative is used, because the
+    // navigation might be canceled or redirected and the RenderFrameHost might
+    // get deleted before being used.
+    kSpeculative,
+
+    // This state corresponds to when a RenderFrameHost is the current one in
+    // its RenderFrameHostManager and FrameTreeNode. In this state,
+    // RenderFrameHost is visible to the user. Transition to kActive state may
+    // happen from either kSpeculative (when navigation commits) or
+    // kInBackForwardCache (when restoring from BackForwardCache) states.
+    //
+    // RenderFrameHost can also be created in this state for an empty document
+    // in a FrameTreeNode (e.g initializing root and child in an empty
+    // FrameTree).
+    kActive,
+
+    // This state corresponds to when RenderFrameHost is stored in
+    // BackForwardCache. This happens when the user navigates away from a
+    // document, so that the RenderFrameHost can be re-used after a history
+    // navigation. Transition to this state happens only from kActive state.
+    kInBackForwardCache,
+
+    // This state corresponds to when RenderFrameHost has started running unload
+    // handlers. An event such as navigation commit or detaching the frame
+    // causes the RenderFrameHost to transition to this state. Then, the
+    // RenderFrameHost sends IPCs to the renderer process to execute unload
+    // handlers and deletes the RenderFrame. The RenderFrameHost waits for an
+    // ACK from the renderer process, either FrameHostMsg_Unload_ACK for a
+    // navigating frame or FrameHostMsg_Detach for its subframes, after which
+    // the RenderFrameHost transitions to kReadyToBeDeleted state.
+    //
+    // Transition to this state happens only from kActive state. Note that
+    // eviction from BackForwardCache does not run unload handlers, and
+    // kInBackForwardCache moves to kReadyToBeDeleted.
+    kRunningUnloadHandlers,
+
+    // This state corresponds to when RenderFrameHost has completed running the
+    // unload handlers. Once all the descendant frames in other processes are
+    // gone, this RenderFrameHost will delete itself. Transition to this state
+    // may happen from one of kSpeculative, kActive, kInBackForwardCache or
+    // kRunningUnloadHandlers states.
+    kReadyToBeDeleted,
+  };
+  LifecycleState lifecycle_state() const { return lifecycle_state_; }
+  void SetLifecycleStateToActive();
+
   enum class BeforeUnloadType {
     BROWSER_INITIATED_NAVIGATION,
     RENDERER_INITIATED_NAVIGATION,
@@ -777,17 +862,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
     no_create_browser_accessibility_manager_for_testing_ = flag;
   }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-  // Select popup menu related methods (for external popup menus).
-  void DidSelectPopupMenuItem(int selected_index);
-  void DidCancelPopupMenu();
-#else
-  void DidSelectPopupMenuItems(const std::vector<int>& selected_indices);
-  void DidCancelPopupMenu();
-#endif
-#endif
-
   // Indicates that a navigation is ready to commit and can be
   // handled by this RenderFrame.
   // |subresource_loader_params| is used in network service land to pass
@@ -901,7 +975,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       mojo::PendingAssociatedReceiver<blink::mojom::DevToolsAgent> receiver);
 
 #if defined(OS_ANDROID)
-  base::android::ScopedJavaLocalRef<jobject> GetJavaRenderFrameHost();
+  base::android::ScopedJavaLocalRef<jobject> GetJavaRenderFrameHost() override;
   service_manager::InterfaceProvider* GetJavaInterfaces() override;
 #endif
 
@@ -926,7 +1000,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Binds the receiver end of the InterfaceProvider interface through which
   // services provided by this RenderFrameHost are exposed to the corresponding
   // RenderFrame. The caller is responsible for plumbing the client end to the
-  // the renderer process.
+  // renderer process.
   void BindInterfaceProviderReceiver(
       mojo::PendingReceiver<service_manager::mojom::InterfaceProvider>
           interface_provider_receiver);
@@ -934,10 +1008,18 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Binds the receiver end of the BrowserInterfaceBroker interface through
   // which services provided by this RenderFrameHost are exposed to the
   // corresponding RenderFrame. The caller is responsible for plumbing the
-  // client end to the the renderer process.
+  // client end to the renderer process.
   void BindBrowserInterfaceBrokerReceiver(
       mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>);
 
+  // Binds the receiver end of the DomOperationControllerHost interface through
+  // which services provided by this RenderFrameHost are exposed to the
+  // corresponding RenderFrame. The caller is responsible for plumbing the
+  // client end to the renderer process.
+  void BindDomOperationControllerHostReceiver(
+      mojo::PendingAssociatedReceiver<mojom::DomAutomationControllerHost>
+          receiver);
+
   // Exposed so that tests can swap the implementation and intercept calls.
   mojo::AssociatedReceiver<mojom::FrameHost>&
   frame_host_receiver_for_testing() {
@@ -951,13 +1033,19 @@ class CONTENT_EXPORT RenderFrameHostImpl
   }
 
   // Exposed so that tests can swap the implementation and intercept calls.
+  mojo::AssociatedReceiver<blink::mojom::LocalMainFrameHost>&
+  local_main_frame_host_receiver_for_testing() {
+    return local_main_frame_host_receiver_;
+  }
+
+  // Exposed so that tests can swap the implementation and intercept calls.
   mojo::Receiver<blink::mojom::BrowserInterfaceBroker>&
   browser_interface_broker_receiver_for_testing() {
     return broker_receiver_;
   }
   void SetKeepAliveTimeoutForTesting(base::TimeDelta timeout);
 
-  blink::mojom::WebSandboxFlags active_sandbox_flags() {
+  network::mojom::WebSandboxFlags active_sandbox_flags() {
     return active_sandbox_flags_;
   }
 
@@ -974,10 +1062,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // for unload handler processing.
   void SetSubframeUnloadTimeoutForTesting(const base::TimeDelta& timeout);
 
-  service_manager::BinderRegistry& BinderRegistryForTesting() {
-    return *registry_;
-  }
-
   mojo::Remote<blink::mojom::FileChooser> BindFileChooserForTesting();
 
   // Called when the WebAudio AudioContext given by |audio_context_id| has
@@ -987,11 +1071,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // Called when this RenderFrameHostImpl enters the BackForwardCache, the
   // document enters in a "Frozen" state where no Javascript can run.
-  void EnterBackForwardCache();
+  void DidEnterBackForwardCache();
 
   // Called when this RenderFrameHostImpl leaves the BackForwardCache. This
   // occurs immediately before a restored document is committed.
-  void LeaveBackForwardCache();
+  void WillLeaveBackForwardCache();
 
   // Take ownership over the DidCommitProvisionalLoad_Params that
   // were last used to commit this navigation.
@@ -1004,8 +1088,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // BackForwardCache after time to live.
   void StartBackForwardCacheEvictionTimer();
 
-  bool is_in_back_forward_cache() const { return is_in_back_forward_cache_; }
-
   bool IsBackForwardCacheDisabled() const;
 
   // Prevents this frame (along with its parents/children) from being added to
@@ -1093,10 +1175,15 @@ class CONTENT_EXPORT RenderFrameHostImpl
       CommitCallbackInterceptor* interceptor);
 
   // Posts a message from a frame in another process to the current renderer.
-  void PostMessageEvent(int32_t source_routing_id,
-                        const base::string16& source_origin,
-                        const base::string16& target_origin,
-                        blink::TransferableMessage message);
+  void PostMessageEvent(
+      const base::Optional<base::UnguessableToken>& source_token,
+      const base::string16& source_origin,
+      const base::string16& target_origin,
+      blink::TransferableMessage message);
+
+  // Requests to swap the current frame into the frame tree, replacing the
+  // RenderFrameProxy it is associated with.
+  void SwapIn();
 
   // Manual RTTI to ensure safe downcasts in tests.
   virtual bool IsTestRenderFrameHost() const;
@@ -1117,6 +1204,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Clears the entries in the PrefetchedSignedExchangeCache if exists.
   void ClearPrefetchedSignedExchangeCache();
 
+  // Creates a WebBundleHandleTracker from WebBundleHandles which are attached
+  // |this| or the parent frame or the opener frame.
+  std::unique_ptr<WebBundleHandleTracker> MaybeCreateWebBundleHandleTracker();
+
   // Adds |message| to the DevTools console only if it is unique (i.e. has not
   // been added to the console previously from this frame).
   virtual void AddUniqueMessageToConsole(
@@ -1196,8 +1287,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   void CreateWebBluetoothService(
       mojo::PendingReceiver<blink::mojom::WebBluetoothService> receiver);
-  void GetCredentialManager(
-      mojo::PendingReceiver<blink::mojom::CredentialManager> receiver);
 
   void GetAuthenticator(
       mojo::PendingReceiver<blink::mojom::Authenticator> receiver);
@@ -1237,6 +1326,18 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void BindRestrictedCookieManager(
       mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver);
 
+  // Requires the following preconditions, reporting a bad message otherwise.
+  //
+  // 1. This frame's top-frame origin must be potentially trustworthy and
+  // have scheme HTTP or HTTPS. (See network::SuitableTrustTokenOrigin's class
+  // comment for the rationale.)
+  //
+  // 2. Trust Tokens must be enabled (network::features::kTrustTokens).
+  //
+  // 3. This frame's origin must be potentially trustworthy.
+  void BindHasTrustTokensAnswerer(
+      mojo::PendingReceiver<network::mojom::HasTrustTokensAnswerer> receiver);
+
   // Creates connections to WebUSB interfaces bound to this frame.
   void CreateWebUsbService(
       mojo::PendingReceiver<blink::mojom::WebUsbService> receiver);
@@ -1264,6 +1365,9 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void GetFeatureObserver(
       mojo::PendingReceiver<blink::mojom::FeatureObserver> receiver);
 
+  void BindScreenEnumerationReceiver(
+      mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver);
+
   // https://mikewest.github.io/corpp/#initialize-embedder-policy-for-global
   const network::CrossOriginEmbedderPolicy& cross_origin_embedder_policy()
       const {
@@ -1279,11 +1383,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // Semi-formal definition of COOP:
   // https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e
-  network::mojom::CrossOriginOpenerPolicy cross_origin_opener_policy() const {
+  network::CrossOriginOpenerPolicy cross_origin_opener_policy() const {
     return cross_origin_opener_policy_;
   }
-  void set_cross_origin_opener_policy(
-      network::mojom::CrossOriginOpenerPolicy policy) {
+  void set_cross_origin_opener_policy(network::CrossOriginOpenerPolicy policy) {
     cross_origin_opener_policy_ = policy;
   }
 
@@ -1302,6 +1405,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
     return has_committed_any_navigation_;
   }
 
+  // Sets the embedding token corresponding to the document in this
+  // RenderFrameHost.
+  void SetEmbeddingToken(
+      const base::Optional<base::UnguessableToken>& embedding_token);
+
   // Return true if the process this RenderFrameHost is using has crashed and we
   // are replacing RenderFrameHosts for crashed frames rather than reusing them.
   //
@@ -1309,6 +1417,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // IsRenderFrameLive() is false when the RenderProcess died, but it is also
   // false when it hasn't been initialized.
   bool must_be_replaced() const { return must_be_replaced_; }
+  // Resets the must_be_replaced after the RFH has been reinitialized. Do not
+  // add any more usages of this.
+  // TODO(https://crbug.com/1006814): Remove this.
+  void reset_must_be_replaced() { must_be_replaced_ = false; }
 
   std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
   CreateCrossOriginPrefetchLoaderFactoryBundle();
@@ -1426,13 +1538,42 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void DownloadURL(blink::mojom::DownloadURLParamsPtr params) override;
   void FocusedElementChanged(bool is_editable_element,
                              const gfx::Rect& bounds_in_frame_widget) override;
+  void ShowPopupMenu(
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+      const gfx::Rect& bounds,
+      int32_t item_height,
+      double font_size,
+      int32_t selected_item,
+      std::vector<blink::mojom::MenuItemPtr> menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
+  void DidLoadResourceFromMemoryCache(
+      const GURL& url,
+      const std::string& http_method,
+      const std::string& mime_type,
+      network::mojom::RequestDestination request_destination) override;
+  void DidChangeFrameOwnerProperties(
+      const base::UnguessableToken& child_frame_token,
+      blink::mojom::FrameOwnerPropertiesPtr frame_owner_properties) override;
 
   // blink::LocalMainFrameHost overrides:
   void ScaleFactorChanged(float scale) override;
   void ContentsPreferredSizeChanged(const gfx::Size& pref_size) override;
+  void TextAutosizerPageInfoChanged(
+      blink::mojom::TextAutosizerPageInfoPtr page_info) override;
 
   void ReportNoBinderForInterface(const std::string& error);
 
+  // Returns true if this object has any NavigationRequests matching |origin|.
+  // Since this function is used to find existing committed/committing origins
+  // that have not opted-in to isolation, and since any calls to this function
+  // will be initiated by a NavigationRequest that is itself requesting opt-in
+  // isolation, |navigation_request_to_exclude| allows that request to exclude
+  // itself from consideration.
+  bool HasCommittingNavigationRequestForOrigin(
+      const url::Origin& origin,
+      NavigationRequest* navigation_request_to_exclude);
+
   // Force the RenderFrameHost to be left in pending deletion state instead of
   // being actually deleted after navigating away:
   // - Force waiting for unload handler result regardless of whether an
@@ -1441,6 +1582,46 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // - Ignore any OnUnloadACK sent by the renderer process.
   void DoNotDeleteForTesting();
 
+  // Document-associated data. This is cleared whenever a new document is hosted
+  // by this RenderFrameHost. Please refer to the description at
+  // content/public/browser/render_document_host_user_data.h for more details.
+  base::SupportsUserData::Data* GetRenderDocumentHostUserData(
+      const void* key) const {
+    return document_associated_data_.GetUserData(key);
+  }
+
+  void SetRenderDocumentHostUserData(
+      const void* key,
+      std::unique_ptr<base::SupportsUserData::Data> data) {
+    document_associated_data_.SetUserData(key, std::move(data));
+  }
+
+  void RemoveRenderDocumentHostUserData(const void* key) {
+    document_associated_data_.RemoveUserData(key);
+  }
+
+  // Returns the child RenderFrameHostImpl if |child_frame_routing_id| is an
+  // immediate child of this FrameTreeNode. |child_frame_routing_id| is
+  // considered untrusted, so the renderer process is killed if it refers to a
+  // RenderFrameHostImpl that is not a child of this node.
+  RenderFrameHostImpl* FindAndVerifyChild(int32_t child_frame_routing_id,
+                                          bad_message::BadMessageReason reason);
+
+  // Returns the child RenderFrameHostImpl if |child_frame_token| is an
+  // immediate child of this FrameTreeNode. |child_frame_token| is considered
+  // untrusted, so the renderer process is killed if it refers to a
+  // RenderFrameHostImpl that is not a child of this node.
+  RenderFrameHostImpl* FindAndVerifyChild(
+      const base::UnguessableToken& child_frame_token,
+      bad_message::BadMessageReason reason);
+
+  mojo::PendingRemote<network::mojom::CookieAccessObserver>
+  CreateCookieAccessObserver();
+
+  // network::mojom::CookieAccessObserver:
+  void OnCookiesAccessed(
+      network::mojom::CookieAccessDetailsPtr details) override;
+
  protected:
   friend class RenderFrameHostFactory;
 
@@ -1448,13 +1629,17 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // TODO(nasko): Remove dependency on RenderViewHost here. RenderProcessHost
   // should be the abstraction needed here, but we need RenderViewHost to pass
   // into WebContentsObserver::FrameDetached for now.
+  // |lifecycle_state_| can either be kActive or kSpeculative during
+  // RenderFrameHostImpl creation.
   RenderFrameHostImpl(SiteInstance* site_instance,
                       scoped_refptr<RenderViewHostImpl> render_view_host,
                       RenderFrameHostDelegate* delegate,
                       FrameTree* frame_tree,
                       FrameTreeNode* frame_tree_node,
                       int32_t routing_id,
-                      bool renderer_initiated_creation);
+                      const base::UnguessableToken& frame_token,
+                      bool renderer_initiated_creation,
+                      LifecycleState lifecycle_state);
 
   // The SendCommit* functions below are wrappers for commit calls
   // made to mojom::FrameNavigationControl and mojom::NavigationClient.
@@ -1583,9 +1768,15 @@ class CONTENT_EXPORT RenderFrameHostImpl
   FRIEND_TEST_ALL_PREFIXES(RenderFrameHostImplTest, ExpectedMainWorldOrigin);
   FRIEND_TEST_ALL_PREFIXES(SecurityExploitBrowserTest,
                            AttemptDuplicateRenderWidgetHost);
+  FRIEND_TEST_ALL_PREFIXES(RenderDocumentHostUserDataTest,
+                           CheckInPendingDeletionState);
 
   class DroppedInterfaceRequestLogger;
 
+  RenderFrameHostImpl* FindAndVerifyChildInternal(
+      RenderFrameHostOrProxy child_frame_or_proxy,
+      bad_message::BadMessageReason reason);
+
   // Update the RenderProcessHost priority when a navigation occurs.
   void UpdateRenderProcessHostFramePriorities();
 
@@ -1600,9 +1791,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   void OnDidChangeFramePolicy(int32_t frame_routing_id,
                               const blink::FramePolicy& frame_policy);
-  void OnDidChangeFrameOwnerProperties(
-      int32_t frame_routing_id,
-      const blink::mojom::FrameOwnerProperties& properties);
   void OnForwardResourceTimingToParent(
       const ResourceTimingInfo& resource_timing);
   void OnDidStopLoading();
@@ -1613,19 +1801,14 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void OnFrameDidCallFocus();
   void OnSaveImageFromDataURL(const std::string& url_str);
 
-  // To be called by ComputeSiteForCookiesForNavigation() and
-  // ComputeSiteForCookies().
-  // Starts traversing the tree from |render_frame_host|.
-  // |is_origin_secure| is whether the origin of the destination of the
-  // navigation whose site_for_cookies is being calculated is secure.
-  net::SiteForCookies ComputeSiteForCookiesInternal(
-      const RenderFrameHostImpl* render_frame_host,
-      bool is_origin_secure) const;
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void OnShowPopup(const FrameHostMsg_ShowPopup_Params& params);
-  void OnHidePopup();
-#endif
+  // Computes the IsolationInfo for both navigations and subresources.
+  //
+  // For navigations, |frame_origin| is the origin being navigated to. For
+  // subresources, |frame_origin| is the value of |last_committed_origin_|.
+  net::IsolationInfo ComputeIsolationInfoInternal(
+      const url::Origin& frame_origin,
+      net::IsolationInfo::RedirectMode redirect_mode) const;
+
 #if defined(OS_ANDROID)
   void ForwardGetInterfaceToRenderFrame(const std::string& interface_name,
                                         mojo::ScopedMessagePipeHandle pipe);
@@ -1685,7 +1868,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void DidChangeName(const std::string& name,
                      const std::string& unique_name) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::ParsedFeaturePolicy& feature_policy_header,
       const blink::DocumentPolicy::FeatureState& document_policy_header)
       override;
@@ -1715,8 +1898,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void HandleAXLocationChanges(
       std::vector<mojom::LocationChangesPtr> changes) override;
 
-  // Registers Mojo interfaces that this frame host makes available.
-  void RegisterMojoInterfaces();
+  // mojom::DomAutomationControllerHost:
+  void DomOperationResponse(const std::string& json_string) override;
+
+  // network::mojom::CookieAccessObserver
+  void Clone(mojo::PendingReceiver<network::mojom::CookieAccessObserver>
+                 observer) override;
 
   // Resets any waiting state of this RenderFrameHost that is no longer
   // relevant.
@@ -1826,13 +2013,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // frames, it will return the current frame's view.
   RenderWidgetHostViewBase* GetViewForAccessibility();
 
-  // Returns the child FrameTreeNode if |child_frame_routing_id| is an
-  // immediate child of this FrameTreeNode.  |child_frame_routing_id| is
-  // considered untrusted, so the renderer process is killed if it refers to a
-  // FrameTreeNode that is not a child of this node.
-  FrameTreeNode* FindAndVerifyChild(int32_t child_frame_routing_id,
-                                    bad_message::BadMessageReason reason);
-
   // Returns a raw pointer to the Web Bluetooth Service owned by the frame. Used
   // for testing purposes only (see |TestRenderFrameHost|).
   WebBluetoothServiceImpl* GetWebBluetoothServiceForTesting();
@@ -1861,8 +2041,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // when no appropriate NavigationRequest has been found.
   std::unique_ptr<NavigationRequest> CreateNavigationRequestForCommit(
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      bool is_same_document,
-      NavigationEntryImpl* entry_for_request);
+      bool is_same_document);
 
   // Whether the |request| corresponds to a navigation to the pending
   // NavigationEntry. This is used at commit time, when the NavigationRequest
@@ -1927,11 +2106,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Update this frame's last committed origin.
   void SetLastCommittedOrigin(const url::Origin& origin);
 
-  // Set the |last_committed_origin_| and |network_isolation_key_| of |this|
-  // frame, inheriting the origin from |new_frame_creator| as appropriate
-  // (e.g. depending on whether |this| frame should be sandboxed / should have
-  // an opaque origin instead).
-  void SetOriginAndNetworkIsolationKeyOfNewFrame(
+  // Set the |last_committed_origin_| and |isolation_info_| of |this| frame,
+  // inheriting the origin from |new_frame_creator| as appropriate (e.g.
+  // depending on whether |this| frame should be sandboxed / should have an
+  // opaque origin instead).
+  void SetOriginAndIsolationInfoOfNewFrame(
       const url::Origin& new_frame_creator);
 
   // Called when a navigation commits succesfully to |url|. This will update
@@ -2132,6 +2311,14 @@ class CONTENT_EXPORT RenderFrameHostImpl
     return has_unload_handler_ || do_not_delete_for_testing_;
   }
 
+  // Updates the |lifecycle_state_|. Called when there is a change in the
+  // RenderFrameHost LifecycleState.
+  void SetLifecycleState(LifecycleState state);
+
+  void BindReportingObserver(
+      mojo::PendingReceiver<blink::mojom::ReportingObserver>
+          reporting_observer_receiver);
+
   // The RenderViewHost that this RenderFrameHost is associated with.
   //
   // It is kept alive as long as any RenderFrameHosts or RenderFrameProxyHosts
@@ -2192,8 +2379,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   network::CrossOriginEmbedderPolicy cross_origin_embedder_policy_;
 
-  network::mojom::CrossOriginOpenerPolicy cross_origin_opener_policy_ =
-      network::mojom::CrossOriginOpenerPolicy::kUnsafeNone;
+  network::CrossOriginOpenerPolicy cross_origin_opener_policy_;
 
   // Track the site URL of the last site we committed successfully, as obtained
   // from SiteInstance::GetSiteURL.
@@ -2307,11 +2493,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   std::unique_ptr<blink::AssociatedInterfaceRegistry> associated_registry_;
 
-  std::unique_ptr<service_manager::BinderRegistry> registry_;
   std::unique_ptr<service_manager::InterfaceProvider> remote_interfaces_;
 
   std::list<std::unique_ptr<WebBluetoothServiceImpl>> web_bluetooth_services_;
 
+  std::unique_ptr<ScreenEnumerationImpl> screen_enumeration_impl_;
+
   // The object managing the accessibility tree for this frame.
   std::unique_ptr<BrowserAccessibilityManager> browser_accessibility_manager_;
 
@@ -2497,7 +2684,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // copy of the active sandbox flags which are stored in the FrameTreeNode for
   // this RenderFrameHost, but may diverge if this RenderFrameHost is pending
   // deletion.
-  blink::mojom::WebSandboxFlags active_sandbox_flags_;
+  network::mojom::WebSandboxFlags active_sandbox_flags_;
 
   // Tracks the document policy which has been set on this frame.
   std::unique_ptr<blink::DocumentPolicy> document_policy_;
@@ -2566,7 +2753,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       dropped_interface_request_logger_;
 
   // IPC-friendly token that represents this host.
-  const base::UnguessableToken frame_token_ = base::UnguessableToken::Create();
+  const base::UnguessableToken frame_token_;
 
   viz::mojom::InputTargetClient* input_target_client_ = nullptr;
   mojo::Remote<mojom::FrameInputHandler> frame_input_handler_;
@@ -2580,6 +2767,9 @@ class CONTENT_EXPORT RenderFrameHostImpl
   mojo::AssociatedReceiver<mojom::RenderAccessibilityHost>
       render_accessibility_host_receiver_{this};
 
+  mojo::AssociatedReceiver<mojom::DomAutomationControllerHost>
+      dom_automation_controller_receiver_{this};
+
   std::unique_ptr<KeepAliveHandleFactory> keep_alive_handle_factory_;
   base::TimeDelta keep_alive_timeout_;
 
@@ -2613,23 +2803,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // empty document is loaded.
   blink::mojom::ResourceLoadInfoPtr deferred_main_frame_load_info_;
 
-  enum class UnloadState {
-    // The initial state. The frame is alive.
-    NotRun,
-
-    // An event such as a navigation happened causing the frame to start its
-    // deletion. IPC are sent to execute the unload handlers and delete the
-    // RenderFrame. The RenderFrameHost is waiting for an ACK. Either
-    // FrameHostMsg_Unload_ACK for the navigating frame, or FrameHostMsg_Detach
-    // for its subframe.
-    InProgress,
-
-    // The unload handlers have run. Once all the descendant frames in other
-    // processes are gone, this RenderFrameHost can delete itself too.
-    Completed,
-  };
-  UnloadState unload_state_ = UnloadState::NotRun;
-
   // If a subframe failed to finish running its unload handler after
   // |subframe_unload_timeout_| the RenderFrameHost is deleted.
   base::TimeDelta subframe_unload_timeout_;
@@ -2638,7 +2811,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   base::OneShotTimer subframe_unload_timer_;
 
   // BackForwardCache:
-  bool is_in_back_forward_cache_ = false;
   bool is_evicted_from_back_forward_cache_ = false;
   base::OneShotTimer back_forward_cache_eviction_timer_;
 
@@ -2686,12 +2858,13 @@ class CONTENT_EXPORT RenderFrameHostImpl
   scoped_refptr<PrefetchedSignedExchangeCache>
       prefetched_signed_exchange_cache_;
 
-  // Network isolation key to be used for subresources from the currently
-  // committed navigation. This is specific to a document and should be reset on
+  // Isolation information to be used for subresources from the currently
+  // committed navigation. Stores both the SiteForCookies and the
+  // NetworkIsolationKey. This is specific to a document and should be reset on
   // every cross-document commit. When a new frame is created, the new frame
-  // inherits the network isolation key from the creator frame, similarly to the
-  // last committed origin.
-  net::NetworkIsolationKey network_isolation_key_;
+  // inherits the IsolationInfo from the creator frame, similarly to the last
+  // committed origin.
+  net::IsolationInfo isolation_info_;
 
   // Hold onto hashes of the last |kMaxCookieSameSiteDeprecationUrls| cookie
   // URLs that we have seen since the last committed navigation, in order to
@@ -2754,15 +2927,46 @@ class CONTENT_EXPORT RenderFrameHostImpl
   scoped_refptr<WebAuthRequestSecurityChecker>
       webauth_request_security_checker_;
 
+  // Container for arbitrary document-associated feature-specific data. Should
+  // be reset when committing a cross-document navigation in this
+  // RenderFrameHost. Please refer to the description at
+  // content/public/browser/render_document_host_user_data.h for more details.
+  class DocumentAssociatedData : public base::SupportsUserData {
+    friend class RenderFrameHostImpl;
+  };
+  DocumentAssociatedData document_associated_data_;
+
   // This time is used to record the last WebXR DOM Overlay setup request.
   base::TimeTicks last_xr_overlay_setup_time_;
 
   std::unique_ptr<CrossOriginEmbedderPolicyReporter> coep_reporter_;
 
+  // Navigation ID for the last committed cross-document non-bfcached navigation
+  // in this RenderFrameHost.
+  // TODO(crbug.com/936696): Make this const after we have RenderDocument.
+  int64_t last_committed_cross_document_navigation_id_ = -1;
+
+  // Tracks the state of |this| RenderFrameHost from the point it is created to
+  // when it gets deleted.
+  LifecycleState lifecycle_state_;
+
   // If true, RenderFrameHost should not be actually deleted and should be left
   // stuck in pending deletion.
   bool do_not_delete_for_testing_ = false;
 
+  // Embedding token for the document in this RenderFrameHost.
+  base::Optional<base::UnguessableToken> embedding_token_;
+
+  // Observers listening to cookie access notifications for the current document
+  // in this RenderFrameHost.
+  // Note: at the moment this set is not cleared when a new document is created
+  // in this RenderFrameHost. This is done because the first observer is created
+  // before the navigation actually commits and because the old routing id-based
+  // behaved in the same way as well.
+  // This problem should go away with RenderDocumentHost in any case.
+  // TODO(crbug.com/936696): Remove this warning after the RDH ships.
+  mojo::ReceiverSet<network::mojom::CookieAccessObserver> cookie_observers_;
+
   // NOTE: This must be the last member.
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc b/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
index 06d73274943..fb399217074 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
@@ -34,11 +34,14 @@
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/common/page_visibility_state.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/navigation_handle_observer.h"
+#include "content/public/test/render_frame_host_test_support.h"
 #include "content/public/test/simple_url_loader_test_helper.h"
 #include "content/public/test/test_frame_navigation_observer.h"
 #include "content/public/test/test_navigation_observer.h"
@@ -164,6 +167,7 @@ class FirstPartySchemeContentBrowserClient : public TestContentBrowserClient {
 // See https://crbug.com/491535
 class RenderFrameHostImplBrowserTest : public ContentBrowserTest {
  public:
+  using LifecycleState = RenderFrameHostImpl::LifecycleState;
   RenderFrameHostImplBrowserTest()
       : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {
     // This makes the tests that check NetworkIsolationKeys make sure both the
@@ -188,6 +192,11 @@ class RenderFrameHostImplBrowserTest : public ContentBrowserTest {
     host_resolver()->AddRule("*", "127.0.0.1");
     SetupCrossSiteRedirector(embedded_test_server());
     ASSERT_TRUE(embedded_test_server()->Start());
+
+    // TODO(https://crbug.com/794320): Remove this when the new Java Bridge code
+    // is integrated into WebView.
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        switches::kJavaScriptFlags, "--expose_gc");
   }
   net::EmbeddedTestServer* https_server() { return &https_server_; }
 
@@ -195,6 +204,10 @@ class RenderFrameHostImplBrowserTest : public ContentBrowserTest {
     return static_cast<WebContentsImpl*>(shell()->web_contents());
   }
 
+  RenderFrameHostImpl* root_frame_host() const {
+    return web_contents()->GetMainFrame();
+  }
+
  private:
   base::test::ScopedFeatureList feature_list_;
   net::EmbeddedTestServer https_server_;
@@ -453,10 +466,12 @@ class RenderFrameHostFactoryForBeforeUnloadInterceptor
       FrameTree* frame_tree,
       FrameTreeNode* frame_tree_node,
       int32_t routing_id,
+      const base::UnguessableToken& frame_token,
       bool renderer_initiated_creation) override {
     return base::WrapUnique(new RenderFrameHostImplForBeforeUnloadInterceptor(
         site_instance, std::move(render_view_host), delegate, frame_tree,
-        frame_tree_node, routing_id, renderer_initiated_creation));
+        frame_tree_node, routing_id, frame_token, renderer_initiated_creation,
+        RenderFrameHostImpl::LifecycleState::kActive));
   }
 };
 
@@ -772,7 +787,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBeforeUnloadBrowserTest,
   // navigation, so it swapped RenderFrameHosts. |main_frame| should now be
   // pending deletion and waiting for unload ACK, but it should not be waiting
   // for the beforeunload completion callback.
-  EXPECT_FALSE(main_frame->is_active());
+  EXPECT_TRUE(main_frame->IsPendingDeletion());
   EXPECT_FALSE(main_frame->is_waiting_for_beforeunload_completion());
   EXPECT_EQ(0u, main_frame->beforeunload_pending_replies_.size());
   EXPECT_EQ(nullptr, main_frame->GetBeforeUnloadInitiator());
@@ -1156,9 +1171,11 @@ class ExecuteScriptBeforeRenderFrameDeletedHelper
 // code and may run nested message loops and send sync IPC messages.
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
                        FrameDetached_WindowOpenIPCFails) {
-  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "title1.html")));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
   EXPECT_EQ(1u, Shell::windows().size());
-  GURL test_url = GetTestUrl("render_frame_host", "window_open.html");
+  GURL test_url =
+      embedded_test_server()->GetURL("/render_frame_host/window_open.html");
   std::string open_script =
       base::StringPrintf("popup = window.open('%s');", test_url.spec().c_str());
 
@@ -3097,7 +3114,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeSiteForCookiesForNavigation) {
+                       ComputeIsolationInfoForNavigationSiteForCookies) {
   // Start second server for HTTPS.
   https_server()->ServeFilesFromSourceDirectory(GetTestDataFilePath());
   ASSERT_TRUE(https_server()->Start());
@@ -3132,22 +3149,28 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
     FrameTreeNode* child_d = child_b->child_at(0);
     EXPECT_EQ("d.com", child_d->current_url().host());
 
-    EXPECT_EQ("a.com", main_frame->ComputeSiteForCookiesForNavigation(url)
+    EXPECT_EQ("a.com", main_frame->ComputeIsolationInfoForNavigation(url)
+                           .site_for_cookies()
                            .registrable_domain());
-    EXPECT_EQ("b.com", main_frame->ComputeSiteForCookiesForNavigation(b_url)
+    EXPECT_EQ("b.com", main_frame->ComputeIsolationInfoForNavigation(b_url)
+                           .site_for_cookies()
                            .registrable_domain());
-    EXPECT_EQ("c.com", main_frame->ComputeSiteForCookiesForNavigation(c_url)
+    EXPECT_EQ("c.com", main_frame->ComputeIsolationInfoForNavigation(c_url)
+                           .site_for_cookies()
                            .registrable_domain());
 
     // a.com -> a.com frame being navigated.
     EXPECT_EQ("a.com", child_a->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(url)
+                           ->ComputeIsolationInfoForNavigation(url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_a->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(b_url)
+                           ->ComputeIsolationInfoForNavigation(b_url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_a->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(c_url)
+                           ->ComputeIsolationInfoForNavigation(c_url)
+                           .site_for_cookies()
                            .registrable_domain());
 
     // a.com -> a.com -> b.com frame being navigated.
@@ -3156,35 +3179,44 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
     // a/a/a from a/a/b. We currently treat this as all first-party, but there
     // is a case to be made for doing it differently, due to involvement of b.
     EXPECT_EQ("a.com", child_b->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(url)
+                           ->ComputeIsolationInfoForNavigation(url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_b->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(b_url)
+                           ->ComputeIsolationInfoForNavigation(b_url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_b->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(c_url)
+                           ->ComputeIsolationInfoForNavigation(c_url)
+                           .site_for_cookies()
                            .registrable_domain());
 
     // a.com -> c.com frame being navigated.
     EXPECT_EQ("a.com", child_c->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(url)
+                           ->ComputeIsolationInfoForNavigation(url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_c->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(b_url)
+                           ->ComputeIsolationInfoForNavigation(b_url)
+                           .site_for_cookies()
                            .registrable_domain());
     EXPECT_EQ("a.com", child_c->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(c_url)
+                           ->ComputeIsolationInfoForNavigation(c_url)
+                           .site_for_cookies()
                            .registrable_domain());
 
     // a.com -> a.com -> b.com -> d.com frame being navigated.
     EXPECT_EQ("", child_d->current_frame_host()
-                      ->ComputeSiteForCookiesForNavigation(url)
+                      ->ComputeIsolationInfoForNavigation(url)
+                      .site_for_cookies()
                       .registrable_domain());
     EXPECT_EQ("", child_d->current_frame_host()
-                      ->ComputeSiteForCookiesForNavigation(b_url)
+                      ->ComputeIsolationInfoForNavigation(b_url)
+                      .site_for_cookies()
                       .registrable_domain());
     EXPECT_EQ("", child_d->current_frame_host()
-                      ->ComputeSiteForCookiesForNavigation(c_url)
+                      ->ComputeIsolationInfoForNavigation(c_url)
+                      .site_for_cookies()
                       .registrable_domain());
   }
 
@@ -3217,38 +3249,40 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 
     // Main frame navigations are not affected by the special schema.
     EXPECT_TRUE(net::SiteForCookies::FromUrl(url).IsEquivalent(
-        main_frame->ComputeSiteForCookiesForNavigation(url)));
+        main_frame->ComputeIsolationInfoForNavigation(url).site_for_cookies()));
     EXPECT_TRUE(net::SiteForCookies::FromUrl(b_url).IsEquivalent(
-        main_frame->ComputeSiteForCookiesForNavigation(b_url)));
+        main_frame->ComputeIsolationInfoForNavigation(b_url)
+            .site_for_cookies()));
     EXPECT_TRUE(net::SiteForCookies::FromUrl(c_url).IsEquivalent(
-        main_frame->ComputeSiteForCookiesForNavigation(c_url)));
+        main_frame->ComputeIsolationInfoForNavigation(c_url)
+            .site_for_cookies()));
 
     // Child navigation gets the magic scheme.
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aa->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(url)));
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aa->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(b_url)));
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aa->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(c_url)));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aa->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(url)
+                                      .site_for_cookies()));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aa->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(b_url)
+                                      .site_for_cookies()));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aa->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(c_url)
+                                      .site_for_cookies()));
 
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aabd->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(url)));
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aabd->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(b_url)));
-    EXPECT_TRUE(
-        net::SiteForCookies::FromUrl(trusty_url)
-            .IsEquivalent(child_aabd->current_frame_host()
-                              ->ComputeSiteForCookiesForNavigation(c_url)));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aabd->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(url)
+                                      .site_for_cookies()));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aabd->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(b_url)
+                                      .site_for_cookies()));
+    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
+                    .IsEquivalent(child_aabd->current_frame_host()
+                                      ->ComputeIsolationInfoForNavigation(c_url)
+                                      .site_for_cookies()));
   }
 
   // Test trusted scheme that gives first-partiness if the url is secure.
@@ -3280,43 +3314,133 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 
     // Main frame navigations are not affected by the special schema.
     EXPECT_TRUE(net::SiteForCookies::FromUrl(url).IsEquivalent(
-        main_frame->ComputeSiteForCookiesForNavigation(url)));
+        main_frame->ComputeIsolationInfoForNavigation(url).site_for_cookies()));
     EXPECT_TRUE(net::SiteForCookies::FromUrl(b_url).IsEquivalent(
-        main_frame->ComputeSiteForCookiesForNavigation(b_url)));
+        main_frame->ComputeIsolationInfoForNavigation(b_url)
+            .site_for_cookies()));
     EXPECT_TRUE(
         net::SiteForCookies::FromUrl(secure_url)
             .IsEquivalent(
-                main_frame->ComputeSiteForCookiesForNavigation(secure_url)));
+                main_frame->ComputeIsolationInfoForNavigation(secure_url)
+                    .site_for_cookies()));
 
     // Child navigation gets the magic scheme iff secure.
     EXPECT_TRUE(child_aa->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(url)
+                    ->ComputeIsolationInfoForNavigation(url)
+                    .site_for_cookies()
                     .IsNull());
     EXPECT_TRUE(child_aa->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(b_url)
+                    ->ComputeIsolationInfoForNavigation(b_url)
+                    .site_for_cookies()
                     .IsNull());
-    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
-                    .IsEquivalent(
-                        child_aa->current_frame_host()
-                            ->ComputeSiteForCookiesForNavigation(secure_url)));
+    EXPECT_TRUE(
+        net::SiteForCookies::FromUrl(trusty_url)
+            .IsEquivalent(child_aa->current_frame_host()
+                              ->ComputeIsolationInfoForNavigation(secure_url)
+                              .site_for_cookies()));
 
     EXPECT_TRUE(child_aabd->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(url)
+                    ->ComputeIsolationInfoForNavigation(url)
+                    .site_for_cookies()
                     .IsNull());
     EXPECT_TRUE(child_aabd->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(b_url)
+                    ->ComputeIsolationInfoForNavigation(b_url)
+                    .site_for_cookies()
                     .IsNull());
-    EXPECT_TRUE(net::SiteForCookies::FromUrl(trusty_url)
-                    .IsEquivalent(
-                        child_aabd->current_frame_host()
-                            ->ComputeSiteForCookiesForNavigation(secure_url)));
+    EXPECT_TRUE(
+        net::SiteForCookies::FromUrl(trusty_url)
+            .IsEquivalent(child_aabd->current_frame_host()
+                              ->ComputeIsolationInfoForNavigation(secure_url)
+                              .site_for_cookies()));
   }
 
   SetBrowserClientForTesting(old_client);
 }
 
+// Test that when ancestor iframes differ in scheme that the SiteForCookies
+// state is updated accordingly.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       ComputeSiteForCookiesSchemefulIsSameForAncestorFrames) {
+  https_server()->ServeFilesFromSourceDirectory(GetTestDataFilePath());
+  https_server()->SetSSLConfig(net::EmbeddedTestServer::CERT_TEST_NAMES);
+  ASSERT_TRUE(https_server()->Start());
+
+  GURL url = https_server()->GetURL(
+      "a.test", "/cross_site_iframe_factory.html?a.test(a.test)");
+  GURL insecure_url = embedded_test_server()->GetURL(
+      "a.test", "/cross_site_iframe_factory.html?a.test(a.test(a.test))");
+  GURL other_url = https_server()->GetURL("c.test", "/");
+  EXPECT_TRUE(NavigateToURL(shell(), insecure_url));
+  {
+    WebContentsImpl* wc =
+        static_cast<WebContentsImpl*>(shell()->web_contents());
+    RenderFrameHostImpl* main_frame = wc->GetMainFrame();
+
+    EXPECT_EQ("a.test", main_frame->GetLastCommittedURL().host());
+    EXPECT_EQ("http", main_frame->frame_tree_node()->current_origin().scheme());
+    ASSERT_EQ(1u, main_frame->child_count());
+    FrameTreeNode* child = main_frame->child_at(0);
+    EXPECT_EQ("a.test", child->current_url().host());
+    EXPECT_EQ("http", child->current_origin().scheme());
+    ASSERT_EQ(1u, child->child_count());
+    FrameTreeNode* grandchild = child->child_at(0);
+    EXPECT_EQ("a.test", grandchild->current_url().host());
+
+    // Both the frames above grandchild are the same scheme, so
+    // SiteForCookies::schemefully_same() should indicate that.
+    EXPECT_TRUE(child->current_frame_host()
+                    ->ComputeIsolationInfoForNavigation(other_url)
+                    .site_for_cookies()
+                    .schemefully_same());
+    EXPECT_EQ("a.test", child->current_frame_host()
+                            ->ComputeIsolationInfoForNavigation(other_url)
+                            .site_for_cookies()
+                            .registrable_domain());
+
+    net::SiteForCookies grandchild_same_scheme =
+        grandchild->current_frame_host()->ComputeSiteForCookies();
+    EXPECT_TRUE(grandchild_same_scheme.schemefully_same());
+    EXPECT_EQ("a.test", grandchild_same_scheme.registrable_domain());
+
+    net::SiteForCookies grandchild_same_scheme_navigation =
+        grandchild->current_frame_host()
+            ->ComputeIsolationInfoForNavigation(other_url)
+            .site_for_cookies();
+    EXPECT_TRUE(grandchild_same_scheme_navigation.schemefully_same());
+    EXPECT_EQ("a.test", grandchild_same_scheme_navigation.registrable_domain());
+
+    // Navigate the middle child frame to https.
+    NavigateFrameToURL(child, url);
+    EXPECT_EQ("a.test", child->current_url().host());
+    EXPECT_EQ("https", child->current_origin().scheme());
+    EXPECT_EQ(1u, child->child_count());
+
+    grandchild = child->child_at(0);
+
+    // Now the frames above grandchild differ only in scheme. SiteForCookies
+    // should be the same except that schemefully_same() should be false.
+    net::SiteForCookies grandchild_cross_scheme =
+        grandchild->current_frame_host()->ComputeSiteForCookies();
+    EXPECT_FALSE(grandchild_cross_scheme.schemefully_same());
+    EXPECT_EQ("a.test", grandchild_cross_scheme.registrable_domain());
+
+    net::SiteForCookies grandchild_cross_scheme_navigation =
+        grandchild->current_frame_host()
+            ->ComputeIsolationInfoForNavigation(other_url)
+            .site_for_cookies();
+    EXPECT_FALSE(grandchild_cross_scheme_navigation.schemefully_same());
+    EXPECT_EQ("a.test",
+              grandchild_cross_scheme_navigation.registrable_domain());
+
+    // IsEquivalent() doesn't check schemefully_same.
+    EXPECT_TRUE(grandchild_cross_scheme.IsEquivalent(grandchild_same_scheme));
+    EXPECT_TRUE(grandchild_cross_scheme_navigation.IsEquivalent(
+        grandchild_same_scheme_navigation));
+  }
+}
+
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeSiteForCookiesForNavigationSandbox) {
+                       ComputeIsolationInfoForNavigationSiteForCookiesSandbox) {
   // Test sandboxed subframe.
   {
     GURL url = embedded_test_server()->GetURL(
@@ -3358,13 +3482,15 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
     // |child_aa| frame navigation should be cross-site since its parent is
     // sandboxed without allow-same-origin
     EXPECT_TRUE(child_aa->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(url)
+                    ->ComputeIsolationInfoForNavigation(url)
+                    .site_for_cookies()
                     .IsNull());
 
     // |child_a2a| frame navigation should be same-site since its sandboxed
     // parent is sandbox-same-origin.
     EXPECT_EQ("a.com", child_a2a->current_frame_host()
-                           ->ComputeSiteForCookiesForNavigation(url)
+                           ->ComputeIsolationInfoForNavigation(url)
+                           .site_for_cookies()
                            .registrable_domain());
   }
 
@@ -3387,13 +3513,15 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
         child_a->current_frame_host()->GetLastCommittedOrigin().opaque());
 
     EXPECT_TRUE(child_a->current_frame_host()
-                    ->ComputeSiteForCookiesForNavigation(url)
+                    ->ComputeIsolationInfoForNavigation(url)
+                    .site_for_cookies()
                     .IsNull());
   }
 }
 
-IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeSiteForCookiesForNavigationAboutBlank) {
+IN_PROC_BROWSER_TEST_F(
+    RenderFrameHostImplBrowserTest,
+    ComputeIsolationInfoForNavigationSiteForCookiesAboutBlank) {
   GURL url = embedded_test_server()->GetURL(
       "a.com", "/page_with_blank_iframe_tree.html");
 
@@ -3419,12 +3547,13 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   // navigating the nested about:blank iframe to a.com is fine, since the origin
   // is inherited.
   EXPECT_EQ("a.com", child_aa->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(url)
+                         ->ComputeIsolationInfoForNavigation(url)
+                         .site_for_cookies()
                          .registrable_domain());
 }
 
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeSiteForCookiesForNavigationSrcDoc) {
+                       ComputeIsolationInfoForNavigationSiteForCookiesSrcDoc) {
   // srcdoc frames basically don't figure into site_for_cookies computation.
   GURL url = embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_srcdoc_iframe_tree.html");
@@ -3450,26 +3579,33 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   ASSERT_EQ(0u, child_sd_a_sd->child_count());
 
   EXPECT_EQ("a.com", child_sd->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(url)
+                         ->ComputeIsolationInfoForNavigation(url)
+                         .site_for_cookies()
                          .registrable_domain());
   EXPECT_EQ("a.com", child_sd_a->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(url)
+                         ->ComputeIsolationInfoForNavigation(url)
+                         .site_for_cookies()
                          .registrable_domain());
   EXPECT_EQ("a.com", child_sd_a_sd->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(url)
+                         ->ComputeIsolationInfoForNavigation(url)
+                         .site_for_cookies()
                          .registrable_domain());
 
   GURL b_url = embedded_test_server()->GetURL("b.com", "/");
-  EXPECT_EQ("b.com", main_frame->ComputeSiteForCookiesForNavigation(b_url)
+  EXPECT_EQ("b.com", main_frame->ComputeIsolationInfoForNavigation(b_url)
+                         .site_for_cookies()
                          .registrable_domain());
   EXPECT_EQ("a.com", child_sd->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(b_url)
+                         ->ComputeIsolationInfoForNavigation(b_url)
+                         .site_for_cookies()
                          .registrable_domain());
   EXPECT_EQ("a.com", child_sd_a->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(b_url)
+                         ->ComputeIsolationInfoForNavigation(b_url)
+                         .site_for_cookies()
                          .registrable_domain());
   EXPECT_EQ("a.com", child_sd_a_sd->current_frame_host()
-                         ->ComputeSiteForCookiesForNavigation(b_url)
+                         ->ComputeIsolationInfoForNavigation(b_url)
+                         .site_for_cookies()
                          .registrable_domain());
 }
 
@@ -3537,10 +3673,10 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 
   // The old RFH should be pending deletion, but its site_for_cookies should
   // be unchanged.
-  EXPECT_FALSE(child_rfh->is_active());
+  EXPECT_TRUE(child_rfh->IsPendingDeletion());
   EXPECT_EQ(kid_url, child_rfh->GetLastCommittedURL());
   EXPECT_EQ(url, main_frame->GetLastCommittedURL());
-  EXPECT_FALSE(main_frame->is_active());
+  EXPECT_TRUE(main_frame->IsPendingDeletion());
   EXPECT_FALSE(main_frame->IsCurrent());
   net::SiteForCookies computed_for_child = child_rfh->ComputeSiteForCookies();
   EXPECT_TRUE(
@@ -3616,7 +3752,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest, WebUiReloadAfterCrash) {
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
                        CheckIsCurrentBeforeAndAfterUnload) {
   IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
-  std::string onunload_script = "window.onunload = function(){}";
+  std::string onunload_script = "window.onunload = function(){ while(1);}";
   GURL url_ab(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   GURL url_c(embedded_test_server()->GetURL("c.com", "/title1.html"));
@@ -3626,13 +3762,12 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   RenderFrameHostImpl* rfh_a = web_contents()->GetMainFrame();
   RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
   RenderFrameDeletedObserver delete_rfh_b(rfh_b);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_b->unload_state_);
+  EXPECT_EQ(LifecycleState::kActive, rfh_b->lifecycle_state());
 
-  // 2) Set an arbitrarily long timeout to ensure the subframe unload timer
-  // doesn't fire before we call OnDetach(). Act as if there was a slow unload
-  // handler on rfh_b. The non navigating frames are waiting for
-  // FrameHostMsg_Detach.
-  rfh_b->SetSubframeUnloadTimeoutForTesting(base::TimeDelta::FromSeconds(30));
+  // 2) Disable the unload timer to ensure that the unload timer doesn't fire
+  // before we call OnDetach(). Act as if there was a slow unload handler on
+  // rfh_b. The non navigating frames are waiting for FrameHostMsg_Detach.
+  rfh_b->DisableUnloadTimerForTesting();
   auto detach_filter = base::MakeRefCounted<DropMessageFilter>(
       FrameMsgStart, FrameHostMsg_Detach::ID);
   rfh_b->GetProcess()->AddFilter(detach_filter.get());
@@ -3645,7 +3780,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   // 4) Navigate rfh_a to C.
   EXPECT_TRUE(NavigateToURL(shell(), url_c));
   RenderFrameHostImpl* rfh_c = web_contents()->GetMainFrame();
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_b->unload_state_);
+  EXPECT_EQ(LifecycleState::kRunningUnloadHandlers, rfh_b->lifecycle_state());
 
   // 5) Check the IsCurrent state of rfh_a, rfh_b and rfh_c after navigating to
   // C.
@@ -3659,6 +3794,137 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   EXPECT_TRUE(delete_rfh_b.deleted());
 }
 
+// Test the LifecycleState is updated correctly for the main frame during
+// navigation.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       CheckLifecycleStateTransitionOnMainFrame) {
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = root_frame_host();
+  EXPECT_EQ(LifecycleState::kActive, rfh_a->lifecycle_state());
+
+  // 2) Leave rfh_a in pending deletion state to check for rfh_a LifecycleState
+  // after navigating to B.
+  LeaveInPendingDeletionState(rfh_a);
+
+  // 3) Start navigation to B, but don't commit yet.
+  TestNavigationManager manager(shell()->web_contents(), url_b);
+  shell()->LoadURL(url_b);
+  EXPECT_TRUE(manager.WaitForRequestStart());
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  RenderFrameHostImpl* pending_rfh =
+      root->render_manager()->speculative_frame_host();
+  NavigationRequest* navigation_request = root->navigation_request();
+  EXPECT_EQ(navigation_request->associated_site_instance_type(),
+            NavigationRequest::AssociatedSiteInstanceType::SPECULATIVE);
+  EXPECT_TRUE(pending_rfh);
+
+  // 4) Check the LifecycleState of both rfh_a and pending_rfh before commit.
+  EXPECT_EQ(LifecycleState::kSpeculative, pending_rfh->lifecycle_state());
+  EXPECT_EQ(LifecycleState::kActive, rfh_a->lifecycle_state());
+  EXPECT_EQ(root_frame_host(), rfh_a);
+
+  // 5) Let the navigation finish and make sure it is succeeded.
+  manager.WaitForNavigationFinished();
+  EXPECT_EQ(url_b, web_contents()->GetMainFrame()->GetLastCommittedURL());
+  RenderFrameHostImpl* rfh_b = root_frame_host();
+
+  // 6) Check the LifecycleState of both rfh_a and rfh_b after navigating to B.
+  EXPECT_EQ(LifecycleState::kRunningUnloadHandlers, rfh_a->lifecycle_state());
+  EXPECT_EQ(LifecycleState::kActive, rfh_b->lifecycle_state());
+}
+
+// Test the LifecycleState is updated correctly for a subframe.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       CheckRFHLifecycleStateTransitionOnSubFrame) {
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+  GURL url_ab(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  GURL url_c(embedded_test_server()->GetURL("c.com", "/title1.html"));
+
+  // Lifecycle state of initial (Blank page) RenderFrameHost should be active as
+  // we don't update the LifecycleState prior to navigation commits (to new URL
+  // i.e., url_ab in this case).
+  EXPECT_EQ(LifecycleState::kActive, root_frame_host()->lifecycle_state());
+
+  // 1) Navigate to a page with an iframe.
+  EXPECT_TRUE(NavigateToURL(shell(), url_ab));
+  RenderFrameHostImpl* rfh_a = web_contents()->GetMainFrame();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+  EXPECT_EQ(LifecycleState::kActive, rfh_b->lifecycle_state());
+
+  // 2) Navigate B's subframe to a cross-site C.
+  NavigateFrameToURL(rfh_b->frame_tree_node(), url_c);
+
+  // 3) Check LifecycleState of sub-frame rfh_c after navigating from subframe
+  // rfh_b.
+  RenderFrameHostImpl* rfh_c = rfh_a->child_at(0)->current_frame_host();
+  EXPECT_EQ(LifecycleState::kActive, rfh_c->lifecycle_state());
+
+  // 4) Add a new child frame.
+  RenderFrameHostCreatedObserver subframe_observer(web_contents());
+  EXPECT_TRUE(ExecJs(rfh_c,
+                     "let iframe = document.createElement('iframe');"
+                     "document.body.appendChild(iframe);"));
+  subframe_observer.Wait();
+
+  // 5) LifecycleState of newly inserted child frame should be kActive before
+  // navigation.
+  RenderFrameHostImpl* rfh_d = rfh_c->child_at(0)->current_frame_host();
+  EXPECT_EQ(LifecycleState::kActive, rfh_d->lifecycle_state());
+}
+
+// Test the LifecycleState when a renderer crashes during navigation.
+// When navigating after a crash, the new RenderFrameHost should
+// become active immediately, prior to the navigation committing. This is
+// an optimization to prevent the user from sitting around on the sad tab
+// unnecessarily.
+// TODO(https://crbug.com/1072817): This behavior might be revisited in the
+// future.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       CheckRFHLifecycleStateWhenRendererCrashes) {
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = root_frame_host();
+  EXPECT_EQ(LifecycleState::kActive, rfh_a->lifecycle_state());
+
+  // 2) Renderer crash.
+  RenderProcessHost* renderer_process = rfh_a->GetProcess();
+  RenderProcessHostWatcher crash_observer(
+      renderer_process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  renderer_process->Shutdown(0);
+  crash_observer.Wait();
+
+  // 3) Start navigation to B, but don't commit yet.
+  TestNavigationManager manager(shell()->web_contents(), url_b);
+  shell()->LoadURL(url_b);
+  EXPECT_TRUE(manager.WaitForRequestStart());
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  RenderFrameHostImpl* current_rfh =
+      root->render_manager()->current_frame_host();
+  NavigationRequest* navigation_request = root->navigation_request();
+  EXPECT_EQ(navigation_request->associated_site_instance_type(),
+            NavigationRequest::AssociatedSiteInstanceType::CURRENT);
+
+  // 4) Check the LifecycleState of B's RFH.
+  EXPECT_EQ(LifecycleState::kActive, current_rfh->lifecycle_state());
+
+  // 5) Let the navigation finish and make sure it is succeeded.
+  manager.WaitForNavigationFinished();
+  EXPECT_EQ(url_b, web_contents()->GetMainFrame()->GetLastCommittedURL());
+  EXPECT_EQ(LifecycleState::kActive, current_rfh->lifecycle_state());
+}
+
 namespace {
 
 // Collects the committed IPAddressSpaces, and makes them available for
@@ -4017,8 +4283,8 @@ IN_PROC_BROWSER_TEST_F(ContentBrowserTest,
   EXPECT_TRUE(web_contents->IsDocumentOnLoadCompletedInMainFrame());
 }
 
-// TODO(crbug.com/794320): the code below is temporary and will be removed when
-// Java Bridge is mojofied.
+// TODO(https://crbug.com/794320): the code below is temporary and will be
+// removed when Java Bridge is mojofied.
 #if defined(OS_ANDROID)
 
 struct ObjectData {
@@ -4112,8 +4378,8 @@ class MockObjectHost : public blink::mojom::RemoteObjectHost {
     }
   }
 
-  void ReleaseObject(int32_t) override {
-    // TODO(crbug.com/794320): implement this.
+  void ReleaseObject(int32_t object_id) override {
+    release_object_called_[object_id] = true;
   }
 
   mojo::PendingRemote<blink::mojom::RemoteObjectHost> GetRemote() {
@@ -4122,9 +4388,15 @@ class MockObjectHost : public blink::mojom::RemoteObjectHost {
 
   MockObject* GetMockObject() const { return mock_object_.get(); }
 
+  bool release_object_called_for_object(int32_t object_id) const {
+    return release_object_called_.at(object_id);
+  }
+
  private:
   mojo::Receiver<blink::mojom::RemoteObjectHost> receiver_{this};
   std::unique_ptr<MockObject> mock_object_;
+  std::map<int32_t, bool> release_object_called_{{kMainObject.id, false},
+                                                 {kInnerObject.id, false}};
 };
 
 class RemoteObjectInjector : public WebContentsObserver {
@@ -4165,7 +4437,7 @@ void SetupRemoteObjectInvocation(Shell* shell, const GURL& url) {
 }
 }  // namespace
 
-// TODO(crbug.com/794320): Remove this when the new Java Bridge code is
+// TODO(https://crbug.com/794320): Remove this when the new Java Bridge code is
 // integrated into WebView.
 // This test is a temporary way of verifying that the renderer part
 // works as expected.
@@ -4255,5 +4527,31 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   EXPECT_NE(error.find(error_message), std::string::npos);
 }
 
+// Based on testReturnedObjectIsGarbageCollected.
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest, RemoteObjectRelease) {
+  GURL url(embedded_test_server()->GetURL("/empty.html"));
+
+  WebContents* web_contents = shell()->web_contents();
+  RemoteObjectInjector injector(web_contents);
+  SetupRemoteObjectInvocation(shell(), url);
+
+  EXPECT_EQ(
+      "object",
+      EvalJs(
+          web_contents,
+          "globalInner = testObject.getInnerObject(); typeof globalInner; "));
+
+  EXPECT_FALSE(injector.GetObjectHost().release_object_called_for_object(
+      kInnerObject.id));
+  EXPECT_EQ("object", EvalJs(web_contents, "gc(); typeof globalInner;"));
+  EXPECT_FALSE(injector.GetObjectHost().release_object_called_for_object(
+      kInnerObject.id));
+  EXPECT_EQ(
+      "undefined",
+      EvalJs(web_contents, "delete globalInner; gc(); typeof globalInner;"));
+  EXPECT_TRUE(injector.GetObjectHost().release_object_called_for_object(
+      kInnerObject.id));
+}
+
 #endif  // OS_ANDROID
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl_mac_browsertest.mm b/chromium/content/browser/frame_host/render_frame_host_impl_mac_browsertest.mm
index 924e208233b..6c74902c88d 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl_mac_browsertest.mm
+++ b/chromium/content/browser/frame_host/render_frame_host_impl_mac_browsertest.mm
@@ -7,6 +7,7 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/run_loop.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager.cc b/chromium/content/browser/frame_host/render_frame_host_manager.cc
index 4c370c23a22..73050ff98a7 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager.cc
@@ -12,12 +12,13 @@
 #include <utility>
 #include <vector>
 
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/containers/adapters.h"
 #include "base/debug/crash_logging.h"
 #include "base/debug/dump_without_crashing.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
+#include "base/notreached.h"
 #include "base/stl_util.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
@@ -25,11 +26,12 @@
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_navigation_entry.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
+#include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
+#include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
@@ -182,19 +184,23 @@ ShouldSwapBrowsingInstance ShouldProactivelySwapBrowsingInstance(
 // "same-origin + COEP" value.
 // [1] https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e
 bool CrossOriginOpenerPolicyMatch(
-    network::mojom::CrossOriginOpenerPolicy initiator_coop,
+    network::mojom::CrossOriginOpenerPolicyValue initiator_coop,
     network::mojom::CrossOriginEmbedderPolicyValue initiator_coep,
     const url::Origin& initiator_origin,
-    network::mojom::CrossOriginOpenerPolicy destination_coop,
+    network::mojom::CrossOriginOpenerPolicyValue destination_coop,
     network::mojom::CrossOriginEmbedderPolicyValue destination_coep,
     const url::Origin& destination_origin) {
   if (initiator_coop != destination_coop)
     return false;
-  if (initiator_coop == network::mojom::CrossOriginOpenerPolicy::kUnsafeNone)
+  if (initiator_coop ==
+      network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone) {
     return true;
-  if (initiator_coop == network::mojom::CrossOriginOpenerPolicy::kSameOrigin &&
-      initiator_coep != destination_coep)
+  }
+  if (initiator_coop ==
+          network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin &&
+      initiator_coep != destination_coep) {
     return false;
+  }
   if (!initiator_origin.IsSameOriginWith(destination_origin))
     return false;
   return true;
@@ -203,16 +209,17 @@ bool CrossOriginOpenerPolicyMatch(
 // This function returns whether the BrowsingInstance should change following
 // COOP rules defined in:
 // https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e#changes-to-navigation
+// TODO(ahemery): This should be a member of NavigationRequest.
 bool ShouldSwapBrowsingInstanceForCrossOriginOpenerPolicy(
-    network::mojom::CrossOriginOpenerPolicy initiator_coop,
+    network::mojom::CrossOriginOpenerPolicyValue initiator_coop,
     network::mojom::CrossOriginEmbedderPolicyValue initiator_coep,
     const url::Origin& initiator_origin,
     bool is_initiator_aboutblank,
-    network::mojom::CrossOriginOpenerPolicy destination_coop,
+    network::mojom::CrossOriginOpenerPolicyValue destination_coop,
     network::mojom::CrossOriginEmbedderPolicyValue destination_coep,
     const url::Origin& destination_origin) {
   using network::mojom::CrossOriginEmbedderPolicyValue;
-  using network::mojom::CrossOriginOpenerPolicy;
+  using network::mojom::CrossOriginOpenerPolicyValue;
 
   if (!base::FeatureList::IsEnabled(
           network::features::kCrossOriginOpenerPolicy))
@@ -238,8 +245,8 @@ bool ShouldSwapBrowsingInstanceForCrossOriginOpenerPolicy(
   // [1]
   // https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e#changes-to-navigation
   if (is_initiator_aboutblank &&
-      initiator_coop == CrossOriginOpenerPolicy::kSameOriginAllowPopups &&
-      destination_coop == CrossOriginOpenerPolicy::kUnsafeNone) {
+      initiator_coop == CrossOriginOpenerPolicyValue::kSameOriginAllowPopups &&
+      destination_coop == CrossOriginOpenerPolicyValue::kUnsafeNone) {
     return false;
   }
   return true;
@@ -289,13 +296,16 @@ void RenderFrameHostManager::InitRoot(SiteInstance* site_instance,
                                       bool renderer_initiated_creation) {
   SetRenderFrameHost(CreateRenderFrameHost(
       CreateFrameCase::kInitRoot, site_instance,
-      /*frame_routing_id=*/MSG_ROUTING_NONE, renderer_initiated_creation));
+      /*frame_routing_id=*/MSG_ROUTING_NONE, base::UnguessableToken::Create(),
+      renderer_initiated_creation));
 }
 
-void RenderFrameHostManager::InitChild(SiteInstance* site_instance,
-                                       int32_t frame_routing_id) {
+void RenderFrameHostManager::InitChild(
+    SiteInstance* site_instance,
+    int32_t frame_routing_id,
+    const base::UnguessableToken& frame_token) {
   SetRenderFrameHost(CreateRenderFrameHost(
-      CreateFrameCase::kInitChild, site_instance, frame_routing_id,
+      CreateFrameCase::kInitChild, site_instance, frame_routing_id, frame_token,
       /*renderer_initiated_creation=*/false));
   // Notify the delegate of the creation of the current RenderFrameHost.
   // Do this only for subframes, as the main frame case is taken care of by
@@ -311,8 +321,6 @@ RenderViewHostImpl* RenderFrameHostManager::current_host() const {
 }
 
 RenderWidgetHostView* RenderFrameHostManager::GetRenderWidgetHostView() const {
-  if (delegate_->GetInterstitialForRenderManager())
-    return delegate_->GetInterstitialForRenderManager()->GetView();
   if (render_frame_host_)
     return render_frame_host_->GetView();
   return nullptr;
@@ -335,8 +343,6 @@ RenderFrameProxyHost* RenderFrameHostManager::GetProxyToParent() {
     return nullptr;
 
   return GetRenderFrameProxyHost(frame_tree_node_->parent()
-                                     ->render_manager()
-                                     ->current_frame_host()
                                      ->GetSiteInstance());
 }
 
@@ -353,7 +359,6 @@ RenderFrameProxyHost* RenderFrameHostManager::GetProxyToOuterDelegate() {
   }
 
   return GetRenderFrameProxyHost(outer_contents_frame_tree_node->parent()
-                                     ->current_frame_host()
                                      ->GetSiteInstance());
 }
 
@@ -375,8 +380,7 @@ void RenderFrameHostManager::Stop() {
   // A loading speculative RenderFrameHost should also stop.
   if (speculative_render_frame_host_ &&
       speculative_render_frame_host_->is_loading()) {
-    speculative_render_frame_host_->Send(
-        new FrameMsg_Stop(speculative_render_frame_host_->GetRoutingID()));
+    speculative_render_frame_host_->GetAssociatedLocalFrame()->StopLoading();
   }
 }
 
@@ -536,7 +540,7 @@ void RenderFrameHostManager::CommitFramePolicy(
   // Notify all of the frame's proxies about updated policies, excluding
   // the parent process since it already knows the latest state.
   SiteInstance* parent_site_instance =
-      frame_tree_node_->parent()->current_frame_host()->GetSiteInstance();
+      frame_tree_node_->parent()->GetSiteInstance();
   for (const auto& pair : proxy_hosts_) {
     if (pair.second->GetSiteInstance() != parent_site_instance) {
       pair.second->GetAssociatedRemoteFrame()->DidUpdateFramePolicy(
@@ -822,6 +826,13 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
     if (render_frame_host_->render_view_host()
             ->GetWidget()
             ->renderer_initialized()) {
+      static auto* crash_key = base::debug::AllocateCrashKeyString(
+          "IsRenderFrameLive", base::debug::CrashKeySize::Size32);
+      std::string message = base::StringPrintf(
+          "rdu=%d", IsRendererDebugURL(request->common_params().url));
+      // This string is whitelisted for collection from Android Webview. It must
+      // only contain booleans to avoid leaking any PII.
+      base::debug::SetCrashKeyString(crash_key, message);
       base::debug::DumpWithoutCrashing();
       NOTREACHED();
     }
@@ -944,10 +955,8 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
       // done earlier to keep browser and renderer state in sync.  This is
       // important to do before CommitPending(), which destroys the
       // corresponding proxy. See https://crbug.com/487872.
-      if (GetRenderFrameProxyHost(dest_site_instance.get())) {
-        navigation_rfh->Send(
-            new FrameMsg_SwapIn(navigation_rfh->GetRoutingID()));
-      }
+      if (GetRenderFrameProxyHost(dest_site_instance.get()))
+        navigation_rfh->SwapIn();
       CommitPending(std::move(speculative_render_frame_host_), nullptr,
                     request->require_coop_browsing_instance_swap());
     }
@@ -1094,7 +1103,7 @@ void RenderFrameHostManager::OnEnforceInsecureNavigationsSet(
 void RenderFrameHostManager::OnDidChangeCollapsedState(bool collapsed) {
   DCHECK(frame_tree_node_->parent());
   SiteInstance* parent_site_instance =
-      frame_tree_node_->parent()->current_frame_host()->GetSiteInstance();
+      frame_tree_node_->parent()->GetSiteInstance();
 
   // There will be no proxy to represent the pending or speculative RFHs in the
   // parent's SiteInstance until the navigation is committed, but the old RFH is
@@ -1114,8 +1123,7 @@ void RenderFrameHostManager::OnDidUpdateFrameOwnerProperties(
     const blink::mojom::FrameOwnerProperties& properties) {
   // FrameOwnerProperties exist only for frames that have a parent.
   CHECK(frame_tree_node_->parent());
-  SiteInstance* parent_instance =
-      frame_tree_node_->parent()->current_frame_host()->GetSiteInstance();
+  SiteInstance* parent_instance = frame_tree_node_->parent()->GetSiteInstance();
 
   auto properties_for_local_frame = properties.Clone();
 
@@ -1159,12 +1167,10 @@ void RenderFrameHostManager::OnDidSetAdFrameType(
 }
 
 RenderFrameHostManager::SiteInstanceDescriptor::SiteInstanceDescriptor(
-    BrowserContext* browser_context,
     GURL dest_url,
     SiteInstanceRelation relation_to_current)
     : existing_site_instance(nullptr),
       dest_url(dest_url),
-      browser_context(browser_context),
       relation(relation_to_current) {}
 
 void RenderFrameHostManager::RenderProcessGone(
@@ -1559,20 +1565,20 @@ RenderFrameHostManager::GetSiteInstanceForNavigation(
   return new_instance;
 }
 
-void RenderFrameHostManager::InitializeRenderFrameIfNecessary(
-    RenderFrameHostImpl* render_frame_host) {
+bool RenderFrameHostManager::InitializeRenderFrameForImmediateUse() {
   // TODO(jam): this copies some logic inside GetFrameHostForNavigation, which
   // also duplicates logic in Navigate. They should all use this method, but
   // that involves slight reordering.
   // http://crbug.com/794229
-  if (render_frame_host->IsRenderFrameLive())
-    return;
+  if (render_frame_host_->IsRenderFrameLive())
+    return true;
 
-  if (!ReinitializeRenderFrame(render_frame_host))
-    return;
+  render_frame_host_->reset_must_be_replaced();
 
-  if (render_frame_host != render_frame_host_.get())
-    return;
+  if (!ReinitializeRenderFrame(render_frame_host_.get())) {
+    NOTREACHED();
+    return false;
+  }
 
   // TODO(jam): uncomment this when the method is shared. Not adding the call
   // now to make merge to 63 easier.
@@ -1588,6 +1594,7 @@ void RenderFrameHostManager::InitializeRenderFrameIfNecessary(
     delegate_->NotifyMainFrameSwappedFromRenderManager(
         nullptr, render_frame_host_.get());
   }
+  return true;
 }
 
 void RenderFrameHostManager::PrepareForInnerDelegateAttach(
@@ -1608,14 +1615,6 @@ void RenderFrameHostManager::PrepareForInnerDelegateAttach(
   CreateNewFrameForInnerDelegateAttachIfNecessary();
 }
 
-void RenderFrameHostManager::SetEmbeddingToken(
-    const base::UnguessableToken& embedding_token) {
-  RenderFrameProxyHost* proxy_to_parent = GetProxyToParent();
-  DCHECK(proxy_to_parent);
-  proxy_to_parent->GetAssociatedRemoteFrame()->SetEmbeddingToken(
-      embedding_token);
-}
-
 RenderFrameHostManager::SiteInstanceDescriptor
 RenderFrameHostManager::DetermineSiteInstanceForURL(
     const GURL& dest_url,
@@ -1637,7 +1636,6 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
       static_cast<SiteInstanceImpl*>(current_instance);
   NavigationControllerImpl& controller =
       delegate_->GetControllerForRenderManager();
-  BrowserContext* browser_context = controller.GetBrowserContext();
 
   // If the entry has an instance already we should usually use it, unless it is
   // no longer suitable.
@@ -1676,7 +1674,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
     // have been broken anyway if there were no error. Otherwise, we keep it
     // in the same BrowsingInstance to preserve scripting relationships after
     // reloads.
-    return SiteInstanceDescriptor(browser_context, GURL(kUnreachableWebDataURL),
+    return SiteInstanceDescriptor(GURL(kUnreachableWebDataURL),
                                   force_browsing_instance_swap
                                       ? SiteInstanceRelation::UNRELATED
                                       : SiteInstanceRelation::RELATED);
@@ -1685,8 +1683,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
   // If a swap is required, we need to force the SiteInstance AND
   // BrowsingInstance to be different ones, using CreateForURL.
   if (force_browsing_instance_swap) {
-    return SiteInstanceDescriptor(browser_context, dest_url,
-                                  SiteInstanceRelation::UNRELATED);
+    return SiteInstanceDescriptor(dest_url, SiteInstanceRelation::UNRELATED);
   }
 
   // TODO(https://crbug.com/566091): Don't create OOPIFs on the NTP.  Remove
@@ -1694,7 +1691,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
   // isolation policy.
   if (!frame_tree_node_->IsMainFrame()) {
     SiteInstance* parent_site_instance =
-        frame_tree_node_->parent()->current_frame_host()->GetSiteInstance();
+        frame_tree_node_->parent()->GetSiteInstance();
     if (GetContentClient()->browser()->ShouldStayInParentProcessForNTP(
             dest_url, parent_site_instance)) {
       return SiteInstanceDescriptor(parent_site_instance);
@@ -1713,18 +1710,22 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
     // In this case, there is no current URL, so comparing against the site is
     // ok.  See additional comments below.)
     //
-    // Also, if the URL should use process-per-site mode and there is an
+    // Also, if the URL's site should use process-per-site mode and there is an
     // existing process for the site, we should use it.  We can call
     // GetRelatedSiteInstance() for this, which will eagerly set the site and
     // thus use the correct process.
+    DCHECK_EQ(controller.GetBrowserContext(),
+              current_instance_impl->GetBrowserContext());
+    const GURL dest_site_url = SiteInstanceImpl::GetSiteForURL(
+        current_instance_impl->GetIsolationContext(), dest_url);
     bool use_process_per_site =
-        RenderProcessHost::ShouldUseProcessPerSite(browser_context, dest_url) &&
+        RenderProcessHost::ShouldUseProcessPerSite(
+            current_instance_impl->GetBrowserContext(), dest_site_url) &&
         RenderProcessHostImpl::GetSoleProcessHostForURL(
             current_instance_impl->GetIsolationContext(), dest_url);
     if (current_instance_impl->HasRelatedSiteInstance(dest_url) ||
         use_process_per_site) {
-      return SiteInstanceDescriptor(browser_context, dest_url,
-                                    SiteInstanceRelation::RELATED);
+      return SiteInstanceDescriptor(dest_url, SiteInstanceRelation::RELATED);
     }
 
     // For extensions, Web UI URLs (such as the new tab page), and apps we do
@@ -1732,8 +1733,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
     // will have a non-privileged RenderProcessHost. Create a new SiteInstance
     // for this URL instead (with the correct process type).
     if (!current_instance_impl->IsSuitableForURL(dest_url)) {
-      return SiteInstanceDescriptor(browser_context, dest_url,
-                                    SiteInstanceRelation::RELATED);
+      return SiteInstanceDescriptor(dest_url, SiteInstanceRelation::RELATED);
     }
 
     // Normally the "site" on the SiteInstance is set lazily when the load
@@ -1787,8 +1787,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
         frame_tree_node_->frame_tree()->root()->current_frame_host();
     if (IsCurrentlySameSite(main_frame, dest_url))
       return SiteInstanceDescriptor(main_frame->GetSiteInstance());
-    RenderFrameHostImpl* parent =
-        frame_tree_node_->parent()->current_frame_host();
+    RenderFrameHostImpl* parent = frame_tree_node_->parent();
     if (IsCurrentlySameSite(parent, dest_url))
       return SiteInstanceDescriptor(parent->GetSiteInstance());
   }
@@ -1812,8 +1811,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
   if (!base::FeatureList::IsEnabled(
           features::kProcessSharingWithStrictSiteInstances)) {
     if (!frame_tree_node_->IsMainFrame()) {
-      RenderFrameHostImpl* parent =
-          frame_tree_node_->parent()->current_frame_host();
+      RenderFrameHostImpl* parent = frame_tree_node_->parent();
       bool dest_url_requires_dedicated_process =
           SiteInstanceImpl::DoesSiteRequireDedicatedProcess(
               parent->GetSiteInstance()->GetIsolationContext(), dest_url);
@@ -1826,8 +1824,7 @@ RenderFrameHostManager::DetermineSiteInstanceForURL(
 
   // Start the new renderer in a new SiteInstance, but in the current
   // BrowsingInstance.
-  return SiteInstanceDescriptor(browser_context, dest_url,
-                                SiteInstanceRelation::RELATED);
+  return SiteInstanceDescriptor(dest_url, SiteInstanceRelation::RELATED);
 }
 
 bool RenderFrameHostManager::IsBrowsingInstanceSwapAllowedForPageTransition(
@@ -2049,11 +2046,10 @@ void RenderFrameHostManager::CreateProxiesForNewNamedFrame() {
   // opener's SiteInstance, since new windows are always first opened in the
   // same SiteInstance as their opener, and if the new window navigates
   // cross-site, that proxy would be created as part of unloading.
-  for (FrameTreeNode* ancestor = opener->parent(); ancestor;
-       ancestor = ancestor->parent()) {
-    RenderFrameHostImpl* ancestor_rfh = ancestor->current_frame_host();
-    if (ancestor_rfh->GetSiteInstance() != current_instance)
-      CreateRenderFrameProxy(ancestor_rfh->GetSiteInstance());
+  for (RenderFrameHost* ancestor = opener->parent(); ancestor;
+       ancestor = ancestor->GetParent()) {
+    if (ancestor->GetSiteInstance() != current_instance)
+      CreateRenderFrameProxy(ancestor->GetSiteInstance());
   }
 }
 
@@ -2062,6 +2058,7 @@ RenderFrameHostManager::CreateRenderFrameHost(
     CreateFrameCase create_frame_case,
     SiteInstance* site_instance,
     int32_t frame_routing_id,
+    const base::UnguessableToken& frame_token,
     bool renderer_initiated_creation) {
   FrameTree* frame_tree = frame_tree_node_->frame_tree();
 
@@ -2080,9 +2077,7 @@ RenderFrameHostManager::CreateRenderFrameHost(
       DCHECK(!frame_tree_node_->IsMainFrame());
       // The first RenderFrameHost for a child FrameTreeNode is always in the
       // same SiteInstance as its parent.
-      DCHECK_EQ(
-          frame_tree_node_->parent()->current_frame_host()->GetSiteInstance(),
-          site_instance);
+      DCHECK_EQ(frame_tree_node_->parent()->GetSiteInstance(), site_instance);
       // The RenderViewHost must already exist for the parent's SiteInstance.
       DCHECK(render_view_host);
       break;
@@ -2107,11 +2102,17 @@ RenderFrameHostManager::CreateRenderFrameHost(
                                          /*swapped_out=*/false);
   }
   CHECK(render_view_host);
+  // Lifecycle state of newly created RenderFrameHostImpl.
+  RenderFrameHostImpl::LifecycleState lifecycle_state =
+      create_frame_case == CreateFrameCase::kCreateSpeculative
+          ? RenderFrameHostImpl::LifecycleState::kSpeculative
+          : RenderFrameHostImpl::LifecycleState::kActive;
 
   return RenderFrameHostFactory::Create(
       site_instance, std::move(render_view_host),
       frame_tree->render_frame_delegate(), frame_tree, frame_tree_node_,
-      frame_routing_id, renderer_initiated_creation);
+      frame_routing_id, frame_token, renderer_initiated_creation,
+      lifecycle_state);
 }
 
 bool RenderFrameHostManager::CreateSpeculativeRenderFrameHost(
@@ -2178,6 +2179,7 @@ RenderFrameHostManager::CreateSpeculativeRenderFrame(SiteInstance* instance) {
   std::unique_ptr<RenderFrameHostImpl> new_render_frame_host =
       CreateRenderFrameHost(CreateFrameCase::kCreateSpeculative, instance,
                             /*frame_routing_id=*/MSG_ROUTING_NONE,
+                            base::UnguessableToken::Create(),
                             /*renderer_initiated_creation=*/false);
   DCHECK_EQ(new_render_frame_host->GetSiteInstance(), instance);
 
@@ -2225,14 +2227,18 @@ RenderFrameHostManager::CreateSpeculativeRenderFrame(SiteInstance* instance) {
         render_view_host->GetMainFrameRoutingIdForCrbug1006814();
     std::string message = base::StringPrintf(
         "created=%d,process=%d,proxy=%d,widget=%d,main_rfh=%d,new_rfh=%d,"
-        "in_pdo=%d",
+        "in_pdo=%d,in_cpdo=%d,wi=%d",
         new_render_frame_host->IsRenderFrameCreated(),
         new_render_frame_host->GetProcess()->IsInitializedAndNotDead(),
         !!GetRenderFrameProxyHost(instance), widget_renderer_initialized,
         main_rfh_routing_id, new_render_frame_host->routing_id(),
         static_cast<RenderProcessHostImpl*>(
             render_view_host->GetWidget()->GetProcess())
-            ->GetWithinProcessDiedObserverForCrbug1006814());
+            ->GetWithinProcessDiedObserverForCrbug1006814(),
+        static_cast<RenderProcessHostImpl*>(
+            render_view_host->GetWidget()->GetProcess())
+            ->GetWithinCleanupProcessDiedObserverForCrbug1006814(),
+        render_view_host->GetWidget()->get_initializer_for_crbug_1006814());
     // This string is whitelisted for collection from Android Webview. It must
     // only contain booleans to avoid leaking any PII.
     base::debug::SetCrashKeyString(crash_key, message);
@@ -2344,7 +2350,8 @@ void RenderFrameHostManager::SwapOuterDelegateFrame(
   render_frame_host->Send(new UnfreezableFrameMsg_Unload(
       render_frame_host->GetRoutingID(), proxy->GetRoutingID(),
       false /* is_loading */,
-      render_frame_host->frame_tree_node()->current_replication_state()));
+      render_frame_host->frame_tree_node()->current_replication_state(),
+      proxy->GetFrameToken()));
   proxy->SetRenderFrameProxyCreated(true);
 }
 
@@ -2372,6 +2379,10 @@ bool RenderFrameHostManager::InitRenderView(
   bool created = delegate_->CreateRenderViewForRenderManager(
       render_view_host, opener_frame_routing_id,
       proxy ? proxy->GetRoutingID() : MSG_ROUTING_NONE,
+      proxy
+          ? proxy->GetFrameToken()
+          : static_cast<RenderFrameHostImpl*>(render_view_host->GetMainFrame())
+                ->frame_token(),
       frame_tree_node_->devtools_frame_token(),
       frame_tree_node_->current_replication_state());
 
@@ -2425,15 +2436,37 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
                    request->common_params().navigation_type ==
                        mojom::NavigationType::RELOAD_ORIGINAL_REQUEST_URL;
 
+  // Retrieve COOP and COEP from the response headers. If we don't have the
+  // headers yet we try to inherit the current page COOP/COEP to have a
+  // relevant speculative RFH.
+  network::mojom::CrossOriginOpenerPolicyValue coop;
+  network::mojom::CrossOriginEmbedderPolicyValue coep;
+  if (auto* response = request->response()) {
+    coop = response->parsed_headers->cross_origin_opener_policy.value;
+    coep = response->parsed_headers->cross_origin_embedder_policy.value;
+  } else {
+    // The heuristic for inheriting is to have the most conservative approach
+    // towards BrowsingInstance switching. Every same-origin navigation should
+    // yield a no swap decision. This is done to work with the renderer crash
+    // optimization that instantly commits the speculative RenderFrameHost.
+    bool inherit_coop =
+        render_frame_host_->has_committed_any_navigation() ||
+        render_frame_host_->cross_origin_opener_policy().value ==
+            network::mojom::CrossOriginOpenerPolicyValue::kSameOrigin;
+    coop = inherit_coop
+               ? render_frame_host_->cross_origin_opener_policy().value
+               : network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone;
+    coep = render_frame_host_->cross_origin_embedder_policy().value;
+  }
+
   bool cross_origin_policy_swap =
-      request->response() && frame_tree_node_->IsMainFrame() &&
+      frame_tree_node_->IsMainFrame() &&
+      !request->common_params().url.IsAboutBlank() &&
       ShouldSwapBrowsingInstanceForCrossOriginOpenerPolicy(
-          render_frame_host_->cross_origin_opener_policy(),
+          render_frame_host_->cross_origin_opener_policy().value,
           render_frame_host_->cross_origin_embedder_policy().value,
           render_frame_host_->GetLastCommittedOrigin(),
-          !render_frame_host_->has_committed_any_navigation(),
-          request->response()->cross_origin_opener_policy,
-          request->response()->cross_origin_embedder_policy.value,
+          !render_frame_host_->has_committed_any_navigation(), coop, coep,
           url::Origin::Create(request->common_params().url));
 
   if (cross_origin_policy_swap)
@@ -2473,6 +2506,7 @@ bool RenderFrameHostManager::InitRenderFrame(
   int parent_routing_id = MSG_ROUTING_NONE;
   if (frame_tree_node_->parent()) {
     parent_routing_id = frame_tree_node_->parent()
+                            ->frame_tree_node()
                             ->render_manager()
                             ->GetRoutingIdForSiteInstance(site_instance);
     CHECK_NE(parent_routing_id, MSG_ROUTING_NONE);
@@ -2522,6 +2556,7 @@ bool RenderFrameHostManager::ReinitializeRenderFrame(
     RenderFrameHostImpl* render_frame_host) {
   // This should be used only when the RenderFrame is not live.
   DCHECK(!render_frame_host->IsRenderFrameLive());
+  DCHECK(!render_frame_host->must_be_replaced());
 
   // Recreate the opener chain.
   CreateOpenerProxies(render_frame_host->GetSiteInstance(), frame_tree_node_);
@@ -2710,10 +2745,8 @@ void RenderFrameHostManager::CommitPending(
     old_view->Hide();
   }
 
-  // Make sure the size is up to date.  (Fix for bug 1079768.)
-  delegate_->UpdateRenderViewSizeForRenderManager(is_main_frame);
-
   RenderWidgetHostView* new_view = render_frame_host_->GetView();
+
   if (will_focus_location_bar) {
     delegate_->SetFocusToLocationBar();
   } else if (focus_render_view && new_view) {
@@ -2858,6 +2891,15 @@ std::unique_ptr<RenderFrameHostImpl> RenderFrameHostManager::SetRenderFrameHost(
       std::move(render_frame_host_);
   render_frame_host_ = std::move(render_frame_host);
 
+  if (render_frame_host_ && render_frame_host_->lifecycle_state() !=
+                                RenderFrameHostImpl::LifecycleState::kActive) {
+    // Set the |render_frame_host_| LifecycleState to kActive after the swap
+    // with the current RenderFrameHost if it is not null. RenderFrameHost can
+    // be either be in kspeculative or kInBackForwardCache before setting the
+    // lifecycle_state to kActive here.
+    render_frame_host_->SetLifecycleStateToActive();
+  }
+
   if (frame_tree_node_->IsMainFrame()) {
     // Update the count of top-level frames using this SiteInstance.  All
     // subframes are in the same BrowsingInstance as the main frame, so we only
@@ -3110,8 +3152,7 @@ void RenderFrameHostManager::CreateNewFrameForInnerDelegateAttachIfNecessary() {
   }
   // Swap in the speculative frame. It will later be replaced when
   // WebContents::AttachToOuterWebContentsFrame is called.
-  speculative_render_frame_host_->Send(
-      new FrameMsg_SwapIn(speculative_render_frame_host_->GetRoutingID()));
+  speculative_render_frame_host_->SwapIn();
   CommitPending(std::move(speculative_render_frame_host_), nullptr,
                 false /* clear_proxies_on_commit */);
   NotifyPrepareForInnerDelegateAttachComplete(true /* success */);
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager.h b/chromium/content/browser/frame_host/render_frame_host_manager.h
index 1225bfef7ee..a7fa84f147d 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager.h
+++ b/chromium/content/browser/frame_host/render_frame_host_manager.h
@@ -31,9 +31,7 @@
 #include "url/origin.h"
 
 namespace content {
-class BrowserContext;
 class FrameTreeNode;
-class InterstitialPageImpl;
 class NavigationControllerImpl;
 class NavigationEntry;
 class NavigationRequest;
@@ -120,6 +118,7 @@ class CONTENT_EXPORT RenderFrameHostManager
         RenderViewHost* render_view_host,
         int opener_frame_routing_id,
         int proxy_routing_id,
+        const base::UnguessableToken& frame_token,
         const base::UnguessableToken& devtools_frame_token,
         const FrameReplicationState& replicated_frame_state) = 0;
     virtual void CreateRenderWidgetHostViewForRenderManager(
@@ -136,22 +135,17 @@ class CONTENT_EXPORT RenderFrameHostManager
         bool* proceed_to_fire_unload) = 0;
     virtual void RenderProcessGoneFromRenderManager(
         RenderViewHost* render_view_host) = 0;
-    virtual void UpdateRenderViewSizeForRenderManager(bool is_main_frame) = 0;
     virtual void CancelModalDialogsForRenderManager() = 0;
-    virtual void NotifySwappedFromRenderManager(RenderFrameHost* old_host,
-                                                RenderFrameHost* new_host,
+    virtual void NotifySwappedFromRenderManager(RenderFrameHost* old_frame,
+                                                RenderFrameHost* new_frame,
                                                 bool is_main_frame) = 0;
     // TODO(nasko): This should be removed once extensions no longer use
     // NotificationService. See https://crbug.com/462682.
     virtual void NotifyMainFrameSwappedFromRenderManager(
-        RenderFrameHost* old_host,
-        RenderFrameHost* new_host) = 0;
+        RenderFrameHost* old_frame,
+        RenderFrameHost* new_frame) = 0;
     virtual NavigationControllerImpl& GetControllerForRenderManager() = 0;
 
-    // Returns the interstitial page showing in the delegate, or null if there
-    // is none.
-    virtual InterstitialPageImpl* GetInterstitialForRenderManager() = 0;
-
     // Returns true if the location bar should be focused by default rather than
     // the page contents. The view calls this function when the tab is focused
     // to see what it should do.
@@ -185,7 +179,9 @@ class CONTENT_EXPORT RenderFrameHostManager
   void InitRoot(SiteInstance* site_instance, bool renderer_initiated_creation);
 
   // Initialize this frame as the child of another frame.
-  void InitChild(SiteInstance* site_instance, int32_t frame_routing_id);
+  void InitChild(SiteInstance* site_instance,
+                 int32_t frame_routing_id,
+                 const base::UnguessableToken& frame_token);
 
   // Returns the currently active RenderFrameHost.
   //
@@ -486,8 +482,11 @@ class CONTENT_EXPORT RenderFrameHostManager
   scoped_refptr<SiteInstance> GetSiteInstanceForNavigationRequest(
       NavigationRequest* navigation_request);
 
-  // Helper to initialize the RenderFrame if it's not initialized.
-  void InitializeRenderFrameIfNecessary(RenderFrameHostImpl* render_frame_host);
+  // Helper to initialize the current RenderFrame if it's not initialized.
+  // TODO(https://crbug.com/1006814): Remove this. For now debug URLs and
+  // WebView JS execution are an exception to replacing all crashed frames for
+  // RenderDocument. This is a no-op if the frame is already initialized.
+  bool InitializeRenderFrameForImmediateUse();
 
   // Prepares the FrameTreeNode for attaching an inner WebContents. This step
   // may involve replacing |current_frame_host()| with a new RenderFrameHost
@@ -507,9 +506,6 @@ class CONTENT_EXPORT RenderFrameHostManager
     attach_to_inner_delegate_state_ = AttachToInnerDelegateState::ATTACHED;
   }
 
-  // Sets an embedding token to track the relationship of a frame to its parent.
-  void SetEmbeddingToken(const base::UnguessableToken& embedding_token);
-
  private:
   friend class NavigatorTest;
   friend class RenderFrameHostManagerTest;
@@ -546,8 +542,7 @@ class CONTENT_EXPORT RenderFrameHostManager
         : existing_site_instance(site_instance),
           relation(SiteInstanceRelation::PREEXISTING) {}
 
-    SiteInstanceDescriptor(BrowserContext* browser_context,
-                           GURL dest_url,
+    SiteInstanceDescriptor(GURL dest_url,
                            SiteInstanceRelation relation_to_current);
 
     // Set with an existing SiteInstance to be reused.
@@ -556,10 +551,6 @@ class CONTENT_EXPORT RenderFrameHostManager
     // In case |existing_site_instance| is null, specify a destination URL.
     GURL dest_url;
 
-    // In case |existing_site_instance| is null, specify a BrowsingContext, to
-    // be used with |dest_url| to resolve the site URL.
-    BrowserContext* browser_context;
-
     // Specifies how the new site is related to the current BrowsingInstance.
     // This is PREEXISTING iff |existing_site_instance| is defined.
     SiteInstanceRelation relation;
@@ -736,6 +727,7 @@ class CONTENT_EXPORT RenderFrameHostManager
       CreateFrameCase create_frame_case,
       SiteInstance* site_instance,
       int32_t frame_routing_id,
+      const base::UnguessableToken& frame_token,
       bool renderer_initiated_creation);
 
   // Create and initialize a speculative RenderFrameHost for an ongoing
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc b/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
index 8f7e0919f7c..b0028e5be49 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
@@ -56,6 +56,7 @@
 #include "content/public/common/page_state.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -2613,7 +2614,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
   // The previous RFH should still be pending deletion, as we wait for either
   // the FrameHostMsg_Unload_ACK or a timeout.
   ASSERT_TRUE(rfh->IsRenderFrameLive());
-  ASSERT_FALSE(rfh->is_active());
+  ASSERT_TRUE(rfh->IsPendingDeletion());
 
   // We specifically want verify behavior between unload and RFH destruction.
   ASSERT_FALSE(rfh_observer.deleted());
@@ -3338,7 +3339,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
   // The previous RFH should still be pending deletion, as we wait for either
   // the FrameHostMsg_Unload_ACK or a timeout.
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
-  ASSERT_FALSE(rfh_a->is_active());
+  ASSERT_TRUE(rfh_a->IsPendingDeletion());
 
   // The corresponding RVH should still be referenced by the proxy and the old
   // frame.
@@ -3408,7 +3409,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
   // The previous RFH should still be pending deletion, as we wait for either
   // the unload ACK or a timeout.
   ASSERT_TRUE(rfh_a->IsRenderFrameLive());
-  ASSERT_FALSE(rfh_a->is_active());
+  ASSERT_TRUE(rfh_a->IsPendingDeletion());
 
   // When the previous RFH was unloaded, it should have still gotten a
   // replacement proxy even though it's the last active frame in the process.
@@ -3792,7 +3793,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest, LastCommittedOrigin) {
   // The old RFH should now be pending deletion.  Verify it still has correct
   // last committed origin.
   EXPECT_EQ(url::Origin::Create(url_a), rfh_a->GetLastCommittedOrigin());
-  EXPECT_FALSE(rfh_a->is_active());
+  EXPECT_TRUE(rfh_a->IsPendingDeletion());
 
   // Wait for |rfh_a| to be deleted and double-check |rfh_b|'s origin.
   deleted_observer.WaitUntilDeleted();
@@ -3826,7 +3827,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest, LastCommittedOrigin) {
   // the iframe's old RFH still has correct origin, even though it's pending
   // deletion.
   if (AreAllSitesIsolatedForTesting()) {
-    EXPECT_FALSE(child_rfh_b->is_active());
+    EXPECT_TRUE(child_rfh_b->IsPendingDeletion());
     EXPECT_NE(child_rfh_b, child->current_frame_host());
     EXPECT_EQ(url::Origin::Create(url_b),
               child_rfh_b->GetLastCommittedOrigin());
@@ -5715,7 +5716,7 @@ class ProcessPerSiteContentBrowserClient : public TestContentBrowserClient {
   }
 
   bool ShouldUseProcessPerSite(BrowserContext* browser_context,
-                               const GURL& effective_url) override {
+                               const GURL& site_url) override {
     return should_use_process_per_site_;
   }
 
@@ -6187,7 +6188,7 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerUnloadBrowserTest,
 
   // At this point, |rfh| should still be live and pending deletion.
   EXPECT_FALSE(rfh_observer.deleted());
-  EXPECT_FALSE(rfh->is_active());
+  EXPECT_TRUE(rfh->IsPendingDeletion());
   EXPECT_TRUE(rfh->IsRenderFrameLive());
 
   // Meanwhile, the new page should have two subframes.
@@ -7017,6 +7018,52 @@ IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
   EXPECT_TRUE(is_proxy_live(c5, b_site_instance));
 }
 
+// With just the right initial navigations using RendererDebugURLs, creating a
+// new RenderFrameHost can fail. https://crbug.com/1006814
+IN_PROC_BROWSER_TEST_P(RenderFrameHostManagerTest,
+                       NavigateFromRevivedRendererDebugURL) {
+  StartEmbeddedServer();
+  // This matches IsRendererDebugURL.
+  GURL debug_url("javascript:'hello'");
+  // Just needs to be any URL that would navigate successfully.
+  GURL other_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  // Go to the debug URL. This is a synchronous navigation.
+  shell()->LoadURL(debug_url);
+  ASSERT_EQ("hello", EvalJs(shell(), "document.body.innerText"));
+
+  // Crash the renderer.
+  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  RenderFrameHostImpl* rfh = root->current_frame_host();
+  RenderProcessHost* process = rfh->GetProcess();
+  RenderProcessHostWatcher crash_observer(
+      process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  process->Shutdown(0);
+  crash_observer.Wait();
+
+  // Load the URL again. This will cause the RenderWidgetHost to be revived,
+  // pointing to a RenderWidget in a new process.
+  shell()->LoadURL(debug_url);
+  ASSERT_EQ("hello", EvalJs(shell(), "document.body.innerText"));
+  RenderProcessHost* new_process = root->current_frame_host()->GetProcess();
+
+  // Now try load another URL. It should cope smoothly with the fact that the
+  // RenderWidgetHost is already revived.
+  ASSERT_TRUE(NavigateToURL(web_contents, other_url));
+
+  // In https://crbug.com/1006814 with site-isolation disabled when creating new
+  // hosts for crashed frames, the process does not change. We check that here
+  // to make sure that we actually recreated the bug. With site-isolation
+  // enabled, the process should change.
+  if (!AreAllSitesIsolatedForTesting()) {
+    ASSERT_EQ(new_process, root->current_frame_host()->GetProcess());
+  } else {
+    ASSERT_NE(new_process, root->current_frame_host()->GetProcess());
+  }
+}
+
 INSTANTIATE_TEST_SUITE_P(All,
                          RenderFrameHostManagerTest,
                          testing::ValuesIn(RenderDocumentFeatureLevelValues()));
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc b/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 85113ef8f72..7c72abc9193 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
@@ -326,10 +326,6 @@ class RenderFrameHostManagerTest
       // all BrowsingInstances used in the test.
       SetContents(CreateTestWebContents());
     }
-
-#if defined(OS_ANDROID)
-    Compositor::Initialize();
-#endif
   }
 
   void TearDown() override {
@@ -419,8 +415,10 @@ class RenderFrameHostManagerTest
     std::unique_ptr<NavigationRequest> navigation_request =
         NavigationRequest::CreateBrowserInitiated(
             frame_tree_node, std::move(common_params), std::move(commit_params),
-            !entry->is_renderer_initiated(), entry->extra_headers(),
-            frame_entry, entry, request_body, nullptr /* navigation_ui_data */);
+            !entry->is_renderer_initiated(),
+            GlobalFrameRoutingId() /* initiator_routing_id */,
+            entry->extra_headers(), frame_entry, entry, request_body,
+            nullptr /* navigation_ui_data */, base::nullopt /* impression */);
 
     // Simulates request creation that triggers the 1st internal call to
     // GetFrameHostForNavigation.
@@ -593,8 +591,8 @@ TEST_P(RenderFrameHostManagerTest, UpdateFaviconURLWhilePendingUnload) {
   navigation->set_drop_unload_ack(true);
   navigation->Commit();
   TestRenderFrameHost* dest_rfh = contents()->GetMainFrame();
-  EXPECT_FALSE(ntp_rfh->is_active());
-  EXPECT_TRUE(dest_rfh->is_active());
+  EXPECT_TRUE(ntp_rfh->IsPendingDeletion());
+  EXPECT_TRUE(dest_rfh->IsCurrent());
 
   // The new RFH should be able to update its favicons.
   {
@@ -1037,9 +1035,9 @@ TEST_P(RenderFrameHostManagerTest, WebUIInNewTab) {
   RenderFrameHostManager* manager1 =
       web_contents1->GetRenderManagerForTesting();
   // Test the case that new RVH is considered live.
-  manager1->current_host()->CreateRenderView(-1, MSG_ROUTING_NONE,
-                                             base::UnguessableToken::Create(),
-                                             FrameReplicationState(), false);
+  manager1->current_host()->CreateRenderView(
+      -1, MSG_ROUTING_NONE, base::UnguessableToken::Create(),
+      base::UnguessableToken::Create(), FrameReplicationState(), false);
   EXPECT_TRUE(manager1->current_host()->IsRenderViewLive());
   EXPECT_TRUE(manager1->current_frame_host()->IsRenderFrameLive());
 
@@ -1073,9 +1071,9 @@ TEST_P(RenderFrameHostManagerTest, WebUIInNewTab) {
       web_contents2->GetRenderManagerForTesting();
   // Make sure the new RVH is considered live.  This is usually done in
   // RenderWidgetHost::Init when opening a new tab from a link.
-  manager2->current_host()->CreateRenderView(-1, MSG_ROUTING_NONE,
-                                             base::UnguessableToken::Create(),
-                                             FrameReplicationState(), false);
+  manager2->current_host()->CreateRenderView(
+      -1, MSG_ROUTING_NONE, base::UnguessableToken::Create(),
+      base::UnguessableToken::Create(), FrameReplicationState(), false);
   EXPECT_TRUE(manager2->current_host()->IsRenderViewLive());
 
   const GURL kUrl2(GetWebUIURL("foo/bar"));
@@ -1162,11 +1160,11 @@ TEST_P(RenderFrameHostManagerTest, NavigateAfterMissingUnloadACK) {
   back_navigation1->set_drop_unload_ack(true);
   back_navigation1->Commit();
   EXPECT_TRUE(rfh2->IsWaitingForUnloadACK());
-  EXPECT_FALSE(rfh2->is_active());
+  EXPECT_TRUE(rfh2->IsPendingDeletion());
 
   // We should be able to navigate forward.
   NavigationSimulator::GoForward(contents());
-  EXPECT_TRUE(main_test_rfh()->is_active());
+  EXPECT_TRUE(main_test_rfh()->IsCurrent());
 }
 
 // Test that we create RenderFrameProxy objects for the opener chain when
@@ -1396,7 +1394,7 @@ TEST_P(RenderFrameHostManagerTest, CleanUpProxiesOnProcessCrash) {
   // Make sure the new opener RVH is considered live.
   opener1_manager->current_host()->CreateRenderView(
       -1, MSG_ROUTING_NONE, base::UnguessableToken::Create(),
-      FrameReplicationState(), false);
+      base::UnguessableToken::Create(), FrameReplicationState(), false);
   EXPECT_TRUE(opener1_manager->current_host()->IsRenderViewLive());
   EXPECT_TRUE(opener1_manager->current_frame_host()->IsRenderFrameLive());
 
@@ -1632,21 +1630,21 @@ TEST_P(RenderFrameHostManagerTest, DeleteFrameAfterUnloadACK) {
   contents()->NavigateAndCommit(kUrl1);
   TestRenderFrameHost* rfh1 = contents()->GetMainFrame();
   RenderFrameDeletedObserver rfh_deleted_observer(rfh1);
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
 
   // Navigate to new site, simulating onbeforeunload approval.
   auto navigation =
       NavigationSimulatorImpl::CreateBrowserInitiated(kUrl2, contents());
   navigation->ReadyToCommit();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
   TestRenderFrameHost* rfh2 = contents()->GetPendingMainFrame();
 
   // Simulate the unload ack, unexpectedly early (before commit).  It should
   // have no effect.
   rfh1->SimulateUnloadACK();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
 
   // The new page commits.
   navigation->set_drop_unload_ack(true);
@@ -1654,8 +1652,8 @@ TEST_P(RenderFrameHostManagerTest, DeleteFrameAfterUnloadACK) {
   EXPECT_FALSE(contents()->CrossProcessNavigationPending());
   EXPECT_EQ(rfh2, contents()->GetMainFrame());
   EXPECT_TRUE(contents()->GetPendingMainFrame() == nullptr);
-  EXPECT_TRUE(rfh2->is_active());
-  EXPECT_FALSE(rfh1->is_active());
+  EXPECT_TRUE(rfh2->IsCurrent());
+  EXPECT_TRUE(rfh1->IsPendingDeletion());
 
   // Simulate the unload ack.
   rfh1->SimulateUnloadACK();
@@ -1680,7 +1678,7 @@ TEST_P(RenderFrameHostManagerTest, UnloadFrameAfterUnloadACK) {
   contents()->NavigateAndCommit(kUrl1);
   TestRenderFrameHost* rfh1 = contents()->GetMainFrame();
   RenderFrameDeletedObserver rfh_deleted_observer(rfh1);
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
 
   // Increment the number of active frames in SiteInstanceImpl so that rfh1 is
   // not deleted on unload.
@@ -1691,7 +1689,7 @@ TEST_P(RenderFrameHostManagerTest, UnloadFrameAfterUnloadACK) {
       NavigationSimulatorImpl::CreateBrowserInitiated(kUrl2, contents());
   navigation->ReadyToCommit();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
   TestRenderFrameHost* rfh2 = contents()->GetPendingMainFrame();
 
   // The new page commits.
@@ -1700,8 +1698,8 @@ TEST_P(RenderFrameHostManagerTest, UnloadFrameAfterUnloadACK) {
   EXPECT_FALSE(contents()->CrossProcessNavigationPending());
   EXPECT_EQ(rfh2, contents()->GetMainFrame());
   EXPECT_TRUE(contents()->GetPendingMainFrame() == nullptr);
-  EXPECT_FALSE(rfh1->is_active());
-  EXPECT_TRUE(rfh2->is_active());
+  EXPECT_TRUE(rfh1->IsPendingDeletion());
+  EXPECT_TRUE(rfh2->IsCurrent());
 
   // Simulate the unload ack.
   rfh1->OnUnloaded();
@@ -1727,7 +1725,7 @@ TEST_P(RenderFrameHostManagerTest, CommitNewNavigationBeforeSendingUnload) {
   contents()->NavigateAndCommit(kUrl1);
   TestRenderFrameHost* rfh1 = contents()->GetMainFrame();
   RenderFrameDeletedObserver rfh_deleted_observer(rfh1);
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
 
   // Increment the number of active frames in rfh1's SiteInstance so that the
   // SiteInstance is not deleted on unload.
@@ -1739,7 +1737,7 @@ TEST_P(RenderFrameHostManagerTest, CommitNewNavigationBeforeSendingUnload) {
       NavigationSimulatorImpl::CreateBrowserInitiated(kUrl2, contents());
   navigation->ReadyToCommit();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
   TestRenderFrameHost* rfh2 = contents()->GetPendingMainFrame();
 
   // The new page commits.
@@ -1748,8 +1746,8 @@ TEST_P(RenderFrameHostManagerTest, CommitNewNavigationBeforeSendingUnload) {
   EXPECT_FALSE(contents()->CrossProcessNavigationPending());
   EXPECT_EQ(rfh2, contents()->GetMainFrame());
   EXPECT_TRUE(contents()->GetPendingMainFrame() == nullptr);
-  EXPECT_FALSE(rfh1->is_active());
-  EXPECT_TRUE(rfh2->is_active());
+  EXPECT_TRUE(rfh1->IsPendingDeletion());
+  EXPECT_TRUE(rfh2->IsCurrent());
 
   // Simulate the unload ack.
   rfh1->OnUnloaded();
@@ -1773,7 +1771,7 @@ TEST_P(RenderFrameHostManagerTest, CancelPendingProperlyDeletesOrSwaps) {
   // Navigate to the first page.
   contents()->NavigateAndCommit(kUrl1);
   TestRenderFrameHost* rfh1 = main_test_rfh();
-  EXPECT_TRUE(rfh1->is_active());
+  EXPECT_TRUE(rfh1->IsCurrent());
 
   // Navigate to a new site, starting a cross-site navigation.
   controller().LoadURL(kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK,
@@ -1832,23 +1830,23 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   const GURL kUrlA("http://www.google.com/");
   const GURL kUrlB("http://webkit.org/");
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Create a page with two child frames.
   contents()->NavigateAndCommit(kUrlA);
   contents()->GetMainFrame()->OnCreateChildFrame(
       contents()->GetMainFrame()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame_name", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame_name", "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   contents()->GetMainFrame()->OnCreateChildFrame(
       contents()->GetMainFrame()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame_name", "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame_name", "uniqueName2",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   RenderFrameHostManager* root_manager =
       contents()->GetFrameTree()->root()->render_manager();
   RenderFrameHostManager* iframe1 =
@@ -1891,8 +1889,10 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   EXPECT_TRUE(GetPendingFrameHost(iframe2));
   EXPECT_EQ(host1, GetPendingFrameHost(iframe1));
   EXPECT_EQ(host2, GetPendingFrameHost(iframe2));
-  EXPECT_TRUE(GetPendingFrameHost(iframe1)->is_active());
-  EXPECT_TRUE(GetPendingFrameHost(iframe2)->is_active());
+  EXPECT_EQ(GetPendingFrameHost(iframe1)->lifecycle_state(),
+            RenderFrameHostImpl::LifecycleState::kActive);
+  EXPECT_EQ(GetPendingFrameHost(iframe2)->lifecycle_state(),
+            RenderFrameHostImpl::LifecycleState::kActive);
   EXPECT_NE(GetPendingFrameHost(iframe1), GetPendingFrameHost(iframe2));
   EXPECT_EQ(GetPendingFrameHost(iframe1)->GetSiteInstance(),
             GetPendingFrameHost(iframe2)->GetSiteInstance());
@@ -1950,11 +1950,27 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
       << "This SiteInstance should be destroyable now.";
 }
 
+#if defined(OS_ANDROID)
+// TODO(lukasza): https://crbug.com/1067432: Calling Compositor::Initialize()
+// DCHECKs flakily and without such call the test below consistently fails on
+// Android (DCHECKing about parent_view->GetFrameSinkId().is_valid() in
+// RenderWidgetHostViewChildFrame::SetFrameConnectorDelegate).
+#define MAYBE_TwoTabsCrashOneReloadsOneLeaves \
+  DISABLED_TwoTabsCrashOneReloadsOneLeaves
+#else
+#define MAYBE_TwoTabsCrashOneReloadsOneLeaves TwoTabsCrashOneReloadsOneLeaves
+#endif
 // Two tabs in the same process crash. The first tab is reloaded, and the second
 // tab navigates away without reloading. The second tab's navigation shouldn't
 // mess with the first tab's content. Motivated by http://crbug.com/473714.
 TEST_P(RenderFrameHostManagerTestWithSiteIsolation,
-       TwoTabsCrashOneReloadsOneLeaves) {
+       MAYBE_TwoTabsCrashOneReloadsOneLeaves) {
+#if defined(OS_ANDROID)
+  // TODO(lukasza): https://crbug.com/1067432: This call might DCHECK flakily
+  // about !CompositorImpl::IsInitialized()..
+  Compositor::Initialize();
+#endif
+
   const GURL kUrl1("http://www.google.com/");
   const GURL kUrl2("http://webkit.org/");
   const GURL kUrl3("http://whatwg.org/");
@@ -1991,10 +2007,10 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation,
       contents1->GetMainFrame()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame_name", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, "frame_name", "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   RenderFrameHostManager* iframe =
       contents()->GetFrameTree()->root()->child_at(0)->render_manager();
   NavigationEntryImpl entry(
@@ -2045,10 +2061,10 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation,
       main_rfh->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   RenderFrameHostManager* subframe_rfhm =
       contents()->GetFrameTree()->root()->child_at(0)->render_manager();
 
@@ -2209,21 +2225,23 @@ TEST_P(RenderFrameHostManagerTest, TraverseComplexOpenerChain) {
   FrameTree* tree1 = contents()->GetFrameTree();
   FrameTreeNode* root1 = tree1->root();
   int process_id = root1->current_frame_host()->GetProcess()->GetID();
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   tree1->AddFrame(
-      root1, process_id, 12,
+      root1->current_frame_host(), process_id, 12,
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName0", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName0",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
   tree1->AddFrame(
-      root1, process_id, 13,
+      root1->current_frame_host(), process_id, 13,
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName1",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
 
   std::unique_ptr<TestWebContents> tab2(
       TestWebContents::Create(browser_context(), nullptr));
@@ -2232,19 +2250,21 @@ TEST_P(RenderFrameHostManagerTest, TraverseComplexOpenerChain) {
   FrameTreeNode* root2 = tree2->root();
   process_id = root2->current_frame_host()->GetProcess()->GetID();
   tree2->AddFrame(
-      root2, process_id, 22,
+      root2->current_frame_host(), process_id, 22,
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName2",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
   tree2->AddFrame(
-      root2, process_id, 23,
+      root2->current_frame_host(), process_id, 23,
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName3", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName3",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
 
   std::unique_ptr<TestWebContents> tab3(
       TestWebContents::Create(browser_context(), nullptr));
@@ -2258,12 +2278,13 @@ TEST_P(RenderFrameHostManagerTest, TraverseComplexOpenerChain) {
   FrameTreeNode* root4 = tree4->root();
   process_id = root4->current_frame_host()->GetProcess()->GetID();
   tree4->AddFrame(
-      root4, process_id, 42,
+      root4->current_frame_host(), process_id, 42,
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), "uniqueName4", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false, kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, std::string(), "uniqueName4",
+      false, base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      kOwnerType);
 
   root1->child_at(1)->SetOpener(root1->child_at(1));
   root1->SetOpener(root2->child_at(1));
@@ -2321,7 +2342,7 @@ TEST_P(RenderFrameHostManagerTest, PageFocusPropagatesToSubframeProcesses) {
   const GURL kUrlB("http://b.com/");
   const GURL kUrlC("http://c.com/");
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Set up a page at a.com with three subframes: two for b.com and one for
   // c.com.
   contents()->NavigateAndCommit(kUrlA);
@@ -2329,23 +2350,23 @@ TEST_P(RenderFrameHostManagerTest, PageFocusPropagatesToSubframeProcesses) {
       main_test_rfh()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame1", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame1", "uniqueName1", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       main_test_rfh()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame2", "uniqueName2", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame2", "uniqueName2", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
   main_test_rfh()->OnCreateChildFrame(
       main_test_rfh()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame3", "uniqueName3", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame3", "uniqueName3", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
 
   FrameTreeNode* root = contents()->GetFrameTree()->root();
   RenderFrameHostManager* child1 = root->child_at(0)->render_manager();
@@ -2452,16 +2473,16 @@ TEST_P(RenderFrameHostManagerTest,
   const GURL kUrlB("http://b.com/");
   const GURL kUrlC("http://c.com/");
 
-  constexpr auto kOwnerType = blink::FrameOwnerElementType::kIframe;
+  constexpr auto kOwnerType = blink::mojom::FrameOwnerElementType::kIframe;
   // Set up a page at a.com with a b.com subframe.
   contents()->NavigateAndCommit(kUrlA);
   main_test_rfh()->OnCreateChildFrame(
       main_test_rfh()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame1", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), kOwnerType);
+      blink::mojom::TreeScopeType::kDocument, "frame1", "uniqueName1", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), kOwnerType);
 
   FrameTreeNode* root = contents()->GetFrameTree()->root();
   RenderFrameHostManager* child = root->child_at(0)->render_manager();
@@ -2854,8 +2875,11 @@ TEST_P(RenderFrameHostManagerTest, NavigateFromDeadRendererToWebUI) {
   std::unique_ptr<NavigationRequest> navigation_request =
       NavigationRequest::CreateBrowserInitiated(
           frame_tree_node, std::move(common_params), std::move(commit_params),
-          !entry.is_renderer_initiated(), entry.extra_headers(), frame_entry,
-          &entry, nullptr /* request_body */, nullptr /* navigation_ui_data */);
+          !entry.is_renderer_initiated(),
+          GlobalFrameRoutingId() /* initiator_routing_id */,
+          entry.extra_headers(), frame_entry, &entry,
+          nullptr /* request_body */, nullptr /* navigation_ui_data */,
+          base::nullopt /* impression */);
   manager->DidCreateNavigationRequest(navigation_request.get());
 
   // As the initial RenderFrame was not live, the new RenderFrameHost should be
@@ -3018,10 +3042,10 @@ TEST_P(RenderFrameHostManagerTestWithSiteIsolation,
       main_test_rfh()->GetProcess()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, "frame1", "uniqueName1", false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, "frame1", "uniqueName1", false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
 
   FrameTreeNode* root = contents()->GetFrameTree()->root();
   RenderFrameHostManager* child = root->child_at(0)->render_manager();
@@ -3207,7 +3231,7 @@ TEST_P(RenderFrameHostManagerTest, BeginNavigationIgnoredWhenNotActive) {
   navigation_to_kUrl2->Commit();
   EXPECT_NE(initial_rfh, main_test_rfh());
   ASSERT_FALSE(delete_observer.deleted());
-  EXPECT_FALSE(initial_rfh->is_active());
+  EXPECT_TRUE(initial_rfh->IsPendingDeletion());
 
   // The initial RFH receives a BeginNavigation IPC. The navigation should not
   // start.
@@ -3227,7 +3251,7 @@ TEST_P(RenderFrameHostManagerTest, ReceivedFramePolicyAfterNavigationStarted) {
   TestRenderFrameHost* initial_rfh = main_test_rfh();
 
   // The RFH should start out with an empty frame policy.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             initial_rfh->frame_tree_node()->active_sandbox_flags());
 
   // Navigate cross-site but don't commit the navigation.
@@ -3236,16 +3260,16 @@ TEST_P(RenderFrameHostManagerTest, ReceivedFramePolicyAfterNavigationStarted) {
   navigation_to_kUrl2->ReadyToCommit();
 
   // Now send the frame policy for the initial page.
-  initial_rfh->SendFramePolicy(blink::mojom::WebSandboxFlags::kAll,
+  initial_rfh->SendFramePolicy(network::mojom::WebSandboxFlags::kAll,
                                {} /* feature_policy_header */,
                                {} /* document_policy_header */);
   // Verify that the policy landed in the frame tree.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             initial_rfh->frame_tree_node()->active_sandbox_flags());
 
   // Commit the naviagation; the new frame should have a clear frame policy.
   navigation_to_kUrl2->Commit();
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             main_test_rfh()->frame_tree_node()->active_sandbox_flags());
 }
 
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter.cc b/chromium/content/browser/frame_host/render_frame_message_filter.cc
index f6511e22ab0..33e2c5f972d 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter.cc
+++ b/chromium/content/browser/frame_host/render_frame_message_filter.cc
@@ -45,8 +45,8 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "storage/browser/blob/blob_storage_context.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
 #include "url/gurl.h"
@@ -70,14 +70,15 @@ namespace {
 void CreateChildFrameOnUI(
     int process_id,
     int parent_routing_id,
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const std::string& frame_name,
     const std::string& frame_unique_name,
     bool is_created_by_script,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const blink::FramePolicy& frame_policy,
     const blink::mojom::FrameOwnerProperties& frame_owner_properties,
-    blink::FrameOwnerElementType owner_type,
+    blink::mojom::FrameOwnerElementType owner_type,
     int new_routing_id,
     mojo::ScopedMessagePipeHandle interface_provider_receiver_handle,
     mojo::ScopedMessagePipeHandle browser_interface_broker_handle) {
@@ -93,7 +94,7 @@ void CreateChildFrameOnUI(
             std::move(interface_provider_receiver_handle)),
         mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>(
             std::move(browser_interface_broker_handle)),
-        scope, frame_name, frame_unique_name, is_created_by_script,
+        scope, frame_name, frame_unique_name, is_created_by_script, frame_token,
         devtools_frame_token, frame_policy, frame_owner_properties, owner_type);
   }
 }
@@ -279,6 +280,7 @@ void RenderFrameMessageFilter::OnCreateChildFrame(
   params_reply->browser_interface_broker_handle =
       browser_interface_broker.PassPipe().release();
 
+  params_reply->frame_token = base::UnguessableToken::Create();
   params_reply->devtools_frame_token = base::UnguessableToken::Create();
 
   base::PostTask(
@@ -286,9 +288,10 @@ void RenderFrameMessageFilter::OnCreateChildFrame(
       base::BindOnce(
           &CreateChildFrameOnUI, render_process_id_, params.parent_routing_id,
           params.scope, params.frame_name, params.frame_unique_name,
-          params.is_created_by_script, params_reply->devtools_frame_token,
-          params.frame_policy, params.frame_owner_properties,
-          params.frame_owner_element_type, params_reply->child_routing_id,
+          params.is_created_by_script, params_reply->frame_token,
+          params_reply->devtools_frame_token, params.frame_policy,
+          params.frame_owner_properties, params.frame_owner_element_type,
+          params_reply->child_routing_id,
           interface_provider_receiver.PassPipe(),
           browser_interface_broker_receiver.PassPipe()));
 }
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter.h b/chromium/content/browser/frame_host/render_frame_message_filter.h
index 451bfecfa4b..8d1c932e9f3 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter.h
+++ b/chromium/content/browser/frame_host/render_frame_message_filter.h
@@ -17,7 +17,7 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom.h"
 #include "url/origin.h"
 
 #if BUILDFLAG(ENABLE_PLUGINS)
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc b/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
index 36b26cc494b..c64a7286604 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -75,7 +76,7 @@ void SetCookieDirect(WebContentsImpl* tab,
   BrowserContext::GetDefaultStoragePartition(tab->GetBrowserContext())
       ->GetCookieManagerForBrowserProcess()
       ->SetCanonicalCookie(
-          *cookie_obj, url.scheme(), options,
+          *cookie_obj, url, options,
           base::BindLambdaForTesting(
               [&](net::CanonicalCookie::CookieInclusionStatus status) {
                 run_loop.Quit();
diff --git a/chromium/content/browser/frame_host/render_frame_proxy_host.cc b/chromium/content/browser/frame_host/render_frame_proxy_host.cc
index c6bdaf87026..425b0b4f6e1 100644
--- a/chromium/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/chromium/content/browser/frame_host/render_frame_proxy_host.cc
@@ -32,6 +32,7 @@
 #include "content/public/common/content_features.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom.h"
@@ -54,6 +55,12 @@ typedef std::unordered_map<RenderFrameProxyHostID,
 base::LazyInstance<RoutingIDFrameProxyMap>::DestructorAtExit
     g_routing_id_frame_proxy_map = LAZY_INSTANCE_INITIALIZER;
 
+using TokenFrameMap = std::unordered_map<base::UnguessableToken,
+                                         RenderFrameProxyHost*,
+                                         base::UnguessableTokenHash>;
+base::LazyInstance<TokenFrameMap>::Leaky g_token_frame_proxy_map =
+    LAZY_INSTANCE_INITIALIZER;
+
 }  // namespace
 
 // static
@@ -68,7 +75,22 @@ RenderFrameProxyHost* RenderFrameProxyHost::FromID(int process_id,
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RoutingIDFrameProxyMap* frames = g_routing_id_frame_proxy_map.Pointer();
   auto it = frames->find(RenderFrameProxyHostID(process_id, routing_id));
-  return it == frames->end() ? NULL : it->second;
+  return it == frames->end() ? nullptr : it->second;
+}
+
+// static
+RenderFrameProxyHost* RenderFrameProxyHost::FromFrameToken(
+    int process_id,
+    const base::UnguessableToken& frame_token) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  TokenFrameMap* frames = g_token_frame_proxy_map.Pointer();
+  auto it = frames->find(frame_token);
+  // The check against |process_id| isn't strictly necessary, but represents
+  // an extra level of protection against a renderer trying to force a frame
+  // token.
+  return it != frames->end() && it->second->GetProcess()->GetID() == process_id
+             ? it->second
+             : nullptr;
 }
 
 RenderFrameProxyHost::RenderFrameProxyHost(
@@ -87,13 +109,14 @@ RenderFrameProxyHost::RenderFrameProxyHost(
           .insert(std::make_pair(
               RenderFrameProxyHostID(GetProcess()->GetID(), routing_id_), this))
           .second);
+  CHECK(g_token_frame_proxy_map.Get()
+            .insert(std::make_pair(frame_token_, this))
+            .second);
   CHECK(render_view_host_ ||
         frame_tree_node_->render_manager()->IsMainFrameForInnerDelegate());
 
   bool is_proxy_to_parent = !frame_tree_node_->IsMainFrame() &&
                             frame_tree_node_->parent()
-                                    ->render_manager()
-                                    ->current_frame_host()
                                     ->GetSiteInstance() == site_instance;
   bool is_proxy_to_outer_delegate =
       frame_tree_node_->render_manager()->IsMainFrameForInnerDelegate();
@@ -134,6 +157,7 @@ RenderFrameProxyHost::~RenderFrameProxyHost() {
   GetProcess()->RemoveRoute(routing_id_);
   g_routing_id_frame_proxy_map.Get().erase(
       RenderFrameProxyHostID(GetProcess()->GetID(), routing_id_));
+  g_token_frame_proxy_map.Get().erase(frame_token_);
 }
 
 void RenderFrameProxyHost::SetChildRWHView(
@@ -153,6 +177,7 @@ RenderViewHostImpl* RenderFrameProxyHost::GetRenderViewHost() {
 
 RenderWidgetHostView* RenderFrameProxyHost::GetRenderWidgetHostView() {
   return frame_tree_node_->parent()
+      ->frame_tree_node()
       ->render_manager()
       ->GetRenderWidgetHostView();
 }
@@ -210,8 +235,10 @@ bool RenderFrameProxyHost::InitRenderFrameProxy() {
     // new child frames always start out as local frames, so a new proxy should
     // never have a RenderFrameHost as a parent.
     RenderFrameProxyHost* parent_proxy =
-        frame_tree_node_->parent()->render_manager()->GetRenderFrameProxyHost(
-            site_instance_.get());
+        frame_tree_node_->parent()
+            ->frame_tree_node()
+            ->render_manager()
+            ->GetRenderFrameProxyHost(site_instance_.get());
     CHECK(parent_proxy);
 
     // Proxies that aren't live in the parent node should not be initialized
@@ -236,7 +263,7 @@ bool RenderFrameProxyHost::InitRenderFrameProxy() {
                             ->GetRoutingID();
   GetProcess()->GetRendererInterface()->CreateFrameProxy(
       routing_id_, view_routing_id, opener_routing_id, parent_routing_id,
-      frame_tree_node_->current_replication_state(),
+      frame_tree_node_->current_replication_state(), frame_token_,
       frame_tree_node_->devtools_frame_token());
 
   SetRenderFrameProxyCreated(true);
@@ -423,8 +450,8 @@ void RenderFrameProxyHost::OnOpenURL(
       current_rfh, params.user_gesture, &download_policy);
 
   if ((frame_tree_node_->pending_frame_policy().sandbox_flags &
-       blink::mojom::WebSandboxFlags::kDownloads) !=
-      blink::mojom::WebSandboxFlags::kNone) {
+       network::mojom::WebSandboxFlags::kDownloads) !=
+      network::mojom::WebSandboxFlags::kNone) {
     if (download_policy.blocking_downloads_in_sandbox_enabled) {
       download_policy.SetDisallowed(content::NavigationDownloadType::kSandbox);
     } else {
@@ -439,11 +466,13 @@ void RenderFrameProxyHost::OnOpenURL(
   // TODO(clamy): The transition should probably be changed for POST navigations
   // to PAGE_TRANSITION_FORM_SUBMIT. See https://crbug.com/829827.
   frame_tree_node_->navigator()->NavigateFromFrameProxy(
-      current_rfh, validated_url, params.initiator_origin, site_instance_.get(),
-      params.referrer, ui::PAGE_TRANSITION_LINK,
-      params.should_replace_current_entry, download_policy,
-      params.post_body ? "POST" : "GET", params.post_body, params.extra_headers,
-      std::move(blob_url_loader_factory), params.user_gesture);
+      current_rfh, validated_url,
+      GlobalFrameRoutingId(GetProcess()->GetID(), params.initiator_routing_id),
+      params.initiator_origin, site_instance_.get(), params.referrer,
+      ui::PAGE_TRANSITION_LINK, params.should_replace_current_entry,
+      download_policy, params.post_body ? "POST" : "GET", params.post_body,
+      params.extra_headers, std::move(blob_url_loader_factory),
+      params.user_gesture, params.impression);
 }
 
 void RenderFrameProxyHost::CheckCompleted() {
@@ -528,27 +557,24 @@ void RenderFrameProxyHost::OnRouteMessageEvent(
                                                        GetSiteInstance()))
     return;
 
-  int32_t source_routing_id = params.source_routing_id;
+  base::Optional<base::UnguessableToken> translated_source_token;
   base::string16 source_origin = params.source_origin;
   base::string16 target_origin = params.target_origin;
   blink::TransferableMessage message = std::move(params.message->data);
 
-  // If there is a source_routing_id, translate it to the routing ID of the
+  // If there is a source_routing_id, translate it to the frame token of the
   // equivalent RenderFrameProxyHost in the target process.
-  if (source_routing_id != MSG_ROUTING_NONE) {
-    RenderFrameHostImpl* source_rfh =
-        RenderFrameHostImpl::FromID(GetProcess()->GetID(), source_routing_id);
-    if (!source_rfh) {
-      source_routing_id = MSG_ROUTING_NONE;
-    } else {
+  if (params.source_routing_id != MSG_ROUTING_NONE) {
+    RenderFrameHostImpl* source_rfh = RenderFrameHostImpl::FromID(
+        GetProcess()->GetID(), params.source_routing_id);
+    if (source_rfh) {
       // https://crbug.com/822958: If the postMessage is going to a descendant
       // frame, ensure that any pending visual properties such as size are sent
       // to the target frame before the postMessage, as sites might implicitly
       // be relying on this ordering.
       bool target_is_descendant_of_source = false;
-      for (FrameTreeNode* node = target_rfh->frame_tree_node(); node;
-           node = node->parent()) {
-        if (node == source_rfh->frame_tree_node()) {
+      for (RenderFrameHost* rfh = target_rfh; rfh; rfh = rfh->GetParent()) {
+        if (rfh == source_rfh) {
           target_is_descendant_of_source = true;
           break;
         }
@@ -591,16 +617,14 @@ void RenderFrameProxyHost::OnRouteMessageEvent(
               ->render_manager()
               ->GetRenderFrameProxyHost(target_site_instance);
       if (source_proxy_in_target_site_instance) {
-        source_routing_id =
-            source_proxy_in_target_site_instance->GetRoutingID();
-      } else {
-        source_routing_id = MSG_ROUTING_NONE;
+        translated_source_token =
+            source_proxy_in_target_site_instance->GetFrameToken();
       }
     }
   }
 
-  target_rfh->PostMessageEvent(source_routing_id, source_origin, target_origin,
-                               std::move(message));
+  target_rfh->PostMessageEvent(translated_source_token, source_origin,
+                               target_origin, std::move(message));
 }
 
 void RenderFrameProxyHost::OnDidChangeOpener(int32_t opener_routing_id) {
diff --git a/chromium/content/browser/frame_host/render_frame_proxy_host.h b/chromium/content/browser/frame_host/render_frame_proxy_host.h
index 4d257f3159d..4f9511a5ddf 100644
--- a/chromium/content/browser/frame_host/render_frame_proxy_host.h
+++ b/chromium/content/browser/frame_host/render_frame_proxy_host.h
@@ -75,6 +75,9 @@ class CONTENT_EXPORT RenderFrameProxyHost
   using CreatedCallback = base::RepeatingCallback<void(RenderFrameProxyHost*)>;
 
   static RenderFrameProxyHost* FromID(int process_id, int routing_id);
+  static RenderFrameProxyHost* FromFrameToken(
+      int process_id,
+      const base::UnguessableToken& frame_token);
 
   // Sets a callback to be called whenever any RenderFrameProxyHost is created.
   static void SetCreatedCallbackForTesting(
@@ -174,6 +177,8 @@ class CONTENT_EXPORT RenderFrameProxyHost
   blink::AssociatedInterfaceProvider* GetRemoteAssociatedInterfacesTesting();
   bool IsInertForTesting();
 
+  const base::UnguessableToken& GetFrameToken() const { return frame_token_; }
+
  private:
   // IPC Message handlers.
   void OnDetach();
@@ -239,6 +244,8 @@ class CONTENT_EXPORT RenderFrameProxyHost
   mojo::AssociatedReceiver<blink::mojom::RemoteFrameHost>
       remote_frame_host_receiver_{this};
 
+  base::UnguessableToken frame_token_ = base::UnguessableToken::Create();
+
   DISALLOW_COPY_AND_ASSIGN(RenderFrameProxyHost);
 };
 
diff --git a/chromium/content/browser/frame_host/sandbox_flags.md b/chromium/content/browser/frame_host/sandbox_flags.md
new file mode 100644
index 00000000000..e65f317ea62
--- /dev/null
+++ b/chromium/content/browser/frame_host/sandbox_flags.md
@@ -0,0 +1,29 @@
+The sandbox policy
+------------------
+
+The sandbox policy determines a set of capabilities a document will have.
+It is defined in two types of objects:
+- The frame.
+- The document.
+
+The frame policy is parsed from the <iframe>’s sandbox attribute.
+Example: <iframe sandbox="allow-script allow-origin">
+
+The document policy is parsed from the HTTP Content-Security-Policy header.
+Example: Content-Security-Policy: sandbox allow-script allow-origin
+
+On top of that, the sandbox policy is inherited from:
+- The frame to its document.
+- The document to its children frames.
+- The document to its opened windows’s main frame.
+
+The distinction between a frame and a document is important. The document is
+replaced after navigations, but the frame stays.
+
+The sandbox policy is bit field. The sandbox flags are defined by:
+/services/network/public/mojom/web_sandbox_flags.mojom
+Multiple sandbox policy are combined using a bitwise AND in the bitfield. This
+way, the policy can only be further restricted.
+
+Specification:
+- http://www.whatwg.org/specs/web-apps/current-work/#attr-iframe-sandbox
diff --git a/chromium/content/browser/frame_host/sec_fetch_browsertest.cc b/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
index 11a96411cae..a3b99e3bec1 100644
--- a/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
+++ b/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/frame_host/webui_navigation_throttle.cc b/chromium/content/browser/frame_host/webui_navigation_throttle.cc
deleted file mode 100644
index 6c716ac4f8c..00000000000
--- a/chromium/content/browser/frame_host/webui_navigation_throttle.cc
+++ /dev/null
@@ -1,68 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/webui_navigation_throttle.h"
-
-#include "base/command_line.h"
-#include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/public/browser/navigation_handle.h"
-#include "content/public/common/content_switches.h"
-#include "content/public/common/url_constants.h"
-
-namespace content {
-
-WebUINavigationThrottle::WebUINavigationThrottle(
-    NavigationHandle* navigation_handle)
-    : NavigationThrottle(navigation_handle) {}
-
-WebUINavigationThrottle::~WebUINavigationThrottle() {}
-
-NavigationThrottle::ThrottleCheckResult
-WebUINavigationThrottle::WillStartRequest() {
-  // Allow only chrome: and chrome-untrusted: scheme documents to be navigated
-  // to.
-  if (navigation_handle()->GetURL().SchemeIs(kChromeUIScheme) ||
-      navigation_handle()->GetURL().SchemeIs(kChromeUIUntrustedScheme))
-    return PROCEED;
-
-  return BLOCK_REQUEST;
-}
-
-const char* WebUINavigationThrottle::GetNameForLogging() {
-  return "WebUINavigationThrottle";
-}
-
-// static
-std::unique_ptr<NavigationThrottle>
-WebUINavigationThrottle::CreateThrottleForNavigation(
-    NavigationHandle* navigation_handle) {
-  // The WebUI security model (which keeps renderes with WebUI bindings separate
-  // from untrusted renderers) only makes sense in multi-process mode.
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kSingleProcess))
-    return nullptr;
-
-  // Only throttle subframe navigations.
-  if (navigation_handle->IsInMainFrame())
-    return nullptr;
-
-  RenderFrameHostImpl* parent = NavigationRequest::From(navigation_handle)
-                                    ->frame_tree_node()
-                                    ->parent()
-                                    ->current_frame_host();
-
-  // Throttle if the renderer process has WebUI bindings, or if the parent frame
-  // is on a WebUI page.
-  if (ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
-          parent->GetProcess()->GetID()) ||
-      parent->GetLastCommittedURL().SchemeIs(kChromeUIScheme)) {
-    return std::make_unique<WebUINavigationThrottle>(navigation_handle);
-  }
-
-  return nullptr;
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/webui_navigation_throttle.h b/chromium/content/browser/frame_host/webui_navigation_throttle.h
deleted file mode 100644
index b47aa830487..00000000000
--- a/chromium/content/browser/frame_host/webui_navigation_throttle.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_WEBUI_NAVIGATION_THROTTLE_H_
-#define CONTENT_BROWSER_FRAME_HOST_WEBUI_NAVIGATION_THROTTLE_H_
-
-#include "content/public/browser/navigation_throttle.h"
-
-namespace content {
-
-// This NavigationThrottle class is used to check for subframe navigations to
-// web content in WebUI processes and/or chrome:// documents. When the
-// parent frame is at a chrome:// URL or is in a process with WebUI
-// bindings, subframes are only allowed to navigate to chrome:// URLs.
-// Note: There are WebUI documents that live on non-chrome: schemes and do
-// not have WebUI bindings. Those are not covered by this restriction.
-//
-// This is an important security property to uphold, because by default
-// WebUI documents have high privileges and if malicious web content is
-// loaded in their process, it can be used as an easy step towards a sandbox
-// escape.
-//
-// Note: Navigations in the main frame are allowed, as those will result in a
-// process change with BrowsingInstance change and drop of privileges.
-// Subframes are resticted because they must be in the same BrowsingInstance
-// and would have the ability to communicate with the parent document.
-class WebUINavigationThrottle : public NavigationThrottle {
- public:
-  static std::unique_ptr<NavigationThrottle> CreateThrottleForNavigation(
-      NavigationHandle* navigation_handle);
-
-  explicit WebUINavigationThrottle(NavigationHandle* navigation_handle);
-  ~WebUINavigationThrottle() override;
-
-  // NavigationThrottle methods
-  ThrottleCheckResult WillStartRequest() override;
-  const char* GetNameForLogging() override;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(WebUINavigationThrottle);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_WEBUI_NAVIGATION_THROTTLE_H_
diff --git a/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc b/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
index 06a6689fdd5..c9af746cf92 100644
--- a/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
+++ b/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
index ac80e0e8ee0..633129ca01d 100644
--- a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
+++ b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
@@ -76,15 +76,12 @@ void SensorProviderProxyImpl::GetSensor(SensorType type,
       GetDeviceService().BindSensorProvider(std::move(receiver));
   }
 
-  // TODO(shalamov): base::BindOnce should be used (https://crbug.com/714018),
-  // however, PermissionController::RequestPermission enforces use of repeating
-  // callback.
   permission_controller_->RequestPermission(
       PermissionType::SENSORS, render_frame_host_,
       render_frame_host_->GetLastCommittedURL().GetOrigin(), false,
-      base::BindRepeating(
-          &SensorProviderProxyImpl::OnPermissionRequestCompleted,
-          weak_factory_.GetWeakPtr(), type, base::Passed(std::move(callback))));
+      base::BindOnce(&SensorProviderProxyImpl::OnPermissionRequestCompleted,
+                     weak_factory_.GetWeakPtr(), type,
+                     base::Passed(std::move(callback))));
 }
 
 void SensorProviderProxyImpl::OnPermissionRequestCompleted(
diff --git a/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc b/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
index 9468e10cef1..c3f1079e3d8 100644
--- a/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
+++ b/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
@@ -149,7 +149,7 @@ TEST_F(GeolocationServiceTest, PermissionGrantedPolicyViolation) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
@@ -173,7 +173,7 @@ TEST_F(GeolocationServiceTest, PermissionGrantedNoPolicyViolation) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
@@ -200,7 +200,7 @@ TEST_F(GeolocationServiceTest, PermissionGrantedSync) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
@@ -227,7 +227,7 @@ TEST_F(GeolocationServiceTest, PermissionDeniedSync) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
@@ -252,7 +252,7 @@ TEST_F(GeolocationServiceTest, PermissionGrantedAsync) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
@@ -282,7 +282,7 @@ TEST_F(GeolocationServiceTest, PermissionDeniedAsync) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus status) {
+      base::BindOnce([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
@@ -301,7 +301,7 @@ TEST_F(GeolocationServiceTest, ServiceClosedBeforePermissionResponse) {
   mojo::Remote<Geolocation> geolocation;
   service_remote()->CreateGeolocation(
       geolocation.BindNewPipeAndPassReceiver(), true,
-      base::BindRepeating([](blink::mojom::PermissionStatus) {
+      base::BindOnce([](blink::mojom::PermissionStatus) {
         ADD_FAILURE() << "PositionStatus received unexpectedly.";
       }));
   // Don't immediately respond to the request.
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
index b09b8ffe768..e4ebd7fcd4a 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
@@ -642,7 +642,7 @@ void GpuDataManagerImplPrivate::RequestDxDiagNodeData() {
     }
 
     manager->UpdateDxDiagNodeRequestStatus(true);
-    host->gpu_service()->RequestCompleteGpuInfo(
+    host->info_collection_gpu_service()->RequestDxDiagNodeInfo(
         base::BindOnce([](const gpu::DxDiagNode& dx_diagnostics) {
           GpuDataManagerImpl* manager = GpuDataManagerImpl::GetInstance();
           manager->UpdateDxDiagNode(dx_diagnostics);
@@ -699,8 +699,8 @@ void GpuDataManagerImplPrivate::RequestGpuSupportedRuntimeVersion(
         }
 
         manager->UpdateDx12VulkanRequestStatus(true);
-        host->gpu_service()->GetGpuSupportedRuntimeVersionAndDevicePerfInfo(
-            base::BindOnce(
+        host->info_collection_gpu_service()
+            ->GetGpuSupportedRuntimeVersionAndDevicePerfInfo(base::BindOnce(
                 [](const gpu::Dx12VulkanVersionInfo& dx12_vulkan_info,
                    const gpu::DevicePerfInfo& device_perf_info) {
                   GpuDataManagerImpl* manager =
@@ -1319,6 +1319,10 @@ bool GpuDataManagerImplPrivate::IsGpuProcessUsingHardwareGpu() const {
   if (base::StartsWith(gpu_info_.gl_renderer, "Google SwiftShader",
                        base::CompareCase::SENSITIVE))
     return false;
+  if (base::StartsWith(gpu_info_.gl_renderer, "ANGLE",
+                       base::CompareCase::SENSITIVE) &&
+      gpu_info_.gl_renderer.find("SwiftShader Device") != std::string::npos)
+    return false;
   if (gpu_info_.gl_renderer == "Disabled")
     return false;
   return true;
diff --git a/chromium/content/browser/gpu/gpu_data_manager_testing_arrays_and_structs_autogen.h b/chromium/content/browser/gpu/gpu_data_manager_testing_arrays_and_structs_autogen.h
index 845aaed339c..9c8242dbc93 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_testing_arrays_and_structs_autogen.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_testing_arrays_and_structs_autogen.h
@@ -20,16 +20,18 @@ const int kFeatureListForGpuManagerTestingEntry1[1] = {
 
 const GpuControlList::More kMoreForEntry1_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -48,16 +50,18 @@ const GpuControlList::GLStrings kGLStringsForGpuManagerTestingEntry2 = {
 
 const GpuControlList::More kMoreForEntry2_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -69,16 +73,18 @@ const int kFeatureListForGpuManagerTestingEntry3[1] = {
 
 const GpuControlList::More kMoreForEntry3_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -98,16 +104,18 @@ const GpuControlList::GLStrings kGLStringsForGpuManagerTestingEntry4 = {
 
 const GpuControlList::More kMoreForEntry4_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -119,16 +127,18 @@ const int kFeatureListForGpuManagerTestingEntry5[1] = {
 
 const GpuControlList::More kMoreForEntry5_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -144,16 +154,18 @@ const GpuControlList::GLStrings kGLStringsForGpuManagerTestingEntry5Exception0 =
 
 const GpuControlList::More kMoreForEntry5_572251052Exception0 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -178,16 +190,18 @@ const int kFeatureListForGpuManagerTestingEntry6[14] = {
 
 const GpuControlList::More kMoreForEntry6_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
@@ -199,16 +213,18 @@ const int kFeatureListForGpuManagerTestingEntry7[1] = {
 
 const GpuControlList::More kMoreForEntry7_572251052 = {
     GpuControlList::kGLTypeNone,  // gl_type
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},  // gl_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gl_version
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // pixel_shader_version
     false,      // in_process_gpu
     0,          // gl_reset_notification_strategy
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr,
      nullptr},  // direct_rendering_version
-    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical, nullptr,
-     nullptr},                  // gpu_count
+    {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
+     GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // gpu_count
     GpuControlList::kDontCare,  // hardware_overlay
     0,                          // test_group
     GpuControlList::kDontCare,  // subpixel_font_rendering
diff --git a/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc b/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
index 53fff888bdf..742589f9f2f 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_testing_autogen.cc
@@ -30,7 +30,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -42,7 +43,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry1_572251052,  // more data
         },
         0,        // exceptions count
@@ -62,7 +64,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -74,7 +77,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry2_572251052,  // more data
         },
         0,        // exceptions count
@@ -94,7 +98,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -106,7 +111,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry3_572251052,  // more data
         },
         0,        // exceptions count
@@ -126,7 +132,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -138,7 +145,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry4_572251052,  // more data
         },
         0,        // exceptions count
@@ -158,7 +166,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -170,7 +179,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry5_572251052,  // more data
         },
         base::size(kExceptionsForEntry5),  // exceptions count
@@ -190,7 +200,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                     // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                              // os_version
             0x00,                                   // vendor_id
             0,                                      // DeviceIDs size
             nullptr,                                // DeviceIDs
@@ -202,7 +213,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                      // intel_gpu_series size
             nullptr,                                // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry6_572251052,  // more data
         },
         0,        // exceptions count
@@ -222,7 +234,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
         {
             GpuControlList::kOsAny,  // os_type
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},                       // os_version
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                                // os_version
             0x8086,                                   // vendor_id
             0,                                        // DeviceIDs size
             nullptr,                                  // DeviceIDs
@@ -234,7 +247,8 @@ const GpuControlList::Entry kGpuDataManagerTestingEntries[] = {
             0,                                        // intel_gpu_series size
             nullptr,                                  // intel_gpu_series
             {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-             nullptr, nullptr},         // intel_gpu_generation
+             GpuControlList::kVersionSchemaCommon, nullptr,
+             nullptr},                  // intel_gpu_generation
             &kMoreForEntry7_572251052,  // more data
         },
         0,        // exceptions count
diff --git a/chromium/content/browser/gpu/gpu_data_manager_testing_exceptions_autogen.h b/chromium/content/browser/gpu/gpu_data_manager_testing_exceptions_autogen.h
index d63c75b3cca..d879bd64bcc 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_testing_exceptions_autogen.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_testing_exceptions_autogen.h
@@ -16,8 +16,8 @@ const GpuControlList::Conditions kExceptionsForEntry5[1] = {
     {
         GpuControlList::kOsAny,  // os_type
         {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-         nullptr, nullptr},                               // os_version
-        0x00,                                             // vendor_id
+         GpuControlList::kVersionSchemaCommon, nullptr, nullptr},  // os_version
+        0x00,                                                      // vendor_id
         0,                                                // DeviceIDs size
         nullptr,                                          // DeviceIDs
         GpuControlList::kMultiGpuCategoryNone,            // multi_gpu_category
@@ -28,7 +28,8 @@ const GpuControlList::Conditions kExceptionsForEntry5[1] = {
         0,        // intel_gpu_series size
         nullptr,  // intel_gpu_series
         {GpuControlList::kUnknown, GpuControlList::kVersionStyleNumerical,
-         nullptr, nullptr},                   // intel_gpu_generation
+         GpuControlList::kVersionSchemaCommon, nullptr,
+         nullptr},                            // intel_gpu_generation
         &kMoreForEntry5_572251052Exception0,  // more data
     },
 };
diff --git a/chromium/content/browser/gpu/gpu_feature_checker_impl.cc b/chromium/content/browser/gpu/gpu_feature_checker_impl.cc
index 71fa220680a..c0fbe2c165c 100644
--- a/chromium/content/browser/gpu/gpu_feature_checker_impl.cc
+++ b/chromium/content/browser/gpu/gpu_feature_checker_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/gpu/gpu_feature_checker_impl.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "build/build_config.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
 #include "content/public/browser/browser_thread.h"
diff --git a/chromium/content/browser/gpu/gpu_ipc_browsertests.cc b/chromium/content/browser/gpu/gpu_ipc_browsertests.cc
index 61d47a54b2a..670a9f5c9f6 100644
--- a/chromium/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/chromium/content/browser/gpu/gpu_ipc_browsertests.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/gpu_utils.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/gpu_stream_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/test/gpu_browsertest_helpers.h"
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
diff --git a/chromium/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc b/chromium/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
index 043b247c186..dcbcb823254 100644
--- a/chromium/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
+++ b/chromium/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
@@ -5,7 +5,7 @@
 #include "content/browser/gpu/gpu_memory_buffer_manager_singleton.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/task/post_task.h"
 #include "components/viz/host/gpu_host_impl.h"
 #include "content/browser/gpu/gpu_process_host.h"
diff --git a/chromium/content/browser/gpu/gpu_process_host.cc b/chromium/content/browser/gpu/gpu_process_host.cc
index d47312d5f89..d39f52a896c 100644
--- a/chromium/content/browser/gpu/gpu_process_host.cc
+++ b/chromium/content/browser/gpu/gpu_process_host.cc
@@ -61,6 +61,7 @@
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "gpu/config/gpu_finch_features.h"
 #include "gpu/config/gpu_preferences.h"
+#include "gpu/config/gpu_switches.h"
 #include "gpu/ipc/common/gpu_client_ids.h"
 #include "gpu/ipc/host/shader_disk_cache.h"
 #include "gpu/ipc/in_process_command_buffer.h"
@@ -214,6 +215,9 @@ static const char* const kSwitchNames[] = {
     service_manager::switches::kGpuSandboxFailuresFatal,
     service_manager::switches::kDisableGpuSandbox,
     service_manager::switches::kNoSandbox,
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+    switches::kDisableDevShmUsage,
+#endif
 #if defined(OS_WIN)
     switches::kDisableHighResTimer,
 #endif  // defined(OS_WIN)
@@ -230,6 +234,7 @@ static const char* const kSwitchNames[] = {
     switches::kEnableLogging,
     switches::kEnableDeJelly,
     switches::kDeJellyScreenWidth,
+    switches::kDoubleBufferCompositing,
     switches::kEnableVizDevTools,
     switches::kHeadless,
     switches::kLoggingLevel,
@@ -611,10 +616,6 @@ void GpuProcessHost::TerminateGpuProcess(const std::string& message) {
   termination_origin_ = GpuTerminationOrigin::kOzoneWaylandProxy;
   process_->TerminateOnBadMessageReceived(message);
 }
-
-void GpuProcessHost::SendGpuProcessMessage(IPC::Message* message) {
-  Send(message);
-}
 #endif  // defined(USE_OZONE)
 
 // static
@@ -677,8 +678,9 @@ GpuProcessHost::GpuProcessHost(int host_id, GpuProcessKind kind)
     in_process_ = true;
   }
 #if !defined(OS_ANDROID)
-  if (!in_process_ && base::FeatureList::IsEnabled(
-                          features::kForwardMemoryPressureEventsToGpuProcess)) {
+  if (!in_process_ && kind != GPU_PROCESS_KIND_INFO_COLLECTION &&
+      base::FeatureList::IsEnabled(
+          features::kForwardMemoryPressureEventsToGpuProcess)) {
     memory_pressure_listener_ =
         std::make_unique<base::MemoryPressureListener>(base::BindRepeating(
             &GpuProcessHost::OnMemoryPressure, base::Unretained(this)));
@@ -754,11 +756,7 @@ GpuProcessHost::~GpuProcessHost() {
         // Don't block offscreen contexts (and force page reload for webgl)
         // if this was an intentional shutdown or the OOM killer on Android
         // killed us while Chrome was in the background.
-// TODO(crbug.com/598400): Restrict this to Android for now, since other
-// platforms might fall through here for the 'exit_on_context_lost' workaround.
-#if defined(OS_ANDROID)
         block_offscreen_contexts = false;
-#endif
         message += "exited normally. Everything is okay.";
         break;
       case base::TERMINATION_STATUS_ABNORMAL_TERMINATION:
@@ -860,6 +858,8 @@ bool GpuProcessHost::Init() {
       switches::GetDeadlineToSynchronizeSurfaces();
   params.main_thread_task_runner =
       base::CreateSingleThreadTaskRunner({BrowserThread::UI});
+  params.info_collection_gpu_process =
+      kind_ == GPU_PROCESS_KIND_INFO_COLLECTION;
   gpu_host_ = std::make_unique<viz::GpuHostImpl>(
       this, std::move(viz_main_pending_remote), std::move(params));
 
@@ -904,11 +904,6 @@ bool GpuProcessHost::Send(IPC::Message* msg) {
 
 bool GpuProcessHost::OnMessageReceived(const IPC::Message& message) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-#if defined(USE_OZONE)
-  ui::OzonePlatform::GetInstance()
-      ->GetGpuPlatformSupportHost()
-      ->OnMessageReceived(message);
-#endif
   return true;
 }
 
@@ -1129,6 +1124,27 @@ bool GpuProcessHost::LaunchGpuProcess() {
     cmd_line->AppendSwitch(service_manager::switches::kDisableGpuSandbox);
     cmd_line->AppendSwitchASCII(switches::kUseGL,
                                 gl::kGLImplementationDisabledName);
+
+    // Pass the current device info to the info-collection GPU process for
+    // crash key logging.
+    const gpu::GPUInfo::GPUDevice device_info = GetGPUInfo().active_gpu();
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuVendorId,
+        base::StringPrintf("%u", device_info.vendor_id));
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuDeviceId,
+        base::StringPrintf("%u", device_info.device_id));
+#if defined(OS_WIN)
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuSubSystemId,
+        base::StringPrintf("%u", device_info.sub_sys_id));
+    cmd_line->AppendSwitchASCII(switches::kGpuRevision,
+                                base::StringPrintf("%u", device_info.revision));
+#endif
+    if (device_info.driver_version.length()) {
+      cmd_line->AppendSwitchASCII(switches::kGpuDriverVersion,
+                                  device_info.driver_version);
+    }
   }
 
   // TODO(penghuang): Replace all GPU related switches with GpuPreferences.
@@ -1243,6 +1259,14 @@ viz::mojom::GpuService* GpuProcessHost::gpu_service() {
   return gpu_host_->gpu_service();
 }
 
+#if defined(OS_WIN)
+viz::mojom::InfoCollectionGpuService*
+GpuProcessHost::info_collection_gpu_service() {
+  DCHECK(gpu_host_);
+  return gpu_host_->info_collection_gpu_service();
+}
+#endif
+
 int GpuProcessHost::GetIDForTesting() const {
   return process_->GetData().id;
 }
diff --git a/chromium/content/browser/gpu/gpu_process_host.h b/chromium/content/browser/gpu/gpu_process_host.h
index 6a51ea57246..3471ec0da41 100644
--- a/chromium/content/browser/gpu/gpu_process_host.h
+++ b/chromium/content/browser/gpu/gpu_process_host.h
@@ -42,6 +42,10 @@
 #include "services/viz/privileged/mojom/viz_main.mojom.h"
 #include "url/gurl.h"
 
+#if defined(OS_WIN)
+#include "services/viz/privileged/mojom/gl/info_collection_gpu_service.mojom.h"
+#endif
+
 #if BUILDFLAG(USE_VIZ_DEVTOOLS)
 #include "content/browser/gpu/viz_devtools_connector.h"
 #endif
@@ -106,6 +110,11 @@ class GpuProcessHost : public BrowserChildProcessHostDelegate,
 
   CONTENT_EXPORT viz::mojom::GpuService* gpu_service();
 
+#if defined(OS_WIN)
+  CONTENT_EXPORT viz::mojom::InfoCollectionGpuService*
+  info_collection_gpu_service();
+#endif
+
   CONTENT_EXPORT int GetIDForTesting() const;
 
   viz::GpuHostImpl* gpu_host() { return gpu_host_.get(); }
@@ -172,7 +181,6 @@ class GpuProcessHost : public BrowserChildProcessHostDelegate,
       mojo::PendingReceiver<service_manager::mojom::Service> receiver) override;
 #if defined(USE_OZONE)
   void TerminateGpuProcess(const std::string& message) override;
-  void SendGpuProcessMessage(IPC::Message* message) override;
 #endif
 
   bool LaunchGpuProcess();
diff --git a/chromium/content/browser/gpu/in_process_gpu_thread_browsertests.cc b/chromium/content/browser/gpu/in_process_gpu_thread_browsertests.cc
index b4902aaacac..6f5d597561d 100644
--- a/chromium/content/browser/gpu/in_process_gpu_thread_browsertests.cc
+++ b/chromium/content/browser/gpu/in_process_gpu_thread_browsertests.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 
 namespace {
diff --git a/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc
index 78fb5412e0d..ff12f92adb2 100644
--- a/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc
+++ b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/callback_forward.h"
+#include "base/clang_profiling_buildflags.h"
 #include "base/location.h"
 #include "base/run_loop.h"
 #include "base/task/post_task.h"
@@ -99,13 +100,6 @@ class TestGpuService : public viz::mojom::GpuService {
                               const gpu::SyncToken& sync_token) override {}
   void GetVideoMemoryUsageStats(
       GetVideoMemoryUsageStatsCallback callback) override {}
-#if defined(OS_WIN)
-  void RequestCompleteGpuInfo(
-      RequestCompleteGpuInfoCallback callback) override {}
-  void GetGpuSupportedRuntimeVersionAndDevicePerfInfo(
-      GetGpuSupportedRuntimeVersionAndDevicePerfInfoCallback callback)
-      override {}
-#endif
   void RequestHDRStatus(RequestHDRStatusCallback callback) override {}
   void LoadedShader(int32_t client_id,
                     const std::string& key,
@@ -126,6 +120,10 @@ class TestGpuService : public viz::mojom::GpuService {
   void BeginCATransaction() override {}
   void CommitCATransaction(CommitCATransactionCallback callback) override {}
 #endif
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  void WriteClangProfilingProfile(
+      WriteClangProfilingProfileCallback callback) override {}
+#endif
   void Crash() override {}
   void Hang() override {}
   void ThrowJavaException() override {}
diff --git a/chromium/content/browser/hid/hid_browsertest.cc b/chromium/content/browser/hid/hid_browsertest.cc
index 226b1682c99..3a6c6af7044 100644
--- a/chromium/content/browser/hid/hid_browsertest.cc
+++ b/chromium/content/browser/hid/hid_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/hid_delegate.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/histogram_synchronizer.cc b/chromium/content/browser/histogram_synchronizer.cc
index 1cda0da8e82..db61830161a 100644
--- a/chromium/content/browser/histogram_synchronizer.cc
+++ b/chromium/content/browser/histogram_synchronizer.cc
@@ -8,9 +8,9 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_delta_serialization.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/pickle.h"
diff --git a/chromium/content/browser/histograms_internals_ui.cc b/chromium/content/browser/histograms_internals_ui.cc
index 4b9a018bda1..6a5ece6b525 100644
--- a/chromium/content/browser/histograms_internals_ui.cc
+++ b/chromium/content/browser/histograms_internals_ui.cc
@@ -75,12 +75,8 @@ void HistogramsMessageHandler::HandleRequestHistograms(
   for (base::HistogramBase* histogram :
        base::StatisticsRecorder::Sort(base::StatisticsRecorder::WithName(
            base::StatisticsRecorder::GetHistograms(), query))) {
-    // TODO(crbug.com/809820): Return the histogram object as a DictionaryValue
-    // for better UI that is built client side.
-    std::string ascii_output;
-    histogram->WriteHTMLGraph(&ascii_output);
-    ascii_output += "<br><hr><br>";
-    histograms_list.Append(std::move(ascii_output));
+    base::DictionaryValue histogram_dict = histogram->ToGraphDict();
+    histograms_list.Append(std::move(histogram_dict));
   }
 
   ResolveJavascriptCallback(base::Value(callback_id),
diff --git a/chromium/content/browser/host_zoom_map_impl_browsertest.cc b/chromium/content/browser/host_zoom_map_impl_browsertest.cc
index 843c065fddc..0ecc56d3d6b 100644
--- a/chromium/content/browser/host_zoom_map_impl_browsertest.cc
+++ b/chromium/content/browser/host_zoom_map_impl_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/idle/idle_browsertest.cc b/chromium/content/browser/idle/idle_browsertest.cc
deleted file mode 100644
index 06ae09ff4dc..00000000000
--- a/chromium/content/browser/idle/idle_browsertest.cc
+++ /dev/null
@@ -1,109 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/idle/idle_manager.h"
-#include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/storage_partition_impl.h"
-#include "content/public/browser/content_browser_client.h"
-#include "content/public/common/content_switches.h"
-#include "content/public/test/browser_test_utils.h"
-#include "content/public/test/content_browser_test.h"
-#include "content/public/test/content_browser_test_utils.h"
-#include "content/shell/browser/shell.h"
-#include "testing/gmock/include/gmock/gmock.h"
-
-using ::testing::NiceMock;
-
-namespace content {
-
-namespace {
-
-class MockIdleTimeProvider : public IdleManager::IdleTimeProvider {
- public:
-  MockIdleTimeProvider() = default;
-  ~MockIdleTimeProvider() override = default;
-
-  MOCK_METHOD1(CalculateIdleState, ui::IdleState(base::TimeDelta));
-  MOCK_METHOD0(CalculateIdleTime, base::TimeDelta());
-  MOCK_METHOD0(CheckIdleStateIsLocked, bool());
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(MockIdleTimeProvider);
-};
-
-class IdleTest : public ContentBrowserTest {
- public:
-  IdleTest() = default;
-  ~IdleTest() override = default;
-
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
-                                    "IdleDetection");
-  }
-};
-
-}  // namespace
-
-IN_PROC_BROWSER_TEST_F(IdleTest, Start) {
-  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
-
-  auto mock_time_provider = std::make_unique<NiceMock<MockIdleTimeProvider>>();
-  auto* rph = static_cast<RenderProcessHostImpl*>(
-      shell()->web_contents()->GetMainFrame()->GetProcess());
-  IdleManager* idle_mgr =
-      static_cast<StoragePartitionImpl*>(rph->GetStoragePartition())
-          ->GetIdleManager();
-
-  // Test that statuses are updated after idleDetector.start().
-  std::string script = R"(
-    (async () => {
-        let idleDetector = new IdleDetector({threshold: 60});
-        await idleDetector.start();
-        return new Promise(function(resolve) {
-          let states = [];
-          idleDetector.addEventListener('change', e => {
-            let {user, screen} = idleDetector.state;
-            states.push(`${user}-${screen}`)
-            if (states.length >= 3) {
-              let states_str = states.join(',');
-              resolve(states_str);
-            }
-          });
-        });
-    }) ();
-  )";
-
-  EXPECT_CALL(*mock_time_provider, CalculateIdleTime())
-      // Initial state of the system.
-      .WillOnce(testing::Return(base::TimeDelta::FromSeconds(0)))
-      // Simulates a user going idle.
-      .WillOnce(testing::Return(base::TimeDelta::FromSeconds(60)))
-      // Simulates a screen getting locked after the user goes idle.
-      .WillOnce(testing::Return(base::TimeDelta::FromSeconds(60)))
-      // Simulates a user going back to active.
-      .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(0)));
-
-  EXPECT_CALL(*mock_time_provider, CheckIdleStateIsLocked())
-      // Initial state of the system.
-      .WillOnce(testing::Return(false))
-      // Simulates unlocked screen while user goes idle.
-      .WillOnce(testing::Return(false))
-      // Simulates a screen getting locked after the user goes idle.
-      .WillOnce(testing::Return(true))
-      // Simulates an unlocked screen as user goes back to active.
-      .WillRepeatedly(testing::Return(false));
-
-  idle_mgr->SetIdleTimeProviderForTest(std::move(mock_time_provider));
-
-  std::string result = EvalJs(shell(), script).ExtractString();
-  std::vector<std::string> states = base::SplitString(
-      result, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
-
-  EXPECT_EQ("idle-unlocked", states.at(0));
-  EXPECT_EQ("idle-locked", states.at(1));
-  EXPECT_EQ("active-unlocked", states.at(2));
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/idle/idle_manager.cc b/chromium/content/browser/idle/idle_manager_impl.cc
index 8bfe1b1660d..cdb167b0713 100644
--- a/chromium/content/browser/idle/idle_manager.cc
+++ b/chromium/content/browser/idle/idle_manager_impl.cc
@@ -2,37 +2,39 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <utility>
+#include "content/browser/idle/idle_manager_impl.h"
 
-#include "content/browser/idle/idle_manager.h"
+#include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
-#include "content/browser/idle/idle_monitor.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/idle_manager.h"
 #include "content/public/browser/permission_controller.h"
 #include "content/public/browser/permission_type.h"
 #include "ui/base/idle/idle.h"
+#include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
 namespace {
 
+using blink::mojom::IdleManagerError;
+using blink::mojom::IdleState;
+using blink::mojom::PermissionStatus;
+
 constexpr base::TimeDelta kPollInterval = base::TimeDelta::FromSeconds(1);
 
 constexpr base::TimeDelta kMinimumThreshold = base::TimeDelta::FromSeconds(60);
 
 // Default provider implementation. Everything is delegated to
-// ui::CalculateIdleState, ui::CalculateIdleTime, and
-// ui::CheckIdleStateIsLocked.
+// ui::CalculateIdleTime and ui::CheckIdleStateIsLocked.
 class DefaultIdleProvider : public IdleManager::IdleTimeProvider {
  public:
   DefaultIdleProvider() = default;
   ~DefaultIdleProvider() override = default;
 
-  ui::IdleState CalculateIdleState(base::TimeDelta idle_threshold) override {
-    return ui::CalculateIdleState(idle_threshold.InSeconds());
-  }
-
   base::TimeDelta CalculateIdleTime() override {
     return base::TimeDelta::FromSeconds(ui::CalculateIdleTime());
   }
@@ -57,14 +59,16 @@ blink::mojom::IdleStatePtr IdleTimeToIdleState(bool locked,
   else
     screen = blink::mojom::ScreenIdleState::kUnlocked;
 
-  return blink::mojom::IdleState::New(user, screen);
+  return IdleState::New(user, screen);
 }
 
 }  // namespace
 
-IdleManager::IdleManager() : idle_time_provider_(new DefaultIdleProvider()) {}
+IdleManagerImpl::IdleManagerImpl(BrowserContext* browser_context)
+    : idle_time_provider_(new DefaultIdleProvider()),
+      browser_context_(browser_context) {}
 
-IdleManager::~IdleManager() {
+IdleManagerImpl::~IdleManagerImpl() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   while (!monitors_.empty()) {
@@ -74,39 +78,58 @@ IdleManager::~IdleManager() {
   }
 }
 
-void IdleManager::CreateService(
-    mojo::PendingReceiver<blink::mojom::IdleManager> receiver) {
+void IdleManagerImpl::CreateService(
+    mojo::PendingReceiver<blink::mojom::IdleManager> receiver,
+    const url::Origin& origin) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  receivers_.Add(this, std::move(receiver));
+  receivers_.Add(this, std::move(receiver), origin);
 }
 
-void IdleManager::AddMonitor(
+void IdleManagerImpl::AddMonitor(
     base::TimeDelta threshold,
     mojo::PendingRemote<blink::mojom::IdleMonitor> monitor_remote,
     AddMonitorCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (threshold < kMinimumThreshold) {
-    receivers_.ReportBadMessage("Minimum threshold is 60 seconds.");
+    receivers_.ReportBadMessage("Minimum threshold is 1 minute.");
     return;
   }
 
+  const url::Origin& origin = receivers_.current_context();
+  if (!HasPermission(origin)) {
+    std::move(callback).Run(IdleManagerError::kPermissionDisabled, nullptr);
+    return;
+  }
+
+  blink::mojom::IdleStatePtr current_state = CheckIdleState(threshold);
+  auto response_state = current_state->Clone();
   auto monitor = std::make_unique<IdleMonitor>(
-      std::move(monitor_remote), CheckIdleState(threshold), threshold);
+      std::move(monitor_remote), std::move(current_state), threshold);
 
-  // This unretained reference is safe because IdleManager owns all IdleMonitor
-  // instances.
+  // This unretained reference is safe because IdleManagerImpl owns all
+  // IdleMonitor instances.
   monitor->SetErrorHandler(
-      base::BindOnce(&IdleManager::RemoveMonitor, base::Unretained(this)));
+      base::BindOnce(&IdleManagerImpl::RemoveMonitor, base::Unretained(this)));
 
   monitors_.Append(monitor.release());
 
   StartPolling();
 
-  std::move(callback).Run(CheckIdleState(threshold));
+  std::move(callback).Run(IdleManagerError::kSuccess,
+                          std::move(response_state));
+}
+
+bool IdleManagerImpl::HasPermission(const url::Origin& origin) {
+  PermissionController* permission_controller =
+      BrowserContext::GetPermissionController(browser_context_);
+  DCHECK(permission_controller);
+  PermissionStatus status = permission_controller->GetPermissionStatus(
+      PermissionType::NOTIFICATIONS, origin.GetURL(), origin.GetURL());
+  return status == PermissionStatus::GRANTED;
 }
 
-void IdleManager::RemoveMonitor(IdleMonitor* monitor) {
+void IdleManagerImpl::RemoveMonitor(IdleMonitor* monitor) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   monitor->RemoveFromList();
@@ -117,32 +140,32 @@ void IdleManager::RemoveMonitor(IdleMonitor* monitor) {
   }
 }
 
-void IdleManager::SetIdleTimeProviderForTest(
+void IdleManagerImpl::SetIdleTimeProviderForTest(
     std::unique_ptr<IdleTimeProvider> idle_time_provider) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   idle_time_provider_ = std::move(idle_time_provider);
 }
 
-bool IdleManager::IsPollingForTest() {
+bool IdleManagerImpl::IsPollingForTest() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return poll_timer_.IsRunning();
 }
 
-void IdleManager::StartPolling() {
+void IdleManagerImpl::StartPolling() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (!poll_timer_.IsRunning()) {
     poll_timer_.Start(FROM_HERE, kPollInterval,
-                      base::BindRepeating(&IdleManager::UpdateIdleState,
+                      base::BindRepeating(&IdleManagerImpl::UpdateIdleState,
                                           base::Unretained(this)));
   }
 }
 
-void IdleManager::StopPolling() {
+void IdleManagerImpl::StopPolling() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   poll_timer_.Stop();
 }
 
-blink::mojom::IdleStatePtr IdleManager::CheckIdleState(
+blink::mojom::IdleStatePtr IdleManagerImpl::CheckIdleState(
     base::TimeDelta threshold) {
   base::TimeDelta idle_time = idle_time_provider_->CalculateIdleTime();
   bool locked = idle_time_provider_->CheckIdleStateIsLocked();
@@ -150,7 +173,7 @@ blink::mojom::IdleStatePtr IdleManager::CheckIdleState(
   return IdleTimeToIdleState(locked, idle_time, threshold);
 }
 
-void IdleManager::UpdateIdleState() {
+void IdleManagerImpl::UpdateIdleState() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   for (auto* node = monitors_.head(); node != monitors_.end();
diff --git a/chromium/content/browser/idle/idle_manager.h b/chromium/content/browser/idle/idle_manager_impl.h
index 9fde9a097d8..ad6cc18fd22 100644
--- a/chromium/content/browser/idle/idle_manager.h
+++ b/chromium/content/browser/idle/idle_manager_impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_BROWSER_IDLE_IDLE_MANAGER_H_
-#define CONTENT_BROWSER_IDLE_IDLE_MANAGER_H_
+#ifndef CONTENT_BROWSER_IDLE_IDLE_MANAGER_IMPL_H_
+#define CONTENT_BROWSER_IDLE_IDLE_MANAGER_IMPL_H_
 
 #include <memory>
 
@@ -15,58 +15,43 @@
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "content/browser/idle/idle_monitor.h"
+#include "content/public/browser/idle_manager.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
-#include "ui/base/idle/idle.h"
 #include "url/origin.h"
 
 namespace content {
 
-class CONTENT_EXPORT IdleManager : public blink::mojom::IdleManager {
+class BrowserContext;
+
+class CONTENT_EXPORT IdleManagerImpl : public IdleManager,
+                                       public blink::mojom::IdleManager {
  public:
-  // This class adapts functions from ui:: and allows tests to
-  // inject custom providers.
-  // Adapted from: extensions/browser/api/idle/idle_manager.h
-  class IdleTimeProvider {
-   public:
-    using IdleCallback = base::OnceCallback<void(blink::mojom::IdleState)>;
-    using IdleTimeCallback = base::OnceCallback<void(int)>;
-
-    IdleTimeProvider() {}
-    virtual ~IdleTimeProvider() {}
-
-    // See ui/base/idle/idle.h for the semantics of these methods.
-    // TODO(goto): should this be made private? Doesn't seem to be necessary
-    // as part of a public interface.
-    virtual ui::IdleState CalculateIdleState(
-        base::TimeDelta idle_threshold) = 0;
-    virtual base::TimeDelta CalculateIdleTime() = 0;
-    virtual bool CheckIdleStateIsLocked() = 0;
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(IdleTimeProvider);
-  };
-
-  IdleManager();
-  ~IdleManager() override;
-
-  void CreateService(mojo::PendingReceiver<blink::mojom::IdleManager> receiver);
+  explicit IdleManagerImpl(BrowserContext* browser_context);
+  ~IdleManagerImpl() override;
 
-  // blink.mojom.IdleManager:
-  void AddMonitor(base::TimeDelta threshold,
-                  mojo::PendingRemote<blink::mojom::IdleMonitor> monitor_remote,
-                  AddMonitorCallback callback) override;
+  IdleManagerImpl(const IdleManagerImpl&) = delete;
+  IdleManagerImpl& operator=(const IdleManagerImpl&) = delete;
 
-  // Testing helpers.
+  // IdleManager:
+  void CreateService(mojo::PendingReceiver<blink::mojom::IdleManager> receiver,
+                     const url::Origin& origin) override;
   void SetIdleTimeProviderForTest(
-      std::unique_ptr<IdleTimeProvider> idle_provider);
+      std::unique_ptr<IdleTimeProvider> idle_provider) override;
+  bool IsPollingForTest() override;
 
-  // Tests whether the manager is still polling for updates or not.
-  bool IsPollingForTest();
+  // blink.mojom.IdleManager:
+  void AddMonitor(base::TimeDelta threshold,
+                  mojo::PendingRemote<blink::mojom::IdleMonitor> monitor_remote,
+                  AddMonitorCallback callback) final;
 
  private:
+  // Check permission controller to see if the notification permission is
+  // enabled for the origin.
+  bool HasPermission(const url::Origin&);
+
   // Called internally when a monitor's pipe closes to remove it from
   // |monitors_|.
   void RemoveMonitor(IdleMonitor* monitor);
@@ -91,18 +76,21 @@ class CONTENT_EXPORT IdleManager : public blink::mojom::IdleManager {
   base::RepeatingTimer poll_timer_;
   std::unique_ptr<IdleTimeProvider> idle_time_provider_;
 
+  // Raw pointer should always be valid. IdleManagerImpl is owned by the
+  // StoragePartitionImpl which is owned by BrowserContext. Therefore when the
+  // BrowserContext is destroyed, |this| will be destroyed as well.
+  BrowserContext* const browser_context_;
+
   // Registered clients.
-  mojo::ReceiverSet<blink::mojom::IdleManager> receivers_;
+  mojo::ReceiverSet<blink::mojom::IdleManager, url::Origin> receivers_;
 
   // Owns Monitor instances, added when clients call AddMonitor().
   base::LinkedList<IdleMonitor> monitors_;
 
   SEQUENCE_CHECKER(sequence_checker_);
-  base::WeakPtrFactory<IdleManager> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(IdleManager);
+  base::WeakPtrFactory<IdleManagerImpl> weak_factory_{this};
 };
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_IDLE_IDLE_MANAGER_H_
+#endif  // CONTENT_BROWSER_IDLE_IDLE_MANAGER_IMPL_H_
diff --git a/chromium/content/browser/idle/idle_manager_unittest.cc b/chromium/content/browser/idle/idle_manager_unittest.cc
index edefe4b6043..62a4f28af97 100644
--- a/chromium/content/browser/idle/idle_manager_unittest.cc
+++ b/chromium/content/browser/idle/idle_manager_unittest.cc
@@ -2,8 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/idle/idle_manager.h"
+#include "content/browser/idle/idle_manager_impl.h"
 
+#include <tuple>
 #include <utility>
 
 #include "base/bind.h"
@@ -11,490 +12,382 @@
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
+#include "base/test/task_environment.h"
+#include "base/test/test_mock_time_task_runner.h"
 #include "base/time/time.h"
 #include "content/browser/permissions/permission_controller_impl.h"
 #include "content/public/browser/permission_controller.h"
 #include "content/public/browser/permission_type.h"
-#include "content/public/common/service_manager_connection.h"
+#include "content/public/test/browser_task_environment.h"
 #include "content/public/test/mock_permission_manager.h"
-#include "content/public/test/navigation_simulator.h"
 #include "content/public/test/test_browser_context.h"
-#include "content/test/test_render_frame_host.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
 
+using blink::mojom::IdleManagerError;
 using blink::mojom::IdleMonitorPtr;
+using blink::mojom::IdleStatePtr;
+using blink::mojom::ScreenIdleState;
+using blink::mojom::UserIdleState;
 using ::testing::_;
-using ::testing::InSequence;
 using ::testing::Invoke;
 using ::testing::NiceMock;
-using ::testing::StrictMock;
+using ::testing::Return;
+using url::Origin;
 
 namespace content {
 
 namespace {
 
+const char kTestUrl[] = "https://www.google.com";
+
 constexpr base::TimeDelta kThreshold = base::TimeDelta::FromSeconds(60);
 
 class MockIdleMonitor : public blink::mojom::IdleMonitor {
  public:
-  MOCK_METHOD1(Update, void(blink::mojom::IdleStatePtr));
+  MOCK_METHOD1(Update, void(IdleStatePtr));
 };
 
 class MockIdleTimeProvider : public IdleManager::IdleTimeProvider {
  public:
   MockIdleTimeProvider() = default;
   ~MockIdleTimeProvider() override = default;
+  MockIdleTimeProvider(const MockIdleTimeProvider&) = delete;
+  MockIdleTimeProvider& operator=(const MockIdleTimeProvider&) = delete;
 
-  MOCK_METHOD1(CalculateIdleState, ui::IdleState(base::TimeDelta));
   MOCK_METHOD0(CalculateIdleTime, base::TimeDelta());
   MOCK_METHOD0(CheckIdleStateIsLocked, bool());
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(MockIdleTimeProvider);
 };
 
-class IdleManagerTest : public RenderViewHostImplTestHarness {
+class IdleManagerTest : public testing::Test {
  protected:
-  IdleManagerTest() {}
-
-  ~IdleManagerTest() override {}
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(IdleManagerTest);
-};
-
-}  // namespace
-
-TEST_F(IdleManagerTest, AddMonitor) {
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
-
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  base::RunLoop loop;
-
-  service_remote.set_disconnect_handler(base::BindLambdaForTesting([&]() {
-    ADD_FAILURE() << "Unexpected connection error";
-
-    loop.Quit();
-  }));
-
-  // Initial state of the system.
-  EXPECT_CALL(*mock, CalculateIdleTime())
-      .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(0)));
-  EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-      .WillRepeatedly(testing::Return(false));
-
-  service_remote->AddMonitor(
-      kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-      base::BindOnce(
-          [](base::OnceClosure callback, blink::mojom::IdleStatePtr state) {
-            // The initial state of the status of the user is to be active.
-            EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-            EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-            std::move(callback).Run();
-          },
-          loop.QuitClosure()));
-
-  loop.Run();
-}
-
-// Disabled test: https://crbug.com/1062668
-TEST_F(IdleManagerTest, DISABLED_Idle) {
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
-
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  {
-    base::RunLoop loop;
-    // Initial state of the system.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(0)));
-
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-          loop.Quit();
-        }));
-
-    loop.Run();
+  IdleManagerTest()
+      : task_environment_(base::test::TaskEnvironment::TimeSource::MOCK_TIME),
+        browser_context_(new TestBrowserContext()) {}
+  ~IdleManagerTest() override = default;
+  IdleManagerTest(const IdleManagerTest&) = delete;
+  IdleManagerTest& operator=(const IdleManagerTest&) = delete;
+
+  void SetUp() override {
+    permission_manager_ = new NiceMock<MockPermissionManager>();
+    idle_time_provider_ = new NiceMock<MockIdleTimeProvider>();
+    browser_context_->SetPermissionControllerDelegate(
+        base::WrapUnique(permission_manager_));
+    idle_manager_ = std::make_unique<IdleManagerImpl>(browser_context_.get());
+    idle_manager_->SetIdleTimeProviderForTest(
+        base::WrapUnique(idle_time_provider_));
+    idle_manager_->CreateService(service_remote_.BindNewPipeAndPassReceiver(),
+                                 Origin::Create(url_));
   }
 
-  {
-    base::RunLoop loop;
-    // Simulates a user going idle.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(60)));
-
-    // Expects Update to be notified about the change to idle.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kIdle, state->user);
-          loop.Quit();
-        }));
-    loop.Run();
+  void TearDown() override {
+    idle_manager_.reset();
   }
 
-  {
-    base::RunLoop loop;
-    // Simulates a user going active, calling a callback under the threshold.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(0)));
-
-    // Expects Update to be notified about the change to active.
-    // auto quit = loop.QuitClosure();
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-          // Ends the test.
-          loop.Quit();
-        }));
-    loop.Run();
-  }
-}
-
-TEST_F(IdleManagerTest, UnlockingScreen) {
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
-
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  {
-    base::RunLoop loop;
-
-    // Initial state of the system.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(true));
-
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kLocked, state->screen);
-          loop.Quit();
-        }));
+  IdleManagerImpl* GetIdleManager() { return idle_manager_.get(); }
 
-    loop.Run();
+  void SetPermissionStatus(const GURL& origin,
+                           blink::mojom::PermissionStatus permission_status) {
+    ON_CALL(*permission_manager_,
+            GetPermissionStatus(PermissionType::NOTIFICATIONS, origin, origin))
+        .WillByDefault(Return(permission_status));
   }
 
-  {
+  std::tuple<UserIdleState, ScreenIdleState> AddMonitorRequest(
+      base::TimeDelta threshold) {
     base::RunLoop loop;
+    UserIdleState user_result;
+    ScreenIdleState screen_result;
 
-    // Simulates a user unlocking the screen.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(false));
-
-    // Expects Update to be notified about the change to unlocked.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-          loop.Quit();
-        }));
-
+    service_remote_->AddMonitor(
+        threshold, monitor_receiver_.BindNewPipeAndPassRemote(),
+        base::BindLambdaForTesting(
+            [&loop, &user_result, &screen_result](IdleManagerError error,
+                                                  IdleStatePtr state) {
+              EXPECT_EQ(IdleManagerError::kSuccess, error);
+              user_result = state->user;
+              screen_result = state->screen;
+              loop.Quit();
+            }));
     loop.Run();
+    return std::make_tuple(user_result, screen_result);
   }
-}
-
-// Disabled test: https://crbug.com/1062668
-TEST_F(IdleManagerTest, DISABLED_LockingScreen) {
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
 
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  {
+  std::tuple<UserIdleState, ScreenIdleState> GetIdleStatus() {
     base::RunLoop loop;
-
-    // Initial state of the system.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(false));
-
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-          loop.Quit();
-        }));
-
+    UserIdleState user_result;
+    ScreenIdleState screen_result;
+
+    EXPECT_CALL(idle_monitor_, Update(_))
+        .WillOnce(
+            Invoke([&loop, &user_result, &screen_result](IdleStatePtr state) {
+              user_result = state->user;
+              screen_result = state->screen;
+              loop.Quit();
+            }));
+
+    // Fast forward to run polling task.
+    task_environment_.FastForwardBy(base::TimeDelta::FromSeconds(1));
     loop.Run();
+    return std::make_tuple(user_result, screen_result);
   }
 
-  {
+  void DisconnectRenderer() {
     base::RunLoop loop;
 
-    // Simulates a user locking the screen.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(true));
-
-    // Expects Update to be notified about the change to unlocked.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kLocked, state->screen);
-          loop.Quit();
-        }));
+    // Simulates the renderer disconnecting.
+    monitor_receiver_.reset();
 
-    loop.Run();
+    // Wait for the IdleManager to observe the pipe close.
+    loop.RunUntilIdle();
   }
-}
-
-// Disabled test: https://crbug.com/1062668
-TEST_F(IdleManagerTest, DISABLED_LockingScreenThenIdle) {
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
-
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  {
-    base::RunLoop loop;
-
-    // Initial state of the system.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(false));
 
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-          loop.Quit();
-        }));
-
-    loop.Run();
+  MockIdleTimeProvider* idle_time_provider() const {
+    return idle_time_provider_;
   }
+  const GURL& url() const { return url_; }
 
-  {
-    base::RunLoop loop;
-
-    // Simulates a user locking screen.
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(true));
+ protected:
+  mojo::Remote<blink::mojom::IdleManager> service_remote_;
 
-    // Expects Update to be notified about the change to locked.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kLocked, state->screen);
-          EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-          loop.Quit();
-        }));
+ private:
+  BrowserTaskEnvironment task_environment_;
+  std::unique_ptr<TestBrowserContext> browser_context_;
+  std::unique_ptr<IdleManagerImpl> idle_manager_;
+  MockPermissionManager* permission_manager_;
+  MockIdleTimeProvider* idle_time_provider_;
+  NiceMock<MockIdleMonitor> idle_monitor_;
+  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver_{&idle_monitor_};
+  GURL url_ = GURL(kTestUrl);
+};
 
-    loop.Run();
-  }
+}  // namespace
 
-  {
-    base::RunLoop loop;
+TEST_F(IdleManagerTest, AddMonitor) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-    // Simulates a user going idle, whilte the screen is still locked.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(60)));
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(true));
-
-    // Expects Update to be notified about the change to active.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kIdle, state->user);
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kLocked, state->screen);
-          // Ends the test.
-          loop.Quit();
-        }));
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
 
-    loop.Run();
-  }
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            AddMonitorRequest(kThreshold));
 }
 
-// Disabled test: https://crbug.com/1062668
-TEST_F(IdleManagerTest, DISABLED_LockingScreenAfterIdle) {
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
+TEST_F(IdleManagerTest, Idle) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            AddMonitorRequest(kThreshold));
+
+  // Simulates a user going idle.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(60)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kIdle, ScreenIdleState::kLocked),
+            GetIdleStatus());
+
+  // Simulates a user going active, calling a callback under the threshold.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            GetIdleStatus());
+}
 
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
+TEST_F(IdleManagerTest, UnlockingScreen) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-  {
-    base::RunLoop loop;
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(70)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kIdle, ScreenIdleState::kLocked),
+            AddMonitorRequest(kThreshold));
+
+  // Simulates a user unlocking the screen.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            GetIdleStatus());
+}
 
-    // Initial state of the system.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(0)));
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(false));
+TEST_F(IdleManagerTest, LockingScreen) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kActive, state->user);
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-          loop.Quit();
-        }));
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            AddMonitorRequest(kThreshold));
+
+  // Simulates a user locking the screen.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(10)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kLocked),
+            GetIdleStatus());
+}
 
-    loop.Run();
-  }
+TEST_F(IdleManagerTest, LockingScreenThenIdle) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-  {
-    base::RunLoop loop;
-    // Simulates a user going idle, but with the screen still unlocked.
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(60)));
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(false));
-
-    // Expects Update to be notified about the change to idle.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::UserIdleState::kIdle, state->user);
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kUnlocked, state->screen);
-          loop.Quit();
-        }));
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            AddMonitorRequest(kThreshold));
+
+  // Simulates a user locking screen.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(10)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kLocked),
+            GetIdleStatus());
+
+  // Simulates a user going idle, while the screen is still locked.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(70)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kIdle, ScreenIdleState::kLocked),
+            GetIdleStatus());
+}
 
-    loop.Run();
-  }
+TEST_F(IdleManagerTest, LockingScreenAfterIdle) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-  {
-    base::RunLoop loop;
-    // Simulates the screeng getting locked by the system after the user goes
-    // idle (e.g. screensaver kicks in first, throwing idleness, then getting
-    // locked).
-    EXPECT_CALL(*mock, CalculateIdleTime())
-        .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(60)));
-    EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-        .WillRepeatedly(testing::Return(true));
-
-    // Expects Update to be notified about the change to locked.
-    EXPECT_CALL(monitor, Update(_))
-        .WillOnce(Invoke([&](blink::mojom::IdleStatePtr state) {
-          EXPECT_EQ(blink::mojom::ScreenIdleState::kLocked, state->screen);
-          EXPECT_EQ(blink::mojom::UserIdleState::kIdle, state->user);
-          // Ends the test.
-          loop.Quit();
-        }));
-    loop.Run();
-  }
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(0)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked),
+            AddMonitorRequest(kThreshold));
+
+  // Simulates a user going idle, but with the screen still unlocked.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(60)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kIdle, ScreenIdleState::kUnlocked),
+            GetIdleStatus());
+
+  // Simulates the screen getting locked by the system after the user goes
+  // idle (e.g. screensaver kicks in first, throwing idleness, then getting
+  // locked).
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(60)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(true));
+
+  EXPECT_EQ(std::make_tuple(UserIdleState::kIdle, ScreenIdleState::kLocked),
+            GetIdleStatus());
 }
 
 TEST_F(IdleManagerTest, RemoveMonitorStopsPolling) {
   // Simulates the renderer disconnecting (e.g. on page reload) and verifies
   // that the polling stops for the idle detection.
 
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
-
-  MockIdleMonitor monitor;
-  mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
-
-  {
-    base::RunLoop loop;
-
-    service_remote->AddMonitor(
-        kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
-        base::BindLambdaForTesting(
-            [&](blink::mojom::IdleStatePtr state) { loop.Quit(); }));
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
 
-    loop.Run();
-  }
+  AddMonitorRequest(kThreshold);
 
+  auto* impl = GetIdleManager();
   EXPECT_TRUE(impl->IsPollingForTest());
 
-  {
-    base::RunLoop loop;
-
-    // Simulates the renderer disconnecting.
-    monitor_receiver.reset();
-
-    // Wait for the IdleManager to observe the pipe close.
-    loop.RunUntilIdle();
-  }
+  DisconnectRenderer();
 
   EXPECT_FALSE(impl->IsPollingForTest());
 }
 
 TEST_F(IdleManagerTest, Threshold) {
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
+
+  // Initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime())
+      .WillOnce(Return(base::TimeDelta::FromSeconds(90)));
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked())
+      .WillOnce(Return(false));
+
+  EXPECT_EQ(
+      AddMonitorRequest(base::TimeDelta::FromSeconds(91)),
+      std::make_tuple(UserIdleState::kActive, ScreenIdleState::kUnlocked));
+}
+
+TEST_F(IdleManagerTest, InvalidThreshold) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::GRANTED);
+  mojo::test::BadMessageObserver bad_message_observer;
 
   MockIdleMonitor monitor;
   mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
 
-  base::RunLoop loop;
+  // Should not start initial state of the system.
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime()).Times(0);
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked()).Times(0);
 
-  // Initial state of the system.
-  EXPECT_CALL(*mock, CalculateIdleTime())
-      .WillRepeatedly(testing::Return(base::TimeDelta::FromSeconds(91)));
-  EXPECT_CALL(*mock, CheckIdleStateIsLocked())
-      .WillRepeatedly(testing::Return(false));
-
-  service_remote->AddMonitor(
-      base::TimeDelta::FromSeconds(90),
-      monitor_receiver.BindNewPipeAndPassRemote(),
-      base::BindLambdaForTesting([&](blink::mojom::IdleStatePtr state) {
-        EXPECT_EQ(blink::mojom::UserIdleState::kIdle, state->user);
-        loop.Quit();
-      }));
+  service_remote_->AddMonitor(base::TimeDelta::FromSeconds(50),
+                              monitor_receiver.BindNewPipeAndPassRemote(),
+                              base::NullCallback());
 
-  loop.Run();
+  EXPECT_EQ("Minimum threshold is 1 minute.",
+            bad_message_observer.WaitForBadMessage());
 }
 
-TEST_F(IdleManagerTest, BadThreshold) {
-  mojo::test::BadMessageObserver bad_message_observer;
-  auto impl = std::make_unique<IdleManager>();
-  auto* mock = new NiceMock<MockIdleTimeProvider>();
-  impl->SetIdleTimeProviderForTest(base::WrapUnique(mock));
-  mojo::Remote<blink::mojom::IdleManager> service_remote;
-  impl->CreateService(service_remote.BindNewPipeAndPassReceiver());
+TEST_F(IdleManagerTest, NotificationPermissionDisabled) {
+  SetPermissionStatus(url(), blink::mojom::PermissionStatus::DENIED);
 
   MockIdleMonitor monitor;
   mojo::Receiver<blink::mojom::IdleMonitor> monitor_receiver(&monitor);
 
   // Should not start initial state of the system.
-  EXPECT_CALL(*mock, CalculateIdleTime()).Times(0);
-  EXPECT_CALL(*mock, CheckIdleStateIsLocked()).Times(0);
+  EXPECT_CALL(*idle_time_provider(), CalculateIdleTime()).Times(0);
+  EXPECT_CALL(*idle_time_provider(), CheckIdleStateIsLocked()).Times(0);
 
-  service_remote->AddMonitor(base::TimeDelta::FromSeconds(50),
-                             monitor_receiver.BindNewPipeAndPassRemote(),
-                             base::NullCallback());
-  EXPECT_EQ("Minimum threshold is 60 seconds.",
-            bad_message_observer.WaitForBadMessage());
+  base::RunLoop loop;
+  service_remote_->AddMonitor(
+      kThreshold, monitor_receiver.BindNewPipeAndPassRemote(),
+      base::BindLambdaForTesting(
+          [&loop](IdleManagerError error, IdleStatePtr state) {
+            EXPECT_EQ(IdleManagerError::kPermissionDisabled, error);
+            EXPECT_FALSE(state);
+            loop.Quit();
+          }));
+  loop.Run();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/idle/idle_monitor.cc b/chromium/content/browser/idle/idle_monitor.cc
index d40db28b9f5..636e88ed0cd 100644
--- a/chromium/content/browser/idle/idle_monitor.cc
+++ b/chromium/content/browser/idle/idle_monitor.cc
@@ -2,16 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <utility>
-
 #include "content/browser/idle/idle_monitor.h"
 
+#include <utility>
+
 #include "base/bind.h"
-#include "base/callback_helpers.h"
-#include "content/public/browser/permission_controller.h"
-#include "content/public/browser/permission_type.h"
 #include "mojo/public/cpp/bindings/connection_error_callback.h"
-#include "ui/base/idle/idle.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/idle/idle_monitor.h b/chromium/content/browser/idle/idle_monitor.h
index 98c4462e06c..8a182577ad4 100644
--- a/chromium/content/browser/idle/idle_monitor.h
+++ b/chromium/content/browser/idle/idle_monitor.h
@@ -9,17 +9,12 @@
 
 #include "base/callback.h"
 #include "base/containers/linked_list.h"
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
 #include "base/sequence_checker.h"
 #include "base/time/time.h"
-#include "base/timer/timer.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/connection_error_callback.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
-#include "ui/base/idle/idle.h"
-#include "url/origin.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/image_capture/OWNERS b/chromium/content/browser/image_capture/OWNERS
index 97f49d74d75..00a852936ac 100644
--- a/chromium/content/browser/image_capture/OWNERS
+++ b/chromium/content/browser/image_capture/OWNERS
@@ -1,5 +1,4 @@
-# Original (legacy) owner.
-mcasas@chromium.org
+file://third_party/blink/renderer/modules/imagecapture/OWNERS
 
 # COMPONENT: Blink>ImageCapture
-# TEAM: chromium-dev@chromium.org
+# TEAM: webrtc-dev@chromium.org
diff --git a/chromium/content/browser/image_capture/image_capture_impl.cc b/chromium/content/browser/image_capture/image_capture_impl.cc
index 9ef9af820da..0469a4342d2 100644
--- a/chromium/content/browser/image_capture/image_capture_impl.cc
+++ b/chromium/content/browser/image_capture/image_capture_impl.cc
@@ -8,19 +8,24 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/command_line.h"
 #include "base/task/post_task.h"
 #include "base/unguessable_token.h"
+#include "build/build_config.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "content/browser/renderer_host/media/video_capture_manager.h"
+#include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/permission_controller.h"
+#include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
 #include "media/base/bind_to_current_loop.h"
 #include "media/capture/mojom/image_capture_types.h"
 #include "media/capture/video/video_capture_device.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 
 namespace content {
@@ -74,15 +79,15 @@ void TakePhotoOnIOThread(const std::string& source_id,
 
 }  // anonymous namespace
 
-ImageCaptureImpl::ImageCaptureImpl() {}
-
-ImageCaptureImpl::~ImageCaptureImpl() {}
-
 // static
 void ImageCaptureImpl::Create(
+    RenderFrameHost* render_frame_host,
     mojo::PendingReceiver<media::mojom::ImageCapture> receiver) {
-  mojo::MakeSelfOwnedReceiver(std::make_unique<ImageCaptureImpl>(),
-                              std::move(receiver));
+  DCHECK(render_frame_host);
+  // ImageCaptureImpl owns itself. It will self-destruct when a Mojo interface
+  // error occurs, the render frame host is deleted, or the render frame host
+  // navigates to a new document.
+  new ImageCaptureImpl(render_frame_host, std::move(receiver));
 }
 
 void ImageCaptureImpl::GetPhotoState(const std::string& source_id,
@@ -94,7 +99,9 @@ void ImageCaptureImpl::GetPhotoState(const std::string& source_id,
 
   GetPhotoStateCallback scoped_callback =
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
-          media::BindToCurrentLoop(std::move(callback)),
+          media::BindToCurrentLoop(
+              base::BindOnce(&ImageCaptureImpl::OnGetPhotoState,
+                             weak_factory_.GetWeakPtr(), std::move(callback))),
           mojo::CreateEmptyPhotoState());
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
@@ -111,6 +118,14 @@ void ImageCaptureImpl::SetOptions(const std::string& source_id,
                        "ImageCaptureImpl::SetOptions",
                        TRACE_EVENT_SCOPE_PROCESS);
 
+  // TODO(crbug.com/934063): Check "has_zoom" as well if upcoming metrics show
+  // that zoom may be moved under this permission.
+  if ((settings->has_pan || settings->has_tilt) &&
+      !HasPanTiltZoomPermissionGranted()) {
+    std::move(callback).Run(false);
+    return;
+  }
+
   SetOptionsCallback scoped_callback =
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           media::BindToCurrentLoop(std::move(callback)), false);
@@ -139,4 +154,48 @@ void ImageCaptureImpl::TakePhoto(const std::string& source_id,
                      std::move(scoped_callback)));
 }
 
+ImageCaptureImpl::ImageCaptureImpl(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<media::mojom::ImageCapture> receiver)
+    : FrameServiceBase(render_frame_host, std::move(receiver)) {}
+
+ImageCaptureImpl::~ImageCaptureImpl() = default;
+
+void ImageCaptureImpl::OnGetPhotoState(GetPhotoStateCallback callback,
+                                       media::mojom::PhotoStatePtr state) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  // TODO(crbug.com/934063): Reset "zoom" as well if upcoming metrics show
+  // that zoom may be moved under this permission.
+  if (!HasPanTiltZoomPermissionGranted()) {
+    state->pan = media::mojom::Range::New();
+    state->tilt = media::mojom::Range::New();
+  }
+  std::move(callback).Run(std::move(state));
+}
+
+bool ImageCaptureImpl::HasPanTiltZoomPermissionGranted() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+#if defined(OS_ANDROID)
+  // Camera PTZ is desktop only at the moment.
+  return true;
+#else
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableExperimentalWebPlatformFeatures)) {
+    return false;
+  }
+
+  auto* web_contents = WebContents::FromRenderFrameHost(render_frame_host());
+  auto* permission_controller = BrowserContext::GetPermissionController(
+      web_contents->GetBrowserContext());
+  DCHECK(permission_controller);
+
+  blink::mojom::PermissionStatus status =
+      permission_controller->GetPermissionStatusForFrame(
+          PermissionType::CAMERA_PAN_TILT_ZOOM, render_frame_host(),
+          origin().GetURL());
+
+  return status == blink::mojom::PermissionStatus::GRANTED;
+#endif
+}
 }  // namespace content
diff --git a/chromium/content/browser/image_capture/image_capture_impl.h b/chromium/content/browser/image_capture/image_capture_impl.h
index b7bc6f891c6..1f2bf3fe3b5 100644
--- a/chromium/content/browser/image_capture/image_capture_impl.h
+++ b/chromium/content/browser/image_capture/image_capture_impl.h
@@ -5,17 +5,18 @@
 #ifndef CONTENT_BROWSER_IMAGE_CAPTURE_IMAGE_CAPTURE_IMPL_H_
 #define CONTENT_BROWSER_IMAGE_CAPTURE_IMAGE_CAPTURE_IMPL_H_
 
+#include "base/memory/weak_ptr.h"
+#include "content/public/browser/frame_service_base.h"
 #include "media/capture/mojom/image_capture.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
-class ImageCaptureImpl : public media::mojom::ImageCapture {
+class ImageCaptureImpl final
+    : public content::FrameServiceBase<media::mojom::ImageCapture> {
  public:
-  ImageCaptureImpl();
-  ~ImageCaptureImpl() override;
-
   static void Create(
+      RenderFrameHost* render_frame_host,
       mojo::PendingReceiver<media::mojom::ImageCapture> receiver);
 
   void GetPhotoState(const std::string& source_id,
@@ -29,6 +30,17 @@ class ImageCaptureImpl : public media::mojom::ImageCapture {
                  TakePhotoCallback callback) override;
 
  private:
+  ImageCaptureImpl(RenderFrameHost* render_frame_host,
+                   mojo::PendingReceiver<media::mojom::ImageCapture> receiver);
+  ~ImageCaptureImpl() override;
+
+  void OnGetPhotoState(GetPhotoStateCallback callback,
+                       media::mojom::PhotoStatePtr);
+
+  bool HasPanTiltZoomPermissionGranted();
+
+  base::WeakPtrFactory<ImageCaptureImpl> weak_factory_{this};
+
   DISALLOW_COPY_AND_ASSIGN(ImageCaptureImpl);
 };
 
diff --git a/chromium/content/browser/indexed_db/file_stream_reader_to_data_pipe.cc b/chromium/content/browser/indexed_db/file_stream_reader_to_data_pipe.cc
index ade7ac08f17..8e83a01a43a 100644
--- a/chromium/content/browser/indexed_db/file_stream_reader_to_data_pipe.cc
+++ b/chromium/content/browser/indexed_db/file_stream_reader_to_data_pipe.cc
@@ -60,8 +60,8 @@ void FileStreamReaderToDataPipe::ReadMore() {
       new network::NetToMojoIOBuffer(pending_write_.get()));
   int result =
       reader_->Read(buffer.get(), base::checked_cast<int>(read_bytes),
-                    base::BindRepeating(&FileStreamReaderToDataPipe::DidRead,
-                                        base::Unretained(this)));
+                    base::BindOnce(&FileStreamReaderToDataPipe::DidRead,
+                                   base::Unretained(this)));
 
   if (result != net::ERR_IO_PENDING)
     DidRead(result);
diff --git a/chromium/content/browser/indexed_db/indexed_db_backing_store.cc b/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
index dd023461ebc..d02f5368073 100644
--- a/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
@@ -1297,18 +1297,34 @@ Status IndexedDBBackingStore::ClearObjectStore(
   IDB_TRACE("IndexedDBBackingStore::ClearObjectStore");
   if (!KeyPrefix::ValidIds(database_id, object_store_id))
     return InvalidDBKeyStatus();
-  const std::string start_key =
-      KeyPrefix(database_id, object_store_id).Encode();
-  const std::string stop_key =
-      KeyPrefix(database_id, object_store_id + 1).Encode();
-  Status s = transaction->transaction()->RemoveRange(
-      start_key, stop_key,
-      LevelDBScopeDeletionMode::kImmediateWithRangeEndExclusive);
+
+  Status s =
+      DeleteBlobsInObjectStore(transaction, database_id, object_store_id);
   if (!s.ok()) {
     INTERNAL_WRITE_ERROR(CLEAR_OBJECT_STORE);
     return s;
   }
-  return DeleteBlobsInObjectStore(transaction, database_id, object_store_id);
+
+  // Don't delete the BlobEntryKeys so that they can be read and deleted
+  // via CollectBlobFilesToRemove.
+  // TODO(enne): This process could be optimized by storing the blob ids
+  // in DeleteBlobsInObjectStore rather than re-reading them later.
+  const std::string start_key1 =
+      KeyPrefix(database_id, object_store_id).Encode();
+  const std::string stop_key1 =
+      BlobEntryKey::EncodeMinKeyForObjectStore(database_id, object_store_id);
+  const std::string start_key2 =
+      BlobEntryKey::EncodeStopKeyForObjectStore(database_id, object_store_id);
+  const std::string stop_key2 =
+      KeyPrefix(database_id, object_store_id + 1).Encode();
+  s = transaction->transaction()->RemoveRange(
+      start_key1, stop_key1,
+      LevelDBScopeDeletionMode::kImmediateWithRangeEndExclusive);
+  if (!s.ok())
+    return s;
+  return transaction->transaction()->RemoveRange(
+      start_key2, stop_key2,
+      LevelDBScopeDeletionMode::kImmediateWithRangeEndExclusive);
 }
 
 Status IndexedDBBackingStore::DeleteRecord(
diff --git a/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
index 59c25e44056..ba33ee14668 100644
--- a/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
@@ -13,11 +13,12 @@
 #include "base/barrier_closure.h"
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/containers/span.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/guid.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/sequenced_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
@@ -64,12 +65,6 @@ using url::Origin;
 namespace content {
 namespace indexed_db_backing_store_unittest {
 
-// Write |content| to |file|. Returns true on success.
-bool WriteFile(const base::FilePath& file, base::StringPiece content) {
-  int write_size = base::WriteFile(file, content.data(), content.length());
-  return write_size >= 0 && write_size == static_cast<int>(content.length());
-}
-
 class TestableIndexedDBBackingStore : public IndexedDBBackingStore {
  public:
   TestableIndexedDBBackingStore(
@@ -1551,45 +1546,45 @@ TEST_F(IndexedDBBackingStoreTest, ReadCorruptionInfo) {
 
   // Empty file.
   std::string dummy_data;
-  ASSERT_TRUE(WriteFile(info_path, dummy_data));
+  ASSERT_TRUE(base::WriteFile(info_path, dummy_data));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // File size > 4 KB.
   dummy_data.resize(5000, 'c');
-  ASSERT_TRUE(WriteFile(info_path, dummy_data));
+  ASSERT_TRUE(base::WriteFile(info_path, dummy_data));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // Random string.
-  ASSERT_TRUE(WriteFile(info_path, "foo bar"));
+  ASSERT_TRUE(base::WriteFile(info_path, "foo bar"));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // Not a dictionary.
-  ASSERT_TRUE(WriteFile(info_path, "[]"));
+  ASSERT_TRUE(base::WriteFile(info_path, "[]"));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // Empty dictionary.
-  ASSERT_TRUE(WriteFile(info_path, "{}"));
+  ASSERT_TRUE(base::WriteFile(info_path, "{}"));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // Dictionary, no message key.
-  ASSERT_TRUE(WriteFile(info_path, "{\"foo\":\"bar\"}"));
+  ASSERT_TRUE(base::WriteFile(info_path, "{\"foo\":\"bar\"}"));
   EXPECT_TRUE(indexed_db::ReadCorruptionInfo(path_base, origin).empty());
   EXPECT_FALSE(PathExists(info_path));
 
   // Dictionary, message key.
-  ASSERT_TRUE(WriteFile(info_path, "{\"message\":\"bar\"}"));
+  ASSERT_TRUE(base::WriteFile(info_path, "{\"message\":\"bar\"}"));
   std::string message = indexed_db::ReadCorruptionInfo(path_base, origin);
   EXPECT_FALSE(message.empty());
   EXPECT_FALSE(PathExists(info_path));
   EXPECT_EQ("bar", message);
 
   // Dictionary, message key and more.
-  ASSERT_TRUE(WriteFile(info_path, "{\"message\":\"foo\",\"bar\":5}"));
+  ASSERT_TRUE(base::WriteFile(info_path, "{\"message\":\"foo\",\"bar\":5}"));
   message = indexed_db::ReadCorruptionInfo(path_base, origin);
   EXPECT_FALSE(message.empty());
   EXPECT_FALSE(PathExists(info_path));
@@ -1974,5 +1969,98 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, SchemaUpgradeV3ToV4) {
   EXPECT_TRUE(CheckBlobInfoMatches(result_value.external_objects));
 }
 
+// This tests that external objects are deleted when ClearObjectStore is called.
+// See: http://crbug.com/488851
+// TODO(enne): we could use more comprehensive testing for ClearObjectStore.
+TEST_P(IndexedDBBackingStoreTestWithExternalObjects, ClearObjectStoreObjects) {
+  const std::vector<IndexedDBKey> keys = {
+      IndexedDBKey(ASCIIToUTF16("key0")), IndexedDBKey(ASCIIToUTF16("key1")),
+      IndexedDBKey(ASCIIToUTF16("key2")), IndexedDBKey(ASCIIToUTF16("key3"))};
+
+  const int64_t database_id = 777;
+  const int64_t object_store_id = 999;
+
+  // Create two object stores, to verify that only one gets deleted.
+  for (size_t i = 0; i < 2; ++i) {
+    const int64_t write_object_store_id = object_store_id + i;
+
+    std::vector<IndexedDBExternalObject> external_objects;
+    for (size_t j = 0; j < 4; ++j) {
+      std::string type = "type " + base::NumberToString(j);
+      external_objects.push_back(CreateBlobInfo(base::UTF8ToUTF16(type), 1));
+    }
+
+    std::vector<IndexedDBValue> values = {
+        IndexedDBValue("value0", {external_objects[0]}),
+        IndexedDBValue("value1", {external_objects[1]}),
+        IndexedDBValue("value2", {external_objects[2]}),
+        IndexedDBValue("value3", {external_objects[3]}),
+    };
+    ASSERT_GE(keys.size(), values.size());
+
+    // Initiate transaction1 - write records.
+    std::unique_ptr<IndexedDBBackingStore::Transaction> transaction1 =
+        std::make_unique<IndexedDBBackingStore::Transaction>(
+            backing_store()->AsWeakPtr(),
+            blink::mojom::IDBTransactionDurability::Relaxed,
+            blink::mojom::IDBTransactionMode::ReadWrite);
+    transaction1->Begin(CreateDummyLock());
+    IndexedDBBackingStore::RecordIdentifier record;
+    for (size_t i = 0; i < values.size(); ++i) {
+      EXPECT_TRUE(backing_store()
+                      ->PutRecord(transaction1.get(), database_id,
+                                  write_object_store_id, keys[i], &values[i],
+                                  &record)
+                      .ok());
+    }
+
+    // Start committing transaction1.
+    bool succeeded = false;
+    EXPECT_TRUE(
+        transaction1->CommitPhaseOne(CreateBlobWriteCallback(&succeeded)).ok());
+    task_environment_.RunUntilIdle();
+
+    // Finish committing transaction1.
+
+    EXPECT_TRUE(succeeded);
+    EXPECT_TRUE(transaction1->CommitPhaseTwo().ok());
+  }
+
+  // Initiate transaction 2 - delete object store
+  std::unique_ptr<IndexedDBBackingStore::Transaction> transaction2 =
+      std::make_unique<IndexedDBBackingStore::Transaction>(
+          backing_store()->AsWeakPtr(),
+          blink::mojom::IDBTransactionDurability::Relaxed,
+          blink::mojom::IDBTransactionMode::ReadWrite);
+  transaction2->Begin(CreateDummyLock());
+  IndexedDBValue result_value;
+  EXPECT_TRUE(
+      backing_store()
+          ->ClearObjectStore(transaction2.get(), database_id, object_store_id)
+          .ok());
+
+  // Start committing transaction2.
+  bool succeeded = false;
+  EXPECT_TRUE(
+      transaction2->CommitPhaseOne(CreateBlobWriteCallback(&succeeded)).ok());
+  task_environment_.RunUntilIdle();
+
+  // Finish committing transaction2.
+
+  EXPECT_TRUE(succeeded);
+  EXPECT_TRUE(transaction2->CommitPhaseTwo().ok());
+
+  // Verify blob removals.
+  ASSERT_EQ(4UL, backing_store()->removals().size());
+  EXPECT_EQ(blob_context_->writes()[0].path, backing_store()->removals()[0]);
+  EXPECT_EQ(blob_context_->writes()[1].path, backing_store()->removals()[1]);
+  EXPECT_EQ(blob_context_->writes()[2].path, backing_store()->removals()[2]);
+  EXPECT_EQ(blob_context_->writes()[3].path, backing_store()->removals()[3]);
+
+  // Clean up on the IDB sequence.
+  transaction2.reset();
+  task_environment_.RunUntilIdle();
+}
+
 }  // namespace indexed_db_backing_store_unittest
 }  // namespace content
diff --git a/chromium/content/browser/indexed_db/indexed_db_browsertest.cc b/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
index 41a5cf343a8..d05598c4303 100644
--- a/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
@@ -40,6 +40,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -1013,9 +1014,7 @@ INSTANTIATE_TEST_SUITE_P(IndexedDBBrowserTestInstantiation,
                                            "failTransactionCommit",
                                            "clearObjectStore"));
 
-// TODO(crbug.com/1071292): Make this test less brittle and re-enable it.
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest,
-                       DISABLED_DeleteCompactsBackingStore) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, DeleteCompactsBackingStore) {
   const GURL kTestUrl = GetTestUrl("indexeddb", "delete_compact.html");
   const url::Origin kTestOrigin = url::Origin::Create(kTestUrl);
   SimpleTest(GURL(kTestUrl.spec() + "#fill"));
@@ -1182,21 +1181,7 @@ IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTestV2SchemaCorruption, LifecycleTest) {
   SimpleTest(embedded_test_server()->GetURL(test_file));
 }
 
-class IndexedDBBrowserTestSingleProcess : public IndexedDBBrowserTest {
- public:
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitch(switches::kSingleProcess);
-  }
-};
-
-// https://crbug.com/788788
-#if defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
-#define MAYBE_RenderThreadShutdownTest DISABLED_RenderThreadShutdownTest
-#else
-#define MAYBE_RenderThreadShutdownTest RenderThreadShutdownTest
-#endif  // defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
-IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTestSingleProcess,
-                       MAYBE_RenderThreadShutdownTest) {
+IN_PROC_BROWSER_TEST_F(IndexedDBBrowserTest, ShutdownWithRequests) {
   SimpleTest(GetTestUrl("indexeddb", "shutdown_with_requests.html"));
 }
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_connection.cc b/chromium/content/browser/indexed_db/indexed_db_connection.cc
index 248ea079d7b..28ce4999ff4 100644
--- a/chromium/content/browser/indexed_db/indexed_db_connection.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_connection.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/stl_util.h"
 #include "content/browser/indexed_db/indexed_db_class_factory.h"
 #include "content/browser/indexed_db/indexed_db_database_callbacks.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_context_impl.cc b/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
index 29d3a7112a8..1f0b7d1fe2f 100644
--- a/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
@@ -10,11 +10,11 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string_util.h"
@@ -864,7 +864,7 @@ void IndexedDBContextImpl::QueryDiskAndUpdateQuotaUsage(const Origin& origin) {
   if (difference) {
     origin_size_map_[origin] = current_disk_usage;
     quota_manager_proxy()->NotifyStorageModified(
-        storage::QuotaClient::kIndexedDatabase, origin,
+        storage::QuotaClientType::kIndexedDatabase, origin,
         blink::mojom::StorageType::kTemporary, difference);
     NotifyIndexedDBListChanged(origin);
   }
diff --git a/chromium/content/browser/indexed_db/indexed_db_control_wrapper.cc b/chromium/content/browser/indexed_db/indexed_db_control_wrapper.cc
new file mode 100644
index 00000000000..e187c7e8c4e
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_control_wrapper.cc
@@ -0,0 +1,95 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/indexed_db/indexed_db_control_wrapper.h"
+
+namespace content {
+
+IndexedDBControlWrapper::IndexedDBControlWrapper(
+    scoped_refptr<IndexedDBContextImpl> context)
+    : context_(std::move(context)) {}
+
+IndexedDBControlWrapper::~IndexedDBControlWrapper() = default;
+
+void IndexedDBControlWrapper::BindIndexedDB(
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  // TODO(enne): track special storage policy here.
+  BindRemoteIfNeeded();
+  indexed_db_control_->BindIndexedDB(origin, std::move(receiver));
+}
+
+void IndexedDBControlWrapper::GetUsage(GetUsageCallback usage_callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->GetUsage(std::move(usage_callback));
+}
+
+void IndexedDBControlWrapper::DeleteForOrigin(
+    const url::Origin& origin,
+    DeleteForOriginCallback callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->DeleteForOrigin(origin, std::move(callback));
+}
+
+void IndexedDBControlWrapper::ForceClose(
+    const url::Origin& origin,
+    storage::mojom::ForceCloseReason reason,
+    base::OnceClosure callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->ForceClose(origin, reason, std::move(callback));
+}
+
+void IndexedDBControlWrapper::GetConnectionCount(
+    const url::Origin& origin,
+    GetConnectionCountCallback callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->GetConnectionCount(origin, std::move(callback));
+}
+
+void IndexedDBControlWrapper::DownloadOriginData(
+    const url::Origin& origin,
+    DownloadOriginDataCallback callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->DownloadOriginData(origin, std::move(callback));
+}
+
+void IndexedDBControlWrapper::GetAllOriginsDetails(
+    GetAllOriginsDetailsCallback callback) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->GetAllOriginsDetails(std::move(callback));
+}
+
+void IndexedDBControlWrapper::SetForceKeepSessionState() {
+  BindRemoteIfNeeded();
+  indexed_db_control_->SetForceKeepSessionState();
+}
+
+void IndexedDBControlWrapper::BindTestInterface(
+    mojo::PendingReceiver<storage::mojom::IndexedDBControlTest> receiver) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->BindTestInterface(std::move(receiver));
+}
+
+void IndexedDBControlWrapper::AddObserver(
+    mojo::PendingRemote<storage::mojom::IndexedDBObserver> observer) {
+  BindRemoteIfNeeded();
+  indexed_db_control_->AddObserver(std::move(observer));
+}
+
+void IndexedDBControlWrapper::BindRemoteIfNeeded() {
+  DCHECK(
+      !(indexed_db_control_.is_bound() && !indexed_db_control_.is_connected()))
+      << "Rebinding is not supported yet.";
+
+  if (indexed_db_control_.is_bound())
+    return;
+  IndexedDBContextImpl* idb_context = GetIndexedDBContextInternal();
+  idb_context->IDBTaskRunner()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&IndexedDBContextImpl::Bind,
+                     base::WrapRefCounted(idb_context),
+                     indexed_db_control_.BindNewPipeAndPassReceiver()));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/indexed_db/indexed_db_control_wrapper.h b/chromium/content/browser/indexed_db/indexed_db_control_wrapper.h
new file mode 100644
index 00000000000..5457ed16c76
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_control_wrapper.h
@@ -0,0 +1,55 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_CONTROL_WRAPPER_H_
+#define CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_CONTROL_WRAPPER_H_
+
+#include "components/services/storage/public/mojom/indexed_db_control.mojom.h"
+#include "content/browser/indexed_db/indexed_db_context_impl.h"
+
+namespace content {
+
+class CONTENT_EXPORT IndexedDBControlWrapper
+    : public storage::mojom::IndexedDBControl {
+ public:
+  explicit IndexedDBControlWrapper(scoped_refptr<IndexedDBContextImpl> context);
+  ~IndexedDBControlWrapper() override;
+
+  // mojom::IndexedDBControl implementation:
+  void BindIndexedDB(
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) override;
+  void GetUsage(GetUsageCallback usage_callback) override;
+  void DeleteForOrigin(const url::Origin& origin,
+                       DeleteForOriginCallback callback) override;
+  void ForceClose(const url::Origin& origin,
+                  storage::mojom::ForceCloseReason reason,
+                  base::OnceClosure callback) override;
+  void GetConnectionCount(const url::Origin& origin,
+                          GetConnectionCountCallback callback) override;
+  void DownloadOriginData(const url::Origin& origin,
+                          DownloadOriginDataCallback callback) override;
+  void GetAllOriginsDetails(GetAllOriginsDetailsCallback callback) override;
+  void SetForceKeepSessionState() override;
+  void BindTestInterface(
+      mojo::PendingReceiver<storage::mojom::IndexedDBControlTest> receiver)
+      override;
+  void AddObserver(
+      mojo::PendingRemote<storage::mojom::IndexedDBObserver> observer) override;
+
+  // TODO(enne): remove this once IndexedDB moves to storage service.
+  IndexedDBContextImpl* GetIndexedDBContextInternal() { return context_.get(); }
+
+ private:
+  void BindRemoteIfNeeded();
+
+  mojo::Remote<storage::mojom::IndexedDBControl> indexed_db_control_;
+  scoped_refptr<IndexedDBContextImpl> context_;
+
+  DISALLOW_COPY_AND_ASSIGN(IndexedDBControlWrapper);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_CONTROL_WRAPPER_H_
diff --git a/chromium/content/browser/indexed_db/indexed_db_cursor.cc b/chromium/content/browser/indexed_db/indexed_db_cursor.cc
index 0c19d2e9076..91e5e035eee 100644
--- a/chromium/content/browser/indexed_db/indexed_db_cursor.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_cursor.cc
@@ -9,7 +9,8 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/task/post_task.h"
 #include "content/browser/indexed_db/indexed_db_callback_helpers.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
index 05acf5b6f9c..2751303773c 100644
--- a/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
@@ -10,7 +10,6 @@
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/string16.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_external_object.cc b/chromium/content/browser/indexed_db/indexed_db_external_object.cc
index 41763330e11..62ba3c32b5e 100644
--- a/chromium/content/browser/indexed_db/indexed_db_external_object.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_external_object.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/browser/indexed_db/indexed_db_leveldb_coding.h"
 #include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
index 33e50e455f3..176b39499b9 100644
--- a/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
@@ -10,7 +10,6 @@
 #include "base/barrier_closure.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/run_loop.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_feature_observer_browsertest.cc b/chromium/content/browser/indexed_db/indexed_db_feature_observer_browsertest.cc
index 89cbdec48f3..6e4de397027 100644
--- a/chromium/content/browser/indexed_db/indexed_db_feature_observer_browsertest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_feature_observer_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/feature_observer_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_index_writer.cc b/chromium/content/browser/indexed_db/indexed_db_index_writer.cc
index 9bdb91f2db8..bf1ade767c3 100644
--- a/chromium/content/browser/indexed_db/indexed_db_index_writer.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_index_writer.cc
@@ -7,7 +7,6 @@
 #include <stddef.h>
 #include <utility>
 
-#include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_tracing.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_leveldb_coding.cc b/chromium/content/browser/indexed_db/indexed_db_leveldb_coding.cc
index f36b83d0588..292e86cbd62 100644
--- a/chromium/content/browser/indexed_db/indexed_db_leveldb_coding.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_leveldb_coding.cc
@@ -10,8 +10,9 @@
 #include <utility>
 
 #include "base/big_endian.h"
+#include "base/check_op.h"
 #include "base/containers/span.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/sys_byteorder.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc b/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
index b26cf7bd949..40c0633728a 100644
--- a/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
@@ -6,7 +6,6 @@
 
 #include <utility>
 
-#include "base/logging.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_quota_client.cc b/chromium/content/browser/indexed_db/indexed_db_quota_client.cc
index df6138cb988..f35ae3da5a9 100644
--- a/chromium/content/browser/indexed_db/indexed_db_quota_client.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_quota_client.cc
@@ -10,7 +10,7 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/task/post_task.h"
 #include "base/task_runner_util.h"
 #include "base/threading/sequenced_task_runner_handle.h"
@@ -78,8 +78,8 @@ IndexedDBQuotaClient::IndexedDBQuotaClient(
 
 IndexedDBQuotaClient::~IndexedDBQuotaClient() = default;
 
-QuotaClient::ID IndexedDBQuotaClient::id() const {
-  return kIndexedDatabase;
+storage::QuotaClientType IndexedDBQuotaClient::type() const {
+  return storage::QuotaClientType::kIndexedDatabase;
 }
 
 void IndexedDBQuotaClient::OnQuotaManagerDestroyed() {}
diff --git a/chromium/content/browser/indexed_db/indexed_db_quota_client.h b/chromium/content/browser/indexed_db/indexed_db_quota_client.h
index f1ea7bd76fc..fe85dc97592 100644
--- a/chromium/content/browser/indexed_db/indexed_db_quota_client.h
+++ b/chromium/content/browser/indexed_db/indexed_db_quota_client.h
@@ -13,6 +13,7 @@
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "storage/browser/quota/quota_client.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "storage/browser/quota/quota_task.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 #include "url/origin.h"
@@ -29,7 +30,7 @@ class IndexedDBQuotaClient : public storage::QuotaClient {
       scoped_refptr<IndexedDBContextImpl> indexed_db_context);
 
   // QuotaClient implementation:
-  ID id() const override;
+  storage::QuotaClientType type() const override;
   void OnQuotaManagerDestroyed() override;
   void GetOriginUsage(const url::Origin& origin,
                       blink::mojom::StorageType type,
diff --git a/chromium/content/browser/indexed_db/indexed_db_quota_client_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_quota_client_unittest.cc
index fb0af044e91..4bfeb7cd60d 100644
--- a/chromium/content/browser/indexed_db/indexed_db_quota_client_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_quota_client_unittest.cc
@@ -144,7 +144,7 @@ class IndexedDBQuotaClientTest : public testing::Test {
 
   void SetFileSizeTo(const base::FilePath& path, int size) {
     std::string junk(size, 'a');
-    ASSERT_EQ(size, base::WriteFile(path, junk.c_str(), size));
+    ASSERT_TRUE(base::WriteFile(path, junk));
   }
 
   void AddFakeIndexedDB(const url::Origin& origin, int size) {
diff --git a/chromium/content/browser/indexed_db/indexed_db_transaction.cc b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
index 233d4aa140d..989bdf48470 100644
--- a/chromium/content/browser/indexed_db/indexed_db_transaction.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
@@ -8,10 +8,11 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/sequenced_task_runner_handle.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
index 3de8f6a9c21..11eccda767b 100644
--- a/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
@@ -9,8 +9,8 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check.h"
 #include "base/debug/stack_trace.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/browser/indexed_db/indexed_db_value.cc b/chromium/content/browser/indexed_db/indexed_db_value.cc
index e3d880e67cd..ca9a7f8e938 100644
--- a/chromium/content/browser/indexed_db/indexed_db_value.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_value.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/indexed_db/indexed_db_value.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
 namespace content {
diff --git a/chromium/content/browser/installedapp/installed_app_provider_impl_win.cc b/chromium/content/browser/installedapp/installed_app_provider_impl_win.cc
index cf83b7b244c..7cf00a47278 100644
--- a/chromium/content/browser/installedapp/installed_app_provider_impl_win.cc
+++ b/chromium/content/browser/installedapp/installed_app_provider_impl_win.cc
@@ -37,6 +37,7 @@ using Microsoft::WRL::ComPtr;
 namespace {
 
 constexpr size_t kMaxAllowedRelatedApps = 3;
+constexpr char kWindowsPlatformName[] = "windows";
 
 void OnGetAppUrlHandlers(
     std::vector<blink::mojom::RelatedApplicationPtr> related_apps,
@@ -64,14 +65,18 @@ void OnGetAppUrlHandlers(
     base::string16 app_user_model_id(
         base::win::ScopedHString(app_user_model_id_native).Get());
 
-    for (size_t j = 0;
-         j < std::min(related_apps.size(), kMaxAllowedRelatedApps); ++j) {
+    size_t windows_app_count = 0;
+    for (size_t j = 0; j < related_apps.size(); ++j) {
       auto& related_app = related_apps[j];
-      // v1 supports only 'store' platform name. It doesn't necessarily mean
-      // the app must be installed from the store though.
-      if (related_app->platform != "store")
+
+      // v1 supports only 'windows' platform name.
+      if (related_app->platform != kWindowsPlatformName)
         continue;
 
+      // It iterates only max 3 windows related apps.
+      if (++windows_app_count > kMaxAllowedRelatedApps)
+        break;
+
       if (!related_app->id.has_value())
         continue;
 
diff --git a/chromium/content/browser/isolated_origin_browsertest.cc b/chromium/content/browser/isolated_origin_browsertest.cc
index 923f1e90d86..4854899157f 100644
--- a/chromium/content/browser/isolated_origin_browsertest.cc
+++ b/chromium/content/browser/isolated_origin_browsertest.cc
@@ -14,6 +14,7 @@
 #include "components/network_session_configurator/common/network_switches.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/frame_host/navigator.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -23,6 +24,7 @@
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -32,6 +34,7 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
+#include "content/test/did_commit_navigation_interceptor.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "net/dns/mock_host_resolver.h"
@@ -111,11 +114,13 @@ class IsolatedOriginTest : public IsolatedOriginTestBase {
   DISALLOW_COPY_AND_ASSIGN(IsolatedOriginTest);
 };
 
-class OriginIsolationOptInTest : public IsolatedOriginTestBase {
+// Base class used for server-based origin isolation opt-in tests to handle the
+// server responses and other common infrastructure.
+class OriginIsolationOptInServerTest : public IsolatedOriginTestBase {
  public:
-  OriginIsolationOptInTest()
+  OriginIsolationOptInServerTest()
       : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {}
-  ~OriginIsolationOptInTest() override = default;
+  ~OriginIsolationOptInServerTest() override = default;
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     IsolatedOriginTestBase::SetUpCommandLine(command_line);
@@ -125,14 +130,15 @@ class OriginIsolationOptInTest : public IsolatedOriginTestBase {
     //  --site-per-process isn't the default, such as Android.
     IsolateAllSitesForTesting(command_line);
     command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
-    feature_list_.InitAndEnableFeature(features::kOriginPolicy);
+    feature_list_.InitAndEnableFeature(feature_switch());
   }
 
   void SetUpOnMainThread() override {
     IsolatedOriginTestBase::SetUpOnMainThread();
     https_server()->AddDefaultHandlers(GetTestDataFilePath());
-    https_server()->RegisterRequestHandler(base::BindRepeating(
-        &OriginIsolationOptInTest::HandleResponse, base::Unretained(this)));
+    https_server()->RegisterRequestHandler(
+        base::BindRepeating(&OriginIsolationOptInServerTest::HandleResponse,
+                            base::Unretained(this)));
     ASSERT_TRUE(https_server()->Start());
     host_resolver()->AddRule("*", "127.0.0.1");
     embedded_test_server()->StartAcceptingConnections();
@@ -143,23 +149,57 @@ class OriginIsolationOptInTest : public IsolatedOriginTestBase {
     IsolatedOriginTestBase::TearDownOnMainThread();
   }
 
-  void SetOriginPolicyManifest(const std::string& manifest) {
-    origin_policy_manifest_ = manifest;
-  }
-
   // Need an https server because
   // OriginPolicyThrottle::ShouldRequestOriginPolicy() will return false
   // otherwise.
   net::EmbeddedTestServer* https_server() { return &https_server_; }
 
+  bool ShouldOriginGetOptInIsolation(const url::Origin& origin) {
+    auto* site_instance = static_cast<SiteInstanceImpl*>(
+        shell()->web_contents()->GetMainFrame()->GetSiteInstance());
+
+    return ChildProcessSecurityPolicyImpl::GetInstance()
+        ->ShouldOriginGetOptInIsolation(site_instance->GetIsolationContext(),
+                                        origin);
+  }
+
+ protected:
+  virtual const base::Feature& feature_switch() = 0;
+  virtual std::unique_ptr<net::test_server::HttpResponse> HandleResponse(
+      const net::test_server::HttpRequest& request) = 0;
+
  private:
+  net::EmbeddedTestServer https_server_;
+  base::test::ScopedFeatureList feature_list_;
+
+  DISALLOW_COPY_AND_ASSIGN(OriginIsolationOptInServerTest);
+};
+
+// Tests of opt-in origin isolation which use origin policy as the opt-in
+// mechanism. Most tests for the overall feature are in this class, but see also
+// OriginIsolationOptInHeaderTest for tests that verify headers can be used as
+// an opt-in mechanism as well.
+class OriginIsolationOptInOriginPolicyTest
+    : public OriginIsolationOptInServerTest {
+ public:
+  OriginIsolationOptInOriginPolicyTest() = default;
+
+  void SetOriginPolicyManifest(const std::string& manifest) {
+    origin_policy_manifest_ = manifest;
+  }
+
+ protected:
+  const base::Feature& feature_switch() override {
+    return features::kOriginPolicy;
+  }
+
   std::unique_ptr<net::test_server::HttpResponse> HandleResponse(
-      const net::test_server::HttpRequest& request) {
-    std::unique_ptr<net::test_server::BasicHttpResponse> response =
-        std::make_unique<net::test_server::BasicHttpResponse>();
+      const net::test_server::HttpRequest& request) override {
+    auto response = std::make_unique<net::test_server::BasicHttpResponse>();
 
-    // TODO(wjmaclean): document how this handler works.
-    if (request.relative_url == "/isolate_me") {
+    // Ensures requests to /isolate_origin request that the origin policy be
+    // applied.
+    if (request.relative_url == "/isolate_origin") {
       response->set_code(net::HTTP_OK);
       response->set_content_type("text/html");
       response->AddCustomHeader("Origin-Policy", "allowed=(latest)");
@@ -168,7 +208,7 @@ class OriginIsolationOptInTest : public IsolatedOriginTestBase {
     }
 
     // Intercepts the request to get the origin policy, and injects the policy.
-    // Note: this will only be activated for requests that load "isolate_me"
+    // Note: this will only be activated for requests that load "isolate_origin"
     // above, since only it sets the Origin-Policy header.
     if (request.relative_url == "/.well-known/origin-policy") {
       response->set_code(net::HTTP_OK);
@@ -178,33 +218,103 @@ class OriginIsolationOptInTest : public IsolatedOriginTestBase {
 
     // If we return nullptr, then the server will go ahead and actually serve
     // the file.
-    return std::unique_ptr<net::test_server::HttpResponse>();
+    return nullptr;
   }
 
-  net::EmbeddedTestServer https_server_;
   std::string origin_policy_manifest_;
-  base::test::ScopedFeatureList feature_list_;
 
-  DISALLOW_COPY_AND_ASSIGN(OriginIsolationOptInTest);
+  DISALLOW_COPY_AND_ASSIGN(OriginIsolationOptInOriginPolicyTest);
 };
 
+// Tests that verify headers can be used to opt-in to origin isolation.  See
+// OriginIsolationOptInOriginPolicyTest for most tests of the feature.
+class OriginIsolationOptInHeaderTest : public OriginIsolationOptInServerTest {
+ public:
+  OriginIsolationOptInHeaderTest() = default;
+
+  void SetHeaderValue(const std::string& header_value) {
+    header_ = header_value;
+  }
+
+ protected:
+  const base::Feature& feature_switch() override {
+    return features::kOriginIsolationHeader;
+  }
+
+  std::unique_ptr<net::test_server::HttpResponse> HandleResponse(
+      const net::test_server::HttpRequest& request) override {
+    if (request.relative_url == "/isolate_origin") {
+      auto response = std::make_unique<net::test_server::BasicHttpResponse>();
+      response->set_code(net::HTTP_OK);
+      response->set_content_type("text/html");
+
+      if (header_) {
+        response->AddCustomHeader("Origin-Isolation", *header_);
+      }
+
+      response->set_content("isolate me!");
+      return std::move(response);
+    }
+
+    // If we return nullptr, then the server will go ahead and actually serve
+    // the file.
+    return nullptr;
+  }
+
+  base::Optional<std::string> header_;
+
+  DISALLOW_COPY_AND_ASSIGN(OriginIsolationOptInHeaderTest);
+};
+
+// This tests that origin policy opt-in causes the origin to end up in the
+// isolated origins list.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest, Basic) {
+  SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
+
+  GURL url(https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  url::Origin origin(url::Origin::Create(url));
+
+  EXPECT_FALSE(ShouldOriginGetOptInIsolation(origin));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_TRUE(ShouldOriginGetOptInIsolation(origin));
+}
+
+// This tests that header-based opt-in causes the origin to end up in the
+// isolated origins list.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInHeaderTest, Basic) {
+  SetHeaderValue("?1");
+
+  GURL url(https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  url::Origin origin(url::Origin::Create(url));
+
+  EXPECT_FALSE(ShouldOriginGetOptInIsolation(origin));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_TRUE(ShouldOriginGetOptInIsolation(origin));
+}
+
+// Further tests deep-dive into various scenarios for the isolation opt-ins.
+// They use the origin policy mechanism, under the assumption that it will be
+// the same for the header mechanism since they both trigger the same behavior
+// in ChildProcessSecurityPolicyImpl.
+
 // In this test the sub-origin is isolated because the origin policy requests
 // "isolation". It will have a different site instance than the main frame.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, SimpleSubOriginIsolationTest) {
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       SimpleSubOriginIsolationTest) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
   // Start off with an a(a) page, then navigate the subframe to an isolated sub
   // origin.
   GURL test_url(https_server()->GetURL("foo.com",
                                        "/cross_site_iframe_factory.html?"
                                        "foo.com(foo.com)"));
-  GURL isolated_sub_origin(
-      https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
   EXPECT_TRUE(NavigateToURL(shell(), test_url));
   EXPECT_EQ(2u, shell()->web_contents()->GetAllFrames().size());
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child_frame_node = root->child_at(0);
-  NavigateFrameToURL(child_frame_node, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node, isolated_suborigin_url);
   EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
             child_frame_node->current_frame_host()->GetSiteInstance());
   EXPECT_TRUE(child_frame_node->current_frame_host()
@@ -222,7 +332,7 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, SimpleSubOriginIsolationTest) {
 
 // In this test the sub-origin isn't isolated because the origin policy doesn't
 // request "isolation". It will have the same site instance as the main frame.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
                        SimpleSubOriginNonIsolationTest) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"] })");
   // Start off with an a(a) page, then navigate the subframe to an isolated sub
@@ -230,21 +340,22 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
   GURL test_url(https_server()->GetURL("foo.com",
                                        "/cross_site_iframe_factory.html?"
                                        "foo.com(foo.com)"));
-  GURL isolated_sub_origin(
-      https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
   EXPECT_TRUE(NavigateToURL(shell(), test_url));
   EXPECT_EQ(2u, shell()->web_contents()->GetAllFrames().size());
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child_frame_node = root->child_at(0);
-  NavigateFrameToURL(child_frame_node, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node, isolated_suborigin_url);
   EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
             child_frame_node->current_frame_host()->GetSiteInstance());
 }
 
 // This test verifies that renderer-initiated navigations to/from isolated
 // sub-origins works as expected.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, RendererInitiatedNavigations) {
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       RendererInitiatedNavigations) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
   GURL test_url(https_server()->GetURL("foo.com",
                                        "/cross_site_iframe_factory.html?"
@@ -256,7 +367,7 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, RendererInitiatedNavigations) {
   FrameTreeNode* child = root->child_at(0);
 
   GURL isolated_sub_origin_url(
-      https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
   {
     // Navigate the child to an isolated origin.
     TestFrameNavigationObserver observer(child);
@@ -286,10 +397,12 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, RendererInitiatedNavigations) {
 // both for renderer-initiated and browser-initiated navigations.
 // Note: this test is essentially identical to
 // IsolatedOriginTest.MainFrameNavigation.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, MainFrameNavigation) {
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       MainFrameNavigation) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
   GURL unisolated_url(https_server()->GetURL("www.foo.com", "/title1.html"));
-  GURL isolated_url(https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+  GURL isolated_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
 
   EXPECT_TRUE(NavigateToURL(shell(), unisolated_url));
 
@@ -348,7 +461,7 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, MainFrameNavigation) {
   // Do a renderer-initiated navigation from isolated.foo.com to another
   // isolated origin and ensure there is a different isolated process.
   GURL second_isolated_url(
-      https_server()->GetURL("isolated.bar.com", "/isolate_me"));
+      https_server()->GetURL("isolated.bar.com", "/isolate_origin"));
   EXPECT_TRUE(NavigateToURLFromRenderer(web_contents(), second_isolated_url));
   EXPECT_EQ(https_server()->GetURL("isolated.bar.com", "/"),
             web_contents()->GetSiteInstance()->GetSiteURL());
@@ -359,7 +472,7 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, MainFrameNavigation) {
 // This test ensures that if an origin starts off being isolated in a
 // BrowsingInstance, it continues that way within the BrowsingInstance, even
 // if a new policy is received that removes the opt-in request.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
                        OriginIsolationStateRetainedForBrowsingInstance) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
   // Start off with an a(a,a) page, then navigate the subframe to an isolated
@@ -367,8 +480,8 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
   GURL test_url(https_server()->GetURL("foo.com",
                                        "/cross_site_iframe_factory.html?"
                                        "foo.com(foo.com, foo.com)"));
-  GURL isolated_sub_origin(
-      https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
   EXPECT_TRUE(NavigateToURL(shell(), test_url));
   EXPECT_EQ(3u, shell()->web_contents()->GetAllFrames().size());
 
@@ -376,14 +489,14 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
   FrameTreeNode* child_frame_node0 = root->child_at(0);
   FrameTreeNode* child_frame_node1 = root->child_at(1);
 
-  NavigateFrameToURL(child_frame_node0, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node0, isolated_suborigin_url);
   EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
             child_frame_node0->current_frame_host()->GetSiteInstance());
 
   // Change OriginPolicy manifest to stop isolating the sub-origin. It should
   // still be isolated, to remain consistent with the other frame.
   SetOriginPolicyManifest(R"({ })");
-  NavigateFrameToURL(child_frame_node1, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node1, isolated_suborigin_url);
   EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
             child_frame_node1->current_frame_host()->GetSiteInstance());
 
@@ -391,29 +504,26 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest,
   EXPECT_EQ(child_frame_node0->current_frame_host()->GetSiteInstance(),
             child_frame_node1->current_frame_host()->GetSiteInstance());
 
-  // Make sure the master opt-in list no longer has the origin listed.
+  // Make sure the master opt-in list still has the origin tracked.
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
-  EXPECT_FALSE(policy->DoesOriginRequestOptInIsolation(
-      IsolationContext(shell()->web_contents()->GetBrowserContext()),
-      url::Origin::Create(isolated_sub_origin)));
+  EXPECT_TRUE(policy->HasOriginEverRequestedOptInIsolation(
+      url::Origin::Create(isolated_suborigin_url)));
 }
 
 // This test ensures that if an origin starts off not being isolated in a
 // BrowsingInstance, it continues that way within the BrowsingInstance, even
 // if a new opt-in policy is received.
-// TODO(wjmaclean): Re-enable this once we support tracking non-opted-in
-// origins.
-IN_PROC_BROWSER_TEST_F(
-    OriginIsolationOptInTest,
-    DISABLED_OriginNonIsolationStateRetainedForBrowsingInstance) {
+// Case #1 where the non-opted-in origin is currently in the frame tree.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       OriginNonIsolationStateRetainedForBrowsingInstance1) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"] })");
   // Start off with an a(a,a) page, then navigate the subframe to an isolated
   // sub origin.
   GURL test_url(https_server()->GetURL("foo.com",
                                        "/cross_site_iframe_factory.html?"
                                        "foo.com(foo.com, foo.com)"));
-  GURL isolated_sub_origin(
-      https_server()->GetURL("isolated.foo.com", "/isolate_me"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
   EXPECT_TRUE(NavigateToURL(shell(), test_url));
   EXPECT_EQ(3u, shell()->web_contents()->GetAllFrames().size());
 
@@ -421,22 +531,119 @@ IN_PROC_BROWSER_TEST_F(
   FrameTreeNode* child_frame_node0 = root->child_at(0);
   FrameTreeNode* child_frame_node1 = root->child_at(1);
 
-  NavigateFrameToURL(child_frame_node0, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node0, isolated_suborigin_url);
   EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
             child_frame_node0->current_frame_host()->GetSiteInstance());
 
   // Change OriginPolicy manifest to start isolating the sub-origin. It should
-  // still be isolated, to remain consistent with the other frame.
+  // still be not-isolated, to remain consistent with the other frame.
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
-  NavigateFrameToURL(child_frame_node1, isolated_sub_origin);
+  NavigateFrameToURL(child_frame_node1, isolated_suborigin_url);
   EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
             child_frame_node1->current_frame_host()->GetSiteInstance());
 
   // Make sure the master opt-in list has the origin listed.
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
-  EXPECT_TRUE(policy->DoesOriginRequestOptInIsolation(
-      IsolationContext(shell()->web_contents()->GetBrowserContext()),
-      url::Origin::Create(isolated_sub_origin)));
+  EXPECT_TRUE(policy->HasOriginEverRequestedOptInIsolation(
+      url::Origin::Create(isolated_suborigin_url)));
+}
+
+// This test ensures that if an origin starts off not being isolated in a
+// BrowsingInstance, it continues that way within the BrowsingInstance, even
+// if a new opt-in policy is received.
+// Case #2 where the non-opted-in origin is currently not in the frame tree.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       OriginNonIsolationStateRetainedForBrowsingInstance2) {
+  SetOriginPolicyManifest(R"({ "ids": ["my-policy"] })");
+  // Start off with an a(a) page, then navigate the subframe to an isolated sub
+  // origin.
+  GURL test_url(https_server()->GetURL("foo.com",
+                                       "/cross_site_iframe_factory.html?"
+                                       "foo.com(foo.com)"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  EXPECT_EQ(2u, shell()->web_contents()->GetAllFrames().size());
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  FrameTreeNode* child_frame_node0 = root->child_at(0);
+
+  // Even though we're navigating to isolated.foo.com, there's no manifest
+  // requesting opt-in, so it should end up in the same SiteInstance as the
+  // main frame.
+  NavigateFrameToURL(child_frame_node0, isolated_suborigin_url);
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            child_frame_node0->current_frame_host()->GetSiteInstance());
+
+  // This navigation removes isolated_suborigin_url from the frame tree, but it
+  // should still be in the session history.
+  NavigateFrameToURL(child_frame_node0,
+                     https_server()->GetURL("foo.com", "/title1.html"));
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            child_frame_node0->current_frame_host()->GetSiteInstance());
+
+  // Change OriginPolicy manifest to start isolating the sub-origin. It should
+  // still be not isolated, to remain consistent with the other frame.
+  SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
+  NavigateFrameToURL(child_frame_node0, isolated_suborigin_url);
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            child_frame_node0->current_frame_host()->GetSiteInstance());
+
+  // Make sure the master opt-in list has the origin listed.
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  EXPECT_TRUE(policy->HasOriginEverRequestedOptInIsolation(
+      url::Origin::Create(isolated_suborigin_url)));
+
+  // Make sure the current browsing instance does *not* isolate the origin.
+  EXPECT_FALSE(policy->ShouldOriginGetOptInIsolation(
+      root->current_frame_host()->GetSiteInstance()->GetIsolationContext(),
+      url::Origin::Create(isolated_suborigin_url)));
+}
+
+// This test makes sure that a different tab in the same BrowsingInstance where
+// an origin originally did not opt-in respects that state even if the
+// OriginPolicy changes.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       OriginNonIsolationStateRetainedForPopup) {
+  SetOriginPolicyManifest(R"({ })");
+  // Start off with an a(a,a) page, then navigate the subframe to an isolated
+  // sub origin.
+  GURL test_url(https_server()->GetURL("foo.com",
+                                       "/cross_site_iframe_factory.html?"
+                                       "foo.com(foo.com)"));
+  GURL isolated_suborigin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  EXPECT_EQ(2u, shell()->web_contents()->GetAllFrames().size());
+
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  FrameTreeNode* child_frame_node0 = root->child_at(0);
+
+  NavigateFrameToURL(child_frame_node0, isolated_suborigin_url);
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            child_frame_node0->current_frame_host()->GetSiteInstance());
+
+  // Change OriginPolicy manifest to start isolating the sub-origin. It should
+  // still be isolated, to remain consistent with the other frame.
+  SetOriginPolicyManifest(R"({ "isolation": true })");
+
+  // Open a popup in the same browsing instance, and navigate it to the
+  // not-opted-in origin. Even though the manifest now requests isolation, it
+  // should not opt-in since it's in the same BrowsingInstance where it
+  // originally wasn't opted in.
+  Shell* popup = OpenPopup(shell(), isolated_suborigin_url, "foo");
+  auto* popup_web_contents = popup->web_contents();
+  EXPECT_TRUE(
+      NavigateToURLFromRenderer(popup_web_contents, isolated_suborigin_url));
+
+  EXPECT_EQ(shell()->web_contents()->GetSiteInstance()->GetBrowsingInstanceId(),
+            popup_web_contents->GetSiteInstance()->GetBrowsingInstanceId());
+
+  // Make sure the current browsing instance does *not* isolate the origin.
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  EXPECT_FALSE(policy->ShouldOriginGetOptInIsolation(
+      root->current_frame_host()->GetSiteInstance()->GetIsolationContext(),
+      url::Origin::Create(isolated_suborigin_url)));
 }
 
 // This test handles the case where the base origin is isolated, but a
@@ -445,7 +652,8 @@ IN_PROC_BROWSER_TEST_F(
 // TODO(wjmaclean): Modify this to verify that the sub-origin is placed into the
 // site-keyed SiteInstance corresponding to the base-origin, and not the
 // origin-keyed SiteInstance the base origin is assigned to.
-IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, IsolatedBaseOrigin) {
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       IsolatedBaseOrigin) {
   SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
   // Start off with an isolated base-origin in an a(a) configuration, then
   // navigate the subframe to a sub-origin no requesting isolation.
@@ -459,19 +667,281 @@ IN_PROC_BROWSER_TEST_F(OriginIsolationOptInTest, IsolatedBaseOrigin) {
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child_frame_node = root->child_at(0);
   NavigateFrameToURL(child_frame_node, non_isolated_sub_origin);
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  EXPECT_TRUE(policy->ShouldOriginGetOptInIsolation(
+      root->current_frame_host()->GetSiteInstance()->GetIsolationContext(),
+      url::Origin::Create(test_url)));
   EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
             child_frame_node->current_frame_host()->GetSiteInstance());
   // Make sure the master opt-in list has both the base origin and the sub
   // origin both isolated.
-  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
-  EXPECT_TRUE(policy->DoesOriginRequestOptInIsolation(
-      IsolationContext(shell()->web_contents()->GetBrowserContext()),
+  EXPECT_TRUE(policy->HasOriginEverRequestedOptInIsolation(
       url::Origin::Create(test_url)));
-  EXPECT_FALSE(policy->DoesOriginRequestOptInIsolation(
-      IsolationContext(shell()->web_contents()->GetBrowserContext()),
+  EXPECT_FALSE(policy->HasOriginEverRequestedOptInIsolation(
       url::Origin::Create(non_isolated_sub_origin)));
 }
 
+// This test creates a scenario where we have a frame without a
+// FrameNavigationEntry, and then we created another frame with the same origin
+// that opts-in to isolation. The opt-in triggers a walk of the session history
+// and the frame tree ... the session history won't pick up the first frame, but
+// the frame-tree walk should.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest, FrameTreeTest) {
+  EXPECT_TRUE(NavigateToURL(shell(),
+                            https_server()->GetURL("bar.com", "/title1.html")));
+  // Have tab1 call window.open() to create blank tab2.
+  FrameTreeNode* tab1_root = web_contents()->GetFrameTree()->root();
+  ShellAddedObserver new_shell_observer;
+  ASSERT_TRUE(ExecuteScript(tab1_root->current_frame_host(),
+                            "window.w = window.open()"));
+  Shell* tab2_shell = new_shell_observer.GetShell();
+
+  // Create iframe in tab2.
+  FrameTreeNode* tab2_root =
+      static_cast<WebContentsImpl*>(tab2_shell->web_contents())
+          ->GetFrameTree()
+          ->root();
+  ASSERT_TRUE(ExecuteScript(tab2_root->current_frame_host(),
+                            "var iframe = document.createElement('iframe');"
+                            "document.body.appendChild(iframe);"));
+  EXPECT_EQ(1U, tab2_root->child_count());
+  FrameTreeNode* tab2_child = tab2_root->child_at(0);
+  GURL isolated_origin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  // The subframe won't be isolated.
+  EXPECT_TRUE(NavigateFrameToURL(tab2_child, isolated_origin_url));
+
+  // Do a browser-initiated navigation of tab1 to the same origin, but isolate
+  // it this time. This should place the two frames with |isolated_origin_url|
+  // into different BrowsingInstances.
+  SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
+  EXPECT_TRUE(NavigateToURL(shell(), isolated_origin_url));
+
+  // Since the same origin exists in two tabs, but one is isolated and the other
+  // isn't, we expect them to be in different BrowsingInstances.
+  using ScopedOriginIsolationOptInRequest =
+      ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest;
+
+  EXPECT_NE(tab1_root->current_frame_host()->GetSiteInstance(),
+            tab2_child->current_frame_host()->GetSiteInstance());
+  EXPECT_NE(tab1_root->current_frame_host()
+                ->GetSiteInstance()
+                ->GetIsolationContext()
+                .browsing_instance_id(),
+            tab2_child->current_frame_host()
+                ->GetSiteInstance()
+                ->GetIsolationContext()
+                .browsing_instance_id());
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  url::Origin isolated_origin = url::Origin::Create(isolated_origin_url);
+  {
+    // Verify that |isolated origin| is in the non-opt-in list for tab2's
+    // child's BrowsingInstance. We do this by requesting opt-in for the origin,
+    // then verifying that it is denied by DoesOriginRequestOptInIsolation.
+    std::unique_ptr<ScopedOriginIsolationOptInRequest> scoped_request =
+        ScopedOriginIsolationOptInRequest::GetScopedOriginIsolationOptInRequest(
+            isolated_origin);
+
+    EXPECT_FALSE(
+        policy->ShouldOriginGetOptInIsolation(tab2_child->current_frame_host()
+                                                  ->GetSiteInstance()
+                                                  ->GetIsolationContext(),
+                                              isolated_origin));
+  }
+  // Verify that |isolated_origin| in tab1 is indeed isolated.
+  EXPECT_TRUE(policy->ShouldOriginGetOptInIsolation(
+      tab1_root->current_frame_host()->GetSiteInstance()->GetIsolationContext(),
+      isolated_origin));
+  // Verify that the tab2 child frame has no FrameNavigationEntry.
+  // TODO(wjmaclean): when https://crbug.com/524208 is fixed, this next check
+  // will fail, and it should be removed with the CL that fixes 524208.
+  EXPECT_EQ(
+      nullptr,
+      tab2_shell->web_contents()->GetController().GetLastCommittedEntry());
+
+  // Now, create a second frame in tab2 and navigate it to
+  // |isolated_origin_url|. Even though isolation is requested, it should not
+  // be isolated.
+  ASSERT_TRUE(ExecuteScript(tab2_root->current_frame_host(),
+                            "var iframe = document.createElement('iframe');"
+                            "document.body.appendChild(iframe);"));
+  EXPECT_EQ(2U, tab2_root->child_count());
+  FrameTreeNode* tab2_child2 = tab2_root->child_at(1);
+  NavigateFrameToURL(tab2_child2, isolated_origin_url);
+  EXPECT_EQ(tab2_child->current_frame_host()->GetSiteInstance(),
+            tab2_child2->current_frame_host()->GetSiteInstance());
+
+  // Check that the two child frames can script each other.
+  EXPECT_TRUE(ExecuteScript(tab2_child2, R"(
+      parent.frames[0].cross_frame_property_test = 'hello from t2c2'; )"));
+  std::string message;
+  EXPECT_TRUE(ExecuteScriptAndExtractString(
+      tab2_child,
+      "domAutomationController.send(window.cross_frame_property_test);",
+      &message));
+  EXPECT_EQ("hello from t2c2", message);
+}
+
+// Similar to FrameTreeTest, but we stop the navigation that's not requesting
+// isolation at the pending commit state in tab2, then verify that the FrameTree
+// walk has correctly registered the origin as non-isolated in tab2, but
+// isolated in tab1.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       FrameTreeTestPendingCommit) {
+  GURL isolated_origin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+  TestNavigationManager non_isolated_delayer(shell()->web_contents(),
+                                             isolated_origin_url);
+  shell()->web_contents()->GetController().LoadURL(
+      isolated_origin_url, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  EXPECT_TRUE(non_isolated_delayer.WaitForResponse());
+
+  Shell* tab2 = CreateBrowser();
+  // Do a browser-initiated navigation of tab2 to the same origin, but isolate
+  // it this time. This should place the two frames with |isolated_origin_url|
+  // into different BrowsingInstances.
+  SetOriginPolicyManifest(R"({ "ids": ["my-policy"], "isolation": true })");
+  EXPECT_TRUE(NavigateToURL(tab2, isolated_origin_url));
+
+  // Now commit the non-isolated navigation.
+  non_isolated_delayer.WaitForNavigationFinished();
+
+  FrameTreeNode* tab1_root = web_contents()->GetFrameTree()->root();
+  SiteInstanceImpl* tab1_site_instance =
+      tab1_root->current_frame_host()->GetSiteInstance();
+  FrameTreeNode* tab2_root = static_cast<WebContentsImpl*>(tab2->web_contents())
+                                 ->GetFrameTree()
+                                 ->root();
+  SiteInstanceImpl* tab2_site_instance =
+      tab2_root->current_frame_host()->GetSiteInstance();
+  EXPECT_NE(tab1_site_instance, tab2_site_instance);
+  EXPECT_NE(tab1_site_instance->GetIsolationContext().browsing_instance_id(),
+            tab2_site_instance->GetIsolationContext().browsing_instance_id());
+
+  // Despite the non-isolated navigation only being at pending-commit when we
+  // got the response for the isolated navigation, it should be properly
+  // registered as non-isolated in its browsing instance.
+  using ScopedOriginIsolationOptInRequest =
+      ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest;
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  url::Origin isolated_origin = url::Origin::Create(isolated_origin_url);
+  {
+    // Verify that |isolated origin| is in the non-opt-in list for tab1's
+    // BrowsingInstance. We do this by requesting opt-in for the origin, then
+    // verifying that it is denied by ShouldOriginGetOptInIsolation.
+    std::unique_ptr<ScopedOriginIsolationOptInRequest> scoped_request =
+        ScopedOriginIsolationOptInRequest::GetScopedOriginIsolationOptInRequest(
+            isolated_origin);
+
+    EXPECT_FALSE(policy->ShouldOriginGetOptInIsolation(
+        tab1_site_instance->GetIsolationContext(), isolated_origin));
+  }
+  // Verify that |isolated_origin| in tab2 is indeed isolated.
+  EXPECT_TRUE(policy->ShouldOriginGetOptInIsolation(
+      tab2_site_instance->GetIsolationContext(), isolated_origin));
+}
+
+// Helper class to navigate a second tab to a specified URL that requests opt-in
+// origin isolation just before the first tab processes the next
+// DidCommitProvisionalLoad message.
+class InjectIsolationRequestingNavigation
+    : public DidCommitNavigationInterceptor {
+ public:
+  InjectIsolationRequestingNavigation(
+      OriginIsolationOptInOriginPolicyTest* test_framework,
+      WebContents* tab1_web_contents,
+      Shell* tab2,
+      const GURL& url)
+      : DidCommitNavigationInterceptor(tab1_web_contents),
+        test_framework_(test_framework),
+        tab2_(tab2),
+        url_(url) {}
+
+  bool was_called() { return was_called_; }
+
+ private:
+  // DidCommitNavigationInterceptor implementation.
+  bool WillProcessDidCommitNavigation(
+      RenderFrameHost* render_frame_host,
+      NavigationRequest* navigation_request,
+      ::FrameHostMsg_DidCommitProvisionalLoad_Params* params,
+      mojom::DidCommitProvisionalLoadInterfaceParamsPtr* interface_params)
+      override {
+    was_called_ = true;
+
+    // Performa a navigation of |tab2_| to |url_|. |url_| should request
+    // isolation.
+    test_framework_->SetOriginPolicyManifest(
+        R"({ "ids": ["my-policy"], "isolation": true })");
+    EXPECT_TRUE(NavigateToURL(tab2_, url_));
+
+    return true;
+  }
+
+  OriginIsolationOptInOriginPolicyTest* test_framework_;
+  Shell* tab2_;
+  const GURL& url_;
+  bool was_called_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(InjectIsolationRequestingNavigation);
+};
+
+// This test is similar to the one above, but exercises the pending navigation
+// when it's at a different stage, namely between the CommitNavigation and
+// DidCommitProvisionalLoad, rather than at WillProcessResponse.
+IN_PROC_BROWSER_TEST_F(OriginIsolationOptInOriginPolicyTest,
+                       FrameTreeTestBeforeDidCommit) {
+  GURL isolated_origin_url(
+      https_server()->GetURL("isolated.foo.com", "/isolate_origin"));
+
+  FrameTreeNode* tab1_root = web_contents()->GetFrameTree()->root();
+  // We use the following, slightly more verbose, code instead of
+  // CreateBrowser() in order to avoid issues with NavigateToURL() in
+  // InjectIsolationRequestingNavigation::WillProcessDidCommitNavigation()
+  // getting stuck when it calls for WaitForLoadStop internally.
+  Shell* tab2 =
+      Shell::CreateNewWindow(shell()->web_contents()->GetBrowserContext(),
+                             GURL(), nullptr, gfx::Size());
+
+  InjectIsolationRequestingNavigation injector(this, web_contents(), tab2,
+                                               isolated_origin_url);
+  EXPECT_TRUE(NavigateToURL(shell(), isolated_origin_url));
+  EXPECT_TRUE(injector.was_called());
+
+  SiteInstanceImpl* tab1_site_instance =
+      tab1_root->current_frame_host()->GetSiteInstance();
+  FrameTreeNode* tab2_root = static_cast<WebContentsImpl*>(tab2->web_contents())
+                                 ->GetFrameTree()
+                                 ->root();
+  SiteInstanceImpl* tab2_site_instance =
+      tab2_root->current_frame_host()->GetSiteInstance();
+  EXPECT_NE(tab1_site_instance, tab2_site_instance);
+  EXPECT_NE(tab1_site_instance->GetIsolationContext().browsing_instance_id(),
+            tab2_site_instance->GetIsolationContext().browsing_instance_id());
+
+  // Despite the non-isolated navigation only being at pending-commit when we
+  // got the response for the isolated navigation, it should be properly
+  // registered as non-isolated in its browsing instance.
+  using ScopedOriginIsolationOptInRequest =
+      ChildProcessSecurityPolicyImpl::ScopedOriginIsolationOptInRequest;
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  url::Origin isolated_origin = url::Origin::Create(isolated_origin_url);
+  {
+    // Verify that |isolated origin| is in the non-opt-in list for tab1's
+    // BrowsingInstance. We do this by requesting opt-in for the origin, then
+    // verifying that it is denied by DoesOriginRequestOptInIsolation.
+    std::unique_ptr<ScopedOriginIsolationOptInRequest> scoped_request =
+        ScopedOriginIsolationOptInRequest::GetScopedOriginIsolationOptInRequest(
+            isolated_origin);
+
+    EXPECT_FALSE(policy->ShouldOriginGetOptInIsolation(
+        tab1_site_instance->GetIsolationContext(), isolated_origin));
+  }
+  // Verify that |isolated_origin| in tab2 is indeed isolated.
+  EXPECT_TRUE(policy->ShouldOriginGetOptInIsolation(
+      tab2_site_instance->GetIsolationContext(), isolated_origin));
+}
+
 class StrictOriginIsolationTest : public IsolatedOriginTestBase {
  public:
   StrictOriginIsolationTest() {}
diff --git a/chromium/content/browser/isolated_origin_util.cc b/chromium/content/browser/isolated_origin_util.cc
index 5948444056d..48dd0d18ccf 100644
--- a/chromium/content/browser/isolated_origin_util.cc
+++ b/chromium/content/browser/isolated_origin_util.cc
@@ -6,6 +6,7 @@
 
 #include "content/browser/isolated_origin_util.h"
 
+#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
 #include "url/gurl.h"
diff --git a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
index 976d92098ef..6426c9a3ef5 100644
--- a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
+++ b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
@@ -9,8 +9,8 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check.h"
 #include "base/containers/flat_set.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/optional.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
diff --git a/chromium/content/browser/keyboard_lock_browsertest.cc b/chromium/content/browser/keyboard_lock_browsertest.cc
index 9c499a8f22a..da432907f2a 100644
--- a/chromium/content/browser/keyboard_lock_browsertest.cc
+++ b/chromium/content/browser/keyboard_lock_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/loader/cached_navigation_url_loader.cc b/chromium/content/browser/loader/cached_navigation_url_loader.cc
index ef98daa31d2..54c58fdb6ba 100644
--- a/chromium/content/browser/loader/cached_navigation_url_loader.cc
+++ b/chromium/content/browser/loader/cached_navigation_url_loader.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
+#include "services/network/public/mojom/parsed_headers.mojom.h"
 
 namespace content {
 
@@ -35,9 +36,10 @@ CachedNavigationURLLoader::CachedNavigationURLLoader(
 void CachedNavigationURLLoader::OnResponseStarted() {
   GlobalRequestID global_id = GlobalRequestID::MakeBrowserInitiated();
 
+  auto response_head = network::mojom::URLResponseHead::New();
+  response_head->parsed_headers = network::mojom::ParsedHeaders::New();
   delegate_->OnResponseStarted(
-      /*url_loader_client_endpoints=*/nullptr,
-      network::mojom::URLResponseHead::New(),
+      /*url_loader_client_endpoints=*/nullptr, std::move(response_head),
       /*response_body=*/mojo::ScopedDataPipeConsumerHandle(), global_id,
       /*is_download=*/false, NavigationDownloadPolicy(), base::nullopt);
 }
@@ -54,6 +56,7 @@ std::unique_ptr<NavigationURLLoader> CachedNavigationURLLoader::Create(
 void CachedNavigationURLLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     PreviewsState new_previews_state) {
   NOTREACHED();
 }
diff --git a/chromium/content/browser/loader/cached_navigation_url_loader.h b/chromium/content/browser/loader/cached_navigation_url_loader.h
index 72005987f8e..65bd30d0d18 100644
--- a/chromium/content/browser/loader/cached_navigation_url_loader.h
+++ b/chromium/content/browser/loader/cached_navigation_url_loader.h
@@ -24,9 +24,11 @@ class CachedNavigationURLLoader : public NavigationURLLoader {
       NavigationURLLoaderDelegate* delegate);
 
   // NavigationURLLoader implementation.
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      PreviewsState new_previews_state) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      PreviewsState new_previews_state) override;
 
  private:
   void OnResponseStarted();
diff --git a/chromium/content/browser/loader/cors_file_origin_browsertest.cc b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
index 0ef4ef5ea69..222759c2b14 100644
--- a/chromium/content/browser/loader/cors_file_origin_browsertest.cc
+++ b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
@@ -19,6 +19,7 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -99,13 +100,16 @@ class CorsFileOriginBrowserTest : public ContentBrowserTest {
   }
 
  private:
-  bool AllowFileAccessFromFiles() override { return false; }
+  virtual bool AllowFileAccessFromFiles() const { return false; }
   virtual bool IsWebSecurityEnabled() const { return true; }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     if (!IsWebSecurityEnabled()) {
       command_line->AppendSwitch(switches::kDisableWebSecurity);
     }
+    if (AllowFileAccessFromFiles()) {
+      command_line->AppendSwitch(switches::kAllowFileAccessFromFiles);
+    }
 
     ContentBrowserTest::SetUpCommandLine(command_line);
   }
@@ -179,7 +183,7 @@ class CorsFileOriginBrowserTest : public ContentBrowserTest {
 class CorsFileOriginBrowserTestWithAllowFileAccessFromFiles
     : public CorsFileOriginBrowserTest {
  private:
-  bool AllowFileAccessFromFiles() override { return true; }
+  bool AllowFileAccessFromFiles() const override { return true; }
 };
 
 // Tests end to end Origin header and CORS check behaviors with
@@ -187,7 +191,6 @@ class CorsFileOriginBrowserTestWithAllowFileAccessFromFiles
 class CorsFileOriginBrowserTestWithDisableWebSecurity
     : public CorsFileOriginBrowserTest {
  private:
-  bool AllowFileAccessFromFiles() override { return false; }
   bool IsWebSecurityEnabled() const override { return false; }
 };
 
diff --git a/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc b/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
index 28310a47cea..eaeb6560231 100644
--- a/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
+++ b/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
@@ -10,6 +10,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "base/thread_annotations.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc b/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
index f2f51b6604c..3b4298fff67 100644
--- a/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
+++ b/chromium/content/browser/loader/cross_origin_read_blocking_checker.cc
@@ -104,10 +104,10 @@ CrossOriginReadBlockingChecker::CrossOriginReadBlockingChecker(
   network::CrossOriginReadBlocking::LogAction(
       network::CrossOriginReadBlocking::Action::kResponseStarted);
 
-  // |isolated_world_origin| and |network| are only used for UMA and Rappor
-  // logging related to the OOR-CORS feature.  Since OOR-CORS is not used in
-  // scenarios relevant to CrossOriginReadBlockingChecker, we can just use
-  // |base::nullopt| and |nullptr| here.
+  // |isolated_world_origin| and |network_service_client| are only used for UMA
+  // and UKM logging related to the OOR-CORS feature.  Since OOR-CORS is not
+  // used in scenarios relevant to CrossOriginReadBlockingChecker, we can just
+  // use |base::nullopt| and |nullptr| here.
   const base::Optional<url::Origin> isolated_world_origin = base::nullopt;
   constexpr network::mojom::NetworkServiceClient* network_service_client =
       nullptr;
diff --git a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
index 526053c88fb..7e630c8000f 100644
--- a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
+++ b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
@@ -31,6 +31,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -773,7 +774,9 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, BackToAboutBlank) {
   }
 }
 
-IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, BlockForVariousTargets) {
+// Test is flaky on Android, see crbug.com/1075663
+IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
+                       DISABLED_BlockForVariousTargets) {
   // This webpage loads a cross-site HTML page in different targets such as
   // <img>,<link>,<embed>, etc. Since the requested document is blocked, and one
   // character string (' ') is returned instead, this tests that the renderer
diff --git a/chromium/content/browser/loader/file_url_loader_factory.cc b/chromium/content/browser/loader/file_url_loader_factory.cc
index 3108484a4cd..c550b8b5060 100644
--- a/chromium/content/browser/loader/file_url_loader_factory.cc
+++ b/chromium/content/browser/loader/file_url_loader_factory.cc
@@ -149,22 +149,6 @@ MojoResult ConvertNetErrorToMojoResult(net::Error net_error) {
   }
 }
 
-network::mojom::FetchResponseType CalculateResponseType(
-    network::mojom::RequestMode mode,
-    bool is_allowed_access) {
-  // Though file:// is out of web standards, let's roughly follow the step 5 of
-  // https://fetch.spec.whatwg.org/#main-fetch.
-  if (is_allowed_access || mode == network::mojom::RequestMode::kNavigate ||
-      mode == network::mojom::RequestMode::kSameOrigin) {
-    return network::mojom::FetchResponseType::kBasic;
-  } else if (mode == network::mojom::RequestMode::kNoCors) {
-    return network::mojom::FetchResponseType::kOpaque;
-  } else {
-    DCHECK(network::cors::IsCorsEnabledRequestMode(mode)) << mode;
-    return network::mojom::FetchResponseType::kCors;
-  }
-}
-
 class FileURLDirectoryLoader
     : public network::mojom::URLLoader,
       public net::DirectoryLister::DirectoryListerDelegate {
@@ -187,9 +171,11 @@ class FileURLDirectoryLoader
   }
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {}
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}
@@ -404,9 +390,11 @@ class FileURLLoader : public network::mojom::URLLoader {
   }
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {
     // |removed_headers| and |modified_headers| are unused. It doesn't make
     // sense for files. The FileURLLoader can redirect only to another file.
     std::unique_ptr<RedirectData> redirect_data = std::move(redirect_data_);
@@ -688,9 +676,8 @@ class FileURLLoader : public network::mojom::URLLoader {
       head->did_mime_sniff = true;
     }
     if (head->headers) {
-      head->headers->AddHeader(
-          base::StringPrintf("%s: %s", net::HttpRequestHeaders::kContentType,
-                             head->mime_type.c_str()));
+      head->headers->AddHeader(net::HttpRequestHeaders::kContentType,
+                               head->mime_type);
     }
     client_->OnReceiveResponse(std::move(head));
     client_->OnStartLoadingResponseBody(std::move(pipe.consumer_handle));
@@ -838,7 +825,7 @@ void FileURLLoaderFactory::CreateLoaderAndStart(
   // check that takes --allow-file-access-from-files into account.
   // CORS is not available for the file scheme, but can be exceptionally
   // permitted by the access lists.
-  bool is_allowed_access =
+  bool is_request_considered_same_origin =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableWebSecurity) ||
       (request.request_initiator &&
@@ -850,7 +837,8 @@ void FileURLLoaderFactory::CreateLoaderAndStart(
              network::cors::OriginAccessList::AccessState::kAllowed)));
 
   network::mojom::FetchResponseType response_type =
-      CalculateResponseType(request.mode, is_allowed_access);
+      network::cors::CalculateResponseType(request.mode,
+                                           is_request_considered_same_origin);
 
   CreateLoaderAndStartInternal(request, response_type, std::move(loader),
                                std::move(client));
diff --git a/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
index 6a833a4c4b3..ab2a755ec1e 100644
--- a/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
+++ b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
@@ -5,6 +5,7 @@
 // This must be before Windows headers
 #include "base/bind_helpers.h"
 #include "build/build_config.h"
+#include "content/public/test/browser_test.h"
 
 #if defined(OS_WIN)
 #include <objbase.h>
diff --git a/chromium/content/browser/loader/loader_browsertest.cc b/chromium/content/browser/loader/loader_browsertest.cc
index 099766845bb..f82d19ea842 100644
--- a/chromium/content/browser/loader/loader_browsertest.cc
+++ b/chromium/content/browser/loader/loader_browsertest.cc
@@ -8,6 +8,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/command_line.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
@@ -29,6 +30,7 @@
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -103,6 +105,12 @@ class LoaderBrowserTest : public ContentBrowserTest,
   bool got_downloads() const { return got_downloads_; }
 
  private:
+  void SetUp() override {
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        "cors_exempt_header_list", "ExemptFoo");
+    ContentBrowserTest::SetUp();
+  }
+
   bool got_downloads_;
 };
 
@@ -1117,7 +1125,8 @@ class URLModifyingThrottle : public blink::URLLoaderThrottle {
     GURL::Replacements replacements;
     replacements.SetQueryStr("foo=bar");
     request->url = request->url.ReplaceComponents(replacements);
-    request->headers.SetHeader("Foo", "Bar");
+    request->headers.SetHeader("Foo", "BarRequest");
+    request->cors_exempt_headers.SetHeader("ExemptFoo", "ExemptBarRequest");
   }
 
   void WillRedirectRequest(
@@ -1125,11 +1134,14 @@ class URLModifyingThrottle : public blink::URLLoaderThrottle {
       const network::mojom::URLResponseHead& response_head,
       bool* defer,
       std::vector<std::string>* to_be_removed_request_headers,
-      net::HttpRequestHeaders* modified_request_headers) override {
+      net::HttpRequestHeaders* modified_request_headers,
+      net::HttpRequestHeaders* modified_cors_exempt_request_headers) override {
     if (!modify_redirect_)
       return;
 
-    modified_request_headers->SetHeader("Foo", "Bar");
+    modified_request_headers->SetHeader("Foo", "BarRedirect");
+    modified_cors_exempt_request_headers->SetHeader("ExemptFoo",
+                                                    "ExemptBarRedirect");
 
     if (modified_redirect_url_)
       return;  // Only need to do this once.
@@ -1206,7 +1218,8 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, URLLoaderThrottleStartModify) {
   {
     base::AutoLock auto_lock(lock);
     ASSERT_TRUE(urls_requested.find(expected_url) != urls_requested.end());
-    ASSERT_TRUE(header_map[expected_url]["Foo"] == "Bar");
+    ASSERT_TRUE(header_map[expected_url]["Foo"] == "BarRequest");
+    ASSERT_TRUE(header_map[expected_url]["ExemptFoo"] == "ExemptBarRequest");
   }
 
   SetBrowserClientForTesting(old_content_browser_client);
@@ -1240,7 +1253,8 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, URLLoaderThrottleRedirectModify) {
 
   {
     base::AutoLock auto_lock(lock);
-    ASSERT_EQ(header_map[expected_url]["Foo"], "Bar");
+    ASSERT_EQ(header_map[expected_url]["Foo"], "BarRedirect");
+    ASSERT_EQ(header_map[expected_url]["ExemptFoo"], "ExemptBarRedirect");
     ASSERT_NE(urls_requested.find(expected_url), urls_requested.end());
   }
 
diff --git a/chromium/content/browser/loader/navigation_url_loader.cc b/chromium/content/browser/loader/navigation_url_loader.cc
index 7e8240811bb..ab426e2480f 100644
--- a/chromium/content/browser/loader/navigation_url_loader.cc
+++ b/chromium/content/browser/loader/navigation_url_loader.cc
@@ -31,6 +31,7 @@ std::unique_ptr<NavigationURLLoader> NavigationURLLoader::Create(
         prefetched_signed_exchange_cache,
     NavigationURLLoaderDelegate* delegate,
     bool is_served_from_back_forward_cache,
+    mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer,
     std::vector<std::unique_ptr<NavigationLoaderInterceptor>>
         initial_interceptors) {
   if (g_loader_factory) {
@@ -47,7 +48,7 @@ std::unique_ptr<NavigationURLLoader> NavigationURLLoader::Create(
       browser_context, storage_partition, std::move(request_info),
       std::move(navigation_ui_data), service_worker_handle, appcache_handle,
       std::move(prefetched_signed_exchange_cache), delegate,
-      std::move(initial_interceptors));
+      std::move(cookie_observer), std::move(initial_interceptors));
 }
 
 void NavigationURLLoader::SetFactoryForTesting(
diff --git a/chromium/content/browser/loader/navigation_url_loader.h b/chromium/content/browser/loader/navigation_url_loader.h
index 18e4859cfdc..7322f606e4e 100644
--- a/chromium/content/browser/loader/navigation_url_loader.h
+++ b/chromium/content/browser/loader/navigation_url_loader.h
@@ -59,6 +59,7 @@ class CONTENT_EXPORT NavigationURLLoader {
           prefetched_signed_exchange_cache,
       NavigationURLLoaderDelegate* delegate,
       bool is_served_from_back_forward_cache,
+      mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer,
       std::vector<std::unique_ptr<NavigationLoaderInterceptor>>
           initial_interceptors = {});
 
@@ -71,9 +72,11 @@ class CONTENT_EXPORT NavigationURLLoader {
   // request. |new_previews_state| will be updated for newly created URLLoaders,
   // but the existing default URLLoader will not see |new_previews_state| unless
   // the URLLoader happens to be reset.
-  virtual void FollowRedirect(const std::vector<std::string>& removed_headers,
-                              const net::HttpRequestHeaders& modified_headers,
-                              PreviewsState new_previews_state) = 0;
+  virtual void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      PreviewsState new_previews_state) = 0;
 
  protected:
   NavigationURLLoader() {}
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.cc b/chromium/content/browser/loader/navigation_url_loader_impl.cc
index 2be5d4400de..9ecb16d776d 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.cc
@@ -41,8 +41,7 @@
 #include "content/browser/service_worker/service_worker_container_host.h"
 #include "content/browser/service_worker/service_worker_main_resource_handle.h"
 #include "content/browser/service_worker/service_worker_main_resource_handle_core.h"
-#include "content/browser/service_worker/service_worker_provider_host.h"
-#include "content/browser/service_worker/service_worker_request_handler.h"
+#include "content/browser/service_worker/service_worker_navigation_loader_interceptor.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -70,6 +69,7 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/common/webplugininfo.h"
+#include "media/media_buildflags.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/load_flags.h"
@@ -89,7 +89,9 @@
 #include "services/network/public/cpp/request_destination.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/loader/mime_sniffing_throttle.h"
 #include "third_party/blink/public/common/loader/throttling_url_loader.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
@@ -191,29 +193,22 @@ const net::NetworkTrafficAnnotationTag kNavigationUrlLoaderTrafficAnnotation =
 
 std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
     NavigationRequestInfo* request_info,
-    int frame_tree_node_id) {
+    int frame_tree_node_id,
+    mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer) {
   // TODO(scottmg): Port over stuff from RDHI::BeginNavigationRequest() here.
   auto new_request = std::make_unique<network::ResourceRequest>();
 
   new_request->method = request_info->common_params->method;
   new_request->url = request_info->common_params->url;
-  new_request->site_for_cookies = request_info->site_for_cookies;
-  new_request->attach_same_site_cookies =
-      request_info->begin_params->attach_same_site_cookies;
+  new_request->site_for_cookies =
+      request_info->isolation_info.site_for_cookies();
+  new_request->force_ignore_site_for_cookies =
+      request_info->begin_params->force_ignore_site_for_cookies;
   new_request->trusted_params = network::ResourceRequest::TrustedParams();
-  new_request->trusted_params->network_isolation_key =
-      request_info->network_isolation_key;
+  new_request->trusted_params->isolation_info = request_info->isolation_info;
+  new_request->trusted_params->cookie_observer = std::move(cookie_observer);
   new_request->is_main_frame = request_info->is_main_frame;
 
-  if (request_info->is_main_frame) {
-    new_request->trusted_params->update_network_isolation_key_on_redirect =
-        network::mojom::UpdateNetworkIsolationKeyOnRedirect::
-            kUpdateTopFrameAndFrameOrigin;
-  } else {
-    new_request->trusted_params->update_network_isolation_key_on_redirect =
-        network::mojom::UpdateNetworkIsolationKeyOnRedirect::kUpdateFrameOrigin;
-  }
-
   net::RequestPriority net_priority = net::HIGHEST;
   if (!request_info->is_main_frame &&
       base::FeatureList::IsEnabled(features::kLowPriorityIframes)) {
@@ -230,6 +225,7 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
       request_info->common_params->referrer->policy);
   new_request->headers.AddHeadersFromString(
       request_info->begin_params->headers);
+  new_request->cors_exempt_headers = request_info->cors_exempt_headers;
 
   new_request->resource_type = static_cast<int>(
       request_info->is_main_frame ? blink::mojom::ResourceType::kMainFrame
@@ -266,22 +262,22 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
   } else {
     if (frame_tree_node) {
       switch (frame_tree_node->frame_owner_element_type()) {
-        case blink::FrameOwnerElementType::kObject:
+        case blink::mojom::FrameOwnerElementType::kObject:
           new_request->destination =
               network::mojom::RequestDestination::kObject;
           break;
-        case blink::FrameOwnerElementType::kEmbed:
+        case blink::mojom::FrameOwnerElementType::kEmbed:
           new_request->destination = network::mojom::RequestDestination::kEmbed;
           break;
-        case blink::FrameOwnerElementType::kIframe:
+        case blink::mojom::FrameOwnerElementType::kIframe:
           new_request->destination =
               network::mojom::RequestDestination::kIframe;
           break;
-        case blink::FrameOwnerElementType::kFrame:
+        case blink::mojom::FrameOwnerElementType::kFrame:
           new_request->destination = network::mojom::RequestDestination::kFrame;
           break;
-        case blink::FrameOwnerElementType::kPortal:
-        case blink::FrameOwnerElementType::kNone:
+        case blink::mojom::FrameOwnerElementType::kPortal:
+        case blink::mojom::FrameOwnerElementType::kNone:
           NOTREACHED();
           break;
       }
@@ -300,8 +296,6 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
 
   new_request->credentials_mode = network::mojom::CredentialsMode::kInclude;
   new_request->redirect_mode = network::mojom::RedirectMode::kManual;
-  new_request->fetch_request_context_type =
-      static_cast<int>(request_info->begin_params->request_context_type);
   new_request->upgrade_if_insecure = request_info->upgrade_if_insecure;
   new_request->throttling_profile_id = request_info->devtools_frame_token;
   new_request->transition_type = request_info->common_params->transition;
@@ -327,6 +321,21 @@ void UnknownSchemeCallback(
           handled_externally ? net::ERR_ABORTED : net::ERR_UNKNOWN_URL_SCHEME));
 }
 
+const char* FrameAcceptHeaderValue() {
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  static const char kFrameAcceptHeaderValueWithAvif[] =
+      "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,"
+      "image/webp,image/apng,*/*;q=0.8";
+  static const char* accept_value =
+      base::FeatureList::IsEnabled(blink::features::kAVIF)
+          ? kFrameAcceptHeaderValueWithAvif
+          : network::kFrameAcceptHeaderValue;
+  return accept_value;
+#else
+  return network::kFrameAcceptHeaderValue;
+#endif
+}
+
 }  // namespace
 
 // Kept around during the lifetime of the navigation request, and is
@@ -344,6 +353,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
           initial_interceptors,
       std::unique_ptr<network::ResourceRequest> resource_request,
       BrowserContext* browser_context,
+      StoragePartitionImpl* storage_partition,
       const GURL& url,
       mojo::PendingReceiver<network::mojom::URLLoaderFactory>
           proxied_factory_receiver,
@@ -361,6 +371,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
         known_schemes_(std::move(known_schemes)),
         bypass_redirect_checks_(bypass_redirect_checks),
         browser_context_(browser_context),
+        storage_partition_(storage_partition),
         head_(network::mojom::URLResponseHead::New()) {}
 
   ~URLLoaderRequestController() override {
@@ -444,7 +455,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
               std::move(factory));
     }
 
-    std::string accept_value = network::kFrameAcceptHeaderValue;
+    std::string accept_value = FrameAcceptHeaderValue();
     if (signed_exchange_utils::IsSignedExchangeHandlingEnabled(
             browser_context_)) {
       accept_value.append(kAcceptHeaderSignedExchangeSuffix);
@@ -506,8 +517,8 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
 
     // Set up an interceptor for service workers.
     if (service_worker_handle_) {
-      std::unique_ptr<NavigationLoaderInterceptor> service_worker_interceptor =
-          ServiceWorkerRequestHandler::CreateForNavigation(
+      auto service_worker_interceptor =
+          ServiceWorkerNavigationLoaderInterceptor::CreateForNavigation(
               resource_request_->url, service_worker_handle_->AsWeakPtr(),
               *request_info);
       // The interceptor may not be created in certain cases (e.g., the origin
@@ -656,8 +667,10 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     // let the loader just follow the redirect.
     if (url_loader_) {
       DCHECK(!redirect_info_.new_url.is_empty());
-      url_loader_->FollowRedirect(std::move(url_loader_removed_headers_),
-                                  std::move(url_loader_modified_headers_));
+      url_loader_->FollowRedirect(
+          std::move(url_loader_removed_headers_),
+          std::move(url_loader_modified_headers_),
+          std::move(url_loader_modified_cors_exempt_headers_));
       return;
     }
 
@@ -780,10 +793,12 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     return factory;
   }
 
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      PreviewsState new_previews_state,
-                      base::Time ui_post_time) {
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      PreviewsState new_previews_state,
+      base::Time ui_post_time) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     DCHECK(!redirect_info_.new_url.is_empty());
     ui_to_io_time_ += (base::Time::Now() - ui_post_time);
@@ -812,19 +827,9 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     resource_request_->site_for_cookies = redirect_info_.new_site_for_cookies;
 
     // See if navigation network isolation key needs to be updated.
-    if (resource_request_->resource_type ==
-        static_cast<int>(blink::mojom::ResourceType::kMainFrame)) {
-      url::Origin origin = url::Origin::Create(resource_request_->url);
-      resource_request_->trusted_params->network_isolation_key =
-          net::NetworkIsolationKey(origin, origin);
-    } else {
-      DCHECK_EQ(static_cast<int>(blink::mojom::ResourceType::kSubFrame),
-                resource_request_->resource_type);
-      url::Origin subframe_origin = url::Origin::Create(resource_request_->url);
-      resource_request_->trusted_params->network_isolation_key =
-          resource_request_->trusted_params->network_isolation_key
-              .CreateWithNewFrameOrigin(subframe_origin);
-    }
+    resource_request_->trusted_params->isolation_info =
+        resource_request_->trusted_params->isolation_info.CreateForRedirect(
+            url::Origin::Create(resource_request_->url));
 
     resource_request_->referrer = GURL(redirect_info_.new_referrer);
     resource_request_->referrer_policy = redirect_info_.new_referrer_policy;
@@ -835,13 +840,14 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     // |resource_request_| during redirect.
     url_loader_removed_headers_ = removed_headers;
     url_loader_modified_headers_ = modified_headers;
+    url_loader_modified_cors_exempt_headers_ = modified_cors_exempt_headers;
 
     // Don't send Accept: application/signed-exchange for fallback redirects.
     if (redirect_info_.is_signed_exchange_fallback_redirect) {
       url_loader_modified_headers_.SetHeader(net::HttpRequestHeaders::kAccept,
-                                             network::kFrameAcceptHeaderValue);
+                                             FrameAcceptHeaderValue());
       resource_request_->headers.SetHeader(net::HttpRequestHeaders::kAccept,
-                                           network::kFrameAcceptHeaderValue);
+                                           FrameAcceptHeaderValue());
     }
 
     Restart();
@@ -855,11 +861,18 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   // network::mojom::URLLoaderClient implementation:
   void OnReceiveResponse(network::mojom::URLResponseHeadPtr head) override {
     head_ = std::move(head);
+    on_receive_response_time_ = base::TimeTicks::Now();
   }
 
   // network::mojom::URLLoaderClient implementation:
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle response_body) override {
+    if (!on_receive_response_time_.is_null()) {
+      UMA_HISTOGRAM_TIMES(
+          "Navigation.OnReceiveResponseToOnStartLoadingResponseBody",
+          base::TimeTicks::Now() - on_receive_response_time_);
+    }
+
     response_body_ = std::move(response_body);
     received_response_ = true;
 
@@ -956,10 +969,13 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
       network::mojom::URLResponseHeadPtr head,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       bool is_download) {
-    owner_->OnReceiveResponse(std::move(head),
-                              std::move(url_loader_client_endpoints),
-                              std::move(response_body_), global_request_id_,
-                              is_download, ui_to_io_time_, base::Time::Now());
+    network::mojom::URLResponseHead* head_ptr = head.get();
+    auto on_receive_response = base::BindOnce(
+        &NavigationURLLoaderImpl::OnReceiveResponse, owner_, std::move(head),
+        std::move(url_loader_client_endpoints), std::move(response_body_),
+        global_request_id_, is_download, ui_to_io_time_, base::Time::Now());
+
+    ParseHeaders(url_, head_ptr, std::move(on_receive_response));
   }
 
   void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
@@ -994,10 +1010,11 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
 
     url_ = redirect_info.new_url;
 
-    base::PostTask(
-        FROM_HERE, {BrowserThread::UI},
+    network::mojom::URLResponseHead* head_ptr = head.get();
+    auto on_receive_redirect =
         base::BindOnce(&NavigationURLLoaderImpl::OnReceiveRedirect, owner_,
-                       redirect_info, std::move(head), base::Time::Now()));
+                       redirect_info, std::move(head), base::Time::Now());
+    ParseHeaders(url_, head_ptr, std::move(on_receive_redirect));
   }
 
   void OnUploadProgress(int64_t current_position,
@@ -1081,7 +1098,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
               new_interceptors;
           new_interceptors.push_back(std::move(interceptors_[i]));
           new_interceptors.swap(interceptors_);
-          // Reset the state of ServiceWorkerProviderHost.
+          // Reset the state of ServiceWorkerContainerHost.
           // Currently we don't support Service Worker in Signed Exchange
           // pages. The page will not be controlled by service workers. And
           // Service Worker related APIs will fail with NoDocumentURL error.
@@ -1142,6 +1159,44 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
         std::move(accept_langs));
   }
 
+  void ParseHeaders(const GURL& url,
+                    network::mojom::URLResponseHead* head,
+                    base::OnceClosure continuation) {
+    // The main path:
+    // --------------
+    // The ParsedHeaders are already provided. No more work needed.
+    //
+    // Currently used when the response is coming from:
+    // - Network
+    // - ServiceWorker
+    // - WebUI
+    if (head->parsed_headers) {
+      std::move(continuation).Run();
+      return;
+    }
+
+    // As an optimization, when we know the parsed headers will be empty, we can
+    // skip the network process roundtrip.
+    // TODO(arthursonzogni): If there are any performance issues, consider
+    // checking the |head->headers| contains at least one header to be parsed.
+    if (!head->headers) {
+      head->parsed_headers = network::mojom::ParsedHeaders::New();
+      std::move(continuation).Run();
+      return;
+    }
+
+    auto assign = [](base::OnceClosure continuation,
+                     network::mojom::URLResponseHead* head,
+                     network::mojom::ParsedHeadersPtr parsed_headers) {
+      head->parsed_headers = std::move(parsed_headers);
+      std::move(continuation).Run();
+    };
+
+    storage_partition_->GetNetworkContext()->ParseHeaders(
+        url, head->headers,
+        base::BindOnce(assign, std::move(continuation), head));
+  }
+
   std::vector<std::unique_ptr<NavigationLoaderInterceptor>> interceptors_;
   size_t interceptor_index_ = 0;
 
@@ -1163,6 +1218,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   // will be consumed by next |url_loader_->FollowRedirect()|.
   std::vector<std::string> url_loader_removed_headers_;
   net::HttpRequestHeaders url_loader_modified_headers_;
+  net::HttpRequestHeaders url_loader_modified_cors_exempt_headers_;
 
   std::vector<GURL> url_chain_;
 
@@ -1190,9 +1246,12 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   mojo::PendingRemote<network::mojom::URLLoader> response_url_loader_;
 
   // Set to true if we receive a valid response from a URLLoader, i.e.
-  // URLLoaderClient::OnReceivedResponse() is called.
+  // URLLoaderClient::OnStartLoadingResponseBody() is called.
   bool received_response_ = false;
 
+  // When URLLoaderClient::OnReceiveResponse() is called. For UMA.
+  base::TimeTicks on_receive_response_time_;
+
   bool started_ = false;
 
   // Lazily initialized and used in the case of non-network resource
@@ -1238,15 +1297,13 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   // (eg: NavigationLoaderInterceptor for loading a local Web Bundle file).
   bool bypass_redirect_checks_;
 
-  // Used to reset the state of ServiceWorkerProviderHost when
-  // SignedExchangeRequestHandler will handle the response.
-  base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host_;
   ServiceWorkerMainResourceHandle* service_worker_handle_ = nullptr;
 
   // Counts the time overhead of all the hops from the UI to the IO threads.
   base::TimeDelta ui_to_io_time_;
 
   BrowserContext* browser_context_;
+  StoragePartitionImpl* storage_partition_;
 
   network::mojom::URLResponseHeadPtr head_;
   mojo::ScopedDataPipeConsumerHandle response_body_;
@@ -1268,6 +1325,7 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
     scoped_refptr<PrefetchedSignedExchangeCache>
         prefetched_signed_exchange_cache,
     NavigationURLLoaderDelegate* delegate,
+    mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer,
     std::vector<std::unique_ptr<NavigationLoaderInterceptor>>
         initial_interceptors)
     : delegate_(delegate),
@@ -1283,15 +1341,15 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
   ServiceWorkerMainResourceHandleCore* service_worker_handle_core =
       service_worker_handle ? service_worker_handle->core() : nullptr;
 
-  std::unique_ptr<network::ResourceRequest> new_request =
-      CreateResourceRequest(request_info.get(), frame_tree_node_id);
-
   auto* partition = static_cast<StoragePartitionImpl*>(storage_partition);
   scoped_refptr<SignedExchangePrefetchMetricRecorder>
       signed_exchange_prefetch_metric_recorder =
           partition->GetPrefetchURLLoaderService()
               ->signed_exchange_prefetch_metric_recorder();
 
+  std::unique_ptr<network::ResourceRequest> new_request = CreateResourceRequest(
+      request_info.get(), frame_tree_node_id, std::move(cookie_observer));
+
   std::string accept_langs = GetContentClient()->browser()->GetAcceptLangs(
       partition->browser_context());
 
@@ -1420,9 +1478,10 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
   DCHECK(!request_controller_);
   request_controller_ = std::make_unique<URLLoaderRequestController>(
       std::move(initial_interceptors), std::move(new_request), browser_context,
-      request_info->common_params->url, std::move(proxied_factory_receiver),
-      std::move(proxied_factory_remote), std::move(known_schemes),
-      bypass_redirect_checks, weak_factory_.GetWeakPtr());
+      partition, request_info->common_params->url,
+      std::move(proxied_factory_receiver), std::move(proxied_factory_remote),
+      std::move(known_schemes), bypass_redirect_checks,
+      weak_factory_.GetWeakPtr());
   request_controller_->Start(
       std::move(pending_network_factory), service_worker_handle,
       service_worker_handle_core, appcache_handle,
@@ -1439,8 +1498,10 @@ NavigationURLLoaderImpl::~NavigationURLLoaderImpl() {
 void NavigationURLLoaderImpl::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     PreviewsState new_previews_state) {
   request_controller_->FollowRedirect(removed_headers, modified_headers,
+                                      modified_cors_exempt_headers,
                                       new_previews_state, base::Time::Now());
 }
 
@@ -1477,7 +1538,7 @@ void NavigationURLLoaderImpl::OnReceiveResponse(
 }
 
 void NavigationURLLoaderImpl::OnReceiveRedirect(
-    const net::RedirectInfo& redirect_info,
+    net::RedirectInfo redirect_info,
     network::mojom::URLResponseHeadPtr response_head,
     base::Time io_post_time) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.h b/chromium/content/browser/loader/navigation_url_loader_impl.h
index 87a09090bea..0d856e83a47 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.h
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.h
@@ -47,14 +47,17 @@ class CONTENT_EXPORT NavigationURLLoaderImpl : public NavigationURLLoader {
       scoped_refptr<PrefetchedSignedExchangeCache>
           prefetched_signed_exchange_cache,
       NavigationURLLoaderDelegate* delegate,
+      mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer,
       std::vector<std::unique_ptr<NavigationLoaderInterceptor>>
           initial_interceptors);
   ~NavigationURLLoaderImpl() override;
 
   // NavigationURLLoader implementation:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      PreviewsState new_previews_state) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      PreviewsState new_previews_state) override;
 
   void OnReceiveResponse(
       network::mojom::URLResponseHeadPtr response_head,
@@ -64,7 +67,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl : public NavigationURLLoader {
       bool is_download,
       base::TimeDelta total_ui_to_io_time,
       base::Time io_post_time);
-  void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
+  void OnReceiveRedirect(net::RedirectInfo redirect_info,
                          network::mojom::URLResponseHeadPtr response,
                          base::Time io_post_time);
   void OnComplete(const network::URLLoaderCompletionStatus& status);
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
index 0c9d8ce0267..82ebc55f63f 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
@@ -33,6 +33,7 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/test_navigation_url_loader_delegate.h"
+#include "ipc/ipc_message.h"
 #include "net/base/load_flags.h"
 #include "net/base/mock_network_change_notifier.h"
 #include "net/proxy_resolution/configured_proxy_resolution_service.h"
@@ -101,7 +102,8 @@ class TestNavigationLoaderInterceptor : public NavigationLoaderInterceptor {
         0 /* keepalive_request_size */, resource_scheduler_client_,
         nullptr /* keepalive_statistics_recorder */,
         nullptr /* network_usage_accumulator */, nullptr /* header_client */,
-        nullptr /* origin_policy_manager */, nullptr /* trust_token_helper */);
+        nullptr /* origin_policy_manager */, nullptr /* trust_token_helper */,
+        mojo::NullRemote() /* cookie_observer */);
   }
 
   bool MaybeCreateLoaderForResponse(
@@ -170,7 +172,8 @@ class NavigationURLLoaderImplTest : public testing::Test {
       bool upgrade_if_insecure = false) {
     mojom::BeginNavigationParamsPtr begin_params =
         mojom::BeginNavigationParams::New(
-            headers, net::LOAD_NORMAL, false /* skip_service_worker */,
+            MSG_ROUTING_NONE /* initiator_routing_id */, headers,
+            net::LOAD_NORMAL, false /* skip_service_worker */,
             blink::mojom::RequestContextType::LOCATION,
             network::mojom::RequestDestination::kDocument,
             blink::WebMixedContentContextType::kBlockable,
@@ -181,7 +184,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
             GURL() /* client_side_redirect_url */,
             base::nullopt /* devtools_initiator_info */,
             false /* attach_same_site_cookie */,
-            nullptr /* trust_token_params */);
+            nullptr /* trust_token_params */, base::nullopt /* impression */);
 
     auto common_params = CreateCommonNavigationParams();
     common_params->url = url;
@@ -193,16 +196,18 @@ class NavigationURLLoaderImplTest : public testing::Test {
     std::unique_ptr<NavigationRequestInfo> request_info(
         new NavigationRequestInfo(
             std::move(common_params), std::move(begin_params),
-            net::SiteForCookies::FromUrl(url),
-            net::NetworkIsolationKey(origin, origin), is_main_frame,
-            false /* parent_is_main_frame */, false /* are_ancestors_secure */,
-            -1 /* frame_tree_node_id */, false /* is_for_guests_only */,
-            false /* report_raw_headers */, false /* is_prerenering */,
+            net::IsolationInfo::Create(
+                net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin,
+                origin, net::SiteForCookies::FromUrl(url)),
+            is_main_frame, false /* parent_is_main_frame */,
+            false /* are_ancestors_secure */, -1 /* frame_tree_node_id */,
+            false /* is_for_guests_only */, false /* report_raw_headers */,
+            false /* is_prerenering */,
             upgrade_if_insecure /* upgrade_if_insecure */,
             nullptr /* blob_url_loader_factory */,
             base::UnguessableToken::Create() /* devtools_navigation_token */,
             base::UnguessableToken::Create() /* devtools_frame_token */,
-            false /* obey_origin_policy */));
+            false /* obey_origin_policy */, {} /* cors_exempt_headers */));
     std::vector<std::unique_ptr<NavigationLoaderInterceptor>> interceptors;
     most_recent_resource_request_ = base::nullopt;
     interceptors.push_back(std::make_unique<TestNavigationLoaderInterceptor>(
@@ -214,6 +219,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
         std::move(request_info), nullptr /* navigation_ui_data */,
         nullptr /* service_worker_handle */, nullptr /* appcache_handle */,
         nullptr /* prefetched_signed_exchange_cache */, delegate,
+        mojo::NullRemote() /* cookie_access_obsever */,
         std::move(interceptors));
   }
 
@@ -236,7 +242,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
                            redirect_url.GetOrigin().spec().c_str()),
         request_method, &delegate);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
 
     EXPECT_EQ(expected_redirect_method, delegate.redirect_info().new_method);
 
@@ -277,7 +283,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
                            url.GetOrigin().spec().c_str()),
         "GET", &delegate, NavigationDownloadPolicy(), is_main_frame);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
     delegate.WaitForResponseStarted();
 
     return most_recent_resource_request_.value().priority;
@@ -294,7 +300,7 @@ class NavigationURLLoaderImplTest : public testing::Test {
         "GET", &delegate, NavigationDownloadPolicy(), true /*is_main_frame*/,
         upgrade_if_insecure);
     delegate.WaitForRequestRedirected();
-    loader->FollowRedirect({}, {}, PREVIEWS_OFF);
+    loader->FollowRedirect({}, {}, {}, PREVIEWS_OFF);
     if (expect_request_fail) {
       delegate.WaitForRequestFailed();
     } else {
@@ -322,7 +328,7 @@ TEST_F(NavigationURLLoaderImplTest, RequestPriority) {
             NavigateAndReturnRequestPriority(url, false /* is_main_frame */));
 }
 
-TEST_F(NavigationURLLoaderImplTest, NetworkIsolationKeyOfMainFrameNavigation) {
+TEST_F(NavigationURLLoaderImplTest, IsolationInfoOfMainFrameNavigation) {
   ASSERT_TRUE(http_test_server_.Start());
 
   const GURL url = http_test_server_.GetURL("/foo");
@@ -339,13 +345,16 @@ TEST_F(NavigationURLLoaderImplTest, NetworkIsolationKeyOfMainFrameNavigation) {
 
   ASSERT_TRUE(most_recent_resource_request_);
   ASSERT_TRUE(most_recent_resource_request_->trusted_params);
-  EXPECT_EQ(
-      net::NetworkIsolationKey(origin, origin),
-      most_recent_resource_request_->trusted_params->network_isolation_key);
+  EXPECT_TRUE(
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin, origin,
+          net::SiteForCookies::FromOrigin(origin))
+          .IsEqualForTesting(
+              most_recent_resource_request_->trusted_params->isolation_info));
 }
 
 TEST_F(NavigationURLLoaderImplTest,
-       NetworkIsolationKeyOfRedirectedMainFrameNavigation) {
+       IsolationInfoOfRedirectedMainFrameNavigation) {
   ASSERT_TRUE(http_test_server_.Start());
 
   const GURL url = http_test_server_.GetURL("/redirect301-to-echo");
@@ -355,9 +364,12 @@ TEST_F(NavigationURLLoaderImplTest,
   HTTPRedirectOriginHeaderTest(url, "GET", "GET", url.GetOrigin().spec());
 
   ASSERT_TRUE(most_recent_resource_request_->trusted_params);
-  EXPECT_EQ(
-      net::NetworkIsolationKey(origin, origin),
-      most_recent_resource_request_->trusted_params->network_isolation_key);
+  EXPECT_TRUE(
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin, origin,
+          net::SiteForCookies::FromOrigin(origin))
+          .IsEqualForTesting(
+              most_recent_resource_request_->trusted_params->isolation_info));
 }
 
 TEST_F(NavigationURLLoaderImplTest, Redirect301Tests) {
@@ -456,7 +468,7 @@ TEST_F(NavigationURLLoaderImplTest, RedirectModifiedHeaders) {
   net::HttpRequestHeaders redirect_headers;
   redirect_headers.SetHeader("Header2", "");
   redirect_headers.SetHeader("Header3", "Value3");
-  loader->FollowRedirect({}, redirect_headers, PREVIEWS_OFF);
+  loader->FollowRedirect({}, redirect_headers, {}, PREVIEWS_OFF);
   delegate.WaitForResponseStarted();
 
   // Redirected request should also have modified headers.
diff --git a/chromium/content/browser/loader/navigation_url_loader_unittest.cc b/chromium/content/browser/loader/navigation_url_loader_unittest.cc
index d8b34f87671..4701e28d871 100644
--- a/chromium/content/browser/loader/navigation_url_loader_unittest.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_unittest.cc
@@ -22,6 +22,7 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/test_navigation_url_loader_delegate.h"
+#include "ipc/ipc_message.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_status_flags.h"
@@ -57,6 +58,7 @@ class NavigationURLLoaderTest : public testing::Test {
       NavigationURLLoaderDelegate* delegate) {
     mojom::BeginNavigationParamsPtr begin_params =
         mojom::BeginNavigationParams::New(
+            MSG_ROUTING_NONE /* initiator_routing_id */,
             std::string() /* headers */, net::LOAD_NORMAL,
             false /* skip_service_worker */,
             blink::mojom::RequestContextType::LOCATION,
@@ -68,8 +70,8 @@ class NavigationURLLoaderTest : public testing::Test {
             std::string() /* searchable_form_encoding */,
             GURL() /* client_side_redirect_url */,
             base::nullopt /* devtools_initiator_info */,
-            false /* attach_same_site_cookies */,
-            nullptr /* trust_token_params */);
+            false /* force_ignore_site_for_cookies */,
+            nullptr /* trust_token_params */, base::nullopt /* impression */);
     auto common_params = CreateCommonNavigationParams();
     common_params->url = url;
     common_params->initiator_origin = url::Origin::Create(url);
@@ -78,21 +80,22 @@ class NavigationURLLoaderTest : public testing::Test {
     std::unique_ptr<NavigationRequestInfo> request_info(
         new NavigationRequestInfo(
             std::move(common_params), std::move(begin_params),
-            net::SiteForCookies::FromUrl(url),
-            net::NetworkIsolationKey(origin, origin), true /* is_main_frame */,
-            false /* parent_is_main_frame */, false /* are_ancestors_secure */,
-            -1 /* frame_tree_node_id */, false /* is_for_guests_only */,
-            false /* report_raw_headers */, false /* is_prerendering */,
-            false /* upgrade_if_insecure */,
+            net::IsolationInfo::Create(
+                net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin,
+                origin, net::SiteForCookies::FromUrl(url)),
+            true /* is_main_frame */, false /* parent_is_main_frame */,
+            false /* are_ancestors_secure */, -1 /* frame_tree_node_id */,
+            false /* is_for_guests_only */, false /* report_raw_headers */,
+            false /* is_prerendering */, false /* upgrade_if_insecure */,
             nullptr /* blob_url_loader_factory */,
             base::UnguessableToken::Create() /* devtools_navigation_token */,
             base::UnguessableToken::Create() /* devtools_frame_token */,
-            false /* obey_origin_policy */));
+            false /* obey_origin_policy */, {} /* cors_exempt_headers */));
     return NavigationURLLoader::Create(
         browser_context_.get(),
         BrowserContext::GetDefaultStoragePartition(browser_context_.get()),
         std::move(request_info), nullptr, nullptr, nullptr, nullptr, delegate,
-        false);
+        false, mojo::NullRemote());
   }
 
  protected:
diff --git a/chromium/content/browser/loader/prefetch_browsertest.cc b/chromium/content/browser/loader/prefetch_browsertest.cc
index 9c4f9f49216..387af864050 100644
--- a/chromium/content/browser/loader/prefetch_browsertest.cc
+++ b/chromium/content/browser/loader/prefetch_browsertest.cc
@@ -13,13 +13,17 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/url_loader_monitor.h"
 #include "content/shell/browser/shell.h"
 #include "net/base/features.h"
+#include "net/base/isolation_info.h"
 #include "net/dns/mock_host_resolver.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_request.h"
 #include "third_party/blink/public/common/features.h"
 
 namespace content {
@@ -51,13 +55,9 @@ class PrefetchBrowserTest
     if (split_cache_enabled_) {
       enable_features.push_back(
           net::features::kSplitCacheByNetworkIsolationKey);
-      enable_features.push_back(
-          network::features::kPrefetchMainResourceNetworkIsolationKey);
     } else {
       disabled_features.push_back(
           net::features::kSplitCacheByNetworkIsolationKey);
-      disabled_features.push_back(
-          network::features::kPrefetchMainResourceNetworkIsolationKey);
     }
 
     feature_list_.InitWithFeatures(enable_features, disabled_features);
@@ -157,6 +157,55 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTestPrivacyChanges, RedirectNotFollowed) {
 }
 
 IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
+                       CrossOriginDocumentHasNoSameSiteCookies) {
+  const char* prefetch_path = "/prefetch.html";
+  const char* target_path = "/target.html";
+  RegisterResponse(
+      target_path,
+      ResponseEntry("<head><title>Prefetch Target</title></head>"));
+
+  base::RunLoop prefetch_waiter;
+  auto request_counter = RequestCounter::CreateAndMonitor(
+      cross_origin_server_.get(), target_path, &prefetch_waiter);
+  RegisterRequestHandler(cross_origin_server_.get());
+  ASSERT_TRUE(cross_origin_server_->Start());
+
+  const GURL cross_origin_target_url =
+      cross_origin_server_->GetURL("3p.example", target_path);
+  RegisterResponse(
+      prefetch_path,
+      ResponseEntry(base::StringPrintf(
+          "<body><link rel='prefetch' as='document' href='%s'></body>",
+          cross_origin_target_url.spec().c_str())));
+  RegisterRequestHandler(embedded_test_server());
+  ASSERT_TRUE(embedded_test_server()->Start());
+  EXPECT_EQ(0, request_counter->GetRequestCount());
+  EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
+
+  URLLoaderMonitor monitor({cross_origin_target_url});
+
+  // Loading a page that prefetches the target URL would increment the
+  // |request_counter|.
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
+  prefetch_waiter.Run();
+  EXPECT_EQ(1, request_counter->GetRequestCount());
+  EXPECT_EQ(1, GetPrefetchURLLoaderCallCount());
+
+  monitor.WaitForUrls();
+  base::Optional<network::ResourceRequest> request =
+      monitor.GetRequestInfo(cross_origin_target_url);
+  ASSERT_TRUE(request);
+  ASSERT_TRUE(request->site_for_cookies.IsNull());
+  ASSERT_TRUE(request->trusted_params);
+  url::Origin cross_origin = url::Origin::Create(cross_origin_target_url);
+  EXPECT_TRUE(net::IsolationInfo::Create(
+                  net::IsolationInfo::RedirectMode::kUpdateNothing,
+                  cross_origin, cross_origin, net::SiteForCookies())
+                  .IsEqualForTesting(request->trusted_params->isolation_info));
+}
+
+IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
                        CrossOriginDocumentReusedAsNavigation) {
   const char* prefetch_path = "/prefetch.html";
   const char* target_path = "/target.html";
@@ -592,6 +641,71 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, WithPreload) {
   NavigateToURLAndWaitTitle(target_url, "done");
 }
 
+IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
+                       CrossOriginWithPreloadHasNoSameSiteCookies) {
+  const char* target_path = "/target.html";
+  const char* preload_path = "/preload.js";
+  RegisterResponse(
+      target_path,
+      ResponseEntry("<head><title>Prefetch Target</title><script "
+                    "src=\"./preload.js\"></script></head>",
+                    "text/html",
+                    {{"link", "</preload.js>;rel=\"preload\";as=\"script\""},
+                     {"access-control-allow-origin", "*"}}));
+  RegisterResponse(preload_path,
+                   ResponseEntry("document.title=\"done\";", "text/javascript",
+                                 {{"cache-control", "public, max-age=600"}}));
+
+  base::RunLoop preload_waiter;
+  auto target_request_counter =
+      RequestCounter::CreateAndMonitor(cross_origin_server_.get(), target_path);
+  auto preload_request_counter = RequestCounter::CreateAndMonitor(
+      cross_origin_server_.get(), preload_path, &preload_waiter);
+  RegisterRequestHandler(cross_origin_server_.get());
+
+  ASSERT_TRUE(cross_origin_server_->Start());
+
+  const GURL cross_origin_target_url =
+      cross_origin_server_->GetURL("3p.example", target_path);
+
+  const char* prefetch_path = "/prefetch.html";
+  RegisterResponse(prefetch_path,
+                   ResponseEntry(base::StringPrintf(
+                       "<body><link rel='prefetch' href='%s' as='document' "
+                       "crossorigin='anonymous'></body>",
+                       cross_origin_target_url.spec().c_str())));
+  RegisterRequestHandler(embedded_test_server());
+  ASSERT_TRUE(embedded_test_server()->Start());
+  EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
+
+  URLLoaderMonitor monitor({cross_origin_target_url});
+
+  // Loading a page that prefetches the target URL would increment both
+  // |target_request_counter| and |preload_request_counter|.
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
+  preload_waiter.Run();
+  EXPECT_EQ(1, target_request_counter->GetRequestCount());
+  EXPECT_EQ(1, preload_request_counter->GetRequestCount());
+  EXPECT_EQ(2, GetPrefetchURLLoaderCallCount());
+
+  GURL cross_origin_preload_url =
+      cross_origin_server_->GetURL("3p.example", preload_path);
+  WaitUntilLoaded(cross_origin_preload_url);
+
+  monitor.WaitForUrls();
+  base::Optional<network::ResourceRequest> request =
+      monitor.GetRequestInfo(cross_origin_target_url);
+  ASSERT_TRUE(request);
+  ASSERT_TRUE(request->site_for_cookies.IsNull());
+  ASSERT_TRUE(request->trusted_params);
+  url::Origin cross_origin = url::Origin::Create(cross_origin_target_url);
+  EXPECT_TRUE(net::IsolationInfo::Create(
+                  net::IsolationInfo::RedirectMode::kUpdateNothing,
+                  cross_origin, cross_origin, net::SiteForCookies())
+                  .IsEqualForTesting(request->trusted_params->isolation_info));
+}
+
 IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, CrossOriginWithPreload) {
   const char* target_path = "/target.html";
   const char* preload_path = "/preload.js";
@@ -639,7 +753,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, CrossOriginWithPreload) {
   preload_waiter.Run();
   EXPECT_EQ(1, target_request_counter->GetRequestCount());
   EXPECT_EQ(1, preload_request_counter->GetRequestCount());
-  EXPECT_EQ(split_cache_enabled_ ? 2 : 1, GetPrefetchURLLoaderCallCount());
+  EXPECT_EQ(2, GetPrefetchURLLoaderCallCount());
 
   GURL cross_origin_preload_url =
       cross_origin_server_->GetURL("3p.example", preload_path);
@@ -732,8 +846,8 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, SignedExchangeWithPreload) {
   MockSignedExchangeHandlerFactory factory({MockSignedExchangeHandlerParams(
       target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
       GURL(embedded_test_server()->GetURL(target_path)), "text/html",
-      {base::StringPrintf("Link: <%s>;rel=\"preload\";as=\"script\"",
-                          preload_url_in_sxg.spec().c_str())},
+      {{"Link", base::StringPrintf("<%s>;rel=\"preload\";as=\"script\"",
+                                   preload_url_in_sxg.spec().c_str())}},
       net::SHA256HashValue({{0x00}}))});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
@@ -808,8 +922,8 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
       target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
       GURL(cross_origin_server_->GetURL("3p.example", target_path)),
       "text/html",
-      {base::StringPrintf("Link: <%s>;rel=\"preload\";as=\"script\"",
-                          preload_url_in_sxg.spec().c_str())},
+      {{"Link", base::StringPrintf("<%s>;rel=\"preload\";as=\"script\"",
+                                   preload_url_in_sxg.spec().c_str())}},
       net::SHA256HashValue({{0x00}}))});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
@@ -828,7 +942,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
   preload_waiter.Run();
   EXPECT_EQ(1, preload_request_counter->GetRequestCount());
 
-  EXPECT_EQ(split_cache_enabled_ ? 2 : 1, GetPrefetchURLLoaderCallCount());
+  EXPECT_EQ(2, GetPrefetchURLLoaderCallCount());
 
   WaitUntilLoaded(preload_url_in_sxg);
 
diff --git a/chromium/content/browser/loader/prefetch_url_loader.cc b/chromium/content/browser/loader/prefetch_url_loader.cc
index 4b34df0f330..4b652887ba2 100644
--- a/chromium/content/browser/loader/prefetch_url_loader.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader.cc
@@ -60,7 +60,6 @@ PrefetchURLLoader::PrefetchURLLoader(
           signed_exchange_utils::IsSignedExchangeHandlingEnabled(
               browser_context)) {
   DCHECK(network_loader_factory_);
-  RecordPrefetchRedirectHistogram(PrefetchRedirect::kPrefetchMade);
 
   if (is_signed_exchange_handling_enabled_) {
     // Set the SignedExchange accept header.
@@ -88,19 +87,10 @@ PrefetchURLLoader::PrefetchURLLoader(
 
 PrefetchURLLoader::~PrefetchURLLoader() = default;
 
-void PrefetchURLLoader::RecordPrefetchRedirectHistogram(
-    PrefetchRedirect event) {
-  // We only want to record prefetch vs prefetch redirects when we're not
-  // experimenting with a request's redirect mode.
-  if (base::FeatureList::IsEnabled(blink::features::kPrefetchPrivacyChanges))
-    return;
-
-  base::UmaHistogramEnumeration("Prefetch.Redirect", event);
-}
-
 void PrefetchURLLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   DCHECK(modified_headers.IsEmpty())
       << "Redirect with modified headers was not supported yet. "
@@ -108,21 +98,17 @@ void PrefetchURLLoader::FollowRedirect(
   DCHECK(!new_url) << "Redirect with modified URL was not "
                       "supported yet. crbug.com/845683";
   if (signed_exchange_prefetch_handler_) {
-    RecordPrefetchRedirectHistogram(
-        PrefetchRedirect::kPrefetchRedirectedSXGHandler);
-
     // Rebind |client_receiver_| and |loader_|.
     client_receiver_.Bind(signed_exchange_prefetch_handler_->FollowRedirect(
         loader_.BindNewPipeAndPassReceiver()));
     return;
   }
 
-  RecordPrefetchRedirectHistogram(PrefetchRedirect::kPrefetchRedirected);
-
   DCHECK(loader_);
-  loader_->FollowRedirect(removed_headers,
-                          net::HttpRequestHeaders() /* modified_headers */,
-                          base::nullopt);
+  loader_->FollowRedirect(
+      removed_headers, net::HttpRequestHeaders() /* modified_headers */,
+      net::HttpRequestHeaders() /* modified_cors_exempt_headers */,
+      base::nullopt);
 }
 
 void PrefetchURLLoader::SetPriority(net::RequestPriority priority,
diff --git a/chromium/content/browser/loader/prefetch_url_loader.h b/chromium/content/browser/loader/prefetch_url_loader.h
index 11056a4cba6..d2ecfa5cac5 100644
--- a/chromium/content/browser/loader/prefetch_url_loader.h
+++ b/chromium/content/browser/loader/prefetch_url_loader.h
@@ -86,20 +86,12 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
       const network::URLLoaderCompletionStatus& completion_status);
 
  private:
-  // This enum is used to record a histogram and should not be renumbered.
-  enum class PrefetchRedirect {
-    kPrefetchMade = 0,
-    kPrefetchRedirected = 1,
-    kPrefetchRedirectedSXGHandler = 2,
-    kMaxValue = kPrefetchRedirectedSXGHandler
-  };
-
-  void RecordPrefetchRedirectHistogram(PrefetchRedirect event);
-
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/browser/loader/prefetch_url_loader_service.cc b/chromium/content/browser/loader/prefetch_url_loader_service.cc
index 46314386ae2..8e8dfa97694 100644
--- a/chromium/content/browser/loader/prefetch_url_loader_service.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader_service.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "mojo/public/cpp/bindings/message.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/base/load_flags.h"
@@ -50,8 +51,7 @@ struct PrefetchURLLoaderService::BindContext {
         cross_origin_factory(other->cross_origin_factory),
         prefetched_signed_exchange_cache(
             other->prefetched_signed_exchange_cache),
-        prefetch_network_isolation_keys(
-            other->prefetch_network_isolation_keys) {}
+        prefetch_isolation_infos(other->prefetch_isolation_infos) {}
 
   ~BindContext() = default;
 
@@ -64,10 +64,9 @@ struct PrefetchURLLoaderService::BindContext {
 
   scoped_refptr<PrefetchedSignedExchangeCache> prefetched_signed_exchange_cache;
 
-  // This maps recursive prefetch tokens to NetworkIsolationKeys that they
-  // should be fetched with.
-  std::map<base::UnguessableToken, net::NetworkIsolationKey>
-      prefetch_network_isolation_keys;
+  // This maps recursive prefetch tokens to IsolationInfos that they should be
+  // fetched with.
+  std::map<base::UnguessableToken, net::IsolationInfo> prefetch_isolation_infos;
 
   // This must be the last member.
   base::WeakPtrFactory<PrefetchURLLoaderService::BindContext> weak_ptr_factory{
@@ -122,7 +121,7 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
 
   DCHECK_EQ(static_cast<int>(blink::mojom::ResourceType::kPrefetch),
             resource_request.resource_type);
-  auto& current_context = *loader_factory_receivers_.current_context();
+  BindContext& current_context = *current_bind_context();
 
   if (!current_context.render_frame_host) {
     mojo::Remote<network::mojom::URLLoaderClient>(std::move(client))
@@ -150,13 +149,18 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
       return;
     }
 
+    // Cross-site prefetches shouldn't include SameSite cookies.
+    resource_request.site_for_cookies = net::SiteForCookies();
+
     // Use the trusted cross-origin prefetch loader factory, and set the
     // request's NetworkIsolationKey suitable for the cross-origin prefetch.
     network_loader_factory_to_use = current_context.cross_origin_factory;
     url::Origin destination_origin = url::Origin::Create(resource_request.url);
     resource_request.trusted_params = network::ResourceRequest::TrustedParams();
-    resource_request.trusted_params->network_isolation_key =
-        net::NetworkIsolationKey(destination_origin, destination_origin);
+    resource_request.trusted_params->isolation_info =
+        net::IsolationInfo::Create(
+            net::IsolationInfo::RedirectMode::kUpdateNothing,
+            destination_origin, destination_origin, net::SiteForCookies());
   }
 
   // Recursive prefetch from a cross-origin main resource prefetch.
@@ -166,23 +170,28 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
     // context's |cross_origin_factory| was already created.
     DCHECK(current_context.cross_origin_factory);
 
-    // Resurrect the request's NetworkIsolationKey from the current context's
-    // map, and use it for this request.
-    auto nik_iterator = current_context.prefetch_network_isolation_keys.find(
-        resource_request.recursive_prefetch_token.value());
+    // Resurrect the request's IsolationInfo from the current context's map, and
+    // use it for this request.
+    auto isolation_info_iterator =
+        current_context.prefetch_isolation_infos.find(
+            resource_request.recursive_prefetch_token.value());
 
     // An unexpected token could indicate a compromised renderer trying to fetch
     // a request in a special way. We'll cancel the request.
-    if (nik_iterator == current_context.prefetch_network_isolation_keys.end()) {
+    if (isolation_info_iterator ==
+        current_context.prefetch_isolation_infos.end()) {
       mojo::Remote<network::mojom::URLLoaderClient>(std::move(client))
           ->OnComplete(
               network::URLLoaderCompletionStatus(net::ERR_INVALID_ARGUMENT));
       return;
     }
 
+    // Cross-site prefetches shouldn't include SameSite cookies.
+    resource_request.site_for_cookies = net::SiteForCookies();
+
     resource_request.trusted_params = network::ResourceRequest::TrustedParams();
-    resource_request.trusted_params->network_isolation_key =
-        nik_iterator->second;
+    resource_request.trusted_params->isolation_info =
+        isolation_info_iterator->second;
     network_loader_factory_to_use = current_context.cross_origin_factory;
   }
 
@@ -224,16 +233,33 @@ PrefetchURLLoaderService::~PrefetchURLLoaderService() = default;
 // renderer, so that it can be cached correctly.
 bool PrefetchURLLoaderService::IsValidCrossOriginPrefetch(
     const network::ResourceRequest& resource_request) {
+  // All fetches need to have an associated request_initiator.
+  if (!resource_request.request_initiator) {
+    mojo::ReportBadMessage("Prefetch/IsValidCrossOrigin: no request_initiator");
+    return false;
+  }
+
   // The request is expected to be cross-origin. Same-origin prefetches do not
   // need a special NetworkIsolationKey, and therefore must not be marked for
   // restricted use.
   url::Origin destination_origin = url::Origin::Create(resource_request.url);
-  // TODO(domfarolino): We want to check that the request's initiator is
-  // equivalent to the frame's last committed origin. If they are not equal, we
-  // must cancel the request.
-  if (!resource_request.request_initiator ||
-      resource_request.request_initiator->IsSameOriginWith(
+  DCHECK(resource_request.request_initiator.has_value());  // Checked above.
+  if (resource_request.request_initiator->IsSameOriginWith(
           destination_origin)) {
+    mojo::ReportBadMessage("Prefetch/IsValidCrossOrigin: same-origin");
+    return false;
+  }
+
+  // The request initiator has to match the request_initiator_site_lock - it has
+  // to be the same origin as the last committed origin in the frame.
+  const BindContext& current_context = *current_bind_context();
+  // Presence of |render_frame_host| is guaranteed by the caller - the caller
+  // calls earlier EnsureCrossOriginFactory which has the same DCHECK.
+  DCHECK(current_context.render_frame_host);
+  if (resource_request.request_initiator.value() !=
+      current_context.render_frame_host->GetLastCommittedOrigin()) {
+    mojo::ReportBadMessage(
+        "Prefetch/IsValidCrossOrigin: frame origin mismatch");
     return false;
   }
 
@@ -241,6 +267,7 @@ bool PrefetchURLLoaderService::IsValidCrossOriginPrefetch(
   // mode must be |kError|.
   if (base::FeatureList::IsEnabled(blink::features::kPrefetchPrivacyChanges) &&
       resource_request.redirect_mode != network::mojom::RedirectMode::kError) {
+    mojo::ReportBadMessage("Prefetch/IsValidCrossOrigin: wrong redirect mode");
     return false;
   }
 
@@ -248,20 +275,23 @@ bool PrefetchURLLoaderService::IsValidCrossOriginPrefetch(
   // the prefetch cache. This is because it is possible that another origin
   // prefetched the same resource, which should only be reused for top-level
   // navigations.
-  if (resource_request.load_flags & net::LOAD_CAN_USE_RESTRICTED_PREFETCH)
+  if (resource_request.load_flags & net::LOAD_CAN_USE_RESTRICTED_PREFETCH) {
+    mojo::ReportBadMessage(
+        "Prefetch/IsValidCrossOrigin: can use restricted prefetch");
     return false;
+  }
 
   // The request must not already have its |trusted_params| initialized.
-  if (resource_request.trusted_params)
+  if (resource_request.trusted_params) {
+    mojo::ReportBadMessage("Prefetch/IsValidCrossOrigin: trusted params");
     return false;
+  }
 
   return true;
 }
 
 void PrefetchURLLoaderService::EnsureCrossOriginFactory() {
-  DCHECK(base::FeatureList::IsEnabled(
-      network::features::kPrefetchMainResourceNetworkIsolationKey));
-  auto& current_context = *loader_factory_receivers_.current_context();
+  BindContext& current_context = *current_bind_context();
   // If the factory has already been created, don't re-create it.
   if (current_context.cross_origin_factory)
     return;
@@ -299,17 +329,18 @@ base::UnguessableToken PrefetchURLLoaderService::GenerateRecursivePrefetchToken(
   if (!current_context)
     return base::UnguessableToken::Create();
 
-  // Create NetworkIsolationKey.
+  // Create IsolationInfo.
   url::Origin destination_origin = url::Origin::Create(request.url);
-  net::NetworkIsolationKey preload_nik =
-      net::NetworkIsolationKey(destination_origin, destination_origin);
+  net::IsolationInfo preload_isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RedirectMode::kUpdateNothing, destination_origin,
+      destination_origin, net::SiteForCookies());
 
   // Generate token.
   base::UnguessableToken return_token = base::UnguessableToken::Create();
 
   // Associate the two, and return the token.
-  current_context->prefetch_network_isolation_keys.insert(
-      {return_token, preload_nik});
+  current_context->prefetch_isolation_infos.insert(
+      {return_token, preload_isolation_info});
   return return_token;
 }
 
diff --git a/chromium/content/browser/loader/prefetch_url_loader_service.h b/chromium/content/browser/loader/prefetch_url_loader_service.h
index 66785834ab6..98e29f04230 100644
--- a/chromium/content/browser/loader/prefetch_url_loader_service.h
+++ b/chromium/content/browser/loader/prefetch_url_loader_service.h
@@ -106,6 +106,10 @@ class CONTENT_EXPORT PrefetchURLLoaderService final
   CreateURLLoaderThrottles(const network::ResourceRequest& request,
                            int frame_tree_node_id);
 
+  const std::unique_ptr<BindContext>& current_bind_context() const {
+    return loader_factory_receivers_.current_context();
+  }
+
   scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter_;
   BrowserContext* browser_context_ = nullptr;
 
diff --git a/chromium/content/browser/loader/quic_transport_browsertest.cc b/chromium/content/browser/loader/quic_transport_browsertest.cc
index b41d03ee18a..cc588e56f18 100644
--- a/chromium/content/browser/loader/quic_transport_browsertest.cc
+++ b/chromium/content/browser/loader/quic_transport_browsertest.cc
@@ -19,6 +19,7 @@
 #include "base/threading/thread_restrictions.h"
 #include "components/network_session_configurator/common/network_switches.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -287,5 +288,52 @@ IN_PROC_BROWSER_TEST_F(QuicTransportBrowserTest, DISABLED_ReceiveStream) {
   ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("PASS"), {ASCIIToUTF16("FAIL")}));
 }
 
+IN_PROC_BROWSER_TEST_F(QuicTransportBrowserTest, BidirectionalStream) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html")));
+
+  ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("Title Of Awesomeness")));
+
+  ASSERT_TRUE(ExecuteScript(
+      shell(), base::StringPrintf(R"JS(
+    async function run() {
+      const transport = new QuicTransport('quic-transport://localhost:%d/echo');
+
+      await transport.ready;
+
+      const data = [65, 66, 67];
+
+      const bidiStream = await transport.createBidirectionalStream();
+      const writer = bidiStream.writable.getWriter();
+      await writer.write(new Uint8Array(data));
+
+      const reader = bidiStream.readable.getReader();
+
+      const {value, done: done1} = await reader.read();
+      if (done1) {
+        throw new Error('reading should not be done');
+      }
+      const actual = Array.from(value);
+      if (JSON.stringify(actual) !== JSON.stringify(data)) {
+        throw new Error('arrays do not match');
+      }
+
+      await writer.close();
+
+      const {done: done2} = await reader.read();
+      if (!done2) {
+        throw new Error('receiveStream should be done');
+      }
+    }
+
+    run().then(() => { document.title = 'PASS'; },
+               (e) => { console.log(e); document.title = 'FAIL'; });
+)JS",
+                                  server_.server_address().port())));
+
+  ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("PASS"), {ASCIIToUTF16("FAIL")}));
+}
+
 }  // namespace
 }  // namespace content
diff --git a/chromium/content/browser/loader/reload_cache_control_browsertest.cc b/chromium/content/browser/loader/reload_cache_control_browsertest.cc
index 702ef948995..25985d7c3bd 100644
--- a/chromium/content/browser/loader/reload_cache_control_browsertest.cc
+++ b/chromium/content/browser/loader/reload_cache_control_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/loader/resource_scheduler_browsertest.cc b/chromium/content/browser/loader/resource_scheduler_browsertest.cc
index f6ea7f5a0f3..c437c283c7a 100644
--- a/chromium/content/browser/loader/resource_scheduler_browsertest.cc
+++ b/chromium/content/browser/loader/resource_scheduler_browsertest.cc
@@ -5,6 +5,7 @@
 #include <map>
 #include <string>
 
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/locks/lock_manager_browsertest.cc b/chromium/content/browser/locks/lock_manager_browsertest.cc
index 251e501f859..17cd90ac2b6 100644
--- a/chromium/content/browser/locks/lock_manager_browsertest.cc
+++ b/chromium/content/browser/locks/lock_manager_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/feature_observer_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/manifest/manifest_browsertest.cc b/chromium/content/browser/manifest/manifest_browsertest.cc
index 86fb19002f4..e77855bd836 100644
--- a/chromium/content/browser/manifest/manifest_browsertest.cc
+++ b/chromium/content/browser/manifest/manifest_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -194,17 +195,18 @@ IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, NoManifest) {
 // If a page manifest points to a 404 URL, requesting the manifest should return
 // the empty manifest. However, the manifest URL will be non-empty.
 IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, 404Manifest) {
-  GURL test_url = GetTestUrl("manifest", "404-manifest.html");
+  GURL test_url = embedded_test_server()->GetURL("/manifest/404-manifest.html");
 
   ASSERT_TRUE(NavigateToURL(shell(), test_url));
 
   GetManifestAndWait();
   EXPECT_TRUE(manifest().IsEmpty());
   EXPECT_FALSE(manifest_url().is_empty());
-  EXPECT_EQ(0, GetConsoleErrorCount());
+  // 1 error for syntax errors in manifest/thereisnomanifestthere.json.
+  EXPECT_EQ(1, GetConsoleErrorCount());
   ASSERT_EQ(1u, reported_manifest_urls().size());
   EXPECT_EQ(manifest_url(), reported_manifest_urls()[0]);
-  EXPECT_EQ(0u, manifests_reported_when_favicon_url_updated().size());
+  EXPECT_EQ(1u, manifests_reported_when_favicon_url_updated().size());
 }
 
 // If a page has an empty manifest, requesting the manifest should return the
@@ -320,6 +322,22 @@ IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, DynamicManifest) {
   EXPECT_EQ(0, GetConsoleErrorCount());
 }
 
+// This page has a manifest with only file handlers specified. Asking
+// for just the manifest should succeed with a non empty manifest.
+IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, FileHandlerManifest) {
+  GURL test_url =
+      embedded_test_server()->GetURL("/manifest/file-handler-manifest.html");
+  ASSERT_TRUE(NavigateToURL(shell(), test_url));
+
+  GetManifestAndWait();
+  EXPECT_FALSE(manifest().IsEmpty());
+  EXPECT_FALSE(manifest_url().is_empty());
+  EXPECT_FALSE(manifest().file_handlers.empty());
+  EXPECT_EQ(0, GetConsoleErrorCount());
+  ASSERT_EQ(1u, reported_manifest_urls().size());
+  EXPECT_EQ(manifest_url(), reported_manifest_urls()[0]);
+}
+
 // If a page's manifest lives in a different origin, it should follow the CORS
 // rules and requesting the manifest should return an empty manifest (unless the
 // response contains CORS headers).
diff --git a/chromium/content/browser/manifest/manifest_manager_host.cc b/chromium/content/browser/manifest/manifest_manager_host.cc
index b063e0d1e98..68ea016c62e 100644
--- a/chromium/content/browser/manifest/manifest_manager_host.cc
+++ b/chromium/content/browser/manifest/manifest_manager_host.cc
@@ -9,25 +9,34 @@
 #include "base/bind.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/web_contents.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/manifest/manifest.h"
 
 namespace content {
 
-ManifestManagerHost::ManifestManagerHost(WebContents* web_contents)
-    : WebContentsObserver(web_contents),
-      manifest_url_change_observer_receivers_(web_contents, this) {}
+ManifestManagerHost::ManifestManagerHost(RenderFrameHost* render_frame_host)
+    : manifest_manager_frame_(render_frame_host) {
+  // Check that |manifest_manager_frame_| is a main frame.
+  DCHECK(!manifest_manager_frame_->GetParent());
+}
 
 ManifestManagerHost::~ManifestManagerHost() {
   OnConnectionError();
 }
 
-void ManifestManagerHost::RenderFrameDeleted(
-    RenderFrameHost* render_frame_host) {
-  if (render_frame_host == manifest_manager_frame_)
-    OnConnectionError();
+void ManifestManagerHost::BindObserver(
+    mojo::PendingAssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+        receiver) {
+  manifest_url_change_observer_receiver_.Bind(std::move(receiver));
+}
+
+ManifestManagerHost* ManifestManagerHost::GetOrCreateForCurrentDocument(
+    RenderFrameHostImpl* rfh) {
+  DCHECK(rfh->is_main_frame());
+  if (!GetForCurrentDocument(rfh))
+    CreateForCurrentDocument(rfh);
+  return GetForCurrentDocument(rfh);
 }
 
 void ManifestManagerHost::GetManifest(GetManifestCallback callback) {
@@ -45,11 +54,7 @@ void ManifestManagerHost::RequestManifestDebugInfo(
 }
 
 blink::mojom::ManifestManager& ManifestManagerHost::GetManifestManager() {
-  if (manifest_manager_frame_ != web_contents()->GetMainFrame())
-    OnConnectionError();
-
   if (!manifest_manager_) {
-    manifest_manager_frame_ = web_contents()->GetMainFrame();
     manifest_manager_frame_->GetRemoteInterfaces()->GetInterface(
         manifest_manager_.BindNewPipeAndPassReceiver());
     manifest_manager_.set_disconnect_handler(base::BindOnce(
@@ -59,8 +64,6 @@ blink::mojom::ManifestManager& ManifestManagerHost::GetManifestManager() {
 }
 
 void ManifestManagerHost::OnConnectionError() {
-  manifest_manager_frame_ = nullptr;
-  manifest_manager_.reset();
   std::vector<GetManifestCallback> callbacks;
   for (CallbackMap::iterator it(&callbacks_); !it.IsAtEnd(); it.Advance()) {
     callbacks.push_back(std::move(*it.GetCurrentValue()));
@@ -68,6 +71,10 @@ void ManifestManagerHost::OnConnectionError() {
   callbacks_.Clear();
   for (auto& callback : callbacks)
     std::move(callback).Run(GURL(), blink::Manifest());
+
+  if (GetForCurrentDocument(manifest_manager_frame_)) {
+    DeleteForCurrentDocument(manifest_manager_frame_);
+  }
 }
 
 void ManifestManagerHost::OnRequestManifestResponse(
@@ -81,12 +88,16 @@ void ManifestManagerHost::OnRequestManifestResponse(
 
 void ManifestManagerHost::ManifestUrlChanged(
     const base::Optional<GURL>& manifest_url) {
-  if (manifest_url_change_observer_receivers_.GetCurrentTargetFrame() !=
-      web_contents()->GetMainFrame()) {
+  if (!manifest_manager_frame_->IsCurrent())
     return;
-  }
-  static_cast<WebContentsImpl*>(web_contents())
+
+  // TODO(yuzus): |NotifyManifestUrlChanged| should start taking a
+  // |RenderFrameHost| parameter.
+  WebContents* web_contents =
+      WebContents::FromRenderFrameHost(manifest_manager_frame_);
+  static_cast<WebContentsImpl*>(web_contents)
       ->NotifyManifestUrlChanged(manifest_url);
 }
 
+RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(ManifestManagerHost)
 }  // namespace content
diff --git a/chromium/content/browser/manifest/manifest_manager_host.h b/chromium/content/browser/manifest/manifest_manager_host.h
index 3dc0bbf6e1a..57f51dc9fad 100644
--- a/chromium/content/browser/manifest/manifest_manager_host.h
+++ b/chromium/content/browser/manifest/manifest_manager_host.h
@@ -8,8 +8,8 @@
 #include "base/callback_forward.h"
 #include "base/containers/id_map.h"
 #include "base/macros.h"
-#include "content/public/browser/web_contents_observer.h"
-#include "content/public/browser/web_contents_receiver_set.h"
+#include "content/public/browser/render_document_host_user_data.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/manifest/manifest_manager.mojom.h"
 #include "third_party/blink/public/mojom/manifest/manifest_observer.mojom.h"
@@ -21,16 +21,16 @@ struct Manifest;
 namespace content {
 
 class RenderFrameHost;
-class WebContents;
+class RenderFrameHostImpl;
 
 // ManifestManagerHost is a helper class that allows callers to get the Manifest
 // associated with the main frame of the observed WebContents. It handles the
 // IPC messaging with the child process.
 // TODO(mlamouri): keep a cached version and a dirty bit here.
-class ManifestManagerHost : public WebContentsObserver,
-                            public blink::mojom::ManifestUrlChangeObserver {
+class ManifestManagerHost
+    : public RenderDocumentHostUserData<ManifestManagerHost>,
+      public blink::mojom::ManifestUrlChangeObserver {
  public:
-  explicit ManifestManagerHost(WebContents* web_contents);
   ~ManifestManagerHost() override;
 
   using GetManifestCallback =
@@ -44,10 +44,18 @@ class ManifestManagerHost : public WebContentsObserver,
   void RequestManifestDebugInfo(
       blink::mojom::ManifestManager::RequestManifestDebugInfoCallback callback);
 
-  // WebContentsObserver
-  void RenderFrameDeleted(RenderFrameHost* render_frame_host) override;
+  void BindObserver(
+      mojo::PendingAssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+          receiver);
+
+  static ManifestManagerHost* GetOrCreateForCurrentDocument(
+      RenderFrameHostImpl* rfh);
 
  private:
+  explicit ManifestManagerHost(RenderFrameHost* render_frame_host);
+
+  friend class RenderDocumentHostUserData<ManifestManagerHost>;
+
   using CallbackMap = base::IDMap<std::unique_ptr<GetManifestCallback>>;
 
   blink::mojom::ManifestManager& GetManifestManager();
@@ -60,13 +68,14 @@ class ManifestManagerHost : public WebContentsObserver,
   // blink::mojom::ManifestUrlChangeObserver:
   void ManifestUrlChanged(const base::Optional<GURL>& manifest_url) override;
 
-  RenderFrameHost* manifest_manager_frame_ = nullptr;
+  RenderFrameHost* manifest_manager_frame_;
   mojo::Remote<blink::mojom::ManifestManager> manifest_manager_;
   CallbackMap callbacks_;
 
-  WebContentsFrameReceiverSet<blink::mojom::ManifestUrlChangeObserver>
-      manifest_url_change_observer_receivers_;
+  mojo::AssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+      manifest_url_change_observer_receiver_{this};
 
+  RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL();
   DISALLOW_COPY_AND_ASSIGN(ManifestManagerHost);
 };
 
diff --git a/chromium/content/browser/media/android/media_player_renderer.cc b/chromium/content/browser/media/android/media_player_renderer.cc
index 8feb2629a20..e5fe440cc7b 100644
--- a/chromium/content/browser/media/android/media_player_renderer.cc
+++ b/chromium/content/browser/media/android/media_player_renderer.cc
@@ -6,7 +6,6 @@
 
 #include <memory>
 
-#include "base/android/build_info.h"
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/task/post_task.h"
@@ -118,17 +117,12 @@ void MediaPlayerRenderer::CreateMediaPlayer(
 
   const std::string user_agent = GetContentClient()->browser()->GetUserAgent();
 
-  // Never allow credentials on KitKat. See https://crbug.com/936566.
-  bool allow_credentials = url_params.allow_credentials &&
-                           base::android::BuildInfo::GetInstance()->sdk_int() >
-                               base::android::SDK_VERSION_KITKAT;
-
   media_player_.reset(new media::MediaPlayerBridge(
       url_params.media_url, url_params.site_for_cookies,
       url_params.top_frame_origin, user_agent,
       false,  // hide_url_log
       this,   // MediaPlayerBridge::Client
-      allow_credentials, url_params.is_hls));
+      url_params.allow_credentials, url_params.is_hls));
 
   media_player_->Initialize();
   UpdateVolume();
diff --git a/chromium/content/browser/media/android/media_resource_getter_impl.cc b/chromium/content/browser/media/android/media_resource_getter_impl.cc
index fb0d57dd3f2..b9124937651 100644
--- a/chromium/content/browser/media/android/media_resource_getter_impl.cc
+++ b/chromium/content/browser/media/android/media_resource_getter_impl.cc
@@ -12,6 +12,7 @@
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/file_system/browser_file_system_helper.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -19,6 +20,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
+#include "ipc/ipc_message.h"
 #include "media/base/android/media_url_interceptor.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/auth.h"
@@ -42,8 +44,7 @@ GetRestrictedCookieManagerForContext(
     const GURL& url,
     const net::SiteForCookies& site_for_cookies,
     const url::Origin& top_frame_origin,
-    int render_process_id,
-    int render_frame_id) {
+    RenderFrameHostImpl* render_frame_host) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   url::Origin origin = url::Origin::Create(url);
@@ -51,11 +52,17 @@ GetRestrictedCookieManagerForContext(
       BrowserContext::GetDefaultStoragePartition(browser_context);
 
   mojo::PendingRemote<network::mojom::RestrictedCookieManager> pipe;
-  storage_partition->CreateRestrictedCookieManager(
-      network::mojom::RestrictedCookieManagerRole::NETWORK, origin,
-      site_for_cookies, top_frame_origin,
-      /* is_service_worker = */ false, render_process_id, render_frame_id,
-      pipe.InitWithNewPipeAndPassReceiver());
+  static_cast<StoragePartitionImpl*>(storage_partition)
+      ->CreateRestrictedCookieManager(
+          network::mojom::RestrictedCookieManagerRole::NETWORK, origin,
+          site_for_cookies, top_frame_origin,
+          /* is_service_worker = */ false,
+          render_frame_host ? render_frame_host->GetProcess()->GetID() : -1,
+          render_frame_host ? render_frame_host->GetRoutingID()
+                            : MSG_ROUTING_NONE,
+          pipe.InitWithNewPipeAndPassReceiver(),
+          render_frame_host ? render_frame_host->CreateCookieAccessObserver()
+                            : mojo::NullRemote());
   return pipe;
 }
 
@@ -163,7 +170,7 @@ void MediaResourceGetterImpl::GetCookies(const GURL& url,
   mojo::Remote<network::mojom::RestrictedCookieManager> cookie_manager(
       GetRestrictedCookieManagerForContext(
           browser_context_, url, site_for_cookies, top_frame_origin,
-          render_process_id_, render_frame_id_));
+          RenderFrameHostImpl::FromID(render_process_id_, render_frame_id_)));
   network::mojom::RestrictedCookieManager* cookie_manager_ptr =
       cookie_manager.get();
   cookie_manager_ptr->GetCookiesString(
diff --git a/chromium/content/browser/media/audible_metrics.h b/chromium/content/browser/media/audible_metrics.h
index 94f191e0990..fa2397d307e 100644
--- a/chromium/content/browser/media/audible_metrics.h
+++ b/chromium/content/browser/media/audible_metrics.h
@@ -9,6 +9,7 @@
 #include <memory>
 #include <set>
 
+#include "base/macros.h"
 #include "base/time/tick_clock.h"
 #include "content/common/content_export.h"
 
diff --git a/chromium/content/browser/media/audio_input_stream_broker.cc b/chromium/content/browser/media/audio_input_stream_broker.cc
index 6773ee4dea4..45429d6995e 100644
--- a/chromium/content/browser/media/audio_input_stream_broker.cc
+++ b/chromium/content/browser/media/audio_input_stream_broker.cc
@@ -66,7 +66,6 @@ AudioInputStreamBroker::AudioInputStreamBroker(
     uint32_t shared_memory_count,
     media::UserInputMonitorBase* user_input_monitor,
     bool enable_agc,
-    audio::mojom::AudioProcessingConfigPtr processing_config,
     AudioStreamBroker::DeleterCallback deleter,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
         renderer_factory_client)
@@ -77,7 +76,6 @@ AudioInputStreamBroker::AudioInputStreamBroker(
       user_input_monitor_(user_input_monitor),
       enable_agc_(enable_agc),
       deleter_(std::move(deleter)),
-      processing_config_(std::move(processing_config)),
       renderer_factory_client_(std::move(renderer_factory_client)) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(renderer_factory_client_);
@@ -172,7 +170,7 @@ void AudioInputStreamBroker::CreateStream(
           media::AudioLogFactory::AudioComponent::AUDIO_INPUT_CONTROLLER,
           log_component_id, render_process_id(), render_frame_id()),
       device_id_, params_, shared_memory_count_, enable_agc_,
-      std::move(key_press_count_buffer), std::move(processing_config_),
+      std::move(key_press_count_buffer),
       base::BindOnce(&AudioInputStreamBroker::StreamCreated,
                      weak_ptr_factory_.GetWeakPtr(), std::move(stream)));
 }
diff --git a/chromium/content/browser/media/audio_input_stream_broker.h b/chromium/content/browser/media/audio_input_stream_broker.h
index 7cdfb9a59e5..c77b7edc1d2 100644
--- a/chromium/content/browser/media/audio_input_stream_broker.h
+++ b/chromium/content/browser/media/audio_input_stream_broker.h
@@ -19,7 +19,6 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
 
 namespace media {
@@ -42,7 +41,6 @@ class CONTENT_EXPORT AudioInputStreamBroker final
       uint32_t shared_memory_count,
       media::UserInputMonitorBase* user_input_monitor,
       bool enable_agc,
-      audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client);
@@ -76,7 +74,6 @@ class CONTENT_EXPORT AudioInputStreamBroker final
 
   DeleterCallback deleter_;
 
-  audio::mojom::AudioProcessingConfigPtr processing_config_;
   mojo::Remote<mojom::RendererAudioInputStreamFactoryClient>
       renderer_factory_client_;
   mojo::Receiver<AudioInputStreamObserver> observer_receiver_{this};
diff --git a/chromium/content/browser/media/audio_input_stream_broker_unittest.cc b/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
index 7d9a264e004..6c028e0a786 100644
--- a/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
+++ b/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
@@ -118,7 +118,6 @@ class MockStreamFactory : public audio::FakeStreamFactory {
       uint32_t shared_memory_count,
       bool enable_agc,
       base::ReadOnlySharedMemoryRegion key_press_count_buffer,
-      audio::mojom::AudioProcessingConfigPtr processing_config,
       CreateInputStreamCallback created_callback) override {
     // No way to cleanly exit the test here in case of failure, so use CHECK.
     CHECK(stream_request_data_);
@@ -150,7 +149,6 @@ struct TestEnvironment {
             kShMemCount,
             nullptr /*user_input_monitor*/,
             kEnableAgc,
-            nullptr,
             deleter.Get(),
             renderer_factory_client.MakeRemote())) {}
 
@@ -174,7 +172,7 @@ TEST(AudioInputStreamBrokerTest, StoresProcessAndFrameId) {
 
   AudioInputStreamBroker broker(
       kRenderProcessId, kRenderFrameId, kDeviceId, TestParams(), kShMemCount,
-      nullptr /*user_input_monitor*/, kEnableAgc, nullptr, deleter.Get(),
+      nullptr /*user_input_monitor*/, kEnableAgc, deleter.Get(),
       renderer_factory_client.MakeRemote());
 
   EXPECT_EQ(kRenderProcessId, broker.render_process_id());
diff --git a/chromium/content/browser/media/audio_loopback_stream_broker.cc b/chromium/content/browser/media/audio_loopback_stream_broker.cc
index adcc342731c..034c0e5edc6 100644
--- a/chromium/content/browser/media/audio_loopback_stream_broker.cc
+++ b/chromium/content/browser/media/audio_loopback_stream_broker.cc
@@ -7,8 +7,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/task/post_task.h"
 #include "base/unguessable_token.h"
 #include "content/public/browser/browser_task_traits.h"
diff --git a/chromium/content/browser/media/audio_output_stream_broker.cc b/chromium/content/browser/media/audio_output_stream_broker.cc
index 4f113129f13..9edb6597fe5 100644
--- a/chromium/content/browser/media/audio_output_stream_broker.cc
+++ b/chromium/content/browser/media/audio_output_stream_broker.cc
@@ -67,14 +67,12 @@ AudioOutputStreamBroker::AudioOutputStreamBroker(
     const std::string& output_device_id,
     const media::AudioParameters& params,
     const base::UnguessableToken& group_id,
-    const base::Optional<base::UnguessableToken>& processing_id,
     DeleterCallback deleter,
     mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
     : AudioStreamBroker(render_process_id, render_frame_id),
       output_device_id_(output_device_id),
       params_(params),
       group_id_(group_id),
-      processing_id_(processing_id),
       deleter_(std::move(deleter)),
       client_(std::move(client)),
       observer_(render_process_id, render_frame_id, stream_id),
@@ -111,15 +109,6 @@ AudioOutputStreamBroker::~AudioOutputStreamBroker() {
   TRACE_EVENT_NESTABLE_ASYNC_END1("audio", "AudioOutputStreamBroker", this,
                                   "disconnect reason",
                                   static_cast<uint32_t>(reason));
-
-  UMA_HISTOGRAM_ENUMERATION("Media.Audio.Render.StreamBrokerDisconnectReason2",
-                            reason);
-
-  if (AwaitingCreated()) {
-    UMA_HISTOGRAM_TIMES(
-        "Media.Audio.Render.StreamBrokerDocumentDestroyedAwaitingCreatedTime",
-        base::TimeTicks::Now() - stream_creation_start_time_);
-  }
 }
 
 void AudioOutputStreamBroker::CreateStream(
@@ -150,7 +139,7 @@ void AudioOutputStreamBroker::CreateStream(
       MediaInternals::GetInstance()->CreateMojoAudioLog(
           media::AudioLogFactory::AudioComponent::AUDIO_OUTPUT_CONTROLLER,
           log_component_id, render_process_id(), render_frame_id()),
-      output_device_id_, params_, group_id_, processing_id_,
+      output_device_id_, params_, group_id_,
       base::BindOnce(&AudioOutputStreamBroker::StreamCreated,
                      weak_ptr_factory_.GetWeakPtr(), std::move(stream)));
 }
@@ -161,8 +150,6 @@ void AudioOutputStreamBroker::StreamCreated(
   DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
   TRACE_EVENT_NESTABLE_ASYNC_END1("audio", "CreateStream", this, "success",
                                   !!data_pipe);
-  UMA_HISTOGRAM_TIMES("Media.Audio.Render.StreamBrokerStreamCreationTime",
-                      base::TimeTicks::Now() - stream_creation_start_time_);
   stream_creation_start_time_ = base::TimeTicks();
 
   if (!data_pipe) {
diff --git a/chromium/content/browser/media/audio_output_stream_broker.h b/chromium/content/browser/media/audio_output_stream_broker.h
index d209cb22d7b..c9bac8dd8fb 100644
--- a/chromium/content/browser/media/audio_output_stream_broker.h
+++ b/chromium/content/browser/media/audio_output_stream_broker.h
@@ -36,7 +36,6 @@ class CONTENT_EXPORT AudioOutputStreamBroker final : public AudioStreamBroker {
       const std::string& output_device_id,
       const media::AudioParameters& params,
       const base::UnguessableToken& group_id,
-      const base::Optional<base::UnguessableToken>& processing_id,
       DeleterCallback deleter,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
           client);
@@ -62,7 +61,6 @@ class CONTENT_EXPORT AudioOutputStreamBroker final : public AudioStreamBroker {
   const std::string output_device_id_;
   const media::AudioParameters params_;
   const base::UnguessableToken group_id_;
-  const base::Optional<base::UnguessableToken> processing_id_;
 
   // Set while CreateStream() has been called, but not StreamCreated().
   base::TimeTicks stream_creation_start_time_;
diff --git a/chromium/content/browser/media/audio_output_stream_broker_unittest.cc b/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
index 2fa2667fd50..2e5a2d475e3 100644
--- a/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
+++ b/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
@@ -121,7 +121,6 @@ class MockStreamFactory : public audio::FakeStreamFactory {
       const std::string& output_device_id,
       const media::AudioParameters& params,
       const base::UnguessableToken& group_id,
-      const base::Optional<base::UnguessableToken>& processing_id,
       CreateOutputStreamCallback created_callback) final {
     // No way to cleanly exit the test here in case of failure, so use CHECK.
     CHECK(stream_request_data_);
@@ -150,7 +149,6 @@ struct TestEnvironment {
             kDeviceId,
             TestParams(),
             group,
-            base::nullopt,
             deleter.Get(),
             provider_client.MakePendingRemote())) {}
 
@@ -175,7 +173,7 @@ TEST(AudioOutputStreamBrokerTest, StoresProcessAndFrameId) {
 
   AudioOutputStreamBroker broker(
       kRenderProcessId, kRenderFrameId, kStreamId, kDeviceId, TestParams(),
-      base::UnguessableToken::Create(), base::nullopt, deleter.Get(),
+      base::UnguessableToken::Create(), deleter.Get(),
       provider_client.MakePendingRemote());
 
   EXPECT_EQ(kRenderProcessId, broker.render_process_id());
diff --git a/chromium/content/browser/media/audio_stream_broker.cc b/chromium/content/browser/media/audio_stream_broker.cc
index 184f4088c0c..bfe35ab87d2 100644
--- a/chromium/content/browser/media/audio_stream_broker.cc
+++ b/chromium/content/browser/media/audio_stream_broker.cc
@@ -33,14 +33,12 @@ class AudioStreamBrokerFactoryImpl final : public AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       media::UserInputMonitorBase* user_input_monitor,
       bool enable_agc,
-      audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client) final {
     return std::make_unique<AudioInputStreamBroker>(
         render_process_id, render_frame_id, device_id, params,
-        shared_memory_count, user_input_monitor, enable_agc,
-        std::move(processing_config), std::move(deleter),
+        shared_memory_count, user_input_monitor, enable_agc, std::move(deleter),
         std::move(renderer_factory_client));
   }
 
@@ -66,13 +64,12 @@ class AudioStreamBrokerFactoryImpl final : public AudioStreamBrokerFactory {
       const std::string& output_device_id,
       const media::AudioParameters& params,
       const base::UnguessableToken& group_id,
-      const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
       final {
     return std::make_unique<AudioOutputStreamBroker>(
         render_process_id, render_frame_id, stream_id, output_device_id, params,
-        group_id, processing_id, std::move(deleter), std::move(client));
+        group_id, std::move(deleter), std::move(client));
   }
 };
 
diff --git a/chromium/content/browser/media/audio_stream_broker.h b/chromium/content/browser/media/audio_stream_broker.h
index 65b69641882..fd80dd51c2f 100644
--- a/chromium/content/browser/media/audio_stream_broker.h
+++ b/chromium/content/browser/media/audio_stream_broker.h
@@ -17,7 +17,6 @@
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace audio {
 namespace mojom {
@@ -106,7 +105,6 @@ class CONTENT_EXPORT AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       media::UserInputMonitorBase* user_input_monitor,
       bool enable_agc,
-      audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client) = 0;
@@ -129,7 +127,6 @@ class CONTENT_EXPORT AudioStreamBrokerFactory {
       const std::string& output_device_id,
       const media::AudioParameters& params,
       const base::UnguessableToken& group_id,
-      const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
           client) = 0;
diff --git a/chromium/content/browser/media/capture/aura_window_video_capture_device_browsertest.cc b/chromium/content/browser/media/capture/aura_window_video_capture_device_browsertest.cc
index dd854ab48ce..9cbeed4d268 100644
--- a/chromium/content/browser/media/capture/aura_window_video_capture_device_browsertest.cc
+++ b/chromium/content/browser/media/capture/aura_window_video_capture_device_browsertest.cc
@@ -19,6 +19,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/desktop_media_id.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/video_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/browser/media/capture/desktop_capture_device.cc b/chromium/content/browser/media/capture/desktop_capture_device.cc
index a766c97453e..3385690f9b9 100644
--- a/chromium/content/browser/media/capture/desktop_capture_device.cc
+++ b/chromium/content/browser/media/capture/desktop_capture_device.cc
@@ -10,12 +10,13 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/message_loop/message_pump_type.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/synchronization/lock.h"
diff --git a/chromium/content/browser/media/capture/frame_sink_video_capture_device.cc b/chromium/content/browser/media/capture/frame_sink_video_capture_device.cc
index 3c93ee9dfe6..549e6563c0d 100644
--- a/chromium/content/browser/media/capture/frame_sink_video_capture_device.cc
+++ b/chromium/content/browser/media/capture/frame_sink_video_capture_device.cc
@@ -8,11 +8,12 @@
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/callback_helpers.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
diff --git a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller.cc b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller.cc
index 0bc6700725b..15f52176353 100644
--- a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller.cc
+++ b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller.cc
@@ -9,7 +9,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
@@ -55,8 +55,8 @@ void MouseCursorOverlayController::OnMouseMoved(const gfx::PointF& location) {
       mouse_move_start_location_ = location;
       mouse_activity_ended_timer_.Start(
           FROM_HERE, kIdleTimeout,
-          base::BindRepeating(&MouseCursorOverlayController::OnMouseHasGoneIdle,
-                              base::Unretained(this)));
+          base::BindOnce(&MouseCursorOverlayController::OnMouseHasGoneIdle,
+                         base::Unretained(this)));
       break;
     case kStartingToMove:
       if (std::abs(location.x() - mouse_move_start_location_.x()) >
@@ -85,8 +85,8 @@ void MouseCursorOverlayController::OnMouseClicked(const gfx::PointF& location) {
   } else {
     mouse_activity_ended_timer_.Start(
         FROM_HERE, kIdleTimeout,
-        base::BindRepeating(&MouseCursorOverlayController::OnMouseHasGoneIdle,
-                            base::Unretained(this)));
+        base::BindOnce(&MouseCursorOverlayController::OnMouseHasGoneIdle,
+                       base::Unretained(this)));
   }
   set_mouse_move_behavior(kRecentlyMovedOrClicked);
 
diff --git a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_aura.cc b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_aura.cc
index 34a3f7e49b3..4c6d8bf832e 100644
--- a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_aura.cc
+++ b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_aura.cc
@@ -9,7 +9,7 @@
 #include "ui/base/cursor/cursor.h"
 #include "ui/base/cursor/cursor_loader.h"
 #include "ui/base/cursor/cursor_lookup.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/events/event.h"
 #include "ui/events/event_handler.h"
 #include "ui/wm/public/activation_client.h"
diff --git a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_browsertest.cc b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_browsertest.cc
index ed89507b5df..3273303ed79 100644
--- a/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_browsertest.cc
+++ b/chromium/content/browser/media/capture/mouse_cursor_overlay_controller_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/browser/media/capture/screen_capture_device_android.cc b/chromium/content/browser/media/capture/screen_capture_device_android.cc
index d97c36be52c..098a40b4819 100644
--- a/chromium/content/browser/media/capture/screen_capture_device_android.cc
+++ b/chromium/content/browser/media/capture/screen_capture_device_android.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "media/capture/content/android/thread_safe_capture_oracle.h"
 
 namespace content {
diff --git a/chromium/content/browser/media/capture/web_contents_video_capture_device_browsertest.cc b/chromium/content/browser/media/capture/web_contents_video_capture_device_browsertest.cc
index 3e9b8896125..2c651c8b050 100644
--- a/chromium/content/browser/media/capture/web_contents_video_capture_device_browsertest.cc
+++ b/chromium/content/browser/media/capture/web_contents_video_capture_device_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/video_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/browser/media/cdm_registry_impl_unittest.cc b/chromium/content/browser/media/cdm_registry_impl_unittest.cc
index e919de1d1e0..73e4d43e894 100644
--- a/chromium/content/browser/media/cdm_registry_impl_unittest.cc
+++ b/chromium/content/browser/media/cdm_registry_impl_unittest.cc
@@ -27,7 +27,6 @@ namespace {
 using VideoCodec = media::VideoCodec;
 using EncryptionScheme = media::EncryptionScheme;
 using CdmSessionType = media::CdmSessionType;
-using CdmProxy = media::CdmProxy;
 
 const char kTestCdmName[] = "Test CDM";
 const char kAlternateCdmName[] = "Alternate CDM";
@@ -58,9 +57,6 @@ bool StlEquals(const Container a, std::initializer_list<T> b) {
 #define EXPECT_SESSION_TYPES(...) \
   EXPECT_STL_EQ(cdm.capability.session_types, __VA_ARGS__)
 
-#define EXPECT_CDM_PROXY_PROTOCOLS(...) \
-  EXPECT_STL_EQ(cdm.capability.cdm_proxy_protocols, __VA_ARGS__)
-
 }  // namespace
 
 // For simplicity and to make failures easier to diagnose, this test uses
@@ -77,8 +73,7 @@ class CdmRegistryImplTest : public testing::Test {
         base::FilePath::FromUTF8Unsafe(kTestPath), kTestFileSystemId,
         CdmCapability(
             {media::kCodecVP8, media::kCodecVP9}, {EncryptionScheme::kCenc},
-            {CdmSessionType::kTemporary, CdmSessionType::kPersistentLicense},
-            {CdmProxy::Protocol::kIntel}),
+            {CdmSessionType::kTemporary, CdmSessionType::kPersistentLicense}),
         kTestKeySystem, /*supports_sub_key_systems=*/true);
   }
 
@@ -121,7 +116,6 @@ TEST_F(CdmRegistryImplTest, Register) {
   EXPECT_ENCRYPTION_SCHEMES(EncryptionScheme::kCenc);
   EXPECT_SESSION_TYPES(CdmSessionType::kTemporary,
                        CdmSessionType::kPersistentLicense);
-  EXPECT_CDM_PROXY_PROTOCOLS(CdmProxy::Protocol::kIntel);
   EXPECT_EQ(kTestKeySystem, cdm.supported_key_system);
   EXPECT_TRUE(cdm.supports_sub_key_systems);
 }
diff --git a/chromium/content/browser/media/encrypted_media_browsertest.cc b/chromium/content/browser/media/encrypted_media_browsertest.cc
index 8778dfcceda..31035dc8540 100644
--- a/chromium/content/browser/media/encrypted_media_browsertest.cc
+++ b/chromium/content/browser/media/encrypted_media_browsertest.cc
@@ -11,6 +11,7 @@
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/media.h"
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory.cc b/chromium/content/browser/media/forwarding_audio_stream_factory.cc
index 1ba3ccd16e4..e711cf4165b 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory.cc
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory.cc
@@ -7,8 +7,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/no_destructor.h"
 #include "base/stl_util.h"
 #include "base/task/post_task.h"
@@ -80,7 +80,6 @@ void ForwardingAudioStreamFactory::Core::CreateInputStream(
     const media::AudioParameters& params,
     uint32_t shared_memory_count,
     bool enable_agc,
-    audio::mojom::AudioProcessingConfigPtr processing_config,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
         renderer_factory_client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -90,7 +89,6 @@ void ForwardingAudioStreamFactory::Core::CreateInputStream(
       .insert(broker_factory_->CreateAudioInputStreamBroker(
           render_process_id, render_frame_id, device_id, params,
           shared_memory_count, user_input_monitor_, enable_agc,
-          std::move(processing_config),
           base::BindOnce(&ForwardingAudioStreamFactory::Core::RemoveInput,
                          base::Unretained(this)),
           std::move(renderer_factory_client)))
@@ -115,7 +113,6 @@ void ForwardingAudioStreamFactory::Core::CreateOutputStream(
     int render_frame_id,
     const std::string& device_id,
     const media::AudioParameters& params,
-    const base::Optional<base::UnguessableToken>& processing_id,
     mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
@@ -123,7 +120,7 @@ void ForwardingAudioStreamFactory::Core::CreateOutputStream(
   outputs_
       .insert(broker_factory_->CreateAudioOutputStreamBroker(
           render_process_id, render_frame_id, ++stream_id_counter_, device_id,
-          params, group_id_, processing_id,
+          params, group_id_,
           base::BindOnce(&ForwardingAudioStreamFactory::Core::RemoveOutput,
                          base::Unretained(this)),
           std::move(client)))
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory.h b/chromium/content/browser/media/forwarding_audio_stream_factory.h
index fe464f56e62..7ba03b9c375 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory.h
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory.h
@@ -23,7 +23,6 @@
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
 
 namespace media {
@@ -74,7 +73,6 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
         const media::AudioParameters& params,
         uint32_t shared_memory_count,
         bool enable_agc,
-        audio::mojom::AudioProcessingConfigPtr processing_config,
         mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
             renderer_factory_client);
 
@@ -87,7 +85,6 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
         int render_frame_id,
         const std::string& device_id,
         const media::AudioParameters& params,
-        const base::Optional<base::UnguessableToken>& processing_id,
         mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
             client);
 
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc b/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
index 9b16ba5598f..fa9ae1c9b58 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
@@ -109,7 +109,6 @@ class MockBrokerFactory : public AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       media::UserInputMonitorBase* user_input_monitor,
       bool enable_agc,
-      audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client) final {
@@ -130,7 +129,6 @@ class MockBrokerFactory : public AudioStreamBrokerFactory {
       const std::string& output_device_id,
       const media::AudioParameters& params,
       const base::UnguessableToken& group_id,
-      const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
       final {
@@ -207,8 +205,8 @@ class ForwardingAudioStreamFactoryTest : public RenderViewHostTestHarness {
       mojo::PendingReceiver<audio::mojom::StreamFactory> receiver) {
     stream_factory_.receiver_.Bind(std::move(receiver));
     stream_factory_.receiver_.set_disconnect_handler(
-        base::BindRepeating(&audio::FakeStreamFactory::ResetReceiver,
-                            base::Unretained(&stream_factory_)));
+        base::BindOnce(&audio::FakeStreamFactory::ResetReceiver,
+                       base::Unretained(&stream_factory_)));
   }
 
   base::WeakPtr<MockBroker> ExpectLoopbackBrokerConstruction(
@@ -272,7 +270,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, CreateInputStream_CreatesInputStream) {
   factory.core()->CreateInputStream(main_rfh()->GetProcess()->GetID(),
                                     main_rfh()->GetRoutingID(), kInputDeviceId,
                                     kParams, kSharedMemoryCount, kEnableAgc,
-                                    nullptr, std::move(client));
+                                    std::move(client));
 }
 
 TEST_F(ForwardingAudioStreamFactoryTest,
@@ -311,7 +309,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-      kOutputDeviceId, kParams, base::nullopt, std::move(client));
+      kOutputDeviceId, kParams, std::move(client));
 }
 
 TEST_F(ForwardingAudioStreamFactoryTest,
@@ -331,7 +329,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(client));
     testing::Mock::VerifyAndClear(&*main_rfh_broker);
   }
@@ -341,7 +339,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(client));
     testing::Mock::VerifyAndClear(&*other_rfh_broker);
   }
@@ -412,7 +410,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(client));
+        kOutputDeviceId, kParams, std::move(client));
     testing::Mock::VerifyAndClear(&*main_rfh_broker);
   }
   {
@@ -421,7 +419,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(client));
+        kOutputDeviceId, kParams, std::move(client));
     testing::Mock::VerifyAndClear(&*other_rfh_broker);
   }
 
@@ -464,7 +462,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
     ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(input_client));
     testing::Mock::VerifyAndClear(&*main_rfh_input_broker);
   }
@@ -475,7 +473,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
     ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(input_client));
     testing::Mock::VerifyAndClear(&*other_rfh_input_broker);
   }
@@ -510,7 +508,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
     ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
+        kOutputDeviceId, kParams, std::move(output_client));
     testing::Mock::VerifyAndClear(&*main_rfh_output_broker);
   }
   {
@@ -520,7 +518,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
     ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
+        kOutputDeviceId, kParams, std::move(output_client));
     testing::Mock::VerifyAndClear(&*other_rfh_output_broker);
   }
 
@@ -558,13 +556,13 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyWebContents_DestroysStreams) {
   factory.core()->CreateInputStream(main_rfh()->GetProcess()->GetID(),
                                     main_rfh()->GetRoutingID(), kInputDeviceId,
                                     kParams, kSharedMemoryCount, kEnableAgc,
-                                    nullptr, std::move(input_client));
+                                    std::move(input_client));
 
   EXPECT_CALL(*output_broker, CreateStream(NotNull()));
   ignore_result(output_client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-      kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
+      kOutputDeviceId, kParams, std::move(output_client));
 
   DeleteContents();
   base::RunLoop().RunUntilIdle();
@@ -597,7 +595,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
     ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(input_client));
     testing::Mock::VerifyAndClear(&*main_rfh_input_broker);
   }
@@ -608,7 +606,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
     ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
+        kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc,
         std::move(input_client));
     testing::Mock::VerifyAndClear(&*other_rfh_input_broker);
   }
@@ -620,7 +618,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
     ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
+        kOutputDeviceId, kParams, std::move(output_client));
     testing::Mock::VerifyAndClear(&*main_rfh_output_broker);
   }
   {
@@ -630,7 +628,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
     ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
+        kOutputDeviceId, kParams, std::move(output_client));
     testing::Mock::VerifyAndClear(&*other_rfh_output_broker);
   }
 
@@ -686,7 +684,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, MuteWithOutputStream_ConnectsMuter) {
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-      kOutputDeviceId, kParams, base::nullopt, std::move(client));
+      kOutputDeviceId, kParams, std::move(client));
   base::RunLoop().RunUntilIdle();
   testing::Mock::VerifyAndClear(&*broker);
 
@@ -727,7 +725,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-      kOutputDeviceId, kParams, base::nullopt, std::move(client));
+      kOutputDeviceId, kParams, std::move(client));
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(factory.IsMuted());
   EXPECT_TRUE(stream_factory_.IsConnected());
@@ -757,7 +755,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(client));
+        kOutputDeviceId, kParams, std::move(client));
     base::RunLoop().RunUntilIdle();
     testing::Mock::VerifyAndClear(&*broker);
   }
@@ -776,7 +774,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
     ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
-        kOutputDeviceId, kParams, base::nullopt, std::move(client));
+        kOutputDeviceId, kParams, std::move(client));
     base::RunLoop().RunUntilIdle();
     testing::Mock::VerifyAndClear(&*another_broker);
   }
diff --git a/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc b/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
index a941bb86c5f..a90f9325606 100644
--- a/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
+++ b/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/task/post_task.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -84,8 +84,7 @@ void CreateSystemWideLoopbackStreamHelper(
   const bool enable_agc = false;
   factory->CreateInputStream(
       -1, -1, media::AudioDeviceDescription::kLoopbackWithMuteDeviceId, params,
-      total_segments, enable_agc, nullptr /* processing_config */,
-      std::move(client_remote));
+      total_segments, enable_agc, std::move(client_remote));
 }
 
 }  // namespace
diff --git a/chromium/content/browser/media/key_system_support_impl.cc b/chromium/content/browser/media/key_system_support_impl.cc
index 51b74658818..369809695ae 100644
--- a/chromium/content/browser/media/key_system_support_impl.cc
+++ b/chromium/content/browser/media/key_system_support_impl.cc
@@ -80,7 +80,6 @@ bool IsHardwareSecureCodecsOverriddenFromCommandLine(
 
 void GetHardwareSecureDecryptionCaps(
     const std::string& key_system,
-    const base::flat_set<media::CdmProxy::Protocol>& cdm_proxy_protocols,
     std::vector<media::VideoCodec>* video_codecs,
     std::vector<media::EncryptionScheme>* encryption_schemes) {
   DCHECK(video_codecs->empty());
@@ -98,11 +97,6 @@ void GetHardwareSecureDecryptionCaps(
     return;
   }
 
-  if (cdm_proxy_protocols.empty()) {
-    DVLOG(1) << "CDM does not support any CdmProxy protocols";
-    return;
-  }
-
   // Hardware secure video codecs need hardware video decoder support.
   // TODO(xhwang): Make sure this check is as close as possible to the check
   // in the render process. For example, also check check GPU features like
@@ -123,8 +117,7 @@ void GetHardwareSecureDecryptionCaps(
   base::flat_set<media::EncryptionScheme> encryption_scheme_set;
 
   GetContentClient()->browser()->GetHardwareSecureDecryptionCaps(
-      key_system, cdm_proxy_protocols, &video_codec_set,
-      &encryption_scheme_set);
+      key_system, &video_codec_set, &encryption_scheme_set);
 
   *video_codecs = SetToVector(video_codec_set);
   *encryption_schemes = SetToVector(encryption_scheme_set);
@@ -184,7 +177,6 @@ void KeySystemSupportImpl::IsKeySystemSupported(
       SetToVector(cdm_info->capability.encryption_schemes);
 
   GetHardwareSecureDecryptionCaps(key_system,
-                                  cdm_info->capability.cdm_proxy_protocols,
                                   &capability->hw_secure_video_codecs,
                                   &capability->hw_secure_encryption_schemes);
 
diff --git a/chromium/content/browser/media/key_system_support_impl_unittest.cc b/chromium/content/browser/media/key_system_support_impl_unittest.cc
index e687ae11535..fb3a457ec97 100644
--- a/chromium/content/browser/media/key_system_support_impl_unittest.cc
+++ b/chromium/content/browser/media/key_system_support_impl_unittest.cc
@@ -69,7 +69,7 @@ class KeySystemSupportTest : public testing::Test {
     return CdmCapability(
         {VideoCodec::kCodecVP8, VideoCodec::kCodecVP9},
         {EncryptionScheme::kCenc, EncryptionScheme::kCbcs},
-        {CdmSessionType::kTemporary, CdmSessionType::kPersistentLicense}, {});
+        {CdmSessionType::kTemporary, CdmSessionType::kPersistentLicense});
   }
 
   // Registers |key_system| with |capability|. All other values for CdmInfo have
diff --git a/chromium/content/browser/media/media_browsertest.cc b/chromium/content/browser/media/media_browsertest.cc
index 626c5cd2c46..a29d792d29b 100644
--- a/chromium/content/browser/media/media_browsertest.cc
+++ b/chromium/content/browser/media/media_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -35,11 +36,6 @@ void MediaBrowserTest::SetUpCommandLine(base::CommandLine* command_line) {
       switches::kAutoplayPolicy,
       switches::autoplay::kNoUserGestureRequiredPolicy);
   command_line->AppendSwitch(switches::kExposeInternalsForTesting);
-#if defined(OS_LINUX)
-  // Due to problems with PulseAudio failing to start, use a fake audio
-  // stream. crbug.com/1047655#c70
-  command_line->AppendSwitch(switches::kDisableAudioOutput);
-#endif
 
   std::vector<base::Feature> enabled_features = {
 #if defined(OS_ANDROID)
@@ -51,6 +47,12 @@ void MediaBrowserTest::SetUpCommandLine(base::CommandLine* command_line) {
     // Disable fallback after decode error to avoid unexpected test pass on
     // the fallback path.
     media::kFallbackAfterDecodeError,
+
+#if defined(OS_LINUX)
+    // Disable out of process audio on Linux due to process spawn
+    // failures. http://crbug.com/986021
+    features::kAudioServiceOutOfProcess,
+#endif
   };
 
   scoped_feature_list_.InitWithFeatures(enabled_features, disabled_features);
@@ -336,10 +338,16 @@ IN_PROC_BROWSER_TEST_P(MediaTest, VideoErrorEmptySrcAttribute) {
 }
 
 IN_PROC_BROWSER_TEST_P(MediaTest, VideoErrorNoSupportedStreams) {
-  RunErrorMessageTest(
-      "video", "no_streams.webm",
-      "DEMUXER_ERROR_NO_SUPPORTED_STREAMS: FFmpegDemuxer: no supported streams",
-      GetParam());
+  // The test doesn't work from file: scheme without AllowFileAccessFromFiles.
+  // TODO(wolenetz): https://crbug.com/1071473: Investigate and reenable the
+  // test.
+  if (!GetParam())
+    return;
+
+  RunErrorMessageTest("video", "no_streams.webm",
+                      "DEMUXER_ERROR_NO_SUPPORTED_STREAMS: FFmpegDemuxer: no "
+                      "supported streams",
+                      GetParam());
 }
 
 // Covers tear-down when navigating away as opposed to browser exiting.
diff --git a/chromium/content/browser/media/media_canplaytype_browsertest.cc b/chromium/content/browser/media/media_canplaytype_browsertest.cc
index 29aa48acb48..3e8d10e6f50 100644
--- a/chromium/content/browser/media/media_canplaytype_browsertest.cc
+++ b/chromium/content/browser/media/media_canplaytype_browsertest.cc
@@ -10,6 +10,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/media/media_capabilities_browsertest.cc b/chromium/content/browser/media/media_capabilities_browsertest.cc
index 4452f1c5116..423b87a6d90 100644
--- a/chromium/content/browser/media/media_capabilities_browsertest.cc
+++ b/chromium/content/browser/media/media_capabilities_browsertest.cc
@@ -34,7 +34,13 @@ const char* kPropSupported = kSupported;
 const char* kPropSupported = kUnsupported;
 #endif  // USE_PROPRIETARY_CODECS
 
-enum StreamType { kAudio, kVideo, kAudioWithSpatialRendering };
+enum StreamType {
+  kAudio,
+  kVideo,
+  kAudioWithSpatialRendering,
+  kVideoWithHdrMetadata,
+  kVideoWithoutHdrMetadata
+};
 
 enum ConfigType { kFile, kMediaSource };
 
@@ -48,9 +54,9 @@ class MediaCapabilitiesTest : public ContentBrowserTest {
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
-                                    "MediaCapabilities");
-    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
                                     "MediaCapabilitiesSpatialAudio");
+    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
+                                    "MediaCapabilitiesDynamicRange");
   }
 
   std::string CanDecodeAudio(const std::string& config_type,
@@ -71,16 +77,58 @@ class MediaCapabilitiesTest : public ContentBrowserTest {
                      StreamType::kAudioWithSpatialRendering, spatial_rendering);
   }
 
+  std::string CanDecodeVideoWithHdrMetadata(
+      const std::string& config_type,
+      const std::string& content_type,
+      const std::string& color_gamut,
+      const std::string& transfer_function,
+      const std::string& hdr_metadata_type = "") {
+    StreamType stream_type = StreamType::kVideoWithHdrMetadata;
+    if (hdr_metadata_type == "")
+      stream_type = StreamType::kVideoWithoutHdrMetadata;
+
+    return CanDecode(config_type, content_type, stream_type,
+                     /* spatialRendering */ false, hdr_metadata_type,
+                     color_gamut, transfer_function);
+  }
+
   std::string CanDecode(const std::string& config_type,
                         const std::string& content_type,
                         StreamType stream_type,
-                        const bool& spatial_rendering = false) {
+                        const bool& spatial_rendering = false,
+                        const std::string& hdr_metadata_type = "",
+                        const std::string& color_gamut = "",
+                        const std::string& transfer_function = "") {
     std::string command;
     if (stream_type == StreamType::kAudio) {
       command.append("testAudioConfig(");
     } else if (stream_type == StreamType::kAudioWithSpatialRendering) {
       command.append("testAudioConfigWithSpatialRendering(");
       command.append(spatial_rendering ? "true, " : "false, ");
+    } else if (stream_type == StreamType::kVideoWithHdrMetadata) {
+      command.append("testVideoConfigWithHdrMetadata(");
+      DCHECK(!hdr_metadata_type.empty());
+      DCHECK(!color_gamut.empty());
+      DCHECK(!transfer_function.empty());
+      command.append("\"");
+      command.append(hdr_metadata_type);
+      command.append("\", ");
+      command.append("\"");
+      command.append(color_gamut);
+      command.append("\", ");
+      command.append("\"");
+      command.append(transfer_function);
+      command.append("\", ");
+    } else if (stream_type == StreamType::kVideoWithoutHdrMetadata) {
+      command.append("testVideoConfigWithoutHdrMetadata(");
+      DCHECK(!color_gamut.empty());
+      DCHECK(!transfer_function.empty());
+      command.append("\"");
+      command.append(color_gamut);
+      command.append("\", ");
+      command.append("\"");
+      command.append(transfer_function);
+      command.append("\", ");
     } else {
       command.append("testVideoConfig(");
     }
@@ -316,6 +364,66 @@ IN_PROC_BROWSER_TEST_P(MediaCapabilitiesTestWithConfigType,
                               /*spatial_rendering*/ true));
 }
 
+// Cover basic HDR support.
+IN_PROC_BROWSER_TEST_P(MediaCapabilitiesTestWithConfigType,
+                       VideoTypesWithDynamicRange) {
+  base::FilePath file_path = media::GetTestDataFilePath(kDecodeTestFile);
+
+  const std::string& config_type = GetTypeString();
+
+  EXPECT_TRUE(
+      NavigateToURL(shell(), content::GetFileUrlWithQuery(file_path, "")));
+
+  // All color gamuts and transfer functions should be supported.
+  EXPECT_EQ(kSupported, CanDecodeVideoWithHdrMetadata(
+                            config_type, "'video/webm; codecs=\"vp8\"'",
+                            /* colorGamut */ "srgb",
+                            /* transferFunction */ "srgb"));
+  EXPECT_EQ(kSupported, CanDecodeVideoWithHdrMetadata(
+                            config_type, "'video/webm; codecs=\"vp8\"'",
+                            /* colorGamut */ "p3",
+                            /* transferFunction */ "pq"));
+  EXPECT_EQ(kSupported, CanDecodeVideoWithHdrMetadata(
+                            config_type, "'video/webm; codecs=\"vp8\"'",
+                            /* colorGamut */ "rec2020",
+                            /* transferFunction */ "hlg"));
+
+  // No HdrMetadataType is currently supported.
+  EXPECT_EQ(kUnsupported, CanDecodeVideoWithHdrMetadata(
+                              config_type, "'video/webm; codecs=\"vp8\"'",
+                              /* colorGamut */ "srgb",
+                              /* transferFunction */ "srgb",
+                              /* hdrMetadataType */ "smpteSt2086"));
+  EXPECT_EQ(kUnsupported, CanDecodeVideoWithHdrMetadata(
+                              config_type, "'video/webm; codecs=\"vp8\"'",
+                              /* colorGamut */ "srgb",
+                              /* transferFunction */ "srgb",
+                              /* hdrMetadataType */ "smpteSt2094-10"));
+  EXPECT_EQ(kUnsupported, CanDecodeVideoWithHdrMetadata(
+                              config_type, "'video/webm; codecs=\"vp8\"'",
+                              /* colorGamut */ "srgb",
+                              /* transferFunction */ "srgb",
+                              /* hdrMetadataType */ "smpteSt2094-40"));
+
+  // Make sure results are expected with some USE_PROPRIETARY_CODECS
+  EXPECT_EQ(kPropSupported,
+            CanDecodeVideoWithHdrMetadata(config_type,
+                                          "'video/mp4; codecs=\"avc1.42E01E\"'",
+                                          /* colorGamut */ "p3",
+                                          /* transferFunction */ "pq"));
+  EXPECT_EQ(kPropSupported,
+            CanDecodeVideoWithHdrMetadata(config_type,
+                                          "'video/mp4; codecs=\"avc1.42101E\"'",
+                                          /* colorGamut */ "srgb",
+                                          /* transferFunction */ "srgb"));
+  EXPECT_EQ(kUnsupported,
+            CanDecodeVideoWithHdrMetadata(config_type,
+                                          "'video/mp4; codecs=\"avc1.42701E\"'",
+                                          /* colorGamut */ "srgb",
+                                          /* transferFunction */ "srgb",
+                                          /* hdrMetadataType */ "smpteSt2086"));
+}
+
 INSTANTIATE_TEST_SUITE_P(File,
                          MediaCapabilitiesTestWithConfigType,
                          ::testing::Values(ConfigType::kFile));
diff --git a/chromium/content/browser/media/media_color_browsertest.cc b/chromium/content/browser/media/media_color_browsertest.cc
index 5ef10552897..5adefafaf08 100644
--- a/chromium/content/browser/media/media_color_browsertest.cc
+++ b/chromium/content/browser/media/media_color_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "media/base/test_data_util.h"
 #include "media/media_buildflags.h"
@@ -16,10 +17,20 @@ namespace content {
 
 class MediaColorTest : public MediaBrowserTest {
  public:
+  void SetUpOnMainThread() override {
+    embedded_test_server()->ServeFilesFromSourceDirectory(
+        media::GetTestDataPath());
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
   void RunColorTest(const std::string& video_file) {
-    base::FilePath path = media::GetTestDataFilePath("blackwhite.html");
-    std::string final_title =
-        RunTest(GetFileUrlWithQuery(path, video_file), media::kEnded);
+    GURL base_url = embedded_test_server()->GetURL("/blackwhite.html");
+
+    GURL::Replacements replacements;
+    replacements.SetQueryStr(video_file);
+    GURL test_url = base_url.ReplaceComponents(replacements);
+
+    std::string final_title = RunTest(test_url, media::kEnded);
     EXPECT_EQ(media::kEnded, final_title);
   }
   void SetUp() override {
diff --git a/chromium/content/browser/media/media_interface_factory_holder.cc b/chromium/content/browser/media/media_interface_factory_holder.cc
index d4c9aeb0068..dcba3df9fb8 100644
--- a/chromium/content/browser/media/media_interface_factory_holder.cc
+++ b/chromium/content/browser/media/media_interface_factory_holder.cc
@@ -8,9 +8,9 @@ namespace content {
 
 MediaInterfaceFactoryHolder::MediaInterfaceFactoryHolder(
     MediaServiceGetter media_service_getter,
-    CreateInterfaceProviderCB create_interface_provider_cb)
+    FrameServicesGetter frame_services_getter)
     : media_service_getter_(std::move(media_service_getter)),
-      create_interface_provider_cb_(std::move(create_interface_provider_cb)) {}
+      frame_services_getter_(std::move(frame_services_getter)) {}
 
 MediaInterfaceFactoryHolder::~MediaInterfaceFactoryHolder() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
@@ -28,7 +28,7 @@ media::mojom::InterfaceFactory* MediaInterfaceFactoryHolder::Get() {
 void MediaInterfaceFactoryHolder::ConnectToMediaService() {
   media_service_getter_.Run().CreateInterfaceFactory(
       interface_factory_remote_.BindNewPipeAndPassReceiver(),
-      create_interface_provider_cb_.Run());
+      frame_services_getter_.Run());
   interface_factory_remote_.set_disconnect_handler(base::BindOnce(
       &MediaInterfaceFactoryHolder::OnMediaServiceConnectionError,
       base::Unretained(this)));
diff --git a/chromium/content/browser/media/media_interface_factory_holder.h b/chromium/content/browser/media/media_interface_factory_holder.h
index f77e02e50dc..3325c2b350a 100644
--- a/chromium/content/browser/media/media_interface_factory_holder.h
+++ b/chromium/content/browser/media/media_interface_factory_holder.h
@@ -10,11 +10,11 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/threading/thread_checker.h"
+#include "media/mojo/mojom/frame_interface_factory.mojom.h"
 #include "media/mojo/mojom/interface_factory.mojom.h"
 #include "media/mojo/mojom/media_service.mojom.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/service_manager/public/mojom/interface_provider.mojom.h"
 
 namespace content {
 
@@ -24,13 +24,12 @@ class MediaInterfaceFactoryHolder {
  public:
   using MediaServiceGetter =
       base::RepeatingCallback<media::mojom::MediaService&()>;
-  using CreateInterfaceProviderCB = base::RepeatingCallback<
-      mojo::PendingRemote<service_manager::mojom::InterfaceProvider>()>;
+  using FrameServicesGetter = base::RepeatingCallback<
+      mojo::PendingRemote<media::mojom::FrameInterfaceFactory>()>;
 
   // |media_service_getter| will be called from the UI thread.
-  MediaInterfaceFactoryHolder(
-      MediaServiceGetter media_service_getter,
-      CreateInterfaceProviderCB create_interface_provider_cb);
+  MediaInterfaceFactoryHolder(MediaServiceGetter media_service_getter,
+                              FrameServicesGetter frame_services_getter);
   ~MediaInterfaceFactoryHolder();
 
   // Gets the MediaService |interface_factory_remote_|. The returned pointer is
@@ -44,7 +43,7 @@ class MediaInterfaceFactoryHolder {
   void OnMediaServiceConnectionError();
 
   MediaServiceGetter media_service_getter_;
-  CreateInterfaceProviderCB create_interface_provider_cb_;
+  FrameServicesGetter frame_services_getter_;
   mojo::Remote<media::mojom::InterfaceFactory> interface_factory_remote_;
 
   THREAD_CHECKER(thread_checker_);
diff --git a/chromium/content/browser/media/media_interface_proxy.cc b/chromium/content/browser/media/media_interface_proxy.cc
index 6aa962ef52c..b9328271479 100644
--- a/chromium/content/browser/media/media_interface_proxy.cc
+++ b/chromium/content/browser/media/media_interface_proxy.cc
@@ -16,14 +16,15 @@
 #include "base/time/time.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/service_sandbox_type.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/media_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/service_process_host.h"
 #include "content/public/common/content_client.h"
 #include "media/mojo/buildflags.h"
+#include "media/mojo/mojom/frame_interface_factory.mojom.h"
 #include "media/mojo/mojom/media_service.mojom.h"
-#include "media/mojo/services/media_interface_provider.h"
 
 #if BUILDFLAG(ENABLE_MOJO_CDM)
 #include "content/public/browser/browser_context.h"
@@ -34,6 +35,7 @@
 #endif
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
+#include "base/metrics/histogram_macros.h"
 #include "base/threading/sequence_local_storage_slot.h"
 #include "base/time/time.h"
 #include "content/browser/media/cdm_storage_impl.h"
@@ -47,10 +49,6 @@
 #endif  // defined(OS_MACOSX)
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-#include "media/mojo/mojom/cdm_proxy.mojom.h"
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
 #if defined(OS_ANDROID)
 #include "content/browser/media/android/media_player_renderer.h"
 #include "content/browser/media/flinging_renderer.h"
@@ -64,35 +62,80 @@ namespace {
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
 // How long an instance of the CDM service is allowed to sit idle before we
 // disconnect and effectively kill it.
-constexpr base::TimeDelta kCdmServiceIdleTimeout =
-    base::TimeDelta::FromSeconds(5);
+constexpr auto kCdmServiceIdleTimeout = base::TimeDelta::FromSeconds(5);
+
+// The CDM name will be displayed as the process name in the Task Manager.
+// Put a length limit and restrict to ASCII. Empty name is allowed, in which
+// case the process name will be "media::mojom::CdmService".
+bool IsValidCdmDisplayName(const std::string& cdm_name) {
+  constexpr size_t kMaxCdmNameSize = 256;
+  return cdm_name.size() <= kMaxCdmNameSize && base::IsStringASCII(cdm_name);
+}
 
-// Gets an instance of the CDM service for the CDM identified by |guid|.
-// Instances are started lazily as needed.
-media::mojom::CdmService& GetCdmServiceForGuid(const base::Token& guid) {
-  // NOTE: Sequence-local storage is used to limit the lifetime of these Remote
+// A map hosts all media::mojom::CdmService remotes, each of which corresponds
+// to one CDM process. There should be only one instance of this class stored in
+// base::SequenceLocalStorageSlot. See below.
+class CdmServiceMap {
+ public:
+  CdmServiceMap() = default;
+
+  ~CdmServiceMap() {
+    DVLOG(1) << __func__ << ": max_remote_count_=" << max_remote_count_;
+    UMA_HISTOGRAM_COUNTS_100("Media.EME.MaxCdmProcessCount", max_remote_count_);
+  }
+
+  // Gets or creates a media::mojom::CdmService remote. The returned remote
+  // might not be bound, e.g. if it's newly created.
+  auto& GetOrCreateRemote(const base::Token& guid) {
+    auto& remote = remotes_[guid];
+    max_remote_count_ = std::max(max_remote_count_, remotes_.size());
+    return remote;
+  }
+
+  void EraseRemote(const base::Token& guid) {
+    DCHECK(remotes_.count(guid));
+    remotes_.erase(guid);
+  }
+
+ private:
+  std::map<base::Token, mojo::Remote<media::mojom::CdmService>> remotes_;
+  size_t max_remote_count_ = 0;
+};
+
+CdmServiceMap& GetCdmServiceMap() {
+  // NOTE: Sequence-local storage is used to limit the lifetime of the Remote
   // objects to that of the UI-thread sequence. This ensures the Remotes are
   // destroyed when the task environment is torn down and reinitialized, e.g.,
   // between unit tests.
-  static base::NoDestructor<base::SequenceLocalStorageSlot<
-      std::map<base::Token, mojo::Remote<media::mojom::CdmService>>>>
-      slot;
-  auto& remotes = slot->GetOrCreateValue();
-  auto& remote = remotes[guid];
+  static base::NoDestructor<base::SequenceLocalStorageSlot<CdmServiceMap>> slot;
+  return slot->GetOrCreateValue();
+}
+
+// Erases the CDM service instance for the CDM identified by |guid|.
+void EraseCdmServiceForGuid(const base::Token& guid) {
+  GetCdmServiceMap().EraseRemote(guid);
+}
+
+// Gets an instance of the CDM service for the CDM identified by |guid|.
+// Instances are started lazily as needed.
+media::mojom::CdmService& GetCdmServiceForGuid(const base::Token& guid,
+                                               const std::string& cdm_name) {
+  auto& remote = GetCdmServiceMap().GetOrCreateRemote(guid);
   if (!remote) {
     ServiceProcessHost::Launch(
         remote.BindNewPipeAndPassReceiver(),
         ServiceProcessHost::Options()
-            .WithDisplayName("Content Decryption Module Service")
-            .WithSandboxType(service_manager::SandboxType::kCdm)
+            .WithDisplayName(cdm_name)
             .Pass());
-    remote.reset_on_disconnect();
-    remote.reset_on_idle_timeout(kCdmServiceIdleTimeout);
+    remote.set_disconnect_handler(
+        base::BindOnce(&EraseCdmServiceForGuid, guid));
+    remote.set_idle_handler(kCdmServiceIdleTimeout,
+                            base::BindRepeating(EraseCdmServiceForGuid, guid));
   }
 
   return *remote.get();
 }
-#endif
+#endif  // ENABLE_LIBRARY_CDMS
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS) && defined(OS_MACOSX)
 
@@ -185,6 +228,51 @@ media::mojom::MediaService& GetSecondaryMediaService() {
   return *remote->get();
 }
 
+class FrameInterfaceFactoryImpl : public media::mojom::FrameInterfaceFactory {
+ public:
+  FrameInterfaceFactoryImpl(RenderFrameHost* rfh,
+                            const base::Token& cdm_guid,
+                            const std::string& cdm_file_system_id)
+      : render_frame_host_(rfh),
+        cdm_guid_(cdm_guid),
+        cdm_file_system_id_(cdm_file_system_id) {
+  }
+
+  void CreateProvisionFetcher(
+      mojo::PendingReceiver<media::mojom::ProvisionFetcher> receiver) override {
+#if BUILDFLAG(ENABLE_MOJO_CDM)
+    ProvisionFetcherImpl::Create(
+        BrowserContext::GetDefaultStoragePartition(
+            render_frame_host_->GetProcess()->GetBrowserContext())
+            ->GetURLLoaderFactoryForBrowserProcess(),
+        std::move(receiver));
+#endif
+  }
+
+  void CreateCdmStorage(
+      mojo::PendingReceiver<media::mojom::CdmStorage> receiver) override {
+#if BUILDFLAG(ENABLE_LIBRARY_CDMS)
+    // Only provide CdmStorageImpl when we have a valid |cdm_file_system_id|,
+    // which is currently only set for the CdmService (not the MediaService).
+    if (cdm_file_system_id_.empty())
+      return;
+
+    CdmStorageImpl::Create(render_frame_host_, cdm_file_system_id_,
+                           std::move(receiver));
+#endif
+  }
+
+  void BindEmbedderReceiver(mojo::GenericPendingReceiver receiver) override {
+    GetContentClient()->browser()->BindMediaServiceReceiver(
+        render_frame_host_, std::move(receiver));
+  }
+
+ private:
+  RenderFrameHost* const render_frame_host_;
+  const base::Token cdm_guid_;
+  const std::string cdm_file_system_id_;
+};
+
 }  // namespace
 
 MediaInterfaceProxy::MediaInterfaceProxy(
@@ -197,14 +285,13 @@ MediaInterfaceProxy::MediaInterfaceProxy(
   DCHECK(render_frame_host_);
   DCHECK(!error_handler.is_null());
 
-  auto create_interface_provider_cb =
+  auto frame_factory_getter =
       base::BindRepeating(&MediaInterfaceProxy::GetFrameServices,
                           base::Unretained(this), base::Token(), std::string());
   media_interface_factory_ptr_ = std::make_unique<MediaInterfaceFactoryHolder>(
-      base::BindRepeating(&GetMediaService), create_interface_provider_cb);
+      base::BindRepeating(&GetMediaService), frame_factory_getter);
   secondary_interface_factory_ = std::make_unique<MediaInterfaceFactoryHolder>(
-      base::BindRepeating(&GetSecondaryMediaService),
-      create_interface_provider_cb);
+      base::BindRepeating(&GetSecondaryMediaService), frame_factory_getter);
 
   receiver_.set_disconnect_handler(std::move(error_handler));
 
@@ -319,64 +406,14 @@ void MediaInterfaceProxy::CreateCdm(
     factory->CreateCdm(key_system, std::move(receiver));
 }
 
-void MediaInterfaceProxy::CreateDecryptor(
-    int cdm_id,
-    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {
-  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
-  if (factory)
-    factory->CreateDecryptor(cdm_id, std::move(receiver));
-}
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-void MediaInterfaceProxy::CreateCdmProxy(
-    const base::Token& cdm_guid,
-    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
-  NOTREACHED() << "The CdmProxy should only be created by a CDM.";
-}
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
-mojo::PendingRemote<service_manager::mojom::InterfaceProvider>
+mojo::PendingRemote<media::mojom::FrameInterfaceFactory>
 MediaInterfaceProxy::GetFrameServices(const base::Token& cdm_guid,
                                       const std::string& cdm_file_system_id) {
-  // Register frame services.
-  mojo::PendingRemote<service_manager::mojom::InterfaceProvider> interfaces;
-
-  // TODO(xhwang): Replace this InterfaceProvider with a dedicated media host
-  // interface. See http://crbug.com/660573
-  auto provider = std::make_unique<media::MediaInterfaceProvider>(
-      interfaces.InitWithNewPipeAndPassReceiver());
-
-#if BUILDFLAG(ENABLE_MOJO_CDM)
-  // TODO(slan): Wrap these into a RenderFrame specific ProvisionFetcher impl.
-  provider->registry()->AddInterface(base::BindRepeating(
-      &ProvisionFetcherImpl::Create,
-      base::RetainedRef(
-          BrowserContext::GetDefaultStoragePartition(
-              render_frame_host_->GetProcess()->GetBrowserContext())
-              ->GetURLLoaderFactoryForBrowserProcess())));
-
-#if BUILDFLAG(ENABLE_LIBRARY_CDMS)
-  // Only provide CdmStorageImpl when we have a valid |cdm_file_system_id|,
-  // which is currently only set for the CdmService (not the MediaService).
-  if (!cdm_file_system_id.empty()) {
-    provider->registry()->AddInterface(base::BindRepeating(
-        &CdmStorageImpl::Create, render_frame_host_, cdm_file_system_id));
-  }
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  provider->registry()->AddInterface(
-      base::BindRepeating(&MediaInterfaceProxy::CreateCdmProxyInternal,
-                          base::Unretained(this), cdm_guid));
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-#endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
-#endif  // BUILDFLAG(ENABLE_MOJO_CDM)
-
-  GetContentClient()->browser()->ExposeInterfacesToMediaService(
-      provider->registry(), render_frame_host_);
-
-  media_registries_.push_back(std::move(provider));
-
-  return interfaces;
+  mojo::PendingRemote<media::mojom::FrameInterfaceFactory> factory;
+  frame_factories_.Add(std::make_unique<FrameInterfaceFactoryImpl>(
+                           render_frame_host_, cdm_guid, cdm_file_system_id),
+                       factory.InitWithNewPipeAndPassReceiver());
+  return factory;
 }
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
@@ -385,10 +422,6 @@ media::mojom::CdmFactory* MediaInterfaceProxy::GetCdmFactory(
     const std::string& key_system) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  base::Token cdm_guid;
-  base::FilePath cdm_path;
-  std::string cdm_file_system_id;
-
   std::unique_ptr<CdmInfo> cdm_info =
       KeySystemSupportImpl::GetCdmInfoForKeySystem(key_system);
   if (!cdm_info) {
@@ -403,26 +436,32 @@ media::mojom::CdmFactory* MediaInterfaceProxy::GetCdmFactory(
     NOTREACHED() << "Invalid file system ID " << cdm_info->file_system_id;
     return nullptr;
   }
-  cdm_guid = cdm_info->guid;
-  cdm_path = cdm_info->path;
-  cdm_file_system_id = cdm_info->file_system_id;
+  if (!IsValidCdmDisplayName(cdm_info->name)) {
+    NOTREACHED() << "Invalid CDM display name " << cdm_info->name;
+    return nullptr;
+  }
+
+  auto& cdm_guid = cdm_info->guid;
 
   auto found = cdm_factory_map_.find(cdm_guid);
   if (found != cdm_factory_map_.end())
     return found->second.get();
 
-  return ConnectToCdmService(cdm_guid, cdm_path, cdm_file_system_id);
+  return ConnectToCdmService(cdm_guid, cdm_info->path, cdm_info->file_system_id,
+                             cdm_info->name);
 }
 
 media::mojom::CdmFactory* MediaInterfaceProxy::ConnectToCdmService(
     const base::Token& cdm_guid,
     const base::FilePath& cdm_path,
-    const std::string& cdm_file_system_id) {
+    const std::string& cdm_file_system_id,
+    const std::string& cdm_name) {
   DVLOG(1) << __func__ << ": cdm_guid = " << cdm_guid.ToString();
 
   DCHECK(!cdm_factory_map_.count(cdm_guid));
 
-  media::mojom::CdmService& cdm_service = GetCdmServiceForGuid(cdm_guid);
+  media::mojom::CdmService& cdm_service =
+      GetCdmServiceForGuid(cdm_guid, cdm_name);
 
 #if defined(OS_MACOSX)
   // LoadCdm() should always be called before CreateInterfaceFactory().
@@ -458,19 +497,6 @@ void MediaInterfaceProxy::OnCdmServiceConnectionError(
   cdm_factory_map_.erase(cdm_guid);
 }
 
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-void MediaInterfaceProxy::CreateCdmProxyInternal(
-    const base::Token& cdm_guid,
-    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
-  DVLOG(1) << __func__;
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
-  if (factory)
-    factory->CreateCdmProxy(cdm_guid, std::move(receiver));
-}
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
 }  // namespace content
diff --git a/chromium/content/browser/media/media_interface_proxy.h b/chromium/content/browser/media/media_interface_proxy.h
index 2f43fbe4964..ba9650c751b 100644
--- a/chromium/content/browser/media/media_interface_proxy.h
+++ b/chromium/content/browser/media/media_interface_proxy.h
@@ -24,12 +24,9 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/unique_receiver_set.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 
-namespace media {
-class MediaInterfaceProvider;
-}
-
 namespace content {
 
 class RenderFrameHost;
@@ -81,22 +78,14 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   void CreateCdm(const std::string& key_system,
                  mojo::PendingReceiver<media::mojom::ContentDecryptionModule>
                      receiver) final;
-  void CreateDecryptor(
-      int cdm_id,
-      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  void CreateCdmProxy(
-      const base::Token& cdm_guid,
-      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 
  private:
   // Gets services provided by the browser (at RenderFrameHost level) to the
   // mojo media (or CDM) service running remotely. |cdm_file_system_id| is
   // used to register the appropriate CdmStorage interface needed by the CDM.
-  mojo::PendingRemote<service_manager::mojom::InterfaceProvider>
-  GetFrameServices(const base::Token& cdm_guid,
-                   const std::string& cdm_file_system_id);
+  mojo::PendingRemote<media::mojom::FrameInterfaceFactory> GetFrameServices(
+      const base::Token& cdm_guid,
+      const std::string& cdm_file_system_id);
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
   // Gets a CdmFactory pointer for |key_system|. Returns null if unexpected
@@ -108,23 +97,16 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   // CdmFactory pointer. Returns nullptr if unexpected error happened.
   // |cdm_path| will be used to preload the CDM, if necessary.
   // |cdm_file_system_id| is used when creating the matching storage interface.
+  // |cdm_name| is used as the display name of the CDM (utility) process.
   media::mojom::CdmFactory* ConnectToCdmService(
       const base::Token& cdm_guid,
       const base::FilePath& cdm_path,
-      const std::string& cdm_file_system_id);
+      const std::string& cdm_file_system_id,
+      const std::string& cdm_name);
 
   // Callback for connection error from the CdmFactoryPtr in the
   // |cdm_factory_map_| associated with |cdm_guid|.
   void OnCdmServiceConnectionError(const base::Token& cdm_guid);
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  // Creates a CdmProxy for the CDM in CdmService. Not implemented in
-  // CreateCdmProxy() because we don't want any client to be able to create
-  // a CdmProxy.
-  void CreateCdmProxyInternal(
-      const base::Token& cdm_guid,
-      mojo::PendingReceiver<media::mojom::CdmProxy> receiver);
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
   // Safe to hold a raw pointer since |this| is owned by RenderFrameHostImpl.
@@ -133,9 +115,7 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   // Receiver for incoming InterfaceFactoryRequest from the the RenderFrameImpl.
   mojo::Receiver<InterfaceFactory> receiver_;
 
-  // TODO(xhwang): Replace InterfaceProvider with a dedicated host interface.
-  // See http://crbug.com/660573
-  std::vector<std::unique_ptr<media::MediaInterfaceProvider>> media_registries_;
+  mojo::UniqueReceiverSet<media::mojom::FrameInterfaceFactory> frame_factories_;
 
   // InterfacePtr to the remote InterfaceFactory implementation in the Media
   // Service hosted in the process specified by the "mojo_media_host" gn
diff --git a/chromium/content/browser/media/media_internals.cc b/chromium/content/browser/media/media_internals.cc
index c2775b32488..d6b0abc3d2a 100644
--- a/chromium/content/browser/media/media_internals.cc
+++ b/chromium/content/browser/media/media_internals.cc
@@ -34,7 +34,6 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/service_manager_connection.h"
 #include "media/audio/audio_features.h"
 #include "media/base/audio_parameters.h"
 #include "media/base/media_log_record.h"
@@ -503,9 +502,6 @@ void MediaInternals::SendGeneralAudioInformation() {
   set_feature_data(features::kAudioServiceLaunchOnStartup);
   set_explicit_feature_data(service_manager::features::kAudioServiceSandbox,
                             service_manager::IsAudioSandboxEnabled());
-  set_explicit_feature_data(features::kWebRtcApmInAudioService,
-                            media::IsWebRtcApmInAudioServiceEnabled());
-
   base::string16 audio_info_update =
       SerializeUpdate("media.updateGeneralAudioInformation", &audio_info_data);
   SendUpdate(audio_info_update);
@@ -560,10 +556,7 @@ void MediaInternals::UpdateVideoCaptureDeviceCapabilities(
     device_dict->SetString("id", descriptor.device_id);
     device_dict->SetString("name", descriptor.GetNameAndModel());
     device_dict->Set("formats", std::move(format_list));
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX) || \
-    defined(OS_ANDROID)
     device_dict->SetString("captureApi", descriptor.GetCaptureApiTypeString());
-#endif
     video_capture_capabilities_cached_data_.Append(std::move(device_dict));
   }
 
diff --git a/chromium/content/browser/media/media_internals_audio_focus_helper.cc b/chromium/content/browser/media/media_internals_audio_focus_helper.cc
index 4c3927a1cbd..6e2935fd65d 100644
--- a/chromium/content/browser/media/media_internals_audio_focus_helper.cc
+++ b/chromium/content/browser/media/media_internals_audio_focus_helper.cc
@@ -110,7 +110,7 @@ bool MediaInternalsAudioFocusHelper::EnsureServiceConnection() {
   if (!audio_focus_.is_bound()) {
     GetMediaSessionService().BindAudioFocusManager(
         audio_focus_.BindNewPipeAndPassReceiver());
-    audio_focus_.set_disconnect_handler(base::BindRepeating(
+    audio_focus_.set_disconnect_handler(base::BindOnce(
         &MediaInternalsAudioFocusHelper::OnMojoError, base::Unretained(this)));
   }
 
@@ -119,15 +119,15 @@ bool MediaInternalsAudioFocusHelper::EnsureServiceConnection() {
     GetMediaSessionService().BindAudioFocusManagerDebug(
         audio_focus_debug_.BindNewPipeAndPassReceiver());
     audio_focus_debug_.set_disconnect_handler(
-        base::BindRepeating(&MediaInternalsAudioFocusHelper::OnDebugMojoError,
-                            base::Unretained(this)));
+        base::BindOnce(&MediaInternalsAudioFocusHelper::OnDebugMojoError,
+                       base::Unretained(this)));
   }
 
   // Add the observer to receive audio focus events.
   if (!receiver_.is_bound()) {
     audio_focus_->AddObserver(receiver_.BindNewPipeAndPassRemote());
 
-    receiver_.set_disconnect_handler(base::BindRepeating(
+    receiver_.set_disconnect_handler(base::BindOnce(
         &MediaInternalsAudioFocusHelper::OnMojoError, base::Unretained(this)));
   }
 
diff --git a/chromium/content/browser/media/media_internals_proxy.cc b/chromium/content/browser/media/media_internals_proxy.cc
index e42baf93cee..9e9dda6b908 100644
--- a/chromium/content/browser/media/media_internals_proxy.cc
+++ b/chromium/content/browser/media/media_internals_proxy.cc
@@ -22,18 +22,18 @@ MediaInternalsProxy::~MediaInternalsProxy() {}
 
 void MediaInternalsProxy::Attach(MediaInternalsMessageHandler* handler) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(!update_callback_);
 
-  handler_ = handler;
   update_callback_ =
-      base::BindRepeating(&MediaInternalsProxy::UpdateUIOnUIThread, this);
+      base::BindRepeating(&MediaInternalsProxy::UpdateUIOnUIThread, handler);
   MediaInternals::GetInstance()->AddUpdateCallback(update_callback_);
 }
 
 void MediaInternalsProxy::Detach() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  handler_ = nullptr;
   MediaInternals::GetInstance()->RemoveUpdateCallback(update_callback_);
+  update_callback_.Reset();
 }
 
 void MediaInternalsProxy::GetEverything() {
@@ -58,11 +58,12 @@ void MediaInternalsProxy::GetEverythingOnIOThread() {
   MediaInternals::GetInstance()->SendVideoCaptureDeviceCapabilities();
 }
 
-void MediaInternalsProxy::UpdateUIOnUIThread(const base::string16& update) {
+// static
+void MediaInternalsProxy::UpdateUIOnUIThread(
+    MediaInternalsMessageHandler* handler,
+    const base::string16& update) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  // Don't forward updates to a destructed UI.
-  if (handler_)
-    handler_->OnUpdate(update);
+  handler->OnUpdate(update);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/media/media_internals_proxy.h b/chromium/content/browser/media/media_internals_proxy.h
index 338c3e67a84..4f1682b9be5 100644
--- a/chromium/content/browser/media/media_internals_proxy.h
+++ b/chromium/content/browser/media/media_internals_proxy.h
@@ -42,9 +42,9 @@ class MediaInternalsProxy
   void GetEverythingOnIOThread();
 
   // Callback for MediaInternals to update. Must be called on UI thread.
-  void UpdateUIOnUIThread(const base::string16& update);
+  static void UpdateUIOnUIThread(MediaInternalsMessageHandler* handler,
+                                 const base::string16& update);
 
-  MediaInternalsMessageHandler* handler_;
   MediaInternals::UpdateCallback update_callback_;
 
   DISALLOW_COPY_AND_ASSIGN(MediaInternalsProxy);
diff --git a/chromium/content/browser/media/media_internals_ui.cc b/chromium/content/browser/media/media_internals_ui.cc
index 9268d0cffef..b40b0dd1810 100644
--- a/chromium/content/browser/media/media_internals_ui.cc
+++ b/chromium/content/browser/media/media_internals_ui.cc
@@ -22,14 +22,7 @@ WebUIDataSource* CreateMediaInternalsHTMLSource() {
       WebUIDataSource::Create(kChromeUIMediaInternalsHost);
 
   source->UseStringsJs();
-
-  if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
-    source->AddResourcePath("media_internals.js",
-                            IDR_MEDIA_INTERNALS_JS_DISABLED);
-  } else {
-    source->AddResourcePath("media_internals.js", IDR_MEDIA_INTERNALS_JS);
-  }
-
+  source->AddResourcePath("media_internals.js", IDR_MEDIA_INTERNALS_JS);
   source->SetDefaultResource(IDR_MEDIA_INTERNALS_HTML);
   return source;
 }
diff --git a/chromium/content/browser/media/media_keys_listener_manager_impl_browsertest.cc b/chromium/content/browser/media/media_keys_listener_manager_impl_browsertest.cc
index 84dbb4a5b22..6e3033ae9cc 100644
--- a/chromium/content/browser/media/media_keys_listener_manager_impl_browsertest.cc
+++ b/chromium/content/browser/media/media_keys_listener_manager_impl_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/media/hardware_key_media_controller.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "media/base/media_switches.h"
 #include "services/media_session/public/cpp/test/test_media_controller.h"
diff --git a/chromium/content/browser/media/media_redirect_browsertest.cc b/chromium/content/browser/media/media_redirect_browsertest.cc
index 69907f24930..d4a54e6cdb0 100644
--- a/chromium/content/browser/media/media_redirect_browsertest.cc
+++ b/chromium/content/browser/media/media_redirect_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/bind.h"
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "media/base/test_data_util.h"
diff --git a/chromium/content/browser/media/media_source_browsertest.cc b/chromium/content/browser/media/media_source_browsertest.cc
index 1c523d81db8..2372cdec182 100644
--- a/chromium/content/browser/media/media_source_browsertest.cc
+++ b/chromium/content/browser/media/media_source_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/command_line.h"
 #include "build/build_config.h"
 #include "content/browser/media/media_browsertest.h"
+#include "content/public/test/browser_test.h"
 #include "media/base/media_switches.h"
 #include "media/base/supported_types.h"
 #include "media/base/test_data_util.h"
@@ -25,7 +26,7 @@ class MediaSourceTest : public MediaBrowserTest {
     query_params.emplace_back("mediaFile", media_file);
     query_params.emplace_back("mediaType", media_type);
     RunMediaTestPage("media_source_player.html", query_params, expectation,
-                     false);
+                     true);
   }
 
   void TestSimplePlayback(const std::string& media_file,
diff --git a/chromium/content/browser/media/media_suspend_browsertest.cc b/chromium/content/browser/media/media_suspend_browsertest.cc
index 4f19895ac8a..c5b03389e72 100644
--- a/chromium/content/browser/media/media_suspend_browsertest.cc
+++ b/chromium/content/browser/media/media_suspend_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/common/media/media_player_delegate_messages.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/media/midi_browsertest.cc b/chromium/content/browser/media/midi_browsertest.cc
index af6d8773c38..5614d3bd11a 100644
--- a/chromium/content/browser/media/midi_browsertest.cc
+++ b/chromium/content/browser/media/midi_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/media/session/audio_focus_delegate_android_browsertest.cc b/chromium/content/browser/media/session/audio_focus_delegate_android_browsertest.cc
index b49a064e29d..5f0ef030ff2 100644
--- a/chromium/content/browser/media/session/audio_focus_delegate_android_browsertest.cc
+++ b/chromium/content/browser/media/session/audio_focus_delegate_android_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/media/session/media_session_impl.h"
 #include "content/browser/media/session/mock_media_session_player_observer.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/media_content_type.h"
diff --git a/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc b/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
index ba6f4ede1f0..60aba4c3b97 100644
--- a/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
+++ b/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/media/session/media_session_impl.h"
 #include "content/browser/media/session/mock_media_session_player_observer.h"
 #include "content/public/browser/media_session_service.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/media_content_type.h"
diff --git a/chromium/content/browser/media/session/media_session_browsertest.cc b/chromium/content/browser/media/session/media_session_browsertest.cc
index d5376cb1725..248f6f35c46 100644
--- a/chromium/content/browser/media/session/media_session_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -468,6 +469,6 @@ IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTestWithBackForwardCache,
 
   // The page should be cached in the back forward cache.
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_TRUE(rfh_a->IsInBackForwardCache());
 }
 }  // namespace content
diff --git a/chromium/content/browser/media/session/media_session_impl_browsertest.cc b/chromium/content/browser/media/session/media_session_impl_browsertest.cc
index ac0335e26fc..77161c71d44 100644
--- a/chromium/content/browser/media/session/media_session_impl_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_impl_browsertest.cc
@@ -24,6 +24,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/media_session.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -2807,41 +2808,50 @@ IN_PROC_BROWSER_TEST_F(MediaSessionImplBrowserTest,
     ASSERT_TRUE(ExecuteScript(
         main_frame, "document.getElementById('video').currentTime = 1"));
 
-    observer.WaitForExpectedPosition(media_session::MediaPosition(
+    // We might only learn about the rate going back to 1.0 when the media time
+    // has already progressed a bit.
+    observer.WaitForExpectedPositionAtLeast(media_session::MediaPosition(
         1.0, duration, base::TimeDelta::FromSeconds(1)));
   }
 
+  base::TimeDelta paused_position;
   {
-    // If we pause the player then the position should be updated.
+    // If we pause the player then the rate should be updated.
     media_session::test::MockMediaSessionMojoObserver observer(*media_session_);
 
     ASSERT_TRUE(
         ExecuteScript(main_frame, "document.getElementById('video').pause()"));
 
-    observer.WaitForExpectedPosition(media_session::MediaPosition(
-        0.0, duration, base::TimeDelta::FromSeconds(1)));
+    // Media time may have progressed since the time we seeked to 1s.
+    paused_position =
+        observer.WaitForExpectedPositionAtLeast(media_session::MediaPosition(
+            0.0, duration, base::TimeDelta::FromSeconds(1)));
   }
 
+  base::TimeDelta resumed_position;
   {
-    // If we resume the player then the position should be updated.
+    // If we resume the player then the rate should be updated.
     media_session::test::MockMediaSessionMojoObserver observer(*media_session_);
 
     ASSERT_TRUE(
         ExecuteScript(main_frame, "document.getElementById('video').play()"));
 
-    observer.WaitForExpectedPosition(media_session::MediaPosition(
-        1.0, duration, base::TimeDelta::FromSeconds(1)));
+    // We might only learn about the rate going back to 1.0 when the media time
+    // has already progressed a bit.
+    resumed_position = observer.WaitForExpectedPositionAtLeast(
+        media_session::MediaPosition(1.0, duration, paused_position));
   }
 
   {
-    // If we change the playback rate then the position should be updated.
+    // If we change the playback rate then the MediaPosition should be updated.
     media_session::test::MockMediaSessionMojoObserver observer(*media_session_);
 
     ASSERT_TRUE(ExecuteScript(
         main_frame, "document.getElementById('video').playbackRate = 2"));
 
-    observer.WaitForExpectedPosition(media_session::MediaPosition(
-        2.0, duration, base::TimeDelta::FromSeconds(1)));
+    // Media time may have progressed since the time we resumed playback.
+    observer.WaitForExpectedPositionAtLeast(
+        media_session::MediaPosition(2.0, duration, resumed_position));
   }
 
   {
diff --git a/chromium/content/browser/media/session/media_session_impl_visibility_browsertest.cc b/chromium/content/browser/media/session/media_session_impl_visibility_browsertest.cc
index 799bb554ab5..1f71da2a080 100644
--- a/chromium/content/browser/media/session/media_session_impl_visibility_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_impl_visibility_browsertest.cc
@@ -7,7 +7,6 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/test/scoped_feature_list.h"
@@ -15,6 +14,7 @@
 #include "content/browser/media/session/media_session_impl.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -94,10 +94,8 @@ class MediaSessionImplVisibilityBrowserTest
 
     VisibilityTestData params = GetVisibilityTestData();
 
-    if (params.media_suspend == MediaSuspend::ENABLED)
-      command_line->AppendSwitch(switches::kEnableMediaSuspend);
-    else
-      command_line->AppendSwitch(switches::kDisableMediaSuspend);
+    if (params.media_suspend == MediaSuspend::DISABLED)
+      command_line->AppendSwitch(switches::kDisableBackgroundMediaSuspend);
   }
 
   const VisibilityTestData& GetVisibilityTestData() {
diff --git a/chromium/content/browser/media/session/media_session_service_impl_browsertest.cc b/chromium/content/browser/media/session/media_session_service_impl_browsertest.cc
index ab14ea96892..0cd73d2c7de 100644
--- a/chromium/content/browser/media/session/media_session_service_impl_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_service_impl_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/media/session/media_session_player_observer.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/media/video_decoder_proxy.cc b/chromium/content/browser/media/video_decoder_proxy.cc
index c5ab6158241..ac24f21b93c 100644
--- a/chromium/content/browser/media/video_decoder_proxy.cc
+++ b/chromium/content/browser/media/video_decoder_proxy.cc
@@ -70,16 +70,6 @@ void VideoDecoderProxy::CreateCdm(
     const std::string& key_system,
     mojo::PendingReceiver<media::mojom::ContentDecryptionModule> receiver) {}
 
-void VideoDecoderProxy::CreateDecryptor(
-    int cdm_id,
-    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {}
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-void VideoDecoderProxy::CreateCdmProxy(
-    const base::Token& cdm_guid,
-    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {}
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
 media::mojom::InterfaceFactory* VideoDecoderProxy::GetMediaInterfaceFactory() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
 
@@ -94,7 +84,7 @@ void VideoDecoderProxy::ConnectToMediaService() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(!interface_factory_remote_);
 
-  mojo::PendingRemote<service_manager::mojom::InterfaceProvider> interfaces;
+  mojo::PendingRemote<media::mojom::FrameInterfaceFactory> interfaces;
   ignore_result(interfaces.InitWithNewPipeAndPassReceiver());
 
   GetMediaService().CreateInterfaceFactory(
diff --git a/chromium/content/browser/media/video_decoder_proxy.h b/chromium/content/browser/media/video_decoder_proxy.h
index b650178a1d9..c035f9c118a 100644
--- a/chromium/content/browser/media/video_decoder_proxy.h
+++ b/chromium/content/browser/media/video_decoder_proxy.h
@@ -63,14 +63,6 @@ class CONTENT_EXPORT VideoDecoderProxy : public media::mojom::InterfaceFactory {
   void CreateCdm(const std::string& key_system,
                  mojo::PendingReceiver<media::mojom::ContentDecryptionModule>
                      receiver) final;
-  void CreateDecryptor(
-      int cdm_id,
-      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  void CreateCdmProxy(
-      const base::Token& cdm_guid,
-      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 
  private:
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
diff --git a/chromium/content/browser/media/webaudio/audio_context_manager_browsertest.cc b/chromium/content/browser/media/webaudio/audio_context_manager_browsertest.cc
index 5832ba6b767..52825e7f7b3 100644
--- a/chromium/content/browser/media/webaudio/audio_context_manager_browsertest.cc
+++ b/chromium/content/browser/media/webaudio/audio_context_manager_browsertest.cc
@@ -5,6 +5,7 @@
 #include "build/build_config.h"
 #include "components/ukm/test_ukm_recorder.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/media/webaudio/audio_context_manager_impl.cc b/chromium/content/browser/media/webaudio/audio_context_manager_impl.cc
index 071f1fa9ad8..62f55cca76e 100644
--- a/chromium/content/browser/media/webaudio/audio_context_manager_impl.cc
+++ b/chromium/content/browser/media/webaudio/audio_context_manager_impl.cc
@@ -89,9 +89,7 @@ void AudioContextManagerImpl::RecordAudibleTime(base::TimeDelta audible_time) {
   DCHECK(ukm_recorder);
 
   ukm::builders::Media_WebAudio_AudioContext_AudibleTime(
-      static_cast<WebContentsImpl*>(
-          WebContents::FromRenderFrameHost(render_frame_host()))
-          ->GetUkmSourceIdForLastCommittedSource())
+      render_frame_host_impl_->GetPageUkmSourceId())
       .SetIsMainFrame(WebContents::FromRenderFrameHost(render_frame_host())
                           ->GetMainFrame() == render_frame_host_impl_)
       .SetAudibleTime(GetBucketedTimeInMilliseconds(audible_time))
diff --git a/chromium/content/browser/message_port_provider.cc b/chromium/content/browser/message_port_provider.cc
index 42a1f4417d3..2f6c6b1f72d 100644
--- a/chromium/content/browser/message_port_provider.cc
+++ b/chromium/content/browser/message_port_provider.cc
@@ -6,6 +6,8 @@
 
 #include <utility>
 
+#include "base/optional.h"
+#include "base/unguessable_token.h"
 #include "build/build_config.h"
 #include "build/chromecast_buildflags.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -17,7 +19,7 @@
 
 #if defined(OS_ANDROID)
 #include "base/android/jni_string.h"
-#include "content/browser/android/app_web_message_port.h"
+#include "content/public/browser/android/app_web_message_port.h"
 #endif
 
 using blink::MessagePortChannel;
@@ -25,22 +27,28 @@ using blink::MessagePortChannel;
 namespace content {
 namespace {
 
-void PostMessageToFrameInternal(WebContents* web_contents,
-                                const base::string16& source_origin,
-                                const base::string16& target_origin,
-                                const base::string16& data,
-                                std::vector<MessagePortChannel> channels) {
+void PostMessageToFrameInternal(
+    WebContents* web_contents,
+    const base::string16& source_origin,
+    const base::string16& target_origin,
+    const base::string16& data,
+    std::vector<blink::MessagePortDescriptor> ports) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
+  // TODO(chrisha): Kill off MessagePortChannel, as MessagePortDescriptor now
+  // plays that role.
+  std::vector<MessagePortChannel> channels;
+  for (auto& port : ports)
+    channels.emplace_back(MessagePortChannel(std::move(port)));
+
   blink::TransferableMessage message;
   message.owned_encoded_message = blink::EncodeStringMessage(data);
   message.encoded_message = message.owned_encoded_message;
   message.ports = std::move(channels);
-  int32_t source_routing_id = MSG_ROUTING_NONE;
 
   RenderFrameHostImpl* rfh =
       static_cast<RenderFrameHostImpl*>(web_contents->GetMainFrame());
-  rfh->PostMessageEvent(source_routing_id, source_origin, target_origin,
+  rfh->PostMessageEvent(base::nullopt, source_origin, target_origin,
                         std::move(message));
 }
 
@@ -62,7 +70,7 @@ void MessagePortProvider::PostMessageToFrame(
     const base::string16& target_origin,
     const base::string16& data) {
   PostMessageToFrameInternal(web_contents, source_origin, target_origin, data,
-                             std::vector<MessagePortChannel>());
+                             std::vector<blink::MessagePortDescriptor>());
 }
 
 #if defined(OS_ANDROID)
@@ -81,37 +89,21 @@ void MessagePortProvider::PostMessageToFrame(
 #endif
 
 #if defined(OS_FUCHSIA) || BUILDFLAG(IS_CHROMECAST)
-// TODO(crbug.com/803242): Deprecated and will be shortly removed.
-// static
-void MessagePortProvider::PostMessageToFrame(
-    WebContents* web_contents,
-    const base::string16& source_origin,
-    const base::Optional<base::string16>& target_origin,
-    const base::string16& data,
-    std::vector<mojo::ScopedMessagePipeHandle> channels) {
-  std::vector<MessagePortChannel> channels_wrapped;
-  for (mojo::ScopedMessagePipeHandle& handle : channels) {
-    channels_wrapped.emplace_back(std::move(handle));
-  }
-  PostMessageToFrameInternal(web_contents, source_origin,
-                             target_origin.value_or(base::EmptyString16()),
-                             data, channels_wrapped);
-}
-
 // static
 void MessagePortProvider::PostMessageToFrame(
     WebContents* web_contents,
     const base::string16& source_origin,
     const base::Optional<base::string16>& target_origin,
     const base::string16& data,
-    std::vector<blink::WebMessagePort> channels) {
-  std::vector<MessagePortChannel> channels_wrapped;
-  for (blink::WebMessagePort& port : channels) {
-    channels_wrapped.emplace_back(port.PassHandle());
-  }
+    std::vector<blink::WebMessagePort> ports) {
+  // Extract the underlying descriptors.
+  std::vector<blink::MessagePortDescriptor> descriptors;
+  descriptors.reserve(ports.size());
+  for (size_t i = 0; i < ports.size(); ++i)
+    descriptors.push_back(ports[i].PassPort());
   PostMessageToFrameInternal(web_contents, source_origin,
                              target_origin.value_or(base::EmptyString16()),
-                             data, channels_wrapped);
+                             data, std::move(descriptors));
 }
 #endif
 
diff --git a/chromium/content/browser/message_port_provider_browsertest.cc b/chromium/content/browser/message_port_provider_browsertest.cc
index 5f88921935b..d4e769d4f3b 100644
--- a/chromium/content/browser/message_port_provider_browsertest.cc
+++ b/chromium/content/browser/message_port_provider_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/message_port_provider.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/mojo_sandbox_browsertest.cc b/chromium/content/browser/mojo_sandbox_browsertest.cc
index 16b2847a061..d7a5d8ce371 100644
--- a/chromium/content/browser/mojo_sandbox_browsertest.cc
+++ b/chromium/content/browser/mojo_sandbox_browsertest.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "base/containers/span.h"
 #include "base/macros.h"
 #include "base/memory/read_only_shared_memory_region.h"
@@ -17,13 +18,17 @@
 #include "base/strings/string_piece.h"
 #include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
+#include "build/build_config.h"
 #include "content/browser/utility_process_host.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_service.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
+#include "services/service_manager/sandbox/sandbox.h"
+#include "services/service_manager/sandbox/switches.h"
 
 namespace content {
 namespace {
@@ -34,16 +39,27 @@ class MojoSandboxTest : public ContentBrowserTest {
  public:
   MojoSandboxTest() = default;
 
-  void SetUpOnMainThread() override {
+  using BeforeStartCallback = base::OnceCallback<void(UtilityProcessHost*)>;
+
+  void StartProcess(BeforeStartCallback callback = BeforeStartCallback()) {
     base::RunLoop run_loop;
     base::PostTaskAndReply(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&MojoSandboxTest::StartUtilityProcessOnIoThread,
-                       base::Unretained(this)),
+                       base::Unretained(this), std::move(callback)),
         run_loop.QuitClosure());
     run_loop.Run();
   }
 
+  mojo::Remote<mojom::TestService> BindTestService() {
+    mojo::Remote<mojom::TestService> test_service;
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&MojoSandboxTest::BindTestServiceOnIoThread,
+                                  base::Unretained(this),
+                                  test_service.BindNewPipeAndPassReceiver()));
+    return test_service;
+  }
+
   void TearDownOnMainThread() override {
     base::RunLoop run_loop;
     base::PostTaskAndReply(
@@ -58,12 +74,19 @@ class MojoSandboxTest : public ContentBrowserTest {
   std::unique_ptr<UtilityProcessHost> host_;
 
  private:
-  void StartUtilityProcessOnIoThread() {
+  void StartUtilityProcessOnIoThread(BeforeStartCallback callback) {
     host_.reset(new UtilityProcessHost());
     host_->SetMetricsName("mojo_sandbox_test_process");
+    if (callback)
+      std::move(callback).Run(host_.get());
     ASSERT_TRUE(host_->Start());
   }
 
+  void BindTestServiceOnIoThread(
+      mojo::PendingReceiver<mojom::TestService> receiver) {
+    host_->GetChildProcess()->BindReceiver(std::move(receiver));
+  }
+
   void StopUtilityProcessOnIoThread() { host_.reset(); }
 
   DISALLOW_COPY_AND_ASSIGN(MojoSandboxTest);
@@ -72,15 +95,8 @@ class MojoSandboxTest : public ContentBrowserTest {
 // Ensures that a read-only shared memory region can be created within a
 // sandboxed process.
 IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessReadOnlySharedMemoryRegion) {
-  mojo::Remote<mojom::TestService> test_service;
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(
-          [](UtilityProcessHost* host,
-             mojo::PendingReceiver<mojom::TestService> receiver) {
-            host->GetChildProcess()->BindReceiver(std::move(receiver));
-          },
-          host_.get(), test_service.BindNewPipeAndPassReceiver()));
+  StartProcess();
+  mojo::Remote<mojom::TestService> test_service = BindTestService();
 
   bool got_response = false;
   base::RunLoop run_loop;
@@ -103,15 +119,8 @@ IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessReadOnlySharedMemoryRegion) {
 // Ensures that a writable shared memory region can be created within a
 // sandboxed process.
 IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessWritableSharedMemoryRegion) {
-  mojo::Remote<mojom::TestService> test_service;
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(
-          [](UtilityProcessHost* host,
-             mojo::PendingReceiver<mojom::TestService> receiver) {
-            host->GetChildProcess()->BindReceiver(std::move(receiver));
-          },
-          host_.get(), test_service.BindNewPipeAndPassReceiver()));
+  StartProcess();
+  mojo::Remote<mojom::TestService> test_service = BindTestService();
 
   bool got_response = false;
   base::RunLoop run_loop;
@@ -134,15 +143,8 @@ IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessWritableSharedMemoryRegion) {
 // Ensures that an unsafe shared memory region can be created within a
 // sandboxed process.
 IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessUnsafeSharedMemoryRegion) {
-  mojo::Remote<mojom::TestService> test_service;
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(
-          [](UtilityProcessHost* host,
-             mojo::PendingReceiver<mojom::TestService> receiver) {
-            host->GetChildProcess()->BindReceiver(std::move(receiver));
-          },
-          host_.get(), test_service.BindNewPipeAndPassReceiver()));
+  StartProcess();
+  mojo::Remote<mojom::TestService> test_service = BindTestService();
 
   bool got_response = false;
   base::RunLoop run_loop;
@@ -162,5 +164,59 @@ IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessUnsafeSharedMemoryRegion) {
   EXPECT_TRUE(got_response);
 }
 
+// Test for service_manager::IsProcessSandboxed().
+IN_PROC_BROWSER_TEST_F(MojoSandboxTest, IsProcessSandboxed) {
+  StartProcess();
+  mojo::Remote<mojom::TestService> test_service = BindTestService();
+
+  // The browser should not be considered sandboxed.
+  EXPECT_FALSE(service_manager::Sandbox::IsProcessSandboxed());
+
+  base::Optional<bool> maybe_is_sandboxed;
+  base::RunLoop run_loop;
+  test_service.set_disconnect_handler(run_loop.QuitClosure());
+  test_service->IsProcessSandboxed(
+      base::BindLambdaForTesting([&](bool is_sandboxed) {
+        maybe_is_sandboxed = is_sandboxed;
+        run_loop.Quit();
+      }));
+  run_loop.Run();
+  ASSERT_TRUE(maybe_is_sandboxed.has_value());
+  EXPECT_TRUE(maybe_is_sandboxed.value());
+}
+
+IN_PROC_BROWSER_TEST_F(MojoSandboxTest, NotIsProcessSandboxed) {
+  StartProcess(base::BindOnce([](UtilityProcessHost* host) {
+    host->SetSandboxType(service_manager::SandboxType::kNoSandbox);
+  }));
+  mojo::Remote<mojom::TestService> test_service = BindTestService();
+
+  // The browser should not be considered sandboxed.
+  EXPECT_FALSE(service_manager::Sandbox::IsProcessSandboxed());
+
+  base::Optional<bool> maybe_is_sandboxed;
+  base::RunLoop run_loop;
+  test_service.set_disconnect_handler(run_loop.QuitClosure());
+  test_service->IsProcessSandboxed(
+      base::BindLambdaForTesting([&](bool is_sandboxed) {
+        maybe_is_sandboxed = is_sandboxed;
+        run_loop.Quit();
+      }));
+  run_loop.Run();
+  ASSERT_TRUE(maybe_is_sandboxed.has_value());
+#if defined(OS_ANDROID)
+  // Android does not support unsandboxed utility processes. See
+  // org.chromium.content.browser.ChildProcessLauncherHelperImpl#createAndStart
+  EXPECT_TRUE(maybe_is_sandboxed.value());
+#else
+  // If the content_browsertests is launched with --no-sandbox, that will
+  // get passed down to the browser and all child processes. In that case,
+  // IsProcessSandboxed() will report true, per the API.
+  bool no_sandbox = base::CommandLine::ForCurrentProcess()->HasSwitch(
+      service_manager::switches::kNoSandbox);
+  EXPECT_EQ(no_sandbox, maybe_is_sandboxed.value());
+#endif
+}
+
 }  //  namespace
 }  //  namespace content
diff --git a/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc b/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
index b92c29df06a..8a36eaa3d0d 100644
--- a/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
+++ b/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/back_forward_cache_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -77,8 +78,7 @@ class FileSystemChooserBrowserTest : public ContentBrowserTest {
     base::ScopedAllowBlockingForTesting allow_blocking;
     base::FilePath result;
     EXPECT_TRUE(base::CreateTemporaryFileInDir(temp_dir_.GetPath(), &result));
-    EXPECT_EQ(int{contents.size()},
-              base::WriteFile(result, contents.data(), contents.size()));
+    EXPECT_TRUE(base::WriteFile(result, contents));
     return result;
   }
 
@@ -90,7 +90,7 @@ class FileSystemChooserBrowserTest : public ContentBrowserTest {
     return result;
   }
 
- private:
+ protected:
   base::test::ScopedFeatureList scoped_feature_list_;
   base::ScopedTempDir temp_dir_;
 };
@@ -128,6 +128,36 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenFile) {
              "return await file.text(); })()"));
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenFileNonASCII) {
+  const std::string file_contents = "hello world!";
+  const base::FilePath test_file =
+      temp_dir_.GetPath().Append(base::FilePath::FromUTF8Unsafe("😋.txt"));
+  {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    EXPECT_TRUE(base::WriteFile(test_file, file_contents));
+  }
+
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(
+      new FakeSelectFileDialogFactory({test_file}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EXPECT_EQ(test_file.BaseName().AsUTF8Unsafe(),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries();"
+                   "  self.selected_entry = e;"
+                   "  return e.name; })()"));
+  EXPECT_EQ(ui::SelectFileDialog::SELECT_OPEN_FILE, dialog_params.type);
+  EXPECT_EQ(shell()->web_contents()->GetTopLevelNativeWindow(),
+            dialog_params.owning_window);
+  EXPECT_EQ(
+      file_contents,
+      EvalJs(shell(),
+             "(async () => { const file = await self.selected_entry.getFile(); "
+             "return await file.text(); })()"));
+}
+
 IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, FullscreenOpenFile) {
   const std::string file_contents = "hello world!";
   const base::FilePath test_file = CreateTestFile(file_contents);
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_browsertest.cc b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_browsertest.cc
index a337f59b144..5af79124fe6 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_browsertest.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -61,8 +62,7 @@ class NativeFileSystemFileWriterBrowserTest : public ContentBrowserTest {
     base::FilePath test_file;
     EXPECT_TRUE(
         base::CreateTemporaryFileInDir(temp_dir_.GetPath(), &test_file));
-    EXPECT_EQ(int{contents.size()},
-              base::WriteFile(test_file, contents.data(), contents.size()));
+    EXPECT_TRUE(base::WriteFile(test_file, contents));
 
     ui::SelectFileDialog::SetFactory(
         new FakeSelectFileDialogFactory({test_file}));
@@ -88,9 +88,7 @@ class NativeFileSystemFileWriterBrowserTest : public ContentBrowserTest {
     base::FilePath test_file =
         temp_dir_.GetPath().AppendASCII("to_be_quarantined.exe");
     std::string file_data = "hello world!";
-    int file_size = static_cast<int>(file_data.size());
-    EXPECT_EQ(file_size,
-              base::WriteFile(test_file, file_data.c_str(), file_size));
+    EXPECT_TRUE(base::WriteFile(test_file, file_data));
 
     ui::SelectFileDialog::SetFactory(
         new FakeSelectFileDialogFactory({test_file}));
diff --git a/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc b/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
index f66f994afc3..2258316ff17 100644
--- a/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
@@ -5,9 +5,10 @@
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 
 #include "base/callback_helpers.h"
+#include "base/check_op.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
+#include "base/notreached.h"
 #include "base/strings/strcat.h"
 #include "base/task/post_task.h"
 #include "base/task/thread_pool.h"
@@ -865,7 +866,10 @@ NativeFileSystemManagerImpl::CreateFileSystemURLFromPath(
 
   base::FilePath root_path =
       isolated_context->CreateVirtualRootPath(result.file_system.id());
-  base::FilePath isolated_path = root_path.AppendASCII(result.base_name);
+  // FromUTF8Unsafe in the following line is safe since result.base_name was the
+  // result of calling AsUTF8Unsafe on a base::FilePath in the first place.
+  base::FilePath isolated_path =
+      root_path.Append(base::FilePath::FromUTF8Unsafe(result.base_name));
 
   result.url = context()->CreateCrackedFileSystemURL(
       origin, storage::kFileSystemTypeIsolated, isolated_path);
diff --git a/chromium/content/browser/native_io/native_io_file_host.cc b/chromium/content/browser/native_io/native_io_file_host.cc
index bd97f53e62b..3a647302023 100644
--- a/chromium/content/browser/native_io/native_io_file_host.cc
+++ b/chromium/content/browser/native_io/native_io_file_host.cc
@@ -24,7 +24,7 @@ NativeIOFileHost::NativeIOFileHost(
   // base::Unretained is safe here because this NativeIOFileHost owns
   // |receiver_|. So, the unretained NativeIOFileHost is guaranteed to outlive
   // |receiver_| and the closure that it uses.
-  receiver_.set_disconnect_handler(base::BindRepeating(
+  receiver_.set_disconnect_handler(base::BindOnce(
       &NativeIOFileHost::OnReceiverDisconnect, base::Unretained(this)));
 }
 
diff --git a/chromium/content/browser/navigation_browsertest.cc b/chromium/content/browser/navigation_browsertest.cc
index 0a8a18d178d..f68dd299f00 100644
--- a/chromium/content/browser/navigation_browsertest.cc
+++ b/chromium/content/browser/navigation_browsertest.cc
@@ -43,6 +43,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -60,6 +61,7 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "content/test/did_commit_navigation_interceptor.h"
 #include "content/test/fake_network_url_loader_factory.h"
+#include "content/test/test_content_browser_client.h"
 #include "content/test/test_render_frame_host_factory.h"
 #include "ipc/ipc_security_test_util.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
@@ -72,6 +74,7 @@
 #include "net/test/url_request/url_request_failed_job.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
+#include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "url/gurl.h"
 #include "url/url_util.h"
 
@@ -167,10 +170,12 @@ class RenderFrameHostFactoryForHistoryBackInterceptor
       FrameTree* frame_tree,
       FrameTreeNode* frame_tree_node,
       int32_t routing_id,
+      const base::UnguessableToken& frame_token,
       bool renderer_initiated_creation) override {
     return base::WrapUnique(new RenderFrameHostImplForHistoryBackInterceptor(
         site_instance, std::move(render_view_host), delegate, frame_tree,
-        frame_tree_node, routing_id, renderer_initiated_creation));
+        frame_tree_node, routing_id, frame_token, renderer_initiated_creation,
+        RenderFrameHostImpl::LifecycleState::kActive));
   }
 };
 
@@ -310,6 +315,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, BrowserInitiatedNavigations) {
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
+    EXPECT_FALSE(observer.last_initiator_routing_id());
   }
 
   RenderFrameHost* initial_rfh =
@@ -326,6 +332,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, BrowserInitiatedNavigations) {
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
+    EXPECT_FALSE(observer.last_initiator_routing_id());
   }
 
   // The RenderFrameHost should not have changed.
@@ -342,6 +349,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, BrowserInitiatedNavigations) {
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
+    EXPECT_FALSE(observer.last_initiator_routing_id());
   }
 
   // The RenderFrameHost should have changed.
@@ -362,6 +370,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
+    EXPECT_FALSE(observer.last_initiator_routing_id());
   }
 
   RenderFrameHost* initial_rfh =
@@ -382,8 +391,13 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
     EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
-    EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetLastCommittedOrigin(),
+
+    RenderFrameHost* main_rfh = shell()->web_contents()->GetMainFrame();
+    EXPECT_EQ(main_rfh->GetLastCommittedOrigin(),
               observer.last_initiator_origin());
+    EXPECT_EQ(GlobalFrameRoutingId(main_rfh->GetProcess()->GetID(),
+                                   main_rfh->GetRoutingID()),
+              observer.last_initiator_routing_id());
   }
 
   // The RenderFrameHost should not have changed.
@@ -411,6 +425,8 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
           ->root()
           ->current_frame_host();
   url::Origin initial_origin = initial_rfh->GetLastCommittedOrigin();
+  GlobalFrameRoutingId initiator_routing_id(initial_rfh->GetProcess()->GetID(),
+                                            initial_rfh->GetRoutingID());
 
   // Simulate clicking on a cross-site link.
   {
@@ -432,6 +448,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_EQ(initial_origin, observer.last_initiator_origin().value());
+    EXPECT_EQ(initiator_routing_id, observer.last_initiator_routing_id());
   }
 
   // The RenderFrameHost should not have changed unless site-per-process is
@@ -650,8 +667,7 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, PostUploadIllegalFilePath) {
   std::string file_content("test-file-content");
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-  ASSERT_LT(
-      0, base::WriteFile(file_path, file_content.data(), file_content.size()));
+  ASSERT_TRUE(base::WriteFile(file_path, file_content));
 
   base::RunLoop run_loop;
   // Fill out the form to refer to the test file.
@@ -802,15 +818,14 @@ IN_PROC_BROWSER_TEST_P(NetworkIsolationNavigationBrowserTest,
   base::Optional<network::ResourceRequest> request =
       monitor.GetRequestInfo(url);
   ASSERT_TRUE(request->trusted_params);
-  EXPECT_EQ(net::NetworkIsolationKey(origin, origin),
-            request->trusted_params->network_isolation_key);
-  EXPECT_EQ(network::mojom::UpdateNetworkIsolationKeyOnRedirect::
-                kUpdateTopFrameAndFrameOrigin,
-            request->trusted_params->update_network_isolation_key_on_redirect);
+  EXPECT_TRUE(net::IsolationInfo::Create(
+                  net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin,
+                  origin, net::SiteForCookies::FromOrigin(origin))
+                  .IsEqualForTesting(request->trusted_params->isolation_info));
 }
 
 IN_PROC_BROWSER_TEST_P(NetworkIsolationNavigationBrowserTest,
-                       RenderNavigationNetworkIsolationKey) {
+                       RenderNavigationIsolationInfo) {
   GURL url(embedded_test_server()->GetURL("/title2.html"));
   url::Origin origin = url::Origin::Create(url);
   EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
@@ -821,15 +836,14 @@ IN_PROC_BROWSER_TEST_P(NetworkIsolationNavigationBrowserTest,
   base::Optional<network::ResourceRequest> request =
       monitor.GetRequestInfo(url);
   ASSERT_TRUE(request->trusted_params);
-  EXPECT_EQ(net::NetworkIsolationKey(origin, origin),
-            request->trusted_params->network_isolation_key);
-  EXPECT_EQ(network::mojom::UpdateNetworkIsolationKeyOnRedirect::
-                kUpdateTopFrameAndFrameOrigin,
-            request->trusted_params->update_network_isolation_key_on_redirect);
+  EXPECT_TRUE(net::IsolationInfo::Create(
+                  net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin,
+                  origin, net::SiteForCookies::FromOrigin(origin))
+                  .IsEqualForTesting(request->trusted_params->isolation_info));
 }
 
 IN_PROC_BROWSER_TEST_P(NetworkIsolationNavigationBrowserTest,
-                       SubframeNetworkIsolationKey) {
+                       SubframeIsolationInfo) {
   GURL url(embedded_test_server()->GetURL("/page_with_iframe.html"));
   GURL iframe_document = embedded_test_server()->GetURL("/title1.html");
   url::Origin origin = url::Origin::Create(url);
@@ -842,21 +856,20 @@ IN_PROC_BROWSER_TEST_P(NetworkIsolationNavigationBrowserTest,
       monitor.GetRequestInfo(url);
   ASSERT_TRUE(main_frame_request.has_value());
   ASSERT_TRUE(main_frame_request->trusted_params);
-  EXPECT_EQ(net::NetworkIsolationKey(origin, origin),
-            main_frame_request->trusted_params->network_isolation_key);
-  EXPECT_EQ(network::mojom::UpdateNetworkIsolationKeyOnRedirect::
-                kUpdateTopFrameAndFrameOrigin,
-            main_frame_request->trusted_params
-                ->update_network_isolation_key_on_redirect);
+  EXPECT_TRUE(net::IsolationInfo::Create(
+                  net::IsolationInfo::RedirectMode::kUpdateTopFrame, origin,
+                  origin, net::SiteForCookies::FromOrigin(origin))
+                  .IsEqualForTesting(
+                      main_frame_request->trusted_params->isolation_info));
 
   base::Optional<network::ResourceRequest> iframe_request =
       monitor.GetRequestInfo(iframe_document);
   ASSERT_TRUE(iframe_request->trusted_params);
-  EXPECT_EQ(net::NetworkIsolationKey(origin, iframe_origin),
-            iframe_request->trusted_params->network_isolation_key);
-  EXPECT_EQ(
-      network::mojom::UpdateNetworkIsolationKeyOnRedirect::kUpdateFrameOrigin,
-      iframe_request->trusted_params->update_network_isolation_key_on_redirect);
+  EXPECT_TRUE(
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateFrameOnly, origin,
+          iframe_origin, net::SiteForCookies::FromOrigin(origin))
+          .IsEqualForTesting(iframe_request->trusted_params->isolation_info));
 }
 
 // Tests that the initiator is not set for a browser initiated top frame
@@ -978,6 +991,177 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
   EXPECT_EQ(starting_page_origin, request->request_initiator);
 }
 
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
+                       RendererInitiatedCrossSiteNewWindowInitator) {
+  GURL url(embedded_test_server()->GetURL("/simple_links.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  RenderFrameHost* initial_rfh =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetFrameTree()
+          ->root()
+          ->current_frame_host();
+  GlobalFrameRoutingId initiator_routing_id(initial_rfh->GetProcess()->GetID(),
+                                            initial_rfh->GetRoutingID());
+
+  // Simulate clicking on a cross-site link.
+  {
+    const char kReplacePortNumber[] =
+        "window.domAutomationController.send(setPortNumber(%d));";
+    uint16_t port_number = embedded_test_server()->port();
+    GURL url = embedded_test_server()->GetURL("foo.com", "/title2.html");
+    bool success = false;
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(
+        shell(), base::StringPrintf(kReplacePortNumber, port_number),
+        &success));
+    success = false;
+
+    ShellAddedObserver new_shell_observer;
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(
+        shell(),
+        "window.domAutomationController.send(clickCrossSiteNewWindowLink());",
+        &success));
+    EXPECT_TRUE(success);
+
+    TestNavigationObserver observer(
+        new_shell_observer.GetShell()->web_contents());
+    observer.Wait();
+    EXPECT_EQ(url, observer.last_navigation_url());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(initiator_routing_id, observer.last_initiator_routing_id());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
+                       RendererInitiatedWithSubframeInitator) {
+  GURL url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(a())"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  GURL subframe_url =
+      embedded_test_server()->GetURL("a.com", "/simple_links.html");
+  FrameTreeNode* main_frame =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetFrameTree()
+          ->root();
+  NavigateFrameToURL(main_frame->child_at(0), subframe_url);
+
+  RenderFrameHostImpl* subframe_rfh =
+      main_frame->child_at(0)->current_frame_host();
+  GlobalFrameRoutingId initiator_routing_id(subframe_rfh->GetProcess()->GetID(),
+                                            subframe_rfh->GetRoutingID());
+
+  // Simulate clicking on a cross-site link.
+  {
+    const char kReplacePortNumber[] =
+        "window.domAutomationController.send(setPortNumber(%d));";
+    uint16_t port_number = embedded_test_server()->port();
+    GURL url = embedded_test_server()->GetURL("foo.com", "/title2.html");
+    bool success = false;
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(
+        subframe_rfh, base::StringPrintf(kReplacePortNumber, port_number),
+        &success));
+    success = false;
+
+    ShellAddedObserver new_shell_observer;
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(
+        subframe_rfh,
+        "window.domAutomationController.send(clickCrossSiteNewWindowLink());",
+        &success));
+    EXPECT_TRUE(success);
+
+    TestNavigationObserver observer(
+        new_shell_observer.GetShell()->web_contents());
+    observer.Wait();
+    EXPECT_EQ(url, observer.last_navigation_url());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(initiator_routing_id, observer.last_initiator_routing_id());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
+                       InitiatorFrameStateConsistentAtDidStartNavigation) {
+  GURL form_page_url(embedded_test_server()->GetURL(
+      "a.com", "/form_that_posts_to_echoall.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), form_page_url));
+
+  // Give the form an action that will navigate to a slow page.
+  GURL form_action_url(embedded_test_server()->GetURL("b.com", "/slow?100"));
+  EXPECT_TRUE(
+      ExecJs(shell(), JsReplace("document.getElementById('form').action = $1",
+                                form_action_url)));
+
+  // Open a new window that can be targeted by the form submission.
+  WebContents* form_contents = shell()->web_contents();
+  ShellAddedObserver new_shell_observer;
+  EXPECT_TRUE(ExecJs(shell(), "window.open('about:blank', 'target_frame');"));
+  WebContents* popup_contents = new_shell_observer.GetShell()->web_contents();
+
+  EXPECT_TRUE(
+      ExecJs(form_contents,
+             "document.getElementById('form').target = 'target_frame';"));
+
+  TestNavigationManager popup_manager(popup_contents, form_action_url);
+  TestNavigationManager form_manager(
+      form_contents, embedded_test_server()->GetURL("a.com", "/title2.html"));
+
+  // Submit the form and navigate the form's page.
+  EXPECT_TRUE(ExecJs(form_contents, "window.location.href = 'title2.html'"));
+  EXPECT_TRUE(
+      ExecJs(form_contents, "document.getElementById('form').submit();"));
+
+  // The form page's navigation should start prior to the form navigation.
+  EXPECT_TRUE(form_manager.WaitForRequestStart());
+  EXPECT_FALSE(popup_manager.GetNavigationHandle());
+
+  // When the navigation starts for the popup, ensure that the original page has
+  // not finished navigating. If this was not the case, we could not make any
+  // statements on the validity of initiator state during a navigation.
+  // Navigation handles are only available prior to DidFinishNavigation().
+  EXPECT_TRUE(popup_manager.WaitForRequestStart());
+  EXPECT_TRUE(form_manager.GetNavigationHandle());
+}
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest,
+                       RendererInitiatedMiddleClickInitator) {
+  GURL url(embedded_test_server()->GetURL("/simple_links.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  RenderFrameHost* initial_rfh =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetFrameTree()
+          ->root()
+          ->current_frame_host();
+  GlobalFrameRoutingId initiator_routing_id(initial_rfh->GetProcess()->GetID(),
+                                            initial_rfh->GetRoutingID());
+
+  // Simulate middle-clicking on a cross-site link.
+  {
+    const char kReplacePortNumber[] =
+        "window.domAutomationController.send(setPortNumber(%d));";
+    uint16_t port_number = embedded_test_server()->port();
+    GURL url = embedded_test_server()->GetURL("foo.com", "/title2.html");
+    bool success = false;
+    EXPECT_TRUE(ExecuteScriptAndExtractBool(
+        shell(), base::StringPrintf(kReplacePortNumber, port_number),
+        &success));
+    success = false;
+
+    ShellAddedObserver new_shell_observer;
+    EXPECT_EQ(true, EvalJs(shell(), R"(
+      target = document.getElementById('cross_site_link');
+      var evt = new MouseEvent("click", {"button": 1 /* middle_button */});
+      target.dispatchEvent(evt);)"));
+
+    TestNavigationObserver observer(
+        new_shell_observer.GetShell()->web_contents());
+    observer.Wait();
+    EXPECT_EQ(url, observer.last_navigation_url());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(initiator_routing_id, observer.last_initiator_routing_id());
+  }
+}
+
 // Data URLs can have a reference fragment like any other URLs. This test makes
 // sure it is taken into account.
 IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, DataURLWithReferenceFragment) {
@@ -1761,6 +1945,117 @@ IN_PROC_BROWSER_TEST_F(NavigationBaseBrowserTest,
       base::Contains(response_2.http_request()->headers, "header_name"));
 }
 
+// Name of header used by CorsInjectingUrlLoader.
+const std::string kCorsHeaderName = "test-header";
+
+// URLLoaderThrottle that stores the last value of |kCorsHeaderName|.
+class CorsInjectingUrlLoader : public blink::URLLoaderThrottle {
+ public:
+  explicit CorsInjectingUrlLoader(std::string* last_cors_header_value)
+      : last_cors_header_value_(last_cors_header_value) {}
+
+  // blink::URLLoaderThrottle:
+  void WillStartRequest(network::ResourceRequest* request,
+                        bool* defer) override {
+    if (!request->cors_exempt_headers.GetHeader(kCorsHeaderName,
+                                                last_cors_header_value_)) {
+      last_cors_header_value_->clear();
+    }
+  }
+
+ private:
+  // See |NavigationCorsExemptBrowserTest::last_cors_header_value_| for details.
+  std::string* last_cors_header_value_;
+};
+
+// ContentBrowserClient responsible for creating CorsInjectingUrlLoader.
+class CorsContentBrowserClient : public TestContentBrowserClient {
+ public:
+  explicit CorsContentBrowserClient(std::string* last_cors_header_value)
+      : last_cors_header_value_(last_cors_header_value) {}
+
+  // ContentBrowserClient overrides:
+  std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
+  CreateURLLoaderThrottles(
+      const network::ResourceRequest& request,
+      BrowserContext* browser_context,
+      const base::RepeatingCallback<WebContents*()>& wc_getter,
+      NavigationUIData* navigation_ui_data,
+      int frame_tree_node_id) override {
+    std::vector<std::unique_ptr<blink::URLLoaderThrottle>> throttles;
+    throttles.push_back(
+        std::make_unique<CorsInjectingUrlLoader>(last_cors_header_value_));
+    return throttles;
+  }
+
+ private:
+  // See |NavigationCorsExemptBrowserTest::last_cors_header_value_| for details.
+  std::string* last_cors_header_value_;
+};
+
+class NavigationCorsExemptBrowserTest : public NavigationBaseBrowserTest {
+ public:
+  NavigationCorsExemptBrowserTest() = default;
+
+ protected:
+  const std::string& last_cors_header_value() const {
+    return last_cors_header_value_;
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ShellContentBrowserClient::set_allow_any_cors_exempt_header_for_browser(
+        true);
+    NavigationBaseBrowserTest::SetUpCommandLine(command_line);
+  }
+  void SetUpOnMainThread() override {
+    original_client_ =
+        SetBrowserClientForTesting(&cors_content_browser_client_);
+    host_resolver()->AddRule("*", "127.0.0.1");
+  }
+  void TearDownOnMainThread() override {
+    if (original_client_)
+      SetBrowserClientForTesting(original_client_);
+    ShellContentBrowserClient::set_allow_any_cors_exempt_header_for_browser(
+        false);
+  }
+
+ private:
+  // Last value of kCorsHeaderName. Set by CorsInjectingUrlLoader.
+  std::string last_cors_header_value_;
+  CorsContentBrowserClient cors_content_browser_client_{
+      &last_cors_header_value_};
+  ContentBrowserClient* original_client_ = nullptr;
+};
+
+// Verifies a header added by way of SetRequestHeader() makes it into
+// |cors_exempt_headers|.
+IN_PROC_BROWSER_TEST_F(NavigationCorsExemptBrowserTest,
+                       SetCorsExemptRequestHeader) {
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  const std::string header_value = "value";
+  content::TestNavigationThrottleInserter throttle_inserter(
+      shell()->web_contents(),
+      base::BindLambdaForTesting([header_value](NavigationHandle* handle)
+                                     -> std::unique_ptr<NavigationThrottle> {
+        NavigationRequest* request = NavigationRequest::From(handle);
+        auto throttle = std::make_unique<TestNavigationThrottle>(handle);
+        throttle->SetCallback(
+            TestNavigationThrottle::WILL_START_REQUEST,
+            base::BindLambdaForTesting([request, header_value]() {
+              request->SetCorsExemptRequestHeader(kCorsHeaderName,
+                                                  header_value);
+            }));
+        return throttle;
+      }));
+  shell()->LoadURL(embedded_test_server()->GetURL("/doc"));
+  response.WaitForRequest();
+  EXPECT_EQ(header_value, response.http_request()->headers.at(kCorsHeaderName));
+  EXPECT_EQ(header_value, last_cors_header_value());
+}
+
 struct NewWebContentsData {
   NewWebContentsData() = default;
   NewWebContentsData(NewWebContentsData&& other)
@@ -1951,320 +2246,6 @@ IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, AboutSrcDocUsesBeginNavigation) {
   interceptor.Wait(1);  // DidCommitNavigation is called.
 }
 
-class TextFragmentAnchorBrowserTest : public NavigationBaseBrowserTest {
- public:
-  TextFragmentAnchorBrowserTest() {
-    feature_list_.InitAndEnableFeature(features::kDocumentPolicy);
-  }
-
- protected:
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    NavigationBaseBrowserTest::SetUpCommandLine(command_line);
-
-    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
-                                    "TextFragmentIdentifiers");
-  }
-
-  // Simulates a click on the middle of the DOM element with the given |id|.
-  void ClickElementWithId(WebContents* web_contents, const std::string& id) {
-    // Get the center coordinates of the DOM element.
-    const int x = EvalJs(web_contents,
-                         JsReplace("const bounds = "
-                                   "document.getElementById($1)."
-                                   "getBoundingClientRect();"
-                                   "Math.floor(bounds.left + bounds.width / 2)",
-                                   id))
-                      .ExtractInt();
-    const int y = EvalJs(web_contents,
-                         JsReplace("const bounds = "
-                                   "document.getElementById($1)."
-                                   "getBoundingClientRect();"
-                                   "Math.floor(bounds.top + bounds.height / 2)",
-                                   id))
-                      .ExtractInt();
-
-    SimulateMouseClickAt(web_contents, 0, blink::WebMouseEvent::Button::kLeft,
-                         gfx::Point(x, y));
-  }
-
-  void WaitForPageLoad(WebContents* contents) {
-    EXPECT_TRUE(WaitForLoadStop(contents));
-    EXPECT_TRUE(WaitForRenderFrameReady(contents->GetMainFrame()));
-  }
-
-  RenderWidgetHostImpl* GetWidgetHost() {
-    return RenderWidgetHostImpl::From(
-        shell()->web_contents()->GetRenderViewHost()->GetWidget());
-  }
-
-  base::test::ScopedFeatureList feature_list_;
-};
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest, EnabledOnUserNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/target_text_link.html"));
-  GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WebContents* main_contents = shell()->web_contents();
-  TestNavigationObserver observer(main_contents);
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  // We need to wait until hit test data is available.
-  HitTestRegionObserver hittest_observer(GetWidgetHost()->GetFrameSinkId());
-  hittest_observer.WaitForHitTestData();
-
-  ClickElementWithId(main_contents, "link");
-  observer.Wait();
-  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(
-      /*expected_scroll_offset_at_top=*/false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       EnabledOnBrowserNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(
-      /*expected_scroll_offset_at_top=*/false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       EnabledOnUserGestureScriptNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/empty.html"));
-  GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WebContents* main_contents = shell()->web_contents();
-  TestNavigationObserver observer(main_contents);
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  // ExecuteScript executes with a user gesture
-  EXPECT_TRUE(ExecuteScript(main_contents,
-                            "location = '" + target_text_url.spec() + "';"));
-  observer.Wait();
-  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(
-      /*expected_scroll_offset_at_top=*/false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       DisabledOnScriptNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/empty.html"));
-  GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WebContents* main_contents = shell()->web_contents();
-  TestNavigationObserver observer(main_contents);
-  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
-      main_contents, "location = '" + target_text_url.spec() + "';"));
-  observer.Wait();
-  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
-
-  WaitForPageLoad(main_contents);
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(GetWidgetHost());
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       DisabledOnScriptHistoryNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-  GURL url(embedded_test_server()->GetURL("/empty.html"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), target_text_url));
-
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(false);
-
-  // Scroll the page back to top so scroll restoration does not scroll the
-  // target back into view.
-  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 0)"));
-  frame_observer.WaitForScrollOffsetAtTop(true);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  TestNavigationObserver observer(main_contents);
-  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(main_contents, "history.back()"));
-  observer.Wait();
-  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
-
-  WaitForPageLoad(main_contents);
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(GetWidgetHost());
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       EnabledOnSameDocumentBrowserNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-
-  // Scroll the page back to top.
-  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 0)"));
-  frame_observer.WaitForScrollOffsetAtTop(true);
-
-  // Perform a same-document browser initiated navigation
-  GURL same_doc_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=some"));
-  EXPECT_TRUE(NavigateToURL(shell(), same_doc_url));
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(
-      /*expected_scroll_offset_at_top=*/false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       DisabledOnSameDocumentScriptNavigation) {
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(
-      embedded_test_server()->GetURL("/scrollable_page_with_content.html"));
-  GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=some"));
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
-  WebContents* main_contents = shell()->web_contents();
-  TestNavigationObserver observer(main_contents);
-  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
-      main_contents, "location = '" + target_text_url.spec() + "';"));
-  observer.Wait();
-  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
-
-  WaitForPageLoad(main_contents);
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(GetWidgetHost());
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest, EnabledByDocumentPolicy) {
-  net::test_server::ControllableHttpResponse response(embedded_test_server(),
-                                                      "/target.html");
-
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/target.html#:~:text=text"));
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  // Load the target document
-  TestNavigationManager navigation_manager(main_contents, url);
-  shell()->LoadURL(url);
-
-  // Start navigation
-  EXPECT_TRUE(navigation_manager.WaitForRequestStart());
-  navigation_manager.ResumeNavigation();
-
-  // Send Document-Policy header
-  response.WaitForRequest();
-  response.Send(
-      "HTTP/1.1 200 OK\r\n"
-      "Content-Type: text/html; charset=utf-8\r\n"
-      "Document-Policy: no-force-load-at-top\r\n"
-      "\r\n"
-      "<p style='position: absolute; top: 10000px;'>Some text</p>");
-  response.Done();
-
-  EXPECT_TRUE(navigation_manager.WaitForResponse());
-  navigation_manager.ResumeNavigation();
-  navigation_manager.WaitForNavigationFinished();
-
-  WaitForPageLoad(main_contents);
-  frame_observer.WaitForScrollOffsetAtTop(
-      /*expected_scroll_offset_at_top=*/false);
-  EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
-                       DisabledByDocumentPolicy) {
-  net::test_server::ControllableHttpResponse response(embedded_test_server(),
-                                                      "/target.html");
-
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url(embedded_test_server()->GetURL("/target.html#:~:text=text"));
-  WebContents* main_contents = shell()->web_contents();
-
-  // Load the target document
-  TestNavigationManager navigation_manager(main_contents, url);
-  shell()->LoadURL(url);
-
-  // Start navigation
-  EXPECT_TRUE(navigation_manager.WaitForRequestStart());
-  navigation_manager.ResumeNavigation();
-
-  // Send Document-Policy header
-  response.WaitForRequest();
-  response.Send(
-      "HTTP/1.1 200 OK\r\n"
-      "Content-Type: text/html; charset=utf-8\r\n"
-      "Document-Policy: force-load-at-top\r\n"
-      "\r\n"
-      "<p style='position: absolute; top: 10000px;'>Some text</p>");
-  response.Done();
-
-  EXPECT_TRUE(navigation_manager.WaitForResponse());
-  navigation_manager.ResumeNavigation();
-  navigation_manager.WaitForNavigationFinished();
-
-  WaitForPageLoad(main_contents);
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(GetWidgetHost());
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
 // Regression test for https://crbug.com/996044
 //  1) Navigate an iframe to srcdoc (about:srcdoc);
 //  2) Same-document navigation to about:srcdoc#1.
@@ -3490,86 +3471,4 @@ IN_PROC_BROWSER_TEST_F(DocumentPolicyBrowserTest,
   EXPECT_FALSE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
 }
 
-class ForceLoadAtTopBrowserTest : public NavigationBrowserTest {
- protected:
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    NavigationBaseBrowserTest::SetUpCommandLine(command_line);
-
-    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
-                                    "ForceLoadAtTop");
-  }
-};
-
-// Test that scroll restoration is disabled with ForceLoadAtTop
-IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, ScrollRestorationDisabled) {
-  GURL url(
-      embedded_test_server()->GetURL("/scrollable_page_with_content.html"));
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
-
-  // Scroll down the page a bit
-  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 1000)"));
-  frame_observer.WaitForScrollOffsetAtTop(false);
-
-  // Navigate away
-  EXPECT_TRUE(ExecuteScript(main_contents, "window.location = 'about:blank'"));
-  EXPECT_TRUE(WaitForLoadStop(main_contents));
-  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
-
-  // Navigate back
-  EXPECT_TRUE(ExecuteScript(main_contents, "history.back()"));
-  EXPECT_TRUE(WaitForLoadStop(main_contents));
-  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(RenderWidgetHostImpl::From(
-      main_contents->GetRenderViewHost()->GetWidget()));
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-// Test that element fragment anchor scrolling is disabled with ForceLoadAtTop
-IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, FragmentAnchorDisabled) {
-  GURL url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#text"));
-  WebContents* main_contents = shell()->web_contents();
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(RenderWidgetHostImpl::From(
-      main_contents->GetRenderViewHost()->GetWidget()));
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
-IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, TextFragmentAnchorDisabled) {
-  GURL url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#:~:text=text"));
-  WebContents* main_contents = shell()->web_contents();
-  RenderFrameSubmissionObserver frame_observer(main_contents);
-
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
-
-  // Wait a short amount of time to ensure the page does not scroll.
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
-  run_loop.Run();
-  RunUntilInputProcessed(RenderWidgetHostImpl::From(
-      main_contents->GetRenderViewHost()->GetWidget()));
-  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/navigation_mhtml_browsertest.cc b/chromium/content/browser/navigation_mhtml_browsertest.cc
index e5397cd6519..5259af03c98 100644
--- a/chromium/content/browser/navigation_mhtml_browsertest.cc
+++ b/chromium/content/browser/navigation_mhtml_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/threading/thread_restrictions.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -85,7 +86,7 @@ class MhtmlArchive {
     base::ScopedAllowBlockingForTesting allow_blocking_;
     EXPECT_TRUE(file_directory_.CreateUniqueTempDir());
     base::FilePath file_path = file_directory_.GetPath().AppendASCII(file);
-    EXPECT_NE(-1, base::WriteFile(file_path, document.data(), document.size()));
+    EXPECT_TRUE(base::WriteFile(file_path, document));
     return net::FilePathToFileURL(file_path);
   }
 
@@ -315,16 +316,14 @@ IN_PROC_BROWSER_TEST_F(NavigationMhtmlBrowserTest,
       "<iframe src=\"javascript:console.log('test')\"></iframe>");
   GURL mhtml_url = mhtml_archive.Write("index.mhtml");
 
-  auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-      web_contents(),
-      base::StringPrintf(
-          "Blocked script execution in '%s' because the document's frame "
-          "is sandboxed and the 'allow-scripts' permission is not set.",
-          mhtml_url.spec().c_str()));
-  web_contents()->SetDelegate(console_delegate.get());
+  WebContentsConsoleObserver console_observer(web_contents());
+  console_observer.SetPattern(base::StringPrintf(
+      "Blocked script execution in '%s' because the document's frame "
+      "is sandboxed and the 'allow-scripts' permission is not set.",
+      mhtml_url.spec().c_str()));
 
   EXPECT_TRUE(NavigateToURL(shell(), mhtml_url));
-  console_delegate->Wait();
+  console_observer.Wait();
 
   RenderFrameHostImpl* main_document = main_frame_host();
   ASSERT_EQ(1u, main_document->child_count());
@@ -343,16 +342,14 @@ IN_PROC_BROWSER_TEST_F(NavigationMhtmlBrowserTest, IframeJavascriptUrlFound) {
                                 "<iframe></iframe>");
   GURL mhtml_url = mhtml_archive.Write("index.mhtml");
 
-  auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-      web_contents(),
-      base::StringPrintf(
-          "Blocked script execution in '%s' because the document's frame "
-          "is sandboxed and the 'allow-scripts' permission is not set.",
-          mhtml_url.spec().c_str()));
-  web_contents()->SetDelegate(console_delegate.get());
+  WebContentsConsoleObserver console_observer(web_contents());
+  console_observer.SetPattern(base::StringPrintf(
+      "Blocked script execution in '%s' because the document's frame "
+      "is sandboxed and the 'allow-scripts' permission is not set.",
+      mhtml_url.spec().c_str()));
 
   EXPECT_TRUE(NavigateToURL(shell(), mhtml_url));
-  console_delegate->Wait();
+  console_observer.Wait();
 
   RenderFrameHostImpl* main_document = main_frame_host();
   ASSERT_EQ(1u, main_document->child_count());
diff --git a/chromium/content/browser/net/accept_header_browsertest.cc b/chromium/content/browser/net/accept_header_browsertest.cc
index 5af3ff3098a..24c160798f4 100644
--- a/chromium/content/browser/net/accept_header_browsertest.cc
+++ b/chromium/content/browser/net/accept_header_browsertest.cc
@@ -11,12 +11,15 @@
 #include "build/build_config.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "media/media_buildflags.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "ppapi/buildflags/buildflags.h"
+#include "third_party/blink/public/common/features.h"
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/test/ppapi/ppapi_test.h"
@@ -95,16 +98,32 @@ IN_PROC_BROWSER_TEST_F(AcceptHeaderTest, Check) {
       shell(), embedded_test_server()->GetURL("/accept-header.html")));
 
   // ResourceType::kMainFrame
-  EXPECT_EQ(
+  const char* expected_main_frame_accept_header =
       "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,"
-      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
-      GetFor("/accept-header.html"));
+      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9";
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+    expected_main_frame_accept_header =
+        "text/html,application/xhtml+xml,application/xml;q=0.9,"
+        "image/avif,image/webp,image/apng,*/*;q=0.8,"
+        "application/signed-exchange;v=b3;q=0.9";
+  }
+#endif
+  EXPECT_EQ(expected_main_frame_accept_header, GetFor("/accept-header.html"));
 
   // ResourceType::kSubFrame
-  EXPECT_EQ(
+  const char* expected_sub_frame_accept_header =
       "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,"
-      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
-      GetFor("/iframe.html"));
+      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9";
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+    expected_sub_frame_accept_header =
+        "text/html,application/xhtml+xml,application/xml;q=0.9,"
+        "image/avif,image/webp,image/apng,*/*;q=0.8,"
+        "application/signed-exchange;v=b3;q=0.9";
+  }
+#endif
+  EXPECT_EQ(expected_sub_frame_accept_header, GetFor("/iframe.html"));
 
   // ResourceType::kStylesheet
   EXPECT_EQ("text/css,*/*;q=0.1", GetFor("/test.css"));
@@ -113,7 +132,15 @@ IN_PROC_BROWSER_TEST_F(AcceptHeaderTest, Check) {
   EXPECT_EQ("*/*", GetFor("/test.js"));
 
   // ResourceType::kImage
-  EXPECT_EQ("image/webp,image/apng,image/*,*/*;q=0.8", GetFor("/image.gif"));
+  const char* expected_image_accept_header =
+      "image/webp,image/apng,image/*,*/*;q=0.8";
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+    expected_image_accept_header =
+        "image/avif,image/webp,image/apng,image/*,*/*;q=0.8";
+  }
+#endif
+  EXPECT_EQ(expected_image_accept_header, GetFor("/image.gif"));
 
   // ResourceType::kFontResource
   EXPECT_EQ("*/*", GetFor("/test.js"));
diff --git a/chromium/content/browser/net/cross_origin_embedder_policy_reporter.cc b/chromium/content/browser/net/cross_origin_embedder_policy_reporter.cc
index b435f1cbf3a..7d3e980fa4b 100644
--- a/chromium/content/browser/net/cross_origin_embedder_policy_reporter.cc
+++ b/chromium/content/browser/net/cross_origin_embedder_policy_reporter.cc
@@ -10,6 +10,19 @@
 
 namespace content {
 
+namespace {
+
+constexpr char kType[] = "coep";
+
+GURL StripUsernameAndPassword(const GURL& url) {
+  url::Replacements<char> replacements;
+  replacements.ClearUsername();
+  replacements.ClearPassword();
+  return url.ReplaceComponents(replacements);
+}
+
+}  // namespace
+
 CrossOriginEmbedderPolicyReporter::CrossOriginEmbedderPolicyReporter(
     StoragePartition* storage_partition,
     const GURL& context_url,
@@ -28,41 +41,24 @@ CrossOriginEmbedderPolicyReporter::~CrossOriginEmbedderPolicyReporter() =
 void CrossOriginEmbedderPolicyReporter::QueueCorpViolationReport(
     const GURL& blocked_url,
     bool report_only) {
-  const base::Optional<std::string>& endpoint =
-      report_only ? report_only_endpoint_ : endpoint_;
-  if (!endpoint) {
-    return;
-  }
-  url::Replacements<char> replacements;
-  replacements.ClearUsername();
-  replacements.ClearPassword();
-  base::DictionaryValue body;
-  body.SetString("type", "corp");
-  body.SetString("blocked-url",
-                 blocked_url.ReplaceComponents(replacements).spec());
-  storage_partition_->GetNetworkContext()->QueueReport(
-      "coep", *endpoint, context_url_, /*user_agent=*/base::nullopt,
-      std::move(body));
+  GURL url_to_pass = StripUsernameAndPassword(blocked_url);
+  QueueAndNotify({std::make_pair("type", "corp"),
+                  std::make_pair("blocked-url", url_to_pass.spec())},
+                 report_only);
+}
+
+void CrossOriginEmbedderPolicyReporter::BindObserver(
+    mojo::PendingRemote<blink::mojom::ReportingObserver> observer) {
+  observer_.Bind(std::move(observer));
 }
 
 void CrossOriginEmbedderPolicyReporter::QueueNavigationReport(
     const GURL& blocked_url,
     bool report_only) {
-  const base::Optional<std::string>& endpoint =
-      report_only ? report_only_endpoint_ : endpoint_;
-  if (!endpoint) {
-    return;
-  }
-  url::Replacements<char> replacements;
-  replacements.ClearUsername();
-  replacements.ClearPassword();
-  base::DictionaryValue body;
-  body.SetString("type", "navigation");
-  body.SetString("blocked-url",
-                 blocked_url.ReplaceComponents(replacements).spec());
-  storage_partition_->GetNetworkContext()->QueueReport(
-      "coep", *endpoint, context_url_, /*user_agent=*/base::nullopt,
-      std::move(body));
+  GURL url_to_pass = StripUsernameAndPassword(blocked_url);
+  QueueAndNotify({std::make_pair("type", "navigation"),
+                  std::make_pair("blocked-url", url_to_pass.spec())},
+                 report_only);
 }
 
 void CrossOriginEmbedderPolicyReporter::Clone(
@@ -71,4 +67,31 @@ void CrossOriginEmbedderPolicyReporter::Clone(
   receiver_set_.Add(this, std::move(receiver));
 }
 
+void CrossOriginEmbedderPolicyReporter::QueueAndNotify(
+    std::initializer_list<std::pair<base::StringPiece, base::StringPiece>> body,
+    bool report_only) {
+  const base::Optional<std::string>& endpoint =
+      report_only ? report_only_endpoint_ : endpoint_;
+  if (observer_) {
+    std::vector<blink::mojom::ReportBodyElementPtr> list;
+
+    for (const auto& pair : body) {
+      list.push_back(blink::mojom::ReportBodyElement::New(
+          pair.first.as_string(), pair.second.as_string()));
+    }
+
+    observer_->Notify(blink::mojom::Report::New(
+        kType, context_url_, blink::mojom::ReportBody::New(std::move(list))));
+  }
+  if (endpoint) {
+    base::DictionaryValue body_to_pass;
+    for (const auto& pair : body) {
+      body_to_pass.SetString(pair.first, pair.second);
+    }
+    storage_partition_->GetNetworkContext()->QueueReport(
+        kType, *endpoint, context_url_, /*user_agent=*/base::nullopt,
+        std::move(body_to_pass));
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/net/cross_origin_embedder_policy_reporter.h b/chromium/content/browser/net/cross_origin_embedder_policy_reporter.h
index 4aa4f065400..d06fa2a0470 100644
--- a/chromium/content/browser/net/cross_origin_embedder_policy_reporter.h
+++ b/chromium/content/browser/net/cross_origin_embedder_policy_reporter.h
@@ -5,12 +5,16 @@
 #ifndef CONTENT_BROWSER_NET_CROSS_ORIGIN_EMBEDDER_POLICY_REPORTER_H_
 #define CONTENT_BROWSER_NET_CROSS_ORIGIN_EMBEDDER_POLICY_REPORTER_H_
 
+#include <initializer_list>
 #include <string>
 
 #include "base/optional.h"
+#include "base/strings/string_piece.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/cross_origin_embedder_policy.mojom.h"
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -48,11 +52,18 @@ class CONTENT_EXPORT CrossOriginEmbedderPolicyReporter final
       mojo::PendingReceiver<network::mojom::CrossOriginEmbedderPolicyReporter>
           receiver) override;
 
+  void BindObserver(
+      mojo::PendingRemote<blink::mojom::ReportingObserver> observer);
+
   // https://mikewest.github.io/corpp/#abstract-opdef-queue-coep-navigation-violation
   // Queue a violation report for COEP mismatch for nested frame navigation.
   void QueueNavigationReport(const GURL& blocked_url, bool report_only);
 
  private:
+  void QueueAndNotify(std::initializer_list<
+                          std::pair<base::StringPiece, base::StringPiece>> body,
+                      bool report_only);
+
   // See the class comment.
   StoragePartition* const storage_partition_;
 
@@ -62,6 +73,7 @@ class CONTENT_EXPORT CrossOriginEmbedderPolicyReporter final
 
   mojo::ReceiverSet<network::mojom::CrossOriginEmbedderPolicyReporter>
       receiver_set_;
+  mojo::Remote<blink::mojom::ReportingObserver> observer_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/net/cross_origin_embedder_policy_reporter_unittest.cc b/chromium/content/browser/net/cross_origin_embedder_policy_reporter_unittest.cc
index 93a2043f8f8..cc3bfe63c9e 100644
--- a/chromium/content/browser/net/cross_origin_embedder_policy_reporter_unittest.cc
+++ b/chromium/content/browser/net/cross_origin_embedder_policy_reporter_unittest.cc
@@ -13,6 +13,7 @@
 #include "services/network/public/cpp/cross_origin_embedder_policy.h"
 #include "services/network/test/test_network_context.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/mojom/frame/reporting_observer.mojom.h"
 
 namespace content {
 namespace {
@@ -48,6 +49,28 @@ class TestNetworkContext : public network::TestNetworkContext {
   std::vector<Report> reports_;
 };
 
+class TestObserver final : public blink::mojom::ReportingObserver {
+ public:
+  explicit TestObserver(
+      mojo::PendingReceiver<blink::mojom::ReportingObserver> receiver)
+      : receiver_(this, std::move(receiver)) {}
+
+  // blink::mojom::ReportingObserver implementation.
+  void Notify(blink::mojom::ReportPtr report) override {
+    reports_.push_back(std::move(report));
+  }
+
+  void FlushForTesting() { receiver_.FlushForTesting(); }
+
+  const std::vector<blink::mojom::ReportPtr>& reports() const {
+    return reports_;
+  }
+
+ private:
+  mojo::Receiver<blink::mojom::ReportingObserver> receiver_;
+  std::vector<blink::mojom::ReportPtr> reports_;
+};
+
 class CrossOriginEmbedderPolicyReporterTest : public testing::Test {
  public:
   using Report = TestNetworkContext::Report;
@@ -57,22 +80,54 @@ class CrossOriginEmbedderPolicyReporterTest : public testing::Test {
 
   StoragePartition* storage_partition() { return &storage_partition_; }
   const TestNetworkContext& network_context() const { return network_context_; }
-
-  base::Value CreateBodyForCorp(base::StringPiece s) {
+  base::Value CreateBodyForCorp(base::StringPiece s) const {
     base::Value dict(base::Value::Type::DICTIONARY);
-    dict.SetKey("type", base::Value("corp"));
-    dict.SetKey("blocked-url", base::Value(s));
+    for (const auto& pair : CreateBodyForCorpInternal(s)) {
+      dict.SetKey(std::move(pair.first), base::Value(std::move(pair.second)));
+    }
     return dict;
   }
 
   base::Value CreateBodyForNavigation(base::StringPiece s) {
     base::Value dict(base::Value::Type::DICTIONARY);
-    dict.SetKey("type", base::Value("navigation"));
-    dict.SetKey("blocked-url", base::Value(s));
+    for (const auto& pair : CreateBodyForNavigationInternal(s)) {
+      dict.SetKey(std::move(pair.first), base::Value(std::move(pair.second)));
+    }
     return dict;
   }
 
+  blink::mojom::ReportBodyPtr CreateMojomBodyForCorp(base::StringPiece s) {
+    auto body = blink::mojom::ReportBody::New();
+    for (const auto& pair : CreateBodyForCorpInternal(s)) {
+      body->body.push_back(blink::mojom::ReportBodyElement::New(
+          std::move(pair.first), std::move(pair.second)));
+    }
+    return body;
+  }
+
+  blink::mojom::ReportBodyPtr CreateMojomBodyForNavigation(
+      base::StringPiece s) {
+    auto body = blink::mojom::ReportBody::New();
+    for (const auto& pair : CreateBodyForNavigationInternal(s)) {
+      body->body.push_back(blink::mojom::ReportBodyElement::New(
+          std::move(pair.first), std::move(pair.second)));
+    }
+    return body;
+  }
+
  private:
+  std::vector<std::pair<std::string, std::string>> CreateBodyForCorpInternal(
+      base::StringPiece s) const {
+    return {std::make_pair("type", "corp"),
+            std::make_pair("blocked-url", s.as_string())};
+  }
+
+  std::vector<std::pair<std::string, std::string>>
+  CreateBodyForNavigationInternal(base::StringPiece s) const {
+    return {std::make_pair("type", "navigation"),
+            std::make_pair("blocked-url", s.as_string())};
+  }
+
   base::test::TaskEnvironment task_environment_;
   TestNetworkContext network_context_;
   TestStoragePartition storage_partition_;
@@ -141,6 +196,34 @@ TEST_F(CrossOriginEmbedderPolicyReporterTest, UserAndPassForCorp) {
   EXPECT_EQ(r2.body, CreateBodyForCorp("https://www2.example.com/y"));
 }
 
+TEST_F(CrossOriginEmbedderPolicyReporterTest, ObserverForCorp) {
+  const GURL kContextUrl("https://example.com/path");
+  mojo::PendingRemote<blink::mojom::ReportingObserver> observer_remote;
+  TestObserver observer(observer_remote.InitWithNewPipeAndPassReceiver());
+
+  CrossOriginEmbedderPolicyReporter reporter(storage_partition(), kContextUrl,
+                                             base::nullopt, base::nullopt);
+  reporter.BindObserver(std::move(observer_remote));
+  reporter.QueueCorpViolationReport(GURL("https://u:p@www1.example.com/x"),
+                                    /*report_only=*/false);
+  reporter.QueueCorpViolationReport(GURL("https://u:p@www2.example.com/y"),
+                                    /*report_only=*/true);
+
+  observer.FlushForTesting();
+  ASSERT_EQ(2u, observer.reports().size());
+  const blink::mojom::Report& r1 = *(observer.reports()[0]);
+  const blink::mojom::Report& r2 = *(observer.reports()[1]);
+
+  EXPECT_EQ(r1.type, "coep");
+  EXPECT_EQ(r1.url, kContextUrl);
+  EXPECT_TRUE(mojo::Equals(
+      r1.body, CreateMojomBodyForCorp("https://www1.example.com/x")));
+  EXPECT_EQ(r2.type, "coep");
+  EXPECT_EQ(r2.url, kContextUrl);
+  EXPECT_TRUE(mojo::Equals(
+      r2.body, CreateMojomBodyForCorp("https://www2.example.com/y")));
+}
+
 TEST_F(CrossOriginEmbedderPolicyReporterTest, Clone) {
   const GURL kContextUrl("https://example.com/path");
   CrossOriginEmbedderPolicyReporter reporter(storage_partition(), kContextUrl,
@@ -211,6 +294,35 @@ TEST_F(CrossOriginEmbedderPolicyReporterTest, BasicNavigation) {
   EXPECT_EQ(r2.body, CreateBodyForNavigation("http://www2.example.com:41/y"));
 }
 
+TEST_F(CrossOriginEmbedderPolicyReporterTest, ObserverForNavigation) {
+  const GURL kContextUrl("https://example.com/path");
+  mojo::PendingRemote<blink::mojom::ReportingObserver> observer_remote;
+  TestObserver observer(observer_remote.InitWithNewPipeAndPassReceiver());
+
+  CrossOriginEmbedderPolicyReporter reporter(storage_partition(), kContextUrl,
+                                             base::nullopt, base::nullopt);
+  reporter.BindObserver(std::move(observer_remote));
+  reporter.QueueNavigationReport(GURL("https://www1.example.com/x#foo?bar=baz"),
+                                 /*report_only=*/false);
+  reporter.QueueNavigationReport(GURL("http://www2.example.com:41/y"),
+                                 /*report_only=*/true);
+
+  observer.FlushForTesting();
+  ASSERT_EQ(2u, observer.reports().size());
+  const blink::mojom::Report& r1 = *(observer.reports()[0]);
+  const blink::mojom::Report& r2 = *(observer.reports()[1]);
+
+  EXPECT_EQ(r1.type, "coep");
+  EXPECT_EQ(r1.url, kContextUrl);
+  EXPECT_TRUE(mojo::Equals(
+      r1.body,
+      CreateMojomBodyForNavigation("https://www1.example.com/x#foo?bar=baz")));
+  EXPECT_EQ(r2.type, "coep");
+  EXPECT_EQ(r2.url, kContextUrl);
+  EXPECT_TRUE(mojo::Equals(
+      r2.body, CreateMojomBodyForNavigation("http://www2.example.com:41/y")));
+}
+
 TEST_F(CrossOriginEmbedderPolicyReporterTest, UserAndPassForNavigation) {
   const GURL kContextUrl("https://example.com/path");
   CrossOriginEmbedderPolicyReporter reporter(storage_partition(), kContextUrl,
diff --git a/chromium/content/browser/net/net_command_line_flags_browsertest.cc b/chromium/content/browser/net/net_command_line_flags_browsertest.cc
index e47cbbf0807..aacfdfce6ea 100644
--- a/chromium/content/browser/net/net_command_line_flags_browsertest.cc
+++ b/chromium/content/browser/net/net_command_line_flags_browsertest.cc
@@ -5,6 +5,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/net/network_field_trial_browsertest.cc b/chromium/content/browser/net/network_field_trial_browsertest.cc
index f6e78f9cb9c..0e957cdf872 100644
--- a/chromium/content/browser/net/network_field_trial_browsertest.cc
+++ b/chromium/content/browser/net/network_field_trial_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/browser/startup_helper.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/common/network_service_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/network_service_test.mojom.h"
diff --git a/chromium/content/browser/net/split_cache_browsertest.cc b/chromium/content/browser/net/split_cache_browsertest.cc
index 8295b1ef1ce..fdffa80a98c 100644
--- a/chromium/content/browser/net/split_cache_browsertest.cc
+++ b/chromium/content/browser/net/split_cache_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/net_info_browsertest.cc b/chromium/content/browser/net_info_browsertest.cc
index 2a898f25592..a71a3eaa700 100644
--- a/chromium/content/browser/net_info_browsertest.cc
+++ b/chromium/content/browser/net_info_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/browser/net/network_quality_observer_impl.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/network_context_client_base_impl.cc b/chromium/content/browser/network_context_client_base_impl.cc
index a095086b79c..7c3239f8521 100644
--- a/chromium/content/browser/network_context_client_base_impl.cc
+++ b/chromium/content/browser/network_context_client_base_impl.cc
@@ -152,22 +152,6 @@ void NetworkContextClientBase::OnClearSiteData(
   std::move(callback).Run();
 }
 
-void NetworkContextClientBase::OnCookiesChanged(
-    bool is_service_worker,
-    int32_t process_id,
-    int32_t routing_id,
-    const GURL& url,
-    const net::SiteForCookies& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {}
-
-void NetworkContextClientBase::OnCookiesRead(
-    bool is_service_worker,
-    int32_t process_id,
-    int32_t routing_id,
-    const GURL& url,
-    const net::SiteForCookies& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {}
-
 #if defined(OS_ANDROID)
 void NetworkContextClientBase::OnGenerateHttpNegotiateAuthToken(
     const std::string& server_auth_token,
diff --git a/chromium/content/browser/network_service_browsertest.cc b/chromium/content/browser/network_service_browsertest.cc
index f0a5eef6e5f..eb2d87560be 100644
--- a/chromium/content/browser/network_service_browsertest.cc
+++ b/chromium/content/browser/network_service_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/url_utils.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -165,8 +166,10 @@ class NetworkServiceBrowserTest : public ContentBrowserTest {
     request->url = url;
     url::Origin origin = url::Origin::Create(url);
     request->trusted_params = network::ResourceRequest::TrustedParams();
-    request->trusted_params->network_isolation_key =
-        net::NetworkIsolationKey(origin, origin);
+    request->trusted_params->isolation_info =
+        net::IsolationInfo::CreateForInternalRequest(origin);
+    request->site_for_cookies =
+        request->trusted_params->isolation_info.site_for_cookies();
 
     SimpleURLLoaderTestHelper simple_loader_helper;
     std::unique_ptr<network::SimpleURLLoader> simple_loader =
@@ -259,6 +262,7 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
   network::mojom::URLLoaderFactoryParamsPtr params =
       network::mojom::URLLoaderFactoryParams::New();
   params->process_id = network::mojom::kBrowserProcessId;
+  params->automatically_assign_isolation_info = true;
   params->is_corb_enabled = false;
   params->is_trusted = true;
   mojo::Remote<network::mojom::URLLoaderFactory> loader_factory;
@@ -515,17 +519,17 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceWithCorsBrowserTest, FactoryOverride) {
         auto response = network::mojom::URLResponseHead::New();
         response->headers =
             base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.1 200 OK");
-        response->headers->AddHeader(
-            "access-control-allow-origin: https://www2.example.com");
-        response->headers->AddHeader("access-control-allow-methods: *");
+        response->headers->SetHeader("access-control-allow-origin",
+                                     "https://www2.example.com");
+        response->headers->SetHeader("access-control-allow-methods", "*");
         client->OnReceiveResponse(std::move(response));
       } else if (resource_request.method == "custom-method") {
         has_received_request_ = true;
         auto response = network::mojom::URLResponseHead::New();
         response->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
             "HTTP/1.1 202 Accepted");
-        response->headers->AddHeader(
-            "access-control-allow-origin: https://www2.example.com");
+        response->headers->SetHeader("access-control-allow-origin",
+                                     "https://www2.example.com");
         client->OnReceiveResponse(std::move(response));
         client->OnComplete(network::URLLoaderCompletionStatus(net::OK));
       } else {
diff --git a/chromium/content/browser/network_service_client.cc b/chromium/content/browser/network_service_client.cc
index cb96c9e4d34..214ca696e38 100644
--- a/chromium/content/browser/network_service_client.cc
+++ b/chromium/content/browser/network_service_client.cc
@@ -12,7 +12,6 @@
 #include "base/task/post_task.h"
 #include "base/threading/sequence_bound.h"
 #include "base/unguessable_token.h"
-#include "components/rappor/public/rappor_service.h"
 #include "content/browser/browsing_data/clear_site_data_handler.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ -262,13 +261,6 @@ void NetworkServiceClient::OnCorsPreflightRequestCompleted(
 
 void NetworkServiceClient::LogCrossOriginFetchFromContentScript3(
     const std::string& isolated_world_host) {
-  rappor::RapporService* rappor =
-      GetContentClient()->browser()->GetRapporService();
-  if (rappor) {
-    rappor->RecordSampleString("Extensions.CrossOriginFetchFromContentScript3",
-                               rappor::UMA_RAPPOR_TYPE, isolated_world_host);
-  }
-
   ContentBrowserClient* client = GetContentClient()->browser();
   if (client) {
     client->LogUkmEventForCrossOriginFetchFromContentScript3(
diff --git a/chromium/content/browser/network_service_instance_impl.cc b/chromium/content/browser/network_service_instance_impl.cc
index e449c6531a2..04da0a19698 100644
--- a/chromium/content/browser/network_service_instance_impl.cc
+++ b/chromium/content/browser/network_service_instance_impl.cc
@@ -25,6 +25,7 @@
 #include "build/build_config.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/network_service_client.h"
+#include "content/browser/service_sandbox_type.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -263,7 +264,6 @@ network::mojom::NetworkService* GetNetworkService() {
           ServiceProcessHost::Launch(
               std::move(receiver),
               ServiceProcessHost::Options()
-                  .WithSandboxType(service_manager::SandboxType::kNetwork)
                   .WithDisplayName(base::UTF8ToUTF16("Network Service"))
                   .Pass());
         }
@@ -292,7 +292,7 @@ network::mojom::NetworkService* GetNetworkService() {
       (*g_network_service_remote)
           ->SetClient(std::move(client_remote), CreateNetworkServiceParams());
       g_network_service_is_responding = false;
-      g_network_service_remote->QueryVersion(base::BindRepeating(
+      g_network_service_remote->QueryVersion(base::BindOnce(
           [](base::Time start_time, uint32_t) {
             g_network_service_is_responding = true;
             base::TimeDelta delta = base::Time::Now() - start_time;
@@ -409,22 +409,6 @@ network::NetworkConnectionTracker* GetNetworkConnectionTracker() {
 
 void GetNetworkConnectionTrackerFromUIThread(
     base::OnceCallback<void(network::NetworkConnectionTracker*)> callback) {
-  // TODO(fdoray): Investigate why this is needed. The IO thread is supposed to
-  // be initialized by the time the UI thread starts running tasks.
-  //
-  // GetNetworkConnectionTracker() will call CreateNetworkServiceOnIO(). Here it
-  // makes sure the IO thread is running when CreateNetworkServiceOnIO() is
-  // called.
-  if (!content::BrowserThread::IsThreadInitialized(
-          content::BrowserThread::IO)) {
-    // IO thread is not yet initialized. Try again in the next message pump.
-    bool task_posted = base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::BindOnce(&GetNetworkConnectionTrackerFromUIThread,
-                                  std::move(callback)));
-    DCHECK(task_posted);
-    return;
-  }
-
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
       base::BindOnce(&GetNetworkConnectionTracker), std::move(callback));
@@ -488,7 +472,7 @@ base::TimeDelta GetTimeSinceLastNetworkServiceCrash() {
 void PingNetworkService(base::OnceClosure closure) {
   GetNetworkService();
   // Unfortunately, QueryVersion requires a RepeatingCallback.
-  g_network_service_remote->QueryVersion(base::BindRepeating(
+  g_network_service_remote->QueryVersion(base::BindOnce(
       [](base::OnceClosure closure, uint32_t) {
         if (closure)
           std::move(closure).Run();
diff --git a/chromium/content/browser/network_service_restart_browsertest.cc b/chromium/content/browser/network_service_restart_browsertest.cc
index b4cf3991cef..7c12d3e29e4 100644
--- a/chromium/content/browser/network_service_restart_browsertest.cc
+++ b/chromium/content/browser/network_service_restart_browsertest.cc
@@ -33,6 +33,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/notifications/blink_notification_service_impl.cc b/chromium/content/browser/notifications/blink_notification_service_impl.cc
index a717d9f3539..659149f4c5d 100644
--- a/chromium/content/browser/notifications/blink_notification_service_impl.cc
+++ b/chromium/content/browser/notifications/blink_notification_service_impl.cc
@@ -9,8 +9,8 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
+#include "base/check_op.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/task/post_task.h"
 #include "content/browser/notifications/notification_event_dispatcher_impl.h"
diff --git a/chromium/content/browser/notifications/notification_database_conversions.cc b/chromium/content/browser/notifications/notification_database_conversions.cc
index ab336f370af..f238359ad6e 100644
--- a/chromium/content/browser/notifications/notification_database_conversions.cc
+++ b/chromium/content/browser/notifications/notification_database_conversions.cc
@@ -8,7 +8,8 @@
 
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
diff --git a/chromium/content/browser/notifications/notification_id_generator.cc b/chromium/content/browser/notifications/notification_id_generator.cc
index 68298dd1c0b..eebdf0d4e30 100644
--- a/chromium/content/browser/notifications/notification_id_generator.cc
+++ b/chromium/content/browser/notifications/notification_id_generator.cc
@@ -6,7 +6,7 @@
 
 #include <sstream>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/browser/notifications/platform_notification_service_proxy.cc b/chromium/content/browser/notifications/platform_notification_service_proxy.cc
index 2e534dbdf11..ebc3405d8c2 100644
--- a/chromium/content/browser/notifications/platform_notification_service_proxy.cc
+++ b/chromium/content/browser/notifications/platform_notification_service_proxy.cc
@@ -7,7 +7,7 @@
 #include <memory>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/task/post_task.h"
 #include "content/browser/notifications/devtools_event_logging.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
diff --git a/chromium/content/browser/oop_browsertest.cc b/chromium/content/browser/oop_browsertest.cc
index 8f9836b9a0e..5f3984652f7 100644
--- a/chromium/content/browser/oop_browsertest.cc
+++ b/chromium/content/browser/oop_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/origin_trials/origin_trials_browsertest.cc b/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
index c2bfb8126f3..e2fb509805a 100644
--- a/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
+++ b/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -213,11 +214,11 @@ IN_PROC_BROWSER_TEST_P(ForceEnabledOriginTrialsBrowserTest,
 
   // When Iframe navigates away, it loses origin trial.
   const GURL url("https://other.test/notrial.html");
+  TestNavigationObserver navigation_observer(url);
+  navigation_observer.WatchExistingWebContents();
   ASSERT_TRUE(content::ExecuteScript(
       GetFrameByName("same-origin"),
       content::JsReplace("location.href=$1", url.spec())));
-  TestNavigationObserver navigation_observer(url);
-  navigation_observer.WatchExistingWebContents();
   navigation_observer.WaitForNavigationFinished();
   EXPECT_FALSE(HasTrialEnabled(GetFrameByName("same-origin")));
 }
@@ -235,7 +236,9 @@ IN_PROC_BROWSER_TEST_P(ForceEnabledOriginTrialsBrowserTest,
   EXPECT_FALSE(HasTrialEnabled(GetFrameByName("same-origin")));
   EXPECT_FALSE(HasTrialEnabled(GetFrameByName("cross-origin")));
 
-  // Create an iframe with origin trial.
+  // Create an iframe with origin trial and wait for it to load
+  TestNavigationObserver navigation_observer(frame_url);
+  navigation_observer.WatchExistingWebContents();
   ASSERT_TRUE(content::ExecuteScript(
       GetFrameByName("same-origin"),
       content::JsReplace("{"
@@ -245,10 +248,6 @@ IN_PROC_BROWSER_TEST_P(ForceEnabledOriginTrialsBrowserTest,
                          "  document.body.appendChild(ifrm);"
                          "}",
                          frame_url.spec())));
-
-  // Wait for iframe to load.
-  TestNavigationObserver navigation_observer(frame_url);
-  navigation_observer.WatchExistingWebContents();
   navigation_observer.WaitForNavigationFinished();
 
   // The newly created iframe should have origin trial.
diff --git a/chromium/content/browser/payments/payment_app_browsertest.cc b/chromium/content/browser/payments/payment_app_browsertest.cc
index 17af2768b1e..2cd88fe00be 100644
--- a/chromium/content/browser/payments/payment_app_browsertest.cc
+++ b/chromium/content/browser/payments/payment_app_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/payment_app_provider.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/payments/payment_app_provider_impl.cc b/chromium/content/browser/payments/payment_app_provider_impl.cc
index ff7499b7049..991bbeb8de9 100644
--- a/chromium/content/browser/payments/payment_app_provider_impl.cc
+++ b/chromium/content/browser/payments/payment_app_provider_impl.cc
@@ -21,6 +21,7 @@
 #include "base/token.h"
 #include "components/payments/core/native_error_strings.h"
 #include "components/payments/core/payments_validators.h"
+#include "content/browser/devtools/devtools_background_services_context_impl.h"
 #include "content/browser/payments/payment_app_context_impl.h"
 #include "content/browser/payments/payment_app_installer.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
@@ -678,8 +679,9 @@ void AddModifiersToMap(const std::vector<PaymentDetailsModifierPtr>& modifiers,
   }
 }
 
-DevToolsBackgroundServicesContext* GetDevTools(BrowserContext* browser_context,
-                                               const url::Origin& sw_origin) {
+scoped_refptr<DevToolsBackgroundServicesContextImpl> GetDevTools(
+    BrowserContext* browser_context,
+    const url::Origin& sw_origin) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(browser_context);
   auto* storage_partition = BrowserContext::GetStoragePartitionForSite(
@@ -687,23 +689,17 @@ DevToolsBackgroundServicesContext* GetDevTools(BrowserContext* browser_context,
   if (!storage_partition)
     return nullptr;
 
-  auto* dev_tools = storage_partition->GetDevToolsBackgroundServicesContext();
+  scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools =
+      static_cast<DevToolsBackgroundServicesContextImpl*>(
+          storage_partition->GetDevToolsBackgroundServicesContext());
   return dev_tools && dev_tools->IsRecording(
                           DevToolsBackgroundService::kPaymentHandler)
              ? dev_tools
              : nullptr;
 }
 
-DevToolsBackgroundServicesContext* GetDevToolsForInstanceGroup(
-    const base::Token& instance_group,
-    const url::Origin& sw_origin) {
-  BrowserContext* browser_context =
-      BrowserContext::GetBrowserContextForServiceInstanceGroup(instance_group);
-  return browser_context ? GetDevTools(browser_context, sw_origin) : nullptr;
-}
-
 void OnResponseForCanMakePaymentOnUiThread(
-    const base::Token& instance_group,
+    scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools,
     int64_t registration_id,
     const url::Origin& sw_origin,
     const std::string& payment_request_id,
@@ -719,7 +715,6 @@ void OnResponseForCanMakePaymentOnUiThread(
         CanMakePaymentEventResponseType::INVALID_ACCOUNT_BALANCE_VALUE);
   }
 
-  auto* dev_tools = GetDevToolsForInstanceGroup(instance_group, sw_origin);
   if (dev_tools) {
     std::stringstream response_type;
     response_type << response->response_type;
@@ -742,13 +737,12 @@ void OnResponseForCanMakePaymentOnUiThread(
 }
 
 void OnResponseForAbortPaymentOnUiThread(
-    const base::Token& instance_group,
+    scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools,
     int64_t registration_id,
     const url::Origin& sw_origin,
     const std::string& payment_request_id,
     PaymentAppProvider::AbortCallback callback,
     bool payment_aborted) {
-  auto* dev_tools = GetDevToolsForInstanceGroup(instance_group, sw_origin);
   if (dev_tools) {
     dev_tools->LogBackgroundServiceEvent(
         registration_id, sw_origin, DevToolsBackgroundService::kPaymentHandler,
@@ -761,13 +755,12 @@ void OnResponseForAbortPaymentOnUiThread(
 }
 
 void OnResponseForPaymentRequestOnUiThread(
-    const base::Token& instance_group,
+    scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools,
     int64_t registration_id,
     const url::Origin& sw_origin,
     const std::string& payment_request_id,
     PaymentAppProvider::InvokePaymentAppCallback callback,
     PaymentHandlerResponsePtr response) {
-  auto* dev_tools = GetDevToolsForInstanceGroup(instance_group, sw_origin);
   if (dev_tools) {
     std::stringstream response_type;
     response_type << response->response_type;
@@ -823,7 +816,8 @@ void PaymentAppProviderImpl::InvokePaymentApp(
     InvokePaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  auto* dev_tools = GetDevTools(browser_context, sw_origin);
+  scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools =
+      GetDevTools(browser_context, sw_origin);
   if (dev_tools) {
     std::map<std::string, std::string> data = {
         {"Merchant Top Origin", event_data->top_origin.spec()},
@@ -845,11 +839,9 @@ void PaymentAppProviderImpl::InvokePaymentApp(
       browser_context, registration_id,
       base::BindOnce(
           &DispatchPaymentRequestEvent, browser_context, std::move(event_data),
-          base::BindOnce(
-              &OnResponseForPaymentRequestOnUiThread,
-              BrowserContext::GetServiceInstanceGroupFor(browser_context),
-              registration_id, sw_origin, event_data->payment_request_id,
-              std::move(callback))));
+          base::BindOnce(&OnResponseForPaymentRequestOnUiThread, dev_tools,
+                         registration_id, sw_origin,
+                         event_data->payment_request_id, std::move(callback))));
 }
 
 void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
@@ -857,8 +849,8 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
     PaymentRequestEventDataPtr event_data,
     const std::string& app_name,
     const SkBitmap& app_icon,
-    const std::string& sw_js_url,
-    const std::string& sw_scope,
+    const GURL& sw_js_url,
+    const GURL& sw_scope,
     bool sw_use_cache,
     const std::string& method,
     const SupportedDelegations& supported_delegations,
@@ -866,11 +858,7 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
     InvokePaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  DCHECK(base::IsStringUTF8(sw_js_url));
-  GURL url = GURL(sw_js_url);
-  DCHECK(base::IsStringUTF8(sw_scope));
-  GURL scope = GURL(sw_scope);
-  if (!url.is_valid() || !scope.is_valid() || method.empty()) {
+  if (!sw_js_url.is_valid() || !sw_scope.is_valid() || method.empty()) {
     base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
@@ -891,9 +879,9 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
   }
 
   PaymentAppInstaller::Install(
-      web_contents, app_name, string_encoded_icon, url, scope, sw_use_cache,
-      method, supported_delegations,
-      base::BindOnce(&OnInstallPaymentApp, url::Origin::Create(scope),
+      web_contents, app_name, string_encoded_icon, sw_js_url, sw_scope,
+      sw_use_cache, method, supported_delegations,
+      base::BindOnce(&OnInstallPaymentApp, url::Origin::Create(sw_scope),
                      std::move(event_data), std::move(registration_id_callback),
                      std::move(callback)));
 }
@@ -907,7 +895,8 @@ void PaymentAppProviderImpl::CanMakePayment(
     CanMakePaymentCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  auto* dev_tools = GetDevTools(browser_context, sw_origin);
+  scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools =
+      GetDevTools(browser_context, sw_origin);
   if (dev_tools) {
     std::map<std::string, std::string> data = {
         {"Merchant Top Origin", event_data->top_origin.spec()},
@@ -927,13 +916,11 @@ void PaymentAppProviderImpl::CanMakePayment(
 
   StartServiceWorkerForDispatch(
       browser_context, registration_id,
-      base::BindOnce(
-          &DispatchCanMakePaymentEvent, browser_context, std::move(event_data),
-          base::BindOnce(
-              &OnResponseForCanMakePaymentOnUiThread,
-              BrowserContext::GetServiceInstanceGroupFor(browser_context),
-              registration_id, sw_origin, payment_request_id,
-              std::move(callback))));
+      base::BindOnce(&DispatchCanMakePaymentEvent, browser_context,
+                     std::move(event_data),
+                     base::BindOnce(&OnResponseForCanMakePaymentOnUiThread,
+                                    dev_tools, registration_id, sw_origin,
+                                    payment_request_id, std::move(callback))));
 }
 
 void PaymentAppProviderImpl::AbortPayment(BrowserContext* browser_context,
@@ -943,7 +930,8 @@ void PaymentAppProviderImpl::AbortPayment(BrowserContext* browser_context,
                                           AbortCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  auto* dev_tools = GetDevTools(browser_context, sw_origin);
+  scoped_refptr<DevToolsBackgroundServicesContextImpl> dev_tools =
+      GetDevTools(browser_context, sw_origin);
   if (dev_tools) {
     dev_tools->LogBackgroundServiceEvent(
         registration_id, sw_origin, DevToolsBackgroundService::kPaymentHandler,
@@ -955,9 +943,7 @@ void PaymentAppProviderImpl::AbortPayment(BrowserContext* browser_context,
       browser_context, registration_id,
       base::BindOnce(&DispatchAbortPaymentEvent, browser_context,
                      base::BindOnce(&OnResponseForAbortPaymentOnUiThread,
-                                    BrowserContext::GetServiceInstanceGroupFor(
-                                        browser_context),
-                                    registration_id, sw_origin,
+                                    dev_tools, registration_id, sw_origin,
                                     payment_request_id, std::move(callback))));
 }
 
diff --git a/chromium/content/browser/payments/payment_app_provider_impl.h b/chromium/content/browser/payments/payment_app_provider_impl.h
index d1db23870f6..89afdb27186 100644
--- a/chromium/content/browser/payments/payment_app_provider_impl.h
+++ b/chromium/content/browser/payments/payment_app_provider_impl.h
@@ -35,8 +35,8 @@ class CONTENT_EXPORT PaymentAppProviderImpl : public PaymentAppProvider {
       payments::mojom::PaymentRequestEventDataPtr event_data,
       const std::string& app_name,
       const SkBitmap& app_icon,
-      const std::string& sw_js_url,
-      const std::string& sw_scope,
+      const GURL& sw_js_url,
+      const GURL& sw_scope,
       bool sw_use_cache,
       const std::string& method,
       const SupportedDelegations& supported_delegations,
diff --git a/chromium/content/browser/performance_memory_browsertest.cc b/chromium/content/browser/performance_memory_browsertest.cc
index f4872b252b3..b007c7813de 100644
--- a/chromium/content/browser/performance_memory_browsertest.cc
+++ b/chromium/content/browser/performance_memory_browsertest.cc
@@ -5,6 +5,7 @@
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/permissions/permission_controller_impl.cc b/chromium/content/browser/permissions/permission_controller_impl.cc
index a7cfeb85839..c6edd2ebec0 100644
--- a/chromium/content/browser/permissions/permission_controller_impl.cc
+++ b/chromium/content/browser/permissions/permission_controller_impl.cc
@@ -64,6 +64,8 @@ PermissionToSchedulingFeature(PermissionType permission_name) {
     case PermissionType::SENSORS:
     case PermissionType::AR:
     case PermissionType::VR:
+    case PermissionType::CAMERA_PAN_TILT_ZOOM:
+    case PermissionType::WINDOW_PLACEMENT:
       return base::nullopt;
   }
 }
diff --git a/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl.cc b/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl.cc
index c0157fd944d..0911fbe1fc1 100644
--- a/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl.cc
+++ b/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl.cc
@@ -53,6 +53,13 @@ void PictureInPictureServiceImpl::StartSession(
         natural_size, show_play_pause_button,
         session_remote.InitWithNewPipeAndPassReceiver(), std::move(observer),
         &window_size);
+
+    // Frames are to be blocklisted from the back-forward cache because the
+    // picture-in-picture continues to be displayed while the page is in the
+    // cache instead of closing.
+    static_cast<RenderFrameHostImpl*>(render_frame_host_)
+        ->OnSchedulerTrackedFeatureUsed(
+            blink::scheduler::WebSchedulerTrackedFeature::kPictureInPicture);
   }
 
   std::move(callback).Run(std::move(session_remote), window_size);
diff --git a/chromium/content/browser/plugin_content_origin_allowlist.cc b/chromium/content/browser/plugin_content_origin_allowlist.cc
new file mode 100644
index 00000000000..fc7168ce410
--- /dev/null
+++ b/chromium/content/browser/plugin_content_origin_allowlist.cc
@@ -0,0 +1,104 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/plugin_content_origin_allowlist.h"
+
+#include "content/browser/renderer_host/render_view_host_impl.h"
+#include "content/common/frame_messages.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
+
+namespace content {
+
+PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist::
+    ~DocumentPluginContentOriginAllowlist() {}
+
+PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist::
+    DocumentPluginContentOriginAllowlist(RenderFrameHost* render_frame_host) {}
+
+void PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist::
+    InsertOrigin(const url::Origin& content_origin) {
+  origins_.insert(content_origin);
+}
+
+RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(
+    PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist)
+
+PluginContentOriginAllowlist::PluginContentOriginAllowlist(
+    WebContents* web_contents)
+    : WebContentsObserver(web_contents) {}
+
+PluginContentOriginAllowlist::~PluginContentOriginAllowlist() {}
+
+void PluginContentOriginAllowlist::RenderFrameCreated(
+    RenderFrameHost* render_frame_host) {
+  // When RenderFrame is created inside the main frame,
+  DocumentPluginContentOriginAllowlist* allowlist =
+      DocumentPluginContentOriginAllowlist::GetForCurrentDocument(
+          render_frame_host->GetMainFrame());
+  if (!allowlist || allowlist->origins().empty())
+    return;
+  render_frame_host->Send(new FrameMsg_UpdatePluginContentOriginAllowlist(
+      render_frame_host->GetRoutingID(), allowlist->origins()));
+}
+
+bool PluginContentOriginAllowlist::OnMessageReceived(
+    const IPC::Message& message,
+    RenderFrameHost* render_frame_host) {
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(PluginContentOriginAllowlist, message,
+                                   render_frame_host)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_PluginContentOriginAllowed,
+                        OnPluginContentOriginAllowed)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+
+  return handled;
+}
+
+void PluginContentOriginAllowlist::OnPluginContentOriginAllowed(
+    RenderFrameHost* render_frame_host,
+    const url::Origin& content_origin) {
+  DocumentPluginContentOriginAllowlist* allowlist =
+      GetOrCreateAllowlistForFrame(render_frame_host);
+  allowlist->InsertOrigin(content_origin);
+
+  // TODO(yuzus, crbug.com/1061899): This message should be sent to all the
+  // frames in the same frame tree as |render_frame_host|. When mojofying this
+  // IPC, this should use PageBroadcast interface and look up the correct set of
+  // RenderViewHosts from |render_frame_host| instead of getting them from
+  // |web_contents()|.
+  web_contents()->SendToAllFrames(
+      new FrameMsg_UpdatePluginContentOriginAllowlist(MSG_ROUTING_NONE,
+                                                      allowlist->origins()));
+}
+
+PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist*
+PluginContentOriginAllowlist::GetOrCreateAllowlistForFrame(
+    RenderFrameHost* render_frame_host) {
+  RenderFrameHost* main_frame = render_frame_host->GetMainFrame();
+  if (!DocumentPluginContentOriginAllowlist::GetForCurrentDocument(
+          main_frame)) {
+    DocumentPluginContentOriginAllowlist::CreateForCurrentDocument(main_frame);
+  }
+  return DocumentPluginContentOriginAllowlist::GetForCurrentDocument(
+      main_frame);
+}
+
+bool PluginContentOriginAllowlist::IsOriginAllowlistedForFrameForTesting(
+    RenderFrameHost* render_frame_host,
+    const url::Origin& content_origin) {
+  DocumentPluginContentOriginAllowlist* allowlist =
+      DocumentPluginContentOriginAllowlist::GetForCurrentDocument(
+          render_frame_host->GetMainFrame());
+  PluginContentOriginAllowlist::DocumentPluginContentOriginAllowlist::
+      GetForCurrentDocument(render_frame_host->GetMainFrame());
+  if (!allowlist)
+    return false;
+  return allowlist->origins().find(content_origin) !=
+         allowlist->origins().end();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/plugin_content_origin_allowlist.h b/chromium/content/browser/plugin_content_origin_allowlist.h
new file mode 100644
index 00000000000..ccd3e016157
--- /dev/null
+++ b/chromium/content/browser/plugin_content_origin_allowlist.h
@@ -0,0 +1,81 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_ALLOWLIST_H_
+#define CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_ALLOWLIST_H_
+
+#include <set>
+
+#include "base/macros.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/render_document_host_user_data.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "url/origin.h"
+
+namespace content {
+
+class WebContents;
+
+class CONTENT_EXPORT PluginContentOriginAllowlist : public WebContentsObserver {
+  // This class manages the lists of document-tied temporarily allowlisted
+  // plugin content origins that are exempt from power saving.
+  //
+  // RenderFrames report content origins that should be allowlisted via IPC.
+  // This class aggregates those origins and broadcasts the total list to all
+  // RenderFrames inside the same RenderView. This class also sends these
+  // origins to any newly created RenderFrames.
+ public:
+  explicit PluginContentOriginAllowlist(WebContents* web_contents);
+  ~PluginContentOriginAllowlist() override;
+
+ private:
+  FRIEND_TEST_ALL_PREFIXES(PluginContentOriginAllowlistTest,
+                           ClearAllowlistOnNavigate);
+  FRIEND_TEST_ALL_PREFIXES(PluginContentOriginAllowlistTest,
+                           SubframeInheritsAllowlist);
+
+  class DocumentPluginContentOriginAllowlist
+      : public RenderDocumentHostUserData<
+            DocumentPluginContentOriginAllowlist> {
+    // This class manages the list of temporarily allowlisted plugin content
+    // origins that are exempt from power saving. The list is managed
+    // per-document and cleared upon document destruction, as this is part of
+    // the RenderDocumentHostUserData.
+   public:
+    ~DocumentPluginContentOriginAllowlist() override;
+    void InsertOrigin(const url::Origin& content_origin);
+    std::set<url::Origin> origins() { return origins_; }
+
+   private:
+    explicit DocumentPluginContentOriginAllowlist(
+        RenderFrameHost* render_frame_host);
+    friend class RenderDocumentHostUserData<
+        DocumentPluginContentOriginAllowlist>;
+
+    std::set<url::Origin> origins_;
+
+    RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL();
+  };
+
+  static DocumentPluginContentOriginAllowlist* GetOrCreateAllowlistForFrame(
+      RenderFrameHost* render_frame_host);
+
+  static bool IsOriginAllowlistedForFrameForTesting(
+      RenderFrameHost* render_frame_host,
+      const url::Origin& content_origin);
+
+  // WebContentsObserver implementation.
+  void RenderFrameCreated(RenderFrameHost* render_frame_host) override;
+  bool OnMessageReceived(const IPC::Message& message,
+                         RenderFrameHost* render_frame_host) override;
+
+  void OnPluginContentOriginAllowed(RenderFrameHost* render_frame_host,
+                                    const url::Origin& content_origin);
+
+  DISALLOW_COPY_AND_ASSIGN(PluginContentOriginAllowlist);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_ALLOWLIST_H_
diff --git a/chromium/content/browser/plugin_content_origin_allowlist_unittest.cc b/chromium/content/browser/plugin_content_origin_allowlist_unittest.cc
new file mode 100644
index 00000000000..58640167bd4
--- /dev/null
+++ b/chromium/content/browser/plugin_content_origin_allowlist_unittest.cc
@@ -0,0 +1,88 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/plugin_content_origin_allowlist.h"
+
+#include <memory>
+
+#include "build/build_config.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/test/navigation_simulator.h"
+#include "content/public/test/test_renderer_host.h"
+#include "content/public/test/test_utils.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/origin.h"
+
+namespace content {
+
+class PluginContentOriginAllowlistTest : public RenderViewHostTestHarness {
+ public:
+  PluginContentOriginAllowlistTest() = default;
+  ~PluginContentOriginAllowlistTest() override = default;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(PluginContentOriginAllowlistTest);
+};
+
+TEST_F(PluginContentOriginAllowlistTest, ClearAllowlistOnNavigate) {
+  net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
+  ASSERT_TRUE(https_server.Start());
+
+  // 1) Navigate to A.
+  GURL url_a(https_server.GetURL("a.com", "/title1.html"));
+  RenderFrameHost* rfh_a =
+      NavigationSimulator::NavigateAndCommitFromBrowser(web_contents(), url_a);
+
+  // 2) Allowlist an origin on Page A.
+  url::Origin allow_origin = url::Origin::Create(GURL("http://www.google.com"));
+  static_cast<WebContentsImpl*>(web_contents())
+      ->plugin_content_origin_allowlist_->OnPluginContentOriginAllowed(
+          rfh_a, allow_origin);
+  EXPECT_TRUE(
+      PluginContentOriginAllowlist::IsOriginAllowlistedForFrameForTesting(
+          rfh_a, allow_origin));
+
+  // 3) Navigate to B and confirm that the allowlist is cleared.
+  GURL url_b(https_server.GetURL("b.com", "/title2.html"));
+  RenderFrameHost* rfh_b =
+      NavigationSimulator::NavigateAndCommitFromBrowser(web_contents(), url_b);
+  EXPECT_NE(rfh_a, rfh_b);
+  EXPECT_FALSE(
+      PluginContentOriginAllowlist::IsOriginAllowlistedForFrameForTesting(
+          rfh_b, allow_origin));
+}
+
+TEST_F(PluginContentOriginAllowlistTest, SubframeInheritsAllowlist) {
+  net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
+  ASSERT_TRUE(https_server.Start());
+
+  // 1) Navigate to A.
+  GURL url_a(https_server.GetURL("a.com", "/title1.html"));
+  RenderFrameHost* rfh_a =
+      NavigationSimulator::NavigateAndCommitFromBrowser(web_contents(), url_a);
+
+  // 2) Allowlist an origin on Page A.
+  url::Origin allow_origin = url::Origin::Create(GURL("http://www.google.com"));
+  static_cast<WebContentsImpl*>(web_contents())
+      ->plugin_content_origin_allowlist_->OnPluginContentOriginAllowed(
+          rfh_a, allow_origin);
+  EXPECT_TRUE(
+      PluginContentOriginAllowlist::IsOriginAllowlistedForFrameForTesting(
+          rfh_a, allow_origin));
+
+  // 3) Create a frame inside Page A, and confirm that the allowlist is passed
+  // on.
+  content::RenderFrameHostTester* rfh_tester =
+      content::RenderFrameHostTester::For(rfh_a);
+  RenderFrameHost* subframe = rfh_tester->AppendChild("subframe");
+  EXPECT_NE(rfh_a, subframe);
+  EXPECT_TRUE(
+      PluginContentOriginAllowlist::IsOriginAllowlistedForFrameForTesting(
+          subframe, allow_origin));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/plugin_content_origin_whitelist.cc b/chromium/content/browser/plugin_content_origin_whitelist.cc
deleted file mode 100644
index 17e564d371a..00000000000
--- a/chromium/content/browser/plugin_content_origin_whitelist.cc
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/plugin_content_origin_whitelist.h"
-
-#include "content/common/frame_messages.h"
-#include "content/public/browser/navigation_handle.h"
-#include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/web_contents.h"
-
-namespace content {
-
-PluginContentOriginWhitelist::PluginContentOriginWhitelist(
-    WebContents* web_contents)
-    : WebContentsObserver(web_contents) {
-}
-
-PluginContentOriginWhitelist::~PluginContentOriginWhitelist() {
-}
-
-void PluginContentOriginWhitelist::RenderFrameCreated(
-    RenderFrameHost* render_frame_host) {
-  if (!whitelist_.empty()) {
-    render_frame_host->Send(new FrameMsg_UpdatePluginContentOriginWhitelist(
-        render_frame_host->GetRoutingID(), whitelist_));
-  }
-}
-
-bool PluginContentOriginWhitelist::OnMessageReceived(
-    const IPC::Message& message,
-    RenderFrameHost* render_frame_host) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(PluginContentOriginWhitelist, message)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_PluginContentOriginAllowed,
-                        OnPluginContentOriginAllowed)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-
-  return handled;
-}
-
-void PluginContentOriginWhitelist::DidFinishNavigation(
-    NavigationHandle* navigation_handle) {
-  if (!navigation_handle->IsInMainFrame() ||
-      !navigation_handle->HasCommitted() ||
-      navigation_handle->IsSameDocument()) {
-    return;
-  }
-
-  // We expect RenderFrames to clear their replicated whitelist independently.
-  whitelist_.clear();
-}
-
-void PluginContentOriginWhitelist::OnPluginContentOriginAllowed(
-    const url::Origin& content_origin) {
-  whitelist_.insert(content_origin);
-
-  web_contents()->SendToAllFrames(
-      new FrameMsg_UpdatePluginContentOriginWhitelist(
-          MSG_ROUTING_NONE, whitelist_));
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/plugin_content_origin_whitelist.h b/chromium/content/browser/plugin_content_origin_whitelist.h
deleted file mode 100644
index f6f17e865f4..00000000000
--- a/chromium/content/browser/plugin_content_origin_whitelist.h
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_WHITELIST_H_
-#define CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_WHITELIST_H_
-
-#include <set>
-
-#include "base/macros.h"
-#include "content/public/browser/web_contents_observer.h"
-#include "url/origin.h"
-
-namespace content {
-
-class WebContents;
-
-// This class manages the tab-wide list of temporarily whitelisted plugin
-// content origins that are exempt from power saving.
-//
-// RenderFrames report content origins that should be whitelisted via IPC.
-// This class aggregates those origins and broadcasts the total list to all
-// RenderFrames owned by the tab (WebContents). This class also sends these
-// origins to any newly created RenderFrames.
-//
-// Tab-wide whitelists are cleared by top-level navigation. RenderFrames that
-// persist across top level navigations are responsible for clearing their own
-// whitelists.
-class PluginContentOriginWhitelist : public WebContentsObserver {
- public:
-  explicit PluginContentOriginWhitelist(WebContents* web_contents);
-  ~PluginContentOriginWhitelist() override;
-
- private:
-  // WebContentsObserver implementation.
-  void RenderFrameCreated(RenderFrameHost* render_frame_host) override;
-  bool OnMessageReceived(const IPC::Message& message,
-                         RenderFrameHost* render_frame_host) override;
-  void DidFinishNavigation(NavigationHandle* navigation_handle) override;
-
-  void OnPluginContentOriginAllowed(const url::Origin& content_origin);
-
-  std::set<url::Origin> whitelist_;
-
-  DISALLOW_COPY_AND_ASSIGN(PluginContentOriginWhitelist);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_PLUGIN_CONTENT_ORIGIN_WHITELIST_H_
diff --git a/chromium/content/browser/plugin_list.cc b/chromium/content/browser/plugin_list.cc
index 466f60724c7..19e59056af3 100644
--- a/chromium/content/browser/plugin_list.cc
+++ b/chromium/content/browser/plugin_list.cc
@@ -8,9 +8,9 @@
 
 #include <algorithm>
 
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
diff --git a/chromium/content/browser/plugin_service_impl.cc b/chromium/content/browser/plugin_service_impl.cc
index 8f0f145f976..b8800c3381e 100644
--- a/chromium/content/browser/plugin_service_impl.cc
+++ b/chromium/content/browser/plugin_service_impl.cc
@@ -72,13 +72,13 @@ void WillLoadPluginsCallback(base::SequenceChecker* sequence_checker) {
 // static
 void PluginServiceImpl::RecordBrokerUsage(int render_process_id,
                                           int render_frame_id) {
-  WebContents* web_contents = WebContents::FromRenderFrameHost(
-      RenderFrameHost::FromID(render_process_id, render_frame_id));
-  if (web_contents) {
-    ukm::SourceId source_id = static_cast<WebContentsImpl*>(web_contents)
-                                  ->GetUkmSourceIdForLastCommittedSource();
-    ukm::builders::Pepper_Broker(source_id).Record(ukm::UkmRecorder::Get());
-  }
+  RenderFrameHostImpl* rfh =
+      RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
+  if (!rfh)
+    return;
+
+  ukm::SourceId source_id = rfh->GetPageUkmSourceId();
+  ukm::builders::Pepper_Broker(source_id).Record(ukm::UkmRecorder::Get());
 }
 
 // static
diff --git a/chromium/content/browser/plugin_service_impl_browsertest.cc b/chromium/content/browser/plugin_service_impl_browsertest.cc
index 1374e61627d..63b360bf601 100644
--- a/chromium/content/browser/plugin_service_impl_browsertest.cc
+++ b/chromium/content/browser/plugin_service_impl_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/browser/ppapi_plugin_process_host.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/chromium/content/browser/plugin_service_impl_unittest.cc b/chromium/content/browser/plugin_service_impl_unittest.cc
index 6156e81e944..6fa3ef1528e 100644
--- a/chromium/content/browser/plugin_service_impl_unittest.cc
+++ b/chromium/content/browser/plugin_service_impl_unittest.cc
@@ -80,7 +80,8 @@ TEST_F(PluginServiceImplTest, RecordBrokerUsage) {
 
   NavigateAndCommit(GURL(kURL1));
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(web_contents())
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
   PluginServiceImpl* service = PluginServiceImpl::GetInstance();
 
   // Internal usage of the broker should not record metrics. Internal usage will
diff --git a/chromium/content/browser/pointer_lock_browsertest.cc b/chromium/content/browser/pointer_lock_browsertest.cc
index b34a983432c..6e4b05577a5 100644
--- a/chromium/content/browser/pointer_lock_browsertest.cc
+++ b/chromium/content/browser/pointer_lock_browsertest.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <string>
+
 #include "content/browser/pointer_lock_browsertest.h"
 
 #include "base/test/scoped_feature_list.h"
@@ -12,6 +14,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -149,6 +152,66 @@ class PointerLockBrowserTestWithOptions : public PointerLockBrowserTest {
   base::test::ScopedFeatureList feature_list_;
 };
 
+namespace {
+class PointerLockHelper {
+ public:
+  // requestPointerLock is an asynchronous operation. This method returns when
+  // document.body.requestPointerLock() either succeeds or fails.
+  // Returns true if Pointer Lock on body was successful.
+  static EvalJsResult RequestPointerLockOnBody(
+      const ToRenderFrameHost& execution_target,
+      const int options = EXECUTE_SCRIPT_DEFAULT_OPTIONS) {
+    return EvalJs(execution_target,
+                  set_pointer_lock_promise_ +
+                      "document.body.requestPointerLock();" +
+                      wait_for_pointer_lock_promise_,
+                  options);
+  }
+  static EvalJsResult RequestPointerLockWithUnadjustedMovementOnBody(
+      const ToRenderFrameHost& execution_target,
+      const int options = EXECUTE_SCRIPT_DEFAULT_OPTIONS) {
+    return EvalJs(
+        execution_target,
+        set_pointer_lock_promise_ +
+            "document.body.requestPointerLock({unadjustedMovement:true});" +
+            wait_for_pointer_lock_promise_,
+        options);
+  }
+  // exitPointerLock is an asynchronous operation. This method returns when
+  // document.exitPointerLock() either succeeds or fails.
+  // Returns true if Exit Pointer Lock was successful
+  static EvalJsResult ExitPointerLock(
+      const ToRenderFrameHost& execution_target,
+      const int options = EXECUTE_SCRIPT_DEFAULT_OPTIONS) {
+    return EvalJs(execution_target,
+                  set_pointer_lock_promise_ + "document.exitPointerLock();" +
+                      wait_for_pointer_lock_promise_,
+                  options);
+  }
+  static EvalJsResult IsPointerLockOnBody(
+      const ToRenderFrameHost& execution_target,
+      const int options = EXECUTE_SCRIPT_DEFAULT_OPTIONS) {
+    return EvalJs(execution_target,
+                  "document.pointerLockElement === document.body", options);
+  }
+
+ private:
+  static const std::string set_pointer_lock_promise_;
+  static const std::string wait_for_pointer_lock_promise_;
+};
+
+// static
+const std::string PointerLockHelper::set_pointer_lock_promise_ =
+    R"code(pointerLockPromise=new Promise(function (resolve, reject){
+        document.addEventListener('pointerlockchange', resolve);
+        document.addEventListener('pointerlockerror', reject);
+     });)code";
+// static
+const std::string PointerLockHelper::wait_for_pointer_lock_promise_ =
+    "(async()=> {return await pointerLockPromise.then(()=>true, "
+    "()=>false);})()";
+}  // namespace
+
 // crbug.com/1060129
 IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, DISABLED_PointerLockBasic) {
   GURL main_url(embedded_test_server()->GetURL(
@@ -159,41 +222,23 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, DISABLED_PointerLockBasic) {
   FrameTreeNode* child = root->child_at(0);
 
   // Request a pointer lock on the root frame's body.
-  EXPECT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
-
-  // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(root));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
 
   // Request a pointer lock on the child frame's body.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(false, PointerLockHelper::RequestPointerLockOnBody(child));
   // Child frame should not be granted pointer lock since the root frame has it.
-  EXPECT_EQ(false,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(child));
 
   // Release pointer lock on root frame.
-  EXPECT_TRUE(ExecJs(root, "document.exitPointerLock()"));
-
-  // setup promise structure to ensure request finishes.
-  EXPECT_TRUE(ExecJs(child, R"(
-        var advertisementreceivedPromise = new Promise(resolve => {
-          document.addEventListener('pointerlockchange',
-              event => {
-                resolve(true);
-              });
-        });
-      )"));
+  EXPECT_EQ(true, PointerLockHelper::ExitPointerLock(root));
 
   // Request a pointer lock on the child frame's body.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
   // ensure request finishes before moving on.
-  auto advertisementreceived_promise_result =
-      EvalJs(child, "advertisementreceivedPromise");
 
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
 }
 
 // crbug.com/1060129
@@ -209,43 +254,37 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
 
   // Without user activation, pointer lock request from any (child or
   // grand_child) frame fails.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()",
-                     EXECUTE_SCRIPT_NO_USER_GESTURE));
-  EXPECT_EQ(false, EvalJs(child, "document.pointerLockElement == document.body",
-                          EXECUTE_SCRIPT_NO_USER_GESTURE));
-  EXPECT_TRUE(ExecJs(grand_child, "document.body.requestPointerLock()",
-                     EXECUTE_SCRIPT_NO_USER_GESTURE));
-  EXPECT_EQ(false,
-            EvalJs(grand_child, "document.pointerLockElement == document.body",
-                   EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(false, PointerLockHelper::RequestPointerLockOnBody(
+                       child, EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(
+                       child, EXECUTE_SCRIPT_NO_USER_GESTURE));
+
+  EXPECT_EQ(false, PointerLockHelper::RequestPointerLockOnBody(
+                       grand_child, EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(
+                       grand_child, EXECUTE_SCRIPT_NO_USER_GESTURE));
 
   // Execute a empty (dummy) JS to activate the child frame.
   EXPECT_TRUE(ExecJs(child, ""));
 
   // With user activation in the child frame, pointer lock from the same frame
   // succeeds.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()",
-                     EXECUTE_SCRIPT_NO_USER_GESTURE));
-  EXPECT_EQ(true, EvalJs(child, "document.pointerLockElement == document.body",
-                         EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(
+                      child, EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(
+                      child, EXECUTE_SCRIPT_NO_USER_GESTURE));
 
   // But with user activation in the child frame, pointer lock from the
   // grand_child frame fails.
-  EXPECT_TRUE(ExecJs(grand_child, "document.body.requestPointerLock()",
-                     EXECUTE_SCRIPT_NO_USER_GESTURE));
-  EXPECT_EQ(false,
-            EvalJs(grand_child, "document.pointerLockElement == document.body",
-                   EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(false, PointerLockHelper::RequestPointerLockOnBody(
+                       grand_child, EXECUTE_SCRIPT_NO_USER_GESTURE));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(
+                       grand_child, EXECUTE_SCRIPT_NO_USER_GESTURE));
 }
 
-// Flaky on Windows.  https://crbug.com/992529
-#if defined(OS_WIN)
-#define MAYBE_PointerLockEventRouting DISABLED_PointerLockEventRouting
-#else
-#define MAYBE_PointerLockEventRouting PointerLockEventRouting
-#endif
-
-IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, MAYBE_PointerLockEventRouting) {
+// Flaky test crbug.com/1077306
+IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
+                       DISABLED_PointerLockEventRouting) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -261,15 +300,28 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, MAYBE_PointerLockEventRouting) {
 
   WaitForHitTestData(child->current_frame_host());
 
+  std::string set_mouse_move_event_listener =
+      R"code(mouseMoveExecuted = new Promise(function (resolve, reject){
+              mousemoveHandler = function(e){
+                x = e.x; y = e.y; mX = e.movementX; mY = e.movementY;
+                document.removeEventListener('mousemove', mousemoveHandler);
+                resolve();
+              };
+              document.addEventListener('mousemove', mousemoveHandler);
+             });)code";
+  std::string define_variables = R"code(var x; var y;
+       var mX; var mY;
+       var mouseMoveExecuted;
+       var mousemoveHandler;
+       )code";
   // Add a mouse move event listener to the root frame.
-  EXPECT_TRUE(ExecJs(
-      root,
-      "var x; var y; var mX; var mY; document.addEventListener('mousemove', "
-      "function(e) {x = e.x; y = e.y; mX = e.movementX; mY = e.movementY;});"));
+  EXPECT_TRUE(ExecJs(root, define_variables));
+  EXPECT_TRUE(ExecJs(root, set_mouse_move_event_listener));
 
   // Send a mouse move to root frame before lock to set last mouse position.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.pointer_type = blink::WebPointerProperties::PointerType::kMouse;
   mouse_event.SetPositionInWidget(6, 7);
@@ -278,20 +330,19 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, MAYBE_PointerLockEventRouting) {
   mouse_event.movement_y = 9;
   router->RouteMouseEvent(root_view, &mouse_event, ui::LatencyInfo());
 
-  // Make sure that the renderer handled the input event.
-  MainThreadFrameObserver root_observer(root_view->GetRenderWidgetHost());
-  root_observer.Wait();
-
+  // wait for mouse move to fire mouse move event
+  EXPECT_EQ(true, EvalJs(root,
+                         "(async ()=> {return await "
+                         "mouseMoveExecuted.then(()=>true);})();"));
   if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY))
     EXPECT_EQ("[6,7,0,0]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
   else
     EXPECT_EQ("[6,7,8,9]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
 
-  // Request a pointer lock on the root frame's body.
-  EXPECT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(root));
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
+  EXPECT_TRUE(ExecJs(root, set_mouse_move_event_listener));
 
   mouse_event.SetPositionInWidget(10, 12);
   mouse_event.SetPositionInScreen(10, 12);
@@ -299,35 +350,30 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, MAYBE_PointerLockEventRouting) {
   mouse_event.movement_y = 13;
   router->RouteMouseEvent(root_view, &mouse_event, ui::LatencyInfo());
 
-  // Make sure that the renderer handled the input event.
-  root_observer.Wait();
-
+  EXPECT_EQ(true, EvalJs(root,
+                         "(async ()=> {return await "
+                         "mouseMoveExecuted.then(()=>true);})();"));
   // Locked event has same coordinates as before locked.
   if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY))
     EXPECT_EQ("[6,7,4,5]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
   else
     EXPECT_EQ("[6,7,12,13]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
 
-  // Release pointer lock on root frame.
-  EXPECT_TRUE(ExecJs(root, "document.exitPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::ExitPointerLock(root));
 
-  // Request a pointer lock on the child frame's body.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
 
+  // define all all global variables on the child
+  EXPECT_TRUE(ExecJs(child, define_variables));
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
 
   // Add a mouse move event listener to the child frame.
-  EXPECT_TRUE(ExecJs(
-      child,
-      "var x; var y; var mX; var mY; document.addEventListener('mousemove', "
-      "function(e) {x = e.x; y = e.y; mX = e.movementX; mY = e.movementY;});"));
+  EXPECT_TRUE(ExecJs(child, set_mouse_move_event_listener));
 
   gfx::PointF transformed_point;
   root_view->TransformPointToCoordSpaceForView(gfx::PointF(0, 0), child_view,
                                                &transformed_point);
-
   mouse_event.SetPositionInWidget(-transformed_point.x() + 14,
                                   -transformed_point.y() + 15);
   mouse_event.SetPositionInScreen(-transformed_point.x() + 14,
@@ -338,10 +384,9 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, MAYBE_PointerLockEventRouting) {
   // responsible for correctly routing the event to the child frame.
   router->RouteMouseEvent(root_view, &mouse_event, ui::LatencyInfo());
 
-  // Make sure that the renderer handled the input event.
-  MainThreadFrameObserver child_observer(child_view->GetRenderWidgetHost());
-  child_observer.Wait();
-
+  EXPECT_EQ(true, EvalJs(child,
+                         "(async ()=> {return await "
+                         "mouseMoveExecuted.then(()=>true);})()"));
   // This is the first event to child render, so the coordinates is (0, 0)
   if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY))
     EXPECT_EQ("[0,0,0,0]", EvalJs(child, "JSON.stringify([x,y,mX,mY])"));
@@ -361,10 +406,9 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
   // Request a pointer lock on the root frame's body.
-  EXPECT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(root));
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
 
   // Root (platform) RenderWidgetHostView should have the pointer locked.
   EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
@@ -405,13 +449,10 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
                           "c.com", "/cross_site_iframe_factory.html?c(d)")));
 
   // Request a pointer lock to the inner WebContents's document.body.
-  EXPECT_EQ("success", EvalJs(inner_contents->GetMainFrame(), R"(
-        new Promise((resolve, reject) => {
-            document.addEventListener('pointerlockchange', resolve);
-            document.addEventListener('pointerlockerror', reject);
-            document.body.requestPointerLock();
-        }).then(() => 'success');
-        )"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(
+                      inner_contents->GetMainFrame()));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(
+                      inner_contents->GetMainFrame()));
 
   // Root (platform) RenderWidgetHostView should have the pointer locked.
   EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
@@ -460,13 +501,8 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockOopifCrashes) {
       crash_node = crash_node->child_at(0);
 
     // Request a pointer lock to |lock_node|'s document.body.
-    EXPECT_EQ("success", EvalJs(lock_node, R"(
-        new Promise((resolve, reject) => {
-            document.addEventListener('pointerlockchange', resolve);
-            document.addEventListener('pointerlockerror', reject);
-            document.body.requestPointerLock();
-        }).then(() => 'success');
-        )"));
+    EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(lock_node));
+    EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(lock_node));
 
     // Root (platform) RenderWidgetHostView should have the pointer locked.
     EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
@@ -493,14 +529,7 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockOopifCrashes) {
   }
 }
 
-// Flaky on Windows.  https://crbug.com/994228
-#if defined(OS_WIN)
-#define MAYBE_PointerLockWheelEventRouting DISABLED_PointerLockWheelEventRouting
-#else
-#define MAYBE_PointerLockWheelEventRouting PointerLockWheelEventRouting
-#endif
-IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
-                       MAYBE_PointerLockWheelEventRouting) {
+IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockWheelEventRouting) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -524,7 +553,8 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
 
   // Send a mouse move to root frame before lock to set last mouse position.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.pointer_type = blink::WebPointerProperties::PointerType::kMouse;
   mouse_event.SetPositionInWidget(6, 7);
@@ -542,11 +572,10 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
   else
     EXPECT_EQ("[6,7,8,9]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
 
-  // Request a pointer lock on the root frame's body.
-  EXPECT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(root));
 
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
 
   // Add a mouse move wheel event listener to the root frame.
   EXPECT_TRUE(ExecJs(
@@ -556,7 +585,8 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
   root_observer.Wait();
 
   blink::WebMouseWheelEvent wheel_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   wheel_event.SetPositionInScreen(10, 11);
   wheel_event.delta_x = -12;
@@ -581,15 +611,12 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
   // Locked event has same coordinates as before locked.
   EXPECT_EQ("[6,7,12,13]", EvalJs(root, "JSON.stringify([x, y, dX, dY])"));
 
-  // Release pointer lock on root frame.
-  EXPECT_TRUE(ExecJs(root, "document.exitPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::ExitPointerLock(root));
 
-  // Request a pointer lock on the child frame's body.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
 
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
 
   // Add a mouse move event listener to the child frame.
   EXPECT_TRUE(ExecJs(
@@ -634,14 +661,10 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockWidgetHidden) {
   WaitForHitTestData(child->current_frame_host());
 
   // Request a pointer lock on the child frame's body.
-  EXPECT_TRUE(ExecJs(child, "document.body.requestPointerLock()"));
-
-  // execute dummy js to run a js loop and finish the request
-  EXPECT_TRUE(ExecJs(child, ""));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
+
   EXPECT_TRUE(child_view->IsMouseLocked());
   EXPECT_EQ(child_view->host(), web_contents()->GetMouseLockWidget());
 
@@ -665,54 +688,48 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockOutOfFocus) {
 
   root_view->has_focus_ = false;
   // Request a pointer lock on the root frame's body.
-  ASSERT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
-
-  // setup promise structure to ensure request finishes.
-  EXPECT_TRUE(ExecJs(root, R"(
-        var advertisementreceivedPromise = new Promise(resolve => {
-          document.addEventListener('pointerlockerror',
-              event => {
-                resolve(true);
-              });
-        });
-      )"));
-
+  EXPECT_EQ(false, PointerLockHelper::RequestPointerLockOnBody(root));
   // Root frame should not have been granted pointer lock.
-  EXPECT_EQ(false,
-            EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(root));
 }
 #endif
 
-// Flaky. https://crbug.com/1014324
 IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
-                       DISABLED_PointerLockRequestUnadjustedMovement) {
+                       PointerLockRequestUnadjustedMovement) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
 
-  EXPECT_TRUE(ExecJs(root,
-                     "var PointerLockErrorReceived=false;"
-                     "document.addEventListener('pointerlockerror', "
-                     "function() {PointerLockErrorReceived = true;});"));
+  EXPECT_TRUE(ExecJs(root, "var pointerLockPromise;"));
+  std::string wait_for_pointer_lock_promise =
+      "(async ()=> {return await pointerLockPromise.then(()=>true, "
+      "()=>false);})()";
+  std::string set_pointer_lock_promise =
+      R"code(pointerLockPromise = new Promise( function(resolve, reject){
+                        document.addEventListener('pointerlockchange', resolve);
+                        document.addEventListener('pointerlockerror', reject)
+                     });)code";
+
   // Request a pointer lock.
-  EXPECT_TRUE(ExecJs(root, "document.body.requestPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(root));
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
   // Mouse is locked and unadjusted_movement is not set.
   EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
-  // Release pointer lock.
-  EXPECT_TRUE(ExecJs(root, "document.exitPointerLock()"));
 
-  EXPECT_EQ("false", EvalJs(root, "JSON.stringify(PointerLockErrorReceived)"));
+  // Release pointer lock.
+  EXPECT_EQ(true, PointerLockHelper::ExitPointerLock(root));
 
-  // Request a pointer lock with unadjustedMovement.
-  EXPECT_TRUE(ExecJs(
-      root, "document.body.requestPointerLock({unadjustedMovement:true})"));
 #if defined(USE_AURA)
+  // Request a pointer lock with unadjustedMovement.
+  EXPECT_EQ(
+      true,
+      PointerLockHelper::RequestPointerLockWithUnadjustedMovementOnBody(root));
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
+
   // Mouse is locked and unadjusted_movement is set.
   EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
   EXPECT_TRUE(root->current_frame_host()
@@ -720,15 +737,20 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
                   ->GetIsMouseLockedUnadjustedMovementForTesting());
 
   // Release pointer lock, unadjusted_movement bit is reset.
-  EXPECT_TRUE(ExecJs(root, "document.exitPointerLock()"));
+  EXPECT_EQ(true, PointerLockHelper::ExitPointerLock(root));
+
   EXPECT_FALSE(root->current_frame_host()
                    ->GetView()
                    ->GetIsMouseLockedUnadjustedMovementForTesting());
 #else
+  // Request a pointer lock with unadjustedMovement.
   // On platform that does not support unadjusted movement yet, do not lock and
   // a pointerlockerror event is dispatched.
+  EXPECT_EQ(
+      false,
+      PointerLockHelper::RequestPointerLockWithUnadjustedMovementOnBody(root));
+  EXPECT_EQ(false, PointerLockHelper::IsPointerLockOnBody(root));
   EXPECT_FALSE(root->current_frame_host()->GetView()->IsMouseLocked());
-  EXPECT_EQ("true", EvalJs(root, "JSON.stringify(PointerLockErrorReceived)"));
 #endif
 }
 
@@ -759,7 +781,8 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
 
   // Send a mouse move to root frame before lock.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.pointer_type = blink::WebPointerProperties::PointerType::kMouse;
   mouse_event.SetPositionInWidget(6, 7);
@@ -775,10 +798,13 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
   EXPECT_EQ("[6,7,0,0]", EvalJs(root, "JSON.stringify([x,y,mX,mY])"));
 
   // Request a pointer lock with unadjustedMovement.
-  EXPECT_TRUE(ExecJs(
-      root, "document.body.requestPointerLock({unadjustedMovement:true})"));
+  EXPECT_EQ(
+      true,
+      PointerLockHelper::RequestPointerLockWithUnadjustedMovementOnBody(root));
+
   // Root frame should have been granted pointer lock.
-  EXPECT_EQ(true, EvalJs(root, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(root));
+
   // Mouse is locked and unadjusted_movement is not set.
   EXPECT_TRUE(root->current_frame_host()->GetView()->IsMouseLocked());
 
@@ -833,11 +859,10 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
 
   // Request a pointer lock on the child frame's body and wait for the promise
   // to resolve.
-  EXPECT_EQ(nullptr, EvalJs(child, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
+
   EXPECT_TRUE(child_view->IsMouseLocked());
   EXPECT_FALSE(root->current_frame_host()
                    ->GetView()
@@ -882,11 +907,10 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
 
   // Request a pointer lock on the child frame's body and wait for the promise
   // to resolve.
-  EXPECT_EQ(nullptr, EvalJs(child, "document.body.requestPointerLock()"));
-
+  EXPECT_EQ(true, PointerLockHelper::RequestPointerLockOnBody(child));
   // Child frame should have been granted pointer lock.
-  EXPECT_EQ(true,
-            EvalJs(child, "document.pointerLockElement == document.body"));
+  EXPECT_EQ(true, PointerLockHelper::IsPointerLockOnBody(child));
+
   EXPECT_TRUE(child_view->IsMouseLocked());
   EXPECT_FALSE(root->current_frame_host()
                    ->GetView()
diff --git a/chromium/content/browser/portal/portal.cc b/chromium/content/browser/portal/portal.cc
index b9c99f6cd60..ce5f6fe75fe 100644
--- a/chromium/content/browser/portal/portal.cc
+++ b/chromium/content/browser/portal/portal.cc
@@ -11,8 +11,8 @@
 #include "base/memory/ptr_util.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
-#include "content/browser/frame_host/navigator_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_host_manager.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/page_type.h"
 #include "content/public/common/referrer_type_converters.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
@@ -126,16 +127,15 @@ RenderFrameProxyHost* Portal::CreateProxyAndAttachPortal() {
   // Create a FrameTreeNode in the outer WebContents to host the portal, in
   // response to the creation of a portal in the renderer process.
   FrameTreeNode* outer_node = outer_contents_impl->GetFrameTree()->AddFrame(
-      owner_render_frame_host_->frame_tree_node(),
-      owner_render_frame_host_->GetProcess()->GetID(),
+      owner_render_frame_host_, owner_render_frame_host_->GetProcess()->GetID(),
       owner_render_frame_host_->GetProcess()->GetNextRoutingID(),
       std::move(interface_provider_receiver),
       mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker>()
           .InitWithNewPipeAndPassReceiver(),
-      blink::WebTreeScopeType::kDocument, "", "", true,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(), false,
-      blink::FrameOwnerElementType::kPortal);
+      blink::mojom::TreeScopeType::kDocument, "", "", true,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(), false,
+      blink::mojom::FrameOwnerElementType::kPortal);
   outer_node->AddObserver(this);
 
   bool web_contents_created = false;
@@ -157,6 +157,18 @@ RenderFrameProxyHost* Portal::CreateProxyAndAttachPortal() {
       portal_contents_.ReleaseOwnership(), outer_node->current_frame_host(),
       false /* is_full_page */);
 
+  // If a cross-process navigation started while the predecessor was orphaned,
+  // we need to create a view for the speculative RFH as well.
+  if (RenderFrameHostImpl* speculative_rfh =
+          portal_contents_->GetPendingMainFrame()) {
+    if (RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
+            speculative_rfh->GetView())) {
+      view->Destroy();
+    }
+    portal_contents_->CreateRenderWidgetHostViewForRenderManager(
+        speculative_rfh->render_view_host());
+  }
+
   FrameTreeNode* frame_tree_node =
       portal_contents_->GetMainFrame()->frame_tree_node();
   RenderFrameProxyHost* proxy_host =
@@ -220,12 +232,18 @@ void Portal::Navigate(const GURL& url,
   // Fix this so that we can enforce this as an invariant.
   constexpr bool should_replace_entry = true;
 
+  // TODO(https://crbug.com/1074422): It is possible for a portal to be
+  // navigated by a frame other than the owning frame. Find a way to route the
+  // correct initiator of the portal navigation to this call.
   portal_root->navigator()->NavigateFromFrameProxy(
-      portal_frame, url, owner_render_frame_host_->GetLastCommittedOrigin(),
+      portal_frame, url,
+      GlobalFrameRoutingId(owner_render_frame_host_->GetProcess()->GetID(),
+                           owner_render_frame_host_->GetRoutingID()),
+      owner_render_frame_host_->GetLastCommittedOrigin(),
       owner_render_frame_host_->GetSiteInstance(),
       mojo::ConvertTo<Referrer>(referrer), ui::PAGE_TRANSITION_LINK,
-      should_replace_entry, download_policy, "GET", nullptr, "", nullptr,
-      false);
+      should_replace_entry, download_policy, "GET", nullptr, "", nullptr, false,
+      base::nullopt);
 
   std::move(callback).Run();
 }
@@ -272,16 +290,9 @@ void TakeHistoryForActivation(WebContentsImpl* activated_contents,
   NavigationControllerImpl& predecessor_controller =
       predecessor_contents->GetController();
 
-  DCHECK(predecessor_controller.GetLastCommittedEntry());
   // Activation would have discarded any pending entry in the host contents.
   DCHECK(!predecessor_controller.GetPendingEntry());
 
-  // TODO(mcnee): Determine how to deal with a transient entry.
-  if (predecessor_controller.GetTransientEntry() ||
-      activated_controller.GetTransientEntry()) {
-    return;
-  }
-
   // TODO(mcnee): Once we enforce that a portal contents does not build up its
   // own history, make this DCHECK that we only have a single committed entry,
   // possibly with a new pending entry.
@@ -318,14 +329,35 @@ void Portal::Activate(blink::TransferableMessage data,
       << "The binding should have been closed when the portal's outer "
          "FrameTreeNode was deleted due to swap out.";
 
+  DCHECK(portal_contents_);
+  NavigationControllerImpl& portal_controller =
+      portal_contents_->GetController();
+  NavigationControllerImpl& predecessor_controller =
+      outer_contents->GetController();
+
   // If no navigation has yet committed in the portal, it cannot be activated as
   // this would lead to an empty tab contents (without even an about:blank).
-  DCHECK(portal_contents_);
-  if (portal_contents_->GetController().GetLastCommittedEntryIndex() < 0) {
+  if (portal_controller.GetLastCommittedEntryIndex() < 0) {
     std::move(callback).Run(
         blink::mojom::PortalActivateResult::kRejectedDueToPortalNotReady);
     return;
   }
+  DCHECK(predecessor_controller.GetLastCommittedEntry());
+
+  // Error pages and interstitials may not host portals due to the HTTP(S)
+  // restriction.
+  DCHECK_EQ(PAGE_TYPE_NORMAL,
+            predecessor_controller.GetLastCommittedEntry()->GetPageType());
+  DCHECK(!predecessor_controller.GetTransientEntry());
+
+  // If the portal is showing an error page, reject activation.
+  if (portal_controller.GetLastCommittedEntry()->GetPageType() !=
+      PAGE_TYPE_NORMAL) {
+    std::move(callback).Run(
+        blink::mojom::PortalActivateResult::kRejectedDueToErrorInPortal);
+    return;
+  }
+  DCHECK(!portal_controller.GetTransientEntry());
 
   // If a navigation in the main frame is occurring, stop it if possible and
   // reject the activation if it's too late or if an ongoing navigation takes
@@ -346,13 +378,13 @@ void Portal::Activate(blink::TransferableMessage data,
   if (owner_render_frame_host_->HasPendingCommitNavigation() ||
       (outer_navigation &&
        outer_navigation->state() >= NavigationRequest::WILL_PROCESS_RESPONSE) ||
-      NavigatorImpl::ShouldIgnoreIncomingRendererRequest(outer_navigation,
-                                                         has_user_gesture)) {
+      Navigator::ShouldIgnoreIncomingRendererRequest(outer_navigation,
+                                                     has_user_gesture)) {
     std::move(callback).Run(blink::mojom::PortalActivateResult::
                                 kRejectedDueToPredecessorNavigation);
     return;
   }
-  outer_root_node->StopLoading();
+  outer_root_node->navigator()->CancelNavigation(outer_root_node);
 
   DCHECK(!is_closing_) << "Portal should not be shutting down when contents "
                           "ownership is yielded";
@@ -383,6 +415,7 @@ void Portal::Activate(blink::TransferableMessage data,
 
   auto* outer_contents_main_frame_view = static_cast<RenderWidgetHostViewBase*>(
       outer_contents->GetMainFrame()->GetView());
+  DCHECK(!outer_contents->GetPendingMainFrame());
   auto* portal_contents_main_frame_view =
       static_cast<RenderWidgetHostViewBase*>(
           successor_contents_raw->GetMainFrame()->GetView());
@@ -421,24 +454,18 @@ void Portal::Activate(blink::TransferableMessage data,
 
   // These pointers are cleared so that they don't dangle in the event this
   // object isn't immediately deleted. It isn't done sooner because
-  // SwapWebContents misbehaves if the WebContents doesn't appear to be a portal
-  // at that time.
+  // ActivatePortalWebContents misbehaves if the WebContents doesn't appear to
+  // be a portal at that time.
   portal_contents_.Clear();
 
   successor_contents_raw->GetMainFrame()->OnPortalActivated(
       std::move(predecessor_web_contents), std::move(data),
       std::move(callback));
-  successor_contents_raw->NotifyInsidePortal(false);
-
-  // This happens later than SwapWebContents so that the delegate can observe it
-  // happening after predecessor_web_contents has been moved into a portal.
-  successor_contents_raw->GetDelegate()->WebContentsBecamePortal(
-      outer_contents);
-
-  BrowserAccessibilityManager* manager =
-      successor_contents_raw->GetMainFrame()->browser_accessibility_manager();
-  if (manager)
-    manager->OnPortalActivated();
+  // Notifying of activation happens later than ActivatePortalWebContents so
+  // that it is observed after predecessor_web_contents has been moved into a
+  // portal.
+  DCHECK(outer_contents->IsPortal());
+  successor_contents_raw->DidActivatePortal(outer_contents);
 }
 
 void Portal::PostMessageToGuest(
diff --git a/chromium/content/browser/portal/portal_browsertest.cc b/chromium/content/browser/portal/portal_browsertest.cc
index 4e3f0615543..03886cfb01a 100644
--- a/chromium/content/browser/portal/portal_browsertest.cc
+++ b/chromium/content/browser/portal/portal_browsertest.cc
@@ -3,13 +3,16 @@
 // found in the LICENSE file.
 
 #include <memory>
+#include <tuple>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/test_timeouts.h"
 #include "build/build_config.h"
 #include "components/viz/host/host_frame_sink_manager.h"
 #include "content/browser/compositor/surface_utils.h"
@@ -27,7 +30,9 @@
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/page_type.h"
 #include "content/public/test/accessibility_notification_waiter.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -40,6 +45,7 @@
 #include "content/test/portal/portal_created_observer.h"
 #include "content/test/portal/portal_interceptor_for_testing.h"
 #include "content/test/test_render_frame_host_factory.h"
+#include "net/base/net_errors.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -77,7 +83,8 @@ class PortalBrowserTest : public ContentBrowserTest {
 
   Portal* CreatePortalToUrl(WebContentsImpl* host_contents,
                             GURL portal_url,
-                            int number_of_navigations = 1) {
+                            int number_of_navigations = 1,
+                            bool expected_to_succeed = true) {
     EXPECT_GE(number_of_navigations, 1);
     RenderFrameHostImpl* main_frame = host_contents->GetMainFrame();
 
@@ -103,7 +110,7 @@ class PortalBrowserTest : public ContentBrowserTest {
     EXPECT_TRUE(portal_contents);
 
     navigation_observer.WaitForNavigationFinished();
-    EXPECT_TRUE(WaitForLoadStop(portal_contents));
+    EXPECT_EQ(expected_to_succeed, WaitForLoadStop(portal_contents));
 
     return portal;
   }
@@ -400,10 +407,10 @@ IN_PROC_BROWSER_TEST_F(PortalHitTestBrowserTest, DispatchInputEvent) {
   gfx::Point root_location =
       portal_view->TransformPointToRootCoordSpace(gfx::Point(5, 5));
   InputEventAckWaiter waiter(main_frame->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kMouseDown);
-  SimulateRoutedMouseEvent(web_contents_impl, blink::WebInputEvent::kMouseDown,
-                           blink::WebPointerProperties::Button::kLeft,
-                           root_location);
+                             blink::WebInputEvent::Type::kMouseDown);
+  SimulateRoutedMouseEvent(
+      web_contents_impl, blink::WebInputEvent::Type::kMouseDown,
+      blink::WebPointerProperties::Button::kLeft, root_location);
   waiter.Wait();
 
   // Check that the click event was only received by the main frame.
@@ -480,10 +487,10 @@ IN_PROC_BROWSER_TEST_F(PortalHitTestBrowserTest, NoInputToOOPIFInPortal) {
   gfx::Point root_location =
       oopif_view->TransformPointToRootCoordSpace(gfx::Point(5, 5));
   InputEventAckWaiter waiter(main_frame->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kMouseDown);
-  SimulateRoutedMouseEvent(web_contents_impl, blink::WebInputEvent::kMouseDown,
-                           blink::WebPointerProperties::Button::kLeft,
-                           root_location);
+                             blink::WebInputEvent::Type::kMouseDown);
+  SimulateRoutedMouseEvent(
+      web_contents_impl, blink::WebInputEvent::Type::kMouseDown,
+      blink::WebPointerProperties::Button::kLeft, root_location);
   waiter.Wait();
 
   // Check that the click event was only received by the main frame.
@@ -595,9 +602,9 @@ IN_PROC_BROWSER_TEST_F(PortalHitTestBrowserTest,
   gfx::Point root_location =
       oopif_view->TransformPointToRootCoordSpace(gfx::Point(10, 10));
   InputEventAckWaiter waiter(oopif->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kMouseDown);
+                             blink::WebInputEvent::Type::kMouseDown);
   SimulateRoutedMouseEvent(
-      shell()->web_contents(), blink::WebInputEvent::kMouseDown,
+      shell()->web_contents(), blink::WebInputEvent::Type::kMouseDown,
       blink::WebPointerProperties::Button::kLeft, root_location);
   waiter.Wait();
 
@@ -1155,30 +1162,92 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, RemovePortalWhenUnloading) {
   EXPECT_TRUE(ExecJs(main_frame, "div.remove();"));
 }
 
+class PortalOrphanedNavigationBrowserTest
+    : public PortalBrowserTest,
+      public testing::WithParamInterface<std::tuple<bool, bool>> {
+ public:
+  PortalOrphanedNavigationBrowserTest()
+      : cross_site_(std::get<0>(GetParam())),
+        commit_after_adoption_(std::get<1>(GetParam())) {}
+
+  // Provides meaningful param names instead of /0, /1, ...
+  static std::string DescribeParams(
+      const testing::TestParamInfo<ParamType>& info) {
+    bool cross_site;
+    bool commit_after_adoption;
+    std::tie(cross_site, commit_after_adoption) = info.param;
+    return base::StringPrintf("%sSite_Commit%sAdoption",
+                              cross_site ? "Cross" : "Same",
+                              commit_after_adoption ? "After" : "Before");
+  }
+
+ protected:
+  bool cross_site() const { return cross_site_; }
+  bool commit_after_adoption() const { return commit_after_adoption_; }
+
+ private:
+  // Whether the predecessor navigates cross site while orphaned.
+  const bool cross_site_;
+  // Whether the predecessor's navigation commits before or after adoption.
+  const bool commit_after_adoption_;
+};
+
+INSTANTIATE_TEST_SUITE_P(All,
+                         PortalOrphanedNavigationBrowserTest,
+                         testing::Combine(testing::Bool(), testing::Bool()),
+                         PortalOrphanedNavigationBrowserTest::DescribeParams);
+
 // Tests that a portal can navigate while orphaned.
-IN_PROC_BROWSER_TEST_F(PortalBrowserTest, OrphanedNavigation) {
-  EXPECT_TRUE(NavigateToURL(
-      shell(), embedded_test_server()->GetURL("portal.test", "/title1.html")));
+IN_PROC_BROWSER_TEST_P(PortalOrphanedNavigationBrowserTest,
+                       OrphanedNavigation) {
+  GURL main_url(embedded_test_server()->GetURL("portal.test", "/title1.html"));
+  ASSERT_TRUE(NavigateToURL(shell(), main_url));
   WebContentsImpl* web_contents_impl =
       static_cast<WebContentsImpl*>(shell()->web_contents());
-  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
 
-  GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
-  Portal* portal = CreatePortalToUrl(web_contents_impl, a_url);
-  WebContentsImpl* portal_contents = portal->GetPortalContents();
+  GURL portal_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  Portal* portal = CreatePortalToUrl(web_contents_impl, portal_url);
 
-  // Block the activate callback so that the predecessor portal stays orphaned.
-  EXPECT_TRUE(ExecJs(portal_contents->GetMainFrame(),
-                     "window.onportalactivate = e => { while(true) {} };"));
+  GURL predecessor_nav_url(embedded_test_server()->GetURL(
+      cross_site() ? "b.com" : "portal.test", "/title2.html"));
+
+  if (commit_after_adoption()) {
+    // Block the activate callback so that there is ample time to start the
+    // navigation while orphaned.
+    // TODO(mcnee): Ideally, we would have a test interceptor to precisely
+    // control when to proceed with adoption.
+    const int adoption_delay = TestTimeouts::tiny_timeout().InMilliseconds();
+    EXPECT_TRUE(
+        ExecJs(portal->GetPortalContents()->GetMainFrame(),
+               JsReplace("window.onportalactivate = e => {"
+                         "  let end = performance.now() + $1;"
+                         "  while (performance.now() < end);"
+                         "  document.body.appendChild(e.adoptPredecessor());"
+                         "};",
+                         adoption_delay)));
+  } else {
+    // Block the activate callback so that the predecessor portal stays
+    // orphaned.
+    EXPECT_TRUE(ExecJs(portal->GetPortalContents()->GetMainFrame(),
+                       "window.onportalactivate = e => { while(true) {} };"));
+  }
 
   // Activate the portal and navigate the predecessor.
   PortalActivatedObserver activated_observer(portal);
-  TestNavigationObserver main_frame_navigation_observer(web_contents_impl);
-  ExecuteScriptAsync(main_frame,
-                     "document.querySelector('portal').activate();"
-                     "window.location.reload()");
+  TestNavigationManager navigation_manager(web_contents_impl,
+                                           predecessor_nav_url);
+  ExecuteScriptAsync(web_contents_impl->GetMainFrame(),
+                     JsReplace("document.querySelector('portal').activate();"
+                               "window.location.href = $1;",
+                               predecessor_nav_url));
   activated_observer.WaitForActivate();
-  main_frame_navigation_observer.Wait();
+  if (commit_after_adoption()) {
+    ASSERT_TRUE(navigation_manager.WaitForRequestStart());
+    EXPECT_EQ(blink::mojom::PortalActivateResult::kPredecessorWasAdopted,
+              activated_observer.WaitForActivateResult());
+  }
+  navigation_manager.WaitForNavigationFinished();
+  EXPECT_TRUE(navigation_manager.was_successful());
 }
 
 // Tests that the browser doesn't crash if the renderer tries to create the
@@ -1355,11 +1424,14 @@ class RenderFrameHostFactoryForNavigationControlInterceptor
       FrameTree* frame_tree,
       FrameTreeNode* frame_tree_node,
       int32_t routing_id,
+      const base::UnguessableToken& frame_token,
       bool renderer_initiated_creation) override {
     return base::WrapUnique(
         new RenderFrameHostImplForNavigationControlInterceptor(
             site_instance, std::move(render_view_host), delegate, frame_tree,
-            frame_tree_node, routing_id, renderer_initiated_creation));
+            frame_tree_node, routing_id, frame_token,
+            renderer_initiated_creation,
+            RenderFrameHostImpl::LifecycleState::kActive));
   }
 };
 
@@ -1751,6 +1823,60 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, NavigationPrecedence) {
   EXPECT_TRUE(pending_back_navigation.was_successful());
 }
 
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest, RejectActivationOfErrorPages) {
+  net::EmbeddedTestServer bad_https_server(net::EmbeddedTestServer::TYPE_HTTPS);
+  bad_https_server.AddDefaultHandlers(GetTestDataFilePath());
+  bad_https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_EXPIRED);
+  ASSERT_TRUE(bad_https_server.Start());
+
+  GURL main_url(embedded_test_server()->GetURL("portal.test", "/title1.html"));
+  ASSERT_TRUE(NavigateToURL(shell(), main_url));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+
+  GURL bad_portal_url(bad_https_server.GetURL("a.com", "/title1.html"));
+  Portal* portal = CreatePortalToUrl(web_contents_impl, bad_portal_url,
+                                     /* number_of_navigations */ 1,
+                                     /* expected_to_succeed */ false);
+
+  PortalActivatedObserver activated_observer(portal);
+  EXPECT_EQ("reject", EvalJs(main_frame,
+                             "document.querySelector('portal').activate().then("
+                             "    () => 'resolve', () => 'reject');"));
+  EXPECT_EQ(blink::mojom::PortalActivateResult::kRejectedDueToErrorInPortal,
+            activated_observer.result());
+}
+
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest,
+                       RejectActivationOfPostCommitErrorPages) {
+  GURL main_url(embedded_test_server()->GetURL("portal.test", "/title1.html"));
+  ASSERT_TRUE(NavigateToURL(shell(), main_url));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+
+  GURL portal_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  Portal* portal = CreatePortalToUrl(web_contents_impl, portal_url);
+  WebContentsImpl* portal_contents = portal->GetPortalContents();
+
+  std::string error_html = "Error page";
+  TestNavigationObserver error_observer(portal_contents);
+  portal_contents->GetController().LoadPostCommitErrorPage(
+      portal_contents->GetMainFrame(), portal_url, error_html,
+      net::ERR_BLOCKED_BY_CLIENT);
+  error_observer.Wait();
+  EXPECT_FALSE(error_observer.last_navigation_succeeded());
+  EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT, error_observer.last_net_error_code());
+
+  PortalActivatedObserver activated_observer(portal);
+  EXPECT_EQ("reject", EvalJs(main_frame,
+                             "document.querySelector('portal').activate().then("
+                             "    () => 'resolve', () => 'reject');"));
+  EXPECT_EQ(blink::mojom::PortalActivateResult::kRejectedDueToErrorInPortal,
+            activated_observer.result());
+}
+
 IN_PROC_BROWSER_TEST_F(PortalBrowserTest, CallCreateProxyAndAttachPortalTwice) {
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL("portal.test", "/title1.html")));
diff --git a/chromium/content/browser/portal/portal_navigation_throttle_browsertest.cc b/chromium/content/browser/portal/portal_navigation_throttle_browsertest.cc
index 6f65cfd0dc8..6e5e648a3a7 100644
--- a/chromium/content/browser/portal/portal_navigation_throttle_browsertest.cc
+++ b/chromium/content/browser/portal/portal_navigation_throttle_browsertest.cc
@@ -311,6 +311,36 @@ IN_PROC_BROWSER_TEST_F(PortalNavigationThrottleBrowserTest,
   GetWebContents()->SetDelegate(old_delegate);
 }
 
+// Ensure navigating while a portal is orphaned does not bypass cross-origin
+// restrictions.
+IN_PROC_BROWSER_TEST_F(PortalNavigationThrottleBrowserTest,
+                       CrossOriginNavigationWhileOrphaned) {
+  WebContentsImpl* predecessor_contents = GetWebContents();
+  GURL predecessor_url =
+      embedded_test_server()->GetURL("portal.test", "/title1.html");
+  GURL orphan_navigation_url =
+      embedded_test_server()->GetURL("not.portal.test", "/notreached");
+  ASSERT_TRUE(NavigateToURL(predecessor_contents, predecessor_url));
+  Portal* portal = InsertAndWaitForPortal(
+      embedded_test_server()->GetURL("portal.test", "/title2.html"));
+
+  // We want the predecessor's navigation to occur before adoption, so we have
+  // the successor hang to keep the predecessor in the orphaned state.
+  EXPECT_TRUE(ExecJs(portal->GetPortalContents(),
+                     "window.addEventListener('portalactivate', (e) => {"
+                     "  while (true);"
+                     "});"));
+
+  TestNavigationObserver navigation_observer(predecessor_contents);
+  EXPECT_TRUE(ExecJs(predecessor_contents,
+                     JsReplace("document.querySelector('portal').activate();"
+                               "location.href = $1;",
+                               orphan_navigation_url)));
+  navigation_observer.Wait();
+  EXPECT_FALSE(navigation_observer.last_navigation_succeeded());
+  EXPECT_EQ(predecessor_contents->GetLastCommittedURL(), predecessor_url);
+}
+
 class PortalNavigationThrottleBrowserTestCrossOrigin
     : public PortalNavigationThrottleBrowserTest {
  protected:
diff --git a/chromium/content/browser/power_monitor_browsertest.cc b/chromium/content/browser/power_monitor_browsertest.cc
index 81b68e132e8..d7cca93becd 100644
--- a/chromium/content/browser/power_monitor_browsertest.cc
+++ b/chromium/content/browser/power_monitor_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/process_type.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/process_internals/process_internals.mojom b/chromium/content/browser/process_internals/process_internals.mojom
index 14ae3fcb9cb..acc265adf63 100644
--- a/chromium/content/browser/process_internals/process_internals.mojom
+++ b/chromium/content/browser/process_internals/process_internals.mojom
@@ -26,6 +26,8 @@ struct FrameInfo {
   url.mojom.Url? last_committed_url;
 
   array<FrameInfo> subframes;
+
+  bool is_bfcached;
 };
 
 // Basic information describing a WebContents object and all frames that are
@@ -33,6 +35,7 @@ struct FrameInfo {
 struct WebContentsInfo {
   string title;
   FrameInfo root_frame;
+  array<FrameInfo> bfcached_root_frames;
 };
 
 // Information about a currently active isolated origin, including the origin
diff --git a/chromium/content/browser/process_internals/process_internals_browsertest.cc b/chromium/content/browser/process_internals/process_internals_browsertest.cc
index 0febc131890..25b3c666277 100644
--- a/chromium/content/browser/process_internals/process_internals_browsertest.cc
+++ b/chromium/content/browser/process_internals/process_internals_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/process_internals/process_internals_handler_impl.cc b/chromium/content/browser/process_internals/process_internals_handler_impl.cc
index 5cb68ab97b2..535427bdb60 100644
--- a/chromium/content/browser/process_internals/process_internals_handler_impl.cc
+++ b/chromium/content/browser/process_internals/process_internals_handler_impl.cc
@@ -10,6 +10,9 @@
 
 #include "base/strings/string_piece.h"
 #include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/frame_host/back_forward_cache_impl.h"
+#include "content/browser/frame_host/navigation_controller_impl.h"
+#include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/process_internals/process_internals.mojom.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/site_isolation_policy.h"
@@ -24,8 +27,8 @@ namespace {
 
 using IsolatedOriginSource = ChildProcessSecurityPolicy::IsolatedOriginSource;
 
-::mojom::FrameInfoPtr FrameTreeNodeToFrameInfo(FrameTreeNode* ftn) {
-  RenderFrameHost* frame = ftn->current_frame_host();
+::mojom::FrameInfoPtr RenderFrameHostToFrameInfo(RenderFrameHostImpl* frame,
+                                                 bool is_bfcached) {
   auto frame_info = ::mojom::FrameInfo::New();
 
   frame_info->routing_id = frame->GetRoutingID();
@@ -34,6 +37,7 @@ using IsolatedOriginSource = ChildProcessSecurityPolicy::IsolatedOriginSource;
       frame->GetLastCommittedURL().is_valid()
           ? base::make_optional(frame->GetLastCommittedURL())
           : base::nullopt;
+  frame_info->is_bfcached = is_bfcached;
 
   SiteInstanceImpl* site_instance =
       static_cast<SiteInstanceImpl*>(frame->GetSiteInstance());
@@ -49,8 +53,9 @@ using IsolatedOriginSource = ChildProcessSecurityPolicy::IsolatedOriginSource;
           ? base::make_optional(site_instance->GetSiteURL())
           : base::nullopt;
 
-  for (size_t i = 0; i < ftn->child_count(); ++i) {
-    frame_info->subframes.push_back(FrameTreeNodeToFrameInfo(ftn->child_at(i)));
+  for (size_t i = 0; i < frame->child_count(); ++i) {
+    frame_info->subframes.push_back(RenderFrameHostToFrameInfo(
+        frame->child_at(i)->current_frame_host(), is_bfcached));
   }
 
   return frame_info;
@@ -162,7 +167,16 @@ void ProcessInternalsHandlerImpl::GetAllWebContentsInfo(
     auto info = ::mojom::WebContentsInfo::New();
     info->title = base::UTF16ToUTF8(web_contents->GetTitle());
     info->root_frame =
-        FrameTreeNodeToFrameInfo(web_contents->GetFrameTree()->root());
+        RenderFrameHostToFrameInfo(web_contents->GetMainFrame(), false);
+
+    // Retrieve all root frames from bfcache as well.
+    NavigationControllerImpl& controller = web_contents->GetController();
+    const auto& entries = controller.GetBackForwardCache().GetEntries();
+    for (const auto& entry : entries) {
+      info->bfcached_root_frames.push_back(
+          RenderFrameHostToFrameInfo((*entry).render_frame_host.get(), true));
+    }
+
     infos.push_back(std::move(info));
   }
 
diff --git a/chromium/content/browser/push_messaging/push_messaging_manager.cc b/chromium/content/browser/push_messaging/push_messaging_manager.cc
index bd34c7ab16e..c5673426769 100644
--- a/chromium/content/browser/push_messaging/push_messaging_manager.cc
+++ b/chromium/content/browser/push_messaging/push_messaging_manager.cc
@@ -10,10 +10,11 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
diff --git a/chromium/content/browser/renderer_host/DEPS b/chromium/content/browser/renderer_host/DEPS
index d115735a745..94dca6230e4 100644
--- a/chromium/content/browser/renderer_host/DEPS
+++ b/chromium/content/browser/renderer_host/DEPS
@@ -45,6 +45,9 @@ specific_include_rules = {
     "+content/browser/frame_host",
     "+content/public/browser/web_contents.h",
   ],
+  "text_input_client_mac\.mm": [
+    "+content/browser/frame_host"
+  ],
   # TODO(nasko): Remove these exceptions once we've untangled the dependency
   # of RenderViewHost on the FrameTree.
   "render_view_host_impl\.(cc|h)": [
diff --git a/chromium/content/browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc b/chromium/content/browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc
index e8d23090512..ba7236c5ced 100644
--- a/chromium/content/browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc
+++ b/chromium/content/browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/renderer_host/legacy_render_widget_host_win.h"
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc b/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
index 898cca9a64d..f185ce0eb7a 100644
--- a/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
+++ b/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
@@ -7,6 +7,7 @@
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/renderer_host/compositor_dependencies_android.cc b/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
index f55cfda47da..da271b9e65a 100644
--- a/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
+++ b/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
@@ -41,7 +41,7 @@ void BrowserGpuChannelHostFactorySetApplicationVisible(bool is_visible) {
 void SendOnBackgroundedToGpuService() {
   content::GpuProcessHost::CallOnIO(
       content::GPU_PROCESS_KIND_SANDBOXED, false /* force_create */,
-      base::BindRepeating([](content::GpuProcessHost* host) {
+      base::BindOnce([](content::GpuProcessHost* host) {
         if (host) {
           host->gpu_service()->OnBackgrounded();
         }
@@ -51,7 +51,7 @@ void SendOnBackgroundedToGpuService() {
 void SendOnForegroundedToGpuService() {
   content::GpuProcessHost::CallOnIO(
       content::GPU_PROCESS_KIND_SANDBOXED, false /* force_create */,
-      base::BindRepeating([](content::GpuProcessHost* host) {
+      base::BindOnce([](content::GpuProcessHost* host) {
         if (host) {
           host->gpu_service()->OnForegrounded();
         }
@@ -167,7 +167,7 @@ void CompositorDependenciesAndroid::DoLowEndBackgroundCleanup() {
   // lose all renderer contexts.
   content::GpuProcessHost::CallOnIO(
       content::GPU_PROCESS_KIND_SANDBOXED, false /* force_create */,
-      base::BindRepeating([](content::GpuProcessHost* host) {
+      base::BindOnce([](content::GpuProcessHost* host) {
         if (host) {
           host->gpu_service()->OnBackgroundCleanup();
         }
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android.cc b/chromium/content/browser/renderer_host/compositor_impl_android.cc
index 9c65caea9ba..e094050c27a 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android.cc
+++ b/chromium/content/browser/renderer_host/compositor_impl_android.cc
@@ -199,6 +199,12 @@ class CompositorImpl::AndroidHostDisplayClient : public viz::HostDisplayClient {
   void OnContextCreationResult(gpu::ContextResult context_result) override {
     compositor_->OnContextCreationResult(context_result);
   }
+  void SetWideColorEnabled(bool enabled) override {
+    // TODO(cblume): Add support for multiple compositors.
+    // If one goes wide, all should go wide.
+    if (compositor_->root_window_)
+      compositor_->root_window_->SetWideColorEnabled(enabled);
+  }
   void SetPreferredRefreshRate(float refresh_rate) override {
     if (compositor_->root_window_)
       compositor_->root_window_->SetPreferredRefreshRate(refresh_rate);
@@ -222,6 +228,26 @@ class CompositorImpl::ScopedCachedBackBuffer {
   uint32_t cache_id_;
 };
 
+class CompositorImpl::ReadbackRefImpl
+    : public ui::WindowAndroidCompositor::ReadbackRef {
+ public:
+  explicit ReadbackRefImpl(base::WeakPtr<CompositorImpl> weakptr);
+  ~ReadbackRefImpl() override;
+
+ private:
+  base::WeakPtr<CompositorImpl> compositor_weakptr_;
+};
+
+CompositorImpl::ReadbackRefImpl::ReadbackRefImpl(
+    base::WeakPtr<CompositorImpl> weakptr)
+    : compositor_weakptr_(weakptr) {}
+
+CompositorImpl::ReadbackRefImpl::~ReadbackRefImpl() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (compositor_weakptr_)
+    compositor_weakptr_->DecrementPendingReadbacks();
+}
+
 // static
 Compositor* Compositor::Create(CompositorClient* client,
                                gfx::NativeWindow root_window) {
@@ -314,11 +340,6 @@ void CompositorImpl::SetRootWindow(gfx::NativeWindow root_window) {
     root_window_->SetForce60HzRefreshRate();
   root_window_->SetLayer(root_layer ? root_layer : cc::Layer::Create());
   root_window_->GetLayer()->SetBounds(size_);
-  if (!readback_layer_tree_) {
-    readback_layer_tree_ = cc::Layer::Create();
-    readback_layer_tree_->SetHideLayerAndSubtree(true);
-  }
-  root_window->GetLayer()->AddChild(readback_layer_tree_);
   root_window->AttachCompositor(this);
   if (!host_) {
     CreateLayerTreeHost();
@@ -457,7 +478,7 @@ void CompositorImpl::TearDownDisplayAndUnregisterRootFrameSink() {
   // Make a best effort to try to complete pending readbacks.
   // TODO(crbug.com/637035): Consider doing this in a better way,
   // ideally with the guarantee of readbacks completing.
-  if (display_private_ && HavePendingReadbacks()) {
+  if (display_private_ && pending_readbacks_) {
     // Note that while this is not a Sync IPC, the call to
     // InvalidateFrameSinkId below will end up triggering a sync call to
     // FrameSinkManager::DestroyCompositorFrameSink, as this is the root
@@ -466,7 +487,6 @@ void CompositorImpl::TearDownDisplayAndUnregisterRootFrameSink() {
     // execution of this call.
     display_private_->ForceImmediateDrawAndSwapIfPossible();
   }
-
   GetHostFrameSinkManager()->InvalidateFrameSinkId(frame_sink_id_);
   display_private_.reset();
 }
@@ -681,8 +701,10 @@ CompositorImpl::GetBeginMainFrameMetrics() {
   return nullptr;
 }
 
-void CompositorImpl::AttachLayerForReadback(scoped_refptr<cc::Layer> layer) {
-  readback_layer_tree_->AddChild(layer);
+std::unique_ptr<ui::WindowAndroidCompositor::ReadbackRef>
+CompositorImpl::TakeReadbackRef() {
+  ++pending_readbacks_;
+  return std::make_unique<ReadbackRefImpl>(weak_factory_.GetWeakPtr());
 }
 
 void CompositorImpl::RequestCopyOfOutputOnRootLayer(
@@ -748,10 +770,6 @@ void CompositorImpl::OnDisplayMetricsChanged(const display::Display& display,
   }
 }
 
-bool CompositorImpl::HavePendingReadbacks() {
-  return !readback_layer_tree_->children().empty();
-}
-
 bool CompositorImpl::IsDrawingFirstVisibleFrame() const {
   return !has_submitted_frame_since_became_visible_;
 }
@@ -896,4 +914,9 @@ void CompositorImpl::RequestPresentationTimeForNextFrame(
   host_->RequestPresentationTimeForNextFrame(std::move(callback));
 }
 
+void CompositorImpl::DecrementPendingReadbacks() {
+  DCHECK_GT(pending_readbacks_, 0u);
+  --pending_readbacks_;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android.h b/chromium/content/browser/renderer_host/compositor_impl_android.h
index c9d7b2a242f..ed52cd263a6 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android.h
+++ b/chromium/content/browser/renderer_host/compositor_impl_android.h
@@ -89,6 +89,7 @@ class CONTENT_EXPORT CompositorImpl
  private:
   class AndroidHostDisplayClient;
   class ScopedCachedBackBuffer;
+  class ReadbackRefImpl;
 
   // Compositor implementation.
   void SetRootWindow(gfx::NativeWindow root_window) override;
@@ -143,13 +144,15 @@ class CONTENT_EXPORT CompositorImpl
       cc::ActiveFrameSequenceTrackers trackers) override {}
   std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
       override;
+  void NotifyThroughputTrackerResults(
+      cc::CustomTrackerResults results) override {}
 
   // LayerTreeHostSingleThreadClient implementation.
   void DidSubmitCompositorFrame() override;
   void DidLoseLayerTreeFrameSink() override;
 
   // WindowAndroidCompositor implementation.
-  void AttachLayerForReadback(scoped_refptr<cc::Layer> layer) override;
+  std::unique_ptr<ReadbackRef> TakeReadbackRef() override;
   void RequestCopyOfOutputOnRootLayer(
       std::unique_ptr<viz::CopyOutputRequest> request) override;
   void SetNeedsAnimate() override;
@@ -182,8 +185,6 @@ class CONTENT_EXPORT CompositorImpl
       scoped_refptr<viz::ContextProvider> context_provider);
   void DidSwapBuffers(const gfx::Size& swap_size);
 
-  bool HavePendingReadbacks();
-
   void DetachRootWindow();
 
   // Helper functions to perform delayed cleanup after the compositor is no
@@ -211,15 +212,14 @@ class CONTENT_EXPORT CompositorImpl
   void InitializeVizLayerTreeFrameSink(
       scoped_refptr<viz::ContextProviderCommandBuffer> context_provider);
 
+  void DecrementPendingReadbacks();
+
   viz::FrameSinkId frame_sink_id_;
 
   // root_layer_ is the persistent internal root layer, while subroot_layer_
   // is the one attached by the compositor client.
   scoped_refptr<cc::Layer> subroot_layer_;
 
-  // Subtree for hidden layers with CopyOutputRequests on them.
-  scoped_refptr<cc::Layer> readback_layer_tree_;
-
   // Destruction order matters here:
   std::unique_ptr<cc::AnimationHost> animation_host_;
   std::unique_ptr<cc::LayerTreeHost> host_;
@@ -270,6 +270,8 @@ class CONTENT_EXPORT CompositorImpl
 
   base::TimeTicks latest_frame_time_;
 
+  uint32_t pending_readbacks_ = 0u;
+
   base::WeakPtrFactory<CompositorImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(CompositorImpl);
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android_browsertest.cc b/chromium/content/browser/renderer_host/compositor_impl_android_browsertest.cc
index 0ba47420cf6..64af76916cc 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android_browsertest.cc
+++ b/chromium/content/browser/renderer_host/compositor_impl_android_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/gpu_stream_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/cursor_manager_unittest.cc b/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
index 527915db162..95437f6a71b 100644
--- a/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
+++ b/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
@@ -5,21 +5,16 @@
 #include "content/browser/renderer_host/cursor_manager.h"
 
 #include "build/build_config.h"
-#include "content/browser/renderer_host/frame_token_message_queue.h"
-#include "content/browser/renderer_host/render_widget_host_delegate.h"
+#include "content/browser/renderer_host/mock_render_widget_host.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
-#include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/mock_render_widget_host_delegate.h"
-#include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 
 // CursorManager is only instantiated on Aura and Mac.
 #if defined(USE_AURA) || defined(OS_MACOSX)
@@ -49,39 +44,6 @@ class MockRenderWidgetHostViewForCursors : public TestRenderWidgetHostView {
   std::unique_ptr<CursorManager> cursor_manager_;
 };
 
-class MockRenderWidgetHost : public RenderWidgetHostImpl {
- public:
-  static MockRenderWidgetHost* Create(RenderWidgetHostDelegate* delegate,
-                                      RenderProcessHost* process,
-                                      int32_t routing_id) {
-    mojo::PendingRemote<mojom::Widget> widget;
-    std::unique_ptr<MockWidgetImpl> widget_impl =
-        std::make_unique<MockWidgetImpl>(
-            widget.InitWithNewPipeAndPassReceiver());
-
-    return new MockRenderWidgetHost(delegate, process, routing_id,
-                                    std::move(widget_impl), std::move(widget));
-  }
-
- private:
-  MockRenderWidgetHost(RenderWidgetHostDelegate* delegate,
-                       RenderProcessHost* process,
-                       int routing_id,
-                       std::unique_ptr<MockWidgetImpl> widget_impl,
-                       mojo::PendingRemote<mojom::Widget> widget)
-      : RenderWidgetHostImpl(delegate,
-                             process,
-                             routing_id,
-                             std::move(widget),
-                             /*hidden=*/false,
-                             std::make_unique<FrameTokenMessageQueue>()),
-        widget_impl_(std::move(widget_impl)) {}
-
-  std::unique_ptr<MockWidgetImpl> widget_impl_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockRenderWidgetHost);
-};
-
 class CursorManagerTest : public testing::Test {
  public:
   CursorManagerTest() {}
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc
index 60e3c2b19b2..3aba42f8bfc 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc
+++ b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc
@@ -3,6 +3,8 @@
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/direct_manipulation_test_helper_win.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 
 namespace content {
 MockDirectManipulationContent::MockDirectManipulationContent() {}
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc b/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
index 3fe6cc153f7..f622ba89689 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
+++ b/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/renderer_host/legacy_render_widget_host_win.h"
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -321,11 +322,12 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultPinchZoom) {
   // ACK result itself isn't relevant in this test.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
       web_contents->GetRenderViewHost()->GetWidget(),
-      blink::WebInputEvent::kGesturePinchUpdate);
+      blink::WebInputEvent::Type::kGesturePinchUpdate);
 
   // First, test a standard zoom.
   UpdateContents(kInitialZoom, 0, 0);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(kInitialZoom, EvalJs(web_contents, "window.visualViewport.scale"));
@@ -342,7 +344,8 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultPinchZoom) {
 
   // Arbitrary zoom amount chosen here to make the test fail if it does zoom.
   UpdateContents(3.5, 0, 0);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(kInitialZoom, EvalJs(web_contents, "window.visualViewport.scale"));
@@ -358,7 +361,8 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultPinchZoom) {
   const float kEndZoom = 0.5;
 
   UpdateContents(kEndZoom, 0, 0);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(static_cast<int>(kInitialZoom * kEndZoom),
@@ -402,11 +406,12 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultScroll) {
   // ACK result itself isn't relevant in this test.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
       web_contents->GetRenderViewHost()->GetWidget(),
-      blink::WebInputEvent::kMouseWheel);
+      blink::WebInputEvent::Type::kMouseWheel);
 
   // First, test scrolling vertically
   UpdateContents(1, 0, -kInitialScrollDistance);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(0, EvalJs(web_contents, "document.documentElement.scrollLeft"));
@@ -436,7 +441,8 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultScroll) {
   // Updating with arbitrarily chosen numbers that should make it obvious where
   // values are coming from when this test fails.
   UpdateContents(1, 354, 291);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(kInitialScrollDistance,
@@ -457,7 +463,8 @@ IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest, PreventDefaultScroll) {
   const int kScrollXDistance = 120;
   const int kScrollYDistance = 150;
   UpdateContents(1, kScrollXDistance, kScrollYDistance);
-  EXPECT_TRUE(input_msg_watcher->WaitForAck());
+  input_msg_watcher->WaitForAck();
+  EXPECT_TRUE(input_msg_watcher->HasReceivedAck());
   RunUntilInputProcessed(rwhi);
 
   EXPECT_EQ(kInitialScrollDistance - kScrollXDistance,
diff --git a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
index 6ef200bb33e..9d4a00a80fa 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
@@ -20,6 +20,7 @@
 #include "base/no_destructor.h"
 #include "base/path_service.h"
 #include "base/stl_util.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
 #include "base/task/task_traits.h"
@@ -27,6 +28,7 @@
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/trace_event/trace_event.h"
+#include "base/version.h"
 #include "base/win/registry.h"
 #include "content/browser/renderer_host/dwrite_font_file_util_win.h"
 #include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
@@ -216,9 +218,14 @@ std::string DWriteFontLookupTableBuilder::ComputePersistenceHash() {
     to_hash.append(base::WideToUTF8(it.Value()));
   }
 
-  DCHECK(GetContentClient());
-  to_hash.append(
-      GetContentClient()->browser()->GetUserAgentMetadata().major_version);
+  // Recreating version_info::GetMajorVersion as it is not linkable here.
+  base::Version full_version = base::Version(
+      GetContentClient()->browser()->GetUserAgentMetadata().full_version);
+
+  // Version can be an empty string on trybots.
+  if (full_version.IsValid()) {
+    to_hash.append(base::NumberToString(full_version.components()[0]));
+  }
 
   uint32_t fonts_changed_hash = base::PersistentHash(to_hash);
   return std::to_string(fonts_changed_hash);
diff --git a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
index ad9c93b5c01..7f1710bf720 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
@@ -14,9 +14,9 @@
 #include <utility>
 
 #include "base/callback_helpers.h"
+#include "base/check_op.h"
 #include "base/feature_list.h"
 #include "base/i18n/case_conversion.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
@@ -393,12 +393,10 @@ void DWriteFontProxyImpl::MapCharacters(
 void DWriteFontProxyImpl::GetUniqueNameLookupTableIfAvailable(
     GetUniqueNameLookupTableIfAvailableCallback callback) {
   DCHECK(base::FeatureList::IsEnabled(features::kFontSrcLocalMatching));
-  base::ReadOnlySharedMemoryRegion invalid_region;
-  callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
-      std::move(callback), false, std::move(invalid_region));
-
+  /* Table is not synchronously available, return immediately. */
   if (!DWriteFontLookupTableBuilder::GetInstance()
            ->FontUniqueNameTableReady()) {
+    std::move(callback).Run(false, base::ReadOnlySharedMemoryRegion());
     return;
   }
 
@@ -497,9 +495,6 @@ void DWriteFontProxyImpl::GetUniqueFontLookupMode(
 void DWriteFontProxyImpl::GetUniqueNameLookupTable(
     GetUniqueNameLookupTableCallback callback) {
   DCHECK(base::FeatureList::IsEnabled(features::kFontSrcLocalMatching));
-  callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
-      std::move(callback), base::ReadOnlySharedMemoryRegion());
-
   DWriteFontLookupTableBuilder::GetInstance()->QueueShareMemoryRegionWhenReady(
       base::SequencedTaskRunnerHandle::Get(), std::move(callback));
 }
diff --git a/chromium/content/browser/renderer_host/frame_connector_delegate.cc b/chromium/content/browser/renderer_host/frame_connector_delegate.cc
index d86f6c5778c..ab73d3d5824 100644
--- a/chromium/content/browser/renderer_host/frame_connector_delegate.cc
+++ b/chromium/content/browser/renderer_host/frame_connector_delegate.cc
@@ -8,6 +8,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/common/content_switches_internal.h"
 #include "content/common/frame_visual_properties.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/renderer_host/frame_connector_delegate.h b/chromium/content/browser/renderer_host/frame_connector_delegate.h
index 42e4f7f2f5e..4dacdbbc736 100644
--- a/chromium/content/browser/renderer_host/frame_connector_delegate.h
+++ b/chromium/content/browser/renderer_host/frame_connector_delegate.h
@@ -13,14 +13,14 @@
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
 #include "content/common/input/input_handler.mojom.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/common/screen_info.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "ui/gfx/geometry/rect.h"
 
 namespace blink {
 class WebGestureEvent;
-struct WebIntrinsicSizingInfo;
 }
 
 namespace cc {
@@ -76,7 +76,7 @@ class CONTENT_EXPORT FrameConnectorDelegate {
   // Sends the given intrinsic sizing information from a sub-frame to
   // its corresponding remote frame in the parent frame's renderer.
   virtual void SendIntrinsicSizingInfoToParent(
-      const blink::WebIntrinsicSizingInfo&) {}
+      blink::mojom::IntrinsicSizingInfoPtr) {}
 
   // Sends new resize parameters to the sub-frame's renderer.
   void SynchronizeVisualProperties(
@@ -134,7 +134,7 @@ class CONTENT_EXPORT FrameConnectorDelegate {
   // for processing.
   virtual void ForwardAckedTouchpadZoomEvent(
       const blink::WebGestureEvent& event,
-      InputEventAckState ack_result) {}
+      blink::mojom::InputEventResultState ack_result) {}
 
   // A gesture scroll sequence that is not consumed by a child must be bubbled
   // to ancestors who may consume it.
@@ -231,8 +231,9 @@ class CONTENT_EXPORT FrameConnectorDelegate {
 
   bool has_size() const { return has_size_; }
 
-  virtual void DidAckGestureEvent(const blink::WebGestureEvent& event,
-                                  InputEventAckState ack_result) {}
+  virtual void DidAckGestureEvent(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) {}
 
  protected:
   explicit FrameConnectorDelegate(bool use_zoom_for_device_scale_factor);
diff --git a/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.cc b/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.cc
index be8708d4151..3bbf671e699 100644
--- a/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.cc
+++ b/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.cc
@@ -34,10 +34,10 @@ HitTestDebugKeyEventObserver::~HitTestDebugKeyEventObserver() {
 }
 
 void HitTestDebugKeyEventObserver::OnInputEventAck(
-    InputEventAckSource source,
-    InputEventAckState state,
+    blink::mojom::InputEventResultSource source,
+    blink::mojom::InputEventResultState state,
     const blink::WebInputEvent& event) {
-  if (INPUT_EVENT_ACK_STATE_CONSUMED == state ||
+  if (blink::mojom::InputEventResultState::kConsumed == state ||
       (event.GetType() != Type::kRawKeyDown &&
        event.GetType() != Type::kKeyDown)) {
     return;
diff --git a/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.h b/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.h
index 90e20efba0d..f259a03d379 100644
--- a/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.h
+++ b/chromium/content/browser/renderer_host/hit_test_debug_key_event_observer.h
@@ -26,8 +26,8 @@ class HitTestDebugKeyEventObserver
   ~HitTestDebugKeyEventObserver() override;
 
   // RenderWidgetHost::InputEventObserver:
-  void OnInputEventAck(InputEventAckSource source,
-                       InputEventAckState state,
+  void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                       blink::mojom::InputEventResultState state,
                        const blink::WebInputEvent&) override;
 
  private:
diff --git a/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc b/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
index f7171142ec3..9bc610581d5 100644
--- a/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
@@ -7,6 +7,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/widget_messages.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -50,8 +51,8 @@ class GestureScrollEventWatcher : public RenderWidgetHost::InputEventObserver {
       rwh_->RemoveInputEventObserver(this);
   }
 
-  void OnInputEventAck(InputEventAckSource,
-                       InputEventAckState,
+  void OnInputEventAck(blink::mojom::InputEventResultSource,
+                       blink::mojom::InputEventResultState,
                        const blink::WebInputEvent& event) override {
     if (event.GetType() != event_type_)
       return;
@@ -135,7 +136,7 @@ class AutoscrollBrowserTest : public ContentBrowserTest {
 
     // Simulate and send middle click mouse down.
     blink::WebMouseEvent down_event = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseDown, x, y, modifiers);
+        blink::WebInputEvent::Type::kMouseDown, x, y, modifiers);
     down_event.button = blink::WebMouseEvent::Button::kMiddle;
     down_event.SetTimeStamp(ui::EventTimeForNow());
     down_event.SetPositionInScreen(x, y);
@@ -143,7 +144,7 @@ class AutoscrollBrowserTest : public ContentBrowserTest {
 
     // Simulate and send middle click mouse up.
     blink::WebMouseEvent up_event = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseUp, x, y, modifiers);
+        blink::WebInputEvent::Type::kMouseUp, x, y, modifiers);
     up_event.button = blink::WebMouseEvent::Button::kMiddle;
     up_event.SetTimeStamp(ui::EventTimeForNow());
     up_event.SetPositionInScreen(x, y);
@@ -177,14 +178,14 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest, AutoscrollFling) {
 
   // Start autoscroll with middle click.
   auto scroll_begin_watcher = std::make_unique<GestureScrollEventWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollBegin);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollBegin);
   SimulateMiddleClick(10, 10, blink::WebInputEvent::kNoModifiers);
 
   // The page should start scrolling with mouse move.
   RenderFrameSubmissionObserver observer(
       GetWidgetHost()->render_frame_metadata_provider());
   blink::WebMouseEvent move_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 50, 50,
+      blink::WebInputEvent::Type::kMouseMove, 50, 50,
       blink::WebInputEvent::kNoModifiers);
   move_event.SetTimeStamp(ui::EventTimeForNow());
   move_event.SetPositionInScreen(50, 50);
@@ -200,12 +201,12 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest, AutoscrollFlingGSBDeltaHints) {
 
   // Start autoscroll with middle click.
   auto scroll_begin_watcher = std::make_unique<GestureScrollEventWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollBegin);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollBegin);
   SimulateMiddleClick(10, 10, blink::WebInputEvent::kNoModifiers);
 
   // A GSB will be sent on first mouse move.
   blink::WebMouseEvent move_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 50, 50,
+      blink::WebInputEvent::Type::kMouseMove, 50, 50,
       blink::WebInputEvent::kNoModifiers);
   move_event.SetTimeStamp(ui::EventTimeForNow());
   move_event.SetPositionInScreen(50, 50);
@@ -227,12 +228,12 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
 
   // Start autoscroll with middle click.
   auto scroll_update_watcher = std::make_unique<GestureScrollEventWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollUpdate);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollUpdate);
   SimulateMiddleClick(10, 10, blink::WebInputEvent::kNoModifiers);
 
   // Check that the generated GSU has non-zero position in widget.
   blink::WebMouseEvent move_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 50, 50,
+      blink::WebInputEvent::Type::kMouseMove, 50, 50,
       blink::WebInputEvent::kNoModifiers);
   move_event.SetTimeStamp(ui::EventTimeForNow());
   move_event.SetPositionInScreen(50, 50);
@@ -246,7 +247,7 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
   // End autoscroll and check that the GSE generated from autoscroll fling
   // cancelation has non-zero position in widget.
   auto scroll_end_watcher = std::make_unique<GestureScrollEventWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
   SimulateMiddleClick(50, 50, blink::WebInputEvent::kNoModifiers);
   scroll_end_watcher->Wait();
   const blink::WebGestureEvent* acked_scroll_end =
@@ -312,20 +313,20 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
 
   // Start autoscroll with middle click.
   auto scroll_begin_watcher = std::make_unique<GestureScrollEventWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollBegin);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollBegin);
   SimulateMiddleClick(100, 100, blink::WebInputEvent::kNoModifiers);
 
   // Move the mouse up, no scrolling happens since the page is at its extent.
   auto scroll_update_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollUpdate);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollUpdate);
   blink::WebMouseEvent move_up = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 20, 20,
+      blink::WebInputEvent::Type::kMouseMove, 20, 20,
       blink::WebInputEvent::kNoModifiers);
   move_up.SetTimeStamp(ui::EventTimeForNow());
   move_up.SetPositionInScreen(20, 20);
   GetWidgetHost()->ForwardMouseEvent(move_up);
   scroll_begin_watcher->Wait();
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
             scroll_update_watcher->WaitForAck());
 
   // Wait for 10 commits before changing the scroll direction.
@@ -336,7 +337,7 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
   RenderFrameSubmissionObserver observer(
       GetWidgetHost()->render_frame_metadata_provider());
   blink::WebMouseEvent move_down = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 180, 180,
+      blink::WebInputEvent::Type::kMouseMove, 180, 180,
       blink::WebInputEvent::kNoModifiers);
   move_down.SetTimeStamp(ui::EventTimeForNow());
   move_down.SetPositionInScreen(180, 180);
diff --git a/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc b/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
index 8d395a07ee9..eac152694d3 100644
--- a/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/common/input/synthetic_smooth_scroll_gesture_params.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -66,7 +67,7 @@ class CompositedScrollingBrowserTest : public ContentBrowserTest {
   CompositedScrollingBrowserTest() {
     // Disable scroll resampling because this is checking scroll distance.
     scoped_feature_list_.InitAndDisableFeature(
-        features::kResamplingScrollEvents);
+        blink::features::kResamplingScrollEvents);
   }
 
   ~CompositedScrollingBrowserTest() override = default;
diff --git a/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc b/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
index 265adf13b10..0300adb8e03 100644
--- a/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -160,7 +161,7 @@ class CompositorEventAckBrowserTest : public ContentBrowserTest {
     RenderFrameSubmissionObserver observer(
         GetWidgetHost()->render_frame_metadata_provider());
     auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-        GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+        GetWidgetHost(), blink::WebInputEvent::Type::kMouseWheel);
 
     // This event never completes its processing. As kCompositorEventAckDataURL
     // will block the renderer's main thread once it is received.
@@ -172,7 +173,7 @@ class CompositorEventAckBrowserTest : public ContentBrowserTest {
 
     // The compositor should send the event ack, and not be blocked by the event
     // above. The event watcher runs until we get the InputMsgAck callback
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
+    EXPECT_EQ(blink::mojom::InputEventResultState::kSetNonBlocking,
               input_msg_watcher->WaitForAck());
 
     // Expect that the compositor scrolled at least one pixel while the
@@ -263,7 +264,7 @@ IN_PROC_BROWSER_TEST_F(CompositorEventAckBrowserTest,
 
   // Send GSB to start scrolling sequence.
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   gesture_scroll_begin.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
   gesture_scroll_begin.data.scroll_begin.delta_hint_units =
@@ -275,7 +276,7 @@ IN_PROC_BROWSER_TEST_F(CompositorEventAckBrowserTest,
   //  Send a GFS and wait for the page to scroll making sure that fling progress
   //  has started.
   blink::WebGestureEvent gesture_fling_start(
-      blink::WebGestureEvent::kGestureFlingStart,
+      blink::WebGestureEvent::Type::kGestureFlingStart,
       blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   gesture_fling_start.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
   gesture_fling_start.data.fling_start.velocity_x = 0.f;
@@ -302,8 +303,8 @@ IN_PROC_BROWSER_TEST_F(CompositorEventAckBrowserTest,
   // uncancelable since there is an on-going fling with touchscreen source. The
   // test will timeout if the touch start event is cancelable since there is a
   // busy loop in the blocking touch start event listener.
-  InputEventAckWaiter touch_start_ack_observer(GetWidgetHost(),
-                                               WebInputEvent::kTouchStart);
+  InputEventAckWaiter touch_start_ack_observer(
+      GetWidgetHost(), WebInputEvent::Type::kTouchStart);
   touch_event.PressPoint(50, 50);
   touch_event.SetTimeStamp(ui::EventTimeForNow());
   input_event_router->RouteTouchEvent(root_view, &touch_event,
diff --git a/chromium/content/browser/renderer_host/input/event_latency_aura_browsertest.cc b/chromium/content/browser/renderer_host/input/event_latency_aura_browsertest.cc
index f0fecd8a16f..3a86f59f27b 100644
--- a/chromium/content/browser/renderer_host/input/event_latency_aura_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/event_latency_aura_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/test/metrics/histogram_tester.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/public/browser/render_view_host.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/hit_test_region_observer.h"
@@ -54,6 +55,8 @@ class EventLatencyBrowserTest : public ContentBrowserTest {
 
   void FocusButton() const { ASSERT_TRUE(ExecJs(shell(), "focusButton()")); }
 
+  void FocusInput() const { ASSERT_TRUE(ExecJs(shell(), "focusInput()")); }
+
   void StartAnimations() const {
     ASSERT_TRUE(ExecJs(shell(), "startAnimations()"));
   }
@@ -74,8 +77,8 @@ IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButton) {
                                          ->GetRootWindow());
 
   // Press and release the space key. Since the button on the test page is
-  // focused, this should change the visuals of the button and generate a
-  // compositor frame with appropriate event latency metrics.
+  // focused, this should change the visuals of the button and generate
+  // compositor frames with appropriate event latency metrics.
   generator.PressKey(ui::VKEY_SPACE, 0);
   generator.ReleaseKey(ui::VKEY_SPACE, 0);
   RunUntilInputProcessed(GetWidgetHost());
@@ -83,6 +86,98 @@ IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButton) {
   FetchHistogramsFromChildProcesses();
 
   base::HistogramTester::CountsMap expected_counts = {
+      {"EventLatency.KeyPressed.BrowserToRendererCompositor", 1},
+      {"EventLatency.KeyPressed.BeginImplFrameToSendBeginMainFrame", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.HandleInputEvents",
+       1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Animate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.StyleUpdate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.LayoutUpdate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Prepaint", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Composite", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Paint", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "ScrollingCoordinator",
+       1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.CompositeCommit", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.UpdateLayers", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "BeginMainSentToStarted",
+       1},
+      {"EventLatency.KeyPressed.Commit", 1},
+      {"EventLatency.KeyPressed.EndCommitToActivation", 1},
+      {"EventLatency.KeyPressed.Activation", 1},
+      {"EventLatency.KeyPressed.EndActivateToSubmitCompositorFrame", 1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SubmitToReceiveCompositorFrame",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "ReceivedCompositorFrameToStartDraw",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "StartDrawToSwapStart",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame.SwapStartToSwapEnd",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SwapEndToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyPressed.TotalLatency", 1},
+      {"EventLatency.KeyReleased.BrowserToRendererCompositor", 1},
+      {"EventLatency.KeyReleased.BeginImplFrameToSendBeginMainFrame", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.HandleInputEvents",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Animate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.StyleUpdate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.LayoutUpdate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Prepaint", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Composite", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Paint", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit."
+       "ScrollingCoordinator",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.CompositeCommit",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.UpdateLayers", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit."
+       "BeginMainSentToStarted",
+       1},
+      {"EventLatency.KeyReleased.Commit", 1},
+      {"EventLatency.KeyReleased.EndCommitToActivation", 1},
+      {"EventLatency.KeyReleased.Activation", 1},
+      {"EventLatency.KeyReleased.EndActivateToSubmitCompositorFrame", 1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SubmitToReceiveCompositorFrame",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "ReceivedCompositorFrameToStartDraw",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "StartDrawToSwapStart",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame.SwapStartToSwapEnd",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SwapEndToPresentationCompositorFrame",
+       1},
       {"EventLatency.KeyReleased.TotalLatency", 1},
   };
   EXPECT_THAT(histogram_tester.GetTotalCountsForPrefix("EventLatency."),
@@ -91,7 +186,9 @@ IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButton) {
 
 // Tests that if a key-press on a page with an animation causes a visual update,
 // appropriate event latency metrics are reported.
-IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButtonWithAnimation) {
+// TODO(https://crbug.com/1076186): Test is flaky.
+IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest,
+                       DISABLED_KeyPressOnButtonWithAnimation) {
   base::HistogramTester histogram_tester;
 
   ASSERT_NO_FATAL_FAILURE(LoadTestPage());
@@ -105,8 +202,8 @@ IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButtonWithAnimation) {
                                          ->GetRootWindow());
 
   // Press and release the space key. Since the button on the test page is
-  // focused, this should change the visuals of the button and generate a
-  // compositor frame with appropriate event latency metrics.
+  // focused, this should change the visuals of the button and generate
+  // compositor frames with appropriate event latency metrics.
   generator.PressKey(ui::VKEY_SPACE, 0);
   generator.ReleaseKey(ui::VKEY_SPACE, 0);
   RunUntilInputProcessed(GetWidgetHost());
@@ -114,10 +211,184 @@ IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest, KeyPressOnButtonWithAnimation) {
   FetchHistogramsFromChildProcesses();
 
   base::HistogramTester::CountsMap expected_counts = {
+      {"EventLatency.KeyPressed.BrowserToRendererCompositor", 1},
+      {"EventLatency.KeyPressed.BeginImplFrameToSendBeginMainFrame", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.HandleInputEvents",
+       1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Animate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.StyleUpdate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.LayoutUpdate", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Prepaint", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Composite", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Paint", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "ScrollingCoordinator",
+       1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.CompositeCommit", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.UpdateLayers", 1},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "BeginMainSentToStarted",
+       1},
+      {"EventLatency.KeyPressed.Commit", 1},
+      {"EventLatency.KeyPressed.EndCommitToActivation", 1},
+      {"EventLatency.KeyPressed.Activation", 1},
+      {"EventLatency.KeyPressed.EndActivateToSubmitCompositorFrame", 1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyPressed.TotalLatency", 1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SubmitToReceiveCompositorFrame",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "ReceivedCompositorFrameToStartDraw",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "StartDrawToSwapStart",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame.SwapStartToSwapEnd",
+       1},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SwapEndToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyReleased.BrowserToRendererCompositor", 1},
+      {"EventLatency.KeyReleased.BeginImplFrameToSendBeginMainFrame", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.HandleInputEvents",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Animate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.StyleUpdate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.LayoutUpdate", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Prepaint", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Composite", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.Paint", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit."
+       "ScrollingCoordinator",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.CompositeCommit",
+       1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit.UpdateLayers", 1},
+      {"EventLatency.KeyReleased.SendBeginMainFrameToCommit."
+       "BeginMainSentToStarted",
+       1},
+      {"EventLatency.KeyReleased.Commit", 1},
+      {"EventLatency.KeyReleased.EndCommitToActivation", 1},
+      {"EventLatency.KeyReleased.Activation", 1},
+      {"EventLatency.KeyReleased.EndActivateToSubmitCompositorFrame", 1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SubmitToReceiveCompositorFrame",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "ReceivedCompositorFrameToStartDraw",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "StartDrawToSwapStart",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame.SwapStartToSwapEnd",
+       1},
+      {"EventLatency.KeyReleased."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SwapEndToPresentationCompositorFrame",
+       1},
       {"EventLatency.KeyReleased.TotalLatency", 1},
   };
   EXPECT_THAT(histogram_tester.GetTotalCountsForPrefix("EventLatency."),
               testing::ContainerEq(expected_counts));
 }
 
+// Tests that entering a character in a textbox leads to appropriate event
+// latency metrics being reported even though the page has an animation running.
+//
+// Disabled due to flakiness on several platforms. See crbug.com/1072340
+IN_PROC_BROWSER_TEST_F(EventLatencyBrowserTest,
+                       DISABLED_KeyPressInInputWithAnimation) {
+  base::HistogramTester histogram_tester;
+
+  ASSERT_NO_FATAL_FAILURE(LoadTestPage());
+  StartAnimations();
+  FocusInput();
+
+  ui::test::EventGenerator generator(shell()
+                                         ->web_contents()
+                                         ->GetRenderWidgetHostView()
+                                         ->GetNativeView()
+                                         ->GetRootWindow());
+
+  // Enter a character into the focused textbox. This should generate compositor
+  // frames with appropriate event latency metrics.
+  generator.PressKey(ui::VKEY_A, 0);
+  generator.ReleaseKey(ui::VKEY_A, 0);
+  RunUntilInputProcessed(GetWidgetHost());
+
+  FetchHistogramsFromChildProcesses();
+
+  // TODO(crbug/1071645): Since this is this first key-press after the textbox
+  // is focused, there would be two reports, one for the RawKeyDown that causes
+  // some style changes (due to :focus-visible behavior) and one for the Char
+  // that inserts the actual character. These should be reported separately.
+  base::HistogramTester::CountsMap expected_counts = {
+      {"EventLatency.KeyPressed.BrowserToRendererCompositor", 2},
+      {"EventLatency.KeyPressed.BeginImplFrameToSendBeginMainFrame", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.HandleInputEvents",
+       2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Animate", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.StyleUpdate", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.LayoutUpdate", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Prepaint", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Composite", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.Paint", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "ScrollingCoordinator",
+       2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.CompositeCommit", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit.UpdateLayers", 2},
+      {"EventLatency.KeyPressed.SendBeginMainFrameToCommit."
+       "BeginMainSentToStarted",
+       2},
+      {"EventLatency.KeyPressed.Commit", 2},
+      {"EventLatency.KeyPressed.EndCommitToActivation", 2},
+      {"EventLatency.KeyPressed.Activation", 2},
+      {"EventLatency.KeyPressed.EndActivateToSubmitCompositorFrame", 2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame",
+       2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SubmitToReceiveCompositorFrame",
+       2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "ReceivedCompositorFrameToStartDraw",
+       2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "StartDrawToSwapStart",
+       2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame.SwapStartToSwapEnd",
+       2},
+      {"EventLatency.KeyPressed."
+       "SubmitCompositorFrameToPresentationCompositorFrame."
+       "SwapEndToPresentationCompositorFrame",
+       2},
+      {"EventLatency.KeyPressed.TotalLatency", 2},
+  };
+  EXPECT_THAT(histogram_tester.GetTotalCountsForPrefix("EventLatency."),
+              testing::ContainerEq(expected_counts));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/fling_browsertest.cc b/chromium/content/browser/renderer_host/input/fling_browsertest.cc
index 9eb0712498f..ba9bbc9b4d5 100644
--- a/chromium/content/browser/renderer_host/input/fling_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/fling_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -144,12 +145,12 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
         parent_render_widget_host
             ? std::make_unique<InputMsgWatcher>(
                   parent_render_widget_host,
-                  blink::WebInputEvent::kGestureScrollBegin)
+                  blink::WebInputEvent::Type::kGestureScrollBegin)
             : std::make_unique<InputMsgWatcher>(
                   render_widget_host,
-                  blink::WebInputEvent::kGestureScrollBegin);
+                  blink::WebInputEvent::Type::kGestureScrollBegin);
     blink::WebGestureEvent gesture_scroll_begin(
-        blink::WebGestureEvent::kGestureScrollBegin,
+        blink::WebGestureEvent::Type::kGestureScrollBegin,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_scroll_begin.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
     gesture_scroll_begin.data.scroll_begin.delta_hint_units =
@@ -172,7 +173,7 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
 
     //  Send a GFS.
     blink::WebGestureEvent gesture_fling_start(
-        blink::WebGestureEvent::kGestureFlingStart,
+        blink::WebGestureEvent::Type::kGestureFlingStart,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_fling_start.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
     gesture_fling_start.data.fling_start.velocity_x = fling_velocity.x();
@@ -193,10 +194,10 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
         parent_render_widget_host
             ? std::make_unique<InputMsgWatcher>(
                   parent_render_widget_host,
-                  blink::WebInputEvent::kGestureScrollBegin)
+                  blink::WebInputEvent::Type::kGestureScrollBegin)
             : std::make_unique<InputMsgWatcher>(
                   render_widget_host,
-                  blink::WebInputEvent::kGestureScrollBegin);
+                  blink::WebInputEvent::Type::kGestureScrollBegin);
     blink::WebMouseWheelEvent wheel_event =
         SyntheticWebMouseWheelEventBuilder::Build(
             10, 10, fling_velocity.x() / 1000, fling_velocity.y() / 1000, 0,
@@ -218,7 +219,7 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
 
     //  Send a GFS.
     blink::WebGestureEvent gesture_fling_start(
-        blink::WebGestureEvent::kGestureFlingStart,
+        blink::WebGestureEvent::Type::kGestureFlingStart,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_fling_start.SetSourceDevice(blink::WebGestureDevice::kTouchpad);
     gesture_fling_start.data.fling_start.velocity_x = fling_velocity.x();
@@ -311,7 +312,7 @@ IN_PROC_BROWSER_TEST_F(
   // Fling upward and wait for the generated GSE to arrive. Then check that the
   // RWHV has stopped the fling.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
   gfx::Vector2d fling_velocity(0, 2000);
   SimulateTouchscreenFling(
       GetWidgetHost(), nullptr /*parent_render_widget_host*/, fling_velocity);
@@ -326,7 +327,7 @@ IN_PROC_BROWSER_TEST_F(
   // Fling upward and wait for the generated GSE to arrive. Then check that the
   // RWHV has stopped the fling.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
   gfx::Vector2d fling_velocity(0, 2000);
   SimulateTouchpadFling(GetWidgetHost(), nullptr /*parent_render_widget_host*/,
                         fling_velocity);
@@ -430,9 +431,9 @@ IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest,
 
   // Send a GFC to the child and wait for the Generated GSE to get bubbled.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
   blink::WebGestureEvent gesture_fling_cancel(
-      blink::WebGestureEvent::kGestureFlingCancel,
+      blink::WebGestureEvent::Type::kGestureFlingCancel,
       blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   gesture_fling_cancel.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
 
@@ -470,7 +471,7 @@ IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest,
 
   // Fling and wait for the parent to scroll up.
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
   SyntheticSmoothScrollGestureParams params;
   params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
   const gfx::PointF location_in_widget(10, 10);
diff --git a/chromium/content/browser/renderer_host/input/fling_controller.cc b/chromium/content/browser/renderer_host/input/fling_controller.cc
index ff74cc77e53..7ee14043e65 100644
--- a/chromium/content/browser/renderer_host/input/fling_controller.cc
+++ b/chromium/content/browser/renderer_host/input/fling_controller.cc
@@ -61,7 +61,7 @@ FlingController::~FlingController() = default;
 bool FlingController::ObserveAndFilterForTapSuppression(
     const GestureEventWithLatencyInfo& gesture_event) {
   switch (gesture_event.event.GetType()) {
-    case WebInputEvent::kGestureFlingCancel:
+    case WebInputEvent::Type::kGestureFlingCancel:
       // The controllers' state is affected by the cancel event and assumes
       // it's actually stopping an ongoing fling.
       DCHECK(fling_curve_);
@@ -74,15 +74,15 @@ bool FlingController::ObserveAndFilterForTapSuppression(
         touchpad_tap_suppression_controller_.GestureFlingCancelStoppedFling();
       }
       return false;
-    case WebInputEvent::kGestureTapDown:
-    case WebInputEvent::kGestureShowPress:
-    case WebInputEvent::kGestureTapUnconfirmed:
-    case WebInputEvent::kGestureTapCancel:
-    case WebInputEvent::kGestureTap:
-    case WebInputEvent::kGestureDoubleTap:
-    case WebInputEvent::kGestureLongPress:
-    case WebInputEvent::kGestureLongTap:
-    case WebInputEvent::kGestureTwoFingerTap:
+    case WebInputEvent::Type::kGestureTapDown:
+    case WebInputEvent::Type::kGestureShowPress:
+    case WebInputEvent::Type::kGestureTapUnconfirmed:
+    case WebInputEvent::Type::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureLongPress:
+    case WebInputEvent::Type::kGestureLongTap:
+    case WebInputEvent::Type::kGestureTwoFingerTap:
       if (gesture_event.event.SourceDevice() ==
           blink::WebGestureDevice::kTouchscreen) {
         return touchscreen_tap_suppression_controller_.FilterTapEvent(
@@ -101,7 +101,8 @@ bool FlingController::ObserveAndMaybeConsumeGestureEvent(
   // whether there is an ongoing fling. These can affect state so if there's no
   // on-going fling we should just discard these without letting the rest of
   // the fling system see it.
-  if (gesture_event.event.GetType() == WebInputEvent::kGestureFlingCancel &&
+  if (gesture_event.event.GetType() ==
+          WebInputEvent::Type::kGestureFlingCancel &&
       !fling_curve_) {
     TRACE_EVENT_INSTANT0("input", "NoActiveFling", TRACE_EVENT_SCOPE_THREAD);
     return true;
@@ -112,13 +113,13 @@ bool FlingController::ObserveAndMaybeConsumeGestureEvent(
                          TRACE_EVENT_SCOPE_THREAD);
     return true;
   }
-
-  if (gesture_event.event.GetType() == WebInputEvent::kGestureScrollUpdate) {
+  if (gesture_event.event.GetType() ==
+      WebInputEvent::Type::kGestureScrollUpdate) {
     last_seen_scroll_update_ = gesture_event.event.TimeStamp();
   } else if (gesture_event.event.GetType() ==
-                 WebInputEvent::kGestureScrollEnd ||
+                 WebInputEvent::Type::kGestureScrollEnd ||
              gesture_event.event.GetType() ==
-                 WebInputEvent::kGestureScrollBegin) {
+                 WebInputEvent::Type::kGestureScrollBegin) {
     // TODO(bokan): We reset this on Begin as well as End since there appear to
     // be cases where we see an invalid event sequence:
     // https://crbug.com/928569.
@@ -131,14 +132,16 @@ bool FlingController::ObserveAndMaybeConsumeGestureEvent(
   // not sent to the renderer, the controller processes the fling and generates
   // fling progress events (wheel events for touchpad and GSU events for
   // touchscreen and autoscroll) which are handled normally.
-  if (gesture_event.event.GetType() == WebInputEvent::kGestureFlingStart) {
+  if (gesture_event.event.GetType() ==
+      WebInputEvent::Type::kGestureFlingStart) {
     ProcessGestureFlingStart(gesture_event);
     return true;
   }
 
   // If the GestureFlingStart event is processed by the fling_controller_, the
   // GestureFlingCancel event should be the same.
-  if (gesture_event.event.GetType() == WebInputEvent::kGestureFlingCancel) {
+  if (gesture_event.event.GetType() ==
+      WebInputEvent::Type::kGestureFlingCancel) {
     ProcessGestureFlingCancel(gesture_event);
     return true;
   }
@@ -261,7 +264,7 @@ void FlingController::GenerateAndSendWheelEvents(
     const gfx::Vector2dF& delta,
     blink::WebMouseWheelEvent::Phase phase) {
   MouseWheelEventWithLatencyInfo synthetic_wheel(
-      WebInputEvent::kMouseWheel, current_fling_parameters_.modifiers,
+      WebInputEvent::Type::kMouseWheel, current_fling_parameters_.modifiers,
       current_time, ui::LatencyInfo(ui::SourceEventType::WHEEL));
   synthetic_wheel.event.delta_units =
       ui::ScrollGranularity::kScrollByPrecisePixel;
@@ -273,7 +276,8 @@ void FlingController::GenerateAndSendWheelEvents(
   synthetic_wheel.event.SetPositionInScreen(
       current_fling_parameters_.global_point);
   // Send wheel events nonblocking.
-  synthetic_wheel.event.dispatch_type = WebInputEvent::kEventNonBlocking;
+  synthetic_wheel.event.dispatch_type =
+      WebInputEvent::DispatchType::kEventNonBlocking;
 
   event_sender_client_->SendGeneratedWheelEvent(synthetic_wheel);
 }
@@ -292,13 +296,13 @@ void FlingController::GenerateAndSendGestureScrollEvents(
       blink::WebPointerProperties::PointerType::kTouch;
   synthetic_gesture.event.SetSourceDevice(
       current_fling_parameters_.source_device);
-  if (type == WebInputEvent::kGestureScrollUpdate) {
+  if (type == WebInputEvent::Type::kGestureScrollUpdate) {
     synthetic_gesture.event.data.scroll_update.delta_x = delta.x();
     synthetic_gesture.event.data.scroll_update.delta_y = delta.y();
     synthetic_gesture.event.data.scroll_update.inertial_phase =
         WebGestureEvent::InertialPhaseState::kMomentum;
   } else {
-    DCHECK_EQ(WebInputEvent::kGestureScrollEnd, type);
+    DCHECK_EQ(WebInputEvent::Type::kGestureScrollEnd, type);
     synthetic_gesture.event.data.scroll_end.inertial_phase =
         WebGestureEvent::InertialPhaseState::kMomentum;
     synthetic_gesture.event.data.scroll_end.generated_by_fling_controller =
@@ -321,7 +325,7 @@ void FlingController::GenerateAndSendFlingProgressEvents(
     case blink::WebGestureDevice::kTouchscreen:
     case blink::WebGestureDevice::kSyntheticAutoscroll:
       GenerateAndSendGestureScrollEvents(
-          current_time, WebInputEvent::kGestureScrollUpdate, delta);
+          current_time, WebInputEvent::Type::kGestureScrollUpdate, delta);
       break;
     case blink::WebGestureDevice::kUninitialized:
     case blink::WebGestureDevice::kScrollbar:
@@ -341,8 +345,8 @@ void FlingController::GenerateAndSendFlingEndEvents(
       break;
     case blink::WebGestureDevice::kTouchscreen:
     case blink::WebGestureDevice::kSyntheticAutoscroll:
-      GenerateAndSendGestureScrollEvents(current_time,
-                                         WebInputEvent::kGestureScrollEnd);
+      GenerateAndSendGestureScrollEvents(
+          current_time, WebInputEvent::Type::kGestureScrollEnd);
       break;
     case blink::WebGestureDevice::kUninitialized:
     case blink::WebGestureDevice::kScrollbar:
@@ -368,7 +372,8 @@ void FlingController::EndCurrentFling(base::TimeTicks current_time) {
 
 bool FlingController::UpdateCurrentFlingState(
     const WebGestureEvent& fling_start_event) {
-  DCHECK_EQ(WebInputEvent::kGestureFlingStart, fling_start_event.GetType());
+  DCHECK_EQ(WebInputEvent::Type::kGestureFlingStart,
+            fling_start_event.GetType());
 
   const gfx::Vector2dF velocity =
       fling_booster_.GetVelocityForFlingStart(fling_start_event);
@@ -407,13 +412,27 @@ bool FlingController::UpdateCurrentFlingState(
     return false;
   }
 
+  gfx::Vector2dF velocity_from_gfs(
+      fling_start_event.data.fling_start.velocity_x,
+      fling_start_event.data.fling_start.velocity_y);
+
+  float max_velocity_from_gfs =
+      std::max(fabs(velocity_from_gfs.x()), fabs(velocity_from_gfs.y()));
+  float max_velocity = std::max(fabs(current_fling_parameters_.velocity.x()),
+                                fabs(current_fling_parameters_.velocity.y()));
+
+  // Scale the default bound multiplier to compute the maximum scroll distance a
+  // fling can travel based on physics based fling curve.
+  float boost_multiplier = max_velocity / max_velocity_from_gfs;
+
   fling_curve_ = std::unique_ptr<blink::WebGestureCurve>(
       ui::WebGestureCurveImpl::CreateFromDefaultPlatformCurve(
           current_fling_parameters_.source_device,
           current_fling_parameters_.velocity,
           gfx::Vector2dF() /*initial_offset*/, false /*on_main_thread*/,
           GetContentClient()->browser()->ShouldUseMobileFlingCurve(),
-          current_fling_parameters_.global_point, root_widget_viewport_size));
+          current_fling_parameters_.global_point, boost_multiplier,
+          root_widget_viewport_size));
   return true;
 }
 
@@ -428,9 +447,10 @@ FlingController::GetTouchpadTapSuppressionController() {
 
 void FlingController::OnWheelEventAck(
     const MouseWheelEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
-  last_wheel_event_consumed_ = (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED);
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
+  last_wheel_event_consumed_ =
+      (ack_result == blink::mojom::InputEventResultState::kConsumed);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/fling_controller.h b/chromium/content/browser/renderer_host/input/fling_controller.h
index 91e63085422..98bd3f78b41 100644
--- a/chromium/content/browser/renderer_host/input/fling_controller.h
+++ b/chromium/content/browser/renderer_host/input/fling_controller.h
@@ -7,8 +7,7 @@
 
 #include "content/browser/renderer_host/input/touchpad_tap_suppression_controller.h"
 #include "content/browser/renderer_host/input/touchscreen_tap_suppression_controller.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/fling_booster.h"
 
 namespace blink {
@@ -109,8 +108,8 @@ class CONTENT_EXPORT FlingController {
   // wheel event was consumed, in which case we should not start a fling scroll
   // for flings generated by a touchpad source.
   void OnWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result);
 
  protected:
   ui::FlingBooster fling_booster_;
diff --git a/chromium/content/browser/renderer_host/input/fling_controller_unittest.cc b/chromium/content/browser/renderer_host/input/fling_controller_unittest.cc
index 95d17712186..f308e0fa2e7 100644
--- a/chromium/content/browser/renderer_host/input/fling_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/fling_controller_unittest.cc
@@ -6,13 +6,17 @@
 
 #include "base/rand_util.h"
 #include "base/run_loop.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
+#include "build/chromecast_buildflags.h"
 #include "content/browser/renderer_host/input/gesture_event_queue.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/base/ui_base_features.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/fling_booster.h"
+#include "ui/events/gestures/physics_based_fling_curve.h"
 
 #if defined(OS_WIN)
 #include "ui/display/win/test/scoped_screen_win.h"
@@ -21,6 +25,7 @@
 using blink::WebGestureEvent;
 using blink::WebInputEvent;
 using blink::WebMouseWheelEvent;
+using ui::PhysicsBasedFlingCurve;
 
 namespace {
 constexpr double kFrameDelta = 1000.0 / 60.0;
@@ -94,7 +99,7 @@ class FlingControllerTest : public FlingControllerEventSenderClient,
                           bool wait_before_processing = true) {
     scheduled_next_fling_progress_ = false;
     sent_scroll_gesture_count_ = 0;
-    WebGestureEvent fling_start(WebInputEvent::kGestureFlingStart, 0,
+    WebGestureEvent fling_start(WebInputEvent::Type::kGestureFlingStart, 0,
                                 NowTicks(), source_device);
     fling_start.data.fling_start.velocity_x = velocity.x();
     fling_start.data.fling_start.velocity_y = velocity.y();
@@ -109,7 +114,7 @@ class FlingControllerTest : public FlingControllerEventSenderClient,
 
   void SimulateScrollBegin(blink::WebGestureDevice source_device,
                            const gfx::Vector2dF& delta) {
-    WebGestureEvent scroll_begin(WebInputEvent::kGestureScrollBegin, 0,
+    WebGestureEvent scroll_begin(WebInputEvent::Type::kGestureScrollBegin, 0,
                                  NowTicks(), source_device);
     scroll_begin.data.scroll_begin.delta_x_hint = delta.x();
     scroll_begin.data.scroll_begin.delta_y_hint = delta.y();
@@ -125,7 +130,7 @@ class FlingControllerTest : public FlingControllerEventSenderClient,
 
   void SimulateScrollUpdate(blink::WebGestureDevice source_device,
                             const gfx::Vector2dF& delta) {
-    WebGestureEvent scroll_update(WebInputEvent::kGestureScrollUpdate, 0,
+    WebGestureEvent scroll_update(WebInputEvent::Type::kGestureScrollUpdate, 0,
                                   NowTicks(), source_device);
     scroll_update.data.scroll_update.delta_x = delta.x();
     scroll_update.data.scroll_update.delta_y = delta.y();
@@ -143,7 +148,7 @@ class FlingControllerTest : public FlingControllerEventSenderClient,
 
   void SimulateFlingCancel(blink::WebGestureDevice source_device) {
     notified_client_after_fling_stop_ = false;
-    WebGestureEvent fling_cancel(WebInputEvent::kGestureFlingCancel, 0,
+    WebGestureEvent fling_cancel(WebInputEvent::Type::kGestureFlingCancel, 0,
                                  NowTicks(), source_device);
     // autoscroll fling cancel doesn't allow fling boosting.
     if (source_device == blink::WebGestureDevice::kSyntheticAutoscroll)
@@ -167,6 +172,37 @@ class FlingControllerTest : public FlingControllerEventSenderClient,
 
   base::TimeTicks NowTicks() const { return mock_clock_.NowTicks(); }
 
+  float CompleteFlingAndAccumulateScrollDelta() {
+    float total_scroll_delta = 0.f;
+
+    // Sometimes SendGeneratedGestureScrollEvents is not run because fling is
+    // not advanced. This is due to the first |FlingScheduler::OnAnimationStep|
+    // call having the time of the last frame before AddAnimationObserver.
+    // Please see comment in |FlingController::ProgressFling|. This leaves the
+    // last_sent_gesture as a GSE. We therefore don't accrue delta in this case
+    if (last_sent_gesture_.GetType() !=
+        WebInputEvent::Type::kGestureScrollEnd) {
+      DCHECK(last_sent_gesture_.GetType() ==
+             WebInputEvent::Type::kGestureScrollUpdate);
+      total_scroll_delta += last_sent_gesture_.data.scroll_update.delta_x;
+    }
+
+    while (true) {
+      AdvanceTime();
+      ProgressFling(NowTicks());
+      if (last_sent_gesture_.GetType() ==
+          WebInputEvent::Type::kGestureScrollEnd) {
+        break;
+      } else {
+        DCHECK(last_sent_gesture_.GetType() ==
+               WebInputEvent::Type::kGestureScrollUpdate);
+        total_scroll_delta += last_sent_gesture_.data.scroll_update.delta_x;
+      }
+    }
+
+    return total_scroll_delta;
+  }
+
  protected:
   std::unique_ptr<FakeFlingController> fling_controller_;
   int wheel_event_count_ = 0;
@@ -211,7 +247,8 @@ TEST_P(FlingControllerTest,
   SimulateFlingStart(blink::WebGestureDevice::kTouchscreen, gfx::Vector2dF());
   // The controller doesn't start a fling and sends a GSE immediately.
   EXPECT_FALSE(FlingInProgress());
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, last_sent_gesture_.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType());
 }
 
 TEST_P(FlingControllerTest, ControllerHandlesTouchpadGestureFling) {
@@ -265,7 +302,8 @@ TEST_P(FlingControllerTest, FlingStartsAtLastScrollUpdate) {
   // significant amount of delta (~0.030sec * 1000pixels/sec) since we should
   // be measuring the time since the last GSU.
   EXPECT_EQ(1, sent_scroll_gesture_count_);
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_NEAR(last_sent_gesture_.data.scroll_update.delta_x, 30.0, 5);
 }
 
@@ -326,7 +364,8 @@ TEST_P(FlingControllerTest, ControllerHandlesTouchscreenGestureFling) {
   // The fling progress will generate and send GSU events with inertial state.
   AdvanceTime();
   ProgressFling(NowTicks());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
@@ -337,7 +376,8 @@ TEST_P(FlingControllerTest, ControllerHandlesTouchscreenGestureFling) {
 
   // Cancellation should send a GSE.
   EXPECT_FALSE(FlingInProgress());
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, last_sent_gesture_.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType());
 }
 
 TEST_P(FlingControllerTest, ControllerSendsWheelEndWhenTouchpadFlingIsOver) {
@@ -382,7 +422,7 @@ TEST_P(FlingControllerTest, ControllerSendsGSEWhenTouchscreenFlingIsOver) {
   AdvanceTime();
   ProgressFling(NowTicks());
   while (FlingInProgress()) {
-    ASSERT_EQ(WebInputEvent::kGestureScrollUpdate,
+    ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
               last_sent_gesture_.GetType());
     EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
               last_sent_gesture_.data.scroll_update.inertial_phase);
@@ -391,7 +431,8 @@ TEST_P(FlingControllerTest, ControllerSendsGSEWhenTouchscreenFlingIsOver) {
     ProgressFling(NowTicks());
   }
 
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, last_sent_gesture_.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType());
 }
 
 TEST_P(FlingControllerTest, EarlyTouchpadFlingCancelationOnFlingStop) {
@@ -428,14 +469,16 @@ TEST_P(FlingControllerTest, EarlyTouchscreenFlingCancelationOnFlingStop) {
   // progress fling must send GSU events.
   AdvanceTime();
   ProgressFling(NowTicks());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
 
   fling_controller_->StopFling();
   EXPECT_FALSE(FlingInProgress());
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, last_sent_gesture_.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType());
 }
 
 TEST_P(FlingControllerTest, GestureFlingCancelOutsideFling) {
@@ -478,7 +521,8 @@ TEST_P(FlingControllerTest, GestureFlingNotCancelledBySmallTimeDelta) {
   ProgressFling(NowTicks());
   EXPECT_EQ(blink::WebGestureDevice::kTouchscreen,
             last_sent_gesture_.SourceDevice());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
@@ -503,7 +547,8 @@ TEST_P(FlingControllerTest, GestureFlingWithNegativeTimeDelta) {
   ProgressFling(NowTicks());
   EXPECT_EQ(blink::WebGestureDevice::kTouchscreen,
             last_sent_gesture_.SourceDevice());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
@@ -517,8 +562,8 @@ TEST_P(FlingControllerTest, TouchpadFlingWithOldEvent) {
 
   // Create a fling start event.
   base::TimeTicks event_time = NowTicks();
-  WebGestureEvent fling_start(WebInputEvent::kGestureFlingStart, 0, event_time,
-                              blink::WebGestureDevice::kTouchpad);
+  WebGestureEvent fling_start(WebInputEvent::Type::kGestureFlingStart, 0,
+                              event_time, blink::WebGestureDevice::kTouchpad);
   fling_start.data.fling_start.velocity_x = 0.f;
   fling_start.data.fling_start.velocity_y = -1000.f;
   GestureEventWithLatencyInfo fling_start_with_latency(fling_start);
@@ -595,7 +640,8 @@ TEST_P(FlingControllerTest, ControllerBoostsTouchscreenFling) {
   // Fling progress must send GSU events.
   AdvanceTime();
   ProgressFling(NowTicks());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
@@ -624,7 +670,8 @@ TEST_P(FlingControllerTest, ControllerDoesntBoostFinishedFling) {
   double time_to_advance_ms = 1000.0;
   AdvanceTime(time_to_advance_ms);
   ProgressFling(NowTicks());
-  ASSERT_EQ(WebInputEvent::kGestureScrollEnd, last_sent_gesture_.GetType())
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType())
       << "Unexpected Last Sent Gesture: "
       << WebInputEvent::GetName(last_sent_gesture_.GetType());
   EXPECT_EQ(fling_controller_->CurrentFlingVelocity().x(), 0);
@@ -658,7 +705,8 @@ TEST_P(FlingControllerTest, MiddleClickAutoScrollFling) {
 
   AdvanceTime();
   ProgressFling(NowTicks());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate, last_sent_gesture_.GetType());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
             last_sent_gesture_.data.scroll_update.inertial_phase);
   EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
@@ -680,9 +728,10 @@ TEST_P(FlingControllerTest, MiddleClickAutoScrollFling) {
 // wheel event was consumed.
 TEST_P(FlingControllerTest, NoFlingStartAfterWheelEventConsumed) {
   // First ensure that a fling can start after a not consumed wheel event.
-  fling_controller_->OnWheelEventAck(MouseWheelEventWithLatencyInfo(),
-                                     InputEventAckSource::COMPOSITOR_THREAD,
-                                     INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  fling_controller_->OnWheelEventAck(
+      MouseWheelEventWithLatencyInfo(),
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   SimulateFlingStart(blink::WebGestureDevice::kTouchpad,
                      gfx::Vector2dF(1000, 0));
@@ -693,13 +742,132 @@ TEST_P(FlingControllerTest, NoFlingStartAfterWheelEventConsumed) {
   EXPECT_FALSE(FlingInProgress());
 
   // Now test that a consumed touchpad wheel event results in no fling.
-  fling_controller_->OnWheelEventAck(MouseWheelEventWithLatencyInfo(),
-                                     InputEventAckSource::COMPOSITOR_THREAD,
-                                     INPUT_EVENT_ACK_STATE_CONSUMED);
+  fling_controller_->OnWheelEventAck(
+      MouseWheelEventWithLatencyInfo(),
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kConsumed);
 
   SimulateFlingStart(blink::WebGestureDevice::kTouchpad,
                      gfx::Vector2dF(1000, 0));
   EXPECT_FALSE(FlingInProgress());
 }
 
+class FlingControllerWithPhysicsBasedFlingTest : public FlingControllerTest {
+ public:
+  // testing::Test
+  FlingControllerWithPhysicsBasedFlingTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        features::kExperimentalFlingAnimation);
+  }
+
+  ~FlingControllerWithPhysicsBasedFlingTest() override = default;
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+  DISALLOW_COPY_AND_ASSIGN(FlingControllerWithPhysicsBasedFlingTest);
+};
+
+INSTANTIATE_TEST_SUITE_P(All,
+                         FlingControllerWithPhysicsBasedFlingTest,
+                         testing::Bool());
+
+// Ensure the bounding distance for boosted physics based flings is increased
+// by a factor of the boost_multiplier and default multiplier
+TEST_P(FlingControllerWithPhysicsBasedFlingTest,
+       ControllerBoostsTouchscreenFling) {
+  // We use a velocity of 4500 in this test because it yields a scroll delta
+  // that is greater than viewport * boost_multiplier * kDefaultBoundsMultiplier
+
+  // Android and Chromecast use Mobile fling curve so they are ignored
+  // for this test
+  bool use_mobile_fling_curve = false;
+#if defined(OS_ANDROID) || BUILDFLAG(IS_CHROMECAST)
+  use_mobile_fling_curve = true;
+#endif
+  if (use_mobile_fling_curve)
+    return;
+
+  SimulateFlingStart(blink::WebGestureDevice::kTouchscreen,
+                     gfx::Vector2dF(4500, 0));
+  EXPECT_TRUE(FlingInProgress());
+  // Fling progress must send GSU events.
+  AdvanceTime();
+  ProgressFling(NowTicks());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_sent_gesture_.GetType());
+  EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,
+            last_sent_gesture_.data.scroll_update.inertial_phase);
+  EXPECT_GT(last_sent_gesture_.data.scroll_update.delta_x, 0.f);
+
+  // Now cancel the fling.
+  SimulateFlingCancel(blink::WebGestureDevice::kTouchscreen);
+  EXPECT_FALSE(FlingInProgress());
+
+  // The second GFS can be boosted so it should boost the just deactivated
+  // fling. To test that the correct bounds scale is used, the scroll delta
+  // is accumulated after each frame.
+  SimulateFlingStart(blink::WebGestureDevice::kTouchscreen,
+                     gfx::Vector2dF(4500, 0));
+  EXPECT_TRUE(FlingInProgress());
+  if (NeedsBeginFrameForFlingProgress())
+    ProgressFling(NowTicks());
+
+  float total_scroll_delta = CompleteFlingAndAccumulateScrollDelta();
+
+  // We expect the scroll delta to be the viewport * [boost_multiplier = 2] *
+  // multiplier
+  float expected_delta =
+      2 * PhysicsBasedFlingCurve::default_bounds_multiplier_for_testing() *
+      GetRootWidgetViewportSize().width();
+  EXPECT_EQ(ceilf(total_scroll_delta), roundf(expected_delta));
+}
+
+// Ensure that once a fling finishes, the next fling has a boost_multiplier of 1
+TEST_P(FlingControllerWithPhysicsBasedFlingTest,
+       ControllerDoesntBoostFinishedFling) {
+  // Android and Chromecast use Mobile fling curve so they are ignored
+  // for this test
+  bool use_mobile_fling_curve = false;
+#if defined(OS_ANDROID) || BUILDFLAG(IS_CHROMECAST)
+  use_mobile_fling_curve = true;
+#endif
+  if (use_mobile_fling_curve)
+    return;
+  SimulateFlingStart(blink::WebGestureDevice::kTouchscreen,
+                     gfx::Vector2dF(1000, 0), /*wait_before_processing=*/true);
+  EXPECT_TRUE(FlingInProgress());
+  AdvanceTime();
+  ProgressFling(NowTicks());
+
+  // Fast forward so that the fling ends.
+  double time_to_advance_ms = 1000.0;
+  AdvanceTime(time_to_advance_ms);
+  ProgressFling(NowTicks());
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_sent_gesture_.GetType())
+      << "Unexpected Last Sent Gesture: "
+      << WebInputEvent::GetName(last_sent_gesture_.GetType());
+  EXPECT_EQ(fling_controller_->CurrentFlingVelocity().x(), 0);
+  EXPECT_FALSE(FlingInProgress());
+
+  // Now send a new fling, ensure boost_multiplier is 1
+  AdvanceTime();
+  SimulateFlingCancel(blink::WebGestureDevice::kTouchscreen);
+
+  SimulateFlingStart(blink::WebGestureDevice::kTouchscreen,
+                     gfx::Vector2dF(10000, 0));
+  EXPECT_TRUE(FlingInProgress());
+  if (NeedsBeginFrameForFlingProgress())
+    ProgressFling(NowTicks());
+
+  float total_scroll_delta = CompleteFlingAndAccumulateScrollDelta();
+
+  // We expect the scroll delta to be the viewport * [boost_multiplier = 1] *
+  // multiplier
+  float expected_delta =
+      PhysicsBasedFlingCurve::default_bounds_multiplier_for_testing() *
+      GetRootWidgetViewportSize().width();
+  EXPECT_EQ(ceilf(total_scroll_delta), roundf(expected_delta));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/fling_scheduler_unittest.cc b/chromium/content/browser/renderer_host/input/fling_scheduler_unittest.cc
index cecb14dd89e..2c608aca682 100644
--- a/chromium/content/browser/renderer_host/input/fling_scheduler_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/fling_scheduler_unittest.cc
@@ -85,9 +85,9 @@ class FlingSchedulerTest : public testing::Test,
   }
 
   void SimulateFlingStart(const gfx::Vector2dF& velocity) {
-    blink::WebGestureEvent fling_start(blink::WebInputEvent::kGestureFlingStart,
-                                       0, base::TimeTicks::Now(),
-                                       blink::WebGestureDevice::kTouchscreen);
+    blink::WebGestureEvent fling_start(
+        blink::WebInputEvent::Type::kGestureFlingStart, 0,
+        base::TimeTicks::Now(), blink::WebGestureDevice::kTouchscreen);
     fling_start.data.fling_start.velocity_x = velocity.x();
     fling_start.data.fling_start.velocity_y = velocity.y();
     GestureEventWithLatencyInfo fling_start_with_latency(fling_start);
@@ -97,8 +97,8 @@ class FlingSchedulerTest : public testing::Test,
 
   void SimulateFlingCancel() {
     blink::WebGestureEvent fling_cancel(
-        blink::WebInputEvent::kGestureFlingCancel, 0, base::TimeTicks::Now(),
-        blink::WebGestureDevice::kTouchscreen);
+        blink::WebInputEvent::Type::kGestureFlingCancel, 0,
+        base::TimeTicks::Now(), blink::WebGestureDevice::kTouchscreen);
     fling_cancel.data.fling_cancel.prevent_boosting = true;
     GestureEventWithLatencyInfo fling_cancel_with_latency(fling_cancel);
     fling_controller_->ObserveAndMaybeConsumeGestureEvent(
diff --git a/chromium/content/browser/renderer_host/input/gesture_event_queue.cc b/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
index d318665e29f..53027dd3c5f 100644
--- a/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
@@ -45,8 +45,10 @@ GestureEventQueue::~GestureEventQueue() { }
 bool GestureEventQueue::DebounceOrForwardEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
   // GFS and GFC should have been filtered in PassToFlingController.
-  DCHECK_NE(gesture_event.event.GetType(), WebInputEvent::kGestureFlingStart);
-  DCHECK_NE(gesture_event.event.GetType(), WebInputEvent::kGestureFlingCancel);
+  DCHECK_NE(gesture_event.event.GetType(),
+            WebInputEvent::Type::kGestureFlingStart);
+  DCHECK_NE(gesture_event.event.GetType(),
+            WebInputEvent::Type::kGestureFlingCancel);
   if (!ShouldForwardForBounceReduction(gesture_event))
     return false;
 
@@ -94,7 +96,7 @@ bool GestureEventQueue::ShouldForwardForBounceReduction(
     return true;
 
   switch (gesture_event.event.GetType()) {
-    case WebInputEvent::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureScrollUpdate:
       if (!scrolling_in_progress_) {
         debounce_deferring_timer_.Start(
             FROM_HERE,
@@ -109,11 +111,11 @@ bool GestureEventQueue::ShouldForwardForBounceReduction(
       debouncing_deferral_queue_.clear();
       return true;
 
-    case WebInputEvent::kGesturePinchBegin:
-    case WebInputEvent::kGesturePinchEnd:
-    case WebInputEvent::kGesturePinchUpdate:
+    case WebInputEvent::Type::kGesturePinchBegin:
+    case WebInputEvent::Type::kGesturePinchEnd:
+    case WebInputEvent::Type::kGesturePinchUpdate:
       return true;
-    case WebInputEvent::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollBegin:
       // GSB event should not get filtered by the debouncing_deferral_queue_
       // when its previous GSE event is forwarded to the renderer.
       if (!scroll_end_filtered_by_deboucing_deferral_queue_) {
@@ -122,7 +124,7 @@ bool GestureEventQueue::ShouldForwardForBounceReduction(
         debouncing_deferral_queue_.push_back(gesture_event);
         return false;
       }
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollEnd:
       scroll_end_filtered_by_deboucing_deferral_queue_ = false;
       // GSEs generated by the fling controller should not get pushed to the
       // debouncing_deferral_queue_.
@@ -149,16 +151,19 @@ void GestureEventQueue::ForwardGestureEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
   // GFS and GFC should have been filtered in PassToFlingController to get
   // handled by fling controller.
-  DCHECK_NE(gesture_event.event.GetType(), WebInputEvent::kGestureFlingStart);
-  DCHECK_NE(gesture_event.event.GetType(), WebInputEvent::kGestureFlingCancel);
+  DCHECK_NE(gesture_event.event.GetType(),
+            WebInputEvent::Type::kGestureFlingStart);
+  DCHECK_NE(gesture_event.event.GetType(),
+            WebInputEvent::Type::kGestureFlingCancel);
   sent_events_awaiting_ack_.push_back(gesture_event);
   client_->SendGestureEventImmediately(gesture_event);
 }
 
-void GestureEventQueue::ProcessGestureAck(InputEventAckSource ack_source,
-                                          InputEventAckState ack_result,
-                                          WebInputEvent::Type type,
-                                          const ui::LatencyInfo& latency) {
+void GestureEventQueue::ProcessGestureAck(
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result,
+    WebInputEvent::Type type,
+    const ui::LatencyInfo& latency) {
   TRACE_EVENT0("input", "GestureEventQueue::ProcessGestureAck");
 
   if (sent_events_awaiting_ack_.empty()) {
@@ -169,7 +174,8 @@ void GestureEventQueue::ProcessGestureAck(InputEventAckSource ack_source,
   // ACKs could come back out of order. We want to cache them to restore the
   // original order.
   for (auto& outstanding_event : sent_events_awaiting_ack_) {
-    if (outstanding_event.ack_state() != INPUT_EVENT_ACK_STATE_UNKNOWN)
+    if (outstanding_event.ack_state() !=
+        blink::mojom::InputEventResultState::kUnknown)
       continue;
     if (outstanding_event.event.GetType() == type) {
       outstanding_event.latency.AddNewLatencyFrom(latency);
@@ -189,7 +195,7 @@ void GestureEventQueue::AckCompletedEvents() {
   base::AutoReset<bool> process_acks(&processing_acks_, true);
   while (!sent_events_awaiting_ack_.empty()) {
     auto iter = sent_events_awaiting_ack_.begin();
-    if (iter->ack_state() == INPUT_EVENT_ACK_STATE_UNKNOWN)
+    if (iter->ack_state() == blink::mojom::InputEventResultState::kUnknown)
       break;
     GestureEventWithLatencyInfoAndAckState event = *iter;
     sent_events_awaiting_ack_.erase(iter);
@@ -199,8 +205,8 @@ void GestureEventQueue::AckCompletedEvents() {
 
 void GestureEventQueue::AckGestureEventToClient(
     const GestureEventWithLatencyInfo& event_with_latency,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   client_->OnGestureEventAck(event_with_latency, ack_source, ack_result);
 }
 
@@ -218,7 +224,7 @@ void GestureEventQueue::SendScrollEndingEventsNow() {
   for (GestureQueue::const_iterator it = debouncing_deferral_queue.begin();
        it != debouncing_deferral_queue.end(); it++) {
     if (!fling_controller_.ObserveAndMaybeConsumeGestureEvent(*it)) {
-      if (it->event.GetType() == WebInputEvent::kGestureScrollEnd)
+      if (it->event.GetType() == WebInputEvent::Type::kGestureScrollEnd)
         scroll_end_filtered_by_deboucing_deferral_queue_ = false;
       ForwardGestureEvent(*it);
     }
@@ -227,8 +233,8 @@ void GestureEventQueue::SendScrollEndingEventsNow() {
 
 void GestureEventQueue::OnWheelEventAck(
     const MouseWheelEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   fling_controller_.OnWheelEventAck(event, ack_source, ack_result);
 }
 
diff --git a/chromium/content/browser/renderer_host/input/gesture_event_queue.h b/chromium/content/browser/renderer_host/input/gesture_event_queue.h
index b00adf53960..5e096efab6c 100644
--- a/chromium/content/browser/renderer_host/input/gesture_event_queue.h
+++ b/chromium/content/browser/renderer_host/input/gesture_event_queue.h
@@ -15,9 +15,8 @@
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/browser/renderer_host/input/fling_controller.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 class GestureEventQueueTest;
@@ -32,9 +31,10 @@ class CONTENT_EXPORT GestureEventQueueClient {
   virtual void SendGestureEventImmediately(
       const GestureEventWithLatencyInfo& event) = 0;
 
-  virtual void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                                 InputEventAckSource ack_source,
-                                 InputEventAckState ack_result) = 0;
+  virtual void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
 };
 
 // Despite its name, this class isn't so much one queue as it is a collection
@@ -98,8 +98,8 @@ class CONTENT_EXPORT GestureEventQueue {
 
   // Indicates that the caller has received an acknowledgement from the renderer
   // with state |ack_result| and event |type|.
-  void ProcessGestureAck(InputEventAckSource ack_source,
-                         InputEventAckState ack_result,
+  void ProcessGestureAck(blink::mojom::InputEventResultSource ack_source,
+                         blink::mojom::InputEventResultState ack_result,
                          blink::WebInputEvent::Type type,
                          const ui::LatencyInfo& latency);
 
@@ -129,8 +129,8 @@ class CONTENT_EXPORT GestureEventQueue {
   // FlingController. The FlingController should probably be owned by the
   // InputRouter instead.
   void OnWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result);
 
   bool IsFlingActiveForTest() { return FlingInProgressForTest(); }
 
@@ -142,16 +142,21 @@ class CONTENT_EXPORT GestureEventQueue {
       : public GestureEventWithLatencyInfo {
    public:
     GestureEventWithLatencyInfoAndAckState(const GestureEventWithLatencyInfo&);
-    InputEventAckState ack_state() const { return ack_state_; }
-    void set_ack_info(InputEventAckSource source, InputEventAckState state) {
+    blink::mojom::InputEventResultState ack_state() const { return ack_state_; }
+    void set_ack_info(blink::mojom::InputEventResultSource source,
+                      blink::mojom::InputEventResultState state) {
       ack_source_ = source;
       ack_state_ = state;
     }
-    InputEventAckSource ack_source() const { return ack_source_; }
+    blink::mojom::InputEventResultSource ack_source() const {
+      return ack_source_;
+    }
 
    private:
-    InputEventAckSource ack_source_ = InputEventAckSource::UNKNOWN;
-    InputEventAckState ack_state_ = INPUT_EVENT_ACK_STATE_UNKNOWN;
+    blink::mojom::InputEventResultSource ack_source_ =
+        blink::mojom::InputEventResultSource::kUnknown;
+    blink::mojom::InputEventResultState ack_state_ =
+        blink::mojom::InputEventResultState::kUnknown;
   };
 
   // Inovked on the expiration of the debounce interval to release
@@ -166,8 +171,8 @@ class CONTENT_EXPORT GestureEventQueue {
   // Will preserve the FIFO order as events originally arrived.
   void AckCompletedEvents();
   void AckGestureEventToClient(const GestureEventWithLatencyInfo&,
-                               InputEventAckSource,
-                               InputEventAckState);
+                               blink::mojom::InputEventResultSource,
+                               blink::mojom::InputEventResultState);
 
   bool FlingInProgressForTest() const;
 
diff --git a/chromium/content/browser/renderer_host/input/gesture_event_queue_unittest.cc b/chromium/content/browser/renderer_host/input/gesture_event_queue_unittest.cc
index 65c6dd274a7..b6c72126ffd 100644
--- a/chromium/content/browser/renderer_host/input/gesture_event_queue_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/gesture_event_queue_unittest.cc
@@ -11,7 +11,6 @@
 #include <vector>
 
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/test/scoped_feature_list.h"
@@ -22,9 +21,9 @@
 #include "content/browser/renderer_host/input/input_router_config_helper.h"
 #include "content/browser/renderer_host/input/touchpad_tap_suppression_controller.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/blink_features.h"
 
 #if defined(OS_WIN)
@@ -77,15 +76,16 @@ class GestureEventQueueTest : public testing::Test,
       const GestureEventWithLatencyInfo& event) override {
     ++sent_gesture_event_count_;
     if (sync_ack_result_) {
-      std::unique_ptr<InputEventAckState> ack_result =
+      std::unique_ptr<blink::mojom::InputEventResultState> ack_result =
           std::move(sync_ack_result_);
       SendInputEventACK(event.event.GetType(), *ack_result);
     }
   }
 
-  void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                         InputEventAckSource ack_source,
-                         InputEventAckState ack_result) override {
+  void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override {
     ++acked_gesture_event_count_;
     last_acked_event_ = event.event;
     if (sync_followup_event_) {
@@ -134,7 +134,7 @@ class GestureEventQueueTest : public testing::Test,
 
   void SimulateGSEGeneratedByFlingController(WebGestureDevice sourceDevice) {
     WebGestureEvent gesture_scroll_end = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureScrollEnd, sourceDevice);
+        WebInputEvent::Type::kGestureScrollEnd, sourceDevice);
     gesture_scroll_end.data.scroll_end.generated_by_fling_controller = true;
     SimulateGestureEvent(gesture_scroll_end);
   }
@@ -163,9 +163,10 @@ class GestureEventQueueTest : public testing::Test,
   }
 
   void SendInputEventACK(WebInputEvent::Type type,
-                         InputEventAckState ack) {
-    queue()->ProcessGestureAck(InputEventAckSource::COMPOSITOR_THREAD, ack,
-                               type, ui::LatencyInfo());
+                         blink::mojom::InputEventResultState ack) {
+    queue()->ProcessGestureAck(
+        blink::mojom::InputEventResultSource::kCompositorThread, ack, type,
+        ui::LatencyInfo());
   }
 
   void RunUntilIdle() { base::RunLoop().RunUntilIdle(); }
@@ -186,8 +187,8 @@ class GestureEventQueueTest : public testing::Test,
     return last_acked_event_;
   }
 
-  void set_synchronous_ack(InputEventAckState ack_result) {
-    sync_ack_result_.reset(new InputEventAckState(ack_result));
+  void set_synchronous_ack(blink::mojom::InputEventResultState ack_result) {
+    sync_ack_result_.reset(new blink::mojom::InputEventResultState(ack_result));
   }
 
   void set_sync_followup_event(WebInputEvent::Type type,
@@ -234,7 +235,7 @@ class GestureEventQueueTest : public testing::Test,
   size_t acked_gesture_event_count_;
   size_t sent_gesture_event_count_;
   WebGestureEvent last_acked_event_;
-  std::unique_ptr<InputEventAckState> sync_ack_result_;
+  std::unique_ptr<blink::mojom::InputEventResultState> sync_ack_result_;
   std::unique_ptr<WebGestureEvent> sync_followup_event_;
   base::test::ScopedFeatureList feature_list_;
 #if defined(OS_WIN)
@@ -242,18 +243,13 @@ class GestureEventQueueTest : public testing::Test,
 #endif
 };
 
-// This is for tests that are to be run for all source devices.
-class GestureEventQueueWithSourceTest
-    : public GestureEventQueueTest,
-      public testing::WithParamInterface<WebGestureDevice> {};
-
 class GestureEventQueueWithCompositorEventQueueTest
     : public GestureEventQueueTest {};
 
 // Tests a single event with an synchronous ack.
 TEST_F(GestureEventQueueTest, SimpleSyncAck) {
-  set_synchronous_ack(INPUT_EVENT_ACK_STATE_CONSUMED);
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  set_synchronous_ack(blink::mojom::InputEventResultState::kConsumed);
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(0U, GestureEventQueueSize());
@@ -263,55 +259,50 @@ TEST_F(GestureEventQueueTest, SimpleSyncAck) {
 // Tests an event with an synchronous ack which enqueues an additional event.
 TEST_F(GestureEventQueueTest, SyncAckQueuesEvent) {
   std::unique_ptr<WebGestureEvent> queued_event;
-  set_synchronous_ack(INPUT_EVENT_ACK_STATE_CONSUMED);
-  set_sync_followup_event(WebInputEvent::kGestureShowPress,
+  set_synchronous_ack(blink::mojom::InputEventResultState::kConsumed);
+  set_sync_followup_event(WebInputEvent::Type::kGestureShowPress,
                           blink::WebGestureDevice::kTouchscreen);
   // This event enqueues the show press event.
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(2U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(1U, GetAndResetAckedGestureEventCount());
 
-  SendInputEventACK(WebInputEvent::kGestureShowPress,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendInputEventACK(WebInputEvent::Type::kGestureShowPress,
+                    blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(0U, GestureEventQueueSize());
   EXPECT_EQ(1U, GetAndResetAckedGestureEventCount());
 }
 
-INSTANTIATE_TEST_SUITE_P(AllSources,
-                         GestureEventQueueWithSourceTest,
-                         testing::Values(blink::WebGestureDevice::kTouchscreen,
-                                         blink::WebGestureDevice::kTouchpad));
-
 // Test that a GestureScrollEnd is deferred during the debounce interval,
 // that Scrolls are not and that the deferred events are sent after that
 // timer fires.
 TEST_F(GestureEventQueueTest, DebounceDefersFollowingGestureEvents) {
   SetUpForDebounce(3);
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
   EXPECT_EQ(1U, GestureEventDebouncingQueueSize());
 
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
@@ -329,9 +320,9 @@ TEST_F(GestureEventQueueTest, DebounceDefersFollowingGestureEvents) {
   EXPECT_FALSE(ScrollingInProgress());
 
   // Verify that the coalescing queue contains the correct events.
-  WebInputEvent::Type expected[] = {WebInputEvent::kGestureScrollUpdate,
-                                    WebInputEvent::kGestureScrollUpdate,
-                                    WebInputEvent::kGestureScrollEnd};
+  WebInputEvent::Type expected[] = {WebInputEvent::Type::kGestureScrollUpdate,
+                                    WebInputEvent::Type::kGestureScrollUpdate,
+                                    WebInputEvent::Type::kGestureScrollEnd};
 
   for (unsigned i = 0; i < sizeof(expected) / sizeof(WebInputEvent::Type);
        i++) {
@@ -347,7 +338,7 @@ TEST_F(GestureEventQueueTest,
        DebounceDoesNotDeferGSEsGeneratedByFlingController) {
   SetUpForDebounce(3);
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
@@ -360,16 +351,16 @@ TEST_F(GestureEventQueueTest,
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_FALSE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(3U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
 
   // Verify that the coalescing queue contains the correct events.
-  WebInputEvent::Type expected[] = {WebInputEvent::kGestureScrollUpdate,
-                                    WebInputEvent::kGestureScrollEnd,
-                                    WebInputEvent::kGestureScrollBegin};
+  WebInputEvent::Type expected[] = {WebInputEvent::Type::kGestureScrollUpdate,
+                                    WebInputEvent::Type::kGestureScrollEnd,
+                                    WebInputEvent::Type::kGestureScrollBegin};
 
   for (unsigned i = 0; i < sizeof(expected) / sizeof(WebInputEvent::Type);
        i++) {
@@ -380,21 +371,21 @@ TEST_F(GestureEventQueueTest,
 
 TEST_F(GestureEventQueueTest, DebounceDefersGSBIfPreviousGSEDeferred) {
   SetUpForDebounce(3);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(1U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
@@ -404,27 +395,27 @@ TEST_F(GestureEventQueueTest, DebounceDefersGSBIfPreviousGSEDeferred) {
 
 TEST_F(GestureEventQueueTest, DebounceDefersGSBIfPreviousGSEDropped) {
   SetUpForDebounce(3);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(1U, GestureEventDebouncingQueueSize());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
   EXPECT_EQ(0U, GestureEventDebouncingQueueSize());
   EXPECT_TRUE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
@@ -432,8 +423,8 @@ TEST_F(GestureEventQueueTest, DebounceDefersGSBIfPreviousGSEDropped) {
   EXPECT_TRUE(ScrollingInProgress());
 
   // Verify that the coalescing queue contains the correct events.
-  WebInputEvent::Type expected[] = {WebInputEvent::kGestureScrollUpdate,
-                                    WebInputEvent::kGestureScrollUpdate};
+  WebInputEvent::Type expected[] = {WebInputEvent::Type::kGestureScrollUpdate,
+                                    WebInputEvent::Type::kGestureScrollUpdate};
 
   for (unsigned i = 0; i < sizeof(expected) / sizeof(WebInputEvent::Type);
        i++) {
@@ -450,7 +441,7 @@ TEST_F(GestureEventQueueTest, DebounceDropsDeferredEvents) {
 
   EXPECT_FALSE(ScrollingInProgress());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
@@ -458,13 +449,13 @@ TEST_F(GestureEventQueueTest, DebounceDropsDeferredEvents) {
   EXPECT_TRUE(ScrollingInProgress());
 
   // This event should get discarded.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(1U, GestureEventQueueSize());
   EXPECT_EQ(1U, GestureEventDebouncingQueueSize());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(2U, GestureEventQueueSize());
@@ -472,8 +463,8 @@ TEST_F(GestureEventQueueTest, DebounceDropsDeferredEvents) {
   EXPECT_TRUE(ScrollingInProgress());
 
   // Verify that the coalescing queue contains the correct events.
-  WebInputEvent::Type expected[] = {WebInputEvent::kGestureScrollUpdate,
-                                    WebInputEvent::kGestureScrollUpdate};
+  WebInputEvent::Type expected[] = {WebInputEvent::Type::kGestureScrollUpdate,
+                                    WebInputEvent::Type::kGestureScrollUpdate};
 
   for (unsigned i = 0; i < sizeof(expected) / sizeof(WebInputEvent::Type);
       i++) {
@@ -498,7 +489,7 @@ TEST_F(GestureEventQueueTest, TapGetsSuppressedAfterTapDownCancelsFling) {
 
   // Simulate a fling cancel event before sending a gesture tap down event. The
   // fling cancel event is not sent to the renderer.
-  SimulateGestureEvent(WebInputEvent::kGestureFlingCancel,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureFlingCancel,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(0U, GestureEventQueueSize());
@@ -506,13 +497,13 @@ TEST_F(GestureEventQueueTest, TapGetsSuppressedAfterTapDownCancelsFling) {
 
   // Simulate a fling cancelling tap down. The tap down must get suppressed
   // since the fling cancel event is processed by the fling controller.
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GestureEventQueueSize());
 
   // The tap event must get suppressed since its corresponding tap down event
   // is suppressed.
-  SimulateGestureEvent(WebInputEvent::kGestureTap,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTap,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GestureEventQueueSize());
 }
@@ -520,50 +511,53 @@ TEST_F(GestureEventQueueTest, TapGetsSuppressedAfterTapDownCancelsFling) {
 TEST_F(GestureEventQueueWithCompositorEventQueueTest,
        PreserveOrderWithOutOfOrderAck) {
   // Simulate a scroll sequence, events should be ACKed in original order.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(8, -4, 1);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
 
   // All events should have been sent.
   EXPECT_EQ(3U, GetAndResetSentGestureEventCount());
 
   // Simulate GSB ACK.
-  SendInputEventACK(WebInputEvent::kGestureScrollBegin,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, last_acked_event().GetType());
+  SendInputEventACK(WebInputEvent::Type::kGestureScrollBegin,
+                    blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin,
+            last_acked_event().GetType());
   EXPECT_EQ(2U, GestureEventQueueSize());
 
   // Simulate GSE ACK first since it's usually dispatched non-blocking.
-  SendInputEventACK(WebInputEvent::kGestureScrollEnd,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendInputEventACK(WebInputEvent::Type::kGestureScrollEnd,
+                    blink::mojom::InputEventResultState::kConsumed);
   // GSE ACK will be cached in GestureEventQueue since we haven't ACKed GSU yet.
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, last_acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin,
+            last_acked_event().GetType());
   EXPECT_EQ(2U, GestureEventQueueSize());
 
   // Simulate GSU ACK.
-  SendInputEventACK(WebInputEvent::kGestureScrollUpdate,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendInputEventACK(WebInputEvent::Type::kGestureScrollUpdate,
+                    blink::mojom::InputEventResultState::kConsumed);
   // Both ACKs should be released in order.
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, last_acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd,
+            last_acked_event().GetType());
   EXPECT_EQ(0U, GestureEventQueueSize());
 }
 
 TEST_F(GestureEventQueueWithCompositorEventQueueTest,
        MultipleGesturesInFlight) {
   // Simulate a pinch sequence, events should be forwarded immediately.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
-  SimulateGestureEvent(WebInputEvent::kGesturePinchBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
 
   SimulateGestureScrollUpdateEvent(8, -4, 1);
   EXPECT_EQ(1U, GetAndResetSentGestureEventCount());
   EXPECT_EQ(3U, GestureEventQueueSize());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             GestureEventLastQueueEvent().GetType());
 
   // Simulate 2 pinch update events.
@@ -573,29 +567,31 @@ TEST_F(GestureEventQueueWithCompositorEventQueueTest,
   // Events should be forwarded immediately instead of being coalesced.
   EXPECT_EQ(5U, GestureEventQueueSize());
   EXPECT_EQ(2U, GetAndResetSentGestureEventCount());
-  EXPECT_EQ(WebInputEvent::kGesturePinchUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             GestureEventLastQueueEvent().GetType());
 
-  SendInputEventACK(WebInputEvent::kGestureScrollBegin,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendInputEventACK(WebInputEvent::Type::kGestureScrollBegin,
+                    blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(4U, GestureEventQueueSize());
 
-  SendInputEventACK(WebInputEvent::kGesturePinchBegin,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendInputEventACK(WebInputEvent::kGestureScrollUpdate,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendInputEventACK(WebInputEvent::Type::kGesturePinchBegin,
+                    blink::mojom::InputEventResultState::kConsumed);
+  SendInputEventACK(WebInputEvent::Type::kGestureScrollUpdate,
+                    blink::mojom::InputEventResultState::kConsumed);
 
   // Both GestureScrollUpdate and GesturePinchUpdate should have been sent.
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, last_acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            last_acked_event().GetType());
   EXPECT_EQ(2U, GestureEventQueueSize());
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
 
   // Ack the last 2 GesturePinchUpdate events.
-  SendInputEventACK(WebInputEvent::kGesturePinchUpdate,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendInputEventACK(WebInputEvent::kGesturePinchUpdate,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kGesturePinchUpdate, last_acked_event().GetType());
+  SendInputEventACK(WebInputEvent::Type::kGesturePinchUpdate,
+                    blink::mojom::InputEventResultState::kConsumed);
+  SendInputEventACK(WebInputEvent::Type::kGesturePinchUpdate,
+                    blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
+            last_acked_event().GetType());
   EXPECT_EQ(0U, GestureEventQueueSize());
   EXPECT_EQ(0U, GetAndResetSentGestureEventCount());
 }
diff --git a/chromium/content/browser/renderer_host/input/input_disposition_handler.h b/chromium/content/browser/renderer_host/input/input_disposition_handler.h
index 5ef4c5105c8..41f7084a68c 100644
--- a/chromium/content/browser/renderer_host/input/input_disposition_handler.h
+++ b/chromium/content/browser/renderer_host/input/input_disposition_handler.h
@@ -7,9 +7,8 @@
 
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/public/browser/native_web_keyboard_event.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -19,15 +18,18 @@ class CONTENT_EXPORT InputDispositionHandler {
   virtual ~InputDispositionHandler() {}
 
   // Called upon event ack receipt from the renderer.
-  virtual void OnWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                               InputEventAckSource ack_source,
-                               InputEventAckState ack_result) = 0;
-  virtual void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                               InputEventAckSource ack_source,
-                               InputEventAckState ack_result) = 0;
-  virtual void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                                 InputEventAckSource ack_source,
-                                 InputEventAckState ack_result) = 0;
+  virtual void OnWheelEventAck(
+      const MouseWheelEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
+  virtual void OnTouchEventAck(
+      const TouchEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
+  virtual void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/input_router.h b/chromium/content/browser/renderer_host/input/input_router.h
index e311b17fcad..8d09e00cca5 100644
--- a/chromium/content/browser/renderer_host/input/input_router.h
+++ b/chromium/content/browser/renderer_host/input/input_router.h
@@ -12,9 +12,9 @@
 #include "content/browser/renderer_host/input/passthrough_touch_event_queue.h"
 #include "content/common/widget.mojom.h"
 #include "content/public/browser/native_web_keyboard_event.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -37,8 +37,8 @@ class InputRouter {
   // the renderer, then callbacks are *not* run.
   using MouseEventCallback =
       base::OnceCallback<void(const MouseEventWithLatencyInfo& event,
-                              InputEventAckSource ack_source,
-                              InputEventAckState ack_result)>;
+                              blink::mojom::InputEventResultSource ack_source,
+                              blink::mojom::InputEventResultState ack_result)>;
   virtual void SendMouseEvent(const MouseEventWithLatencyInfo& mouse_event,
                               MouseEventCallback event_result_callback) = 0;
 
@@ -47,8 +47,8 @@ class InputRouter {
 
   using KeyboardEventCallback = base::OnceCallback<void(
       const NativeWebKeyboardEventWithLatencyInfo& event,
-      InputEventAckSource ack_source,
-      InputEventAckState ack_result)>;
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result)>;
   virtual void SendKeyboardEvent(
       const NativeWebKeyboardEventWithLatencyInfo& key_event,
       KeyboardEventCallback event_result_callback) = 0;
diff --git a/chromium/content/browser/renderer_host/input/input_router_client.h b/chromium/content/browser/renderer_host/input/input_router_client.h
index ce5a1d7abc7..137975ca6db 100644
--- a/chromium/content/browser/renderer_host/input/input_router_client.h
+++ b/chromium/content/browser/renderer_host/input/input_router_client.h
@@ -10,9 +10,8 @@
 #include "content/common/content_export.h"
 #include "content/common/input/input_handler.mojom.h"
 #include "content/public/browser/native_web_keyboard_event.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace ui {
 class LatencyInfo;
@@ -31,7 +30,7 @@ class CONTENT_EXPORT InputRouterClient {
   //   * |NOT_CONSUMED| will result in |input_event| being sent as usual.
   //   * |CONSUMED| or |NO_CONSUMER_EXISTS| will trigger the appropriate ack.
   //   * |UNKNOWN| will result in |input_event| being dropped.
-  virtual InputEventAckState FilterInputEvent(
+  virtual blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event,
       const ui::LatencyInfo& latency_info) = 0;
 
@@ -39,7 +38,8 @@ class CONTENT_EXPORT InputRouterClient {
   virtual void IncrementInFlightEventCount() = 0;
 
   // Called each time a WebInputEvent ACK IPC is received.
-  virtual void DecrementInFlightEventCount(InputEventAckSource ack_source) = 0;
+  virtual void DecrementInFlightEventCount(
+      blink::mojom::InputEventResultSource ack_source) = 0;
 
   // Called when the router has received an overscroll notification from the
   // renderer.
@@ -84,20 +84,11 @@ class CONTENT_EXPORT InputRouterClient {
       bool unadjusted_movement,
       mojom::WidgetInputHandlerHost::RequestMouseLockCallback response) = 0;
 
-  virtual void RequestMouseLockChange(
-      bool unadjusted_movement,
-      mojom::WidgetInputHandlerHost::RequestMouseLockCallback response) = 0;
-
-  virtual void UnlockMouse() = 0;
-
-  virtual void FallbackCursorModeLockCursor(bool left,
-                                            bool right,
-                                            bool up,
-                                            bool down) = 0;
-  virtual void FallbackCursorModeSetCursorVisibility(bool visible) = 0;
-
   // Returns the size of visible viewport in screen space, in DIPs.
   virtual gfx::Size GetRootWidgetViewportSize() = 0;
+
+  // Called when an invalid input event source is sent from the renderer.
+  virtual void OnInvalidInputEventSource() = 0;
 };
 
 } // namespace content
diff --git a/chromium/content/browser/renderer_host/input/input_router_impl.cc b/chromium/content/browser/renderer_host/input/input_router_impl.cc
index 2d5fbd08c75..a7a2b26cd94 100644
--- a/chromium/content/browser/renderer_host/input/input_router_impl.cc
+++ b/chromium/content/browser/renderer_host/input/input_router_impl.cc
@@ -17,7 +17,6 @@
 #include "content/browser/renderer_host/input/input_disposition_handler.h"
 #include "content/browser/renderer_host/input/input_router_client.h"
 #include "content/common/content_constants_internal.h"
-#include "content/common/edit_command.h"
 #include "content/common/input/input_handler.mojom.h"
 #include "content/common/input/web_touch_event_traits.h"
 #include "content/common/input_messages.h"
@@ -27,6 +26,7 @@
 #include "content/public/common/input_event_ack_state.h"
 #include "ipc/ipc_sender.h"
 #include "services/tracing/public/cpp/perfetto/flow_event_utils.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/blink_event_util.h"
 #include "ui/events/blink/blink_features.h"
 #include "ui/events/blink/web_input_event_traits.h"
@@ -47,11 +47,11 @@ using ui::WebInputEventTraits;
 
 namespace {
 
-bool WasHandled(InputEventAckState state) {
+bool WasHandled(blink::mojom::InputEventResultState state) {
   switch (state) {
-    case INPUT_EVENT_ACK_STATE_CONSUMED:
-    case INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS:
-    case INPUT_EVENT_ACK_STATE_UNKNOWN:
+    case blink::mojom::InputEventResultState::kConsumed:
+    case blink::mojom::InputEventResultState::kNoConsumerExists:
+    case blink::mojom::InputEventResultState::kUnknown:
       return true;
     default:
       return false;
@@ -90,9 +90,7 @@ InputRouterImpl::InputRouterImpl(
                            this,
                            fling_scheduler_client,
                            config.gesture_config),
-      device_scale_factor_(1.f),
-      compositor_touch_action_enabled_(
-          base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {
+      device_scale_factor_(1.f) {
   weak_this_ = weak_ptr_factory_.GetWeakPtr();
 
   DCHECK(client);
@@ -106,15 +104,15 @@ InputRouterImpl::~InputRouterImpl() {}
 void InputRouterImpl::SendMouseEvent(
     const MouseEventWithLatencyInfo& mouse_event,
     MouseEventCallback event_result_callback) {
-  if ((mouse_event.event.GetType() == WebInputEvent::kMouseDown &&
+  if ((mouse_event.event.GetType() == WebInputEvent::Type::kMouseDown &&
        gesture_event_queue_.GetTouchpadTapSuppressionController()
            ->ShouldSuppressMouseDown(mouse_event)) ||
-      (mouse_event.event.GetType() == WebInputEvent::kMouseUp &&
+      (mouse_event.event.GetType() == WebInputEvent::Type::kMouseUp &&
        gesture_event_queue_.GetTouchpadTapSuppressionController()
            ->ShouldSuppressMouseUp())) {
     std::move(event_result_callback)
-        .Run(mouse_event, InputEventAckSource::BROWSER,
-             INPUT_EVENT_ACK_STATE_IGNORED);
+        .Run(mouse_event, blink::mojom::InputEventResultSource::kBrowser,
+             blink::mojom::InputEventResultState::kIgnored);
     return;
   }
 
@@ -146,16 +144,15 @@ void InputRouterImpl::SendGestureEvent(
 
   if (gesture_event_queue_.PassToFlingController(gesture_event)) {
     TRACE_EVENT_INSTANT0("input", "FilteredForFling", TRACE_EVENT_SCOPE_THREAD);
-    disposition_handler_->OnGestureEventAck(gesture_event,
-                                            InputEventAckSource::BROWSER,
-                                            INPUT_EVENT_ACK_STATE_CONSUMED);
+    disposition_handler_->OnGestureEventAck(
+        gesture_event, blink::mojom::InputEventResultSource::kBrowser,
+        blink::mojom::InputEventResultState::kConsumed);
     return;
   }
 
   FilterGestureEventResult result =
       touch_action_filter_.FilterGestureEvent(&gesture_event.event);
-  if (compositor_touch_action_enabled_ &&
-      result == FilterGestureEventResult::kFilterGestureEventDelayed) {
+  if (result == FilterGestureEventResult::kFilterGestureEventDelayed) {
     TRACE_EVENT_INSTANT0("input", "DeferredForTouchAction",
                          TRACE_EVENT_SCOPE_THREAD);
     gesture_event_queue_.QueueDeferredEvents(gesture_event);
@@ -174,9 +171,9 @@ void InputRouterImpl::SendGestureEventWithoutQueueing(
       FilterGestureEventResult::kFilterGestureEventFiltered) {
     TRACE_EVENT_INSTANT0("input", "FilteredForTouchAction",
                          TRACE_EVENT_SCOPE_THREAD);
-    disposition_handler_->OnGestureEventAck(gesture_event,
-                                            InputEventAckSource::BROWSER,
-                                            INPUT_EVENT_ACK_STATE_CONSUMED);
+    disposition_handler_->OnGestureEventAck(
+        gesture_event, blink::mojom::InputEventResultSource::kBrowser,
+        blink::mojom::InputEventResultState::kConsumed);
     return;
   }
 
@@ -185,11 +182,11 @@ void InputRouterImpl::SendGestureEventWithoutQueueing(
   if (gesture_event.event.SourceDevice() ==
       blink::WebGestureDevice::kTouchscreen) {
     if (gesture_event.event.GetType() ==
-        blink::WebInputEvent::kGestureScrollBegin) {
+        blink::WebInputEvent::Type::kGestureScrollBegin) {
       touch_scroll_started_sent_ = false;
     } else if (!touch_scroll_started_sent_ &&
                gesture_event.event.GetType() ==
-                   blink::WebInputEvent::kGestureScrollUpdate) {
+                   blink::WebInputEvent::Type::kGestureScrollUpdate) {
       // A touch scroll hasn't really started until the first
       // GestureScrollUpdate event.  Eg. if the page consumes all touchmoves
       // then no scrolling really ever occurs (even though we still send
@@ -209,9 +206,9 @@ void InputRouterImpl::SendGestureEventWithoutQueueing(
   if (!gesture_event_queue_.DebounceOrForwardEvent(gesture_event)) {
     TRACE_EVENT_INSTANT0("input", "FilteredForDebounce",
                          TRACE_EVENT_SCOPE_THREAD);
-    disposition_handler_->OnGestureEventAck(gesture_event,
-                                            InputEventAckSource::BROWSER,
-                                            INPUT_EVENT_ACK_STATE_CONSUMED);
+    disposition_handler_->OnGestureEventAck(
+        gesture_event, blink::mojom::InputEventResultSource::kBrowser,
+        blink::mojom::InputEventResultState::kConsumed);
   }
 }
 
@@ -280,51 +277,33 @@ void InputRouterImpl::ProcessDeferredGestureEventQueue() {
   }
 }
 
-#if defined(OS_ANDROID)
-void InputRouterImpl::FallbackCursorModeLockCursor(bool left,
-                                                   bool right,
-                                                   bool up,
-                                                   bool down) {
-  client_->FallbackCursorModeLockCursor(left, right, up, down);
-}
-
-void InputRouterImpl::FallbackCursorModeSetCursorVisibility(bool visible) {
-  client_->FallbackCursorModeSetCursorVisibility(visible);
-}
-#endif
-
 void InputRouterImpl::SetTouchActionFromMain(cc::TouchAction touch_action) {
   TRACE_EVENT1("input", "InputRouterImpl::SetTouchActionFromMain",
                "touch_action", TouchActionToString(touch_action));
-  if (compositor_touch_action_enabled_) {
-    touch_action_filter_.OnSetTouchAction(touch_action);
-    touch_event_queue_.StopTimeoutMonitor();
-    ProcessDeferredGestureEventQueue();
-  }
+  touch_action_filter_.OnSetTouchAction(touch_action);
+  touch_event_queue_.StopTimeoutMonitor();
+  ProcessDeferredGestureEventQueue();
   UpdateTouchAckTimeoutEnabled();
 }
 
-void InputRouterImpl::SetWhiteListedTouchAction(cc::TouchAction touch_action,
-                                                uint32_t unique_touch_event_id,
-                                                InputEventAckState state) {
-  DCHECK(!compositor_touch_action_enabled_);
-  OnSetWhiteListedTouchAction(touch_action);
-}
-
 void InputRouterImpl::OnSetWhiteListedTouchAction(
     cc::TouchAction touch_action) {
+  TRACE_EVENT1("input", "InputRouterImpl::OnSetWhiteListedTouchAction",
+               "action", cc::TouchActionToString(touch_action));
   touch_action_filter_.OnSetWhiteListedTouchAction(touch_action);
   client_->OnSetWhiteListedTouchAction(touch_action);
-  if (compositor_touch_action_enabled_) {
-    if (touch_action == cc::TouchAction::kAuto)
-      FlushDeferredGestureQueue();
-    UpdateTouchAckTimeoutEnabled();
-  }
+  if (touch_action == cc::TouchAction::kAuto)
+    FlushDeferredGestureQueue();
+  UpdateTouchAckTimeoutEnabled();
 }
 
-void InputRouterImpl::DidOverscroll(const ui::DidOverscrollParams& params) {
+void InputRouterImpl::DidOverscroll(
+    blink::mojom::DidOverscrollParamsPtr params) {
   // Touchpad and Touchscreen flings are handled on the browser side.
-  ui::DidOverscrollParams fling_updated_params = params;
+  ui::DidOverscrollParams fling_updated_params = {
+      params->accumulated_overscroll, params->latest_overscroll_delta,
+      params->current_fling_velocity, params->causal_event_viewport_point,
+      params->overscroll_behavior};
   fling_updated_params.current_fling_velocity =
       gesture_event_queue_.CurrentFlingVelocity();
   client_->DidOverscroll(fling_updated_params);
@@ -356,20 +335,10 @@ void InputRouterImpl::RequestMouseLock(bool from_user_gesture,
                             std::move(response));
 }
 
-void InputRouterImpl::RequestMouseLockChange(
-    bool unadjusted_movement,
-    RequestMouseLockCallback response) {
-  client_->RequestMouseLockChange(unadjusted_movement, std::move(response));
-}
-
-void InputRouterImpl::UnlockMouse() {
-  client_->UnlockMouse();
-}
-
 void InputRouterImpl::SetMovementXYForTouchPoints(blink::WebTouchEvent* event) {
   for (size_t i = 0; i < event->touches_length; ++i) {
     blink::WebTouchPoint* touch_point = &event->touches[i];
-    if (touch_point->state == blink::WebTouchPoint::kStateMoved) {
+    if (touch_point->state == blink::WebTouchPoint::State::kStateMoved) {
       const gfx::Point& last_position = global_touch_position_[touch_point->id];
       touch_point->movement_x =
           touch_point->PositionInScreen().x() - last_position.x();
@@ -381,10 +350,11 @@ void InputRouterImpl::SetMovementXYForTouchPoints(blink::WebTouchEvent* event) {
     } else {
       touch_point->movement_x = 0;
       touch_point->movement_y = 0;
-      if (touch_point->state == blink::WebTouchPoint::kStateReleased ||
-          touch_point->state == blink::WebTouchPoint::kStateCancelled) {
+      if (touch_point->state == blink::WebTouchPoint::State::kStateReleased ||
+          touch_point->state == blink::WebTouchPoint::State::kStateCancelled) {
         global_touch_position_.erase(touch_point->id);
-      } else if (touch_point->state == blink::WebTouchPoint::kStatePressed) {
+      } else if (touch_point->state ==
+                 blink::WebTouchPoint::State::kStatePressed) {
         DCHECK(global_touch_position_.find(touch_point->id) ==
                global_touch_position_.end());
         global_touch_position_[touch_point->id] =
@@ -420,25 +390,17 @@ void InputRouterImpl::FlushDeferredGestureQueue() {
   ProcessDeferredGestureEventQueue();
 }
 
-void InputRouterImpl::OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                                      InputEventAckSource ack_source,
-                                      InputEventAckState ack_result) {
+void InputRouterImpl::OnTouchEventAck(
+    const TouchEventWithLatencyInfo& event,
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   if (WebTouchEventTraits::IsTouchSequenceStart(event.event)) {
     touch_action_filter_.AppendToGestureSequenceForDebugging("T");
     touch_action_filter_.AppendToGestureSequenceForDebugging(
-        base::NumberToString(ack_result).c_str());
+        base::NumberToString(static_cast<uint32_t>(ack_result)).c_str());
     touch_action_filter_.AppendToGestureSequenceForDebugging(
         base::NumberToString(event.event.unique_touch_event_id).c_str());
     touch_action_filter_.IncreaseActiveTouches();
-    // In certain corner cases, the ack for the touch start may not come with a
-    // touch action, then we should set the touch actions to Auto.
-    if (!compositor_touch_action_enabled_ &&
-        !touch_action_filter_.allowed_touch_action().has_value()) {
-      touch_action_filter_.OnSetTouchAction(cc::TouchAction::kAuto);
-      if (compositor_touch_action_enabled_)
-        touch_event_queue_.StopTimeoutMonitor();
-      UpdateTouchAckTimeoutEnabled();
-    }
   }
   disposition_handler_->OnTouchEventAck(event, ack_source, ack_result);
 
@@ -473,8 +435,8 @@ void InputRouterImpl::SendGestureEventImmediately(
 
 void InputRouterImpl::OnGestureEventAck(
     const GestureEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   touch_event_queue_.OnGestureEventAck(event, ack_result);
   disposition_handler_->OnGestureEventAck(event, ack_source, ack_result);
 }
@@ -508,8 +470,8 @@ void InputRouterImpl::SendMouseWheelEventImmediately(
 
 void InputRouterImpl::OnMouseWheelEventAck(
     const MouseWheelEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   disposition_handler_->OnWheelEventAck(event, ack_source, ack_result);
   gesture_event_queue_.OnWheelEventAck(event, ack_source, ack_result);
 }
@@ -528,8 +490,8 @@ void InputRouterImpl::SendMouseWheelEventForPinchImmediately(
 
 void InputRouterImpl::OnGestureEventForPinchAck(
     const GestureEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   OnGestureEventAck(event, ack_source, ack_result);
 }
 
@@ -563,14 +525,14 @@ void InputRouterImpl::FilterAndSendWebInputEvent(
               });
 
   output_stream_validator_.Validate(input_event);
-  InputEventAckState filtered_state =
+  blink::mojom::InputEventResultState filtered_state =
       client_->FilterInputEvent(input_event, latency_info);
   if (WasHandled(filtered_state)) {
     TRACE_EVENT_INSTANT0("input", "InputEventFiltered",
                          TRACE_EVENT_SCOPE_THREAD);
-    if (filtered_state != INPUT_EVENT_ACK_STATE_UNKNOWN) {
-      std::move(callback).Run(InputEventAckSource::BROWSER, latency_info,
-                              filtered_state, base::nullopt, base::nullopt);
+    if (filtered_state != blink::mojom::InputEventResultState::kUnknown) {
+      std::move(callback).Run(blink::mojom::InputEventResultSource::kBrowser,
+                              latency_info, filtered_state, nullptr, nullptr);
     }
     return;
   }
@@ -581,32 +543,54 @@ void InputRouterImpl::FilterAndSendWebInputEvent(
     TRACE_EVENT_INSTANT0("input", "InputEventSentBlocking",
                          TRACE_EVENT_SCOPE_THREAD);
     client_->IncrementInFlightEventCount();
-    client_->GetWidgetInputHandler()->DispatchEvent(std::move(event),
-                                                    std::move(callback));
+    mojom::WidgetInputHandler::DispatchEventCallback renderer_callback =
+        base::BindOnce(
+            [](mojom::WidgetInputHandler::DispatchEventCallback callback,
+               base::WeakPtr<InputRouterImpl> input_router,
+               blink::mojom::InputEventResultSource source,
+               const ui::LatencyInfo& latency,
+               blink::mojom::InputEventResultState state,
+               blink::mojom::DidOverscrollParamsPtr overscroll,
+               blink::mojom::TouchActionOptionalPtr touch_action) {
+              // Filter source to ensure only valid values are sent from the
+              // renderer.
+              if (source == blink::mojom::InputEventResultSource::kBrowser) {
+                if (input_router)
+                  input_router->client_->OnInvalidInputEventSource();
+                return;
+              }
+
+              std::move(callback).Run(source, latency, state,
+                                      std::move(overscroll),
+                                      std::move(touch_action));
+            },
+            std::move(callback), weak_this_);
+    client_->GetWidgetInputHandler()->DispatchEvent(
+        std::move(event), std::move(renderer_callback));
   } else {
     TRACE_EVENT_INSTANT0("input", "InputEventSentNonBlocking",
                          TRACE_EVENT_SCOPE_THREAD);
     client_->GetWidgetInputHandler()->DispatchNonBlockingEvent(
         std::move(event));
-    std::move(callback).Run(InputEventAckSource::BROWSER, latency_info,
-                            INPUT_EVENT_ACK_STATE_IGNORED, base::nullopt,
-                            base::nullopt);
+    std::move(callback).Run(
+        blink::mojom::InputEventResultSource::kBrowser, latency_info,
+        blink::mojom::InputEventResultState::kIgnored, nullptr, nullptr);
   }
 }
 
 void InputRouterImpl::KeyboardEventHandled(
     const NativeWebKeyboardEventWithLatencyInfo& event,
     KeyboardEventCallback event_result_callback,
-    InputEventAckSource source,
+    blink::mojom::InputEventResultSource source,
     const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
+    blink::mojom::InputEventResultState state,
+    blink::mojom::DidOverscrollParamsPtr overscroll,
+    blink::mojom::TouchActionOptionalPtr touch_action) {
   TRACE_EVENT2("input", "InputRouterImpl::KeboardEventHandled", "type",
                WebInputEvent::GetName(event.event.GetType()), "ack",
-               InputEventAckStateToString(state));
+               InputEventResultStateToString(state));
 
-  if (source != InputEventAckSource::BROWSER)
+  if (source != blink::mojom::InputEventResultSource::kBrowser)
     client_->DecrementInFlightEventCount(source);
   event.latency.AddNewLatencyFrom(latency);
   std::move(event_result_callback).Run(event, source, state);
@@ -620,16 +604,16 @@ void InputRouterImpl::KeyboardEventHandled(
 void InputRouterImpl::MouseEventHandled(
     const MouseEventWithLatencyInfo& event,
     MouseEventCallback event_result_callback,
-    InputEventAckSource source,
+    blink::mojom::InputEventResultSource source,
     const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
+    blink::mojom::InputEventResultState state,
+    blink::mojom::DidOverscrollParamsPtr overscroll,
+    blink::mojom::TouchActionOptionalPtr touch_action) {
   TRACE_EVENT2("input", "InputRouterImpl::MouseEventHandled", "type",
                WebInputEvent::GetName(event.event.GetType()), "ack",
-               InputEventAckStateToString(state));
+               InputEventResultStateToString(state));
 
-  if (source != InputEventAckSource::BROWSER)
+  if (source != blink::mojom::InputEventResultSource::kBrowser)
     client_->DecrementInFlightEventCount(source);
   event.latency.AddNewLatencyFrom(latency);
   std::move(event_result_callback).Run(event, source, state);
@@ -637,32 +621,28 @@ void InputRouterImpl::MouseEventHandled(
 
 void InputRouterImpl::TouchEventHandled(
     const TouchEventWithLatencyInfo& touch_event,
-    InputEventAckSource source,
+    blink::mojom::InputEventResultSource source,
     const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
+    blink::mojom::InputEventResultState state,
+    blink::mojom::DidOverscrollParamsPtr overscroll,
+    blink::mojom::TouchActionOptionalPtr touch_action) {
   TRACE_EVENT2("input", "InputRouterImpl::TouchEventHandled", "type",
                WebInputEvent::GetName(touch_event.event.GetType()), "ack",
-               InputEventAckStateToString(state));
-  if (source != InputEventAckSource::BROWSER)
+               InputEventResultStateToString(state));
+  if (source != blink::mojom::InputEventResultSource::kBrowser)
     client_->DecrementInFlightEventCount(source);
   touch_event.latency.AddNewLatencyFrom(latency);
 
   // The SetTouchAction IPC occurs on a different channel so always
   // send it in the input event ack to ensure it is available at the
   // time the ACK is handled.
-  if (touch_action.has_value()) {
-    if (!compositor_touch_action_enabled_) {
-      OnSetTouchAction(touch_action.value());
-    } else {
-      if (source == InputEventAckSource::COMPOSITOR_THREAD)
-        OnSetWhiteListedTouchAction(touch_action.value());
-      else if (source == InputEventAckSource::MAIN_THREAD)
-        OnSetTouchAction(touch_action.value());
-      else
-        NOTREACHED();
-    }
+  if (touch_action) {
+    if (source == blink::mojom::InputEventResultSource::kCompositorThread)
+      OnSetWhiteListedTouchAction(touch_action->touch_action);
+    else if (source == blink::mojom::InputEventResultSource::kMainThread)
+      OnSetTouchAction(touch_action->touch_action);
+    else
+      NOTREACHED();
   }
 
   // TODO(crbug.com/953547): find a proper way to stop the timeout monitor.
@@ -675,21 +655,21 @@ void InputRouterImpl::TouchEventHandled(
 
 void InputRouterImpl::GestureEventHandled(
     const GestureEventWithLatencyInfo& gesture_event,
-    InputEventAckSource source,
+    blink::mojom::InputEventResultSource source,
     const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
+    blink::mojom::InputEventResultState state,
+    blink::mojom::DidOverscrollParamsPtr overscroll,
+    blink::mojom::TouchActionOptionalPtr touch_action) {
   TRACE_EVENT2("input", "InputRouterImpl::GestureEventHandled", "type",
                WebInputEvent::GetName(gesture_event.event.GetType()), "ack",
-               InputEventAckStateToString(state));
-  if (source != InputEventAckSource::BROWSER)
+               InputEventResultStateToString(state));
+  if (source != blink::mojom::InputEventResultSource::kBrowser)
     client_->DecrementInFlightEventCount(source);
 
   if (overscroll) {
-    DCHECK_EQ(WebInputEvent::kGestureScrollUpdate,
+    DCHECK_EQ(WebInputEvent::Type::kGestureScrollUpdate,
               gesture_event.event.GetType());
-    DidOverscroll(overscroll.value());
+    DidOverscroll(std::move(overscroll));
   }
 
   // |gesture_event_queue_| will forward to OnGestureEventAck when appropriate.
@@ -700,20 +680,20 @@ void InputRouterImpl::GestureEventHandled(
 void InputRouterImpl::MouseWheelEventHandled(
     const MouseWheelEventWithLatencyInfo& event,
     MouseWheelEventQueueClient::MouseWheelEventHandledCallback callback,
-    InputEventAckSource source,
+    blink::mojom::InputEventResultSource source,
     const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
+    blink::mojom::InputEventResultState state,
+    blink::mojom::DidOverscrollParamsPtr overscroll,
+    blink::mojom::TouchActionOptionalPtr touch_action) {
   TRACE_EVENT2("input", "InputRouterImpl::MouseWheelEventHandled", "type",
                WebInputEvent::GetName(event.event.GetType()), "ack",
-               InputEventAckStateToString(state));
-  if (source != InputEventAckSource::BROWSER)
+               InputEventResultStateToString(state));
+  if (source != blink::mojom::InputEventResultSource::kBrowser)
     client_->DecrementInFlightEventCount(source);
   event.latency.AddNewLatencyFrom(latency);
 
   if (overscroll)
-    DidOverscroll(overscroll.value());
+    DidOverscroll(std::move(overscroll));
 
   std::move(callback).Run(event, source, state);
 }
@@ -741,11 +721,9 @@ void InputRouterImpl::FlushTouchEventQueue() {
 void InputRouterImpl::ForceSetTouchActionAuto() {
   touch_action_filter_.AppendToGestureSequenceForDebugging("F");
   touch_action_filter_.OnSetTouchAction(cc::TouchAction::kAuto);
-  if (compositor_touch_action_enabled_) {
-    // TODO(xidachen): Call FlushDeferredGestureQueue when this flag is enabled.
-    touch_event_queue_.StopTimeoutMonitor();
-    ProcessDeferredGestureEventQueue();
-  }
+  // TODO(xidachen): Call FlushDeferredGestureQueue when this flag is enabled.
+  touch_event_queue_.StopTimeoutMonitor();
+  ProcessDeferredGestureEventQueue();
 }
 
 void InputRouterImpl::ForceResetTouchActionForTest() {
@@ -758,7 +736,7 @@ bool InputRouterImpl::IsFlingActiveForTest() {
 
 void InputRouterImpl::OnSetTouchAction(cc::TouchAction touch_action) {
   TRACE_EVENT1("input", "InputRouterImpl::OnSetTouchAction", "action",
-               touch_action);
+               cc::TouchActionToString(touch_action));
 
   // It is possible we get a touch action for a touch start that is no longer
   // in the queue. eg. Events that have fired the Touch ACK timeout.
@@ -769,8 +747,7 @@ void InputRouterImpl::OnSetTouchAction(cc::TouchAction touch_action) {
   touch_action_filter_.AppendToGestureSequenceForDebugging(
       base::NumberToString(static_cast<int>(touch_action)).c_str());
   touch_action_filter_.OnSetTouchAction(touch_action);
-  if (compositor_touch_action_enabled_)
-    touch_event_queue_.StopTimeoutMonitor();
+  touch_event_queue_.StopTimeoutMonitor();
 
   // TouchAction::kNone should disable the touch ack timeout.
   UpdateTouchAckTimeoutEnabled();
diff --git a/chromium/content/browser/renderer_host/input/input_router_impl.h b/chromium/content/browser/renderer_host/input/input_router_impl.h
index 439b1477110..47961159c83 100644
--- a/chromium/content/browser/renderer_host/input/input_router_impl.h
+++ b/chromium/content/browser/renderer_host/input/input_router_impl.h
@@ -14,7 +14,6 @@
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/time/time.h"
-#include "build/build_config.h"
 #include "cc/input/touch_action.h"
 #include "content/browser/renderer_host/input/fling_scheduler.h"
 #include "content/browser/renderer_host/input/gesture_event_queue.h"
@@ -28,13 +27,12 @@
 #include "content/common/input/input_handler.mojom.h"
 #include "content/common/widget.mojom.h"
 #include "content/public/browser/native_web_keyboard_event.h"
-#include "content/public/common/input_event_ack_source.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace ui {
 class LatencyInfo;
-struct DidOverscrollParams;
 }  // namespace ui
 
 namespace content {
@@ -92,18 +90,8 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
   void ForceSetTouchActionAuto() override;
 
   // InputHandlerHost impl
-#if defined(OS_ANDROID)
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override;
-  void FallbackCursorModeSetCursorVisibility(bool visible) override;
-#endif
   void SetTouchActionFromMain(cc::TouchAction touch_action) override;
-  void SetWhiteListedTouchAction(cc::TouchAction touch_action,
-                                 uint32_t unique_touch_event_id,
-                                 InputEventAckState state) override;
-  void DidOverscroll(const ui::DidOverscrollParams& params) override;
+  void DidOverscroll(blink::mojom::DidOverscrollParamsPtr params) override;
   void ImeCancelComposition() override;
   void DidStartScrollingViewport() override;
   void ImeCompositionRangeChanged(
@@ -114,9 +102,6 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
                         bool privileged,
                         bool unadjusted_movement,
                         RequestMouseLockCallback response) override;
-  void RequestMouseLockChange(bool unadjusted_movement,
-                              RequestMouseLockCallback response) override;
-  void UnlockMouse() override;
   void OnHasTouchEventHandlers(bool has_handlers) override;
   void WaitForInputProcessed(base::OnceClosure callback) override;
   void FlushTouchEventQueue() override;
@@ -148,17 +133,18 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
   void SendTouchEventImmediately(
       const TouchEventWithLatencyInfo& touch_event) override;
   void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
   void OnFilteringTouchEvent(const blink::WebTouchEvent& touch_event) override;
   void FlushDeferredGestureQueue() override;
 
   // GestureEventFilterClient
   void SendGestureEventImmediately(
       const GestureEventWithLatencyInfo& gesture_event) override;
-  void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                         InputEventAckSource ack_source,
-                         InputEventAckState ack_result) override;
+  void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override;
 
   // FlingControllerEventSenderClient
   void SendGeneratedWheelEvent(
@@ -172,9 +158,10 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
       const MouseWheelEventWithLatencyInfo& touch_event,
       MouseWheelEventQueueClient::MouseWheelEventHandledCallback callback)
       override;
-  void OnMouseWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                            InputEventAckSource ack_source,
-                            InputEventAckState ack_result) override;
+  void OnMouseWheelEventAck(
+      const MouseWheelEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override;
   void ForwardGestureEventWithLatencyInfo(
       const blink::WebGestureEvent& gesture_event,
       const ui::LatencyInfo& latency_info) override;
@@ -186,53 +173,50 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
       const MouseWheelEventWithLatencyInfo& event,
       TouchpadPinchEventQueueClient::MouseWheelEventHandledCallback callback)
       override;
-  void OnGestureEventForPinchAck(const GestureEventWithLatencyInfo& event,
-                                 InputEventAckSource ack_source,
-                                 InputEventAckState ack_result) override;
+  void OnGestureEventForPinchAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override;
 
   void FilterAndSendWebInputEvent(
       const blink::WebInputEvent& input_event,
       const ui::LatencyInfo& latency_info,
       mojom::WidgetInputHandler::DispatchEventCallback callback);
 
-  void KeyboardEventHandled(
-      const NativeWebKeyboardEventWithLatencyInfo& event,
-      KeyboardEventCallback event_result_callback,
-      InputEventAckSource source,
-      const ui::LatencyInfo& latency,
-      InputEventAckState state,
-      const base::Optional<ui::DidOverscrollParams>& overscroll,
-      const base::Optional<cc::TouchAction>& touch_action);
-  void MouseEventHandled(
-      const MouseEventWithLatencyInfo& event,
-      MouseEventCallback event_result_callback,
-      InputEventAckSource source,
-      const ui::LatencyInfo& latency,
-      InputEventAckState state,
-      const base::Optional<ui::DidOverscrollParams>& overscroll,
-      const base::Optional<cc::TouchAction>& touch_action);
-  void TouchEventHandled(
-      const TouchEventWithLatencyInfo& touch_event,
-      InputEventAckSource source,
-      const ui::LatencyInfo& latency,
-      InputEventAckState state,
-      const base::Optional<ui::DidOverscrollParams>& overscroll,
-      const base::Optional<cc::TouchAction>& touch_action);
-  void GestureEventHandled(
-      const GestureEventWithLatencyInfo& gesture_event,
-      InputEventAckSource source,
-      const ui::LatencyInfo& latency,
-      InputEventAckState state,
-      const base::Optional<ui::DidOverscrollParams>& overscroll,
-      const base::Optional<cc::TouchAction>& touch_action);
+  void KeyboardEventHandled(const NativeWebKeyboardEventWithLatencyInfo& event,
+                            KeyboardEventCallback event_result_callback,
+                            blink::mojom::InputEventResultSource source,
+                            const ui::LatencyInfo& latency,
+                            blink::mojom::InputEventResultState state,
+                            blink::mojom::DidOverscrollParamsPtr overscroll,
+                            blink::mojom::TouchActionOptionalPtr touch_action);
+  void MouseEventHandled(const MouseEventWithLatencyInfo& event,
+                         MouseEventCallback event_result_callback,
+                         blink::mojom::InputEventResultSource source,
+                         const ui::LatencyInfo& latency,
+                         blink::mojom::InputEventResultState state,
+                         blink::mojom::DidOverscrollParamsPtr overscroll,
+                         blink::mojom::TouchActionOptionalPtr touch_action);
+  void TouchEventHandled(const TouchEventWithLatencyInfo& touch_event,
+                         blink::mojom::InputEventResultSource source,
+                         const ui::LatencyInfo& latency,
+                         blink::mojom::InputEventResultState state,
+                         blink::mojom::DidOverscrollParamsPtr overscroll,
+                         blink::mojom::TouchActionOptionalPtr touch_action);
+  void GestureEventHandled(const GestureEventWithLatencyInfo& gesture_event,
+                           blink::mojom::InputEventResultSource source,
+                           const ui::LatencyInfo& latency,
+                           blink::mojom::InputEventResultState state,
+                           blink::mojom::DidOverscrollParamsPtr overscroll,
+                           blink::mojom::TouchActionOptionalPtr touch_action);
   void MouseWheelEventHandled(
       const MouseWheelEventWithLatencyInfo& event,
       MouseWheelEventQueueClient::MouseWheelEventHandledCallback callback,
-      InputEventAckSource source,
+      blink::mojom::InputEventResultSource source,
       const ui::LatencyInfo& latency,
-      InputEventAckState state,
-      const base::Optional<ui::DidOverscrollParams>& overscroll,
-      const base::Optional<cc::TouchAction>& touch_action);
+      blink::mojom::InputEventResultState state,
+      blink::mojom::DidOverscrollParamsPtr overscroll,
+      blink::mojom::TouchActionOptionalPtr touch_action);
 
   // Called when a touch timeout-affecting bit has changed, in turn toggling the
   // touch ack timeout feature of the |touch_event_queue_| as appropriate. Input
@@ -265,8 +249,6 @@ class CONTENT_EXPORT InputRouterImpl : public InputRouter,
 
   float device_scale_factor_;
 
-  bool compositor_touch_action_enabled_;
-
   // Last touch position relative to screen. Used to compute movementX/Y.
   base::flat_map<int, gfx::Point> global_touch_position_;
 
diff --git a/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc b/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
index 64694ba9138..d70d6c359f8 100644
--- a/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
@@ -28,7 +28,6 @@
 #include "content/browser/renderer_host/input/mock_input_disposition_handler.h"
 #include "content/browser/renderer_host/input/mock_input_router_client.h"
 #include "content/common/content_constants_internal.h"
-#include "content/common/edit_command.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/common/input_messages.h"
 #include "content/public/common/content_features.h"
@@ -84,7 +83,7 @@ WebInputEvent& GetEventWithType(WebInputEvent::Type type) {
   } else if (WebInputEvent::IsGestureEventType(type)) {
     static WebGestureEvent gesture;
     event = &gesture;
-  } else if (type == WebInputEvent::kMouseWheel) {
+  } else if (type == WebInputEvent::Type::kMouseWheel) {
     static WebMouseWheelEvent wheel;
     event = &wheel;
   }
@@ -117,29 +116,17 @@ class MockInputRouterImplClient : public InputRouterImplClient {
                         mojom::WidgetInputHandlerHost::RequestMouseLockCallback
                             response) override {}
 
-  void RequestMouseLockChange(
-      bool unadjusted_movement,
-      mojom::WidgetInputHandlerHost::RequestMouseLockCallback response)
-      override {}
-
-  void UnlockMouse() override {}
-
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override {}
-
-  void FallbackCursorModeSetCursorVisibility(bool visible) override {}
-
   gfx::Size GetRootWidgetViewportSize() override {
     return gfx::Size(1920, 1080);
   }
 
+  void OnInvalidInputEventSource() override {}
+
   MockWidgetInputHandler::MessageVector GetAndResetDispatchedMessages() {
     return widget_input_handler_.GetAndResetDispatchedMessages();
   }
 
-  InputEventAckState FilterInputEvent(
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event,
       const ui::LatencyInfo& latency_info) override {
     return input_router_client_.FilterInputEvent(input_event, latency_info);
@@ -149,7 +136,8 @@ class MockInputRouterImplClient : public InputRouterImplClient {
     input_router_client_.IncrementInFlightEventCount();
   }
 
-  void DecrementInFlightEventCount(InputEventAckSource ack_source) override {
+  void DecrementInFlightEventCount(
+      blink::mojom::InputEventResultSource ack_source) override {
     input_router_client_.DecrementInFlightEventCount(ack_source);
   }
 
@@ -203,13 +191,13 @@ class MockInputRouterImplClient : public InputRouterImplClient {
     input_router_client_.set_input_router(input_router);
   }
 
-  void set_filter_state(InputEventAckState filter_state) {
+  void set_filter_state(blink::mojom::InputEventResultState filter_state) {
     input_router_client_.set_filter_state(filter_state);
   }
   int in_flight_event_count() const {
     return input_router_client_.in_flight_event_count();
   }
-  int last_in_flight_event_type() const {
+  blink::WebInputEvent::Type last_in_flight_event_type() const {
     return input_router_client_.last_in_flight_event_type();
   }
   void set_allow_send_event(bool allow) {
@@ -303,14 +291,14 @@ class InputRouterImplTestBase : public testing::Test {
   }
 
   void SimulateGestureEvent(WebGestureEvent gesture) {
-    if (gesture.GetType() == WebInputEvent::kGestureScrollBegin &&
+    if (gesture.GetType() == WebInputEvent::Type::kGestureScrollBegin &&
         gesture.SourceDevice() == blink::WebGestureDevice::kTouchscreen &&
         !gesture.data.scroll_begin.delta_x_hint &&
         !gesture.data.scroll_begin.delta_y_hint) {
       // Ensure non-zero scroll-begin offset-hint to make the event sane,
       // prevents unexpected filtering at TouchActionFilter.
       gesture.data.scroll_begin.delta_y_hint = 2.f;
-    } else if (gesture.GetType() == WebInputEvent::kGestureFlingStart &&
+    } else if (gesture.GetType() == WebInputEvent::Type::kGestureFlingStart &&
                gesture.SourceDevice() ==
                    blink::WebGestureDevice::kTouchscreen &&
                !gesture.data.fling_start.velocity_x &&
@@ -319,7 +307,7 @@ class InputRouterImplTestBase : public testing::Test {
       // validate against such. The velocity should be large enough to make
       // sure that the fling is still active while sending the GFC.
       gesture.data.fling_start.velocity_x = 500.f;
-    } else if (gesture.GetType() == WebInputEvent::kGestureFlingCancel) {
+    } else if (gesture.GetType() == WebInputEvent::Type::kGestureFlingCancel) {
       // Set prevent boosting to make sure that the GFC cancels the active
       // fling.
       gesture.data.fling_cancel.prevent_boosting = true;
@@ -358,7 +346,7 @@ class InputRouterImplTestBase : public testing::Test {
                                                      int modifiers) {
     DCHECK(blink::WebInputEvent::IsPinchGestureEventType(type));
     WebGestureEvent event =
-        (type == blink::WebInputEvent::kGesturePinchUpdate
+        (type == blink::WebInputEvent::Type::kGesturePinchUpdate
              ? SyntheticWebGestureEventBuilder::BuildPinchUpdate(
                    scale, anchor_x, anchor_y, modifiers,
                    blink::WebGestureDevice::kTouchpad)
@@ -426,13 +414,6 @@ class InputRouterImplTestBase : public testing::Test {
     input_router_->SetTouchActionFromMain(cc::TouchAction::kNone);
   }
 
-  void OnSetWhiteListedTouchAction(cc::TouchAction white_listed_touch_action,
-                                   uint32_t unique_touch_event_id,
-                                   InputEventAckState ack_result) {
-    input_router_->SetWhiteListedTouchAction(white_listed_touch_action,
-                                             unique_touch_event_id, ack_result);
-  }
-
   void ResetTouchAction() {
     input_router_->touch_action_filter_.ResetTouchAction();
   }
@@ -457,50 +438,41 @@ class InputRouterImplTestBase : public testing::Test {
   }
 
   void ActiveTouchSequenceCountTest(
-      const base::Optional<cc::TouchAction>& touch_action,
-      InputEventAckState state) {
+      blink::mojom::TouchActionOptionalPtr touch_action,
+      blink::mojom::InputEventResultState state) {
     PressTouchPoint(1, 1);
-    base::Optional<ui::DidOverscrollParams> overscroll;
     input_router_->SendTouchEvent(TouchEventWithLatencyInfo(touch_event_));
-    input_router_->TouchEventHandled(TouchEventWithLatencyInfo(touch_event_),
-                                     InputEventAckSource::MAIN_THREAD,
-                                     ui::LatencyInfo(), state, overscroll,
-                                     touch_action);
+    input_router_->TouchEventHandled(
+        TouchEventWithLatencyInfo(touch_event_),
+        blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+        state, nullptr, std::move(touch_action));
     EXPECT_EQ(input_router_->touch_action_filter_.num_of_active_touches_, 1);
     ReleaseTouchPoint(0);
-    input_router_->OnTouchEventAck(TouchEventWithLatencyInfo(touch_event_),
-                                   InputEventAckSource::MAIN_THREAD, state);
+    input_router_->OnTouchEventAck(
+        TouchEventWithLatencyInfo(touch_event_),
+        blink::mojom::InputEventResultSource::kMainThread, state);
     EXPECT_EQ(input_router_->touch_action_filter_.num_of_active_touches_, 0);
   }
 
-  void StopTimeoutMonitorTest(bool compositor_touch_action_enabled) {
+  void StopTimeoutMonitorTest() {
     ResetTouchAction();
     PressTouchPoint(1, 1);
-    base::Optional<ui::DidOverscrollParams> overscroll;
-    base::Optional<cc::TouchAction> touch_action = cc::TouchAction::kPan;
     input_router_->SendTouchEvent(TouchEventWithLatencyInfo(touch_event_));
     EXPECT_TRUE(input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
     input_router_->TouchEventHandled(
         TouchEventWithLatencyInfo(touch_event_),
-        compositor_touch_action_enabled ? InputEventAckSource::COMPOSITOR_THREAD
-                                        : InputEventAckSource::MAIN_THREAD,
-        ui::LatencyInfo(), INPUT_EVENT_ACK_STATE_NOT_CONSUMED, overscroll,
-        touch_action);
-    if (compositor_touch_action_enabled) {
-      EXPECT_TRUE(
-          input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
-      input_router_->SetTouchActionFromMain(cc::TouchAction::kPan);
-      EXPECT_FALSE(
-          input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
-    } else {
-      EXPECT_FALSE(
-          input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
-    }
+        blink::mojom::InputEventResultSource::kCompositorThread,
+        ui::LatencyInfo(), blink::mojom::InputEventResultState::kNotConsumed,
+        nullptr, blink::mojom::TouchActionOptional::New(cc::TouchAction::kPan));
+    EXPECT_TRUE(input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
+    input_router_->SetTouchActionFromMain(cc::TouchAction::kPan);
+    EXPECT_FALSE(
+        input_router_->touch_event_queue_.IsTimeoutRunningForTesting());
   }
 
   void OnTouchEventAckWithAckState(
-      InputEventAckSource source,
-      InputEventAckState ack_state,
+      blink::mojom::InputEventResultSource source,
+      blink::mojom::InputEventResultState ack_state,
       base::Optional<cc::TouchAction> expected_touch_action,
       base::Optional<cc::TouchAction> expected_white_listed_touch_action) {
     input_router_->OnHasTouchEventHandlers(true);
@@ -526,18 +498,9 @@ class InputRouterImplTestBase : public testing::Test {
   SyntheticWebTouchEvent touch_event_;
 };
 
-class InputRouterImplTest : public InputRouterImplTestBase,
-                            public testing::WithParamInterface<bool> {
+class InputRouterImplTest : public InputRouterImplTestBase {
  public:
-  InputRouterImplTest() : compositor_touch_action_enabled_(GetParam()) {
-    if (GetParam()) {
-      touch_action_feature_list_.InitAndEnableFeature(
-          features::kCompositorTouchAction);
-    } else {
-      touch_action_feature_list_.InitAndDisableFeature(
-          features::kCompositorTouchAction);
-    }
-  }
+  InputRouterImplTest() = default;
 
   base::Optional<cc::TouchAction> AllowedTouchAction() {
     return input_router_->touch_action_filter_.allowed_touch_action_;
@@ -546,21 +509,13 @@ class InputRouterImplTest : public InputRouterImplTestBase,
   cc::TouchAction WhiteListedTouchAction() {
     return input_router_->touch_action_filter_.white_listed_touch_action_;
   }
-
- protected:
-  const bool compositor_touch_action_enabled_;
-
- private:
-  base::test::ScopedFeatureList touch_action_feature_list_;
 };
 
-INSTANTIATE_TEST_SUITE_P(All, InputRouterImplTest, ::testing::Bool());
-
-TEST_P(InputRouterImplTest, HandledInputEvent) {
-  client_->set_filter_state(INPUT_EVENT_ACK_STATE_CONSUMED);
+TEST_F(InputRouterImplTest, HandledInputEvent) {
+  client_->set_filter_state(blink::mojom::InputEventResultState::kConsumed);
 
   // Simulate a keyboard event.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure no input event is sent to the renderer.
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
@@ -570,11 +525,12 @@ TEST_P(InputRouterImplTest, HandledInputEvent) {
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
 }
 
-TEST_P(InputRouterImplTest, ClientCanceledKeyboardEvent) {
-  client_->set_filter_state(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+TEST_F(InputRouterImplTest, ClientCanceledKeyboardEvent) {
+  client_->set_filter_state(
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   // Simulate a keyboard event that has no consumer.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure no input event is sent to the renderer.
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
@@ -582,8 +538,8 @@ TEST_P(InputRouterImplTest, ClientCanceledKeyboardEvent) {
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
 
   // Simulate a keyboard event that should be dropped.
-  client_->set_filter_state(INPUT_EVENT_ACK_STATE_UNKNOWN);
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  client_->set_filter_state(blink::mojom::InputEventResultState::kUnknown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure no input event is sent to the renderer, and no ack is sent.
   dispatched_messages = GetAndResetDispatchedMessages();
@@ -593,22 +549,22 @@ TEST_P(InputRouterImplTest, ClientCanceledKeyboardEvent) {
 
 // Tests ported from RenderWidgetHostTest --------------------------------------
 
-TEST_P(InputRouterImplTest, HandleKeyEventsWeSent) {
+TEST_F(InputRouterImplTest, HandleKeyEventsWeSent) {
   // Simulate a keyboard event.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure we sent the input event to the renderer.
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             disposition_handler_->acked_keyboard_event().GetType());
 }
 
-TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
+TEST_F(InputRouterImplTest, CoalescesWheelEvents) {
   // Simulate wheel events.
   SimulateWheelEvent(0, 0, 0, -5, 0, false,
                      WebMouseWheelEvent::kPhaseBegan);  // sent directly
@@ -631,7 +587,7 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
   const WebMouseWheelEvent* wheel_event =
       static_cast<const WebMouseWheelEvent*>(
@@ -641,7 +597,7 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
   // Check that the ACK sends the second message immediately.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   // The coalesced events can queue up a delayed ack
   // so that additional input events can be processed before
   // we turn off coalescing.
@@ -650,7 +606,7 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
   wheel_event = static_cast<const WebMouseWheelEvent*>(
       dispatched_messages[0]->ToEvent()->Event()->web_event.get());
@@ -659,13 +615,13 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
   // Ack the second event (which had the third coalesced into it).
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
   wheel_event = static_cast<const WebMouseWheelEvent*>(
       dispatched_messages[0]->ToEvent()->Event()->web_event.get());
@@ -674,13 +630,13 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
   // Ack the fourth event.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
   wheel_event = static_cast<const WebMouseWheelEvent*>(
       dispatched_messages[0]->ToEvent()->Event()->web_event.get());
@@ -689,13 +645,13 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
   // Ack the fifth event.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
   wheel_event = static_cast<const WebMouseWheelEvent*>(
       dispatched_messages[0]->ToEvent()->Event()->web_event.get());
@@ -705,7 +661,7 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
   // After the final ack, the queue should be empty.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   dispatched_messages = GetAndResetDispatchedMessages();
@@ -714,114 +670,89 @@ TEST_P(InputRouterImplTest, CoalescesWheelEvents) {
 
 // Test that the active touch sequence count increment when the touch start is
 // not ACKed from the main thread.
-TEST_P(InputRouterImplTest, ActiveTouchSequenceCountWithoutTouchAction) {
-  base::Optional<cc::TouchAction> touch_action;
-  ActiveTouchSequenceCountTest(touch_action,
-                               INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+TEST_F(InputRouterImplTest, ActiveTouchSequenceCountWithoutTouchAction) {
+  ActiveTouchSequenceCountTest(
+      nullptr, blink::mojom::InputEventResultState::kSetNonBlocking);
 }
 
-TEST_P(InputRouterImplTest,
+TEST_F(InputRouterImplTest,
        ActiveTouchSequenceCountWithoutTouchActionNoConsumer) {
-  base::Optional<cc::TouchAction> touch_action;
-  ActiveTouchSequenceCountTest(touch_action,
-                               INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  ActiveTouchSequenceCountTest(
+      nullptr, blink::mojom::InputEventResultState::kNoConsumerExists);
 }
 
 // Test that the active touch sequence count increment when the touch start is
 // ACKed from the main thread.
-TEST_P(InputRouterImplTest, ActiveTouchSequenceCountWithTouchAction) {
-  base::Optional<cc::TouchAction> touch_action(cc::TouchAction::kPanY);
-  ActiveTouchSequenceCountTest(touch_action,
-                               INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+TEST_F(InputRouterImplTest, ActiveTouchSequenceCountWithTouchAction) {
+  ActiveTouchSequenceCountTest(
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kPanY),
+      blink::mojom::InputEventResultState::kSetNonBlocking);
 }
 
-TEST_P(InputRouterImplTest, ActiveTouchSequenceCountWithTouchActionNoConsumer) {
-  base::Optional<cc::TouchAction> touch_action(cc::TouchAction::kPanY);
-  ActiveTouchSequenceCountTest(touch_action,
-                               INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+TEST_F(InputRouterImplTest, ActiveTouchSequenceCountWithTouchActionNoConsumer) {
+  ActiveTouchSequenceCountTest(
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kPanY),
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateConsumed) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateConsumed) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source, INPUT_EVENT_ACK_STATE_CONSUMED,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kConsumed, expected_touch_action,
+      cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateNotConsumed) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateNotConsumed) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source, INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kNotConsumed, expected_touch_action,
+      cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateConsumedShouldBubble) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateConsumedShouldBubble) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source,
-                              INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kConsumedShouldBubble,
+      expected_touch_action, cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateNoConsumerExists) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateNoConsumerExists) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source, INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kNoConsumerExists,
+      expected_touch_action, cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateIgnored) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateIgnored) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source, INPUT_EVENT_ACK_STATE_IGNORED,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kIgnored, expected_touch_action,
+      cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateNonBlocking) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateNonBlocking) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
-  OnTouchEventAckWithAckState(source, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
-                              expected_touch_action, cc::TouchAction::kAuto);
+  OnTouchEventAckWithAckState(
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kSetNonBlocking,
+      expected_touch_action, cc::TouchAction::kAuto);
 }
 
-TEST_P(InputRouterImplTest, TouchActionAutoWithAckStateNonBlockingDueToFling) {
-  InputEventAckSource source = compositor_touch_action_enabled_
-                                   ? InputEventAckSource::COMPOSITOR_THREAD
-                                   : InputEventAckSource::MAIN_THREAD;
+TEST_F(InputRouterImplTest, TouchActionAutoWithAckStateNonBlockingDueToFling) {
   base::Optional<cc::TouchAction> expected_touch_action;
-  if (!compositor_touch_action_enabled_)
-    expected_touch_action = cc::TouchAction::kAuto;
   OnTouchEventAckWithAckState(
-      source, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING,
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      blink::mojom::InputEventResultState::kSetNonBlockingDueToFling,
       expected_touch_action, cc::TouchAction::kAuto);
 }
 
 // Tests that touch-events are sent properly.
-TEST_P(InputRouterImplTest, TouchEventQueue) {
+TEST_F(InputRouterImplTest, TouchEventQueue) {
   OnHasTouchEventHandlers(true);
 
   PressTouchPoint(1, 1);
@@ -843,24 +774,26 @@ TEST_P(InputRouterImplTest, TouchEventQueue) {
   EXPECT_FALSE(TouchEventQueueEmpty());
 
   // Receive an ACK for the first touch-event.
-  touch_start_event[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  touch_start_event[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(TouchEventQueueEmpty());
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kTouchStart,
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart,
             disposition_handler_->acked_touch_event().event.GetType());
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
-  touch_move_event[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  touch_move_event[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_TRUE(TouchEventQueueEmpty());
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kTouchMove,
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove,
             disposition_handler_->acked_touch_event().event.GetType());
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 }
 
 // Tests that the touch-queue is emptied after a page stops listening for touch
 // events and the outstanding ack is received.
-TEST_P(InputRouterImplTest, TouchEventQueueFlush) {
+TEST_F(InputRouterImplTest, TouchEventQueueFlush) {
   OnHasTouchEventHandlers(true);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   EXPECT_TRUE(TouchEventQueueEmpty());
@@ -884,12 +817,12 @@ TEST_P(InputRouterImplTest, TouchEventQueueFlush) {
   // After the ack, the touch-event queue should be empty, and none of the
   // flushed touch-events should have been sent to the renderer.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   EXPECT_TRUE(TouchEventQueueEmpty());
 }
 
-TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
+TEST_F(InputRouterImplTest, UnhandledWheelEvent) {
   // Simulate wheel events.
   SimulateWheelEvent(0, 0, 0, -5, 0, false, WebMouseWheelEvent::kPhaseBegan);
   SimulateWheelEvent(0, 0, 0, -10, 0, false, WebMouseWheelEvent::kPhaseChanged);
@@ -901,7 +834,7 @@ TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
 
   // Indicate that the wheel event was unhandled.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // There should be a ScrollBegin, ScrollUpdate, second MouseWheel, and second
   // ScrollUpdate sent.
@@ -911,18 +844,18 @@ TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
   ASSERT_TRUE(dispatched_messages[1]->ToEvent());
   ASSERT_TRUE(dispatched_messages[2]->ToEvent());
   ASSERT_TRUE(dispatched_messages[3]->ToEvent());
-  ASSERT_EQ(WebInputEvent::kGestureScrollBegin,
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollBegin,
             dispatched_messages[0]->ToEvent()->Event()->web_event->GetType());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate,
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             dispatched_messages[1]->ToEvent()->Event()->web_event->GetType());
-  ASSERT_EQ(WebInputEvent::kMouseWheel,
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_messages[2]->ToEvent()->Event()->web_event->GetType());
-  ASSERT_EQ(WebInputEvent::kGestureScrollUpdate,
+  ASSERT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             dispatched_messages[3]->ToEvent()->Event()->web_event->GetType());
 
   // Indicate that the GestureScrollBegin event was consumed.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Check that the ack for the first MouseWheel, ScrollBegin, and the second
   // MouseWheel were processed.
@@ -931,12 +864,12 @@ TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
   // The last acked wheel event should be the second one since the input router
   // has already sent the immediate ack for the second wheel event.
   EXPECT_EQ(disposition_handler_->acked_wheel_event().delta_y, -10);
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_IGNORED,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kIgnored,
             disposition_handler_->acked_wheel_event_state());
 
   // Ack the first gesture scroll update.
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Check that the ack for the first ScrollUpdate were processed.
   EXPECT_EQ(
@@ -946,7 +879,7 @@ TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
 
   // Ack the second gesture scroll update.
   dispatched_messages[3]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Check that the ack for the second ScrollUpdate were processed.
   EXPECT_EQ(
@@ -955,15 +888,15 @@ TEST_P(InputRouterImplTest, UnhandledWheelEvent) {
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
 }
 
-TEST_P(InputRouterImplTest, TouchTypesIgnoringAck) {
+TEST_F(InputRouterImplTest, TouchTypesIgnoringAck) {
   OnHasTouchEventHandlers(true);
   // Only acks for TouchCancel should always be ignored.
+  ASSERT_TRUE(ShouldBlockEventStream(
+      GetEventWithType(WebInputEvent::Type::kTouchStart)));
+  ASSERT_TRUE(ShouldBlockEventStream(
+      GetEventWithType(WebInputEvent::Type::kTouchMove)));
   ASSERT_TRUE(
-      ShouldBlockEventStream(GetEventWithType(WebInputEvent::kTouchStart)));
-  ASSERT_TRUE(
-      ShouldBlockEventStream(GetEventWithType(WebInputEvent::kTouchMove)));
-  ASSERT_TRUE(
-      ShouldBlockEventStream(GetEventWithType(WebInputEvent::kTouchEnd)));
+      ShouldBlockEventStream(GetEventWithType(WebInputEvent::Type::kTouchEnd)));
 
   // Precede the TouchCancel with an appropriate TouchStart;
   PressTouchPoint(1, 1);
@@ -973,7 +906,7 @@ TEST_P(InputRouterImplTest, TouchTypesIgnoringAck) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   ASSERT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   ASSERT_EQ(0, client_->in_flight_event_count());
 
@@ -993,35 +926,49 @@ TEST_P(InputRouterImplTest, TouchTypesIgnoringAck) {
 }
 
 // TODO(https://crbug.com/866946): Test is flaky, especially on Mac & Fuchsia.
-TEST_P(InputRouterImplTest, DISABLED_GestureTypesIgnoringAck) {
+TEST_F(InputRouterImplTest, DISABLED_GestureTypesIgnoringAck) {
   // We test every gesture type, ensuring that the stream of gestures is valid.
 
 #if defined(OS_WIN)
   display::win::test::ScopedScreenWin scoped_screen_win_;
 #endif
   const WebInputEvent::Type eventTypes[] = {
-      WebInputEvent::kGestureTapDown,     WebInputEvent::kGestureShowPress,
-      WebInputEvent::kGestureTapCancel,   WebInputEvent::kGestureScrollBegin,
-      WebInputEvent::kGestureFlingStart,  WebInputEvent::kGestureFlingCancel,
-      WebInputEvent::kGestureTapDown,     WebInputEvent::kGestureTap,
-      WebInputEvent::kGestureTapDown,     WebInputEvent::kGestureLongPress,
-      WebInputEvent::kGestureTapCancel,   WebInputEvent::kGestureLongTap,
-      WebInputEvent::kGestureTapDown,     WebInputEvent::kGestureTapUnconfirmed,
-      WebInputEvent::kGestureTapCancel,   WebInputEvent::kGestureTapDown,
-      WebInputEvent::kGestureDoubleTap,   WebInputEvent::kGestureTapDown,
-      WebInputEvent::kGestureTapCancel,   WebInputEvent::kGestureTwoFingerTap,
-      WebInputEvent::kGestureTapDown,     WebInputEvent::kGestureTapCancel,
-      WebInputEvent::kGestureScrollBegin, WebInputEvent::kGestureScrollUpdate,
-      WebInputEvent::kGesturePinchBegin,  WebInputEvent::kGesturePinchUpdate,
-      WebInputEvent::kGesturePinchEnd,    WebInputEvent::kGestureScrollEnd};
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureShowPress,
+      WebInputEvent::Type::kGestureTapCancel,
+      WebInputEvent::Type::kGestureScrollBegin,
+      WebInputEvent::Type::kGestureFlingStart,
+      WebInputEvent::Type::kGestureFlingCancel,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureTap,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureLongPress,
+      WebInputEvent::Type::kGestureTapCancel,
+      WebInputEvent::Type::kGestureLongTap,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureTapUnconfirmed,
+      WebInputEvent::Type::kGestureTapCancel,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureDoubleTap,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureTapCancel,
+      WebInputEvent::Type::kGestureTwoFingerTap,
+      WebInputEvent::Type::kGestureTapDown,
+      WebInputEvent::Type::kGestureTapCancel,
+      WebInputEvent::Type::kGestureScrollBegin,
+      WebInputEvent::Type::kGestureScrollUpdate,
+      WebInputEvent::Type::kGesturePinchBegin,
+      WebInputEvent::Type::kGesturePinchUpdate,
+      WebInputEvent::Type::kGesturePinchEnd,
+      WebInputEvent::Type::kGestureScrollEnd};
   for (size_t i = 0; i < base::size(eventTypes); ++i) {
     WebInputEvent::Type type = eventTypes[i];
-    if (type == WebInputEvent::kGestureFlingStart ||
-        type == WebInputEvent::kGestureFlingCancel) {
+    if (type == WebInputEvent::Type::kGestureFlingStart ||
+        type == WebInputEvent::Type::kGestureFlingCancel) {
       SimulateGestureEvent(type, blink::WebGestureDevice::kTouchscreen);
       DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
 
-      if (type == WebInputEvent::kGestureFlingCancel) {
+      if (type == WebInputEvent::Type::kGestureFlingCancel) {
         // The fling controller generates and sends a GSE while handling the
         // GFC.
         EXPECT_EQ(1U, dispatched_messages.size());
@@ -1038,7 +985,7 @@ TEST_P(InputRouterImplTest, DISABLED_GestureTypesIgnoringAck) {
       SimulateGestureEvent(type, blink::WebGestureDevice::kTouchscreen);
       DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
 
-      if (type == WebInputEvent::kGestureScrollUpdate) {
+      if (type == WebInputEvent::Type::kGestureScrollUpdate) {
         // TouchScrollStarted is also dispatched.
         EXPECT_EQ(2U, dispatched_messages.size());
       } else {
@@ -1052,7 +999,7 @@ TEST_P(InputRouterImplTest, DISABLED_GestureTypesIgnoringAck) {
 
       dispatched_messages[dispatched_messages.size() - 1]
           ->ToEvent()
-          ->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+          ->CallCallback(blink::mojom::InputEventResultState::kNotConsumed);
 
       EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
       EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
@@ -1068,9 +1015,9 @@ TEST_P(InputRouterImplTest, DISABLED_GestureTypesIgnoringAck) {
   }
 }
 
-TEST_P(InputRouterImplTest, MouseTypesIgnoringAck) {
-  int start_type = static_cast<int>(WebInputEvent::kMouseDown);
-  int end_type = static_cast<int>(WebInputEvent::kContextMenu);
+TEST_F(InputRouterImplTest, MouseTypesIgnoringAck) {
+  int start_type = static_cast<int>(WebInputEvent::Type::kMouseDown);
+  int end_type = static_cast<int>(WebInputEvent::Type::kContextMenu);
   ASSERT_LT(start_type, end_type);
   for (int i = start_type; i <= end_type; ++i) {
     WebInputEvent::Type type = static_cast<WebInputEvent::Type>(i);
@@ -1085,7 +1032,7 @@ TEST_P(InputRouterImplTest, MouseTypesIgnoringAck) {
       EXPECT_EQ(1, client_->in_flight_event_count());
 
       dispatched_messages[0]->ToEvent()->CallCallback(
-          INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+          blink::mojom::InputEventResultState::kNotConsumed);
       EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
       EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
       EXPECT_EQ(0, client_->in_flight_event_count());
@@ -1100,18 +1047,18 @@ TEST_P(InputRouterImplTest, MouseTypesIgnoringAck) {
 
 // Guard against breaking changes to the list of ignored event ack types in
 // |WebInputEventTraits::ShouldBlockEventStream|.
-TEST_P(InputRouterImplTest, RequiredEventAckTypes) {
+TEST_F(InputRouterImplTest, RequiredEventAckTypes) {
   const WebInputEvent::Type kRequiredEventAckTypes[] = {
-      WebInputEvent::kMouseMove,
-      WebInputEvent::kMouseWheel,
-      WebInputEvent::kRawKeyDown,
-      WebInputEvent::kKeyDown,
-      WebInputEvent::kKeyUp,
-      WebInputEvent::kChar,
-      WebInputEvent::kGestureScrollBegin,
-      WebInputEvent::kGestureScrollUpdate,
-      WebInputEvent::kTouchStart,
-      WebInputEvent::kTouchMove};
+      WebInputEvent::Type::kMouseMove,
+      WebInputEvent::Type::kMouseWheel,
+      WebInputEvent::Type::kRawKeyDown,
+      WebInputEvent::Type::kKeyDown,
+      WebInputEvent::Type::kKeyUp,
+      WebInputEvent::Type::kChar,
+      WebInputEvent::Type::kGestureScrollBegin,
+      WebInputEvent::Type::kGestureScrollUpdate,
+      WebInputEvent::Type::kTouchStart,
+      WebInputEvent::Type::kTouchMove};
   for (size_t i = 0; i < base::size(kRequiredEventAckTypes); ++i) {
     const WebInputEvent::Type required_ack_type = kRequiredEventAckTypes[i];
     ASSERT_TRUE(ShouldBlockEventStream(GetEventWithType(required_ack_type)))
@@ -1119,70 +1066,70 @@ TEST_P(InputRouterImplTest, RequiredEventAckTypes) {
   }
 }
 
-TEST_P(InputRouterImplTest, GestureTypesIgnoringAckInterleaved) {
+TEST_F(InputRouterImplTest, GestureTypesIgnoringAckInterleaved) {
   // Interleave a few events that do and do not ignore acks. All gesture events
   // should be dispatched immediately, but the acks will be blocked on blocking
   // events.
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0, client_->in_flight_event_count());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   // Should have sent |kTouchScrollStarted| and |kGestureScrollUpdate|.
   EXPECT_EQ(2U, dispatched_messages.size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             client_->last_in_flight_event_type());
 
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureTapDown,
+  EXPECT_EQ(WebInputEvent::Type::kGestureTapDown,
             client_->last_in_flight_event_type());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   DispatchedMessages temp_dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, temp_dispatched_messages.size());
   dispatched_messages.emplace_back(std::move(temp_dispatched_messages.at(0)));
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
 
-  SimulateGestureEvent(WebInputEvent::kGestureShowPress,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureShowPress,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(2, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureShowPress,
+  EXPECT_EQ(WebInputEvent::Type::kGestureShowPress,
             client_->last_in_flight_event_type());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   temp_dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, temp_dispatched_messages.size());
   dispatched_messages.emplace_back(std::move(temp_dispatched_messages.at(0)));
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(3, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             client_->last_in_flight_event_type());
 
-  SimulateGestureEvent(WebInputEvent::kGestureTapCancel,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapCancel,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(3, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureTapCancel,
+  EXPECT_EQ(WebInputEvent::Type::kGestureTapCancel,
             client_->last_in_flight_event_type());
 
   // Now ack each ack-respecting event. Should see in-flight event count
@@ -1194,19 +1141,19 @@ TEST_P(InputRouterImplTest, GestureTypesIgnoringAckInterleaved) {
   ASSERT_TRUE(dispatched_messages[2]->ToEvent());
   ASSERT_TRUE(dispatched_messages[3]->ToEvent());
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(2U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(2, client_->in_flight_event_count());
 
   // Ack the second GestureScrollUpdate
   dispatched_messages[2]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(2U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
 
   // Ack the last GestureScrollUpdate
   dispatched_messages[3]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(2U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0, client_->in_flight_event_count());
 
@@ -1216,18 +1163,18 @@ TEST_P(InputRouterImplTest, GestureTypesIgnoringAckInterleaved) {
 
 // Test that GestureShowPress events don't get out of order due to
 // ignoring their acks.
-TEST_P(InputRouterImplTest, GestureShowPressIsInOrder) {
+TEST_F(InputRouterImplTest, GestureShowPressIsInOrder) {
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, dispatched_messages.size());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
 
   // GesturePinchBegin ignores its ack.
-  SimulateGestureEvent(WebInputEvent::kGesturePinchBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
@@ -1235,48 +1182,48 @@ TEST_P(InputRouterImplTest, GestureShowPressIsInOrder) {
   // GesturePinchUpdate ignores its ack.
   // This also verifies that GesturePinchUpdates for touchscreen are sent
   // to the renderer (in contrast to the TrackpadPinchUpdate test).
-  SimulateGestureEvent(WebInputEvent::kGesturePinchUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, dispatched_messages.size());
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGesturePinchUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             client_->last_in_flight_event_type());
 
   // GestureScrollUpdate waits for an ack.
   // This dispatches TouchScrollStarted and GestureScrollUpdate.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(2U, dispatched_messages.size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             client_->last_in_flight_event_type());
 
   // GestureShowPress will be sent immediately since GestureEventQueue allows
   // multiple in-flight events. However the acks will be blocked on outstanding
   // in-flight events.
-  SimulateGestureEvent(WebInputEvent::kGestureShowPress,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureShowPress,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureShowPress,
+  EXPECT_EQ(WebInputEvent::Type::kGestureShowPress,
             client_->last_in_flight_event_type());
 
-  SimulateGestureEvent(WebInputEvent::kGestureShowPress,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureShowPress,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
-  EXPECT_EQ(WebInputEvent::kGestureShowPress,
+  EXPECT_EQ(WebInputEvent::Type::kGestureShowPress,
             client_->last_in_flight_event_type());
 
   // Ack the GestureScrollUpdate to release the two GestureShowPress acks.
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   EXPECT_EQ(3U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0, client_->in_flight_event_count());
@@ -1287,7 +1234,7 @@ TEST_P(InputRouterImplTest, GestureShowPressIsInOrder) {
 
 // Test that touch ack timeout behavior is properly configured for
 // mobile-optimized sites and allowed touch actions.
-TEST_P(InputRouterImplTest, TouchAckTimeoutConfigured) {
+TEST_F(InputRouterImplTest, TouchAckTimeoutConfigured) {
   const int kDesktopTimeoutMs = 1;
   const int kMobileTimeoutMs = 0;
   SetUpForTouchAckTimeoutTest(kDesktopTimeoutMs, kMobileTimeoutMs);
@@ -1308,7 +1255,7 @@ TEST_P(InputRouterImplTest, TouchAckTimeoutConfigured) {
 
   // Ack'ing the timed-out event should fire a TouchCancel.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
 
@@ -1342,9 +1289,9 @@ TEST_P(InputRouterImplTest, TouchAckTimeoutConfigured) {
   ASSERT_EQ(1U, touch_release_event2.size());
   ASSERT_TRUE(touch_release_event2[0]->ToEvent());
   touch_press_event2[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   touch_release_event2[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   PressTouchPoint(1, 1);
   SendTouchEvent();
@@ -1360,9 +1307,9 @@ TEST_P(InputRouterImplTest, TouchAckTimeoutConfigured) {
   ASSERT_EQ(1u, touch_release_event3.size());
   ASSERT_TRUE(touch_release_event3[0]->ToEvent());
   touch_press_event3[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   touch_release_event3[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // As the touch-action is reset by a new touch sequence, the timeout behavior
   // should be restored.
@@ -1375,7 +1322,7 @@ TEST_P(InputRouterImplTest, TouchAckTimeoutConfigured) {
 
 // Test that a touch sequenced preceded by TouchAction::kNone is not affected by
 // the touch timeout.
-TEST_P(InputRouterImplTest,
+TEST_F(InputRouterImplTest,
        TouchAckTimeoutDisabledForTouchSequenceAfterTouchActionNone) {
   const int kDesktopTimeoutMs = 1;
   const int kMobileTimeoutMs = 2;
@@ -1393,8 +1340,9 @@ TEST_P(InputRouterImplTest,
   // TouchAction::kNone should disable the timeout.
   CancelTouchTimeout();
   dispatched_messages[0]->ToEvent()->CallCallback(
-      InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kNone);
+      blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+      blink::mojom::InputEventResultState::kConsumed, nullptr,
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kNone));
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   EXPECT_FALSE(TouchEventTimeoutEnabled());
 
@@ -1409,7 +1357,7 @@ TEST_P(InputRouterImplTest,
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
 
   // End the touch sequence.
@@ -1419,7 +1367,7 @@ TEST_P(InputRouterImplTest,
   dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, dispatched_messages.size());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_TRUE(TouchEventTimeoutEnabled());
   disposition_handler_->GetAndResetAckCount();
   GetAndResetDispatchedMessages();
@@ -1439,7 +1387,7 @@ TEST_P(InputRouterImplTest,
 
 // Test that TouchActionFilter::ResetTouchAction is called before the
 // first touch event for a touch sequence reaches the renderer.
-TEST_P(InputRouterImplTest, TouchActionResetBeforeEventReachesRenderer) {
+TEST_F(InputRouterImplTest, TouchActionResetBeforeEventReachesRenderer) {
   OnHasTouchEventHandlers(true);
 
   // Sequence 1.
@@ -1477,51 +1425,55 @@ TEST_P(InputRouterImplTest, TouchActionResetBeforeEventReachesRenderer) {
   ASSERT_TRUE(touch_release_event2[0]->ToEvent());
 
   touch_press_event1[0]->ToEvent()->CallCallback(
-      InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kNone);
-  touch_move_event1[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+      blink::mojom::InputEventResultState::kConsumed, nullptr,
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kNone));
+  touch_move_event1[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Ensure touch action is still none, as the next touch start hasn't been
   // acked yet. ScrollBegin and ScrollEnd don't require acks.
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
   // This allows the next touch sequence to start.
   touch_release_event1[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Ensure touch action has been set to auto, as a new touch sequence has
   // started.
   touch_press_event2[0]->ToEvent()->CallCallback(
-      InputEventAckSource::COMPOSITOR_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kAuto);
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      ui::LatencyInfo(), blink::mojom::InputEventResultState::kConsumed,
+      nullptr, blink::mojom::TouchActionOptional::New(cc::TouchAction::kAuto));
   touch_press_event2[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
-  touch_move_event2[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
+  touch_move_event2[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   DispatchedMessages gesture_scroll_begin = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, gesture_scroll_begin.size());
   gesture_scroll_begin[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+      blink::mojom::InputEventResultState::kConsumed);
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
   touch_release_event2[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 }
 
 // Test that TouchActionFilter::ResetTouchAction is called when a new touch
 // sequence has no consumer.
-TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHasNoConsumer) {
+TEST_F(InputRouterImplTest, TouchActionResetWhenTouchHasNoConsumer) {
   OnHasTouchEventHandlers(true);
 
   // Sequence 1.
@@ -1537,9 +1489,11 @@ TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHasNoConsumer) {
   ASSERT_TRUE(touch_move_event1[0]->ToEvent());
   CancelTouchTimeout();
   touch_press_event1[0]->ToEvent()->CallCallback(
-      InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kNone);
-  touch_move_event1[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+      blink::mojom::InputEventResultState::kConsumed, nullptr,
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kNone));
+  touch_move_event1[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   ReleaseTouchPoint(0);
   SendTouchEvent();
@@ -1561,39 +1515,39 @@ TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHasNoConsumer) {
 
   // Ensure we have touch-action:none. ScrollBegin and ScrollEnd don't require
   // acks.
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
   touch_release_event1[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   touch_press_event2[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   PressAndSetTouchActionAuto();
   // Ensure touch action has been set to auto, as the touch had no consumer.
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+      blink::mojom::InputEventResultState::kConsumed);
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
 }
 
 // Test that TouchActionFilter::ResetTouchAction is called when the touch
 // handler is removed.
-TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHandlerRemoved) {
+TEST_F(InputRouterImplTest, TouchActionResetWhenTouchHandlerRemoved) {
   // Touch sequence with touch handler.
   OnHasTouchEventHandlers(true);
   PressTouchPoint(1, 1);
@@ -1611,22 +1565,23 @@ TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHandlerRemoved) {
 
   // Ensure we have touch-action:none, suppressing scroll events.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kNone);
+      blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+      blink::mojom::InputEventResultState::kConsumed, nullptr,
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kNone));
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
   dispatched_messages[2]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+      blink::mojom::InputEventResultState::kNotConsumed);
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
@@ -1636,20 +1591,20 @@ TEST_P(InputRouterImplTest, TouchActionResetWhenTouchHandlerRemoved) {
 
   // Ensure touch action has been set to auto, as the touch handler has been
   // removed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+      blink::mojom::InputEventResultState::kConsumed);
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(1U, GetAndResetDispatchedMessages().size());
 }
 
 // Tests that async touch-moves are ack'd from the browser side.
-TEST_P(InputRouterImplTest, AsyncTouchMoveAckedImmediately) {
+TEST_F(InputRouterImplTest, AsyncTouchMoveAckedImmediately) {
   OnHasTouchEventHandlers(true);
 
   PressTouchPoint(1, 1);
@@ -1663,17 +1618,17 @@ TEST_P(InputRouterImplTest, AsyncTouchMoveAckedImmediately) {
 
   // Receive an ACK for the first touch-event.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(2U, GetAndResetDispatchedMessages().size());
@@ -1687,7 +1642,7 @@ TEST_P(InputRouterImplTest, AsyncTouchMoveAckedImmediately) {
 
 // Test that the double tap gesture depends on the touch action of the first
 // tap.
-TEST_P(InputRouterImplTest, DoubleTapGestureDependsOnFirstTap) {
+TEST_F(InputRouterImplTest, DoubleTapGestureDependsOnFirstTap) {
   OnHasTouchEventHandlers(true);
 
   // Sequence 1.
@@ -1698,8 +1653,9 @@ TEST_P(InputRouterImplTest, DoubleTapGestureDependsOnFirstTap) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt, cc::TouchAction::kNone);
+      blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+      blink::mojom::InputEventResultState::kConsumed, nullptr,
+      blink::mojom::TouchActionOptional::New(cc::TouchAction::kNone));
   ReleaseTouchPoint(0);
   SendTouchEvent();
 
@@ -1708,12 +1664,12 @@ TEST_P(InputRouterImplTest, DoubleTapGestureDependsOnFirstTap) {
   SendTouchEvent();
 
   // First tap.
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
 
   // The GestureTapUnconfirmed is converted into a tap, as the touch action is
   // none.
-  SimulateGestureEvent(WebInputEvent::kGestureTapUnconfirmed,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapUnconfirmed,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(4U, dispatched_messages.size());
@@ -1722,45 +1678,45 @@ TEST_P(InputRouterImplTest, DoubleTapGestureDependsOnFirstTap) {
   ASSERT_TRUE(dispatched_messages[2]->ToEvent());
   ASSERT_TRUE(dispatched_messages[3]->ToEvent());
   // This test will become invalid if GestureTap stops requiring an ack.
-  ASSERT_TRUE(
-      ShouldBlockEventStream(GetEventWithType(WebInputEvent::kGestureTap)));
+  ASSERT_TRUE(ShouldBlockEventStream(
+      GetEventWithType(WebInputEvent::Type::kGestureTap)));
   EXPECT_EQ(3, client_->in_flight_event_count());
 
   dispatched_messages[3]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(2, client_->in_flight_event_count());
 
   // This tap gesture is dropped, since the GestureTapUnconfirmed was turned
   // into a tap.
-  SimulateGestureEvent(WebInputEvent::kGestureTap,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTap,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
 
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   // Second Tap.
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, dispatched_messages.size());
 
   // Although the touch-action is now auto, the double tap still won't be
-  // dispatched, because the first tap occured when the touch-action was none.
-  SimulateGestureEvent(WebInputEvent::kGestureDoubleTap,
+  // dispatched, because the first tap occurred when the touch-action was none.
+  SimulateGestureEvent(WebInputEvent::Type::kGestureDoubleTap,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_messages = GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, dispatched_messages.size());
   // This test will become invalid if GestureDoubleTap stops requiring an ack.
   ASSERT_TRUE(ShouldBlockEventStream(
-      GetEventWithType(WebInputEvent::kGestureDoubleTap)));
+      GetEventWithType(WebInputEvent::Type::kGestureDoubleTap)));
   ASSERT_EQ(1, client_->in_flight_event_count());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0, client_->in_flight_event_count());
 }
 
@@ -1796,10 +1752,10 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   // Note that the Touchscreen case is verified as NOT doing this as
   // part of the ShowPressIsInOrder test.
 
-  SimulateGestureEvent(WebInputEvent::kGesturePinchBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchBegin,
                        blink::WebGestureDevice::kTouchpad);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  ASSERT_EQ(WebInputEvent::kGesturePinchBegin,
+  ASSERT_EQ(WebInputEvent::Type::kGesturePinchBegin,
             disposition_handler_->ack_event_type());
 
   SimulateGesturePinchUpdateEvent(1.5f, 20, 25, 0,
@@ -1811,7 +1767,7 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   const WebInputEvent* input_event =
       dispatched_messages[0]->ToEvent()->Event()->web_event.get();
-  ASSERT_EQ(WebInputEvent::kMouseWheel, input_event->GetType());
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel, input_event->GetType());
   const WebMouseWheelEvent* synthetic_wheel =
       static_cast<const WebMouseWheelEvent*>(input_event);
   EXPECT_EQ(20, synthetic_wheel->PositionInWidget().x());
@@ -1821,16 +1777,17 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   EXPECT_TRUE(synthetic_wheel->GetModifiers() &
               blink::WebInputEvent::kControlKey);
   EXPECT_EQ(blink::WebMouseWheelEvent::kPhaseBegan, synthetic_wheel->phase);
-  EXPECT_EQ(blink::WebInputEvent::kBlocking, synthetic_wheel->dispatch_type);
+  EXPECT_EQ(blink::WebInputEvent::DispatchType::kBlocking,
+            synthetic_wheel->dispatch_type);
 
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // Check that the correct unhandled pinch event was received.
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  ASSERT_EQ(WebInputEvent::kGesturePinchUpdate,
+  ASSERT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             disposition_handler_->ack_event_type());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
             disposition_handler_->ack_state());
   EXPECT_EQ(
       1.5f,
@@ -1844,63 +1801,66 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   input_event = dispatched_messages[0]->ToEvent()->Event()->web_event.get();
-  ASSERT_EQ(WebInputEvent::kMouseWheel, input_event->GetType());
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel, input_event->GetType());
   synthetic_wheel = static_cast<const WebMouseWheelEvent*>(input_event);
   EXPECT_EQ(blink::WebMouseWheelEvent::kPhaseChanged, synthetic_wheel->phase);
   if (async_events_enabled_) {
-    EXPECT_EQ(blink::WebInputEvent::kEventNonBlocking,
+    EXPECT_EQ(blink::WebInputEvent::DispatchType::kEventNonBlocking,
               synthetic_wheel->dispatch_type);
   } else {
-    EXPECT_EQ(blink::WebInputEvent::kBlocking, synthetic_wheel->dispatch_type);
+    EXPECT_EQ(blink::WebInputEvent::DispatchType::kBlocking,
+              synthetic_wheel->dispatch_type);
   }
 
   if (async_events_enabled_) {
     dispatched_messages[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_IGNORED);
+        blink::mojom::InputEventResultState::kIgnored);
   } else {
     dispatched_messages[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+        blink::mojom::InputEventResultState::kNotConsumed);
   }
 
   // Check that the correct HANDLED pinch event was received.
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kGesturePinchUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             disposition_handler_->ack_event_type());
   if (async_events_enabled_) {
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_IGNORED, disposition_handler_->ack_state());
+    EXPECT_EQ(blink::mojom::InputEventResultState::kIgnored,
+              disposition_handler_->ack_state());
   } else {
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
+    EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
               disposition_handler_->ack_state());
   }
   EXPECT_FLOAT_EQ(
       0.3f,
       disposition_handler_->acked_gesture_event().data.pinch_update.scale);
 
-  SimulateGestureEvent(WebInputEvent::kGesturePinchEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchEnd,
                        blink::WebGestureDevice::kTouchpad);
   dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   input_event = dispatched_messages[0]->ToEvent()->Event()->web_event.get();
-  ASSERT_EQ(WebInputEvent::kMouseWheel, input_event->GetType());
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel, input_event->GetType());
   synthetic_wheel = static_cast<const WebMouseWheelEvent*>(input_event);
   EXPECT_EQ(blink::WebMouseWheelEvent::kPhaseEnded, synthetic_wheel->phase);
-  EXPECT_EQ(blink::WebInputEvent::kEventNonBlocking,
+  EXPECT_EQ(blink::WebInputEvent::DispatchType::kEventNonBlocking,
             synthetic_wheel->dispatch_type);
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_IGNORED);
+      blink::mojom::InputEventResultState::kIgnored);
 
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kGesturePinchEnd,
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchEnd,
             disposition_handler_->ack_event_type());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_IGNORED, disposition_handler_->ack_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kIgnored,
+            disposition_handler_->ack_state());
 
   // The first event is blocked. We should send following wheel events as
   // blocking events.
-  SimulateGestureEvent(WebInputEvent::kGesturePinchBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGesturePinchBegin,
                        blink::WebGestureDevice::kTouchpad);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  ASSERT_EQ(WebInputEvent::kGesturePinchBegin,
+  ASSERT_EQ(WebInputEvent::Type::kGesturePinchBegin,
             disposition_handler_->ack_event_type());
 
   SimulateGesturePinchUpdateEvent(1.5f, 20, 25, 0,
@@ -1911,21 +1871,23 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   input_event = dispatched_messages[0]->ToEvent()->Event()->web_event.get();
-  ASSERT_EQ(WebInputEvent::kMouseWheel, input_event->GetType());
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel, input_event->GetType());
   synthetic_wheel = static_cast<const WebMouseWheelEvent*>(input_event);
   EXPECT_TRUE(synthetic_wheel->GetModifiers() &
               blink::WebInputEvent::kControlKey);
   EXPECT_EQ(blink::WebMouseWheelEvent::kPhaseBegan, synthetic_wheel->phase);
-  EXPECT_EQ(blink::WebInputEvent::kBlocking, synthetic_wheel->dispatch_type);
+  EXPECT_EQ(blink::WebInputEvent::DispatchType::kBlocking,
+            synthetic_wheel->dispatch_type);
 
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Check that the correct handled pinch event was received.
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  ASSERT_EQ(WebInputEvent::kGesturePinchUpdate,
+  ASSERT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             disposition_handler_->ack_event_type());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, disposition_handler_->ack_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            disposition_handler_->ack_state());
   EXPECT_EQ(
       1.5f,
       disposition_handler_->acked_gesture_event().data.pinch_update.scale);
@@ -1938,30 +1900,32 @@ TEST_P(TouchpadPinchInputRouterImplTest, TouchpadPinchUpdate) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   input_event = dispatched_messages[0]->ToEvent()->Event()->web_event.get();
-  ASSERT_EQ(WebInputEvent::kMouseWheel, input_event->GetType());
+  ASSERT_EQ(WebInputEvent::Type::kMouseWheel, input_event->GetType());
   synthetic_wheel = static_cast<const WebMouseWheelEvent*>(input_event);
   EXPECT_EQ(blink::WebMouseWheelEvent::kPhaseChanged, synthetic_wheel->phase);
-  EXPECT_EQ(blink::WebInputEvent::kBlocking, synthetic_wheel->dispatch_type);
+  EXPECT_EQ(blink::WebInputEvent::DispatchType::kBlocking,
+            synthetic_wheel->dispatch_type);
 
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Check that the correct HANDLED pinch event was received.
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
-  EXPECT_EQ(WebInputEvent::kGesturePinchUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
             disposition_handler_->ack_event_type());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, disposition_handler_->ack_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            disposition_handler_->ack_state());
   EXPECT_FLOAT_EQ(
       0.3f,
       disposition_handler_->acked_gesture_event().data.pinch_update.scale);
 }
 
 // Test proper handling of touchpad Gesture{Pinch,Scroll}Update sequences.
-TEST_P(InputRouterImplTest, TouchpadPinchAndScrollUpdate) {
+TEST_F(InputRouterImplTest, TouchpadPinchAndScrollUpdate) {
   // All gesture events should be sent immediately.
   SimulateGestureScrollUpdateEvent(1.5f, 0.f, 0,
                                    blink::WebGestureDevice::kTouchpad);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate,
                        blink::WebGestureDevice::kTouchpad);
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(2U, dispatched_messages.size());
@@ -1971,7 +1935,7 @@ TEST_P(InputRouterImplTest, TouchpadPinchAndScrollUpdate) {
 
   // Subsequent scroll and pinch events will also be sent immediately.
   SimulateTouchpadGesturePinchEventWithoutWheel(
-      WebInputEvent::kGesturePinchUpdate, 1.5f, 20, 25, 0);
+      WebInputEvent::Type::kGesturePinchUpdate, 1.5f, 20, 25, 0);
   DispatchedMessages temp_dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, temp_dispatched_messages.size());
   ASSERT_TRUE(temp_dispatched_messages[0]->ToEvent());
@@ -1987,7 +1951,7 @@ TEST_P(InputRouterImplTest, TouchpadPinchAndScrollUpdate) {
   EXPECT_EQ(3, client_->in_flight_event_count());
 
   SimulateTouchpadGesturePinchEventWithoutWheel(
-      WebInputEvent::kGesturePinchUpdate, 1.5f, 20, 25, 0);
+      WebInputEvent::Type::kGesturePinchUpdate, 1.5f, 20, 25, 0);
   temp_dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, temp_dispatched_messages.size());
   ASSERT_TRUE(temp_dispatched_messages[0]->ToEvent());
@@ -2004,40 +1968,40 @@ TEST_P(InputRouterImplTest, TouchpadPinchAndScrollUpdate) {
 
   // Ack'ing events should decrease in-flight event count.
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(3, client_->in_flight_event_count());
 
   // Ack the second scroll.
   dispatched_messages[1]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(dispatched_messages[2]->ToEvent()->HasCallback());
   EXPECT_EQ(2U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(2, client_->in_flight_event_count());
 
   // Ack the scroll event.
   dispatched_messages[3]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(dispatched_messages[4]->ToEvent()->HasCallback());
   EXPECT_EQ(2U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(1, client_->in_flight_event_count());
 
   // Ack the scroll event.
   dispatched_messages[5]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_CONSUMED);
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   EXPECT_EQ(0, client_->in_flight_event_count());
 }
 
 // Test proper routing of overscroll notifications received either from
 // event acks or from |DidOverscroll| IPC messages.
-TEST_P(InputRouterImplTest, OverscrollDispatch) {
-  DidOverscrollParams overscroll;
+TEST_F(InputRouterImplTest, OverscrollDispatch) {
+  blink::mojom::DidOverscrollParams overscroll;
   overscroll.accumulated_overscroll = gfx::Vector2dF(-14, 14);
   overscroll.latest_overscroll_delta = gfx::Vector2dF(-7, 0);
   overscroll.current_fling_velocity = gfx::Vector2dF(-1, 0);
 
-  input_router_->DidOverscroll(overscroll);
+  input_router_->DidOverscroll(overscroll.Clone());
   DidOverscrollParams client_overscroll = client_->GetAndResetOverscroll();
   EXPECT_EQ(overscroll.accumulated_overscroll,
             client_overscroll.accumulated_overscroll);
@@ -2049,7 +2013,7 @@ TEST_P(InputRouterImplTest, OverscrollDispatch) {
   // controller.
   EXPECT_EQ(gfx::Vector2dF(), client_overscroll.current_fling_velocity);
 
-  DidOverscrollParams wheel_overscroll;
+  blink::mojom::DidOverscrollParams wheel_overscroll;
   wheel_overscroll.accumulated_overscroll = gfx::Vector2dF(7, -7);
   wheel_overscroll.latest_overscroll_delta = gfx::Vector2dF(3, 0);
   wheel_overscroll.current_fling_velocity = gfx::Vector2dF(1, 0);
@@ -2060,9 +2024,9 @@ TEST_P(InputRouterImplTest, OverscrollDispatch) {
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
 
   dispatched_messages[0]->ToEvent()->CallCallback(
-      InputEventAckSource::COMPOSITOR_THREAD, ui::LatencyInfo(),
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED, DidOverscrollParams(wheel_overscroll),
-      base::nullopt);
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      ui::LatencyInfo(), blink::mojom::InputEventResultState::kNotConsumed,
+      wheel_overscroll.Clone(), nullptr);
 
   client_overscroll = client_->GetAndResetOverscroll();
   EXPECT_EQ(wheel_overscroll.accumulated_overscroll,
@@ -2076,23 +2040,9 @@ TEST_P(InputRouterImplTest, OverscrollDispatch) {
   EXPECT_EQ(gfx::Vector2dF(), client_overscroll.current_fling_velocity);
 }
 
-// Test proper routing of whitelisted touch action notifications received from
-// |SetWhiteListedTouchAction| IPC messages.
-TEST_P(InputRouterImplTest, OnSetWhiteListedTouchAction) {
-  // The white listed touch action is bundled in the ack.
-  if (compositor_touch_action_enabled_)
-    return;
-  cc::TouchAction touch_action = cc::TouchAction::kPanY;
-  OnSetWhiteListedTouchAction(touch_action, 0,
-                              INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  cc::TouchAction white_listed_touch_action =
-      client_->GetAndResetWhiteListedTouchAction();
-  EXPECT_EQ(touch_action, white_listed_touch_action);
-}
-
 // Tests that touch event stream validation passes when events are filtered
 // out. See https://crbug.com/581231 for details.
-TEST_P(InputRouterImplTest, TouchValidationPassesWithFilteredInputEvents) {
+TEST_F(InputRouterImplTest, TouchValidationPassesWithFilteredInputEvents) {
   // Touch sequence with touch handler.
   OnHasTouchEventHandlers(true);
   PressTouchPoint(1, 1);
@@ -2101,7 +2051,7 @@ TEST_P(InputRouterImplTest, TouchValidationPassesWithFilteredInputEvents) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   PressTouchPoint(1, 1);
   SendTouchEvent();
@@ -2109,7 +2059,7 @@ TEST_P(InputRouterImplTest, TouchValidationPassesWithFilteredInputEvents) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   // This event will not be filtered out even though no consumer exists.
   ReleaseTouchPoint(1);
@@ -2125,10 +2075,10 @@ TEST_P(InputRouterImplTest, TouchValidationPassesWithFilteredInputEvents) {
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
   dispatched_messages[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 }
 
-TEST_P(InputRouterImplTest, TouchActionInCallback) {
+TEST_F(InputRouterImplTest, TouchActionInCallback) {
   OnHasTouchEventHandlers(true);
 
   // Send a touchstart
@@ -2137,32 +2087,24 @@ TEST_P(InputRouterImplTest, TouchActionInCallback) {
   DispatchedMessages dispatched_messages = GetAndResetDispatchedMessages();
   ASSERT_EQ(1U, dispatched_messages.size());
   ASSERT_TRUE(dispatched_messages[0]->ToEvent());
-  InputEventAckSource source = InputEventAckSource::MAIN_THREAD;
   base::Optional<cc::TouchAction> expected_touch_action = cc::TouchAction::kPan;
-  if (compositor_touch_action_enabled_)
-    source = InputEventAckSource::COMPOSITOR_THREAD;
   dispatched_messages[0]->ToEvent()->CallCallback(
-      source, ui::LatencyInfo(), INPUT_EVENT_ACK_STATE_CONSUMED, base::nullopt,
-      expected_touch_action);
+      blink::mojom::InputEventResultSource::kCompositorThread,
+      ui::LatencyInfo(), blink::mojom::InputEventResultState::kConsumed,
+      nullptr, blink::mojom::TouchActionOptional::New(cc::TouchAction::kPan));
   ASSERT_EQ(1U, disposition_handler_->GetAndResetAckCount());
   base::Optional<cc::TouchAction> allowed_touch_action = AllowedTouchAction();
   cc::TouchAction white_listed_touch_action = WhiteListedTouchAction();
-  if (compositor_touch_action_enabled_) {
-    EXPECT_FALSE(allowed_touch_action.has_value());
-    EXPECT_EQ(expected_touch_action.value(), white_listed_touch_action);
-  } else {
-    EXPECT_EQ(expected_touch_action, allowed_touch_action);
-  }
+  EXPECT_FALSE(allowed_touch_action.has_value());
+  EXPECT_EQ(expected_touch_action.value(), white_listed_touch_action);
 }
 
-TEST_P(InputRouterImplTest, TimeoutMonitorStopWithMainThreadTouchAction) {
-  // TODO(crbug.com/953547): enable this when the bug is fixed.
-  if (compositor_touch_action_enabled_)
-    return;
+// TODO(crbug.com/953547): enable this when the bug is fixed.
+TEST_F(InputRouterImplTest,
+       DISABLED_TimeoutMonitorStopWithMainThreadTouchAction) {
   SetUpForTouchAckTimeoutTest(1, 1);
   OnHasTouchEventHandlers(true);
-
-  StopTimeoutMonitorTest(compositor_touch_action_enabled_);
+  StopTimeoutMonitorTest();
 }
 
 namespace {
@@ -2225,10 +2167,10 @@ class InputRouterImplScaleMouseEventTest
 }  // namespace
 
 TEST_F(InputRouterImplScaleMouseEventTest, ScaleMouseEventTest) {
-  RunMouseEventTest("Enter", WebInputEvent::kMouseEnter);
-  RunMouseEventTest("Down", WebInputEvent::kMouseDown);
-  RunMouseEventTest("Move", WebInputEvent::kMouseMove);
-  RunMouseEventTest("Up", WebInputEvent::kMouseUp);
+  RunMouseEventTest("Enter", WebInputEvent::Type::kMouseEnter);
+  RunMouseEventTest("Down", WebInputEvent::Type::kMouseDown);
+  RunMouseEventTest("Move", WebInputEvent::Type::kMouseMove);
+  RunMouseEventTest("Up", WebInputEvent::Type::kMouseUp);
 }
 
 TEST_F(InputRouterImplScaleEventTest, ScaleMouseWheelEventTest) {
@@ -2311,7 +2253,7 @@ class InputRouterImplScaleTouchEventTest
     ASSERT_EQ(1u, dispatched_messages_.size());
     ASSERT_TRUE(dispatched_messages_[0]->ToEvent());
     dispatched_messages_[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_CONSUMED);
+        blink::mojom::InputEventResultState::kConsumed);
     ASSERT_TRUE(TouchEventQueueEmpty());
   }
 
@@ -2322,7 +2264,7 @@ class InputRouterImplScaleTouchEventTest
     ASSERT_EQ(1u, dispatched_messages_.size());
     ASSERT_TRUE(dispatched_messages_[0]->ToEvent());
     dispatched_messages_[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_CONSUMED);
+        blink::mojom::InputEventResultState::kConsumed);
   }
 
  private:
@@ -2336,43 +2278,43 @@ TEST_F(InputRouterImplScaleTouchEventTest, ScaleTouchEventTest) {
   // Press
   PressTouchPoint(10, 20);
   PressTouchPoint(100, 200);
-  FlushTouchEvent(WebInputEvent::kTouchStart);
+  FlushTouchEvent(WebInputEvent::Type::kTouchStart);
 
-  RunTouchEventTest("Press", WebTouchPoint::kStatePressed);
+  RunTouchEventTest("Press", WebTouchPoint::State::kStatePressed);
   ReleaseTouchPointAndAck(1);
   ReleaseTouchPointAndAck(0);
 
   // Move
   PressTouchPoint(0, 0);
   PressTouchPoint(0, 0);
-  FlushTouchEvent(WebInputEvent::kTouchStart);
+  FlushTouchEvent(WebInputEvent::Type::kTouchStart);
 
   MoveTouchPoint(0, 10, 20);
   MoveTouchPoint(1, 100, 200);
-  FlushTouchEvent(WebInputEvent::kTouchMove);
-  RunTouchEventTest("Move", WebTouchPoint::kStateMoved);
+  FlushTouchEvent(WebInputEvent::Type::kTouchMove);
+  RunTouchEventTest("Move", WebTouchPoint::State::kStateMoved);
   ReleaseTouchPointAndAck(1);
   ReleaseTouchPointAndAck(0);
 
   // Release
   PressTouchPoint(10, 20);
   PressTouchPoint(100, 200);
-  FlushTouchEvent(WebInputEvent::kTouchMove);
+  FlushTouchEvent(WebInputEvent::Type::kTouchMove);
 
   ReleaseTouchPoint(0);
   ReleaseTouchPoint(1);
-  FlushTouchEvent(WebInputEvent::kTouchEnd);
-  RunTouchEventTest("Release", WebTouchPoint::kStateReleased);
+  FlushTouchEvent(WebInputEvent::Type::kTouchEnd);
+  RunTouchEventTest("Release", WebTouchPoint::State::kStateReleased);
 
   // Cancel
   PressTouchPoint(10, 20);
   PressTouchPoint(100, 200);
-  FlushTouchEvent(WebInputEvent::kTouchStart);
+  FlushTouchEvent(WebInputEvent::Type::kTouchStart);
 
   CancelTouchPoint(0);
   CancelTouchPoint(1);
-  FlushTouchEvent(WebInputEvent::kTouchCancel);
-  RunTouchEventTest("Cancel", WebTouchPoint::kStateCancelled);
+  FlushTouchEvent(WebInputEvent::Type::kTouchCancel);
+  RunTouchEventTest("Cancel", WebTouchPoint::State::kStateCancelled);
 }
 
 namespace {
@@ -2479,7 +2421,7 @@ class InputRouterImplScaleGestureEventTest
           expected_types[i],
           dispatched_messages_[i]->ToEvent()->Event()->web_event->GetType());
       dispatched_messages_[i]->ToEvent()->CallCallback(
-          INPUT_EVENT_ACK_STATE_CONSUMED);
+          blink::mojom::InputEventResultState::kConsumed);
     }
   }
 
@@ -2530,13 +2472,13 @@ TEST_F(InputRouterImplScaleGestureEventTest, GestureScroll) {
 
   PressAndSetTouchActionAuto();
 
-  SendGestureSequence(
-      {WebInputEvent::kGestureTapDown, WebInputEvent::kGestureTapCancel});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureTapCancel});
 
   {
     SimulateGestureEvent(SyntheticWebGestureEventBuilder::BuildScrollBegin(
         delta.x(), delta.y(), blink::WebGestureDevice::kTouchscreen));
-    FlushGestureEvents({WebInputEvent::kGestureScrollBegin});
+    FlushGestureEvents({WebInputEvent::Type::kGestureScrollBegin});
 
     const WebGestureEvent* sent_event = GetSentWebInputEvent<WebGestureEvent>();
     EXPECT_FLOAT_EQ(delta_scaled.x(),
@@ -2553,8 +2495,8 @@ TEST_F(InputRouterImplScaleGestureEventTest, GestureScroll) {
   {
     SimulateGestureScrollUpdateEvent(delta.x(), delta.y(), 0,
                                      blink::WebGestureDevice::kTouchscreen);
-    FlushGestureEvents({WebInputEvent::kTouchScrollStarted,
-                        WebInputEvent::kGestureScrollUpdate});
+    FlushGestureEvents({WebInputEvent::Type::kTouchScrollStarted,
+                        WebInputEvent::Type::kGestureScrollUpdate});
     // Erase TouchScrollStarted so we can inspect the GestureScrollUpdate.
     dispatched_messages_.erase(dispatched_messages_.begin());
 
@@ -2568,7 +2510,7 @@ TEST_F(InputRouterImplScaleGestureEventTest, GestureScroll) {
     EXPECT_FLOAT_EQ(delta.y(), filter_event->data.scroll_update.delta_y);
   }
 
-  SendGestureSequence({WebInputEvent::kGestureScrollEnd});
+  SendGestureSequence({WebInputEvent::Type::kGestureScrollEnd});
 }
 
 TEST_F(InputRouterImplScaleGestureEventTest, GesturePinch) {
@@ -2577,20 +2519,20 @@ TEST_F(InputRouterImplScaleGestureEventTest, GesturePinch) {
 
   PressAndSetTouchActionAuto();
 
-  SendGestureSequence(
-      {WebInputEvent::kGestureTapDown, WebInputEvent::kGestureTapCancel});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureTapCancel});
 
   SimulateGestureEvent(SyntheticWebGestureEventBuilder::BuildScrollBegin(
       0.f, 0.f, blink::WebGestureDevice::kTouchscreen));
-  FlushGestureEvents({WebInputEvent::kGestureScrollBegin});
+  FlushGestureEvents({WebInputEvent::Type::kGestureScrollBegin});
 
-  SendGestureSequence({WebInputEvent::kGesturePinchBegin});
+  SendGestureSequence({WebInputEvent::Type::kGesturePinchBegin});
 
   SimulateGestureEvent(SyntheticWebGestureEventBuilder::BuildPinchUpdate(
       scale_change, anchor.x(), anchor.y(), 0,
       blink::WebGestureDevice::kTouchscreen));
 
-  FlushGestureEvents({WebInputEvent::kGesturePinchUpdate});
+  FlushGestureEvents({WebInputEvent::Type::kGesturePinchUpdate});
   const WebGestureEvent* sent_event = GetSentWebInputEvent<WebGestureEvent>();
   TestLocationInSentEvent(sent_event, anchor, anchor_scaled, base::nullopt);
   EXPECT_FLOAT_EQ(scale_change, sent_event->data.pinch_update.scale);
@@ -2600,34 +2542,37 @@ TEST_F(InputRouterImplScaleGestureEventTest, GesturePinch) {
   TestLocationInFilterEvent(filter_event, anchor, base::nullopt);
   EXPECT_FLOAT_EQ(scale_change, filter_event->data.pinch_update.scale);
 
-  SendGestureSequence(
-      {WebInputEvent::kGesturePinchEnd, WebInputEvent::kGestureScrollEnd});
+  SendGestureSequence({WebInputEvent::Type::kGesturePinchEnd,
+                       WebInputEvent::Type::kGestureScrollEnd});
 }
 
 TEST_F(InputRouterImplScaleGestureEventTest, GestureTap) {
-  SendGestureSequence({WebInputEvent::kGestureTapDown,
-                       WebInputEvent::kGestureShowPress,
-                       WebInputEvent::kGestureTap});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureShowPress,
+                       WebInputEvent::Type::kGestureTap});
 }
 
 TEST_F(InputRouterImplScaleGestureEventTest, GestureDoubleTap) {
-  SendGestureSequence(
-      {WebInputEvent::kGestureTapDown, WebInputEvent::kGestureTapUnconfirmed,
-       WebInputEvent::kGestureTapCancel, WebInputEvent::kGestureTapDown,
-       WebInputEvent::kGestureTapCancel, WebInputEvent::kGestureDoubleTap});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureTapUnconfirmed,
+                       WebInputEvent::Type::kGestureTapCancel,
+                       WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureTapCancel,
+                       WebInputEvent::Type::kGestureDoubleTap});
 }
 
 TEST_F(InputRouterImplScaleGestureEventTest, GestureLongPress) {
-  SendGestureSequence(
-      {WebInputEvent::kGestureTapDown, WebInputEvent::kGestureShowPress,
-       WebInputEvent::kGestureLongPress, WebInputEvent::kGestureTapCancel,
-       WebInputEvent::kGestureLongTap});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureShowPress,
+                       WebInputEvent::Type::kGestureLongPress,
+                       WebInputEvent::Type::kGestureTapCancel,
+                       WebInputEvent::Type::kGestureLongTap});
 }
 
 TEST_F(InputRouterImplScaleGestureEventTest, GestureTwoFingerTap) {
-  SendGestureSequence({WebInputEvent::kGestureTapDown,
-                       WebInputEvent::kGestureTapCancel,
-                       WebInputEvent::kGestureTwoFingerTap});
+  SendGestureSequence({WebInputEvent::Type::kGestureTapDown,
+                       WebInputEvent::Type::kGestureTapCancel,
+                       WebInputEvent::Type::kGestureTwoFingerTap});
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/interaction_mq_dynamic_browsertest.cc b/chromium/content/browser/renderer_host/input/interaction_mq_dynamic_browsertest.cc
index a32553da9a7..32be9994865 100644
--- a/chromium/content/browser/renderer_host/input/interaction_mq_dynamic_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/interaction_mq_dynamic_browsertest.cc
@@ -7,6 +7,7 @@
 #include "build/build_config.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/input/main_thread_event_queue_browsertest.cc b/chromium/content/browser/renderer_host/input/main_thread_event_queue_browsertest.cc
index 1f85699295e..95cc5860200 100644
--- a/chromium/content/browser/renderer_host/input/main_thread_event_queue_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/main_thread_event_queue_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -115,18 +116,19 @@ class MainThreadEventQueueBrowserTest : public ContentBrowserTest {
     SimulateMouseClick(shell()->web_contents(), 0,
                        blink::WebPointerProperties::Button::kLeft);
     auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-        GetWidgetHost(), blink::WebInputEvent::kMouseMove);
+        GetWidgetHost(), blink::WebInputEvent::Type::kMouseMove);
     GetWidgetHost()->ForwardMouseEvent(SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseMove, 10, 10, 0));
+        blink::WebInputEvent::Type::kMouseMove, 10, 10, 0));
     GetWidgetHost()->ForwardMouseEvent(SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseMove, 15, 15, 0));
+        blink::WebInputEvent::Type::kMouseMove, 15, 15, 0));
     GetWidgetHost()->ForwardMouseEvent(SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseMove, 20, 25, 0));
+        blink::WebInputEvent::Type::kMouseMove, 20, 25, 0));
 
     // Runs until we get the InputMsgAck callback.
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, input_msg_watcher->WaitForAck());
-    EXPECT_EQ(InputEventAckSource::MAIN_THREAD,
-              static_cast<InputEventAckSource>(
+    EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+              input_msg_watcher->WaitForAck());
+    EXPECT_EQ(blink::mojom::InputEventResultSource::kMainThread,
+              static_cast<blink::mojom::InputEventResultSource>(
                   input_msg_watcher->last_event_ack_source()));
 
     int mouse_move_count = 0;
@@ -157,7 +159,7 @@ class MainThreadEventQueueBrowserTest : public ContentBrowserTest {
     SimulateMouseClick(shell()->web_contents(), 0,
                        blink::WebPointerProperties::Button::kLeft);
     auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-        GetWidgetHost(), blink::WebInputEvent::kTouchMove);
+        GetWidgetHost(), blink::WebInputEvent::Type::kTouchMove);
 
     auto* root_view = GetWidgetHost()->GetView();
     auto* input_event_router =
@@ -166,10 +168,10 @@ class MainThreadEventQueueBrowserTest : public ContentBrowserTest {
       input_event_router->RouteTouchEvent(root_view, &event, ui::LatencyInfo());
 
     // Runs until we get the InputMsgAck callback.
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
+    EXPECT_EQ(blink::mojom::InputEventResultState::kSetNonBlocking,
               input_msg_watcher->WaitForAck());
-    EXPECT_EQ(InputEventAckSource::COMPOSITOR_THREAD,
-              static_cast<InputEventAckSource>(
+    EXPECT_EQ(blink::mojom::InputEventResultSource::kCompositorThread,
+              static_cast<blink::mojom::InputEventResultSource>(
                   input_msg_watcher->last_event_ack_source()));
 
     int touch_move_count = 0;
diff --git a/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.cc b/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.cc
index ad8f1fc4128..d8262dcdb45 100644
--- a/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.cc
+++ b/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.cc
@@ -21,8 +21,8 @@ namespace content {
 MockInputDispositionHandler::MockInputDispositionHandler()
     : input_router_(nullptr),
       ack_count_(0),
-      ack_event_type_(WebInputEvent::kUndefined),
-      ack_state_(INPUT_EVENT_ACK_STATE_UNKNOWN) {}
+      ack_event_type_(WebInputEvent::Type::kUndefined),
+      ack_state_(blink::mojom::InputEventResultState::kUnknown) {}
 
 MockInputDispositionHandler::~MockInputDispositionHandler() {}
 
@@ -40,8 +40,8 @@ MockInputDispositionHandler::CreateMouseEventCallback() {
 
 void MockInputDispositionHandler::OnWheelEventAck(
     const MouseWheelEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   VLOG(1) << __FUNCTION__ << " called!";
   acked_wheel_event_ = event.event;
   acked_wheel_event_state_ = ack_result;
@@ -50,8 +50,8 @@ void MockInputDispositionHandler::OnWheelEventAck(
 
 void MockInputDispositionHandler::OnTouchEventAck(
     const TouchEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   VLOG(1) << __FUNCTION__ << " called!";
   acked_touch_event_ = event;
   RecordAckCalled(event.event.GetType(), ack_result);
@@ -63,8 +63,8 @@ void MockInputDispositionHandler::OnTouchEventAck(
 
 void MockInputDispositionHandler::OnGestureEventAck(
     const GestureEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   VLOG(1) << __FUNCTION__ << " called!";
   acked_gesture_event_ = event.event;
   RecordAckCalled(event.event.GetType(), ack_result);
@@ -78,7 +78,7 @@ size_t MockInputDispositionHandler::GetAndResetAckCount() {
 
 void MockInputDispositionHandler::RecordAckCalled(
     blink::WebInputEvent::Type type,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   ack_event_type_ = type;
   ++ack_count_;
   ack_state_ = ack_result;
@@ -86,8 +86,8 @@ void MockInputDispositionHandler::RecordAckCalled(
 
 void MockInputDispositionHandler::OnKeyboardEventAck(
     const NativeWebKeyboardEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   VLOG(1) << __FUNCTION__ << " called!";
   acked_key_event_ = std::make_unique<NativeWebKeyboardEvent>(event.event);
   RecordAckCalled(event.event.GetType(), ack_result);
@@ -95,8 +95,8 @@ void MockInputDispositionHandler::OnKeyboardEventAck(
 
 void MockInputDispositionHandler::OnMouseEventAck(
     const MouseEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   VLOG(1) << __FUNCTION__ << " called!";
   acked_mouse_event_ = event.event;
   RecordAckCalled(event.event.GetType(), ack_result);
diff --git a/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.h b/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.h
index 7cc96a180a6..71c2b25d690 100644
--- a/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.h
+++ b/chromium/content/browser/renderer_host/input/mock_input_disposition_handler.h
@@ -27,14 +27,15 @@ class MockInputDispositionHandler : public InputDispositionHandler {
 
   // InputDispositionHandler
   void OnWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
   void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
-  void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                         InputEventAckSource ack_source,
-                         InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
+  void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override;
 
   size_t GetAndResetAckCount();
 
@@ -52,9 +53,9 @@ class MockInputDispositionHandler : public InputDispositionHandler {
     touch_followup_event_ = std::move(event);
   }
 
-  InputEventAckState ack_state() const { return ack_state_; }
+  blink::mojom::InputEventResultState ack_state() const { return ack_state_; }
 
-  InputEventAckState acked_wheel_event_state() const {
+  blink::mojom::InputEventResultState acked_wheel_event_state() const {
     return acked_wheel_event_state_;
   }
 
@@ -75,21 +76,21 @@ class MockInputDispositionHandler : public InputDispositionHandler {
 
  private:
   void RecordAckCalled(blink::WebInputEvent::Type eventType,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultState ack_result);
 
   void OnKeyboardEventAck(const NativeWebKeyboardEventWithLatencyInfo& event,
-                          InputEventAckSource ack_source,
-                          InputEventAckState ack_result);
+                          blink::mojom::InputEventResultSource ack_source,
+                          blink::mojom::InputEventResultState ack_result);
   void OnMouseEventAck(const MouseEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result);
 
   InputRouter* input_router_;
 
   size_t ack_count_;
   blink::WebInputEvent::Type ack_event_type_;
-  InputEventAckState ack_state_;
-  InputEventAckState acked_wheel_event_state_;
+  blink::mojom::InputEventResultState ack_state_;
+  blink::mojom::InputEventResultState acked_wheel_event_state_;
   std::unique_ptr<NativeWebKeyboardEvent> acked_key_event_;
   blink::WebMouseWheelEvent acked_wheel_event_;
   TouchEventWithLatencyInfo acked_touch_event_;
diff --git a/chromium/content/browser/renderer_host/input/mock_input_router.cc b/chromium/content/browser/renderer_host/input/mock_input_router.cc
index d3c4e44cb12..40557631617 100644
--- a/chromium/content/browser/renderer_host/input/mock_input_router.cc
+++ b/chromium/content/browser/renderer_host/input/mock_input_router.cc
@@ -30,7 +30,7 @@ void MockInputRouter::SendTouchEvent(
     const TouchEventWithLatencyInfo& touch_event) {
   send_touch_event_not_cancelled_ =
       client_->FilterInputEvent(touch_event.event, touch_event.latency) ==
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+      blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 bool MockInputRouter::HasPendingEvents() const {
diff --git a/chromium/content/browser/renderer_host/input/mock_input_router_client.cc b/chromium/content/browser/renderer_host/input/mock_input_router_client.cc
index 3cb546c3362..7c1102b7ad5 100644
--- a/chromium/content/browser/renderer_host/input/mock_input_router_client.cc
+++ b/chromium/content/browser/renderer_host/input/mock_input_router_client.cc
@@ -21,13 +21,13 @@ namespace content {
 MockInputRouterClient::MockInputRouterClient()
     : input_router_(nullptr),
       in_flight_event_count_(0),
-      filter_state_(INPUT_EVENT_ACK_STATE_NOT_CONSUMED),
+      filter_state_(blink::mojom::InputEventResultState::kNotConsumed),
       filter_input_event_called_(false),
       white_listed_touch_action_(cc::TouchAction::kAuto) {}
 
 MockInputRouterClient::~MockInputRouterClient() {}
 
-InputEventAckState MockInputRouterClient::FilterInputEvent(
+blink::mojom::InputEventResultState MockInputRouterClient::FilterInputEvent(
     const WebInputEvent& input_event,
     const ui::LatencyInfo& latency_info) {
   filter_input_event_called_ = true;
@@ -40,7 +40,7 @@ void MockInputRouterClient::IncrementInFlightEventCount() {
 }
 
 void MockInputRouterClient::DecrementInFlightEventCount(
-    InputEventAckSource ack_source) {
+    blink::mojom::InputEventResultSource ack_source) {
   --in_flight_event_count_;
 }
 
@@ -66,9 +66,10 @@ void MockInputRouterClient::ForwardGestureEventWithLatencyInfo(
   if (gesture_event.SourceDevice() != blink::WebGestureDevice::kTouchpad)
     return;
 
-  if (gesture_event.GetType() == WebInputEvent::kGestureScrollBegin) {
+  if (gesture_event.GetType() == WebInputEvent::Type::kGestureScrollBegin) {
     is_wheel_scroll_in_progress_ = true;
-  } else if (gesture_event.GetType() == WebInputEvent::kGestureScrollEnd) {
+  } else if (gesture_event.GetType() ==
+             WebInputEvent::Type::kGestureScrollEnd) {
     is_wheel_scroll_in_progress_ = false;
   }
 }
diff --git a/chromium/content/browser/renderer_host/input/mock_input_router_client.h b/chromium/content/browser/renderer_host/input/mock_input_router_client.h
index 2bdb4fb259b..333a84c6b58 100644
--- a/chromium/content/browser/renderer_host/input/mock_input_router_client.h
+++ b/chromium/content/browser/renderer_host/input/mock_input_router_client.h
@@ -25,11 +25,12 @@ class MockInputRouterClient : public InputRouterClient,
   ~MockInputRouterClient() override;
 
   // InputRouterClient
-  InputEventAckState FilterInputEvent(
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event,
       const ui::LatencyInfo& latency_info) override;
   void IncrementInFlightEventCount() override;
-  void DecrementInFlightEventCount(InputEventAckSource ack_source) override;
+  void DecrementInFlightEventCount(
+      blink::mojom::InputEventResultSource ack_source) override;
   void DidOverscroll(const ui::DidOverscrollParams& params) override;
   void OnSetWhiteListedTouchAction(cc::TouchAction touch_action) override;
   void DidStartScrollingViewport() override;
@@ -47,17 +48,8 @@ class MockInputRouterClient : public InputRouterClient,
                         bool unadjusted_movement,
                         mojom::WidgetInputHandlerHost::RequestMouseLockCallback
                             response) override {}
-  void RequestMouseLockChange(
-      bool unadjusted_movement,
-      mojom::WidgetInputHandlerHost::RequestMouseLockCallback response)
-      override {}
-  void UnlockMouse() override {}
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override {}
-  void FallbackCursorModeSetCursorVisibility(bool visible) override {}
   gfx::Size GetRootWidgetViewportSize() override;
+  void OnInvalidInputEventSource() override {}
 
   bool GetAndResetFilterEventCalled();
   ui::DidOverscrollParams GetAndResetOverscroll();
@@ -67,7 +59,7 @@ class MockInputRouterClient : public InputRouterClient,
     input_router_ = input_router;
   }
 
-  void set_filter_state(InputEventAckState filter_state) {
+  void set_filter_state(blink::mojom::InputEventResultState filter_state) {
     filter_state_ = filter_state;
   }
   int in_flight_event_count() const {
@@ -77,7 +69,7 @@ class MockInputRouterClient : public InputRouterClient,
     return last_filter_event()->GetType();
   }
   void set_allow_send_event(bool allow) {
-    filter_state_ = INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+    filter_state_ = blink::mojom::InputEventResultState::kNoConsumerExists;
   }
   const blink::WebInputEvent* last_filter_event() const {
     return last_filter_event_->web_event.get();
@@ -94,7 +86,7 @@ class MockInputRouterClient : public InputRouterClient,
   InputRouter* input_router_;
   int in_flight_event_count_;
 
-  InputEventAckState filter_state_;
+  blink::mojom::InputEventResultState filter_state_;
 
   bool filter_input_event_called_;
   std::unique_ptr<InputEvent> last_filter_event_;
diff --git a/chromium/content/browser/renderer_host/input/motion_event_web.cc b/chromium/content/browser/renderer_host/input/motion_event_web.cc
index 35f500e499d..daf6644a689 100644
--- a/chromium/content/browser/renderer_host/input/motion_event_web.cc
+++ b/chromium/content/browser/renderer_host/input/motion_event_web.cc
@@ -4,7 +4,8 @@
 
 #include "content/browser/renderer_host/input/motion_event_web.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/numerics/math_constants.h"
 #include "content/common/input/web_touch_event_traits.h"
 #include "ui/events/blink/blink_event_util.h"
@@ -21,23 +22,23 @@ namespace {
 ui::MotionEvent::Action GetActionFrom(const WebTouchEvent& event) {
   DCHECK(event.touches_length);
   switch (event.GetType()) {
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchStart:
       if (WebTouchEventTraits::AllTouchPointsHaveState(
-              event, WebTouchPoint::kStatePressed))
+              event, WebTouchPoint::State::kStatePressed))
         return ui::MotionEvent::Action::DOWN;
       else
         return ui::MotionEvent::Action::POINTER_DOWN;
-    case WebInputEvent::kTouchEnd:
+    case WebInputEvent::Type::kTouchEnd:
       if (WebTouchEventTraits::AllTouchPointsHaveState(
-              event, WebTouchPoint::kStateReleased))
+              event, WebTouchPoint::State::kStateReleased))
         return ui::MotionEvent::Action::UP;
       else
         return ui::MotionEvent::Action::POINTER_UP;
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchCancel:
       DCHECK(WebTouchEventTraits::AllTouchPointsHaveState(
-          event, WebTouchPoint::kStateCancelled));
+          event, WebTouchPoint::State::kStateCancelled));
       return ui::MotionEvent::Action::CANCEL;
-    case WebInputEvent::kTouchMove:
+    case WebInputEvent::Type::kTouchMove:
       return ui::MotionEvent::Action::MOVE;
     default:
       break;
@@ -49,8 +50,8 @@ ui::MotionEvent::Action GetActionFrom(const WebTouchEvent& event) {
 
 int GetActionIndexFrom(const WebTouchEvent& event) {
   for (size_t i = 0; i < event.touches_length; ++i) {
-    if (event.touches[i].state != WebTouchPoint::kStateUndefined &&
-        event.touches[i].state != WebTouchPoint::kStateStationary)
+    if (event.touches[i].state != WebTouchPoint::State::kStateUndefined &&
+        event.touches[i].state != WebTouchPoint::State::kStateStationary)
       return i;
   }
   return -1;
diff --git a/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc b/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
index f2452c24fd0..cfc239f3fd6 100644
--- a/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
@@ -24,6 +24,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/tracing_controller.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -87,9 +88,10 @@ class TracingRenderWidgetHost : public RenderWidgetHostImpl {
                              std::make_unique<FrameTokenMessageQueue>()) {
   }
 
-  void OnMouseEventAck(const MouseEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override {
+  void OnMouseEventAck(
+      const MouseEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override {
     RenderWidgetHostImpl::OnMouseEventAck(event, ack_source, ack_result);
   }
 
@@ -304,24 +306,16 @@ class MouseLatencyBrowserTest : public ContentBrowserTest {
 // MouseDown events in the case where no swap is generated.
 // Disabled on Android because we don't support synthetic mouse input on
 // Android (crbug.com/723618).
-// Disabled on Windows due to flakyness (https://crbug.com/800303).
-// Disabled on Linux due to flakyness (https://crbug.com/815363).
-#if defined(OS_ANDROID) || defined(OS_WIN) || defined(OS_LINUX)
-#define MAYBE_MouseDownAndUpRecordedWithoutSwap \
-  DISABLED_MouseDownAndUpRecordedWithoutSwap
-#else
-#define MAYBE_MouseDownAndUpRecordedWithoutSwap \
-  MouseDownAndUpRecordedWithoutSwap
-#endif
+// Disabled on due to flakiness (https://crbug.com/800303, https://crbug.com/815363).
 IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
-                       MAYBE_MouseDownAndUpRecordedWithoutSwap) {
+                       DISABLED_MouseDownAndUpRecordedWithoutSwap) {
   LoadURL();
 
   auto filter = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kMouseUp);
+      GetWidgetHost(), blink::WebInputEvent::Type::kMouseUp);
   StartTracing();
   DoSyncClick(gfx::PointF(100, 100));
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
             filter->GetAckStateWaitIfNecessary());
   const base::Value& trace_data = StopTracing();
 
@@ -357,17 +351,9 @@ IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
 // events in the case where events are coalesced. (crbug.com/771165).
 // Disabled on Android because we don't support synthetic mouse input on Android
 // (crbug.com/723618).
-// http://crbug.com/801629 : Flaky on Linux and Windows, and Mac with
-// --enable-features=VizDisplayCompositor
-#if defined(OS_ANDROID) || defined(OS_WIN) || defined(OS_LINUX)
-#define MAYBE_CoalescedMouseMovesCorrectlyTerminated \
-  DISABLED_CoalescedMouseMovesCorrectlyTerminated
-#else
-#define MAYBE_CoalescedMouseMovesCorrectlyTerminated \
-  CoalescedMouseMovesCorrectlyTerminated
-#endif
+// http://crbug.com/801629 : Flaky on multiple platforms.
 IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
-                       MAYBE_CoalescedMouseMovesCorrectlyTerminated) {
+                       DISABLED_CoalescedMouseMovesCorrectlyTerminated) {
   LoadURL();
 
   StartTracing();
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
index 8d0314dd035..35da2e0a436 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
@@ -65,8 +65,8 @@ void MouseWheelEventQueue::QueueEvent(
 }
 
 bool MouseWheelEventQueue::CanGenerateGestureScroll(
-    InputEventAckState ack_result) const {
-  if (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED) {
+    blink::mojom::InputEventResultState ack_result) const {
+  if (ack_result == blink::mojom::InputEventResultState::kConsumed) {
     TRACE_EVENT_INSTANT0("input", "Wheel Event Consumed",
                          TRACE_EVENT_SCOPE_THREAD);
     return false;
@@ -101,8 +101,8 @@ bool MouseWheelEventQueue::CanGenerateGestureScroll(
 
 void MouseWheelEventQueue::ProcessMouseWheelAck(
     const MouseWheelEventWithLatencyInfo& ack_event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   TRACE_EVENT0("input", "MouseWheelEventQueue::ProcessMouseWheelAck");
   if (!event_sent_for_gesture_ack_)
     return;
@@ -114,7 +114,7 @@ void MouseWheelEventQueue::ProcessMouseWheelAck(
   // If event wasn't consumed then generate a gesture scroll for it.
   if (CanGenerateGestureScroll(ack_result)) {
     WebGestureEvent scroll_update(
-        WebInputEvent::kGestureScrollUpdate, WebInputEvent::kNoModifiers,
+        WebInputEvent::Type::kGestureScrollUpdate, WebInputEvent::kNoModifiers,
         event_sent_for_gesture_ack_->event.TimeStamp(),
         blink::WebGestureDevice::kTouchpad);
 
@@ -248,14 +248,14 @@ void MouseWheelEventQueue::ProcessMouseWheelAck(
 void MouseWheelEventQueue::OnGestureScrollEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
   if (gesture_event.event.GetType() ==
-      blink::WebInputEvent::kGestureScrollBegin) {
+      blink::WebInputEvent::Type::kGestureScrollBegin) {
     scrolling_device_ = gesture_event.event.SourceDevice();
   } else if (scrolling_device_ == gesture_event.event.SourceDevice() &&
              gesture_event.event.GetType() ==
-                 blink::WebInputEvent::kGestureScrollEnd) {
+                 blink::WebInputEvent::Type::kGestureScrollEnd) {
     scrolling_device_ = blink::WebGestureDevice::kUninitialized;
   } else if (gesture_event.event.GetType() ==
-             blink::WebInputEvent::kGestureFlingStart) {
+             blink::WebInputEvent::Type::kGestureFlingStart) {
     // With browser side fling we shouldn't reset scrolling_device_ on GFS since
     // the fling_controller processes the GFS to generate and send GSU events.
   }
@@ -279,7 +279,7 @@ void MouseWheelEventQueue::TryForwardNextEventToRenderer() {
     send_wheel_events_async_ = false;
   } else if (send_wheel_events_async_) {
     event_sent_for_gesture_ack_->event.dispatch_type =
-        WebInputEvent::kEventNonBlocking;
+        WebInputEvent::DispatchType::kEventNonBlocking;
   }
 
   client_->SendMouseWheelEventImmediately(
@@ -294,7 +294,7 @@ void MouseWheelEventQueue::SendScrollEnd(WebGestureEvent update_event,
 
   WebGestureEvent scroll_end(update_event);
   scroll_end.SetTimeStamp(ui::EventTimeForNow());
-  scroll_end.SetType(WebInputEvent::kGestureScrollEnd);
+  scroll_end.SetType(WebInputEvent::Type::kGestureScrollEnd);
   scroll_end.data.scroll_end.synthetic = synthetic;
   scroll_end.data.scroll_end.inertial_phase =
       update_event.data.scroll_update.inertial_phase;
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.h b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.h
index c2b1bc14625..3e4414b3d03 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.h
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.h
@@ -13,9 +13,8 @@
 #include "base/trace_event/trace_event.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -42,15 +41,16 @@ class CONTENT_EXPORT MouseWheelEventQueueClient {
  public:
   using MouseWheelEventHandledCallback =
       base::OnceCallback<void(const MouseWheelEventWithLatencyInfo& ack_event,
-                              InputEventAckSource ack_source,
-                              InputEventAckState ack_result)>;
+                              blink::mojom::InputEventResultSource ack_source,
+                              blink::mojom::InputEventResultState ack_result)>;
   virtual ~MouseWheelEventQueueClient() {}
   virtual void SendMouseWheelEventImmediately(
       const MouseWheelEventWithLatencyInfo& event,
       MouseWheelEventHandledCallback callback) = 0;
-  virtual void OnMouseWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                                    InputEventAckSource ack_source,
-                                    InputEventAckState ack_result) = 0;
+  virtual void OnMouseWheelEventAck(
+      const MouseWheelEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
   virtual void ForwardGestureEventWithLatencyInfo(
       const blink::WebGestureEvent& event,
       const ui::LatencyInfo& latency_info) = 0;
@@ -58,7 +58,19 @@ class CONTENT_EXPORT MouseWheelEventQueueClient {
   virtual bool IsAutoscrollInProgress() = 0;
 };
 
-// A queue for throttling and coalescing mouse wheel events.
+// A queue for throttling and coalescing mouse wheel events. This class tracks
+// wheel events sent to the renderer and receives their ACKs. If the ACK
+// reports the event went unconsumed by the renderer, this class will generate
+// a sequence of gesture scroll events.
+//
+// Within a sequence, wheel events are initially forwarded using a blocking
+// dispatch. This means that further wheel events are queued and scroll event
+// generation will wait (i.e.  block) until the in-flight wheel event is ACKed.
+// Once a wheel event goes unconsumed, and scrolling begins, dispatch of
+// subsequent wheel events becomes non-blocking. This means the wheel event
+// will be ACKed by the browser immediately after being dispatched. This will
+// cause scroll events to follow the wheel immediately and new wheel events
+// will be dispatched immediately rather than queueing.
 class CONTENT_EXPORT MouseWheelEventQueue {
  public:
   // The |client| must outlive the MouseWheelEventQueue.
@@ -93,8 +105,8 @@ class CONTENT_EXPORT MouseWheelEventQueue {
   // Notifies the queue that a mouse wheel event has been processed by the
   // renderer.
   void ProcessMouseWheelAck(const MouseWheelEventWithLatencyInfo& ack_event,
-                            InputEventAckSource ack_source,
-                            InputEventAckState ack_result);
+                            blink::mojom::InputEventResultSource ack_source,
+                            blink::mojom::InputEventResultState ack_result);
 
   void TryForwardNextEventToRenderer();
   void SendScrollEnd(blink::WebGestureEvent update_event, bool synthetic);
@@ -104,7 +116,8 @@ class CONTENT_EXPORT MouseWheelEventQueue {
 
   // True if gesture scroll events can be generated for the wheel event sent for
   // ack.
-  bool CanGenerateGestureScroll(InputEventAckState ack_result) const;
+  bool CanGenerateGestureScroll(
+      blink::mojom::InputEventResultState ack_result) const;
 
   MouseWheelEventQueueClient* client_;
 
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
index 68fa3da1be0..7d6707bfa28 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
@@ -34,12 +34,12 @@ const float kWheelScrollY = 12;
 const float kWheelScrollGlobalX = 50;
 const float kWheelScrollGlobalY = 72;
 
-#define EXPECT_GESTURE_SCROLL_BEGIN_IMPL(event)                    \
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, event->GetType()); \
-  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());         \
-  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());         \
-  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x());   \
-  EXPECT_EQ(kWheelScrollGlobalY, event->PositionInScreen().y());   \
+#define EXPECT_GESTURE_SCROLL_BEGIN_IMPL(event)                          \
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin, event->GetType()); \
+  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());               \
+  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());               \
+  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x());         \
+  EXPECT_EQ(kWheelScrollGlobalY, event->PositionInScreen().y());         \
   EXPECT_EQ(scroll_units, event->data.scroll_begin.delta_hint_units);
 
 #define EXPECT_GESTURE_SCROLL_BEGIN(event)                         \
@@ -72,12 +72,12 @@ const float kWheelScrollGlobalY = 72;
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum,   \
             event->data.scroll_begin.inertial_phase);
 
-#define EXPECT_GESTURE_SCROLL_UPDATE_IMPL(event)                    \
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, event->GetType()); \
-  EXPECT_EQ(scroll_units, event->data.scroll_update.delta_units);   \
-  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());          \
-  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());          \
-  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x());    \
+#define EXPECT_GESTURE_SCROLL_UPDATE_IMPL(event)                          \
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate, event->GetType()); \
+  EXPECT_EQ(scroll_units, event->data.scroll_update.delta_units);         \
+  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());                \
+  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());                \
+  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x());          \
   EXPECT_EQ(kWheelScrollGlobalY, event->PositionInScreen().y());
 
 #define EXPECT_GESTURE_SCROLL_UPDATE(event)                        \
@@ -95,12 +95,12 @@ const float kWheelScrollGlobalY = 72;
   EXPECT_EQ(WebGestureEvent::InertialPhaseState::kMomentum, \
             event->data.scroll_update.inertial_phase);
 
-#define EXPECT_GESTURE_SCROLL_END_IMPL(event)                    \
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, event->GetType()); \
-  EXPECT_EQ(scroll_units, event->data.scroll_end.delta_units);   \
-  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());       \
-  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());       \
-  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x()); \
+#define EXPECT_GESTURE_SCROLL_END_IMPL(event)                          \
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd, event->GetType()); \
+  EXPECT_EQ(scroll_units, event->data.scroll_end.delta_units);         \
+  EXPECT_EQ(kWheelScrollX, event->PositionInWidget().x());             \
+  EXPECT_EQ(kWheelScrollY, event->PositionInWidget().y());             \
+  EXPECT_EQ(kWheelScrollGlobalX, event->PositionInScreen().x());       \
   EXPECT_EQ(kWheelScrollGlobalY, event->PositionInScreen().y());
 
 #define EXPECT_GESTURE_SCROLL_END(event)                           \
@@ -137,7 +137,7 @@ const float kWheelScrollGlobalY = 72;
 #endif
 
 #define EXPECT_MOUSE_WHEEL(event) \
-  EXPECT_EQ(WebInputEvent::kMouseWheel, event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, event->GetType());
 
 }  // namespace
 
@@ -148,7 +148,7 @@ class MouseWheelEventQueueTest : public testing::Test,
       : task_environment_(
             base::test::SingleThreadTaskEnvironment::MainThreadType::UI),
         acked_event_count_(0),
-        last_acked_event_state_(INPUT_EVENT_ACK_STATE_UNKNOWN) {
+        last_acked_event_state_(blink::mojom::InputEventResultState::kUnknown) {
     queue_.reset(new MouseWheelEventQueue(this));
   }
 
@@ -165,7 +165,8 @@ class MouseWheelEventQueueTest : public testing::Test,
     callbacks_.emplace_back(base::BindOnce(
         [](MouseWheelEventHandledCallback callback,
            const MouseWheelEventWithLatencyInfo& event,
-           InputEventAckSource ack_source, InputEventAckState ack_result) {
+           blink::mojom::InputEventResultSource ack_source,
+           blink::mojom::InputEventResultState ack_result) {
           std::move(callback).Run(event, ack_source, ack_result);
         },
         std::move(callback), event));
@@ -177,17 +178,18 @@ class MouseWheelEventQueueTest : public testing::Test,
     WebGestureEvent* cloned_event = new WebGestureEvent();
     std::unique_ptr<WebInputEvent> cloned_event_holder(cloned_event);
     *cloned_event = event;
-    if (event.GetType() == WebInputEvent::kGestureScrollBegin) {
+    if (event.GetType() == WebInputEvent::Type::kGestureScrollBegin) {
       is_wheel_scroll_in_progress_ = true;
-    } else if (event.GetType() == WebInputEvent::kGestureScrollEnd) {
+    } else if (event.GetType() == WebInputEvent::Type::kGestureScrollEnd) {
       is_wheel_scroll_in_progress_ = false;
     }
     sent_events_.push_back(std::move(cloned_event_holder));
   }
 
-  void OnMouseWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                            InputEventAckSource ack_source,
-                            InputEventAckState ack_result) override {
+  void OnMouseWheelEventAck(
+      const MouseWheelEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override {
     ++acked_event_count_;
     last_acked_event_ = event.event;
     last_acked_event_state_ = ack_result;
@@ -201,8 +203,8 @@ class MouseWheelEventQueueTest : public testing::Test,
 
  protected:
   using HandleEventCallback =
-      base::OnceCallback<void(InputEventAckSource ack_source,
-                              InputEventAckState ack_result)>;
+      base::OnceCallback<void(blink::mojom::InputEventResultSource ack_source,
+                              blink::mojom::InputEventResultState ack_result)>;
 
   size_t queued_event_count() const { return queue_->queued_size(); }
 
@@ -233,9 +235,10 @@ class MouseWheelEventQueueTest : public testing::Test,
     return count;
   }
 
-  void SendMouseWheelEventAck(InputEventAckState ack_result) {
+  void SendMouseWheelEventAck(blink::mojom::InputEventResultState ack_result) {
     std::move(callbacks_.front())
-        .Run(InputEventAckSource::COMPOSITOR_THREAD, ack_result);
+        .Run(blink::mojom::InputEventResultSource::kCompositorThread,
+             ack_result);
     callbacks_.pop_front();
   }
 
@@ -316,10 +319,10 @@ class MouseWheelEventQueueTest : public testing::Test,
 
     // Receive an ACK for the mouse wheel event and release the next
     // mouse wheel event.
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(0U, queued_event_count());
     EXPECT_TRUE(event_in_flight());
-    EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+    EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
     EXPECT_EQ(1U, GetAndResetAckedEventCount());
     EXPECT_EQ(3U, all_sent_events().size());
     EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
@@ -338,7 +341,7 @@ class MouseWheelEventQueueTest : public testing::Test,
                    WebMouseWheelEvent::kPhaseBegan,
                    WebMouseWheelEvent::kPhaseNone);
     EXPECT_EQ(1U, GetAndResetSentEventCount());
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(2U, all_sent_events().size());
     EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
     EXPECT_GESTURE_SCROLL_UPDATE_WITH_PHASE(sent_gesture_event(1));
@@ -349,7 +352,7 @@ class MouseWheelEventQueueTest : public testing::Test,
                    WebMouseWheelEvent::kPhaseChanged,
                    WebMouseWheelEvent::kPhaseNone);
     EXPECT_EQ(1U, GetAndResetSentEventCount());
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1U, all_sent_events().size());
     EXPECT_GESTURE_SCROLL_UPDATE_WITH_PHASE(sent_gesture_event(0));
     EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -359,7 +362,7 @@ class MouseWheelEventQueueTest : public testing::Test,
                    WebMouseWheelEvent::kPhaseNone,
                    WebMouseWheelEvent::kPhaseBegan);
     EXPECT_EQ(1U, GetAndResetSentEventCount());
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     // A fling has started, no ScrollEnd/ScrollBegin is sent.
     EXPECT_EQ(1U, all_sent_events().size());
     EXPECT_INERTIAL_GESTURE_SCROLL_UPDATE(sent_gesture_event(0));
@@ -370,7 +373,7 @@ class MouseWheelEventQueueTest : public testing::Test,
                    WebMouseWheelEvent::kPhaseNone,
                    WebMouseWheelEvent::kPhaseChanged);
     EXPECT_EQ(1U, GetAndResetSentEventCount());
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1U, all_sent_events().size());
     EXPECT_INERTIAL_GESTURE_SCROLL_UPDATE(sent_gesture_event(0));
     EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -380,7 +383,7 @@ class MouseWheelEventQueueTest : public testing::Test,
                    WebMouseWheelEvent::kPhaseNone,
                    WebMouseWheelEvent::kPhaseEnded);
     EXPECT_EQ(1U, GetAndResetSentEventCount());
-    SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
     // MomentumPhase is ended, the scroll is done, and GSE is sent
     // immediately.
     EXPECT_EQ(1U, all_sent_events().size());
@@ -393,7 +396,7 @@ class MouseWheelEventQueueTest : public testing::Test,
   std::vector<std::unique_ptr<WebInputEvent>> sent_events_;
   base::circular_deque<HandleEventCallback> callbacks_;
   size_t acked_event_count_;
-  InputEventAckState last_acked_event_state_;
+  blink::mojom::InputEventResultState last_acked_event_state_;
   WebMouseWheelEvent last_acked_event_;
 
  private:
@@ -420,20 +423,20 @@ TEST_F(MouseWheelEventQueueTest, Basic) {
   EXPECT_EQ(0U, GetAndResetSentEventCount());
 
   // Receive an ACK for the first mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_TRUE(event_in_flight());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
 
   // Receive an ACK for the second mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
 }
 
 TEST_F(MouseWheelEventQueueTest, GestureSending) {
@@ -467,7 +470,7 @@ TEST_F(MouseWheelEventQueueTest, WheelEndWithMomentumPhaseEndedInformation) {
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_TRUE(event_in_flight());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
   EXPECT_GESTURE_SCROLL_UPDATE_WITH_PHASE(sent_gesture_event(1));
   EXPECT_EQ(2U, GetAndResetSentEventCount());
@@ -479,7 +482,7 @@ TEST_F(MouseWheelEventQueueTest, WheelEndWithMomentumPhaseEndedInformation) {
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_TRUE(event_in_flight());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_EQ(1U, all_sent_events().size());
   EXPECT_SYNTHETIC_INERTIAL_GESTURE_SCROLL_END(sent_gesture_event(0));
@@ -499,10 +502,10 @@ TEST_F(MouseWheelEventQueueTest, GestureSendingInterrupted) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(2U, all_sent_events().size());
   EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
@@ -516,11 +519,11 @@ TEST_F(MouseWheelEventQueueTest, GestureSendingInterrupted) {
                  kWheelScrollGlobalY, 0, 0, 0, false,
                  WebMouseWheelEvent::kPhaseEnded,
                  WebMouseWheelEvent::kPhaseNone);
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Ensure that a gesture scroll begin terminates the current scroll event.
-  SendGestureEvent(WebInputEvent::kGestureScrollBegin);
+  SendGestureEvent(WebInputEvent::Type::kGestureScrollBegin);
 
   EXPECT_EQ(2U, all_sent_events().size());
   EXPECT_GESTURE_SCROLL_END_WITH_PHASE(sent_gesture_event(1));
@@ -537,14 +540,14 @@ TEST_F(MouseWheelEventQueueTest, GestureSendingInterrupted) {
 
   // New mouse wheel events won't cause gestures because a scroll
   // is already in progress by another device.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, all_sent_events().size());
 
-  SendGestureEvent(WebInputEvent::kGestureScrollEnd);
+  SendGestureEvent(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_EQ(0U, all_sent_events().size());
 
   SendMouseWheel(kWheelScrollX, kWheelScrollY, kWheelScrollGlobalX,
@@ -557,10 +560,10 @@ TEST_F(MouseWheelEventQueueTest, GestureSendingInterrupted) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(2U, all_sent_events().size());
   EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
@@ -580,10 +583,10 @@ TEST_F(MouseWheelEventQueueTest, GestureRailScrolling) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(2U, all_sent_events().size());
   EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
@@ -602,10 +605,10 @@ TEST_F(MouseWheelEventQueueTest, GestureRailScrolling) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   size_t scroll_update_index = 0;
   EXPECT_EQ(1U, all_sent_events().size());
@@ -630,10 +633,10 @@ TEST_F(MouseWheelEventQueueTest, WheelScrollLatching) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(2U, all_sent_events().size());
   EXPECT_GESTURE_SCROLL_BEGIN_WITH_PHASE(sent_gesture_event(0));
@@ -651,10 +654,10 @@ TEST_F(MouseWheelEventQueueTest, WheelScrollLatching) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Scroll latching: no new scroll begin expected.
@@ -673,16 +676,16 @@ TEST_F(MouseWheelEventQueueTest, WheelScrollingWasLatchedHistogramCheck) {
                  kWheelScrollGlobalY, 1, 1, 0, false,
                  WebMouseWheelEvent::kPhaseBegan,
                  WebMouseWheelEvent::kPhaseNone);
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   histogram_tester.ExpectBucketCount(latching_histogram_name, 0, 1);
 
   SendMouseWheel(kWheelScrollX, kWheelScrollY, kWheelScrollGlobalX,
                  kWheelScrollGlobalY, 1, 1, 0, false,
                  WebMouseWheelEvent::kPhaseChanged,
                  WebMouseWheelEvent::kPhaseNone);
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-    histogram_tester.ExpectBucketCount(latching_histogram_name, 0, 1);
-    histogram_tester.ExpectBucketCount(latching_histogram_name, 1, 1);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  histogram_tester.ExpectBucketCount(latching_histogram_name, 0, 1);
+  histogram_tester.ExpectBucketCount(latching_histogram_name, 1, 1);
 }
 
 #if defined(OS_MACOSX)
@@ -698,10 +701,10 @@ TEST_F(MouseWheelEventQueueTest, DoNotSwapXYForShiftScroll) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the mouse wheel event.
-  SendMouseWheelEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendMouseWheelEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(event_in_flight());
-  EXPECT_EQ(WebInputEvent::kMouseWheel, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   EXPECT_EQ(2U, all_sent_events().size());
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.cc b/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.cc
index 3231f779e6e..d5dcae9a259 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.cc
@@ -240,13 +240,13 @@ bool MouseWheelPhaseHandler::ShouldBreakLatchingDueToDirectionChange(
 
 void MouseWheelPhaseHandler::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
-  if (event.GetType() != blink::WebInputEvent::kGestureScrollUpdate ||
+    blink::mojom::InputEventResultState ack_result) {
+  if (event.GetType() != blink::WebInputEvent::Type::kGestureScrollUpdate ||
       first_scroll_update_ack_state_ !=
           FirstScrollUpdateAckState::kNotArrived) {
     return;
   }
-  if (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED)
+  if (ack_result == blink::mojom::InputEventResultState::kConsumed)
     first_scroll_update_ack_state_ = FirstScrollUpdateAckState::kConsumed;
   else
     first_scroll_update_ack_state_ = FirstScrollUpdateAckState::kNotConsumed;
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.h b/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.h
index 255b08480ba..316beb47629 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.h
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_phase_handler.h
@@ -8,8 +8,8 @@
 #include "base/timer/timer.h"
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 class RenderWidgetHostViewBase;
@@ -73,7 +73,7 @@ class CONTENT_EXPORT MouseWheelPhaseHandler {
     return mouse_wheel_end_dispatch_timer_.IsRunning();
   }
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultState ack_result);
 
   // Used to verify the correctness of touchpad_scroll_phase_state_'s value in
   // testing.
diff --git a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
index c8d490159e1..dcc3fdf2e21 100644
--- a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
@@ -45,14 +45,14 @@ bool HasPointChanged(const WebTouchPoint& point_1,
 // static
 const base::FeatureParam<std::string>
     PassthroughTouchEventQueue::kSkipTouchEventFilterType{
-        &features::kSkipTouchEventFilter,
-        features::kSkipTouchEventFilterTypeParamName,
-        features::kSkipTouchEventFilterTypeParamValueDiscrete};
+        &blink::features::kSkipTouchEventFilter,
+        blink::features::kSkipTouchEventFilterTypeParamName,
+        blink::features::kSkipTouchEventFilterTypeParamValueDiscrete};
 
 PassthroughTouchEventQueue::TouchEventWithLatencyInfoAndAckState::
     TouchEventWithLatencyInfoAndAckState(const TouchEventWithLatencyInfo& event)
     : TouchEventWithLatencyInfo(event),
-      ack_state_(INPUT_EVENT_ACK_STATE_UNKNOWN) {}
+      ack_state_(blink::mojom::InputEventResultState::kUnknown) {}
 
 bool PassthroughTouchEventQueue::TouchEventWithLatencyInfoAndAckState::
 operator<(const TouchEventWithLatencyInfoAndAckState& other) const {
@@ -83,7 +83,7 @@ void PassthroughTouchEventQueue::SendTouchCancelEventForTouchEvent(
     const TouchEventWithLatencyInfo& event_to_cancel) {
   TouchEventWithLatencyInfo event = event_to_cancel;
   WebTouchEventTraits::ResetTypeAndTouchStates(
-      WebInputEvent::kTouchCancel,
+      WebInputEvent::Type::kTouchCancel,
       // TODO(rbyers): Shouldn't we use a fresh timestamp?
       event.event.TimeStamp(), &event.event);
   SendTouchEventImmediately(&event, false);
@@ -102,8 +102,9 @@ void PassthroughTouchEventQueue::QueueEvent(
     client_->OnFilteringTouchEvent(event.event);
 
     TouchEventWithLatencyInfoAndAckState event_with_ack_state = event;
-    event_with_ack_state.set_ack_info(InputEventAckSource::BROWSER,
-                                      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    event_with_ack_state.set_ack_info(
+        blink::mojom::InputEventResultSource::kBrowser,
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     outstanding_touches_.insert(event_with_ack_state);
     AckCompletedEvents();
     return;
@@ -116,16 +117,16 @@ void PassthroughTouchEventQueue::PrependTouchScrollNotification() {
   TRACE_EVENT0("input",
                "PassthroughTouchEventQueue::PrependTouchScrollNotification");
 
-  TouchEventWithLatencyInfo touch(WebInputEvent::kTouchScrollStarted,
+  TouchEventWithLatencyInfo touch(WebInputEvent::Type::kTouchScrollStarted,
                                   WebInputEvent::kNoModifiers,
                                   ui::EventTimeForNow(), LatencyInfo());
-  touch.event.dispatch_type = WebInputEvent::kEventNonBlocking;
+  touch.event.dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
   SendTouchEventImmediately(&touch, true);
 }
 
 void PassthroughTouchEventQueue::ProcessTouchAck(
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result,
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result,
     const LatencyInfo& latency_info,
     const uint32_t unique_touch_event_id,
     bool should_stop_timeout_monitor) {
@@ -156,17 +157,19 @@ void PassthroughTouchEventQueue::ProcessTouchAck(
 void PassthroughTouchEventQueue::OnGestureScrollEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
   if (gesture_event.event.GetType() ==
-      blink::WebInputEvent::kGestureScrollUpdate) {
+      blink::WebInputEvent::Type::kGestureScrollUpdate) {
     send_touch_events_async_ = true;
   }
 }
 
 void PassthroughTouchEventQueue::OnGestureEventAck(
     const GestureEventWithLatencyInfo& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // Turn events sent during gesture scrolls to be async.
-  if (event.event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
-    send_touch_events_async_ = (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED);
+  if (event.event.GetType() ==
+      blink::WebInputEvent::Type::kGestureScrollUpdate) {
+    send_touch_events_async_ =
+        (ack_result == blink::mojom::InputEventResultState::kConsumed);
   }
 }
 
@@ -179,7 +182,7 @@ bool PassthroughTouchEventQueue::IsPendingAckTouchStart() const {
     return false;
 
   for (auto& iter : outstanding_touches_) {
-    if (iter.event.GetType() == WebInputEvent::kTouchStart)
+    if (iter.event.GetType() == WebInputEvent::Type::kTouchStart)
       return true;
   }
   return false;
@@ -214,9 +217,10 @@ void PassthroughTouchEventQueue::FlushQueue() {
     auto iter = outstanding_touches_.begin();
     TouchEventWithLatencyInfoAndAckState event = *iter;
     outstanding_touches_.erase(iter);
-    if (event.ack_state() == INPUT_EVENT_ACK_STATE_UNKNOWN)
-      event.set_ack_info(InputEventAckSource::BROWSER,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    if (event.ack_state() == blink::mojom::InputEventResultState::kUnknown)
+      event.set_ack_info(
+          blink::mojom::InputEventResultSource::kBrowser,
+          blink::mojom::InputEventResultState::kNoConsumerExists);
     AckTouchEventToClient(event, event.ack_source(), event.ack_state());
   }
 }
@@ -234,7 +238,7 @@ void PassthroughTouchEventQueue::AckCompletedEvents() {
   base::AutoReset<bool> process_acks(&processing_acks_, true);
   while (!outstanding_touches_.empty()) {
     auto iter = outstanding_touches_.begin();
-    if (iter->ack_state() == INPUT_EVENT_ACK_STATE_UNKNOWN)
+    if (iter->ack_state() == blink::mojom::InputEventResultState::kUnknown)
       break;
     TouchEventWithLatencyInfoAndAckState event = *iter;
     outstanding_touches_.erase(iter);
@@ -244,12 +248,12 @@ void PassthroughTouchEventQueue::AckCompletedEvents() {
 
 void PassthroughTouchEventQueue::AckTouchEventToClient(
     const TouchEventWithLatencyInfo& acked_event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   UpdateTouchConsumerStates(acked_event.event, ack_result);
 
   // Skip ack for TouchScrollStarted since it was synthesized within the queue.
-  if (acked_event.event.GetType() != WebInputEvent::kTouchScrollStarted) {
+  if (acked_event.event.GetType() != WebInputEvent::Type::kTouchScrollStarted) {
     client_->OnTouchEventAck(acked_event, ack_source, ack_result);
   }
 }
@@ -261,17 +265,17 @@ void PassthroughTouchEventQueue::SendTouchEventImmediately(
   // platform scrolling and JS pinching. Touchend events, however, remain
   // uncancelable, mitigating the risk of jank when transitioning to a fling.
   if (send_touch_events_async_ &&
-      touch->event.GetType() != WebInputEvent::kTouchStart)
-    touch->event.dispatch_type = WebInputEvent::kEventNonBlocking;
+      touch->event.GetType() != WebInputEvent::Type::kTouchStart)
+    touch->event.dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
 
-  if (touch->event.GetType() == WebInputEvent::kTouchStart)
+  if (touch->event.GetType() == WebInputEvent::Type::kTouchStart)
     touch->event.touch_start_or_first_touch_move = true;
 
   // For touchmove events, compare touch points position from current event
   // to last sent event and update touch points state.
-  if (touch->event.GetType() == WebInputEvent::kTouchMove) {
+  if (touch->event.GetType() == WebInputEvent::Type::kTouchMove) {
     CHECK(last_sent_touchevent_);
-    if (last_sent_touchevent_->GetType() == WebInputEvent::kTouchStart)
+    if (last_sent_touchevent_->GetType() == WebInputEvent::Type::kTouchStart)
       touch->event.touch_start_or_first_touch_move = true;
     for (unsigned int i = 0; i < last_sent_touchevent_->touches_length; ++i) {
       const WebTouchPoint& last_touch_point = last_sent_touchevent_->touches[i];
@@ -282,14 +286,15 @@ void PassthroughTouchEventQueue::SendTouchEventImmediately(
           continue;
 
         if (!HasPointChanged(last_touch_point, current_touchmove_point))
-          touch->event.touches[j].state = WebTouchPoint::kStateStationary;
+          touch->event.touches[j].state =
+              WebTouchPoint::State::kStateStationary;
 
         break;
       }
     }
   }
 
-  if (touch->event.GetType() != WebInputEvent::kTouchScrollStarted) {
+  if (touch->event.GetType() != WebInputEvent::Type::kTouchScrollStarted) {
     if (last_sent_touchevent_)
       *last_sent_touchevent_ = touch->event;
     else
@@ -329,11 +334,11 @@ bool PassthroughTouchEventQueue::ShouldFilterForEvent(
   // If the experiment is enabled and all events are forwarded, always skip
   // filtering.
   if (events_to_always_forward_ ==
-      features::kSkipTouchEventFilterTypeParamValueAll)
+      blink::features::kSkipTouchEventFilterTypeParamValueAll)
     return false;
   // If the experiment is enabled and only discrete events are forwarded,
   // always run filtering for touchmove events only.
-  return event.GetType() == WebInputEvent::kTouchMove;
+  return event.GetType() == WebInputEvent::Type::kTouchMove;
 }
 
 PassthroughTouchEventQueue::PreFilterResult
@@ -344,7 +349,7 @@ PassthroughTouchEventQueue::FilterBeforeForwardingImpl(
   if (timeout_handler_ && timeout_handler_->FilterEvent(event))
     return PreFilterResult::kFilteredTimeout;
 
-  if (event.GetType() == WebInputEvent::kTouchScrollStarted)
+  if (event.GetType() == WebInputEvent::Type::kTouchScrollStarted)
     return PreFilterResult::kUnfiltered;
 
   if (WebTouchEventTraits::IsTouchSequenceStart(event)) {
@@ -365,13 +370,13 @@ PassthroughTouchEventQueue::FilterBeforeForwardingImpl(
   }
 
   if (drop_remaining_touches_in_sequence_ &&
-      event.GetType() != WebInputEvent::kTouchCancel &&
+      event.GetType() != WebInputEvent::Type::kTouchCancel &&
       // If the SkipTouchEventFilter experiment is running, drop through to
       // the loop that filters events with no nonstationary pointers below.
       ShouldFilterForEvent(event))
     return PreFilterResult::kFilteredNoPageHandlers;
 
-  if (event.GetType() == WebInputEvent::kTouchStart) {
+  if (event.GetType() == WebInputEvent::Type::kTouchStart) {
     if (has_handlers_ || maybe_has_handler_for_current_sequence_)
       return PreFilterResult::kUnfiltered;
     // If the SkipTouchEventFilter experiment is running, drop through to
@@ -389,7 +394,7 @@ PassthroughTouchEventQueue::FilterBeforeForwardingImpl(
   // in the current touch sequence.
   for (size_t i = 0; i < event.touches_length; ++i) {
     const WebTouchPoint& point = event.touches[i];
-    if (point.state == WebTouchPoint::kStateStationary)
+    if (point.state == WebTouchPoint::State::kStateStationary)
       continue;
 
     // |last_sent_touchevent_| will be non-null as long as there is an
@@ -401,7 +406,7 @@ PassthroughTouchEventQueue::FilterBeforeForwardingImpl(
       if (point.id != last_sent_touchevent_->touches[j].id)
         continue;
 
-      if (event.GetType() != WebInputEvent::kTouchMove)
+      if (event.GetType() != WebInputEvent::Type::kTouchMove)
         return PreFilterResult::kUnfiltered;
 
       // All pointers in TouchMove events may have state as StateMoved,
@@ -422,9 +427,9 @@ PassthroughTouchEventQueue::FilterBeforeForwardingImpl(
 
 void PassthroughTouchEventQueue::UpdateTouchConsumerStates(
     const WebTouchEvent& event,
-    InputEventAckState ack_result) {
-  if (event.GetType() == WebInputEvent::kTouchStart) {
-    if (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED)
+    blink::mojom::InputEventResultState ack_result) {
+  if (event.GetType() == WebInputEvent::Type::kTouchStart) {
+    if (ack_result == blink::mojom::InputEventResultState::kConsumed)
       send_touch_events_async_ = false;
 
     // Once we have the ack back for the sequence we know if there
@@ -432,10 +437,10 @@ void PassthroughTouchEventQueue::UpdateTouchConsumerStates(
     // whether we have a handler or not as well.
     if (WebTouchEventTraits::IsTouchSequenceStart(event)) {
       maybe_has_handler_for_current_sequence_ =
-          ack_result != INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+          ack_result != blink::mojom::InputEventResultState::kNoConsumerExists;
     } else {
       maybe_has_handler_for_current_sequence_ |=
-          ack_result != INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+          ack_result != blink::mojom::InputEventResultState::kNoConsumerExists;
     }
   } else if (WebTouchEventTraits::IsTouchSequenceEnd(event)) {
     maybe_has_handler_for_current_sequence_ = false;
diff --git a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.h b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.h
index eca768479c6..024bea927d4 100644
--- a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.h
+++ b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.h
@@ -15,8 +15,8 @@
 #include "base/time/time.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/blink_features.h"
 
 namespace content {
@@ -32,9 +32,10 @@ class CONTENT_EXPORT PassthroughTouchEventQueueClient {
   virtual void SendTouchEventImmediately(
       const TouchEventWithLatencyInfo& event) = 0;
 
-  virtual void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                               InputEventAckSource ack_source,
-                               InputEventAckState ack_result) = 0;
+  virtual void OnTouchEventAck(
+      const TouchEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
 
   virtual void OnFilteringTouchEvent(
       const blink::WebTouchEvent& touch_event) = 0;
@@ -65,8 +66,8 @@ class CONTENT_EXPORT PassthroughTouchEventQueue {
           mobile_touch_ack_timeout_delay(
               base::TimeDelta::FromMilliseconds(1000)),
           touch_ack_timeout_supported(false),
-          skip_touch_filter(
-              base::FeatureList::IsEnabled(features::kSkipTouchEventFilter)),
+          skip_touch_filter(base::FeatureList::IsEnabled(
+              blink::features::kSkipTouchEventFilter)),
           events_to_always_forward(kSkipTouchEventFilterType.Get()) {}
 
     // Touch ack timeout delay for desktop sites. If zero, timeout behavior
@@ -96,15 +97,15 @@ class CONTENT_EXPORT PassthroughTouchEventQueue {
 
   void PrependTouchScrollNotification();
 
-  void ProcessTouchAck(InputEventAckSource ack_source,
-                       InputEventAckState ack_result,
+  void ProcessTouchAck(blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result,
                        const ui::LatencyInfo& latency_info,
                        const uint32_t unique_touch_event_id,
                        bool should_stop_timeout_monitor);
   void OnGestureScrollEvent(const GestureEventWithLatencyInfo& gesture_event);
 
   void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                         InputEventAckState ack_result);
+                         blink::mojom::InputEventResultState ack_result);
 
   void OnHasTouchEventHandlers(bool has_handlers);
 
@@ -127,8 +128,9 @@ class CONTENT_EXPORT PassthroughTouchEventQueue {
  protected:
   void SendTouchCancelEventForTouchEvent(
       const TouchEventWithLatencyInfo& event_to_cancel);
-  void UpdateTouchConsumerStates(const blink::WebTouchEvent& event,
-                                 InputEventAckState ack_result);
+  void UpdateTouchConsumerStates(
+      const blink::WebTouchEvent& event,
+      blink::mojom::InputEventResultState ack_result);
 
  private:
   friend class InputRouterImplTestBase;
@@ -171,16 +173,19 @@ class CONTENT_EXPORT PassthroughTouchEventQueue {
    public:
     TouchEventWithLatencyInfoAndAckState(const TouchEventWithLatencyInfo&);
     bool operator<(const TouchEventWithLatencyInfoAndAckState&) const;
-    InputEventAckState ack_state() const { return ack_state_; }
-    InputEventAckSource ack_source() const { return ack_source_; }
-    void set_ack_info(InputEventAckSource source, InputEventAckState state) {
+    blink::mojom::InputEventResultState ack_state() const { return ack_state_; }
+    blink::mojom::InputEventResultSource ack_source() const {
+      return ack_source_;
+    }
+    void set_ack_info(blink::mojom::InputEventResultSource source,
+                      blink::mojom::InputEventResultState state) {
       ack_source_ = source;
       ack_state_ = state;
     }
 
    private:
-    InputEventAckSource ack_source_;
-    InputEventAckState ack_state_;
+    blink::mojom::InputEventResultSource ack_source_;
+    blink::mojom::InputEventResultState ack_state_;
   };
 
   // These values are logged to UMA. Entries should not be renumbered and
@@ -202,8 +207,8 @@ class CONTENT_EXPORT PassthroughTouchEventQueue {
   bool ShouldFilterForEvent(const blink::WebTouchEvent& event);
 
   void AckTouchEventToClient(const TouchEventWithLatencyInfo& acked_event,
-                             InputEventAckSource ack_source,
-                             InputEventAckState ack_result);
+                             blink::mojom::InputEventResultSource ack_source,
+                             blink::mojom::InputEventResultState ack_result);
 
   void SendTouchEventImmediately(TouchEventWithLatencyInfo* touch,
                                  bool wait_for_ack);
diff --git a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue_unittest.cc b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue_unittest.cc
index 55bd76f94b2..b4c2e2df629 100644
--- a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue_unittest.cc
@@ -9,9 +9,9 @@
 #include <memory>
 #include <utility>
 
+#include "base/check_op.h"
 #include "base/containers/circular_deque.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
@@ -50,7 +50,7 @@ class PassthroughTouchEventQueueTest : public testing::Test,
       : task_environment_(
             base::test::SingleThreadTaskEnvironment::MainThreadType::UI),
         acked_event_count_(0),
-        last_acked_event_state_(INPUT_EVENT_ACK_STATE_UNKNOWN),
+        last_acked_event_state_(blink::mojom::InputEventResultState::kUnknown),
         slop_length_dips_(0) {}
 
   ~PassthroughTouchEventQueueTest() override {}
@@ -75,9 +75,10 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     }
   }
 
-  void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override {
+  void OnTouchEventAck(
+      const TouchEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override {
     ++acked_event_count_;
     if (followup_touch_event_) {
       std::unique_ptr<WebTouchEvent> followup_touch_event =
@@ -121,8 +122,8 @@ class PassthroughTouchEventQueueTest : public testing::Test,
   void SetUpForSkipFilterTesting(const std::string& events_to_always_forward) {
     base::test::ScopedFeatureList feature_list;
     feature_list.InitAndEnableFeatureWithParameters(
-        features::kSkipTouchEventFilter,
-        {{features::kSkipTouchEventFilterTypeParamName,
+        blink::features::kSkipTouchEventFilter,
+        {{blink::features::kSkipTouchEventFilterTypeParamName,
           events_to_always_forward}});
     ResetQueueWithConfig(PassthroughTouchEventQueue::Config());
   }
@@ -132,14 +133,14 @@ class PassthroughTouchEventQueueTest : public testing::Test,
       event.moved_beyond_slop_region = false;
       if (WebTouchEventTraits::IsTouchSequenceStart(event))
         anchor_ = event.touches[0].PositionInWidget();
-      if (event.GetType() == WebInputEvent::kTouchMove) {
+      if (event.GetType() == WebInputEvent::Type::kTouchMove) {
         gfx::Vector2dF delta = anchor_ - event.touches[0].PositionInWidget();
         if (delta.LengthSquared() > slop_length_dips_ * slop_length_dips_)
           event.moved_beyond_slop_region = true;
       }
     } else {
       event.moved_beyond_slop_region =
-          event.GetType() == WebInputEvent::kTouchMove;
+          event.GetType() == WebInputEvent::Type::kTouchMove;
     }
     queue_->QueueEvent(TouchEventWithLatencyInfo(event, ui::LatencyInfo()));
   }
@@ -151,29 +152,32 @@ class PassthroughTouchEventQueueTest : public testing::Test,
         GestureEventWithLatencyInfo(event, ui::LatencyInfo()));
   }
 
-  void SendTouchEventAck(InputEventAckState ack_result) {
+  void SendTouchEventAck(blink::mojom::InputEventResultState ack_result) {
     DCHECK(!sent_events_ids_.empty());
-    queue_->ProcessTouchAck(InputEventAckSource::COMPOSITOR_THREAD, ack_result,
-                            ui::LatencyInfo(), sent_events_ids_.front(), true);
+    queue_->ProcessTouchAck(
+        blink::mojom::InputEventResultSource::kCompositorThread, ack_result,
+        ui::LatencyInfo(), sent_events_ids_.front(), true);
     sent_events_ids_.pop_front();
   }
 
-  void SendTouchEventAckLast(InputEventAckState ack_result) {
+  void SendTouchEventAckLast(blink::mojom::InputEventResultState ack_result) {
     DCHECK(!sent_events_ids_.empty());
-    queue_->ProcessTouchAck(InputEventAckSource::COMPOSITOR_THREAD, ack_result,
-                            ui::LatencyInfo(), sent_events_ids_.back(), true);
+    queue_->ProcessTouchAck(
+        blink::mojom::InputEventResultSource::kCompositorThread, ack_result,
+        ui::LatencyInfo(), sent_events_ids_.back(), true);
     sent_events_ids_.pop_back();
   }
 
-  void SendTouchEventAckWithID(InputEventAckState ack_result,
+  void SendTouchEventAckWithID(blink::mojom::InputEventResultState ack_result,
                                int unique_event_id) {
-    queue_->ProcessTouchAck(InputEventAckSource::COMPOSITOR_THREAD, ack_result,
-                            ui::LatencyInfo(), unique_event_id, true);
+    queue_->ProcessTouchAck(
+        blink::mojom::InputEventResultSource::kCompositorThread, ack_result,
+        ui::LatencyInfo(), unique_event_id, true);
     base::Erase(sent_events_ids_, unique_event_id);
   }
 
   void SendGestureEventAck(WebInputEvent::Type type,
-                           InputEventAckState ack_result) {
+                           blink::mojom::InputEventResultState ack_result) {
     GestureEventWithLatencyInfo event(type, blink::WebInputEvent::kNoModifiers,
                                       ui::EventTimeForNow(), ui::LatencyInfo());
     queue_->OnGestureEventAck(event, ack_result);
@@ -187,8 +191,9 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     followup_gesture_event_.reset(new WebGestureEvent(event));
   }
 
-  void SetSyncAckResult(InputEventAckState sync_ack_result) {
-    sync_ack_result_.reset(new InputEventAckState(sync_ack_result));
+  void SetSyncAckResult(blink::mojom::InputEventResultState sync_ack_result) {
+    sync_ack_result_.reset(
+        new blink::mojom::InputEventResultState(sync_ack_result));
   }
 
   void PressTouchPoint(float x, float y) {
@@ -218,9 +223,9 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     WebTouchPoint& point = touch_event_.touches[index];
     point.radius_x = radius_x;
     point.radius_y = radius_y;
-    touch_event_.touches[index].state = WebTouchPoint::kStateMoved;
+    touch_event_.touches[index].state = WebTouchPoint::State::kStateMoved;
     touch_event_.moved_beyond_slop_region = true;
-    WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove,
+    WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchMove,
                                    touch_event_.TimeStamp(), &touch_event_);
     SendTouchEvent();
   }
@@ -230,9 +235,9 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     CHECK_LT(index, touch_event_.kTouchesLengthCap);
     WebTouchPoint& point = touch_event_.touches[index];
     point.rotation_angle = rotation_angle;
-    touch_event_.touches[index].state = WebTouchPoint::kStateMoved;
+    touch_event_.touches[index].state = WebTouchPoint::State::kStateMoved;
     touch_event_.moved_beyond_slop_region = true;
-    WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove,
+    WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchMove,
                                    touch_event_.TimeStamp(), &touch_event_);
     SendTouchEvent();
   }
@@ -242,9 +247,9 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     CHECK_LT(index, touch_event_.kTouchesLengthCap);
     WebTouchPoint& point = touch_event_.touches[index];
     point.force = force;
-    touch_event_.touches[index].state = WebTouchPoint::kStateMoved;
+    touch_event_.touches[index].state = WebTouchPoint::State::kStateMoved;
     touch_event_.moved_beyond_slop_region = true;
-    WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove,
+    WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchMove,
                                    touch_event_.TimeStamp(), &touch_event_);
     SendTouchEvent();
   }
@@ -309,7 +314,7 @@ class PassthroughTouchEventQueueTest : public testing::Test,
     return sent_events_;
   }
 
-  InputEventAckState acked_event_state() const {
+  blink::mojom::InputEventResultState acked_event_state() const {
     return last_acked_event_state_;
   }
 
@@ -346,11 +351,11 @@ class PassthroughTouchEventQueueTest : public testing::Test,
   size_t acked_event_count_;
   WebTouchEvent last_acked_event_;
   std::vector<WebTouchEvent> sent_events_;
-  InputEventAckState last_acked_event_state_;
+  blink::mojom::InputEventResultState last_acked_event_state_;
   SyntheticWebTouchEvent touch_event_;
   std::unique_ptr<WebTouchEvent> followup_touch_event_;
   std::unique_ptr<WebGestureEvent> followup_gesture_event_;
-  std::unique_ptr<InputEventAckState> sync_ack_result_;
+  std::unique_ptr<blink::mojom::InputEventResultState> sync_ack_result_;
   double slop_length_dips_;
   gfx::PointF anchor_;
   base::circular_deque<int> sent_events_ids_;
@@ -369,20 +374,22 @@ TEST_F(PassthroughTouchEventQueueTest, Basic) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Receive an ACK for the first touch-event.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(WebInputEvent::kTouchStart, acked_event().GetType());
-  EXPECT_EQ(WebInputEvent::kBlocking, acked_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
+            acked_event().dispatch_type);
 
   // Receive an ACK for the second touch-event.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(WebInputEvent::kTouchMove, acked_event().GetType());
-  EXPECT_EQ(WebInputEvent::kBlocking, acked_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
+            acked_event().dispatch_type);
 }
 
 // Tests that touch-events with multiple points are queued properly.
@@ -412,20 +419,20 @@ TEST_F(PassthroughTouchEventQueueTest, BasicMultiTouch) {
 
   // Ack all presses.
   for (size_t i = 0; i < kPointerCount; ++i)
-    SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+    SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(kPointerCount, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
 
   // Ack the touch moves.
   for (size_t i = 0; i < kPointerCount; ++i)
-    SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+    SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(kPointerCount, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
 
   // Ack all releases.
   for (size_t i = 0; i < kPointerCount; ++i)
-    SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+    SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(kPointerCount, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
@@ -451,15 +458,16 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // Process the ack for the sent touch, ensuring that it is honored (despite
   // the touch handler having been removed).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, acked_event_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            acked_event_state());
 
   // Try forwarding a new pointer. It should be forwarded as usual.
   PressTouchPoint(2, 2);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
 
@@ -469,10 +477,10 @@ TEST_F(PassthroughTouchEventQueueTest,
   ReleaseTouchPoint(1);
   EXPECT_EQ(2U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -482,17 +490,19 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(2U, GetAndResetSentEventCount());
   EXPECT_EQ(2U, queued_event_count());
 
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, queued_event_count());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, acked_event_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            acked_event_state());
 
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, queued_event_count());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, acked_event_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            acked_event_state());
 }
 
 // Tests that addition of a touch handler during a touch sequence will continue
@@ -552,8 +562,8 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(2U, queued_event_count());
 
   // Clear the queue.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
 
@@ -600,7 +610,7 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // The ack should trigger forwarding of the touchmove, as if no touch
   // handler registration changes have occurred.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, queued_event_count());
@@ -609,19 +619,19 @@ TEST_F(PassthroughTouchEventQueueTest,
 // Tests that the touch-event queue is robust to redundant acks.
 TEST_F(PassthroughTouchEventQueueTest, SpuriousAcksIgnored) {
   // Trigger a spurious ack.
-  SendTouchEventAckWithID(INPUT_EVENT_ACK_STATE_CONSUMED, 0);
+  SendTouchEventAckWithID(blink::mojom::InputEventResultState::kConsumed, 0);
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Send and ack a touch press.
   PressTouchPoint(1, 1);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
 
   // Trigger a spurious ack.
-  SendTouchEventAckWithID(INPUT_EVENT_ACK_STATE_CONSUMED, 3);
+  SendTouchEventAckWithID(blink::mojom::InputEventResultState::kConsumed, 3);
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 }
 
@@ -638,8 +648,8 @@ TEST_F(PassthroughTouchEventQueueTest, NoConsumer) {
   EXPECT_EQ(2U, queued_event_count());
 
   // Receive an ACK for the first touch-event and the first touch-move
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
@@ -647,14 +657,14 @@ TEST_F(PassthroughTouchEventQueueTest, NoConsumer) {
   // Send a release event. This should reach the renderer.
   ReleaseTouchPoint(0);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  EXPECT_EQ(WebInputEvent::kTouchMove, acked_event().GetType());
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, acked_event().GetType());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Send a press-event, followed by a move should be sent.
   PressTouchPoint(10, 10);
   MoveTouchPoint(0, 5, 5);
 
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_EQ(2U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -662,7 +672,7 @@ TEST_F(PassthroughTouchEventQueueTest, NoConsumer) {
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
   EXPECT_EQ(3U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 }
 
@@ -675,21 +685,21 @@ TEST_F(PassthroughTouchEventQueueTest, AckTouchEventInReverse) {
   EXPECT_EQ(4U, GetAndResetSentEventCount());
   EXPECT_EQ(4U, queued_event_count());
 
-  SendTouchEventAckLast(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAckLast(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
   EXPECT_EQ(4U, queued_event_count());
 
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchStart, acked_event().GetType());
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, acked_event().GetType());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(3U, queued_event_count());
 
-  SendTouchEventAckLast(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAckLast(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
   EXPECT_EQ(3U, queued_event_count());
 
-  SendTouchEventAckLast(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchEnd, acked_event().GetType());
+  SendTouchEventAckLast(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchEnd, acked_event().GetType());
   EXPECT_EQ(3U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
 }
@@ -704,22 +714,23 @@ TEST_F(PassthroughTouchEventQueueTest, AckWithFollowupEvents) {
 
   // Create a touch event that will be queued synchronously by a touch ack.
   // Note, this will be triggered by all subsequent touch acks.
-  WebTouchEvent followup_event(WebInputEvent::kTouchMove,
+  WebTouchEvent followup_event(WebInputEvent::Type::kTouchMove,
                                WebInputEvent::kNoModifiers,
                                ui::EventTimeForNow());
   followup_event.touches_length = 1;
   followup_event.touches[0].id = 0;
-  followup_event.touches[0].state = WebTouchPoint::kStateMoved;
+  followup_event.touches[0].state = WebTouchPoint::State::kStateMoved;
   SetFollowupEvent(followup_event);
 
   // Receive an ACK for the press. This should cause the followup touch-move to
   // be sent to the renderer.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, acked_event_state());
-  EXPECT_EQ(WebInputEvent::kTouchStart, acked_event().GetType());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            acked_event_state());
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, acked_event().GetType());
 
   // Queue another event.
   MoveTouchPoint(0, 2, 2);
@@ -727,7 +738,7 @@ TEST_F(PassthroughTouchEventQueueTest, AckWithFollowupEvents) {
 
   // Receive an ACK for the touch-move followup event. This should cause the
   // subsequent touch move event be sent to the renderer.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
@@ -736,21 +747,21 @@ TEST_F(PassthroughTouchEventQueueTest, AckWithFollowupEvents) {
 // Tests that touch-events can be synchronously ack'ed.
 TEST_F(PassthroughTouchEventQueueTest, SynchronousAcks) {
   // TouchStart
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
   PressTouchPoint(1, 1);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // TouchMove
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
   MoveTouchPoint(0, 2, 2);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // TouchEnd
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
   ReleaseTouchPoint(0);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -758,12 +769,12 @@ TEST_F(PassthroughTouchEventQueueTest, SynchronousAcks) {
 
   // TouchCancel (first inserting a TouchStart so the TouchCancel will be sent)
   PressTouchPoint(1, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
   CancelTouchPoint(0);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -785,24 +796,24 @@ TEST_F(PassthroughTouchEventQueueTest, SynchronousAcksInOrder) {
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Ack the TouchMove
-  SendTouchEventAckLast(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAckLast(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(2U, queued_event_count());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Create a touch event that will be queued synchronously by a touch ack.
-  WebTouchEvent followup_event(WebInputEvent::kTouchMove,
+  WebTouchEvent followup_event(WebInputEvent::Type::kTouchMove,
                                WebInputEvent::kNoModifiers,
                                ui::EventTimeForNow());
   followup_event.touches_length = 1;
   followup_event.touches[0].id = 0;
   followup_event.unique_touch_event_id = 100;
-  followup_event.touches[0].state = WebTouchPoint::kStateMoved;
+  followup_event.touches[0].state = WebTouchPoint::State::kStateMoved;
   SetFollowupEvent(followup_event);
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
 
   // Ack the touch start, should release the |follow_up| event (and its ack).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -814,30 +825,31 @@ TEST_F(PassthroughTouchEventQueueTest, SynchronousAcksInOrder) {
 // TouchEventQueue::QueueEvent() are properly handled.
 TEST_F(PassthroughTouchEventQueueTest, ImmediateAckWithFollowupEvents) {
   // Create a touch event that will be queued synchronously by a touch ack.
-  WebTouchEvent followup_event(WebInputEvent::kTouchStart,
+  WebTouchEvent followup_event(WebInputEvent::Type::kTouchStart,
                                WebInputEvent::kNoModifiers,
                                ui::EventTimeForNow());
   followup_event.touches_length = 1;
   followup_event.touches[0].id = 1;
-  followup_event.touches[0].state = WebTouchPoint::kStatePressed;
+  followup_event.touches[0].state = WebTouchPoint::State::kStatePressed;
   SetFollowupEvent(followup_event);
 
   // Now, enqueue a stationary touch that will not be forwarded.  This should be
   // immediately ack'ed with "NO_CONSUMER_EXISTS".  The followup event should
   // then be enqueued and immediately sent to the renderer.
-  WebTouchEvent stationary_event(WebInputEvent::kTouchMove,
+  WebTouchEvent stationary_event(WebInputEvent::Type::kTouchMove,
                                  WebInputEvent::kNoModifiers,
                                  ui::EventTimeForNow());
   stationary_event.touches_length = 1;
   stationary_event.touches[0].id = 1;
-  stationary_event.touches[0].state = WebTouchPoint::kStateStationary;
+  stationary_event.touches[0].state = WebTouchPoint::State::kStateStationary;
   SendTouchEvent(stationary_event);
 
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, acked_event_state());
-  EXPECT_EQ(WebInputEvent::kTouchMove, acked_event().GetType());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
+            acked_event_state());
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, acked_event().GetType());
 }
 
 // Tests that basic TouchEvent forwarding suppression has been disabled.
@@ -864,17 +876,17 @@ TEST_F(PassthroughTouchEventQueueTest, NoTouchBasic) {
 
   PressTouchPoint(80, 10);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
 
   MoveTouchPoint(0, 80, 20);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   ReleaseTouchPoint(0);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 }
 
@@ -893,7 +905,7 @@ TEST_F(PassthroughTouchEventQueueTest, PendingStart) {
   EXPECT_TRUE(IsPendingAckTouchStart());
 
   // Ack the touchstart (#1).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_FALSE(IsPendingAckTouchStart());
 
@@ -903,7 +915,7 @@ TEST_F(PassthroughTouchEventQueueTest, PendingStart) {
   EXPECT_TRUE(IsPendingAckTouchStart());
 
   // Ack the touchmove (#2).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_TRUE(IsPendingAckTouchStart());
 
@@ -913,12 +925,12 @@ TEST_F(PassthroughTouchEventQueueTest, PendingStart) {
   EXPECT_TRUE(IsPendingAckTouchStart());
 
   // Ack the touchstart for the second point (#3).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_TRUE(IsPendingAckTouchStart());
 
   // Ack the touchstart for the third point (#4).
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_FALSE(IsPendingAckTouchStart());
 }
@@ -930,28 +942,28 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutTypes) {
   // Sending a TouchStart will start the timeout.
   PressTouchPoint(0, 1);
   EXPECT_TRUE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
 
   // A TouchMove should start the timeout.
   MoveTouchPoint(0, 5, 5);
   EXPECT_TRUE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
 
   // A TouchEnd should not start the timeout.
   ReleaseTouchPoint(0);
   EXPECT_FALSE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
 
   // A TouchCancel should not start the timeout.
   PressTouchPoint(0, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   ASSERT_FALSE(IsTimeoutRunning());
   CancelTouchPoint(0);
   EXPECT_FALSE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
 }
 
@@ -980,10 +992,10 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutBasic) {
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Ack'ing the original event should trigger a cancel event.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
-  EXPECT_EQ(WebInputEvent::kTouchCancel, sent_event().GetType());
-  EXPECT_NE(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::Type::kTouchCancel, sent_event().GetType());
+  EXPECT_NE(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
@@ -998,14 +1010,14 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutBasic) {
 
   // The synthetic TouchCancel ack should not reach the client, but should
   // resume touch forwarding.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Subsequent events should be handled normally.
   PressTouchPoint(0, 1);
-  EXPECT_EQ(WebInputEvent::kTouchStart, sent_event().GetType());
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, sent_event().GetType());
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 }
@@ -1022,23 +1034,23 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // Mark the event as consumed. This should prevent the timeout from
   // being activated on subsequent TouchEvents in this gesture.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
 
   // A TouchMove should not start the timeout.
   MoveTouchPoint(0, 5, 5);
   EXPECT_FALSE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
 
   // A secondary TouchStart should not start the timeout.
   PressTouchPoint(1, 0);
   EXPECT_FALSE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
 
   // A TouchEnd should not start the timeout.
   ReleaseTouchPoint(1);
   EXPECT_FALSE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
 
   // A TouchCancel should not start the timeout.
   CancelTouchPoint(0);
@@ -1056,7 +1068,7 @@ TEST_F(PassthroughTouchEventQueueTest,
   ASSERT_TRUE(IsTimeoutRunning());
 
   // Send the ack immediately. The timeout should not have fired.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
@@ -1078,7 +1090,7 @@ TEST_F(PassthroughTouchEventQueueTest, NoTouchTimeoutIfAckIsSynchronous) {
   SetUpForTimeoutTesting();
 
   // Queue a TouchStart.
-  SetSyncAckResult(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SetSyncAckResult(blink::mojom::InputEventResultState::kConsumed);
   ASSERT_FALSE(IsTimeoutRunning());
   PressTouchPoint(0, 1);
   EXPECT_FALSE(IsTimeoutRunning());
@@ -1123,9 +1135,9 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutConfiguredForMobile) {
 
   PressTouchPoint(0, 1);
   ASSERT_TRUE(IsTimeoutRunning());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   ReleaseTouchPoint(0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
   ASSERT_FALSE(IsTimeoutRunning());
 
@@ -1149,7 +1161,7 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutWithFollowupGesture) {
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // The cancelled sequence may turn into a scroll gesture.
-  WebGestureEvent followup_scroll(WebInputEvent::kGestureScrollBegin,
+  WebGestureEvent followup_scroll(WebInputEvent::Type::kGestureScrollBegin,
                                   WebInputEvent::kNoModifiers,
                                   ui::EventTimeForNow());
   SetFollowupEvent(followup_scroll);
@@ -1164,14 +1176,14 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutWithFollowupGesture) {
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Ack the original event, triggering a TouchCancel.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Ack the cancel event. Normally, this would resume touch forwarding,
   // but we're still within a scroll gesture so it remains disabled.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(IsTimeoutRunning());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
@@ -1186,7 +1198,7 @@ TEST_F(PassthroughTouchEventQueueTest, TouchTimeoutWithFollowupGesture) {
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Now end the scroll sequence.
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollEnd);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd);
   PressTouchPoint(0, 1);
   EXPECT_TRUE(IsTimeoutRunning());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
@@ -1206,7 +1218,7 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // The cancelled sequence may turn into a scroll gesture.
-  WebGestureEvent followup_scroll(WebInputEvent::kGestureScrollBegin,
+  WebGestureEvent followup_scroll(WebInputEvent::Type::kGestureScrollBegin,
                                   WebInputEvent::kNoModifiers,
                                   ui::EventTimeForNow());
   SetFollowupEvent(followup_scroll);
@@ -1230,7 +1242,7 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // Now end the scroll sequence.  Events will not be forwarded until the two
   // outstanding touch acks are received.
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollEnd);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd);
   MoveTouchPoint(0, 2, 2);
   ReleaseTouchPoint(0);
   EXPECT_FALSE(IsTimeoutRunning());
@@ -1238,12 +1250,12 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
 
   // Ack the original event, triggering a cancel.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Ack the cancel event, resuming touch forwarding.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
@@ -1280,7 +1292,7 @@ TEST_F(PassthroughTouchEventQueueTest, NoCancelOnTouchTimeoutWithoutConsumer) {
 
   // Ack'ing the original event should not trigger a cancel event, as the
   // TouchStart had no consumer.  However, it should re-enable touch forwarding.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   EXPECT_FALSE(IsTimeoutRunning());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
@@ -1298,42 +1310,42 @@ TEST_F(PassthroughTouchEventQueueTest, TouchMovedBeyondSlopRegionCheck) {
 
   // Queue a TouchStart.
   PressTouchPoint(0, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   ASSERT_EQ(1U, GetAndResetAckedEventCount());
 
   // TouchMove's movedBeyondSlopRegion within the slop region is set to false.
   MoveTouchPoint(0, 0, kHalfSlopLengthDips);
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_FALSE(acked_event().moved_beyond_slop_region);
 
   MoveTouchPoint(0, kHalfSlopLengthDips, 0);
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_FALSE(acked_event().moved_beyond_slop_region);
 
   MoveTouchPoint(0, -kHalfSlopLengthDips, 0);
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_FALSE(acked_event().moved_beyond_slop_region);
 
   MoveTouchPoint(0, -kSlopLengthDips, 0);
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_FALSE(acked_event().moved_beyond_slop_region);
 
   MoveTouchPoint(0, 0, kSlopLengthDips);
   EXPECT_EQ(1U, queued_event_count());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_FALSE(acked_event().moved_beyond_slop_region);
@@ -1347,7 +1359,7 @@ TEST_F(PassthroughTouchEventQueueTest, TouchMovedBeyondSlopRegionCheck) {
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_TRUE(acked_event().moved_beyond_slop_region);
 }
@@ -1358,7 +1370,7 @@ TEST_F(PassthroughTouchEventQueueTest,
        MovedBeyondSlopRegionAlwaysTrueIfDimensionZero) {
   // Queue a TouchStart.
   PressTouchPoint(0, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   ASSERT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -1367,7 +1379,7 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_TRUE(acked_event().moved_beyond_slop_region);
 }
@@ -1378,7 +1390,7 @@ TEST_F(PassthroughTouchEventQueueTest,
        SecondaryTouchForwardedAfterPrimaryHadNoConsumer) {
   // Queue a TouchStart.
   PressTouchPoint(0, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   ASSERT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -1390,7 +1402,7 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // Simulate a secondary pointer press.
   PressTouchPoint(20, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -1398,7 +1410,7 @@ TEST_F(PassthroughTouchEventQueueTest,
   MoveTouchPoint(1, 25, 0);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 }
 
@@ -1408,22 +1420,23 @@ TEST_F(PassthroughTouchEventQueueTest,
        NoForwardingAfterScrollWithNoTouchConsumers) {
   // Queue a TouchStart.
   PressTouchPoint(0, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   ASSERT_EQ(1U, GetAndResetAckedEventCount());
 
-  WebGestureEvent followup_scroll(WebInputEvent::kGestureScrollBegin,
+  WebGestureEvent followup_scroll(WebInputEvent::Type::kGestureScrollBegin,
                                   WebInputEvent::kNoModifiers,
                                   WebInputEvent::GetStaticTimeStampForTests());
   SetFollowupEvent(followup_scroll);
   MoveTouchPoint(0, 20, 5);
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, acked_event_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
+            acked_event_state());
 
   // The secondary pointer press should be forwarded.
   PressTouchPoint(20, 0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
@@ -1431,41 +1444,41 @@ TEST_F(PassthroughTouchEventQueueTest,
   MoveTouchPoint(1, 25, 0);
   EXPECT_EQ(1U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 }
 
 TEST_F(PassthroughTouchEventQueueTest, TouchAbsorptionWithConsumedFirstMove) {
   // Queue a TouchStart.
   PressTouchPoint(0, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   MoveTouchPoint(0, 20, 5);
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollBegin);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(2U, GetAndResetSentEventCount());
 
   // Even if the first touchmove event was consumed, subsequent unconsumed
   // touchmove events should trigger scrolling.
   MoveTouchPoint(0, 60, 5);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   MoveTouchPoint(0, 20, 5);
-  WebGestureEvent followup_scroll(WebInputEvent::kGestureScrollUpdate,
+  WebGestureEvent followup_scroll(WebInputEvent::Type::kGestureScrollUpdate,
                                   WebInputEvent::kNoModifiers,
                                   WebInputEvent::GetStaticTimeStampForTests());
   SetFollowupEvent(followup_scroll);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  SendGestureEventAck(WebInputEvent::kGestureScrollUpdate,
-                      INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  SendGestureEventAck(WebInputEvent::Type::kGestureScrollUpdate,
+                      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
 
   // Touch moves are sent right away.
@@ -1478,58 +1491,58 @@ TEST_F(PassthroughTouchEventQueueTest, TouchStartCancelableDuringScroll) {
   // Queue a touchstart and touchmove that go unconsumed, transitioning to an
   // active scroll sequence.
   PressTouchPoint(0, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   MoveTouchPoint(0, 20, 5);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollBegin);
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollUpdate);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollUpdate);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   // Even though scrolling has begun, touchstart events should be cancelable,
   // allowing, for example, customized pinch processing.
   PressTouchPoint(10, 11);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   // As the touch start was consumed, touchmoves should no longer be throttled.
   MoveTouchPoint(1, 11, 11);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   // With throttling disabled, touchend and touchmove events should also be
   // cancelable.
   MoveTouchPoint(1, 12, 12);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   ReleaseTouchPoint(1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   // If subsequent touchmoves aren't consumed, the generated scroll events
   // will restore async touch dispatch.
   MoveTouchPoint(0, 25, 5);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  SendGestureEvent(blink::WebInputEvent::kGestureScrollUpdate);
-  EXPECT_EQ(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  SendGestureEvent(blink::WebInputEvent::Type::kGestureScrollUpdate);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
   AdvanceTouchTime(kMinSecondsBetweenThrottledTouchmoves + 0.1);
   MoveTouchPoint(0, 30, 5);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_NE(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_NE(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 
   // The touchend will be uncancelable during an active scroll sequence.
   ReleaseTouchPoint(0);
-  EXPECT_NE(WebInputEvent::kBlocking, sent_event().dispatch_type);
+  EXPECT_NE(WebInputEvent::DispatchType::kBlocking, sent_event().dispatch_type);
   ASSERT_EQ(1U, GetAndResetSentEventCount());
 }
 
@@ -1538,7 +1551,7 @@ TEST_F(PassthroughTouchEventQueueTest, UnseenTouchPointerIdsNotForwarded) {
   event.PressPoint(0, 0);
   SendTouchEvent(event);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Give the touchmove a previously unseen pointer id; it should not be sent.
@@ -1553,7 +1566,7 @@ TEST_F(PassthroughTouchEventQueueTest, UnseenTouchPointerIdsNotForwarded) {
   event.touches[0].id = press_id;
   SendTouchEvent(event);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 
   // Do the same for release.
@@ -1580,18 +1593,18 @@ TEST_F(PassthroughTouchEventQueueTest, PointerStatesInTouchMove) {
   PressTouchPoint(4, 4);
 
   // Receive ACK for the first three touch-events.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(1U, queued_event_count());
 
   // Test current touches state before sending TouchMoves.
   const WebTouchEvent& event1 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchStart, event1.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event1.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event1.touches[1].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event1.touches[2].state);
-  EXPECT_EQ(WebTouchPoint::kStatePressed, event1.touches[3].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, event1.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event1.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event1.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event1.touches[2].state);
+  EXPECT_EQ(WebTouchPoint::State::kStatePressed, event1.touches[3].state);
 
   // Move x-position for 1st touch, y-position for 2nd touch
   // and do not move other touches.
@@ -1600,30 +1613,30 @@ TEST_F(PassthroughTouchEventQueueTest, PointerStatesInTouchMove) {
   EXPECT_EQ(3U, queued_event_count());
 
   // Receive an ACK for the last TouchPress event.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // 1st TouchMove is sent. Test for touches state.
   const WebTouchEvent& event2 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event2.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event2.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event2.touches[1].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event2.touches[2].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event2.touches[3].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event2.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event2.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event2.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event2.touches[2].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event2.touches[3].state);
 
   // Move only 4th touch but not others.
   MoveTouchPoints(0, 1.1f, 1.f, 1, 2.f, 20.001f);
   MoveTouchPoints(2, 3.f, 3.f, 3, 4.1f, 4.1f);
 
   // Receive an ACK for previous (1st) TouchMove.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // 2nd TouchMove is sent. Test for touches state.
   const WebTouchEvent& event3 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event3.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event3.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event3.touches[1].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event3.touches[2].state);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event3.touches[3].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event3.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event3.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event3.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event3.touches[2].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event3.touches[3].state);
 }
 
 // Tests that touch point state is correct in TouchMove events
@@ -1631,7 +1644,7 @@ TEST_F(PassthroughTouchEventQueueTest, PointerStatesInTouchMove) {
 TEST_F(PassthroughTouchEventQueueTest,
        PointerStatesWhenOtherThanPositionChanged) {
   PressTouchPoint(1, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // Default initial radiusX/Y is (20.f, 20.f).
   // Default initial rotationAngle is 0.f.
@@ -1639,30 +1652,30 @@ TEST_F(PassthroughTouchEventQueueTest,
 
   // Change touch point radius only.
   ChangeTouchPointRadius(0, 1.5f, 1.f);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // TouchMove is sent. Test for pointer state.
   const WebTouchEvent& event1 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event1.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event1.touches[0].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event1.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event1.touches[0].state);
 
   // Change touch point force.
   ChangeTouchPointForce(0, 0.9f);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // TouchMove is sent. Test for pointer state.
   const WebTouchEvent& event2 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event2.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event2.touches[0].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event2.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event2.touches[0].state);
 
   // Change touch point rotationAngle.
   ChangeTouchPointRotationAngle(0, 1.1f);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   // TouchMove is sent. Test for pointer state.
   const WebTouchEvent& event3 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event3.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event3.touches[0].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event3.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event3.touches[0].state);
 
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(4U, GetAndResetSentEventCount());
@@ -1673,8 +1686,8 @@ TEST_F(PassthroughTouchEventQueueTest,
 TEST_F(PassthroughTouchEventQueueTest, FilterTouchMovesWhenNoPointerChanged) {
   PressTouchPoint(1, 1);
   PressTouchPoint(2, 2);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(2U, GetAndResetSentEventCount());
   EXPECT_EQ(2U, GetAndResetAckedEventCount());
@@ -1685,9 +1698,9 @@ TEST_F(PassthroughTouchEventQueueTest, FilterTouchMovesWhenNoPointerChanged) {
 
   // TouchMove should be allowed and test for touches state.
   const WebTouchEvent& event1 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event1.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event1.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event1.touches[1].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event1.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event1.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event1.touches[1].state);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
@@ -1702,23 +1715,24 @@ TEST_F(PassthroughTouchEventQueueTest, FilterTouchMovesWhenNoPointerChanged) {
   EXPECT_EQ(0U, GetAndResetAckedEventCount());
 
   // Receive an ACK for 1st TouchMove.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(0U, queued_event_count());
   EXPECT_EQ(0U, GetAndResetSentEventCount());
   EXPECT_EQ(4U, GetAndResetAckedEventCount());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, acked_event_state());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
+            acked_event_state());
 
   // Move 2nd touch point.
   MoveTouchPoint(1, 3, 3);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(0U, queued_event_count());
 
   // TouchMove should be allowed and test for touches state.
   const WebTouchEvent& event2 = sent_event();
-  EXPECT_EQ(WebInputEvent::kTouchMove, event2.GetType());
-  EXPECT_EQ(WebTouchPoint::kStateStationary, event2.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event2.touches[1].state);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, event2.GetType());
+  EXPECT_EQ(WebTouchPoint::State::kStateStationary, event2.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event2.touches[1].state);
   EXPECT_EQ(1U, GetAndResetSentEventCount());
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
 }
@@ -1749,15 +1763,16 @@ TEST_F(PassthroughTouchEventQueueTest,
   EXPECT_EQ(2U, queued_event_count());
 
   // Send ACKs.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_IGNORED);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kIgnored);
 
   // Touch-scroll-start Ack is not reported to client.
   EXPECT_EQ(1U, GetAndResetAckedEventCount());
   EXPECT_EQ(0U, queued_event_count());
 
-  EXPECT_EQ(WebInputEvent::kTouchStart, all_sent_events()[0].GetType());
-  EXPECT_EQ(WebInputEvent::kTouchScrollStarted, all_sent_events()[1].GetType());
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, all_sent_events()[0].GetType());
+  EXPECT_EQ(WebInputEvent::Type::kTouchScrollStarted,
+            all_sent_events()[1].GetType());
   EXPECT_EQ(2U, GetAndResetSentEventCount());
 }
 
@@ -1765,29 +1780,29 @@ TEST_F(PassthroughTouchEventQueueTest,
 // events.
 TEST_F(PassthroughTouchEventQueueTest, TouchStartOrFirstTouchMove) {
   PressTouchPoint(1, 1);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchStart, sent_event().GetType());
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchStart, sent_event().GetType());
   EXPECT_TRUE(sent_event().touch_start_or_first_touch_move);
 
   MoveTouchPoint(0, 5, 5);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchMove, sent_event().GetType());
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, sent_event().GetType());
   EXPECT_TRUE(sent_event().touch_start_or_first_touch_move);
 
   MoveTouchPoint(0, 15, 15);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchMove, sent_event().GetType());
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchMove, sent_event().GetType());
   EXPECT_FALSE(sent_event().touch_start_or_first_touch_move);
 
   ReleaseTouchPoint(0);
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kTouchEnd, sent_event().GetType());
+  SendTouchEventAck(blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kTouchEnd, sent_event().GetType());
   EXPECT_FALSE(sent_event().touch_start_or_first_touch_move);
 }
 
 TEST_F(PassthroughTouchEventQueueTest, TouchScrollStartedUnfiltered) {
   SyntheticWebTouchEvent event;
-  event.SetType(WebInputEvent::kTouchScrollStarted);
+  event.SetType(WebInputEvent::Type::kTouchScrollStarted);
   EXPECT_EQ(PassthroughTouchEventQueue::PreFilterResult::kUnfiltered,
             FilterBeforeForwarding(event));
 }
@@ -1915,7 +1930,7 @@ TEST_F(PassthroughTouchEventQueueTest,
   PressTouchPoint(1, 1);
 
   // Send an ack indicating that there's no handler for the current sequence.
-  SendTouchEventAck(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendTouchEventAck(blink::mojom::InputEventResultState::kNoConsumerExists);
 
   // Any subsequent touches in the sequence should be unfiltered.
   SyntheticWebTouchEvent event;
@@ -1930,7 +1945,7 @@ TEST_F(PassthroughTouchEventQueueTest,
 TEST_F(PassthroughTouchEventQueueTest,
        TouchStartUnfilteredWithForwardDiscrete) {
   SetUpForSkipFilterTesting(
-      features::kSkipTouchEventFilterTypeParamValueDiscrete);
+      blink::features::kSkipTouchEventFilterTypeParamValueDiscrete);
 
   OnHasTouchEventHandlers(false);
   SyntheticWebTouchEvent event;
@@ -1942,7 +1957,7 @@ TEST_F(PassthroughTouchEventQueueTest,
 
 TEST_F(PassthroughTouchEventQueueTest, TouchMoveFilteredWithForwardDiscrete) {
   SetUpForSkipFilterTesting(
-      features::kSkipTouchEventFilterTypeParamValueDiscrete);
+      blink::features::kSkipTouchEventFilterTypeParamValueDiscrete);
 
   OnHasTouchEventHandlers(false);
   // Start the touch sequence.
@@ -1958,7 +1973,8 @@ TEST_F(PassthroughTouchEventQueueTest, TouchMoveFilteredWithForwardDiscrete) {
 }
 
 TEST_F(PassthroughTouchEventQueueTest, TouchStartUnfilteredWithForwardAll) {
-  SetUpForSkipFilterTesting(features::kSkipTouchEventFilterTypeParamValueAll);
+  SetUpForSkipFilterTesting(
+      blink::features::kSkipTouchEventFilterTypeParamValueAll);
 
   OnHasTouchEventHandlers(false);
   SyntheticWebTouchEvent event;
@@ -1969,7 +1985,8 @@ TEST_F(PassthroughTouchEventQueueTest, TouchStartUnfilteredWithForwardAll) {
 }
 
 TEST_F(PassthroughTouchEventQueueTest, TouchMoveUnfilteredWithForwardAll) {
-  SetUpForSkipFilterTesting(features::kSkipTouchEventFilterTypeParamValueAll);
+  SetUpForSkipFilterTesting(
+      blink::features::kSkipTouchEventFilterTypeParamValueAll);
 
   OnHasTouchEventHandlers(false);
   // Start the touch sequence.
diff --git a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.cc b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.cc
index 629355c691e..341e7a7d2dc 100644
--- a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.cc
+++ b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.cc
@@ -7,9 +7,10 @@
 #include <stddef.h>
 #include <string>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "build/build_config.h"
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/public/browser/browser_thread.h"
@@ -28,8 +29,8 @@ using ui::LatencyInfo;
 namespace content {
 namespace {
 const char* GetTraceNameFromType(blink::WebInputEvent::Type type) {
-#define CASE_TYPE(t)        \
-  case WebInputEvent::k##t: \
+#define CASE_TYPE(t)              \
+  case WebInputEvent::Type::k##t: \
     return "InputLatency::" #t
   switch (type) {
     CASE_TYPE(Undefined);
@@ -82,6 +83,7 @@ const char* GetTraceNameFromType(blink::WebInputEvent::Type type) {
 RenderWidgetHostLatencyTracker::RenderWidgetHostLatencyTracker(
     RenderWidgetHostDelegate* delegate)
     : has_seen_first_gesture_scroll_update_(false),
+      gesture_scroll_id_(-1),
       active_multi_finger_gesture_(false),
       touch_start_default_prevented_(false),
       render_widget_host_delegate_(delegate) {}
@@ -91,7 +93,7 @@ RenderWidgetHostLatencyTracker::~RenderWidgetHostLatencyTracker() {}
 void RenderWidgetHostLatencyTracker::ComputeInputLatencyHistograms(
     WebInputEvent::Type type,
     const LatencyInfo& latency,
-    InputEventAckState ack_result,
+    blink::mojom::InputEventResultState ack_result,
     base::TimeTicks ack_timestamp) {
   DCHECK(!ack_timestamp.is_null());
   // If this event was coalesced into another event, ignore it, as the event it
@@ -114,11 +116,12 @@ void RenderWidgetHostLatencyTracker::ComputeInputLatencyHistograms(
   bool multi_finger_touch_gesture =
       WebInputEvent::IsTouchEventType(type) && active_multi_finger_gesture_;
 
-  bool action_prevented = ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
+  bool action_prevented =
+      ack_result == blink::mojom::InputEventResultState::kConsumed;
   // Touchscreen tap and scroll gestures depend on the disposition of the touch
   // start and the current touch. For touch start,
   // touch_start_default_prevented_ == (ack_result ==
-  // INPUT_EVENT_ACK_STATE_CONSUMED).
+  // blink::mojom::InputEventResultState::kConsumed).
   if (WebInputEvent::IsTouchEventType(type))
     action_prevented |= touch_start_default_prevented_;
 
@@ -161,7 +164,7 @@ void RenderWidgetHostLatencyTracker::OnInputEvent(
 
   OnEventStart(latency);
 
-  if (event.GetType() == WebInputEvent::kTouchStart) {
+  if (event.GetType() == WebInputEvent::Type::kTouchStart) {
     const WebTouchEvent& touch_event =
         *static_cast<const WebTouchEvent*>(&event);
     DCHECK_GE(touch_event.touches_length, static_cast<unsigned>(1));
@@ -169,8 +172,8 @@ void RenderWidgetHostLatencyTracker::OnInputEvent(
   }
 
   if (latency->source_event_type() == ui::SourceEventType::KEY_PRESS) {
-    DCHECK(event.GetType() == WebInputEvent::kChar ||
-           event.GetType() == WebInputEvent::kRawKeyDown);
+    DCHECK(event.GetType() == WebInputEvent::Type::kChar ||
+           event.GetType() == WebInputEvent::Type::kRawKeyDown);
   }
 
   // This is the only place to add the BEGIN_RWH component. So this component
@@ -200,9 +203,12 @@ void RenderWidgetHostLatencyTracker::OnInputEvent(
       ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT,
       GetTraceNameFromType(event.GetType()));
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
     has_seen_first_gesture_scroll_update_ = false;
-  } else if (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
+    gesture_scroll_id_ = latency->trace_id();
+    latency->set_gesture_scroll_id(gesture_scroll_id_);
+  } else if (event.GetType() ==
+             blink::WebInputEvent::Type::kGestureScrollUpdate) {
     // Make a copy of the INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT with a
     // different name INPUT_EVENT_LATENCY_SCROLL_UPDATE_ORIGINAL_COMPONENT.
     // So we can track the latency specifically for scroll update events.
@@ -220,16 +226,21 @@ void RenderWidgetHostLatencyTracker::OnInputEvent(
     }
 
     has_seen_first_gesture_scroll_update_ = true;
+    latency->set_gesture_scroll_id(gesture_scroll_id_);
     latency->set_scroll_update_delta(
         static_cast<const WebGestureEvent&>(event).data.scroll_update.delta_y);
     latency->set_predicted_scroll_update_delta(
         static_cast<const WebGestureEvent&>(event).data.scroll_update.delta_y);
+  } else if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd) {
+    latency->set_gesture_scroll_id(gesture_scroll_id_);
+    gesture_scroll_id_ = -1;
   }
 }
 
 void RenderWidgetHostLatencyTracker::OnInputEventAck(
     const blink::WebInputEvent& event,
-    LatencyInfo* latency, InputEventAckState ack_result) {
+    LatencyInfo* latency,
+    blink::mojom::InputEventResultState ack_result) {
   DCHECK(latency);
 
   // Latency ends if an event is acked but does not cause render scheduling.
@@ -241,11 +252,11 @@ void RenderWidgetHostLatencyTracker::OnInputEventAck(
   if (WebInputEvent::IsTouchEventType(event.GetType())) {
     const WebTouchEvent& touch_event =
         *static_cast<const WebTouchEvent*>(&event);
-    if (event.GetType() == WebInputEvent::kTouchStart) {
+    if (event.GetType() == WebInputEvent::Type::kTouchStart) {
       touch_start_default_prevented_ =
-          ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
-    } else if (event.GetType() == WebInputEvent::kTouchEnd ||
-               event.GetType() == WebInputEvent::kTouchCancel) {
+          ack_result == blink::mojom::InputEventResultState::kConsumed;
+    } else if (event.GetType() == WebInputEvent::Type::kTouchEnd ||
+               event.GetType() == WebInputEvent::Type::kTouchCancel) {
       active_multi_finger_gesture_ = touch_event.touches_length > 2;
     }
   }
@@ -255,8 +266,8 @@ void RenderWidgetHostLatencyTracker::OnInputEventAck(
   // terminate it as well. We also exclude cases where we're against the scroll
   // extent from scrolling metrics.
   if (!rendering_scheduled || latency->coalesced() ||
-      (event.GetType() == WebInputEvent::kGestureScrollUpdate &&
-       ack_result == INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS)) {
+      (event.GetType() == WebInputEvent::Type::kGestureScrollUpdate &&
+       ack_result == blink::mojom::InputEventResultState::kNoConsumerExists)) {
     latency->Terminate();
   }
 
@@ -268,7 +279,7 @@ void RenderWidgetHostLatencyTracker::OnEventStart(ui::LatencyInfo* latency) {
   static uint64_t global_trace_id = 0;
   latency->set_trace_id(++global_trace_id);
   latency->set_ukm_source_id(
-      render_widget_host_delegate_->GetUkmSourceIdForLastCommittedSource());
+      render_widget_host_delegate_->GetCurrentPageUkmSourceId());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.h b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.h
index 663673bd6f3..5c88d696eea 100644
--- a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.h
+++ b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker.h
@@ -12,7 +12,7 @@
 #include "base/macros.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/latency/latency_info.h"
 #include "ui/latency/latency_tracker.h"
 
@@ -27,10 +27,11 @@ class CONTENT_EXPORT RenderWidgetHostLatencyTracker {
   explicit RenderWidgetHostLatencyTracker(RenderWidgetHostDelegate* delegate);
   virtual ~RenderWidgetHostLatencyTracker();
 
-  void ComputeInputLatencyHistograms(blink::WebInputEvent::Type type,
-                                     const ui::LatencyInfo& latency,
-                                     InputEventAckState ack_result,
-                                     base::TimeTicks ack_timestamp);
+  void ComputeInputLatencyHistograms(
+      blink::WebInputEvent::Type type,
+      const ui::LatencyInfo& latency,
+      blink::mojom::InputEventResultState ack_result,
+      base::TimeTicks ack_timestamp);
 
   // Populates the LatencyInfo with relevant entries for latency tracking.
   // Called when an event is received by the RenderWidgetHost, prior to
@@ -44,7 +45,7 @@ class CONTENT_EXPORT RenderWidgetHostLatencyTracker {
   // to the RenderWidgetHost (from the InputRouter).
   void OnInputEventAck(const blink::WebInputEvent& event,
                        ui::LatencyInfo* latency,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultState ack_result);
 
   void reset_delegate() { render_widget_host_delegate_ = nullptr; }
 
@@ -52,6 +53,8 @@ class CONTENT_EXPORT RenderWidgetHostLatencyTracker {
   void OnEventStart(ui::LatencyInfo* latency);
 
   bool has_seen_first_gesture_scroll_update_;
+  int64_t gesture_scroll_id_;
+
   // Whether the current stream of touch events includes more than one active
   // touch point. This is set in OnInputEvent, and cleared in OnInputEventAck.
   bool active_multi_finger_gesture_;
diff --git a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
index 2b71cdebb8a..64308c5f3db 100644
--- a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
@@ -226,7 +226,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
   size_t total_ukm_entry_count = 0;
   contents()->NavigateAndCommit(url);
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(contents())
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
   EXPECT_NE(ukm::kInvalidSourceId, source_id);
   for (bool rendering_on_main : {false, true}) {
     ResetHistograms();
@@ -245,8 +246,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(wheel_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(wheel, &wheel_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          wheel, &wheel_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
       viz_tracker()->OnGpuSwapBuffersCompleted(wheel_latency);
 
       // UKM metrics.
@@ -338,7 +340,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_TestWheelToScrollHistograms) {
   size_t total_ukm_entry_count = 0;
   contents()->NavigateAndCommit(url);
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(contents())
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
   EXPECT_NE(ukm::kInvalidSourceId, source_id);
   for (bool rendering_on_main : {false, true}) {
     ResetHistograms();
@@ -357,8 +360,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_TestWheelToScrollHistograms) {
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(wheel_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(wheel, &wheel_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          wheel, &wheel_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
       viz_tracker()->OnGpuSwapBuffersCompleted(wheel_latency);
 
       // UKM metrics.
@@ -466,8 +470,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(scroll_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(scroll, &scroll_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          scroll, &scroll_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
       viz_tracker()->OnGpuSwapBuffersCompleted(scroll_latency);
     }
 
@@ -513,7 +518,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
   contents()->NavigateAndCommit(url);
   size_t total_ukm_entry_count = 0;
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(contents())
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
   EXPECT_NE(ukm::kInvalidSourceId, source_id);
   for (bool rendering_on_main : {false, true}) {
     ResetHistograms();
@@ -530,8 +536,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(scroll_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(scroll, &scroll_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          scroll, &scroll_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
     }
 
     {
@@ -551,8 +558,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(touch_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(touch, &touch_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          touch, &touch_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
       viz_tracker()->OnGpuSwapBuffersCompleted(touch_latency);
     }
 
@@ -629,7 +637,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_TestTouchToScrollHistograms) {
   contents()->NavigateAndCommit(url);
   size_t total_ukm_entry_count = 0;
   ukm::SourceId source_id = static_cast<WebContentsImpl*>(contents())
-                                ->GetUkmSourceIdForLastCommittedSource();
+                                ->GetMainFrame()
+                                ->GetPageUkmSourceId();
   EXPECT_NE(ukm::kInvalidSourceId, source_id);
   for (bool rendering_on_main : {false, true}) {
     ResetHistograms();
@@ -646,8 +655,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_TestTouchToScrollHistograms) {
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(scroll_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(scroll, &scroll_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          scroll, &scroll_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
     }
 
     {
@@ -667,8 +677,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_TestTouchToScrollHistograms) {
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
       EXPECT_TRUE(touch_latency.FindLatency(
           ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-      tracker()->OnInputEventAck(touch, &touch_latency,
-                                 INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      tracker()->OnInputEventAck(
+          touch, &touch_latency,
+          blink::mojom::InputEventResultState::kNotConsumed);
       viz_tracker()->OnGpuSwapBuffersCompleted(touch_latency);
     }
 
@@ -745,8 +756,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_ScrollbarEndToEndHistograms) {
   contents()->NavigateAndCommit(url);
   ResetHistograms();
   {
-    auto mouse_move =
-        SyntheticWebMouseEventBuilder::Build(blink::WebMouseEvent::kMouseMove);
+    auto mouse_move = SyntheticWebMouseEventBuilder::Build(
+        blink::WebMouseEvent::Type::kMouseMove);
     base::TimeTicks now = base::TimeTicks::Now();
 
     const ui::LatencyComponentType scroll_components[] = {
@@ -765,8 +776,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, MAYBE_ScrollbarEndToEndHistograms) {
             ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
         EXPECT_TRUE(scrollbar_latency.FindLatency(
             ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, nullptr));
-        tracker()->OnInputEventAck(mouse_move, &scrollbar_latency,
-                                   INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+        tracker()->OnInputEventAck(
+            mouse_move, &scrollbar_latency,
+            blink::mojom::InputEventResultState::kNotConsumed);
         viz_tracker()->OnGpuSwapBuffersCompleted(scrollbar_latency);
       }
     }
@@ -806,8 +818,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
     // Don't include the rendering schedule component, since we're testing the
     // case where rendering isn't scheduled.
     tracker()->OnInputEvent(scroll, &scroll_latency);
-    tracker()->OnInputEventAck(scroll, &scroll_latency,
-                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    tracker()->OnInputEventAck(
+        scroll, &scroll_latency,
+        blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_TRUE(scroll_latency.terminated());
   }
 
@@ -818,8 +831,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
     wheel_latency.set_source_event_type(ui::SourceEventType::WHEEL);
     AddFakeComponents(*tracker(), &wheel_latency);
     tracker()->OnInputEvent(wheel, &wheel_latency);
-    tracker()->OnInputEventAck(wheel, &wheel_latency,
-                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    tracker()->OnInputEventAck(
+        wheel, &wheel_latency,
+        blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_TRUE(wheel_latency.terminated());
   }
 
@@ -830,31 +844,34 @@ TEST_F(RenderWidgetHostLatencyTrackerTest,
     touch_latency.set_source_event_type(ui::SourceEventType::TOUCH);
     AddFakeComponents(*tracker(), &touch_latency);
     tracker()->OnInputEvent(touch, &touch_latency);
-    tracker()->OnInputEventAck(touch, &touch_latency,
-                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    tracker()->OnInputEventAck(
+        touch, &touch_latency,
+        blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_TRUE(touch_latency.terminated());
   }
 
   {
-    auto mouse_move =
-        SyntheticWebMouseEventBuilder::Build(blink::WebMouseEvent::kMouseMove);
+    auto mouse_move = SyntheticWebMouseEventBuilder::Build(
+        blink::WebMouseEvent::Type::kMouseMove);
     ui::LatencyInfo mouse_latency;
     AddFakeComponents(*tracker(), &mouse_latency);
     tracker()->OnInputEvent(mouse_move, &mouse_latency);
-    tracker()->OnInputEventAck(mouse_move, &mouse_latency,
-                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    tracker()->OnInputEventAck(
+        mouse_move, &mouse_latency,
+        blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_TRUE(mouse_latency.terminated());
   }
 
   {
-    auto key_event =
-        SyntheticWebKeyboardEventBuilder::Build(blink::WebKeyboardEvent::kChar);
+    auto key_event = SyntheticWebKeyboardEventBuilder::Build(
+        blink::WebKeyboardEvent::Type::kChar);
     ui::LatencyInfo key_latency;
     key_latency.set_source_event_type(ui::SourceEventType::KEY_PRESS);
     AddFakeComponents(*tracker(), &key_latency);
     tracker()->OnInputEvent(key_event, &key_latency);
-    tracker()->OnInputEventAck(key_event, &key_latency,
-                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    tracker()->OnInputEventAck(
+        key_event, &key_latency,
+        blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_TRUE(key_latency.terminated());
   }
 
@@ -890,8 +907,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, LatencyTerminatedOnAckIfGSUIgnored) {
       AddFakeComponentsWithTimeStamp(*tracker(), &scroll_latency, now);
       AddRenderingScheduledComponent(&scroll_latency, rendering_on_main, now);
       tracker()->OnInputEvent(scroll, &scroll_latency);
-      tracker()->OnInputEventAck(scroll, &scroll_latency,
-                                 INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      tracker()->OnInputEventAck(
+          scroll, &scroll_latency,
+          blink::mojom::InputEventResultState::kNoConsumerExists);
       EXPECT_TRUE(scroll_latency.terminated());
     }
   }
@@ -948,8 +966,9 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, TouchBlockingAndQueueingTime) {
   int touchmove_timestamps_ms[] = {1, 5, 12};
   int touchend_timestamps_ms[] = {3, 8, 12};
 
-  for (InputEventAckState blocking :
-       {INPUT_EVENT_ACK_STATE_NOT_CONSUMED, INPUT_EVENT_ACK_STATE_CONSUMED}) {
+  for (blink::mojom::InputEventResultState blocking :
+       {blink::mojom::InputEventResultState::kNotConsumed,
+        blink::mojom::InputEventResultState::kConsumed}) {
     SyntheticWebTouchEvent event;
     {
       // Touch start.
@@ -1121,10 +1140,11 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, KeyBlockingAndQueueingTime) {
   // These numbers are sensitive to where the histogram buckets are.
   int event_timestamps_ms[] = {11, 25, 35};
 
-  for (InputEventAckState blocking :
-       {INPUT_EVENT_ACK_STATE_NOT_CONSUMED, INPUT_EVENT_ACK_STATE_CONSUMED}) {
+  for (blink::mojom::InputEventResultState blocking :
+       {blink::mojom::InputEventResultState::kNotConsumed,
+        blink::mojom::InputEventResultState::kConsumed}) {
     {
-      NativeWebKeyboardEvent event(blink::WebKeyboardEvent::kRawKeyDown,
+      NativeWebKeyboardEvent event(blink::WebKeyboardEvent::Type::kRawKeyDown,
                                    blink::WebInputEvent::kNoModifiers,
                                    base::TimeTicks::Now());
       ui::LatencyInfo latency_info;
@@ -1216,7 +1236,8 @@ TEST_F(RenderWidgetHostLatencyTrackerTest, KeyEndToEndLatency) {
 TEST_F(RenderWidgetHostLatencyTrackerTest,
        MultiFingerTouchIgnoredForQueueingAndBlockingTimeMetrics) {
   SyntheticWebTouchEvent event;
-  InputEventAckState ack_state = INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+  blink::mojom::InputEventResultState ack_state =
+      blink::mojom::InputEventResultState::kNotConsumed;
 
   {
     // First touch start.
diff --git a/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc b/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
index e7cb819f011..4474ae7c66c 100644
--- a/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -45,6 +46,7 @@ const char kDataURL[] =
     "<style>"
     "body {"
     "  height:9000px;"
+    "  overscroll-behavior:none;"
     "}"
     "</style>"
     "</head>"
@@ -214,13 +216,13 @@ IN_PROC_BROWSER_TEST_F(ScrollLatencyBrowserTest, MultipleWheelScrollOnMain) {
   RunMultipleWheelScroll();
 }
 
-// Do an upward wheel scroll, and verify that no scroll metrics is recorded when
+// Do an upward touch scroll, and verify that no scroll metrics is recorded when
 // the scroll event is ignored.
 IN_PROC_BROWSER_TEST_F(ScrollLatencyBrowserTest,
                        ScrollLatencyNotRecordedIfGSUIgnored) {
   LoadURL();
   auto scroll_update_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollUpdate);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollUpdate);
 
   // Try to scroll upward, the GSU(s) will get ignored since the scroller is at
   // its extent.
@@ -241,7 +243,7 @@ IN_PROC_BROWSER_TEST_F(ScrollLatencyBrowserTest,
   // Runs until we get the OnSyntheticGestureCompleted callback and verify that
   // the first GSU event is ignored.
   run_loop_->Run();
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
             scroll_update_watcher->GetAckStateWaitIfNecessary());
 
   // Wait for one frame and then verify that the scroll metrics are not
@@ -267,18 +269,12 @@ IN_PROC_BROWSER_TEST_F(ScrollLatencyBrowserTest,
 
 using ScrollThroughputBrowserTest = ScrollLatencyBrowserTest;
 
-// The test does a fling during the test, and it times out in slower builds
-// (e.g. when sanitizers are turned on).
-#if defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
-#define MAYBE_ScrollThroughputMetrics DISABLED_ScrollThroughputMetrics
-#else
-#define MAYBE_ScrollThroughputMetrics ScrollThroughputMetrics
-#endif
+// This test flakes on most platforms: https://crbug.com/1067492.
 IN_PROC_BROWSER_TEST_F(ScrollThroughputBrowserTest,
-                       MAYBE_ScrollThroughputMetrics) {
+                       DISABLED_ScrollThroughputMetrics) {
   LoadURL();
   auto scroll_update_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollEnd);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollEnd);
 
   SyntheticSmoothScrollGestureParams params;
   params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
@@ -306,6 +302,9 @@ IN_PROC_BROWSER_TEST_F(ScrollThroughputBrowserTest,
   EXPECT_TRUE(VerifyRecordedSamplesForHistogram(
       1,
       "Graphics.Smoothness.PercentDroppedFrames.ScrollingThread.TouchScroll"));
+
+  RunUntilInputProcessed(GetWidgetHost());
+  FetchHistogramsFromChildProcesses();
   EXPECT_TRUE(VerifyRecordedSamplesForHistogram(
       1, "Event.Latency.ScrollBegin.Touch.BrowserNotifiedToBeforeGpuSwap2"));
 }
@@ -356,13 +355,13 @@ class ScrollLatencyScrollbarBrowserTest : public ScrollLatencyBrowserTest {
     // scrollbar scroll.
     gfx::PointF scrollbar_forward_button(795, 595);
     blink::WebMouseEvent mouse_event = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseDown, scrollbar_forward_button.x(),
+        blink::WebInputEvent::Type::kMouseDown, scrollbar_forward_button.x(),
         scrollbar_forward_button.y(), 0);
     mouse_event.button = blink::WebMouseEvent::Button::kLeft;
     mouse_event.SetTimeStamp(base::TimeTicks::Now());
     GetWidgetHost()->ForwardMouseEvent(mouse_event);
 
-    mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+    mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
     GetWidgetHost()->ForwardMouseEvent(mouse_event);
 
     RunUntilInputProcessed(GetWidgetHost());
@@ -397,7 +396,7 @@ class ScrollLatencyScrollbarBrowserTest : public ScrollLatencyBrowserTest {
     // thread scrollbar ScrollBegin and ScrollUpdate.
     gfx::PointF scrollbar_thumb(795, 30);
     blink::WebMouseEvent mouse_down = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseDown, scrollbar_thumb.x(),
+        blink::WebInputEvent::Type::kMouseDown, scrollbar_thumb.x(),
         scrollbar_thumb.y(), 0);
     mouse_down.button = blink::WebMouseEvent::Button::kLeft;
     mouse_down.SetTimeStamp(base::TimeTicks::Now());
@@ -413,7 +412,7 @@ class ScrollLatencyScrollbarBrowserTest : public ScrollLatencyBrowserTest {
     RunUntilInputProcessed(GetWidgetHost());
 
     blink::WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseMove, scrollbar_thumb.x(),
+        blink::WebInputEvent::Type::kMouseMove, scrollbar_thumb.x(),
         scrollbar_thumb.y() + 10, 0);
     mouse_move.button = blink::WebMouseEvent::Button::kLeft;
     mouse_move.SetTimeStamp(base::TimeTicks::Now());
@@ -428,7 +427,7 @@ class ScrollLatencyScrollbarBrowserTest : public ScrollLatencyBrowserTest {
     RunUntilInputProcessed(GetWidgetHost());
 
     blink::WebMouseEvent mouse_up = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseUp, scrollbar_thumb.x(),
+        blink::WebInputEvent::Type::kMouseUp, scrollbar_thumb.x(),
         scrollbar_thumb.y() + 20, 0);
     mouse_up.button = blink::WebMouseEvent::Button::kLeft;
     mouse_up.SetTimeStamp(base::TimeTicks::Now());
diff --git a/chromium/content/browser/renderer_host/input/stylus_text_selector.cc b/chromium/content/browser/renderer_host/input/stylus_text_selector.cc
index cc4e7ebd16f..591cab2ae16 100644
--- a/chromium/content/browser/renderer_host/input/stylus_text_selector.cc
+++ b/chromium/content/browser/renderer_host/input/stylus_text_selector.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/renderer_host/input/stylus_text_selector.h"
 
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "ui/events/event_constants.h"
 #include "ui/events/gesture_detection/gesture_detector.h"
 #include "ui/events/gesture_detection/gesture_provider_config_helper.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture.cc
index 35cbaaca4d9..87d50bc93e3 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/renderer_host/input/synthetic_gesture.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "content/browser/renderer_host/input/synthetic_gesture_target.h"
 #include "content/browser/renderer_host/input/synthetic_pinch_gesture.h"
 #include "content/browser/renderer_host/input/synthetic_pointer_action.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture.h b/chromium/content/browser/renderer_host/input/synthetic_gesture.h
index d0d0790f341..e6f8bb5ad89 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
index aa70c26d613..235a153178b 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
@@ -62,60 +62,60 @@ WebTouchPoint::State ToWebTouchPointState(
     SyntheticPointerActionParams::PointerActionType action_type) {
   switch (action_type) {
     case SyntheticPointerActionParams::PointerActionType::PRESS:
-      return WebTouchPoint::kStatePressed;
+      return WebTouchPoint::State::kStatePressed;
     case SyntheticPointerActionParams::PointerActionType::MOVE:
-      return WebTouchPoint::kStateMoved;
+      return WebTouchPoint::State::kStateMoved;
     case SyntheticPointerActionParams::PointerActionType::RELEASE:
-      return WebTouchPoint::kStateReleased;
+      return WebTouchPoint::State::kStateReleased;
     case SyntheticPointerActionParams::PointerActionType::CANCEL:
-      return WebTouchPoint::kStateCancelled;
+      return WebTouchPoint::State::kStateCancelled;
     case SyntheticPointerActionParams::PointerActionType::IDLE:
-      return WebTouchPoint::kStateStationary;
+      return WebTouchPoint::State::kStateStationary;
     case SyntheticPointerActionParams::PointerActionType::LEAVE:
     case SyntheticPointerActionParams::PointerActionType::NOT_INITIALIZED:
       NOTREACHED()
           << "Invalid SyntheticPointerActionParams::PointerActionType.";
-      return WebTouchPoint::kStateUndefined;
+      return WebTouchPoint::State::kStateUndefined;
   }
   NOTREACHED() << "Invalid SyntheticPointerActionParams::PointerActionType.";
-  return WebTouchPoint::kStateUndefined;
+  return WebTouchPoint::State::kStateUndefined;
 }
 
 WebInputEvent::Type ToWebMouseEventType(
     SyntheticPointerActionParams::PointerActionType action_type) {
   switch (action_type) {
     case SyntheticPointerActionParams::PointerActionType::PRESS:
-      return WebInputEvent::kMouseDown;
+      return WebInputEvent::Type::kMouseDown;
     case SyntheticPointerActionParams::PointerActionType::MOVE:
-      return WebInputEvent::kMouseMove;
+      return WebInputEvent::Type::kMouseMove;
     case SyntheticPointerActionParams::PointerActionType::RELEASE:
-      return WebInputEvent::kMouseUp;
+      return WebInputEvent::Type::kMouseUp;
     case SyntheticPointerActionParams::PointerActionType::LEAVE:
-      return WebInputEvent::kMouseLeave;
+      return WebInputEvent::Type::kMouseLeave;
     case SyntheticPointerActionParams::PointerActionType::CANCEL:
     case SyntheticPointerActionParams::PointerActionType::IDLE:
     case SyntheticPointerActionParams::PointerActionType::NOT_INITIALIZED:
       NOTREACHED()
           << "Invalid SyntheticPointerActionParams::PointerActionType.";
-      return WebInputEvent::kUndefined;
+      return WebInputEvent::Type::kUndefined;
   }
   NOTREACHED() << "Invalid SyntheticPointerActionParams::PointerActionType.";
-  return WebInputEvent::kUndefined;
+  return WebInputEvent::Type::kUndefined;
 }
 
 WebInputEvent::Type WebTouchPointStateToEventType(
     blink::WebTouchPoint::State state) {
   switch (state) {
-    case blink::WebTouchPoint::kStateReleased:
-      return WebInputEvent::kTouchEnd;
-    case blink::WebTouchPoint::kStatePressed:
-      return WebInputEvent::kTouchStart;
-    case blink::WebTouchPoint::kStateMoved:
-      return WebInputEvent::kTouchMove;
-    case blink::WebTouchPoint::kStateCancelled:
-      return WebInputEvent::kTouchCancel;
+    case blink::WebTouchPoint::State::kStateReleased:
+      return WebInputEvent::Type::kTouchEnd;
+    case blink::WebTouchPoint::State::kStatePressed:
+      return WebInputEvent::Type::kTouchStart;
+    case blink::WebTouchPoint::State::kStateMoved:
+      return WebInputEvent::Type::kTouchMove;
+    case blink::WebTouchPoint::State::kStateCancelled:
+      return WebInputEvent::Type::kTouchCancel;
     default:
-      return WebInputEvent::kUndefined;
+      return WebInputEvent::Type::kUndefined;
   }
 }
 
@@ -229,7 +229,7 @@ class MockScrollMouseTarget : public MockMoveGestureTarget {
   ~MockScrollMouseTarget() override {}
 
   void DispatchInputEventToPlatform(const WebInputEvent& event) override {
-    ASSERT_EQ(event.GetType(), WebInputEvent::kMouseWheel);
+    ASSERT_EQ(event.GetType(), WebInputEvent::Type::kMouseWheel);
     const WebMouseWheelEvent& mouse_wheel_event =
         static_cast<const WebMouseWheelEvent&>(event);
     gfx::Vector2dF delta(mouse_wheel_event.delta_x, mouse_wheel_event.delta_y);
@@ -250,19 +250,19 @@ class MockMoveTouchTarget : public MockMoveGestureTarget {
     ASSERT_EQ(touch_event.touches_length, 1U);
 
     if (!started_) {
-      ASSERT_EQ(touch_event.GetType(), WebInputEvent::kTouchStart);
+      ASSERT_EQ(touch_event.GetType(), WebInputEvent::Type::kTouchStart);
       start_ = touch_event.touches[0].PositionInWidget();
       last_touch_point_ = start_;
       started_ = true;
     } else {
-      ASSERT_NE(touch_event.GetType(), WebInputEvent::kTouchStart);
-      ASSERT_NE(touch_event.GetType(), WebInputEvent::kTouchCancel);
+      ASSERT_NE(touch_event.GetType(), WebInputEvent::Type::kTouchStart);
+      ASSERT_NE(touch_event.GetType(), WebInputEvent::Type::kTouchCancel);
 
       gfx::PointF touch_point(touch_event.touches[0].PositionInWidget());
       gfx::Vector2dF delta = touch_point - last_touch_point_;
       total_abs_move_distance_length_ += delta.Length();
 
-      if (touch_event.GetType() == WebInputEvent::kTouchEnd)
+      if (touch_event.GetType() == WebInputEvent::Type::kTouchEnd)
         start_to_end_distance_ = touch_point - start_;
 
       last_touch_point_ = touch_point;
@@ -281,7 +281,7 @@ class MockFlingGestureTarget : public MockMoveGestureTarget {
   ~MockFlingGestureTarget() override {}
 
   void DispatchInputEventToPlatform(const WebInputEvent& event) override {
-    if (event.GetType() == WebInputEvent::kGestureFlingStart) {
+    if (event.GetType() == WebInputEvent::Type::kGestureFlingStart) {
       const blink::WebGestureEvent& gesture_event =
           static_cast<const blink::WebGestureEvent&>(event);
       fling_velocity_x_ = gesture_event.data.fling_start.velocity_x;
@@ -308,18 +308,18 @@ class MockDragMouseTarget : public MockMoveGestureTarget {
     if (!started_) {
       EXPECT_EQ(mouse_event.button, WebMouseEvent::Button::kLeft);
       EXPECT_EQ(mouse_event.click_count, 1);
-      EXPECT_EQ(mouse_event.GetType(), WebInputEvent::kMouseDown);
+      EXPECT_EQ(mouse_event.GetType(), WebInputEvent::Type::kMouseDown);
       start_ = mouse_event.PositionInWidget();
       last_mouse_point_ = start_;
       started_ = true;
     } else {
       EXPECT_EQ(mouse_event.button, WebMouseEvent::Button::kLeft);
-      ASSERT_NE(mouse_event.GetType(), WebInputEvent::kMouseDown);
+      ASSERT_NE(mouse_event.GetType(), WebInputEvent::Type::kMouseDown);
 
       gfx::PointF mouse_point(mouse_event.PositionInWidget());
       gfx::Vector2dF delta = mouse_point - last_mouse_point_;
       total_abs_move_distance_length_ += delta.Length();
-      if (mouse_event.GetType() == WebInputEvent::kMouseUp)
+      if (mouse_event.GetType() == WebInputEvent::Type::kMouseUp)
         start_to_end_distance_ = mouse_point - start_;
       last_mouse_point_ = mouse_point;
     }
@@ -352,7 +352,7 @@ class MockSyntheticTouchscreenPinchTouchTarget
     ASSERT_EQ(touch_event.touches_length, 2U);
 
     if (!started_) {
-      ASSERT_EQ(touch_event.GetType(), WebInputEvent::kTouchStart);
+      ASSERT_EQ(touch_event.GetType(), WebInputEvent::Type::kTouchStart);
 
       start_0_ = gfx::PointF(touch_event.touches[0].PositionInWidget());
       start_1_ = gfx::PointF(touch_event.touches[1].PositionInWidget());
@@ -362,8 +362,8 @@ class MockSyntheticTouchscreenPinchTouchTarget
 
       started_ = true;
     } else {
-      ASSERT_NE(touch_event.GetType(), WebInputEvent::kTouchStart);
-      ASSERT_NE(touch_event.GetType(), WebInputEvent::kTouchCancel);
+      ASSERT_NE(touch_event.GetType(), WebInputEvent::Type::kTouchStart);
+      ASSERT_NE(touch_event.GetType(), WebInputEvent::Type::kTouchCancel);
 
       gfx::PointF current_0 =
           gfx::PointF(touch_event.touches[0].PositionInWidget());
@@ -442,16 +442,18 @@ class MockSyntheticTouchpadPinchTouchTarget
     const blink::WebGestureEvent& gesture_event =
         static_cast<const blink::WebGestureEvent&>(event);
 
-    if (gesture_event.GetType() == WebInputEvent::kGesturePinchBegin) {
+    if (gesture_event.GetType() == WebInputEvent::Type::kGesturePinchBegin) {
       EXPECT_FALSE(started_);
       EXPECT_FALSE(ended_);
       started_ = true;
-    } else if (gesture_event.GetType() == WebInputEvent::kGesturePinchEnd) {
+    } else if (gesture_event.GetType() ==
+               WebInputEvent::Type::kGesturePinchEnd) {
       EXPECT_TRUE(started_);
       EXPECT_FALSE(ended_);
       ended_ = true;
     } else {
-      EXPECT_EQ(WebInputEvent::kGesturePinchUpdate, gesture_event.GetType());
+      EXPECT_EQ(WebInputEvent::Type::kGesturePinchUpdate,
+                gesture_event.GetType());
       EXPECT_TRUE(started_);
       EXPECT_FALSE(ended_);
       const float scale = gesture_event.data.pinch_update.scale;
@@ -520,13 +522,13 @@ class MockSyntheticTapTouchTarget : public MockSyntheticTapGestureTarget {
 
     switch (state_) {
       case NOT_STARTED:
-        EXPECT_EQ(touch_event.GetType(), WebInputEvent::kTouchStart);
+        EXPECT_EQ(touch_event.GetType(), WebInputEvent::Type::kTouchStart);
         position_ = gfx::PointF(touch_event.touches[0].PositionInWidget());
         start_time_ = touch_event.TimeStamp().since_origin();
         state_ = STARTED;
         break;
       case STARTED:
-        EXPECT_EQ(touch_event.GetType(), WebInputEvent::kTouchEnd);
+        EXPECT_EQ(touch_event.GetType(), WebInputEvent::Type::kTouchEnd);
         EXPECT_EQ(position_,
                   gfx::PointF(touch_event.touches[0].PositionInWidget()));
         stop_time_ = touch_event.TimeStamp().since_origin();
@@ -550,7 +552,7 @@ class MockSyntheticTapMouseTarget : public MockSyntheticTapGestureTarget {
 
     switch (state_) {
       case NOT_STARTED:
-        EXPECT_EQ(mouse_event.GetType(), WebInputEvent::kMouseDown);
+        EXPECT_EQ(mouse_event.GetType(), WebInputEvent::Type::kMouseDown);
         EXPECT_EQ(mouse_event.button, WebMouseEvent::Button::kLeft);
         EXPECT_EQ(mouse_event.click_count, 1);
         position_ = gfx::PointF(mouse_event.PositionInWidget());
@@ -558,7 +560,7 @@ class MockSyntheticTapMouseTarget : public MockSyntheticTapGestureTarget {
         state_ = STARTED;
         break;
       case STARTED:
-        EXPECT_EQ(mouse_event.GetType(), WebInputEvent::kMouseUp);
+        EXPECT_EQ(mouse_event.GetType(), WebInputEvent::Type::kMouseUp);
         EXPECT_EQ(mouse_event.button, WebMouseEvent::Button::kLeft);
         EXPECT_EQ(mouse_event.click_count, 1);
         EXPECT_EQ(position_, gfx::PointF(mouse_event.PositionInWidget()));
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target.h b/chromium/content/browser/renderer_host/input/synthetic_gesture_target.h
index 5ab6fba95ae..5a398b6132c 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_GESTURE_TARGET_H_
 #define CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_GESTURE_TARGET_H_
 
+#include "base/callback_forward.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "content/common/input/synthetic_gesture_params.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_android.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_android.cc
index 40cf4d60fdb..a42e5b53dad 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_android.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_android.cc
@@ -81,16 +81,16 @@ void SyntheticGestureTargetAndroid::DispatchWebTouchEventToPlatform(
     const ui::LatencyInfo&) {
   MotionEventAction action = MOTION_EVENT_ACTION_INVALID;
   switch (web_touch.GetType()) {
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchStart:
       action = MOTION_EVENT_ACTION_START;
       break;
-    case WebInputEvent::kTouchMove:
+    case WebInputEvent::Type::kTouchMove:
       action = MOTION_EVENT_ACTION_MOVE;
       break;
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchCancel:
       action = MOTION_EVENT_ACTION_CANCEL;
       break;
-    case WebInputEvent::kTouchEnd:
+    case WebInputEvent::Type::kTouchEnd:
       action = MOTION_EVENT_ACTION_END;
       break;
     default:
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
index 5b03d1b8f21..ac603a8a1c5 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
@@ -83,7 +83,7 @@ void SyntheticGestureTargetAura::DispatchWebMouseWheelEventToPlatform(
     return;
   }
   base::TimeTicks timestamp = web_wheel.TimeStamp();
-  int modifiers = ui::EF_NONE;
+  int modifiers = ui::WebEventModifiersToEventFlags(web_wheel.GetModifiers());
   if (web_wheel.delta_units == ui::ScrollGranularity::kScrollByPrecisePixel) {
     modifiers |= ui::EF_PRECISION_SCROLLING_DELTA;
   } else if (web_wheel.delta_units == ui::ScrollGranularity::kScrollByPage) {
@@ -108,7 +108,7 @@ void SyntheticGestureTargetAura::DispatchWebGestureEventToPlatform(
     const ui::LatencyInfo& latency_info) {
   DCHECK(blink::WebInputEvent::IsPinchGestureEventType(web_gesture.GetType()) ||
          blink::WebInputEvent::IsFlingGestureEventType(web_gesture.GetType()));
-  ui::EventType event_type = ui::WebEventTypeToEventType(web_gesture.GetType());
+  ui::EventType event_type = web_gesture.GetTypeAsUiEventType();
   int flags = ui::WebEventModifiersToEventFlags(web_gesture.GetModifiers());
   aura::Window* window = GetWindow();
 
@@ -128,7 +128,7 @@ void SyntheticGestureTargetAura::DispatchWebGestureEventToPlatform(
   }
 
   ui::EventMomentumPhase momentum_phase =
-      web_gesture.GetType() == blink::WebInputEvent::kGestureFlingStart
+      web_gesture.GetType() == blink::WebInputEvent::Type::kGestureFlingStart
           ? ui::EventMomentumPhase::BEGAN
           : ui::EventMomentumPhase::END;
   ui::ScrollEvent scroll_event(event_type, web_gesture.PositionInWidget(),
@@ -144,8 +144,7 @@ void SyntheticGestureTargetAura::DispatchWebGestureEventToPlatform(
 void SyntheticGestureTargetAura::DispatchWebMouseEventToPlatform(
     const blink::WebMouseEvent& web_mouse_event,
     const ui::LatencyInfo& latency_info) {
-  ui::EventType event_type =
-      ui::WebEventTypeToEventType(web_mouse_event.GetType());
+  ui::EventType event_type = web_mouse_event.GetTypeAsUiEventType();
   int flags = ui::WebEventModifiersToEventFlags(web_mouse_event.GetModifiers());
   ui::PointerDetails pointer_details(
       ui::WebPointerTypeToEventPointerType(web_mouse_event.pointer_type));
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.cc
index 2b901e8c72f..6a357327057 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.cc
@@ -52,7 +52,7 @@ void SyntheticGestureTargetBase::DispatchInputEventToPlatform(
 
     // Check that all touch pointers are within the content bounds.
     for (unsigned i = 0; i < web_touch.touches_length; i++) {
-      if (web_touch.touches[i].state == WebTouchPoint::kStatePressed &&
+      if (web_touch.touches[i].state == WebTouchPoint::State::kStatePressed &&
           !PointIsWithinContents(web_touch.touches[i].PositionInWidget())) {
         LOG(WARNING)
             << "Touch coordinates are not within content bounds on TouchStart.";
@@ -60,7 +60,7 @@ void SyntheticGestureTargetBase::DispatchInputEventToPlatform(
       }
     }
     DispatchWebTouchEventToPlatform(web_touch, latency_info);
-  } else if (event.GetType() == WebInputEvent::kMouseWheel) {
+  } else if (event.GetType() == WebInputEvent::Type::kMouseWheel) {
     const WebMouseWheelEvent& web_wheel =
         static_cast<const WebMouseWheelEvent&>(event);
     if (!PointIsWithinContents(web_wheel.PositionInWidget())) {
@@ -84,7 +84,7 @@ void SyntheticGestureTargetBase::DispatchInputEventToPlatform(
   } else if (WebInputEvent::IsMouseEventType(event.GetType())) {
     const WebMouseEvent& web_mouse =
         static_cast<const WebMouseEvent&>(event);
-    if (event.GetType() == WebInputEvent::kMouseDown &&
+    if (event.GetType() == WebInputEvent::Type::kMouseDown &&
         !PointIsWithinContents(web_mouse.PositionInWidget())) {
       LOG(WARNING)
           << "Mouse pointer is not within content bounds on MouseDown.";
@@ -96,7 +96,7 @@ void SyntheticGestureTargetBase::DispatchInputEventToPlatform(
         static_cast<const WebGestureEvent&>(event);
     // Touchscreen pinches should be injected as touch events.
     DCHECK_EQ(blink::WebGestureDevice::kTouchpad, web_pinch.SourceDevice());
-    if (event.GetType() == WebInputEvent::kGesturePinchBegin &&
+    if (event.GetType() == WebInputEvent::Type::kGesturePinchBegin &&
         !PointIsWithinContents(web_pinch.PositionInWidget())) {
       LOG(WARNING)
           << "Pinch coordinates are not within content bounds on PinchBegin.";
@@ -108,7 +108,7 @@ void SyntheticGestureTargetBase::DispatchInputEventToPlatform(
         static_cast<const WebGestureEvent&>(event);
     // Touchscreen swipe should be injected as touch events.
     DCHECK_EQ(blink::WebGestureDevice::kTouchpad, web_fling.SourceDevice());
-    if (event.GetType() == WebInputEvent::kGestureFlingStart &&
+    if (event.GetType() == WebInputEvent::Type::kGestureFlingStart &&
         !PointIsWithinContents(web_fling.PositionInWidget())) {
       LOG(WARNING)
           << "Fling coordinates are not within content bounds on FlingStart.";
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.h b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.h
index a1f57138a24..4dd9b2645d6 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_base.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_GESTURE_TARGET_BASE_H_
 #define CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_GESTURE_TARGET_BASE_H_
 
+#include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "content/browser/renderer_host/input/synthetic_gesture_target.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
index 5344bde1875..6fd4b3bbfe9 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
@@ -96,7 +96,7 @@ void SyntheticGestureTargetMac::DispatchWebGestureEventToPlatform(
                                                     toView:nil];
 
     switch (web_gesture.GetType()) {
-      case WebInputEvent::kGesturePinchBegin: {
+      case WebInputEvent::Type::kGesturePinchBegin: {
         id cocoa_event =
             [SyntheticPinchEvent eventWithMagnification:0.0f
                                        locationInWindow:location_in_window
@@ -105,7 +105,7 @@ void SyntheticGestureTargetMac::DispatchWebGestureEventToPlatform(
                          isSyntheticallyInjected:YES];
         return;
       }
-      case WebInputEvent::kGesturePinchEnd: {
+      case WebInputEvent::Type::kGesturePinchEnd: {
         id cocoa_event =
             [SyntheticPinchEvent eventWithMagnification:0.0f
                                        locationInWindow:location_in_window
@@ -113,7 +113,7 @@ void SyntheticGestureTargetMac::DispatchWebGestureEventToPlatform(
         [cocoa_view_ handleEndGestureWithEvent:cocoa_event];
         return;
       }
-      case WebInputEvent::kGesturePinchUpdate: {
+      case WebInputEvent::Type::kGesturePinchUpdate: {
         id cocoa_event = [SyntheticPinchEvent
             eventWithMagnification:web_gesture.data.pinch_update.scale - 1.0f
                   locationInWindow:location_in_window
diff --git a/chromium/content/browser/renderer_host/input/synthetic_input_browsertest.cc b/chromium/content/browser/renderer_host/input/synthetic_input_browsertest.cc
index b10bbc4d448..39c9a8eda68 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_input_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_input_browsertest.cc
@@ -18,6 +18,7 @@
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -70,7 +71,7 @@ class SyntheticInputTest : public ContentBrowserTest {
 class GestureScrollObserver : public RenderWidgetHost::InputEventObserver {
  public:
   void OnInputEvent(const blink::WebInputEvent& event) override {
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin)
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin)
       gesture_scroll_seen_ = true;
   }
   bool HasSeenGestureScrollBegin() const { return gesture_scroll_seen_; }
diff --git a/chromium/content/browser/renderer_host/input/synthetic_mouse_driver.cc b/chromium/content/browser/renderer_host/input/synthetic_mouse_driver.cc
index e0f038e2b36..44772997cfd 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_mouse_driver.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_mouse_driver.cc
@@ -17,9 +17,9 @@ SyntheticMouseDriver::~SyntheticMouseDriver() {}
 void SyntheticMouseDriver::DispatchEvent(SyntheticGestureTarget* target,
                                          const base::TimeTicks& timestamp) {
   mouse_event_.SetTimeStamp(timestamp);
-  if (mouse_event_.GetType() != blink::WebInputEvent::kUndefined) {
+  if (mouse_event_.GetType() != blink::WebInputEvent::Type::kUndefined) {
     target->DispatchInputEventToPlatform(mouse_event_);
-    mouse_event_.SetType(blink::WebInputEvent::kUndefined);
+    mouse_event_.SetType(blink::WebInputEvent::Type::kUndefined);
   }
 }
 
@@ -37,7 +37,7 @@ void SyntheticMouseDriver::Press(float x,
   int modifiers =
       SyntheticPointerActionParams::GetWebMouseEventModifier(button);
   mouse_event_ = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseDown, x, y,
+      blink::WebInputEvent::Type::kMouseDown, x, y,
       modifiers | key_modifiers | last_modifiers_, mouse_event_.pointer_type);
   mouse_event_.button =
       SyntheticPointerActionParams::GetWebMouseEventButton(button);
@@ -60,8 +60,8 @@ void SyntheticMouseDriver::Move(float x,
                                 float force) {
   DCHECK_EQ(index, 0);
   mouse_event_ = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, x, y, key_modifiers | last_modifiers_,
-      mouse_event_.pointer_type);
+      blink::WebInputEvent::Type::kMouseMove, x, y,
+      key_modifiers | last_modifiers_, mouse_event_.pointer_type);
   mouse_event_.button =
       SyntheticPointerActionParams::GetWebMouseEventButtonFromModifier(
           last_modifiers_);
@@ -73,7 +73,7 @@ void SyntheticMouseDriver::Release(int index,
                                    int key_modifiers) {
   DCHECK_EQ(index, 0);
   mouse_event_ = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseUp, mouse_event_.PositionInWidget().x(),
+      blink::WebInputEvent::Type::kMouseUp, mouse_event_.PositionInWidget().x(),
       mouse_event_.PositionInWidget().y(), key_modifiers | last_modifiers_,
       mouse_event_.pointer_type);
   mouse_event_.button =
diff --git a/chromium/content/browser/renderer_host/input/synthetic_pen_driver.cc b/chromium/content/browser/renderer_host/input/synthetic_pen_driver.cc
index 9989a65008a..d848fe89f82 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_pen_driver.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_pen_driver.cc
@@ -15,9 +15,9 @@ SyntheticPenDriver::~SyntheticPenDriver() {}
 void SyntheticPenDriver::Leave(int index) {
   DCHECK_EQ(index, 0);
   mouse_event_ = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseLeave, mouse_event_.PositionInWidget().x(),
-      mouse_event_.PositionInWidget().y(), last_modifiers_,
-      mouse_event_.pointer_type);
+      blink::WebInputEvent::Type::kMouseLeave,
+      mouse_event_.PositionInWidget().x(), mouse_event_.PositionInWidget().y(),
+      last_modifiers_, mouse_event_.pointer_type);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/synthetic_pinch_gesture.h b/chromium/content/browser/renderer_host/input/synthetic_pinch_gesture.h
index bdc7adef31e..f68000dfbc9 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_pinch_gesture.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_pinch_gesture.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_PINCH_GESTURE_H_
 #define CONTENT_BROWSER_RENDERER_HOST_INPUT_SYNTHETIC_PINCH_GESTURE_H_
 
+#include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "content/browser/renderer_host/input/synthetic_gesture.h"
diff --git a/chromium/content/browser/renderer_host/input/synthetic_pointer_action.cc b/chromium/content/browser/renderer_host/input/synthetic_pointer_action.cc
index a412a08ce35..7a61a904ee6 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_pointer_action.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_pointer_action.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/renderer_host/input/synthetic_pointer_action.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "ui/latency/latency_info.h"
 
 namespace content {
diff --git a/chromium/content/browser/renderer_host/input/synthetic_pointer_action_unittest.cc b/chromium/content/browser/renderer_host/input/synthetic_pointer_action_unittest.cc
index 25f423d6ca4..0da2a6a4ea2 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_pointer_action_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_pointer_action_unittest.cc
@@ -25,60 +25,60 @@ WebTouchPoint::State ToWebTouchPointState(
     SyntheticPointerActionParams::PointerActionType action_type) {
   switch (action_type) {
     case SyntheticPointerActionParams::PointerActionType::PRESS:
-      return WebTouchPoint::kStatePressed;
+      return WebTouchPoint::State::kStatePressed;
     case SyntheticPointerActionParams::PointerActionType::MOVE:
-      return WebTouchPoint::kStateMoved;
+      return WebTouchPoint::State::kStateMoved;
     case SyntheticPointerActionParams::PointerActionType::RELEASE:
-      return WebTouchPoint::kStateReleased;
+      return WebTouchPoint::State::kStateReleased;
     case SyntheticPointerActionParams::PointerActionType::CANCEL:
-      return WebTouchPoint::kStateCancelled;
+      return WebTouchPoint::State::kStateCancelled;
     case SyntheticPointerActionParams::PointerActionType::IDLE:
-      return WebTouchPoint::kStateStationary;
+      return WebTouchPoint::State::kStateStationary;
     case SyntheticPointerActionParams::PointerActionType::LEAVE:
     case SyntheticPointerActionParams::PointerActionType::NOT_INITIALIZED:
       NOTREACHED()
           << "Invalid SyntheticPointerActionParams::PointerActionType.";
-      return WebTouchPoint::kStateUndefined;
+      return WebTouchPoint::State::kStateUndefined;
   }
   NOTREACHED() << "Invalid SyntheticPointerActionParams::PointerActionType.";
-  return WebTouchPoint::kStateUndefined;
+  return WebTouchPoint::State::kStateUndefined;
 }
 
 WebInputEvent::Type ToWebMouseEventType(
     SyntheticPointerActionParams::PointerActionType action_type) {
   switch (action_type) {
     case SyntheticPointerActionParams::PointerActionType::PRESS:
-      return WebInputEvent::kMouseDown;
+      return WebInputEvent::Type::kMouseDown;
     case SyntheticPointerActionParams::PointerActionType::MOVE:
-      return WebInputEvent::kMouseMove;
+      return WebInputEvent::Type::kMouseMove;
     case SyntheticPointerActionParams::PointerActionType::RELEASE:
-      return WebInputEvent::kMouseUp;
+      return WebInputEvent::Type::kMouseUp;
     case SyntheticPointerActionParams::PointerActionType::LEAVE:
-      return WebInputEvent::kMouseLeave;
+      return WebInputEvent::Type::kMouseLeave;
     case SyntheticPointerActionParams::PointerActionType::CANCEL:
     case SyntheticPointerActionParams::PointerActionType::IDLE:
     case SyntheticPointerActionParams::PointerActionType::NOT_INITIALIZED:
       NOTREACHED()
           << "Invalid SyntheticPointerActionParams::PointerActionType.";
-      return WebInputEvent::kUndefined;
+      return WebInputEvent::Type::kUndefined;
   }
   NOTREACHED() << "Invalid SyntheticPointerActionParams::PointerActionType.";
-  return WebInputEvent::kUndefined;
+  return WebInputEvent::Type::kUndefined;
 }
 
 WebInputEvent::Type WebTouchPointStateToEventType(
     blink::WebTouchPoint::State state) {
   switch (state) {
-    case blink::WebTouchPoint::kStateReleased:
-      return WebInputEvent::kTouchEnd;
-    case blink::WebTouchPoint::kStatePressed:
-      return WebInputEvent::kTouchStart;
-    case blink::WebTouchPoint::kStateMoved:
-      return WebInputEvent::kTouchMove;
-    case blink::WebTouchPoint::kStateCancelled:
-      return WebInputEvent::kTouchCancel;
+    case blink::WebTouchPoint::State::kStateReleased:
+      return WebInputEvent::Type::kTouchEnd;
+    case blink::WebTouchPoint::State::kStatePressed:
+      return WebInputEvent::Type::kTouchStart;
+    case blink::WebTouchPoint::State::kStateMoved:
+      return WebInputEvent::Type::kTouchMove;
+    case blink::WebTouchPoint::State::kStateCancelled:
+      return WebInputEvent::Type::kTouchCancel;
     default:
-      return WebInputEvent::kUndefined;
+      return WebInputEvent::Type::kUndefined;
   }
 }
 
@@ -476,7 +476,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchAction) {
   int index_array[2] = {0, 1};
   EXPECT_EQ(1, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list1, index_array));
 
@@ -484,14 +484,14 @@ TEST_F(SyntheticPointerActionTest, PointerTouchAction) {
   EXPECT_EQ(2, num_success_);
   EXPECT_EQ(0, num_failure_);
   // The type of the SyntheticWebTouchEvent is the action of the last finger.
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list2, index_array));
 
   ForwardSyntheticPointerAction();
   EXPECT_EQ(3, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchMove);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchMove);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list3, index_array));
 
@@ -499,7 +499,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchAction) {
   index_array[1] = 0;
   EXPECT_EQ(4, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchEnd);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchEnd);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list4, index_array));
 }
@@ -547,7 +547,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionsMultiPressRelease) {
   int index_array[2] = {0, 1};
   EXPECT_EQ(count_success++, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list1, index_array));
 
@@ -556,7 +556,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionsMultiPressRelease) {
     EXPECT_EQ(count_success++, num_success_);
     EXPECT_EQ(0, num_failure_);
     // The type of the SyntheticWebTouchEvent is the action of the last finger.
-    EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+    EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
     EXPECT_TRUE(
         pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
             param_list2, index_array));
@@ -565,7 +565,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionsMultiPressRelease) {
     EXPECT_EQ(count_success++, num_success_);
     EXPECT_EQ(0, num_failure_);
     // The type of the SyntheticWebTouchEvent is the action of the last finger.
-    EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchEnd);
+    EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchEnd);
     EXPECT_TRUE(
         pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
             param_list3, index_array));
@@ -615,7 +615,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionCancel) {
   int index_array[2] = {0, 1};
   EXPECT_EQ(1, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list1, index_array));
 
@@ -623,7 +623,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionCancel) {
   EXPECT_EQ(2, num_success_);
   EXPECT_EQ(0, num_failure_);
   // The type of the SyntheticWebTouchEvent is the action of the last finger.
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list2, index_array));
 
@@ -631,7 +631,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionCancel) {
   index_array[1] = 0;
   EXPECT_EQ(3, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchCancel);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchCancel);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionListDispatchedCorrectly(
       param_list3, index_array));
 }
@@ -675,7 +675,7 @@ TEST_F(SyntheticPointerActionTest, PointerTouchActionTypeInvalid) {
       static_cast<MockSyntheticPointerTouchActionTarget*>(target_.get());
   EXPECT_EQ(1, num_success_);
   EXPECT_EQ(2, num_failure_);
-  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::kTouchStart);
+  EXPECT_EQ(pointer_touch_target->type(), WebInputEvent::Type::kTouchStart);
   EXPECT_TRUE(pointer_touch_target->SyntheticTouchActionDispatchedCorrectly(
       param, 0, 0));
 
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
index 9a33584b1e7..e44ed3e504b 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
@@ -6,7 +6,8 @@
 
 #include <stdint.h>
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "ui/gfx/geometry/point_f.h"
 
 namespace content {
@@ -47,7 +48,8 @@ SyntheticSmoothMoveGestureParams::SyntheticSmoothMoveGestureParams()
       fling_velocity_y(0),
       prevent_fling(true),
       add_slop(true),
-      granularity(ui::ScrollGranularity::kScrollByPixel) {}
+      granularity(ui::ScrollGranularity::kScrollByPixel),
+      key_modifiers(0) {}
 
 SyntheticSmoothMoveGestureParams::SyntheticSmoothMoveGestureParams(
     const SyntheticSmoothMoveGestureParams& other) = default;
@@ -191,7 +193,8 @@ void SyntheticSmoothMoveGesture::ForwardMouseWheelInputEvents(
         blink::WebMouseWheelEvent::Phase phase =
             needs_scroll_begin_ ? blink::WebMouseWheelEvent::kPhaseBegan
                                 : blink::WebMouseWheelEvent::kPhaseChanged;
-        ForwardMouseWheelEvent(target, delta, phase, event_timestamp);
+        ForwardMouseWheelEvent(target, delta, phase, event_timestamp,
+                               params_.key_modifiers);
         current_move_segment_total_delta_ += delta;
         needs_scroll_begin_ = false;
       }
@@ -207,12 +210,12 @@ void SyntheticSmoothMoveGesture::ForwardMouseWheelInputEvents(
           if (!params_.prevent_fling && (params_.fling_velocity_x != 0 ||
                                          params_.fling_velocity_y != 0)) {
             ForwardFlingGestureEvent(
-                target, blink::WebGestureEvent::kGestureFlingStart);
+                target, blink::WebGestureEvent::Type::kGestureFlingStart);
           } else {
             // Forward a wheel event with phase ended and zero deltas.
             ForwardMouseWheelEvent(target, gfx::Vector2d(),
                                    blink::WebMouseWheelEvent::kPhaseEnded,
-                                   event_timestamp);
+                                   event_timestamp, params_.key_modifiers);
           }
           needs_scroll_begin_ = true;
         }
@@ -281,10 +284,11 @@ void SyntheticSmoothMoveGesture::ForwardMouseWheelEvent(
     SyntheticGestureTarget* target,
     const gfx::Vector2dF& delta,
     const blink::WebMouseWheelEvent::Phase phase,
-    const base::TimeTicks& timestamp) const {
+    const base::TimeTicks& timestamp,
+    int key_modifiers) const {
   blink::WebMouseWheelEvent mouse_wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, delta.x(), delta.y(), 0,
-                                                params_.granularity);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          0, 0, delta.x(), delta.y(), key_modifiers, params_.granularity);
 
   mouse_wheel_event.SetPositionInWidget(
       current_move_segment_start_position_.x(),
@@ -370,14 +374,20 @@ gfx::Vector2dF SyntheticSmoothMoveGesture::GetPositionDeltaAtTime(
 void SyntheticSmoothMoveGesture::ComputeNextMoveSegment() {
   current_move_segment_++;
   DCHECK_LT(current_move_segment_, static_cast<int>(params_.distances.size()));
-  int64_t total_duration_in_us = static_cast<int64_t>(
-      1e6 * (params_.distances[current_move_segment_].Length() /
-             params_.speed_in_pixels_s));
-  DCHECK_GT(total_duration_in_us, 0);
-  current_move_segment_start_time_ = current_move_segment_stop_time_;
-  current_move_segment_stop_time_ =
-      current_move_segment_start_time_ +
-      base::TimeDelta::FromMicroseconds(total_duration_in_us);
+  // Percentage based scrolls do not require velocity and are delivered in a
+  // single segment. No need to compute another segment
+  if (params_.granularity == ui::ScrollGranularity::kScrollByPercentage) {
+    current_move_segment_start_time_ = current_move_segment_stop_time_;
+  } else {
+    int64_t total_duration_in_us = static_cast<int64_t>(
+        1e6 * (params_.distances[current_move_segment_].Length() /
+               params_.speed_in_pixels_s));
+    DCHECK_GT(total_duration_in_us, 0);
+    current_move_segment_start_time_ = current_move_segment_stop_time_;
+    current_move_segment_stop_time_ =
+        current_move_segment_start_time_ +
+        base::TimeDelta::FromMicroseconds(total_duration_in_us);
+  }
 }
 
 base::TimeTicks SyntheticSmoothMoveGesture::ClampTimestamp(
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
index 4b710f3c495..3781656327b 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
@@ -40,6 +40,8 @@ class CONTENT_EXPORT SyntheticSmoothMoveGestureParams {
   bool prevent_fling;
   bool add_slop;
   ui::ScrollGranularity granularity;
+  // A bitfield of values from blink::WebInputEvent::Modifiers.
+  int key_modifiers;
 };
 
 // This class is used as helper class for simulation of scroll and drag.
@@ -79,7 +81,8 @@ class CONTENT_EXPORT SyntheticSmoothMoveGesture : public SyntheticGesture {
   void ForwardMouseWheelEvent(SyntheticGestureTarget* target,
                               const gfx::Vector2dF& delta,
                               const blink::WebMouseWheelEvent::Phase phase,
-                              const base::TimeTicks& timestamp) const;
+                              const base::TimeTicks& timestamp,
+                              int key_modifiers) const;
 
   void ForwardFlingGestureEvent(SyntheticGestureTarget* target,
                                 const blink::WebInputEvent::Type type) const;
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
index 62a532f3b9f..7b98c8ec80d 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
@@ -58,6 +58,7 @@ bool SyntheticSmoothScrollGesture::InitializeMoveGesture(
     move_params.input_type = GetInputSourceType(gesture_type);
     move_params.add_slop = true;
     move_params.granularity = params_.granularity;
+    move_params.key_modifiers = params_.key_modifiers;
     move_gesture_.reset(new SyntheticSmoothMoveGesture(move_params));
     return true;
   }
diff --git a/chromium/content/browser/renderer_host/input/synthetic_tap_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_tap_gesture.cc
index 2a317e13084..ff92b5de359 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_tap_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_tap_gesture.cc
@@ -4,7 +4,8 @@
 
 #include "content/browser/renderer_host/input/synthetic_tap_gesture.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "ui/latency/latency_info.h"
 
diff --git a/chromium/content/browser/renderer_host/input/synthetic_touch_driver.cc b/chromium/content/browser/renderer_host/input/synthetic_touch_driver.cc
index 971606adb75..d8f8becfd07 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_touch_driver.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_touch_driver.cc
@@ -18,7 +18,7 @@ SyntheticTouchDriver::~SyntheticTouchDriver() {}
 void SyntheticTouchDriver::DispatchEvent(SyntheticGestureTarget* target,
                                          const base::TimeTicks& timestamp) {
   touch_event_.SetTimeStamp(timestamp);
-  if (touch_event_.GetType() != blink::WebInputEvent::kUndefined)
+  if (touch_event_.GetType() != blink::WebInputEvent::Type::kUndefined)
     target->DispatchInputEventToPlatform(touch_event_);
   touch_event_.ResetPoints();
   ResetPointerIdIndexMap();
@@ -75,7 +75,8 @@ void SyntheticTouchDriver::Cancel(int index,
   DCHECK(pointer_id_map_.find(index) != pointer_id_map_.end());
   touch_event_.CancelPoint(pointer_id_map_[index]);
   touch_event_.SetModifiers(key_modifiers);
-  touch_event_.dispatch_type = blink::WebInputEvent::kEventNonBlocking;
+  touch_event_.dispatch_type =
+      blink::WebInputEvent::DispatchType::kEventNonBlocking;
   pointer_id_map_.erase(index);
 }
 
@@ -117,7 +118,7 @@ void SyntheticTouchDriver::ResetPointerIdIndexMap() {
     if (free_index >= touch_event_.touches_length)
       break;
     if (touch_event_.touches[i].state !=
-        blink::WebTouchPoint::kStateUndefined) {
+        blink::WebTouchPoint::State::kStateUndefined) {
       touch_event_.touches[free_index] = touch_event_.touches[i];
       if (free_index != i)
         touch_event_.touches[i] = blink::WebTouchPoint();
diff --git a/chromium/content/browser/renderer_host/input/synthetic_touchpad_pinch_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_touchpad_pinch_gesture.cc
index 272f6a4a1be..bbb71098e8b 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_touchpad_pinch_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_touchpad_pinch_gesture.cc
@@ -74,7 +74,7 @@ void SyntheticTouchpadPinchGesture::ForwardGestureEvents(
       // Send the start event.
       target->DispatchInputEventToPlatform(
           SyntheticWebGestureEventBuilder::Build(
-              blink::WebGestureEvent::kGesturePinchBegin,
+              blink::WebGestureEvent::Type::kGesturePinchBegin,
               blink::WebGestureDevice::kTouchpad));
       state_ = IN_PROGRESS;
       break;
@@ -94,7 +94,7 @@ void SyntheticTouchpadPinchGesture::ForwardGestureEvents(
       if (HasReachedTarget(event_timestamp)) {
         target->DispatchInputEventToPlatform(
             SyntheticWebGestureEventBuilder::Build(
-                blink::WebGestureEvent::kGesturePinchEnd,
+                blink::WebGestureEvent::Type::kGesturePinchEnd,
                 blink::WebGestureDevice::kTouchpad));
         state_ = DONE;
       }
diff --git a/chromium/content/browser/renderer_host/input/synthetic_touchscreen_pinch_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_touchscreen_pinch_gesture.cc
index 76effc1c346..d620a9f3a3b 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_touchscreen_pinch_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_touchscreen_pinch_gesture.cc
@@ -8,7 +8,8 @@
 
 #include <cmath>
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "ui/latency/latency_info.h"
 
 namespace content {
diff --git a/chromium/content/browser/renderer_host/input/tap_suppression_controller.cc b/chromium/content/browser/renderer_host/input/tap_suppression_controller.cc
index ff618b53157..034e7e68338 100644
--- a/chromium/content/browser/renderer_host/input/tap_suppression_controller.cc
+++ b/chromium/content/browser/renderer_host/input/tap_suppression_controller.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/renderer_host/input/tap_suppression_controller.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/trace_event/trace_event.h"
 #include "ui/events/gesture_detection/gesture_configuration.h"
 
diff --git a/chromium/content/browser/renderer_host/input/touch_action_browsertest.cc b/chromium/content/browser/renderer_host/input/touch_action_browsertest.cc
index aba71cc475f..4c0d99b042a 100644
--- a/chromium/content/browser/renderer_host/input/touch_action_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_action_browsertest.cc
@@ -29,6 +29,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -134,16 +135,10 @@ constexpr base::TimeDelta kLongJankTime =
 
 namespace content {
 
-class TouchActionBrowserTest : public ContentBrowserTest,
-                               public testing::WithParamInterface<bool> {
+class TouchActionBrowserTest : public ContentBrowserTest {
  public:
-  TouchActionBrowserTest() : compositor_touch_action_enabled_(GetParam()) {
-    if (compositor_touch_action_enabled_)
-      feature_list_.InitAndEnableFeature(features::kCompositorTouchAction);
-    else
-      feature_list_.InitAndDisableFeature(features::kCompositorTouchAction);
-  }
-  ~TouchActionBrowserTest() override {}
+  TouchActionBrowserTest() = default;
+  ~TouchActionBrowserTest() override = default;
 
   RenderWidgetHostImpl* GetWidgetHost() {
     return RenderWidgetHostImpl::From(
@@ -466,18 +461,13 @@ class TouchActionBrowserTest : public ContentBrowserTest,
       EXPECT_GT(scroll_left, 0);
   }
 
-  const bool compositor_touch_action_enabled_;
-
  private:
   std::unique_ptr<RenderFrameSubmissionObserver> frame_observer_;
   std::unique_ptr<base::RunLoop> run_loop_;
-  base::test::ScopedFeatureList feature_list_;
 
   DISALLOW_COPY_AND_ASSIGN(TouchActionBrowserTest);
 };
 
-INSTANTIATE_TEST_SUITE_P(All, TouchActionBrowserTest, testing::Bool());
-
 #if !defined(NDEBUG) || defined(ADDRESS_SANITIZER) ||       \
     defined(MEMORY_SANITIZER) || defined(LEAK_SANITIZER) || \
     defined(THREAD_SANITIZER)
@@ -488,10 +478,10 @@ INSTANTIATE_TEST_SUITE_P(All, TouchActionBrowserTest, testing::Bool());
 //
 // Verify the test infrastructure works - we can touch-scroll the page and get a
 // touchcancel as expected.
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_DefaultAuto) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_DefaultAuto) {
   LoadURL(kTouchActionDataURL);
 
-  bool wait_until_scrolled = !compositor_touch_action_enabled_;
+  bool wait_until_scrolled = false;
   DoTouchScroll(gfx::Point(50, 50), gfx::Vector2d(0, 45), wait_until_scrolled,
                 10200, gfx::Vector2d(0, 45), kNoJankTime);
 
@@ -510,10 +500,10 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_DefaultAuto) {
 #else
 #define MAYBE_TouchActionNone TouchActionNone
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_TouchActionNone) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_TouchActionNone) {
   LoadURL(kTouchActionDataURL);
 
-  bool wait_until_scrolled = !compositor_touch_action_enabled_;
+  bool wait_until_scrolled = false;
   DoTouchScroll(gfx::Point(50, 150), gfx::Vector2d(0, 45), wait_until_scrolled,
                 10200, gfx::Vector2d(0, 0), kNoJankTime);
 
@@ -530,10 +520,10 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_TouchActionNone) {
 #else
 #define MAYBE_PanYMainThreadJanky PanYMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanYMainThreadJanky) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_PanYMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
-  bool wait_until_scrolled = !compositor_touch_action_enabled_;
+  bool wait_until_scrolled = false;
   DoTouchScroll(gfx::Point(25, 125), gfx::Vector2d(0, 45), wait_until_scrolled,
                 10000, gfx::Vector2d(0, 45), kShortJankTime);
 }
@@ -545,10 +535,10 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanYMainThreadJanky) {
 #else
 #define MAYBE_PanXMainThreadJanky PanXMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXMainThreadJanky) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_PanXMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
-  bool wait_until_scrolled = !compositor_touch_action_enabled_;
+  bool wait_until_scrolled = false;
   DoTouchScroll(gfx::Point(125, 25), gfx::Vector2d(45, 0), wait_until_scrolled,
                 10000, gfx::Vector2d(45, 0), kShortJankTime);
 }
@@ -560,7 +550,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXMainThreadJanky) {
 #endif
 // When touch ack timeout is triggered, the panx gesture will be allowed even
 // though we touch the pany area.
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXAtYAreaWithTimeout) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_PanXAtYAreaWithTimeout) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
   DoTouchScroll(gfx::Point(25, 125), gfx::Vector2d(45, 0), true, 10000,
@@ -575,7 +565,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXAtYAreaWithTimeout) {
 #endif
 // When touch ack timeout is triggered, the panx gesture will be allowed even
 // though we touch the pany area.
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest,
                        MAYBE_TwoFingerPanXAtYAreaWithTimeout) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
@@ -589,10 +579,10 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
 #else
 #define MAYBE_PanXYMainThreadJanky PanXYMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXYMainThreadJanky) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_PanXYMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
-  bool wait_until_scrolled = !compositor_touch_action_enabled_;
+  bool wait_until_scrolled = false;
   DoTouchScroll(gfx::Point(75, 60), gfx::Vector2d(45, 45), wait_until_scrolled,
                 10000, gfx::Vector2d(45, 45), kShortJankTime);
 }
@@ -604,7 +594,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_PanXYMainThreadJanky) {
 #else
 #define MAYBE_PanXYAtXAreaMainThreadJanky PanXYAtXAreaMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest,
                        MAYBE_PanXYAtXAreaMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
@@ -619,7 +609,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
 #else
 #define MAYBE_PanXYAtYAreaMainThreadJanky PanXYAtYAreaMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest,
                        MAYBE_PanXYAtYAreaMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
@@ -636,7 +626,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
 #define MAYBE_PanXYAtAutoYOverlapAreaMainThreadJanky \
   PanXYAtAutoYOverlapAreaMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest,
                        MAYBE_PanXYAtAutoYOverlapAreaMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
@@ -653,7 +643,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
 #define MAYBE_PanXYAtAutoXOverlapAreaMainThreadJanky \
   PanXYAtAutoXOverlapAreaMainThreadJanky
 #endif
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest,
                        MAYBE_PanXYAtAutoXOverlapAreaMainThreadJanky) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
@@ -669,7 +659,7 @@ IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest,
 #endif
 // Test that two finger panning is treated as pinch zoom and is disallowed when
 // touching the pan-y area.
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, MAYBE_TwoFingerPanYDisallowed) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, MAYBE_TwoFingerPanYDisallowed) {
   LoadURL(kTouchActionURLWithOverlapArea);
 
   DoTwoFingerPan();
@@ -698,7 +688,7 @@ const std::string kDoubleTapZoomDataURL = R"HTML(
 
 // Test that |touch-action: none| correctly blocks a double-tap and drag zoom
 // gesture.
-IN_PROC_BROWSER_TEST_P(TouchActionBrowserTest, BlockDoubleTapDragZoom) {
+IN_PROC_BROWSER_TEST_F(TouchActionBrowserTest, BlockDoubleTapDragZoom) {
   LoadURL(kDoubleTapZoomDataURL.c_str());
 
   ASSERT_EQ(1, ExecuteScriptAndExtractDouble("window.visualViewport.scale"));
diff --git a/chromium/content/browser/renderer_host/input/touch_action_filter.cc b/chromium/content/browser/renderer_host/input/touch_action_filter.cc
index 1682434c378..1398ad469d3 100644
--- a/chromium/content/browser/renderer_host/input/touch_action_filter.cc
+++ b/chromium/content/browser/renderer_host/input/touch_action_filter.cc
@@ -6,11 +6,13 @@
 
 #include <math.h>
 
+#include "base/check_op.h"
 #include "base/debug/crash_logging.h"
 #include "base/debug/dump_without_crashing.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/trace_event/trace_event.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "ui/events/blink/blink_features.h"
 
@@ -96,9 +98,7 @@ void ReportGestureEventFilterResults(bool is_gesture_scroll_begin,
 
 }  // namespace
 
-TouchActionFilter::TouchActionFilter()
-    : compositor_touch_action_enabled_(
-          base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {
+TouchActionFilter::TouchActionFilter() {
   ResetTouchAction();
 }
 
@@ -106,20 +106,36 @@ TouchActionFilter::~TouchActionFilter() {}
 
 FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
     WebGestureEvent* gesture_event) {
+  TRACE_EVENT0("input", "TouchActionFilter::FilterGestureEvent");
   if (gesture_event->SourceDevice() != blink::WebGestureDevice::kTouchscreen)
     return FilterGestureEventResult::kFilterGestureEventAllowed;
 
-  if (compositor_touch_action_enabled_ && has_deferred_events_) {
+  if (has_deferred_events_) {
+    TRACE_EVENT_INSTANT0("input", "Has Deferred", TRACE_EVENT_SCOPE_THREAD);
     WebInputEvent::Type type = gesture_event->GetType();
-    if (type == WebInputEvent::kGestureScrollBegin ||
-        type == WebInputEvent::kGestureScrollUpdate) {
+    if (type == WebInputEvent::Type::kGestureScrollBegin ||
+        type == WebInputEvent::Type::kGestureScrollUpdate) {
       ReportGestureEventFilterResults(
-          type == WebInputEvent::kGestureScrollBegin, false,
+          type == WebInputEvent::Type::kGestureScrollBegin, false,
           FilterGestureEventResult::kFilterGestureEventDelayed);
     }
     return FilterGestureEventResult::kFilterGestureEventDelayed;
   }
 
+  TRACE_EVENT_INSTANT1(
+      "input", "active_action", TRACE_EVENT_SCOPE_THREAD, "action",
+      (active_touch_action_.has_value()
+           ? cc::TouchActionToString(active_touch_action_.value())
+           : "n/a"));
+  TRACE_EVENT_INSTANT1(
+      "input", "allowed_action", TRACE_EVENT_SCOPE_THREAD, "action",
+      (allowed_touch_action_.has_value()
+           ? cc::TouchActionToString(allowed_touch_action_.value())
+           : "n/a"));
+  TRACE_EVENT_INSTANT1("input", "whitelisted_action", TRACE_EVENT_SCOPE_THREAD,
+                       "action",
+                       cc::TouchActionToString(white_listed_touch_action_));
+
   cc::TouchAction touch_action = active_touch_action_.has_value()
                                      ? active_touch_action_.value()
                                      : white_listed_touch_action_;
@@ -127,22 +143,25 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
   // Filter for allowable touch actions first (eg. before the TouchEventQueue
   // can decide to send a touch cancel event).
   switch (gesture_event->GetType()) {
-    case WebInputEvent::kGestureScrollBegin: {
+    case WebInputEvent::Type::kGestureScrollBegin: {
       // In VR or virtual keyboard (https://crbug.com/880701),
       // GestureScrollBegin could come without GestureTapDown.
+      // TODO(bokan): This can also happen due to the fling controller
+      // filtering out the GestureTapDown due to tap suppression (i.e. tapping
+      // during a fling should stop the fling, not be sent to the page). We
+      // should not reset the touch action in this case! We currently work
+      // around this by resetting the whitelisted touch action from the
+      // compositor in this case as well but we should investigate not
+      // filtering the TapDown.
       if (!gesture_sequence_in_progress_) {
+        TRACE_EVENT_INSTANT0("input", "No Sequence at GSB!",
+                             TRACE_EVENT_SCOPE_THREAD);
         gesture_sequence_in_progress_ = true;
         if (allowed_touch_action_.has_value()) {
           active_touch_action_ = allowed_touch_action_;
           touch_action = allowed_touch_action_.value();
         } else {
-          if (compositor_touch_action_enabled_) {
-            touch_action = white_listed_touch_action_;
-          } else {
-            gesture_sequence_.append("B");
-            SetTouchAction(cc::TouchAction::kAuto);
-            touch_action = cc::TouchAction::kAuto;
-          }
+          touch_action = white_listed_touch_action_;
         }
       }
       drop_scroll_events_ =
@@ -153,6 +172,8 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       } else if (active_touch_action_.has_value()) {
         res = FilterGestureEventResult::kFilterGestureEventFiltered;
       } else {
+        TRACE_EVENT_INSTANT0("input", "Deferring Events",
+                             TRACE_EVENT_SCOPE_THREAD);
         has_deferred_events_ = true;
         res = FilterGestureEventResult::kFilterGestureEventDelayed;
       }
@@ -161,8 +182,9 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       return res;
     }
 
-    case WebInputEvent::kGestureScrollUpdate: {
+    case WebInputEvent::Type::kGestureScrollUpdate: {
       if (drop_scroll_events_) {
+        TRACE_EVENT_INSTANT0("input", "Drop Events", TRACE_EVENT_SCOPE_THREAD);
         ReportGestureEventFilterResults(
             false, active_touch_action_.has_value(),
             FilterGestureEventResult::kFilterGestureEventFiltered);
@@ -178,17 +200,11 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       // two-finger scrolling but a "touch-action: pan-x pinch-zoom" region
       // doesn't.
       // TODO(mustaq): Add it to spec?
-      if (!compositor_touch_action_enabled_ &&
-          !active_touch_action_.has_value()) {
-        static auto* crash_key = base::debug::AllocateCrashKeyString(
-            "scrollupdate-gestures", base::debug::CrashKeySize::Size256);
-        base::debug::SetCrashKeyString(crash_key, gesture_sequence_);
-        gesture_sequence_.clear();
-      }
       if (IsYAxisActionDisallowed(touch_action)) {
-        if (compositor_touch_action_enabled_ &&
-            !active_touch_action_.has_value() &&
+        if (!active_touch_action_.has_value() &&
             gesture_event->data.scroll_update.delta_y != 0) {
+          TRACE_EVENT_INSTANT0("input", "Defer Due to YAxis",
+                               TRACE_EVENT_SCOPE_THREAD);
           has_deferred_events_ = true;
           ReportGestureEventFilterResults(
               false, active_touch_action_.has_value(),
@@ -198,9 +214,10 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
         gesture_event->data.scroll_update.delta_y = 0;
         gesture_event->data.scroll_update.velocity_y = 0;
       } else if (IsXAxisActionDisallowed(touch_action)) {
-        if (compositor_touch_action_enabled_ &&
-            !active_touch_action_.has_value() &&
+        if (!active_touch_action_.has_value() &&
             gesture_event->data.scroll_update.delta_x != 0) {
+          TRACE_EVENT_INSTANT0("input", "Defer Due to XAxis",
+                               TRACE_EVENT_SCOPE_THREAD);
           has_deferred_events_ = true;
           ReportGestureEventFilterResults(
               false, active_touch_action_.has_value(),
@@ -216,13 +233,13 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       break;
     }
 
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       // Fling controller processes FlingStart event, and we should never get
       // it here.
       NOTREACHED();
       break;
 
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollEnd:
       if (gesture_sequence_.size() >= 1000)
         gesture_sequence_.erase(gesture_sequence_.begin(),
                                 gesture_sequence_.end() - 250);
@@ -236,21 +253,20 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
 
     // Evaluate the |drop_pinch_events_| here instead of GSB because pinch
     // events could arrive without GSB, e.g. double-tap-drag.
-    case WebInputEvent::kGesturePinchBegin:
+    case WebInputEvent::Type::kGesturePinchBegin:
       drop_pinch_events_ = (touch_action & cc::TouchAction::kPinchZoom) ==
                            cc::TouchAction::kNone;
       FALLTHROUGH;
-    case WebInputEvent::kGesturePinchUpdate:
+    case WebInputEvent::Type::kGesturePinchUpdate:
       gesture_sequence_.append("P");
       if (!drop_pinch_events_)
         return FilterGestureEventResult::kFilterGestureEventAllowed;
-      if (compositor_touch_action_enabled_ &&
-          !active_touch_action_.has_value()) {
+      if (!active_touch_action_.has_value()) {
         has_deferred_events_ = true;
         return FilterGestureEventResult::kFilterGestureEventDelayed;
       }
       return FilterGestureEventResult::kFilterGestureEventFiltered;
-    case WebInputEvent::kGesturePinchEnd:
+    case WebInputEvent::Type::kGesturePinchEnd:
       ReportGestureEventFiltered(drop_pinch_events_);
       return FilterPinchEventAndResetState();
 
@@ -263,39 +279,32 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
     // followed by GestureTap.  See crbug.com/874474#c47 for a repro.  We don't
     // know of any bug resulting from it, but it's better to fix the broken
     // assumption here at least to avoid introducing new bugs in future.
-    case WebInputEvent::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
       gesture_sequence_in_progress_ = false;
       gesture_sequence_.append("D");
       DCHECK_EQ(1, gesture_event->data.tap.tap_count);
       if (!allow_current_double_tap_event_) {
-        gesture_event->SetType(WebInputEvent::kGestureTap);
+        gesture_event->SetType(WebInputEvent::Type::kGestureTap);
         gesture_event->data.tap.tap_count = 2;
       }
       allow_current_double_tap_event_ = true;
       break;
 
     // If double tap is disabled, there's no reason for the tap delay.
-    case WebInputEvent::kGestureTapUnconfirmed: {
+    case WebInputEvent::Type::kGestureTapUnconfirmed: {
       DCHECK_EQ(1, gesture_event->data.tap.tap_count);
       gesture_sequence_.append("C");
-      if (!compositor_touch_action_enabled_ &&
-          !active_touch_action_.has_value()) {
-        static auto* crash_key = base::debug::AllocateCrashKeyString(
-            "tapunconfirmed-gestures", base::debug::CrashKeySize::Size256);
-        base::debug::SetCrashKeyString(crash_key, gesture_sequence_);
-        gesture_sequence_.clear();
-      }
       allow_current_double_tap_event_ =
           (touch_action & cc::TouchAction::kDoubleTapZoom) !=
           cc::TouchAction::kNone;
       if (!allow_current_double_tap_event_) {
-        gesture_event->SetType(WebInputEvent::kGestureTap);
+        gesture_event->SetType(WebInputEvent::Type::kGestureTap);
         drop_current_tap_ending_event_ = true;
       }
       break;
     }
 
-    case WebInputEvent::kGestureTap:
+    case WebInputEvent::Type::kGestureTap:
       gesture_sequence_in_progress_ = false;
       gesture_sequence_.append("A");
       if (drop_current_tap_ending_event_) {
@@ -304,7 +313,7 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       }
       break;
 
-    case WebInputEvent::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureTapCancel:
       gesture_sequence_.append("K");
       if (drop_current_tap_ending_event_) {
         drop_current_tap_ending_event_ = false;
@@ -312,7 +321,7 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       }
       break;
 
-    case WebInputEvent::kGestureTapDown:
+    case WebInputEvent::Type::kGestureTapDown:
       gesture_sequence_in_progress_ = true;
       if (allowed_touch_action_.has_value())
         gesture_sequence_.append("AY");
@@ -332,8 +341,8 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
       DCHECK(!drop_current_tap_ending_event_);
       break;
 
-    case WebInputEvent::kGestureLongTap:
-    case WebInputEvent::kGestureTwoFingerTap:
+    case WebInputEvent::Type::kGestureLongTap:
+    case WebInputEvent::Type::kGestureTwoFingerTap:
       gesture_sequence_.append("G");
       gesture_sequence_in_progress_ = false;
       break;
@@ -348,6 +357,8 @@ FilterGestureEventResult TouchActionFilter::FilterGestureEvent(
 }
 
 void TouchActionFilter::SetTouchAction(cc::TouchAction touch_action) {
+  TRACE_EVENT1("input", "TouchActionFilter::SetTouchAction", "action",
+               cc::TouchActionToString(touch_action));
   allowed_touch_action_ = touch_action;
   active_touch_action_ = allowed_touch_action_;
   white_listed_touch_action_ = touch_action;
@@ -375,6 +386,11 @@ void TouchActionFilter::ForceResetTouchActionForTest() {
 }
 
 void TouchActionFilter::OnSetTouchAction(cc::TouchAction touch_action) {
+  TRACE_EVENT2("input", "TouchActionFilter::OnSetTouchAction", "action",
+               cc::TouchActionToString(touch_action), "allowed",
+               (allowed_touch_action_.has_value()
+                    ? cc::TouchActionToString(allowed_touch_action_.value())
+                    : "n/a"));
   // TODO(https://crbug.com/849819): add a DCHECK for
   // |has_touch_event_handler_|.
   // For multiple fingers, we take the intersection of the touch actions for
@@ -402,10 +418,14 @@ void TouchActionFilter::OnSetTouchAction(cc::TouchAction touch_action) {
 }
 
 void TouchActionFilter::IncreaseActiveTouches() {
+  TRACE_EVENT1("input", "TouchActionFilter::IncreaseActiveTouches", "num",
+               num_of_active_touches_);
   num_of_active_touches_++;
 }
 
 void TouchActionFilter::DecreaseActiveTouches() {
+  TRACE_EVENT1("input", "TouchActionFilter::DecreaseActiveTouches", "num",
+               num_of_active_touches_);
   num_of_active_touches_--;
 }
 
@@ -446,6 +466,7 @@ void TouchActionFilter::AppendToGestureSequenceForDebugging(const char* str) {
 }
 
 void TouchActionFilter::ResetTouchAction() {
+  TRACE_EVENT0("input", "TouchActionFilter::ResetTouchAction");
   // Note that resetting the action mid-sequence is tolerated. Gestures that had
   // their begin event(s) suppressed will be suppressed until the next
   // sequenceo.
@@ -463,6 +484,9 @@ void TouchActionFilter::ResetTouchAction() {
 
 void TouchActionFilter::OnSetWhiteListedTouchAction(
     cc::TouchAction white_listed_touch_action) {
+  TRACE_EVENT2("input", "TouchActionFilter::OnSetWhiteListedTouchAction",
+               "action", cc::TouchActionToString(white_listed_touch_action),
+               "current", cc::TouchActionToString(white_listed_touch_action_));
   // We use '&' here to account for the multiple-finger case, which is the same
   // as OnSetTouchAction.
   white_listed_touch_action_ =
@@ -472,7 +496,7 @@ void TouchActionFilter::OnSetWhiteListedTouchAction(
 bool TouchActionFilter::ShouldSuppressScrolling(
     const blink::WebGestureEvent& gesture_event,
     cc::TouchAction touch_action) {
-  DCHECK(gesture_event.GetType() == WebInputEvent::kGestureScrollBegin);
+  DCHECK(gesture_event.GetType() == WebInputEvent::Type::kGestureScrollBegin);
 
   if (gesture_event.data.scroll_begin.pointer_count >= 2) {
     // Any GestureScrollBegin with more than one fingers is like a pinch-zoom
@@ -511,6 +535,8 @@ bool TouchActionFilter::ShouldSuppressScrolling(
 }
 
 void TouchActionFilter::OnHasTouchEventHandlers(bool has_handlers) {
+  TRACE_EVENT1("input", "TouchActionFilter::OnHasTouchEventHandlers",
+               "has handlers", has_handlers);
   // The has_touch_event_handler_ is default to false which is why we have the
   // "&&" condition here, to ensure that touch actions will be set if there is
   // no touch event handler on a page.
diff --git a/chromium/content/browser/renderer_host/input/touch_action_filter.h b/chromium/content/browser/renderer_host/input/touch_action_filter.h
index 7ebef227c2b..4d2ff433c67 100644
--- a/chromium/content/browser/renderer_host/input/touch_action_filter.h
+++ b/chromium/content/browser/renderer_host/input/touch_action_filter.h
@@ -124,8 +124,6 @@ class CONTENT_EXPORT TouchActionFilter {
   // before GSE.
   bool gesture_sequence_in_progress_ = false;
 
-  bool compositor_touch_action_enabled_ = false;
-
   bool has_deferred_events_ = false;
 
   // Increment at receiving ACK for touch start and decrement at touch end.
diff --git a/chromium/content/browser/renderer_host/input/touch_action_filter_unittest.cc b/chromium/content/browser/renderer_host/input/touch_action_filter_unittest.cc
index b4ecee452da..e0903a59d2e 100644
--- a/chromium/content/browser/renderer_host/input/touch_action_filter_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_action_filter_unittest.cc
@@ -6,9 +6,9 @@
 #include "base/test/scoped_feature_list.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/blink_features.h"
 
 using blink::WebGestureEvent;
@@ -22,20 +22,10 @@ const blink::WebGestureDevice kSourceDevice =
 
 }  // namespace
 
-class TouchActionFilterTest : public testing::Test,
-                              public testing::WithParamInterface<bool> {
+class TouchActionFilterTest : public testing::Test {
  public:
-  TouchActionFilterTest() : compositor_touch_action_enabled_(GetParam()) {
-    filter_.OnHasTouchEventHandlers(true);
-    if (compositor_touch_action_enabled_) {
-      feature_list_.InitAndEnableFeature(features::kCompositorTouchAction);
-      filter_.compositor_touch_action_enabled_ = true;
-    } else {
-      feature_list_.InitAndDisableFeature(features::kCompositorTouchAction);
-      filter_.compositor_touch_action_enabled_ = false;
-    }
-  }
-  ~TouchActionFilterTest() override {}
+  TouchActionFilterTest() { filter_.OnHasTouchEventHandlers(true); }
+  ~TouchActionFilterTest() override = default;
 
  protected:
   base::Optional<cc::TouchAction> ActiveTouchAction() const {
@@ -61,9 +51,9 @@ class TouchActionFilterTest : public testing::Test,
                float expected_dx,
                float expected_dy) {
     WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureTapDown, kSourceDevice);
+        WebInputEvent::Type::kGestureTapDown, kSourceDevice);
     WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureScrollEnd, kSourceDevice);
+        WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
     {
       // Scrolls with no direction hint are permitted in the |action| direction.
@@ -162,9 +152,9 @@ class TouchActionFilterTest : public testing::Test,
                                            float scroll_x,
                                            float scroll_y) {
     WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureTapDown, kSourceDevice);
+        WebInputEvent::Type::kGestureTapDown, kSourceDevice);
     WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureScrollEnd, kSourceDevice);
+        WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
     {
       // Scrolls towards the touch-action direction are permitted.
@@ -238,17 +228,11 @@ class TouchActionFilterTest : public testing::Test,
     }
   }
   TouchActionFilter filter_;
-  const bool compositor_touch_action_enabled_;
-
- private:
-  base::test::ScopedFeatureList feature_list_;
 };
 
-INSTANTIATE_TEST_SUITE_P(All, TouchActionFilterTest, ::testing::Bool());
-
-TEST_P(TouchActionFilterTest, SimpleFilter) {
+TEST_F(TouchActionFilterTest, SimpleFilter) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(2, 3, kSourceDevice);
   const float kDeltaX = 5;
@@ -257,7 +241,7 @@ TEST_P(TouchActionFilterTest, SimpleFilter) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(kDeltaX, kDeltaY, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   // cc::TouchAction::kAuto doesn't cause any filtering.
   ResetTouchAction();
@@ -354,7 +338,7 @@ TEST_P(TouchActionFilterTest, SimpleFilter) {
   filter_.DecreaseActiveTouches();
 }
 
-TEST_P(TouchActionFilterTest, PanLeft) {
+TEST_F(TouchActionFilterTest, PanLeft) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = 7;
@@ -364,7 +348,7 @@ TEST_P(TouchActionFilterTest, PanLeft) {
   PanTestForUnidirectionalTouchAction(cc::TouchAction::kPanLeft, kScrollX, 0);
 }
 
-TEST_P(TouchActionFilterTest, PanRight) {
+TEST_F(TouchActionFilterTest, PanRight) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = -7;
@@ -374,7 +358,7 @@ TEST_P(TouchActionFilterTest, PanRight) {
   PanTestForUnidirectionalTouchAction(cc::TouchAction::kPanRight, kScrollX, 0);
 }
 
-TEST_P(TouchActionFilterTest, PanX) {
+TEST_F(TouchActionFilterTest, PanX) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = 7;
@@ -383,7 +367,7 @@ TEST_P(TouchActionFilterTest, PanX) {
   PanTest(cc::TouchAction::kPanX, kScrollX, kScrollY, kDX, kDY, kDX, 0);
 }
 
-TEST_P(TouchActionFilterTest, PanUp) {
+TEST_F(TouchActionFilterTest, PanUp) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = 6;
@@ -393,7 +377,7 @@ TEST_P(TouchActionFilterTest, PanUp) {
   PanTestForUnidirectionalTouchAction(cc::TouchAction::kPanUp, 0, kScrollY);
 }
 
-TEST_P(TouchActionFilterTest, PanDown) {
+TEST_F(TouchActionFilterTest, PanDown) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = 6;
@@ -403,7 +387,7 @@ TEST_P(TouchActionFilterTest, PanDown) {
   PanTestForUnidirectionalTouchAction(cc::TouchAction::kPanDown, 0, kScrollY);
 }
 
-TEST_P(TouchActionFilterTest, PanY) {
+TEST_F(TouchActionFilterTest, PanY) {
   const float kDX = 5;
   const float kDY = 10;
   const float kScrollX = 6;
@@ -412,13 +396,13 @@ TEST_P(TouchActionFilterTest, PanY) {
   PanTest(cc::TouchAction::kPanY, kScrollX, kScrollY, kDX, kDY, 0, kDY);
 }
 
-TEST_P(TouchActionFilterTest, PanXY) {
+TEST_F(TouchActionFilterTest, PanXY) {
   const float kDX = 5;
   const float kDY = 10;
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   {
     // Scrolls hinted in the X axis are permitted and unmodified.
@@ -495,7 +479,7 @@ TEST_P(TouchActionFilterTest, PanXY) {
   }
 }
 
-TEST_P(TouchActionFilterTest, BitMath) {
+TEST_F(TouchActionFilterTest, BitMath) {
   // Verify that the simple flag mixing properties we depend on are now
   // trivially true.
   EXPECT_EQ(cc::TouchAction::kNone,
@@ -512,9 +496,9 @@ TEST_P(TouchActionFilterTest, BitMath) {
             cc::TouchAction::kManipulation | cc::TouchAction::kDoubleTapZoom);
 }
 
-TEST_P(TouchActionFilterTest, MultiTouch) {
+TEST_F(TouchActionFilterTest, MultiTouch) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(2, 3, kSourceDevice);
   const float kDeltaX = 5;
@@ -523,7 +507,7 @@ TEST_P(TouchActionFilterTest, MultiTouch) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(kDeltaX, kDeltaY, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   // For multiple points, the intersection is what matters.
   ResetTouchAction();
@@ -561,34 +545,28 @@ TEST_P(TouchActionFilterTest, MultiTouch) {
   filter_.DecreaseActiveTouches();
 }
 
-class TouchActionFilterPinchTest : public testing::Test,
-                                   public testing::WithParamInterface<bool> {
+class TouchActionFilterPinchTest : public testing::Test {
  public:
-  TouchActionFilterPinchTest() {
-    if (GetParam())
-      feature_list_.InitAndEnableFeature(features::kCompositorTouchAction);
-    else
-      feature_list_.InitAndDisableFeature(features::kCompositorTouchAction);
-  }
+  TouchActionFilterPinchTest() = default;
 
   void RunTest(bool force_enable_zoom) {
     filter_.OnHasTouchEventHandlers(true);
     filter_.SetForceEnableZoom(force_enable_zoom);
 
     WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureTapDown, kSourceDevice);
+        WebInputEvent::Type::kGestureTapDown, kSourceDevice);
     WebGestureEvent scroll_begin =
         SyntheticWebGestureEventBuilder::BuildScrollBegin(2, 3, kSourceDevice,
                                                           2);
     WebGestureEvent pinch_begin = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGesturePinchBegin, kSourceDevice);
+        WebInputEvent::Type::kGesturePinchBegin, kSourceDevice);
     WebGestureEvent pinch_update =
         SyntheticWebGestureEventBuilder::BuildPinchUpdate(1.2f, 5, 5, 0,
                                                           kSourceDevice);
     WebGestureEvent pinch_end = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGesturePinchEnd, kSourceDevice);
+        WebInputEvent::Type::kGesturePinchEnd, kSourceDevice);
     WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureScrollEnd, kSourceDevice);
+        WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
     // Pinch is allowed with touch-action: auto.
     filter_.ResetTouchAction();
@@ -758,30 +736,27 @@ class TouchActionFilterPinchTest : public testing::Test,
 
  private:
   TouchActionFilter filter_;
-  base::test::ScopedFeatureList feature_list_;
 };
 
-INSTANTIATE_TEST_SUITE_P(All, TouchActionFilterPinchTest, ::testing::Bool());
-
-TEST_P(TouchActionFilterPinchTest, Pinch) {
+TEST_F(TouchActionFilterPinchTest, Pinch) {
   RunTest(false);
 }
 
 // Enables force enable zoom will override touch-action except for
 // touch-action: none.
-TEST_P(TouchActionFilterPinchTest, ForceEnableZoom) {
+TEST_F(TouchActionFilterPinchTest, ForceEnableZoom) {
   RunTest(true);
 }
 
-TEST_P(TouchActionFilterTest, DoubleTapWithTouchActionAuto) {
+TEST_F(TouchActionFilterTest, DoubleTapWithTouchActionAuto) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent unconfirmed_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapUnconfirmed, kSourceDevice);
+      WebInputEvent::Type::kGestureTapUnconfirmed, kSourceDevice);
   WebGestureEvent tap_cancel = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapCancel, kSourceDevice);
+      WebInputEvent::Type::kGestureTapCancel, kSourceDevice);
   WebGestureEvent double_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureDoubleTap, kSourceDevice);
+      WebInputEvent::Type::kGestureDoubleTap, kSourceDevice);
 
   // Double tap is allowed with touch action auto.
   ResetTouchAction();
@@ -790,7 +765,8 @@ TEST_P(TouchActionFilterTest, DoubleTapWithTouchActionAuto) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&unconfirmed_tap),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  EXPECT_EQ(unconfirmed_tap.GetType(), WebInputEvent::kGestureTapUnconfirmed);
+  EXPECT_EQ(unconfirmed_tap.GetType(),
+            WebInputEvent::Type::kGestureTapUnconfirmed);
   // The tap cancel will come as part of the next touch sequence.
   ResetTouchAction();
   // Changing the touch action for the second tap doesn't effect the behaviour
@@ -804,15 +780,15 @@ TEST_P(TouchActionFilterTest, DoubleTapWithTouchActionAuto) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
 }
 
-TEST_P(TouchActionFilterTest, DoubleTap) {
+TEST_F(TouchActionFilterTest, DoubleTap) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent unconfirmed_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapUnconfirmed, kSourceDevice);
+      WebInputEvent::Type::kGestureTapUnconfirmed, kSourceDevice);
   WebGestureEvent tap_cancel = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapCancel, kSourceDevice);
+      WebInputEvent::Type::kGestureTapCancel, kSourceDevice);
   WebGestureEvent double_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureDoubleTap, kSourceDevice);
+      WebInputEvent::Type::kGestureDoubleTap, kSourceDevice);
 
   // Double tap is disabled with any touch action other than auto.
   ResetTouchAction();
@@ -822,7 +798,7 @@ TEST_P(TouchActionFilterTest, DoubleTap) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&unconfirmed_tap),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  EXPECT_EQ(WebInputEvent::kGestureTap, unconfirmed_tap.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTap, unconfirmed_tap.GetType());
   // Changing the touch action for the second tap doesn't effect the behaviour
   // of the event. The tap cancel will come as part of the next touch sequence.
   ResetTouchAction();
@@ -833,18 +809,18 @@ TEST_P(TouchActionFilterTest, DoubleTap) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&double_tap),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  EXPECT_EQ(WebInputEvent::kGestureTap, double_tap.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTap, double_tap.GetType());
   EXPECT_EQ(2, double_tap.data.tap.tap_count);
   filter_.DecreaseActiveTouches();
 }
 
-TEST_P(TouchActionFilterTest, SingleTapWithTouchActionAuto) {
+TEST_F(TouchActionFilterTest, SingleTapWithTouchActionAuto) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent unconfirmed_tap1 = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapUnconfirmed, kSourceDevice);
+      WebInputEvent::Type::kGestureTapUnconfirmed, kSourceDevice);
   WebGestureEvent tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTap, kSourceDevice);
+      WebInputEvent::Type::kGestureTap, kSourceDevice);
 
   // Single tap is allowed with touch action auto.
   ResetTouchAction();
@@ -853,18 +829,19 @@ TEST_P(TouchActionFilterTest, SingleTapWithTouchActionAuto) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&unconfirmed_tap1),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  EXPECT_EQ(WebInputEvent::kGestureTapUnconfirmed, unconfirmed_tap1.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTapUnconfirmed,
+            unconfirmed_tap1.GetType());
   EXPECT_EQ(filter_.FilterGestureEvent(&tap),
             FilterGestureEventResult::kFilterGestureEventAllowed);
 }
 
-TEST_P(TouchActionFilterTest, SingleTap) {
+TEST_F(TouchActionFilterTest, SingleTap) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent unconfirmed_tap1 = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapUnconfirmed, kSourceDevice);
+      WebInputEvent::Type::kGestureTapUnconfirmed, kSourceDevice);
   WebGestureEvent tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTap, kSourceDevice);
+      WebInputEvent::Type::kGestureTap, kSourceDevice);
 
   // With touch action other than auto, tap unconfirmed is turned into tap.
   ResetTouchAction();
@@ -874,21 +851,21 @@ TEST_P(TouchActionFilterTest, SingleTap) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&unconfirmed_tap1),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  EXPECT_EQ(WebInputEvent::kGestureTap, unconfirmed_tap1.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTap, unconfirmed_tap1.GetType());
   EXPECT_EQ(filter_.FilterGestureEvent(&tap),
             FilterGestureEventResult::kFilterGestureEventFiltered);
   filter_.DecreaseActiveTouches();
 }
 
-TEST_P(TouchActionFilterTest, TouchActionResetsOnResetTouchAction) {
+TEST_F(TouchActionFilterTest, TouchActionResetsOnResetTouchAction) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTap, kSourceDevice);
+      WebInputEvent::Type::kGestureTap, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(2, 3, kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   ResetTouchAction();
   filter_.OnSetTouchAction(cc::TouchAction::kNone);
@@ -920,21 +897,21 @@ TEST_P(TouchActionFilterTest, TouchActionResetsOnResetTouchAction) {
   filter_.DecreaseActiveTouches();
 }
 
-TEST_P(TouchActionFilterTest, TouchActionResetMidSequence) {
+TEST_F(TouchActionFilterTest, TouchActionResetMidSequence) {
   filter_.OnHasTouchEventHandlers(true);
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(2, 3, kSourceDevice);
   WebGestureEvent pinch_begin = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchBegin, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchBegin, kSourceDevice);
   WebGestureEvent pinch_update =
       SyntheticWebGestureEventBuilder::BuildPinchUpdate(1.2f, 5, 5, 0,
                                                         kSourceDevice);
   WebGestureEvent pinch_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchEnd, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchEnd, kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   filter_.OnSetTouchAction(cc::TouchAction::kNone);
   filter_.IncreaseActiveTouches();
@@ -983,20 +960,20 @@ TEST_P(TouchActionFilterTest, TouchActionResetMidSequence) {
 
 // This test makes sure that we do not reset scrolling touch action in the
 // middle of a gesture sequence.
-TEST_P(TouchActionFilterTest, TouchActionNotResetWithinGestureSequence) {
+TEST_F(TouchActionFilterTest, TouchActionNotResetWithinGestureSequence) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
   filter_.OnSetTouchAction(cc::TouchAction::kPanY);
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(1, 3, kSourceDevice);
   WebGestureEvent scroll_update =
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(1, 5, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   filter_.IncreaseActiveTouches();
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
@@ -1027,11 +1004,11 @@ TEST_P(TouchActionFilterTest, TouchActionNotResetWithinGestureSequence) {
 // The following 3 tests ensures that when the IPC message
 // OnHasTouchEventHandlers is received in the middle of a gesture sequence, the
 // touch action is not reset.
-TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringTap) {
+TEST_F(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringTap) {
   filter_.OnHasTouchEventHandlers(false);
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   filter_.OnHasTouchEventHandlers(true);
@@ -1040,7 +1017,7 @@ TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringTap) {
   filter_.OnSetTouchAction(cc::TouchAction::kPan);
   // Simulate a simple tap gesture.
   WebGestureEvent tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTap, kSourceDevice);
+      WebInputEvent::Type::kGestureTap, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   // Gesture tap indicates that there is no scroll in progress, so this should
@@ -1049,15 +1026,15 @@ TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringTap) {
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
 }
 
-TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringDoubleTap) {
+TEST_F(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringDoubleTap) {
   filter_.OnHasTouchEventHandlers(false);
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent tap_cancel = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapCancel, kSourceDevice);
+      WebInputEvent::Type::kGestureTapCancel, kSourceDevice);
   WebGestureEvent double_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureDoubleTap, kSourceDevice);
+      WebInputEvent::Type::kGestureDoubleTap, kSourceDevice);
 
   // Simulate a double tap gesture: GTD-->GTC-->GTD-->GTC-->GDT.
   filter_.IncreaseActiveTouches();
@@ -1079,20 +1056,20 @@ TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringDoubleTap) {
   filter_.DecreaseActiveTouches();
 }
 
-TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringScroll) {
+TEST_F(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringScroll) {
   filter_.OnHasTouchEventHandlers(false);
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent tap_cancel = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapCancel, kSourceDevice);
+      WebInputEvent::Type::kGestureTapCancel, kSourceDevice);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(5, 0, kSourceDevice);
   WebGestureEvent scroll_update =
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(5, 0, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   // Simulate a gesture scroll: GTD-->GTC-->GSB-->GSU-->GSE.
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
@@ -1112,16 +1089,16 @@ TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedDuringScroll) {
 
 // If OnHasTouchEventHandlers IPC is received after LongTap or TwoFingerTap,
 // the touch action should be reset.
-TEST_P(TouchActionFilterTest,
+TEST_F(TouchActionFilterTest,
        OnHasTouchEventHandlersReceivedAfterLongTapOrTwoFingerTap) {
   filter_.OnHasTouchEventHandlers(false);
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   WebGestureEvent tap_cancel = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapCancel, kSourceDevice);
+      WebInputEvent::Type::kGestureTapCancel, kSourceDevice);
   WebGestureEvent long_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureLongTap, kSourceDevice);
+      WebInputEvent::Type::kGestureLongTap, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_cancel),
@@ -1135,7 +1112,7 @@ TEST_P(TouchActionFilterTest,
 
   filter_.OnHasTouchEventHandlers(false);
   WebGestureEvent two_finger_tap = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTwoFingerTap, kSourceDevice);
+      WebInputEvent::Type::kGestureTwoFingerTap, kSourceDevice);
 
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
@@ -1149,7 +1126,7 @@ TEST_P(TouchActionFilterTest,
   EXPECT_FALSE(ActiveTouchAction().has_value());
 }
 
-TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedAfterTouchStart) {
+TEST_F(TouchActionFilterTest, OnHasTouchEventHandlersReceivedAfterTouchStart) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
@@ -1165,7 +1142,7 @@ TEST_P(TouchActionFilterTest, OnHasTouchEventHandlersReceivedAfterTouchStart) {
   EXPECT_EQ(filter_.allowed_touch_action().value(), cc::TouchAction::kPanY);
 }
 
-TEST_P(TouchActionFilterTest, ResetTouchActionWithActiveTouch) {
+TEST_F(TouchActionFilterTest, ResetTouchActionWithActiveTouch) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
@@ -1195,14 +1172,14 @@ TEST_P(TouchActionFilterTest, ResetTouchActionWithActiveTouch) {
 // If the renderer is busy, the gesture event might have come before the
 // OnHasTouchEventHanlders IPC is received. In this case, we should allow all
 // the gestures.
-TEST_P(TouchActionFilterTest, GestureArrivesBeforeHasHandlerSet) {
+TEST_F(TouchActionFilterTest, GestureArrivesBeforeHasHandlerSet) {
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
 }
 
-TEST_P(TouchActionFilterTest, PinchGesturesAllowedByWhiteListedTouchAction) {
+TEST_F(TouchActionFilterTest, PinchGesturesAllowedByWhiteListedTouchAction) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
@@ -1210,12 +1187,12 @@ TEST_P(TouchActionFilterTest, PinchGesturesAllowedByWhiteListedTouchAction) {
   // white listed touch action has a default value of Auto, and pinch related
   // gestures should be allowed.
   WebGestureEvent pinch_begin = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchBegin, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchBegin, kSourceDevice);
   WebGestureEvent pinch_update =
       SyntheticWebGestureEventBuilder::BuildPinchUpdate(1.2f, 5, 5, 0,
                                                         kSourceDevice);
   WebGestureEvent pinch_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchEnd, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchEnd, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&pinch_begin),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&pinch_update),
@@ -1226,7 +1203,7 @@ TEST_P(TouchActionFilterTest, PinchGesturesAllowedByWhiteListedTouchAction) {
 
 // Test gesture event filtering with white listed touch action. It should test
 // all 3 kinds of results: Allowed / Dropped / Delayed.
-TEST_P(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
+TEST_F(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
@@ -1239,11 +1216,9 @@ TEST_P(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(dx, dy, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
-  if (!compositor_touch_action_enabled_)
-    filter_.OnSetTouchAction(cc::TouchAction::kPan);
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPan);
   SetGestureSequenceInProgress();
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
@@ -1258,31 +1233,20 @@ TEST_P(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
   ResetActiveTouchAction();
   ResetWhiteListedTouchAction();
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
-  if (!compositor_touch_action_enabled_)
-    filter_.OnSetTouchAction(cc::TouchAction::kPan);
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPan);
   WebGestureEvent pinch_begin = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchBegin, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchBegin, kSourceDevice);
   WebGestureEvent pinch_update =
       SyntheticWebGestureEventBuilder::BuildPinchUpdate(1.2f, 5, 5, 0,
                                                         kSourceDevice);
   WebGestureEvent pinch_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchEnd, kSourceDevice);
-  if (compositor_touch_action_enabled_) {
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_begin),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_update),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_end),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-  } else {
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_begin),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_update),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-    EXPECT_EQ(filter_.FilterGestureEvent(&pinch_end),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-  }
+      WebInputEvent::Type::kGesturePinchEnd, kSourceDevice);
+  EXPECT_EQ(filter_.FilterGestureEvent(&pinch_begin),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
+  EXPECT_EQ(filter_.FilterGestureEvent(&pinch_update),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
+  EXPECT_EQ(filter_.FilterGestureEvent(&pinch_end),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
 
   // Scroll updates should be delayed if white listed touch action is PanY,
   // because there are delta along the direction that is not allowed.
@@ -1290,31 +1254,20 @@ TEST_P(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
   ResetActiveTouchAction();
   ResetWhiteListedTouchAction();
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPanY);
-  if (!compositor_touch_action_enabled_)
-    filter_.OnSetTouchAction(cc::TouchAction::kPanY);
   SetNoDeferredEvents();
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPanY);
   SetGestureSequenceInProgress();
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  if (compositor_touch_action_enabled_) {
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-  } else {
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
-              FilterGestureEventResult::kFilterGestureEventAllowed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
-              FilterGestureEventResult::kFilterGestureEventAllowed);
-  }
+  EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
+  EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
 
   ResetTouchAction();
   ResetActiveTouchAction();
   ResetWhiteListedTouchAction();
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPanX);
-  if (!compositor_touch_action_enabled_)
-    filter_.OnSetTouchAction(cc::TouchAction::kPanX);
   SetNoDeferredEvents();
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPanX);
 
@@ -1340,24 +1293,15 @@ TEST_P(TouchActionFilterTest, FilterWithWhiteListedTouchAction) {
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPanX);
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPanX);
   SetGestureSequenceInProgress();
-  if (compositor_touch_action_enabled_) {
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
-              FilterGestureEventResult::kFilterGestureEventDelayed);
-  } else {
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-    EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
-              FilterGestureEventResult::kFilterGestureEventFiltered);
-  }
+  EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
+  EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
+  EXPECT_EQ(filter_.FilterGestureEvent(&scroll_end),
+            FilterGestureEventResult::kFilterGestureEventDelayed);
 }
 
-TEST_P(TouchActionFilterTest, WhiteListedTouchActionResetToAuto) {
+TEST_F(TouchActionFilterTest, WhiteListedTouchActionResetToAuto) {
   filter_.OnHasTouchEventHandlers(true);
 
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
@@ -1366,7 +1310,7 @@ TEST_P(TouchActionFilterTest, WhiteListedTouchActionResetToAuto) {
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kAuto);
 }
 
-TEST_P(TouchActionFilterTest, WhiteListedTouchActionAutoNoHasHandlers) {
+TEST_F(TouchActionFilterTest, WhiteListedTouchActionAutoNoHasHandlers) {
   filter_.OnHasTouchEventHandlers(false);
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kAuto);
 
@@ -1374,19 +1318,17 @@ TEST_P(TouchActionFilterTest, WhiteListedTouchActionAutoNoHasHandlers) {
   EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kAuto);
 }
 
-TEST_P(TouchActionFilterTest, ResetBeforeHasHandlerSet) {
+TEST_F(TouchActionFilterTest, ResetBeforeHasHandlerSet) {
   // This should not crash, and should set touch action to auto.
   ResetTouchAction();
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
 }
 
-TEST_P(TouchActionFilterTest,
+TEST_F(TouchActionFilterTest,
        WhiteListedTouchActionNotResetAtGestureScrollEnd) {
-  if (!compositor_touch_action_enabled_)
-    return;
   filter_.OnHasTouchEventHandlers(true);
 
   filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
@@ -1399,7 +1341,7 @@ TEST_P(TouchActionFilterTest,
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(dx, dy, 0,
                                                          kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
 
   SetGestureSequenceInProgress();
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
@@ -1414,25 +1356,17 @@ TEST_P(TouchActionFilterTest,
 
 // Having a gesture scroll begin without tap down should set touch action to
 // Auto.
-TEST_P(TouchActionFilterTest, ScrollBeginWithoutTapDown) {
+TEST_F(TouchActionFilterTest, ScrollBeginWithoutTapDown) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
 
-  if (compositor_touch_action_enabled_)
-    filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
-  else
-    filter_.OnSetTouchAction(cc::TouchAction::kPan);
+  filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(5, 0, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  if (compositor_touch_action_enabled_) {
-    EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPan);
-  } else {
-    EXPECT_EQ(ActiveTouchAction().value(), cc::TouchAction::kPan);
-    EXPECT_EQ(filter_.allowed_touch_action().value(), cc::TouchAction::kPan);
-  }
+  EXPECT_EQ(filter_.white_listed_touch_action(), cc::TouchAction::kPan);
 
   ResetTouchAction();
   ResetActiveTouchAction();
@@ -1442,24 +1376,19 @@ TEST_P(TouchActionFilterTest, ScrollBeginWithoutTapDown) {
 
   // Ensure that there is no crash at GSB if both |allowed_| and |active_|
   // touch action have no value.
-  if (compositor_touch_action_enabled_)
-    filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
+  filter_.OnSetWhiteListedTouchAction(cc::TouchAction::kPan);
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
             FilterGestureEventResult::kFilterGestureEventAllowed);
-  if (!compositor_touch_action_enabled_) {
-    EXPECT_EQ(filter_.allowed_touch_action().value(), cc::TouchAction::kAuto);
-    EXPECT_EQ(ActiveTouchAction().value(), cc::TouchAction::kAuto);
-  }
 }
 
 // This tests a gesture tap down with |num_of_active_touches_| == 0
-TEST_P(TouchActionFilterTest, TapDownWithZeroNumOfActiveTouches) {
+TEST_F(TouchActionFilterTest, TapDownWithZeroNumOfActiveTouches) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
 
   WebGestureEvent tap_down = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureTapDown, kSourceDevice);
+      WebInputEvent::Type::kGestureTapDown, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&tap_down),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_TRUE(ActiveTouchAction().has_value());
@@ -1469,7 +1398,7 @@ TEST_P(TouchActionFilterTest, TapDownWithZeroNumOfActiveTouches) {
 // Regression test for crbug.com/771330. One can start one finger panning y, and
 // add another finger to pinch zooming. The pinch zooming should not be allowed
 // if the allowed touch action doesn't allow it.
-TEST_P(TouchActionFilterTest, PinchZoomStartsWithOneFingerPanDisallowed) {
+TEST_F(TouchActionFilterTest, PinchZoomStartsWithOneFingerPanDisallowed) {
   filter_.OnHasTouchEventHandlers(true);
   filter_.OnSetTouchAction(cc::TouchAction::kPanY);
   WebGestureEvent scroll_begin =
@@ -1478,14 +1407,14 @@ TEST_P(TouchActionFilterTest, PinchZoomStartsWithOneFingerPanDisallowed) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(5, 10, 0,
                                                          kSourceDevice);
   WebGestureEvent pinch_begin = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchBegin, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchBegin, kSourceDevice);
   WebGestureEvent pinch_update =
       SyntheticWebGestureEventBuilder::BuildPinchUpdate(1.2f, 5, 5, 0,
                                                         kSourceDevice);
   WebGestureEvent pinch_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGesturePinchEnd, kSourceDevice);
+      WebInputEvent::Type::kGesturePinchEnd, kSourceDevice);
   WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureScrollEnd, kSourceDevice);
+      WebInputEvent::Type::kGestureScrollEnd, kSourceDevice);
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_begin),
             FilterGestureEventResult::kFilterGestureEventAllowed);
   EXPECT_EQ(filter_.FilterGestureEvent(&scroll_update),
@@ -1506,7 +1435,7 @@ TEST_P(TouchActionFilterTest, PinchZoomStartsWithOneFingerPanDisallowed) {
             FilterGestureEventResult::kFilterGestureEventAllowed);
 }
 
-TEST_P(TouchActionFilterTest, ScrollBeginWithoutTapDownWithKnownTouchAction) {
+TEST_F(TouchActionFilterTest, ScrollBeginWithoutTapDownWithKnownTouchAction) {
   filter_.OnHasTouchEventHandlers(true);
   EXPECT_FALSE(ActiveTouchAction().has_value());
   EXPECT_FALSE(filter_.allowed_touch_action().has_value());
@@ -1520,7 +1449,7 @@ TEST_P(TouchActionFilterTest, ScrollBeginWithoutTapDownWithKnownTouchAction) {
   EXPECT_EQ(filter_.allowed_touch_action().value(), cc::TouchAction::kPan);
 }
 
-TEST_P(TouchActionFilterTest, TouchpadScroll) {
+TEST_F(TouchActionFilterTest, TouchpadScroll) {
   WebGestureEvent scroll_begin =
       SyntheticWebGestureEventBuilder::BuildScrollBegin(
           2, 3, blink::WebGestureDevice::kTouchpad);
diff --git a/chromium/content/browser/renderer_host/input/touch_emulator.cc b/chromium/content/browser/renderer_host/input/touch_emulator.cc
index a3d242db2e5..7e8ebc2eecf 100644
--- a/chromium/content/browser/renderer_host/input/touch_emulator.cc
+++ b/chromium/content/browser/renderer_host/input/touch_emulator.cc
@@ -17,7 +17,7 @@
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/blink_event_util.h"
@@ -185,7 +185,7 @@ bool TouchEmulator::HandleMouseEvent(const WebMouseEvent& mouse_event,
   UpdateCursor();
 
   if (mouse_event.button == WebMouseEvent::Button::kRight &&
-      mouse_event.GetType() == WebInputEvent::kMouseDown) {
+      mouse_event.GetType() == WebInputEvent::Type::kMouseDown) {
     client_->ShowContextMenuAtPoint(
         gfx::Point(mouse_event.PositionInWidget().x(),
                    mouse_event.PositionInWidget().y()),
@@ -195,7 +195,7 @@ bool TouchEmulator::HandleMouseEvent(const WebMouseEvent& mouse_event,
   if (mouse_event.button != WebMouseEvent::Button::kLeft)
     return true;
 
-  if (mouse_event.GetType() == WebInputEvent::kMouseMove) {
+  if (mouse_event.GetType() == WebInputEvent::Type::kMouseMove) {
     if (last_mouse_event_was_move_ &&
         mouse_event.TimeStamp() <
             last_mouse_move_timestamp_ + kMouseMoveDropInterval)
@@ -207,17 +207,17 @@ bool TouchEmulator::HandleMouseEvent(const WebMouseEvent& mouse_event,
     last_mouse_event_was_move_ = false;
   }
 
-  if (mouse_event.GetType() == WebInputEvent::kMouseDown)
+  if (mouse_event.GetType() == WebInputEvent::Type::kMouseDown)
     mouse_pressed_ = true;
-  else if (mouse_event.GetType() == WebInputEvent::kMouseUp)
+  else if (mouse_event.GetType() == WebInputEvent::Type::kMouseUp)
     mouse_pressed_ = false;
 
   UpdateShiftPressed((mouse_event.GetModifiers() & WebInputEvent::kShiftKey) !=
                      0);
 
-  if (mouse_event.GetType() != WebInputEvent::kMouseDown &&
-      mouse_event.GetType() != WebInputEvent::kMouseMove &&
-      mouse_event.GetType() != WebInputEvent::kMouseUp) {
+  if (mouse_event.GetType() != WebInputEvent::Type::kMouseDown &&
+      mouse_event.GetType() != WebInputEvent::Type::kMouseMove &&
+      mouse_event.GetType() != WebInputEvent::Type::kMouseUp) {
     return true;
   }
 
@@ -317,18 +317,20 @@ bool TouchEmulator::HandleEmulatedTouchEvent(
 }
 
 bool TouchEmulator::HandleTouchEventAck(
-    const blink::WebTouchEvent& event, InputEventAckState ack_result) {
+    const blink::WebTouchEvent& event,
+    blink::mojom::InputEventResultState ack_result) {
   bool is_sequence_end = WebTouchEventTraits::IsTouchSequenceEnd(event);
   if (emulated_stream_active_sequence_count_) {
     if (is_sequence_end)
       emulated_stream_active_sequence_count_--;
 
     int taps_count_before = pending_taps_count_;
-    const bool event_consumed = ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
+    const bool event_consumed =
+        ack_result == blink::mojom::InputEventResultState::kConsumed;
     if (gesture_provider_) {
       gesture_provider_->OnTouchEventAck(
           event.unique_touch_event_id, event_consumed,
-          InputEventAckStateIsSetNonBlocking(ack_result));
+          InputEventResultStateIsSetNonBlocking(ack_result));
     }
     if (pending_taps_count_ == taps_count_before)
       OnInjectedTouchCompleted();
@@ -344,7 +346,7 @@ bool TouchEmulator::HandleTouchEventAck(
 
 void TouchEmulator::OnGestureEventAck(const WebGestureEvent& event,
                                       RenderWidgetHostViewBase*) {
-  if (event.GetType() != WebInputEvent::kGestureTap)
+  if (event.GetType() != WebInputEvent::Type::kGestureTap)
     return;
   if (pending_taps_count_) {
     pending_taps_count_--;
@@ -367,19 +369,19 @@ void TouchEmulator::OnGestureEvent(const ui::GestureEventData& gesture) {
   DCHECK(gesture_event.unique_touch_event_id);
 
   switch (gesture_event.GetType()) {
-    case WebInputEvent::kUndefined:
+    case WebInputEvent::Type::kUndefined:
       NOTREACHED() << "Undefined WebInputEvent type";
       // Bail without sending the junk event to the client.
       return;
 
-    case WebInputEvent::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollBegin:
       client_->ForwardEmulatedGestureEvent(gesture_event);
       // PinchBegin must always follow ScrollBegin.
       if (InPinchGestureMode())
         PinchBegin(gesture_event);
       break;
 
-    case WebInputEvent::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureScrollUpdate:
       if (InPinchGestureMode()) {
         // Convert scrolls to pinches while shift is pressed.
         if (!pinch_gesture_active_)
@@ -394,14 +396,14 @@ void TouchEmulator::OnGestureEvent(const ui::GestureEventData& gesture) {
       }
       break;
 
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollEnd:
       // PinchEnd must precede ScrollEnd.
       if (pinch_gesture_active_)
         PinchEnd(gesture_event);
       client_->ForwardEmulatedGestureEvent(gesture_event);
       break;
 
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       // PinchEnd must precede FlingStart.
       if (pinch_gesture_active_)
         PinchEnd(gesture_event);
@@ -415,14 +417,14 @@ void TouchEmulator::OnGestureEvent(const ui::GestureEventData& gesture) {
       }
       break;
 
-    case WebInputEvent::kGestureFlingCancel:
+    case WebInputEvent::Type::kGestureFlingCancel:
       // If fling start was suppressed, we should not send fling cancel either.
       if (!suppress_next_fling_cancel_)
         client_->ForwardEmulatedGestureEvent(gesture_event);
       suppress_next_fling_cancel_ = false;
       break;
 
-    case WebInputEvent::kGestureTap:
+    case WebInputEvent::Type::kGestureTap:
       pending_taps_count_++;
       client_->ForwardEmulatedGestureEvent(gesture_event);
       break;
@@ -462,7 +464,7 @@ void TouchEmulator::CancelTouch() {
   }
 
   WebTouchEventTraits::ResetTypeAndTouchStates(
-      WebInputEvent::kTouchCancel, ui::EventTimeForNow(), &touch_event_);
+      WebInputEvent::Type::kTouchCancel, ui::EventTimeForNow(), &touch_event_);
   DCHECK(gesture_provider_);
   if (gesture_provider_->GetCurrentDownEvent())
     HandleEmulatedTouchEvent(touch_event_, last_emulated_start_target_);
@@ -490,7 +492,7 @@ void TouchEmulator::PinchBegin(const WebGestureEvent& event) {
   pinch_anchor_ = event.PositionInWidget();
   pinch_scale_ = 1.f;
   WebGestureEvent pinch_event =
-      GetPinchGestureEvent(WebInputEvent::kGesturePinchBegin, event);
+      GetPinchGestureEvent(WebInputEvent::Type::kGesturePinchBegin, event);
   client_->ForwardEmulatedGestureEvent(pinch_event);
 }
 
@@ -499,7 +501,7 @@ void TouchEmulator::PinchUpdate(const WebGestureEvent& event) {
   float dy = pinch_anchor_.y() - event.PositionInWidget().y();
   float scale = exp(dy * 0.002f);
   WebGestureEvent pinch_event =
-      GetPinchGestureEvent(WebInputEvent::kGesturePinchUpdate, event);
+      GetPinchGestureEvent(WebInputEvent::Type::kGesturePinchUpdate, event);
   pinch_event.data.pinch_update.scale = scale / pinch_scale_;
   client_->ForwardEmulatedGestureEvent(pinch_event);
   pinch_scale_ = scale;
@@ -509,14 +511,15 @@ void TouchEmulator::PinchEnd(const WebGestureEvent& event) {
   DCHECK(pinch_gesture_active_);
   pinch_gesture_active_ = false;
   WebGestureEvent pinch_event =
-      GetPinchGestureEvent(WebInputEvent::kGesturePinchEnd, event);
+      GetPinchGestureEvent(WebInputEvent::Type::kGesturePinchEnd, event);
   client_->ForwardEmulatedGestureEvent(pinch_event);
 }
 
 void TouchEmulator::ScrollEnd(const WebGestureEvent& event) {
-  WebGestureEvent scroll_event(
-      WebInputEvent::kGestureScrollEnd, ModifiersWithoutMouseButtons(event),
-      event.TimeStamp(), blink::WebGestureDevice::kTouchscreen);
+  WebGestureEvent scroll_event(WebInputEvent::Type::kGestureScrollEnd,
+                               ModifiersWithoutMouseButtons(event),
+                               event.TimeStamp(),
+                               blink::WebGestureDevice::kTouchscreen);
   scroll_event.unique_touch_event_id = event.unique_touch_event_id;
   client_->ForwardEmulatedGestureEvent(scroll_event);
 }
@@ -536,17 +539,17 @@ void TouchEmulator::FillTouchEventAndPoint(const WebMouseEvent& mouse_event,
                                            const gfx::PointF& pos_in_root) {
   WebInputEvent::Type eventType;
   switch (mouse_event.GetType()) {
-    case WebInputEvent::kMouseDown:
-      eventType = WebInputEvent::kTouchStart;
+    case WebInputEvent::Type::kMouseDown:
+      eventType = WebInputEvent::Type::kTouchStart;
       break;
-    case WebInputEvent::kMouseMove:
-      eventType = WebInputEvent::kTouchMove;
+    case WebInputEvent::Type::kMouseMove:
+      eventType = WebInputEvent::Type::kTouchMove;
       break;
-    case WebInputEvent::kMouseUp:
-      eventType = WebInputEvent::kTouchEnd;
+    case WebInputEvent::Type::kMouseUp:
+      eventType = WebInputEvent::Type::kTouchEnd;
       break;
     default:
-      eventType = WebInputEvent::kUndefined;
+      eventType = WebInputEvent::Type::kUndefined;
       NOTREACHED() << "Invalid event for touch emulation: "
                    << mouse_event.GetType();
   }
@@ -558,7 +561,7 @@ void TouchEmulator::FillTouchEventAndPoint(const WebMouseEvent& mouse_event,
   point.id = 0;
   point.radius_x = 0.5f * cursor_size_.width();
   point.radius_y = 0.5f * cursor_size_.height();
-  point.force = eventType == WebInputEvent::kTouchEnd ? 0.f : 1.f;
+  point.force = eventType == WebInputEvent::Type::kTouchEnd ? 0.f : 1.f;
   point.rotation_angle = 0.f;
   // We need to convert this to the root-view's coord space, otherwise the
   // GestureRecognizer will potentially receive events for a moving widget,
diff --git a/chromium/content/browser/renderer_host/input/touch_emulator.h b/chromium/content/browser/renderer_host/input/touch_emulator.h
index 4f2848023eb..7d6fd395f2b 100644
--- a/chromium/content/browser/renderer_host/input/touch_emulator.h
+++ b/chromium/content/browser/renderer_host/input/touch_emulator.h
@@ -12,8 +12,8 @@
 #include "base/macros.h"
 #include "content/browser/renderer_host/input/touch_emulator_client.h"
 #include "content/common/cursors/webcursor.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/gesture_detection/filtered_gesture_provider.h"
 #include "ui/events/gesture_detection/gesture_provider_config_helper.h"
 #include "ui/gfx/geometry/size_f.h"
@@ -74,7 +74,7 @@ class CONTENT_EXPORT TouchEmulator : public ui::GestureProviderClient {
   // Returns |true| if the event ack was consumed. Consumed ack should not
   // propagate any further.
   bool HandleTouchEventAck(const blink::WebTouchEvent& event,
-                           InputEventAckState ack_result);
+                           blink::mojom::InputEventResultState ack_result);
 
   // Injects a touch event to be processed for gestures and optionally
   // forwarded to the client. Only works in kInjectingTouchEvents mode.
diff --git a/chromium/content/browser/renderer_host/input/touch_emulator_unittest.cc b/chromium/content/browser/renderer_host/input/touch_emulator_unittest.cc
index ddd54419f6b..ef8e309015b 100644
--- a/chromium/content/browser/renderer_host/input/touch_emulator_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_emulator_unittest.cc
@@ -75,13 +75,13 @@ class TouchEmulatorTest : public testing::Test,
         WebInputEvent::kForwardButtonDown;
     EXPECT_EQ(0, event.GetModifiers() & all_buttons);
     WebInputEvent::DispatchType expected_dispatch_type =
-        event.GetType() == WebInputEvent::kTouchCancel
-            ? WebInputEvent::kEventNonBlocking
-            : WebInputEvent::kBlocking;
+        event.GetType() == WebInputEvent::Type::kTouchCancel
+            ? WebInputEvent::DispatchType::kEventNonBlocking
+            : WebInputEvent::DispatchType::kBlocking;
     EXPECT_EQ(expected_dispatch_type, event.dispatch_type);
     if (ack_touches_synchronously_) {
       emulator()->HandleTouchEventAck(
-          event, INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+          event, blink::mojom::InputEventResultState::kNoConsumerExists);
     }
   }
 
@@ -131,13 +131,13 @@ class TouchEmulatorTest : public testing::Test,
   void PressShift() {
     DCHECK(!shift_pressed_);
     shift_pressed_ = true;
-    SendKeyboardEvent(WebInputEvent::kKeyDown);
+    SendKeyboardEvent(WebInputEvent::Type::kKeyDown);
   }
 
   void ReleaseShift() {
     DCHECK(shift_pressed_);
     shift_pressed_ = false;
-    SendKeyboardEvent(WebInputEvent::kKeyUp);
+    SendKeyboardEvent(WebInputEvent::Type::kKeyUp);
   }
 
   void SendMouseEvent(WebInputEvent::Type type, int  x, int y) {
@@ -152,7 +152,7 @@ class TouchEmulatorTest : public testing::Test,
   }
 
   bool SendMouseWheelEvent() {
-    WebMouseWheelEvent event(WebInputEvent::kMouseWheel, modifiers(),
+    WebMouseWheelEvent event(WebInputEvent::Type::kMouseWheel, modifiers(),
                              GetNextEventTime());
     // Return whether mouse wheel is forwarded.
     return !emulator()->HandleMouseWheelEvent(event);
@@ -161,42 +161,42 @@ class TouchEmulatorTest : public testing::Test,
   void MouseDown(int x, int y) {
     DCHECK(!mouse_pressed_);
     if (x != last_mouse_x_ || y != last_mouse_y_)
-      SendMouseEvent(WebInputEvent::kMouseMove, x, y);
+      SendMouseEvent(WebInputEvent::Type::kMouseMove, x, y);
     mouse_pressed_ = true;
-    SendMouseEvent(WebInputEvent::kMouseDown, x, y);
+    SendMouseEvent(WebInputEvent::Type::kMouseDown, x, y);
   }
 
   void MouseDrag(int x, int y) {
     DCHECK(mouse_pressed_);
-    SendMouseEvent(WebInputEvent::kMouseMove, x, y);
+    SendMouseEvent(WebInputEvent::Type::kMouseMove, x, y);
   }
 
   void MouseMove(int x, int y) {
     DCHECK(!mouse_pressed_);
-    SendMouseEvent(WebInputEvent::kMouseMove, x, y);
+    SendMouseEvent(WebInputEvent::Type::kMouseMove, x, y);
   }
 
   void MouseUp(int x, int y) {
     DCHECK(mouse_pressed_);
     if (x != last_mouse_x_ || y != last_mouse_y_)
-      SendMouseEvent(WebInputEvent::kMouseMove, x, y);
-    SendMouseEvent(WebInputEvent::kMouseUp, x, y);
+      SendMouseEvent(WebInputEvent::Type::kMouseMove, x, y);
+    SendMouseEvent(WebInputEvent::Type::kMouseUp, x, y);
     mouse_pressed_ = false;
   }
 
   bool TouchStart(int x, int  y, bool ack) {
-    return SendTouchEvent(WebInputEvent::kTouchStart,
-                          WebTouchPoint::kStatePressed, x, y, ack);
+    return SendTouchEvent(WebInputEvent::Type::kTouchStart,
+                          WebTouchPoint::State::kStatePressed, x, y, ack);
   }
 
   bool TouchMove(int x, int  y, bool ack) {
-    return SendTouchEvent(WebInputEvent::kTouchMove, WebTouchPoint::kStateMoved,
-                          x, y, ack);
+    return SendTouchEvent(WebInputEvent::Type::kTouchMove,
+                          WebTouchPoint::State::kStateMoved, x, y, ack);
   }
 
   bool TouchEnd(int x, int  y, bool ack) {
-    return SendTouchEvent(WebInputEvent::kTouchEnd,
-                          WebTouchPoint::kStateReleased, x, y, ack);
+    return SendTouchEvent(WebInputEvent::Type::kTouchEnd,
+                          WebTouchPoint::State::kStateReleased, x, y, ack);
   }
 
   WebTouchEvent MakeTouchEvent(WebInputEvent::Type type,
@@ -224,7 +224,7 @@ class TouchEmulatorTest : public testing::Test,
 
       // Touch event is forwarded, ack should not be handled by emulator.
       EXPECT_FALSE(emulator()->HandleTouchEventAck(
-          event, INPUT_EVENT_ACK_STATE_CONSUMED));
+          event, blink::mojom::InputEventResultState::kConsumed));
     } else {
       touch_events_to_ack_.push_back(event);
     }
@@ -247,7 +247,7 @@ class TouchEmulatorTest : public testing::Test,
     touch_events_to_ack_.erase(touch_events_to_ack_.begin());
     // Emulator should not handle ack from native stream.
     EXPECT_FALSE(emulator()->HandleTouchEventAck(
-                 event, INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+        event, blink::mojom::InputEventResultState::kNoConsumerExists));
   }
 
   void DisableSynchronousTouchAck() { ack_touches_synchronously_ = false; }
@@ -562,10 +562,11 @@ TEST_F(TouchEmulatorTest, MultipleTouchStreamsLateEnable) {
   // Enabling in the middle of native touch sequence should be handled.
   // Send artificial late TouchEnd ack, like it is the first thing emulator
   // does see.
-  WebTouchEvent event = MakeTouchEvent(WebInputEvent::kTouchEnd,
-                                       WebTouchPoint::kStateReleased, 10, 10);
+  WebTouchEvent event =
+      MakeTouchEvent(WebInputEvent::Type::kTouchEnd,
+                     WebTouchPoint::State::kStateReleased, 10, 10);
   EXPECT_FALSE(emulator()->HandleTouchEventAck(
-      event, INPUT_EVENT_ACK_STATE_CONSUMED));
+      event, blink::mojom::InputEventResultState::kConsumed));
 
   MouseDown(100, 200);
   EXPECT_EQ("TouchStart GestureTapDown", ExpectedEvents());
@@ -614,15 +615,15 @@ TEST_F(TouchEmulatorTest, CursorScaleFactor) {
 TEST_F(TouchEmulatorTest, InjectingTouchEventsMode) {
   emulator()->Enable(TouchEmulator::Mode::kInjectingTouchEvents,
                      ui::GestureProviderConfigType::GENERIC_MOBILE);
-  InjectTouchEvent(WebInputEvent::kTouchStart, WebTouchPoint::kStatePressed,
-                   100, 200);
+  InjectTouchEvent(WebInputEvent::Type::kTouchStart,
+                   WebTouchPoint::State::kStatePressed, 100, 200);
   EXPECT_EQ("TouchStart GestureTapDown", ExpectedEvents());
-  InjectTouchEvent(WebInputEvent::kTouchMove, WebTouchPoint::kStateMoved, 200,
-                   200);
+  InjectTouchEvent(WebInputEvent::Type::kTouchMove,
+                   WebTouchPoint::State::kStateMoved, 200, 200);
   EXPECT_EQ("TouchMove GestureTapCancel GestureScrollBegin GestureScrollUpdate",
             ExpectedEvents());
-  InjectTouchEvent(WebInputEvent::kTouchEnd, WebTouchPoint::kStateReleased, 200,
-                   200);
+  InjectTouchEvent(WebInputEvent::Type::kTouchEnd,
+                   WebTouchPoint::State::kStateReleased, 200, 200);
   EXPECT_EQ("TouchEnd GestureScrollEnd", ExpectedEvents());
 }
 
diff --git a/chromium/content/browser/renderer_host/input/touch_input_browsertest.cc b/chromium/content/browser/renderer_host/input/touch_input_browsertest.cc
index f3ffc73d4e3..59ee4394413 100644
--- a/chromium/content/browser/renderer_host/input/touch_input_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_input_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -142,10 +143,11 @@ IN_PROC_BROWSER_TEST_F(TouchInputBrowserTest, TouchNoHandler) {
   // A press on |first| should be acked with NO_CONSUMER_EXISTS since there is
   // no touch-handler on it.
   touch.PressPoint(25, 25);
-  auto filter = AddFilter(WebInputEvent::kTouchStart);
+  auto filter = AddFilter(WebInputEvent::Type::kTouchStart);
   SendTouchEvent(&touch);
 
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, filter->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
+            filter->WaitForAck());
 
   // If a touch-press is acked with NO_CONSUMER_EXISTS, then subsequent
   // touch-points don't need to be dispatched until the touch point is released.
@@ -160,11 +162,12 @@ IN_PROC_BROWSER_TEST_F(TouchInputBrowserTest, TouchHandlerNoConsume) {
   // Press on |second| should be acked with NOT_CONSUMED since there is a
   // touch-handler on |second|, but it doesn't consume the event.
   touch.PressPoint(125, 25);
-  auto filter = AddFilter(WebInputEvent::kTouchStart);
+  auto filter = AddFilter(WebInputEvent::Type::kTouchStart);
   SendTouchEvent(&touch);
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, filter->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
+            filter->WaitForAck());
 
-  filter = AddFilter(WebInputEvent::kTouchEnd);
+  filter = AddFilter(WebInputEvent::Type::kTouchEnd);
   touch.ReleasePoint(0);
   SendTouchEvent(&touch);
   filter->WaitForAck();
@@ -177,12 +180,13 @@ IN_PROC_BROWSER_TEST_F(TouchInputBrowserTest, TouchHandlerConsume) {
   // Press on |third| should be acked with CONSUMED since the touch-handler on
   // |third| consimes the event.
   touch.PressPoint(25, 125);
-  auto filter = AddFilter(WebInputEvent::kTouchStart);
+  auto filter = AddFilter(WebInputEvent::Type::kTouchStart);
   SendTouchEvent(&touch);
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, filter->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            filter->WaitForAck());
 
   touch.ReleasePoint(0);
-  filter = AddFilter(WebInputEvent::kTouchEnd);
+  filter = AddFilter(WebInputEvent::Type::kTouchEnd);
   SendTouchEvent(&touch);
   filter->WaitForAck();
 }
@@ -194,14 +198,16 @@ IN_PROC_BROWSER_TEST_F(TouchInputBrowserTest, MultiPointTouchPress) {
   // Press on |first|, which sould be acked with NO_CONSUMER_EXISTS. Then press
   // on |third|. That point should be acked with CONSUMED.
   touch.PressPoint(25, 25);
-  auto filter = AddFilter(WebInputEvent::kTouchStart);
+  auto filter = AddFilter(WebInputEvent::Type::kTouchStart);
   SendTouchEvent(&touch);
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, filter->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNoConsumerExists,
+            filter->WaitForAck());
 
   touch.PressPoint(25, 125);
-  filter = AddFilter(WebInputEvent::kTouchStart);
+  filter = AddFilter(WebInputEvent::Type::kTouchStart);
   SendTouchEvent(&touch);
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, filter->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            filter->WaitForAck());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc
index 1d1d45afe83..1f06e655cc2 100644
--- a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc
+++ b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc
@@ -19,6 +19,7 @@
 #include "ui/aura/env.h"
 #include "ui/aura/window.h"
 #include "ui/base/clipboard/clipboard.h"
+#include "ui/base/pointer/touch_editing_controller.h"
 #include "ui/events/event_observer.h"
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/gfx/geometry/size_conversions.h"
@@ -88,7 +89,7 @@ class TouchSelectionControllerClientAura::EnvEventObserver
       // from touch as this can clear an active selection generated by the pen.
       if ((event.flags() & (ui::EF_IS_SYNTHESIZED | ui::EF_FROM_TOUCH)) ||
           event.AsMouseEvent()->pointer_details().pointer_type ==
-              ui::EventPointerType::POINTER_TYPE_PEN) {
+              ui::EventPointerType::kPen) {
         return;
       }
     }
@@ -433,11 +434,11 @@ bool TouchSelectionControllerClientAura::IsCommandIdEnabled(
   bool readable = rwhva_->GetTextInputType() != ui::TEXT_INPUT_TYPE_PASSWORD;
   bool has_selection = !rwhva_->GetSelectedText().empty();
   switch (command_id) {
-    case IDS_APP_CUT:
+    case ui::TouchEditable::kCut:
       return editable && readable && has_selection;
-    case IDS_APP_COPY:
+    case ui::TouchEditable::kCopy:
       return readable && has_selection;
-    case IDS_APP_PASTE: {
+    case ui::TouchEditable::kPaste: {
       base::string16 result;
       ui::Clipboard::GetForCurrentThread()->ReadText(
           ui::ClipboardBuffer::kCopyPaste, &result);
@@ -456,13 +457,13 @@ void TouchSelectionControllerClientAura::ExecuteCommand(int command_id,
     return;
 
   switch (command_id) {
-    case IDS_APP_CUT:
+    case ui::TouchEditable::kCut:
       host_delegate->Cut();
       break;
-    case IDS_APP_COPY:
+    case ui::TouchEditable::kCopy:
       host_delegate->Copy();
       break;
-    case IDS_APP_PASTE:
+    case ui::TouchEditable::kPaste:
       host_delegate->Paste();
       break;
     default:
diff --git a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
index 1ee527330ec..d65863b1cf5 100644
--- a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/frame_messages.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -264,8 +265,8 @@ class GestureEventWaiter : public RenderWidgetHost::InputEventObserver {
     }
   }
 
-  void OnInputEventAck(InputEventAckSource,
-                       InputEventAckState,
+  void OnInputEventAck(blink::mojom::InputEventResultSource,
+                       blink::mojom::InputEventResultState,
                        const blink::WebInputEvent& event) override {
     if (event.GetType() == target_event_type_) {
       gesture_event_type_ack_seen_ = true;
@@ -321,7 +322,7 @@ class TouchSelectionControllerClientAuraSiteIsolationTest
 
     GestureEventWaiter long_press_waiter(
         expected_target->GetRenderWidgetHost(),
-        blink::WebInputEvent::kGestureLongPress);
+        blink::WebInputEvent::Type::kGestureLongPress);
     SendTouch(main_view, ui::ET_TOUCH_PRESSED, point);
     // Wait until we see the out-bound LongPress on its way to the renderer, so
     // we know it's ok to send the TOUCH_RELEASED to end the sequence.
@@ -337,10 +338,11 @@ class TouchSelectionControllerClientAuraSiteIsolationTest
     // Get main frame view for event insertion.
     RenderWidgetHostViewAura* main_view = GetRenderWidgetHostViewAura();
 
-    GestureEventWaiter tap_down_waiter(expected_target->GetRenderWidgetHost(),
-                                       blink::WebInputEvent::kGestureTapDown);
+    GestureEventWaiter tap_down_waiter(
+        expected_target->GetRenderWidgetHost(),
+        blink::WebInputEvent::Type::kGestureTapDown);
     GestureEventWaiter tap_waiter(expected_target->GetRenderWidgetHost(),
-                                  blink::WebInputEvent::kGestureTap);
+                                  blink::WebInputEvent::Type::kGestureTap);
     SendTouch(main_view, ui::ET_TOUCH_PRESSED, point);
     tap_down_waiter.Wait();
     SendTouch(main_view, ui::ET_TOUCH_RELEASED, point);
@@ -359,9 +361,8 @@ class TouchSelectionControllerClientAuraSiteIsolationTest
     aura::Window* content_window = view->GetNativeView();
     aura::Window::ConvertPointToTarget(content_window, shell_window, &point);
     ui::EventSink* sink = content_window->GetHost()->event_sink();
-    ui::TouchEvent touch(
-        type, point, ui::EventTimeForNow(),
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+    ui::TouchEvent touch(type, point, ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 0));
     ui::EventDispatchDetails details = sink->OnEventFromSource(&touch);
     ASSERT_FALSE(details.dispatcher_destroyed);
   }
@@ -613,7 +614,7 @@ IN_PROC_BROWSER_TEST_P(TouchSelectionControllerClientAuraSiteIsolationTest,
   // 1) Send touch-down.
   ui::TouchEvent touch_down(
       ui::ET_TOUCH_PRESSED, scroll_start_position, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   parent_view->OnTouchEvent(&touch_down);
   EXPECT_EQ(ui::TouchSelectionController::SELECTION_ACTIVE,
             selection_controller->active_status());
@@ -625,7 +626,7 @@ IN_PROC_BROWSER_TEST_P(TouchSelectionControllerClientAuraSiteIsolationTest,
   // 2) Send touch-move.
   ui::TouchEvent touch_move(
       ui::ET_TOUCH_MOVED, scroll_end_position, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   parent_view->OnTouchEvent(&touch_move);
   EXPECT_EQ(ui::TouchSelectionController::SELECTION_ACTIVE,
             selection_controller->active_status());
@@ -682,9 +683,9 @@ IN_PROC_BROWSER_TEST_P(TouchSelectionControllerClientAuraSiteIsolationTest,
   EXPECT_FALSE(ui::TouchSelectionMenuRunner::GetInstance()->IsRunning());
 
   // 3) Send touch-end.
-  ui::TouchEvent touch_up(
-      ui::ET_TOUCH_RELEASED, scroll_end_position, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent touch_up(ui::ET_TOUCH_RELEASED, scroll_end_position,
+                          ui::EventTimeForNow(),
+                          ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   parent_view->OnTouchEvent(&touch_up);
   EXPECT_EQ(ui::TouchSelectionController::SELECTION_ACTIVE,
             selection_controller->active_status());
@@ -855,7 +856,7 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraTest, HiddenOnScroll) {
   // there.
   ui::TouchEvent touch_down(
       ui::ET_TOUCH_PRESSED, gfx::Point(10, 10), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_down);
   EXPECT_EQ(ui::TouchSelectionController::SELECTION_ACTIVE,
             rwhva->selection_controller()->active_status());
@@ -887,9 +888,9 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraTest, HiddenOnScroll) {
   EXPECT_FALSE(ui::TouchSelectionMenuRunner::GetInstance()->IsRunning());
 
   // Lift the finger up: the quick menu should re-appear.
-  ui::TouchEvent touch_up(
-      ui::ET_TOUCH_RELEASED, gfx::Point(10, 10), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent touch_up(ui::ET_TOUCH_RELEASED, gfx::Point(10, 10),
+                          ui::EventTimeForNow(),
+                          ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_up);
   EXPECT_EQ(ui::TouchSelectionController::SELECTION_ACTIVE,
             rwhva->selection_controller()->active_status());
@@ -979,7 +980,7 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraScaleFactorTest,
       ui::SELECTION_HANDLE_DRAG_STARTED);
   ui::TouchEvent touch_down(
       ui::ET_TOUCH_PRESSED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_down);
   selection_controller_client()->Wait();
 
@@ -989,16 +990,16 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraScaleFactorTest,
   handle_point.Offset(10, 0);
   ui::TouchEvent touch_move(
       ui::ET_TOUCH_MOVED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_move);
   selection_controller_client()->Wait();
 
   // Then release.
   selection_controller_client()->InitWaitForSelectionEvent(
       ui::SELECTION_HANDLE_DRAG_STOPPED);
-  ui::TouchEvent touch_up(
-      ui::ET_TOUCH_RELEASED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent touch_up(ui::ET_TOUCH_RELEASED, handle_point,
+                          ui::EventTimeForNow(),
+                          ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_up);
   selection_controller_client()->Wait();
 
@@ -1057,7 +1058,7 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraScaleFactorTest,
       ui::INSERTION_HANDLE_DRAG_STARTED);
   ui::TouchEvent touch_down(
       ui::ET_TOUCH_PRESSED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_down);
   selection_controller_client()->Wait();
 
@@ -1067,16 +1068,16 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAuraScaleFactorTest,
   handle_point.Offset(10, 0);
   ui::TouchEvent touch_move(
       ui::ET_TOUCH_MOVED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_move);
   selection_controller_client()->Wait();
 
   // Then release.
   selection_controller_client()->InitWaitForSelectionEvent(
       ui::INSERTION_HANDLE_DRAG_STOPPED);
-  ui::TouchEvent touch_up(
-      ui::ET_TOUCH_RELEASED, handle_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent touch_up(ui::ET_TOUCH_RELEASED, handle_point,
+                          ui::EventTimeForNow(),
+                          ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   rwhva->OnTouchEvent(&touch_up);
   selection_controller_client()->Wait();
 
diff --git a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc
index 49db289ce07..334361a1ace 100644
--- a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc
+++ b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc
@@ -4,7 +4,8 @@
 
 #include "content/browser/renderer_host/input/touch_selection_controller_client_child_frame.h"
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
@@ -12,6 +13,7 @@
 #include "content/public/browser/touch_selection_controller_client_manager.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "ui/base/clipboard/clipboard.h"
+#include "ui/base/pointer/touch_editing_controller.h"
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/strings/grit/ui_strings.h"
 
@@ -150,11 +152,11 @@ bool TouchSelectionControllerClientChildFrame::IsCommandIdEnabled(
 
   bool has_selection = !rwhv_->GetSelectedText().empty();
   switch (command_id) {
-    case IDS_APP_CUT:
+    case ui::TouchEditable::kCut:
       return editable && readable && has_selection;
-    case IDS_APP_COPY:
+    case ui::TouchEditable::kCopy:
       return readable && has_selection;
-    case IDS_APP_PASTE: {
+    case ui::TouchEditable::kPaste: {
       base::string16 result;
       ui::Clipboard::GetForCurrentThread()->ReadText(
           ui::ClipboardBuffer::kCopyPaste, &result);
@@ -174,13 +176,13 @@ void TouchSelectionControllerClientChildFrame::ExecuteCommand(int command_id,
     return;
 
   switch (command_id) {
-    case IDS_APP_CUT:
+    case ui::TouchEditable::kCut:
       host_delegate->Cut();
       break;
-    case IDS_APP_COPY:
+    case ui::TouchEditable::kCopy:
       host_delegate->Copy();
       break;
-    case IDS_APP_PASTE:
+    case ui::TouchEditable::kPaste:
       host_delegate->Paste();
       break;
     default:
diff --git a/chromium/content/browser/renderer_host/input/touch_timeout_handler.cc b/chromium/content/browser/renderer_host/input/touch_timeout_handler.cc
index 701d613c1bd..36cb66f1cd8 100644
--- a/chromium/content/browser/renderer_host/input/touch_timeout_handler.cc
+++ b/chromium/content/browser/renderer_host/input/touch_timeout_handler.cc
@@ -25,9 +25,9 @@ namespace content {
 namespace {
 
 bool ShouldTouchTriggerTimeout(const WebTouchEvent& event) {
-  return (event.GetType() == WebInputEvent::kTouchStart ||
-          event.GetType() == WebInputEvent::kTouchMove) &&
-         event.dispatch_type == WebInputEvent::kBlocking;
+  return (event.GetType() == WebInputEvent::Type::kTouchStart ||
+          event.GetType() == WebInputEvent::Type::kTouchMove) &&
+         event.dispatch_type == WebInputEvent::DispatchType::kBlocking;
 }
 
 }  // namespace
@@ -81,15 +81,16 @@ void TouchTimeoutHandler::StartIfNecessary(
   timeout_monitor_.Restart(timeout_delay);
 }
 
-bool TouchTimeoutHandler::ConfirmTouchEvent(uint32_t unique_touch_event_id,
-                                            InputEventAckState ack_result,
-                                            bool should_stop_timeout_monitor) {
+bool TouchTimeoutHandler::ConfirmTouchEvent(
+    uint32_t unique_touch_event_id,
+    blink::mojom::InputEventResultState ack_result,
+    bool should_stop_timeout_monitor) {
   if (timeout_event_.event.unique_touch_event_id != unique_touch_event_id)
     return false;
 
   switch (pending_ack_state_) {
     case PENDING_ACK_NONE:
-      if (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED)
+      if (ack_result == blink::mojom::InputEventResultState::kConsumed)
         enabled_for_current_sequence_ = false;
       if (should_stop_timeout_monitor)
         timeout_monitor_.Stop();
@@ -161,9 +162,9 @@ void TouchTimeoutHandler::OnTimeOut() {
 // Skip a cancel event if the timed-out event had no consumer and was the
 // initial event in the gesture.
 bool TouchTimeoutHandler::AckedTimeoutEventRequiresCancel(
-    InputEventAckState ack_result) const {
+    blink::mojom::InputEventResultState ack_result) const {
   DCHECK(HasTimeoutEvent());
-  if (ack_result != INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS)
+  if (ack_result != blink::mojom::InputEventResultState::kNoConsumerExists)
     return true;
   return !WebTouchEventTraits::IsTouchSequenceStart(timeout_event_.event);
 }
diff --git a/chromium/content/browser/renderer_host/input/touch_timeout_handler.h b/chromium/content/browser/renderer_host/input/touch_timeout_handler.h
index 05ea5548d55..b8001a00449 100644
--- a/chromium/content/browser/renderer_host/input/touch_timeout_handler.h
+++ b/chromium/content/browser/renderer_host/input/touch_timeout_handler.h
@@ -12,7 +12,7 @@
 #include "base/time/time.h"
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -28,7 +28,7 @@ class TouchTimeoutHandler {
 
   void StartIfNecessary(const TouchEventWithLatencyInfo& event);
   bool ConfirmTouchEvent(uint32_t unique_touch_event_id,
-                         InputEventAckState ack_result,
+                         blink::mojom::InputEventResultState ack_result,
                          bool should_stop_timeout_monitor);
   bool FilterEvent(const blink::WebTouchEvent& event);
   void SetEnabled(bool enabled);
@@ -47,7 +47,8 @@ class TouchTimeoutHandler {
   void OnTimeOut();
   // Skip a cancel event if the timed-out event had no consumer and was the
   // initial event in the gesture.
-  bool AckedTimeoutEventRequiresCancel(InputEventAckState ack_result) const;
+  bool AckedTimeoutEventRequiresCancel(
+      blink::mojom::InputEventResultState ack_result) const;
   void SetPendingAckState(PendingAckState new_pending_ack_state);
   void LogSequenceStartForUMA();
   void LogSequenceEndForUMAIfNecessary(bool timed_out);
diff --git a/chromium/content/browser/renderer_host/input/touchpad_pinch_browsertest.cc b/chromium/content/browser/renderer_host/input/touchpad_pinch_browsertest.cc
index e329f917f4d..b33dba2cff6 100644
--- a/chromium/content/browser/renderer_host/input/touchpad_pinch_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/touchpad_pinch_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -259,7 +260,7 @@ IN_PROC_BROWSER_TEST_P(TouchpadPinchBrowserTest,
   EnsureNoScaleChangeWhenCanceled(
       base::BindOnce([](WebContents* web_contents, gfx::PointF position) {
         blink::WebGestureEvent double_tap_zoom(
-            blink::WebInputEvent::kGestureDoubleTap,
+            blink::WebInputEvent::Type::kGestureDoubleTap,
             blink::WebInputEvent::kNoModifiers,
             blink::WebInputEvent::GetStaticTimeStampForTests(),
             blink::WebGestureDevice::kTouchpad);
diff --git a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
index 59d8fca3412..7a4af66cc18 100644
--- a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
@@ -20,9 +20,11 @@ blink::WebMouseWheelEvent CreateSyntheticWheelFromTouchpadPinchEvent(
     const blink::WebGestureEvent& pinch_event,
     blink::WebMouseWheelEvent::Phase phase,
     bool cancelable) {
-  DCHECK(pinch_event.GetType() == blink::WebInputEvent::kGesturePinchUpdate ||
-         pinch_event.GetType() == blink::WebInputEvent::kGesturePinchEnd ||
-         pinch_event.GetType() == blink::WebInputEvent::kGestureDoubleTap);
+  DCHECK(
+      pinch_event.GetType() ==
+          blink::WebInputEvent::Type::kGesturePinchUpdate ||
+      pinch_event.GetType() == blink::WebInputEvent::Type::kGesturePinchEnd ||
+      pinch_event.GetType() == blink::WebInputEvent::Type::kGestureDoubleTap);
   float delta_y = 0.0f;
   float wheel_ticks_y = 0.0f;
 
@@ -36,7 +38,8 @@ blink::WebMouseWheelEvent CreateSyntheticWheelFromTouchpadPinchEvent(
   //  - a formula that's relatively easy to use from JavaScript
   // Note that 'wheel' event deltaY values have their sign inverted.  So to
   // convert a wheel deltaY back to a scale use Math.exp(-deltaY/100).
-  if (pinch_event.GetType() == blink::WebInputEvent::kGesturePinchUpdate) {
+  if (pinch_event.GetType() ==
+      blink::WebInputEvent::Type::kGesturePinchUpdate) {
     DCHECK_GT(pinch_event.data.pinch_update.scale, 0);
     delta_y = 100.0f * log(pinch_event.data.pinch_update.scale);
     wheel_ticks_y = pinch_event.data.pinch_update.scale > 1 ? 1 : -1;
@@ -47,7 +50,7 @@ blink::WebMouseWheelEvent CreateSyntheticWheelFromTouchpadPinchEvent(
   // modifier set when we see trackpad pinch gestures.  Ideally we'd someday get
   // a platform 'pinch' event and send that instead.
   blink::WebMouseWheelEvent wheel_event(
-      blink::WebInputEvent::kMouseWheel,
+      blink::WebInputEvent::Type::kMouseWheel,
       pinch_event.GetModifiers() | blink::WebInputEvent::kControlKey,
       pinch_event.TimeStamp());
   wheel_event.SetPositionInWidget(pinch_event.PositionInWidget());
@@ -61,9 +64,10 @@ blink::WebMouseWheelEvent CreateSyntheticWheelFromTouchpadPinchEvent(
   wheel_event.wheel_ticks_y = wheel_ticks_y;
 
   if (cancelable)
-    wheel_event.dispatch_type = blink::WebInputEvent::kBlocking;
+    wheel_event.dispatch_type = blink::WebInputEvent::DispatchType::kBlocking;
   else
-    wheel_event.dispatch_type = blink::WebInputEvent::kEventNonBlocking;
+    wheel_event.dispatch_type =
+        blink::WebInputEvent::DispatchType::kEventNonBlocking;
 
   return wheel_event;
 }
@@ -109,7 +113,7 @@ void TouchpadPinchEventQueue::QueueEvent(
       event.latency.Terminate();
 
       last_event->CoalesceWith(event);
-      DCHECK_EQ(blink::WebInputEvent::kGesturePinchUpdate,
+      DCHECK_EQ(blink::WebInputEvent::Type::kGesturePinchUpdate,
                 last_event->event.GetType());
       TRACE_EVENT_INSTANT1("input",
                            "TouchpadPinchEventQueue::CoalescedPinchEvent",
@@ -125,16 +129,17 @@ void TouchpadPinchEventQueue::QueueEvent(
 
 void TouchpadPinchEventQueue::ProcessMouseWheelAck(
     const MouseWheelEventWithLatencyInfo& ack_event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   TRACE_EVENT0("input", "TouchpadPinchEventQueue::ProcessMouseWheelAck");
   if (!pinch_event_awaiting_ack_)
     return;
 
   if (pinch_event_awaiting_ack_->event.GetType() ==
-          blink::WebInputEvent::kGesturePinchUpdate &&
+          blink::WebInputEvent::Type::kGesturePinchUpdate &&
       !first_event_prevented_.has_value())
-    first_event_prevented_ = (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED);
+    first_event_prevented_ =
+        (ack_result == blink::mojom::InputEventResultState::kConsumed);
 
   pinch_event_awaiting_ack_->latency.AddNewLatencyFrom(ack_event.latency);
   client_->OnGestureEventForPinchAck(*pinch_event_awaiting_ack_, ack_source,
@@ -155,10 +160,11 @@ void TouchpadPinchEventQueue::TryForwardNextEventToRenderer() {
   pinch_queue_.pop_front();
 
   if (pinch_event_awaiting_ack_->event.GetType() ==
-      blink::WebInputEvent::kGesturePinchBegin) {
-    client_->OnGestureEventForPinchAck(*pinch_event_awaiting_ack_,
-                                       InputEventAckSource::BROWSER,
-                                       INPUT_EVENT_ACK_STATE_IGNORED);
+      blink::WebInputEvent::Type::kGesturePinchBegin) {
+    client_->OnGestureEventForPinchAck(
+        *pinch_event_awaiting_ack_,
+        blink::mojom::InputEventResultSource::kBrowser,
+        blink::mojom::InputEventResultState::kIgnored);
     pinch_event_awaiting_ack_.reset();
     TryForwardNextEventToRenderer();
     return;
@@ -169,17 +175,17 @@ void TouchpadPinchEventQueue::TryForwardNextEventToRenderer() {
   bool cancelable = true;
 
   if (pinch_event_awaiting_ack_->event.GetType() ==
-      blink::WebInputEvent::kGesturePinchEnd) {
+      blink::WebInputEvent::Type::kGesturePinchEnd) {
     first_event_prevented_.reset();
     phase = blink::WebMouseWheelEvent::kPhaseEnded;
     cancelable = false;
   } else if (pinch_event_awaiting_ack_->event.GetType() ==
-             blink::WebInputEvent::kGestureDoubleTap) {
+             blink::WebInputEvent::Type::kGestureDoubleTap) {
     phase = blink::WebMouseWheelEvent::kPhaseNone;
     cancelable = true;
   } else {
     DCHECK_EQ(pinch_event_awaiting_ack_->event.GetType(),
-              blink::WebInputEvent::kGesturePinchUpdate);
+              blink::WebInputEvent::Type::kGesturePinchUpdate);
     // The first pinch update event should send a synthetic wheel with phase
     // began.
     if (!first_event_prevented_.has_value()) {
diff --git a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.h b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.h
index cc3959fc176..2b861cc534b 100644
--- a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.h
+++ b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.h
@@ -11,9 +11,8 @@
 #include "base/optional.h"
 #include "content/common/content_export.h"
 #include "content/common/input/event_with_latency_info.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -27,16 +26,16 @@ class CONTENT_EXPORT TouchpadPinchEventQueueClient {
 
   using MouseWheelEventHandledCallback =
       base::OnceCallback<void(const MouseWheelEventWithLatencyInfo& event,
-                              InputEventAckSource ack_source,
-                              InputEventAckState ack_result)>;
+                              blink::mojom::InputEventResultSource ack_source,
+                              blink::mojom::InputEventResultState ack_result)>;
 
   virtual void SendMouseWheelEventForPinchImmediately(
       const MouseWheelEventWithLatencyInfo& event,
       MouseWheelEventHandledCallback callback) = 0;
   virtual void OnGestureEventForPinchAck(
       const GestureEventWithLatencyInfo& event,
-      InputEventAckSource ack_source,
-      InputEventAckState ack_result) = 0;
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) = 0;
 };
 
 // A queue for sending synthetic mouse wheel events for touchpad pinches.
@@ -61,8 +60,8 @@ class CONTENT_EXPORT TouchpadPinchEventQueue {
   // Notifies the queue that a synthetic mouse wheel event has been processed
   // by the renderer.
   void ProcessMouseWheelAck(const MouseWheelEventWithLatencyInfo& ack_event,
-                            InputEventAckSource ack_source,
-                            InputEventAckState ack_result);
+                            blink::mojom::InputEventResultSource ack_source,
+                            blink::mojom::InputEventResultState ack_result);
 
   void TryForwardNextEventToRenderer();
 
diff --git a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue_unittest.cc b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue_unittest.cc
index 8748a014370..9c1d2eddc6b 100644
--- a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue_unittest.cc
@@ -10,10 +10,9 @@
 #include "base/test/scoped_feature_list.h"
 #include "content/common/input/event_with_latency_info.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/gfx/geometry/point_f.h"
 #include "ui/latency/latency_info.h"
 
@@ -29,8 +28,8 @@ class MockTouchpadPinchEventQueueClient {
                void(const MouseWheelEventWithLatencyInfo& event));
   MOCK_METHOD3(OnGestureEventForPinchAck,
                void(const GestureEventWithLatencyInfo& event,
-                    InputEventAckSource ack_source,
-                    InputEventAckState ack_result));
+                    blink::mojom::InputEventResultSource ack_source,
+                    blink::mojom::InputEventResultState ack_result));
 };
 
 class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
@@ -54,7 +53,7 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
 
   void QueuePinchBegin() {
     blink::WebGestureEvent event(
-        blink::WebInputEvent::kGesturePinchBegin,
+        blink::WebInputEvent::Type::kGesturePinchBegin,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchpad);
@@ -66,7 +65,7 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
 
   void QueuePinchEnd() {
     blink::WebGestureEvent event(
-        blink::WebInputEvent::kGesturePinchEnd,
+        blink::WebInputEvent::Type::kGesturePinchEnd,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchpad);
@@ -78,7 +77,7 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
 
   void QueuePinchUpdate(float scale, bool zoom_disabled) {
     blink::WebGestureEvent event(
-        blink::WebInputEvent::kGesturePinchUpdate,
+        blink::WebInputEvent::Type::kGesturePinchUpdate,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchpad);
@@ -92,7 +91,7 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
 
   void QueueDoubleTap() {
     blink::WebGestureEvent event(
-        blink::WebInputEvent::kGestureDoubleTap,
+        blink::WebInputEvent::Type::kGestureDoubleTap,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchpad);
@@ -104,11 +103,11 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
   }
 
   using HandleEventCallback =
-      base::OnceCallback<void(InputEventAckSource ack_source,
-                              InputEventAckState ack_result)>;
+      base::OnceCallback<void(blink::mojom::InputEventResultSource ack_source,
+                              blink::mojom::InputEventResultState ack_result)>;
 
-  void SendWheelEventAck(InputEventAckSource ack_source,
-                         InputEventAckState ack_result) {
+  void SendWheelEventAck(blink::mojom::InputEventResultSource ack_source,
+                         blink::mojom::InputEventResultState ack_result) {
     std::move(callbacks_.front()).Run(ack_source, ack_result);
     callbacks_.pop_front();
   }
@@ -120,15 +119,17 @@ class TouchpadPinchEventQueueTest : public testing::TestWithParam<bool>,
     callbacks_.emplace_back(base::BindOnce(
         [](MouseWheelEventHandledCallback callback,
            const MouseWheelEventWithLatencyInfo& event,
-           InputEventAckSource ack_source, InputEventAckState ack_result) {
+           blink::mojom::InputEventResultSource ack_source,
+           blink::mojom::InputEventResultState ack_result) {
           std::move(callback).Run(event, ack_source, ack_result);
         },
         std::move(callback), event));
   }
 
-  void OnGestureEventForPinchAck(const GestureEventWithLatencyInfo& event,
-                                 InputEventAckSource ack_source,
-                                 InputEventAckState ack_result) override {
+  void OnGestureEventForPinchAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override {
     mock_client_.OnGestureEventForPinchAck(event, ack_source, ack_result);
   }
 
@@ -170,7 +171,8 @@ MATCHER(EventHasCtrlModifier,
 
 MATCHER(EventIsBlocking,
         std::string(negation ? "is not" : "is") + " blocking") {
-  return arg.event.dispatch_type == blink::WebInputEvent::kBlocking;
+  return arg.event.dispatch_type ==
+         blink::WebInputEvent::DispatchType::kBlocking;
 }
 
 // Ensure that when the queue receives a touchpad pinch sequence, it sends a
@@ -179,31 +181,33 @@ TEST_P(TouchpadPinchEventQueueTest, Basic) {
   ::testing::InSequence sequence;
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(::testing::AllOf(
                   EventHasCtrlModifier(), ::testing::Not(EventIsBlocking()))));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure the queue sends the wheel events with phase information.
@@ -211,46 +215,48 @@ TEST_P(TouchpadPinchEventQueueTest, MouseWheelPhase) {
   ::testing::InSequence sequence;
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   EventHasPhase(blink::WebMouseWheelEvent::kPhaseBegan)));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   EventHasPhase(blink::WebMouseWheelEvent::kPhaseChanged)));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
                   testing::_, testing::_));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   EventHasPhase(blink::WebMouseWheelEvent::kPhaseEnded)));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchUpdate(1.23, false);
   if (async_events_enabled_) {
-    SendWheelEventAck(InputEventAckSource::BROWSER,
-                      INPUT_EVENT_ACK_STATE_IGNORED);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                      blink::mojom::InputEventResultState::kIgnored);
   } else {
-    SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                      blink::mojom::InputEventResultState::kNoConsumerExists);
   }
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure that if the renderer consumes the synthetic wheel event, the ack of
@@ -259,16 +265,17 @@ TEST_P(TouchpadPinchEventQueueTest, Consumed) {
   ::testing::InSequence sequence;
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())));
-  EXPECT_CALL(
-      mock_client_,
-      OnGestureEventForPinchAck(
-          EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-          InputEventAckSource::MAIN_THREAD, INPUT_EVENT_ACK_STATE_CONSUMED));
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kMainThread,
+                  blink::mojom::InputEventResultState::kConsumed));
 
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(::testing::AllOf(
@@ -276,16 +283,17 @@ TEST_P(TouchpadPinchEventQueueTest, Consumed) {
 
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure that the queue sends wheel events for updates with |zoom_disabled| as
@@ -294,16 +302,17 @@ TEST_P(TouchpadPinchEventQueueTest, ZoomDisabled) {
   ::testing::InSequence sequence;
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists));
 
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(::testing::AllOf(
@@ -311,53 +320,56 @@ TEST_P(TouchpadPinchEventQueueTest, ZoomDisabled) {
 
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, true);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 TEST_P(TouchpadPinchEventQueueTest, MultipleSequences) {
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED))
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored))
       .Times(2);
   EXPECT_CALL(mock_client_, SendMouseWheelEventForPinchImmediately(testing::_))
       .Times(4);
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS))
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists))
       .Times(2);
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED))
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored))
       .Times(2);
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure we can queue additional pinch event sequences while the queue is
@@ -365,8 +377,9 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleSequences) {
 TEST_P(TouchpadPinchEventQueueTest, MultipleQueuedSequences) {
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_, SendMouseWheelEventForPinchImmediately(testing::_));
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
@@ -384,51 +397,55 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleQueuedSequences) {
 
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_, SendMouseWheelEventForPinchImmediately(testing::_))
       .Times(2);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   // ACK for end event.
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 
   // After acking the first wheel event, the queue continues.
   testing::Mock::VerifyAndClearExpectations(&mock_client_);
 
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                  InputEventAckSource::COMPOSITOR_THREAD,
-                  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kCompositorThread,
+                  blink::mojom::InputEventResultState::kNoConsumerExists));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_, SendMouseWheelEventForPinchImmediately(testing::_));
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   // ACK for end event.
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure the queue handles pinch event sequences with multiple updates.
 TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesInSequence) {
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   if (async_events_enabled_) {
     // Only first wheel event is cancelable.
     // Here the second and the third wheel events are not blocking because we
@@ -451,61 +468,66 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesInSequence) {
             EventHasCtrlModifier(), ::testing::Not(EventIsBlocking()))));
   }
   if (async_events_enabled_) {
-    EXPECT_CALL(mock_client_,
-                OnGestureEventForPinchAck(
-                    EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                    InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
     EXPECT_CALL(
         mock_client_,
         OnGestureEventForPinchAck(
-            EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-            InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED))
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kCompositorThread,
+            blink::mojom::InputEventResultState::kNoConsumerExists));
+    EXPECT_CALL(
+        mock_client_,
+        OnGestureEventForPinchAck(
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kBrowser,
+            blink::mojom::InputEventResultState::kIgnored))
         .Times(2);
   } else {
-    EXPECT_CALL(mock_client_,
-                OnGestureEventForPinchAck(
-                    EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                    InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS))
+    EXPECT_CALL(
+        mock_client_,
+        OnGestureEventForPinchAck(
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kCompositorThread,
+            blink::mojom::InputEventResultState::kNoConsumerExists))
         .Times(3);
   }
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   QueuePinchUpdate(1.23, false);
   if (async_events_enabled_) {
-    SendWheelEventAck(InputEventAckSource::BROWSER,
-                      INPUT_EVENT_ACK_STATE_IGNORED);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                      blink::mojom::InputEventResultState::kIgnored);
   } else {
-    SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                      blink::mojom::InputEventResultState::kNoConsumerExists);
   }
   QueuePinchUpdate(1.23, false);
   if (async_events_enabled_) {
-    SendWheelEventAck(InputEventAckSource::BROWSER,
-                      INPUT_EVENT_ACK_STATE_IGNORED);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                      blink::mojom::InputEventResultState::kIgnored);
   } else {
-    SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                      blink::mojom::InputEventResultState::kNoConsumerExists);
   }
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure the queue coalesces pinch update events.
 TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesCoalesced) {
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   if (async_events_enabled_) {
     // Only the first wheel event is cancelable.
     // Here the second wheel is not blocking because we ack the first wheel
@@ -528,28 +550,32 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesCoalesced) {
             EventHasCtrlModifier(), ::testing::Not(EventIsBlocking()))));
   }
   if (async_events_enabled_) {
-    EXPECT_CALL(mock_client_,
-                OnGestureEventForPinchAck(
-                    EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                    InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS));
     EXPECT_CALL(
         mock_client_,
         OnGestureEventForPinchAck(
-            EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-            InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kCompositorThread,
+            blink::mojom::InputEventResultState::kNoConsumerExists));
+    EXPECT_CALL(
+        mock_client_,
+        OnGestureEventForPinchAck(
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kBrowser,
+            blink::mojom::InputEventResultState::kIgnored));
   } else {
-    EXPECT_CALL(mock_client_,
-                OnGestureEventForPinchAck(
-                    EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-                    InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS))
+    EXPECT_CALL(
+        mock_client_,
+        OnGestureEventForPinchAck(
+            EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+            blink::mojom::InputEventResultSource::kCompositorThread,
+            blink::mojom::InputEventResultState::kNoConsumerExists))
         .Times(2);
   }
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   // The queue will send the first wheel event for this first update.
@@ -562,19 +588,19 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesCoalesced) {
   QueuePinchEnd();
 
   // Ack for the wheel event corresponding to the first update.
-  SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                    INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                    blink::mojom::InputEventResultState::kNoConsumerExists);
   // Ack for the wheel event corresponding to the second and third updates.
   if (async_events_enabled_) {
-    SendWheelEventAck(InputEventAckSource::BROWSER,
-                      INPUT_EVENT_ACK_STATE_IGNORED);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                      blink::mojom::InputEventResultState::kIgnored);
   } else {
-    SendWheelEventAck(InputEventAckSource::COMPOSITOR_THREAD,
-                      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    SendWheelEventAck(blink::mojom::InputEventResultSource::kCompositorThread,
+                      blink::mojom::InputEventResultState::kNoConsumerExists);
   }
   // ACK for end event.
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
   EXPECT_FALSE(queue_->has_pending());
 }
 
@@ -583,39 +609,41 @@ TEST_P(TouchpadPinchEventQueueTest, MultipleUpdatesCoalesced) {
 TEST_P(TouchpadPinchEventQueueTest, MultipleCanceledUpdatesInSequence) {
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())))
       .Times(3);
-  EXPECT_CALL(
-      mock_client_,
-      OnGestureEventForPinchAck(
-          EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-          InputEventAckSource::MAIN_THREAD, INPUT_EVENT_ACK_STATE_CONSUMED))
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kMainThread,
+                  blink::mojom::InputEventResultState::kConsumed))
       .Times(3);
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(::testing::AllOf(
                   EventHasCtrlModifier(), ::testing::Not(EventIsBlocking()))));
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
   QueuePinchUpdate(1.23, false);
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
   QueuePinchEnd();
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 // Ensure that when the queue receives a touchpad double tap, it sends a
@@ -627,15 +655,15 @@ TEST_P(TouchpadPinchEventQueueTest, DoubleTap) {
                   EventHasCtrlModifier(), EventIsBlocking(),
                   EventHasPhase(blink::WebMouseWheelEvent::kPhaseNone),
                   EventHasScale(1.0f))));
-  EXPECT_CALL(
-      mock_client_,
-      OnGestureEventForPinchAck(
-          EventHasType(blink::WebInputEvent::kGestureDoubleTap),
-          InputEventAckSource::MAIN_THREAD, INPUT_EVENT_ACK_STATE_CONSUMED));
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGestureDoubleTap),
+                  blink::mojom::InputEventResultSource::kMainThread,
+                  blink::mojom::InputEventResultState::kConsumed));
 
   QueueDoubleTap();
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
 }
 
 // Ensure that ACKs are only processed when they match the event that is
@@ -644,16 +672,17 @@ TEST_P(TouchpadPinchEventQueueTest, IgnoreNonMatchingEvents) {
   ::testing::InSequence sequence;
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchBegin),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchBegin),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(
                   ::testing::AllOf(EventHasCtrlModifier(), EventIsBlocking())));
-  EXPECT_CALL(
-      mock_client_,
-      OnGestureEventForPinchAck(
-          EventHasType(blink::WebInputEvent::kGesturePinchUpdate),
-          InputEventAckSource::MAIN_THREAD, INPUT_EVENT_ACK_STATE_CONSUMED));
+  EXPECT_CALL(mock_client_,
+              OnGestureEventForPinchAck(
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchUpdate),
+                  blink::mojom::InputEventResultSource::kMainThread,
+                  blink::mojom::InputEventResultState::kConsumed));
 
   EXPECT_CALL(mock_client_,
               SendMouseWheelEventForPinchImmediately(::testing::AllOf(
@@ -661,17 +690,18 @@ TEST_P(TouchpadPinchEventQueueTest, IgnoreNonMatchingEvents) {
 
   EXPECT_CALL(mock_client_,
               OnGestureEventForPinchAck(
-                  EventHasType(blink::WebInputEvent::kGesturePinchEnd),
-                  InputEventAckSource::BROWSER, INPUT_EVENT_ACK_STATE_IGNORED));
+                  EventHasType(blink::WebInputEvent::Type::kGesturePinchEnd),
+                  blink::mojom::InputEventResultSource::kBrowser,
+                  blink::mojom::InputEventResultState::kIgnored));
 
   QueuePinchBegin();
   QueuePinchUpdate(1.23, false);
   QueuePinchEnd();
 
-  SendWheelEventAck(InputEventAckSource::MAIN_THREAD,
-                    INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendWheelEventAck(InputEventAckSource::BROWSER,
-                    INPUT_EVENT_ACK_STATE_IGNORED);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kMainThread,
+                    blink::mojom::InputEventResultState::kConsumed);
+  SendWheelEventAck(blink::mojom::InputEventResultSource::kBrowser,
+                    blink::mojom::InputEventResultState::kIgnored);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/input/touchscreen_tap_suppression_controller.cc b/chromium/content/browser/renderer_host/input/touchscreen_tap_suppression_controller.cc
index 2372fb34aa7..ee727f29f3e 100644
--- a/chromium/content/browser/renderer_host/input/touchscreen_tap_suppression_controller.cc
+++ b/chromium/content/browser/renderer_host/input/touchscreen_tap_suppression_controller.cc
@@ -21,17 +21,17 @@ TouchscreenTapSuppressionController::~TouchscreenTapSuppressionController() {}
 bool TouchscreenTapSuppressionController::FilterTapEvent(
     const GestureEventWithLatencyInfo& event) {
   switch (event.event.GetType()) {
-    case WebInputEvent::kGestureTapDown:
+    case WebInputEvent::Type::kGestureTapDown:
       return ShouldSuppressTapDown();
 
-    case WebInputEvent::kGestureShowPress:
-    case WebInputEvent::kGestureLongPress:
-    case WebInputEvent::kGestureTapUnconfirmed:
-    case WebInputEvent::kGestureTapCancel:
-    case WebInputEvent::kGestureTap:
-    case WebInputEvent::kGestureDoubleTap:
-    case WebInputEvent::kGestureLongTap:
-    case WebInputEvent::kGestureTwoFingerTap:
+    case WebInputEvent::Type::kGestureShowPress:
+    case WebInputEvent::Type::kGestureLongPress:
+    case WebInputEvent::Type::kGestureTapUnconfirmed:
+    case WebInputEvent::Type::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureLongTap:
+    case WebInputEvent::Type::kGestureTwoFingerTap:
       return ShouldSuppressTapEnd();
 
     default:
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc b/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
index f000f323bed..c262d74a8f6 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
@@ -6,7 +6,7 @@
 
 #include <android/input.h>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/time/time.h"
 #include "ui/events/android/key_event_utils.h"
 #include "ui/events/base_event_utils.h"
@@ -129,7 +129,8 @@ WebMouseEvent WebMouseEventBuilder::Build(
   int button = action_button;
   // For events other than MouseDown/Up, action_button is not defined. So we are
   // determining |button| value from |modifiers| as is done in other platforms.
-  if (type != WebInputEvent::kMouseDown && type != WebInputEvent::kMouseUp) {
+  if (type != WebInputEvent::Type::kMouseDown &&
+      type != WebInputEvent::Type::kMouseUp) {
     if (modifiers & ui::EF_LEFT_MOUSE_BUTTON)
       button = ui::MotionEvent::BUTTON_PRIMARY;
     else if (modifiers & ui::EF_MIDDLE_MOUSE_BUTTON)
@@ -152,7 +153,7 @@ WebMouseEvent WebMouseEventBuilder::Build(
 
 WebMouseWheelEvent WebMouseWheelEventBuilder::Build(
     const ui::MotionEventAndroid& motion_event) {
-  WebMouseWheelEvent result(WebInputEvent::kMouseWheel,
+  WebMouseWheelEvent result(WebInputEvent::Type::kMouseWheel,
                             WebInputEvent::kNoModifiers,
                             motion_event.GetEventTime());
   result.SetPositionInWidget(motion_event.GetX(0), motion_event.GetY(0));
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_android_unittest.cc b/chromium/content/browser/renderer_host/input/web_input_event_builders_android_unittest.cc
index a10af624c4c..47d7d475576 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_android_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_android_unittest.cc
@@ -37,7 +37,7 @@ WebKeyboardEvent CreateFakeWebKeyboardEvent(JNIEnv* env,
       ui::events::android::CreateKeyEvent(env, 0, key_code);
 
   WebKeyboardEvent web_event = content::WebKeyboardEventBuilder::Build(
-      env, keydown_event, WebKeyboardEvent::kKeyDown, web_modifier,
+      env, keydown_event, WebKeyboardEvent::Type::kKeyDown, web_modifier,
       blink::WebInputEvent::GetStaticTimeStampForTests(), key_code, 0,
       unicode_character, false);
   return web_event;
@@ -162,7 +162,7 @@ TEST(WebInputEventBuilderAndroidTest, LastChannelKey) {
 // Synthetic key event should produce DomKey::UNIDENTIFIED.
 TEST(WebInputEventBuilderAndroidTest, DomKeySyntheticEvent) {
   WebKeyboardEvent web_event = content::WebKeyboardEventBuilder::Build(
-      nullptr, nullptr, WebKeyboardEvent::kKeyDown, 0,
+      nullptr, nullptr, WebKeyboardEvent::Type::kKeyDown, 0,
       blink::WebInputEvent::GetStaticTimeStampForTests(), kCompositionKeyCode,
       0, 0, false);
   EXPECT_EQ(kCompositionKeyCode, web_event.native_key_code);
@@ -219,7 +219,7 @@ TEST(WebInputEventBuilderAndroidTest, WebMouseEventCoordinates) {
       raw_offset_y, false, &p0, nullptr);
 
   WebMouseEvent web_event = content::WebMouseEventBuilder::Build(
-      motion_event, blink::WebInputEvent::kMouseDown, 1,
+      motion_event, blink::WebInputEvent::Type::kMouseDown, 1,
       ui::MotionEvent::BUTTON_PRIMARY);
   EXPECT_EQ(web_event.PositionInWidget().x(), p0.pos_x_pixels * kPixToDip);
   EXPECT_EQ(web_event.PositionInWidget().y(), p0.pos_y_pixels * kPixToDip);
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
index cfc2815a954..9d420f190a7 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
@@ -258,8 +258,8 @@ blink::WebKeyboardEvent WebKeyboardEventBuilder::Build(NSEvent* event,
     modifiers |= blink::WebInputEvent::kIsAutoRepeat;
 
   blink::WebKeyboardEvent result(
-      ui::IsKeyUpEvent(event) ? blink::WebInputEvent::kKeyUp
-                              : blink::WebInputEvent::kRawKeyDown,
+      ui::IsKeyUpEvent(event) ? blink::WebInputEvent::Type::kKeyUp
+                              : blink::WebInputEvent::Type::kRawKeyDown,
       modifiers, ui::EventTimeStampFromSeconds([event timestamp]));
   result.windows_key_code =
       ui::LocatedToNonLocatedKeyboardCode(ui::KeyboardCodeFromNSEvent(event));
@@ -326,53 +326,53 @@ blink::WebMouseEvent WebMouseEventBuilder::Build(
   NSEventType type = [event type];
   switch (type) {
     case NSMouseExited:
-      event_type = blink::WebInputEvent::kMouseLeave;
+      event_type = blink::WebInputEvent::Type::kMouseLeave;
       break;
     case NSLeftMouseDown:
-      event_type = blink::WebInputEvent::kMouseDown;
+      event_type = blink::WebInputEvent::Type::kMouseDown;
       click_count = [event clickCount];
       button = blink::WebMouseEvent::Button::kLeft;
       break;
     case NSOtherMouseDown:
-      event_type = blink::WebInputEvent::kMouseDown;
+      event_type = blink::WebInputEvent::Type::kMouseDown;
       click_count = [event clickCount];
       button = ButtonFromButtonNumber(event);
       break;
     case NSRightMouseDown:
-      event_type = blink::WebInputEvent::kMouseDown;
+      event_type = blink::WebInputEvent::Type::kMouseDown;
       click_count = [event clickCount];
       button = blink::WebMouseEvent::Button::kRight;
       break;
     case NSLeftMouseUp:
-      event_type = blink::WebInputEvent::kMouseUp;
+      event_type = blink::WebInputEvent::Type::kMouseUp;
       click_count = [event clickCount];
       button = blink::WebMouseEvent::Button::kLeft;
       break;
     case NSOtherMouseUp:
-      event_type = blink::WebInputEvent::kMouseUp;
+      event_type = blink::WebInputEvent::Type::kMouseUp;
       click_count = [event clickCount];
       button = ButtonFromButtonNumber(event);
       break;
     case NSRightMouseUp:
-      event_type = blink::WebInputEvent::kMouseUp;
+      event_type = blink::WebInputEvent::Type::kMouseUp;
       click_count = [event clickCount];
       button = blink::WebMouseEvent::Button::kRight;
       break;
     case NSMouseMoved:
     case NSMouseEntered:
-      event_type = blink::WebInputEvent::kMouseMove;
+      event_type = blink::WebInputEvent::Type::kMouseMove;
       button = ButtonFromPressedMouseButtons();
       break;
     case NSLeftMouseDragged:
-      event_type = blink::WebInputEvent::kMouseMove;
+      event_type = blink::WebInputEvent::Type::kMouseMove;
       button = blink::WebMouseEvent::Button::kLeft;
       break;
     case NSOtherMouseDragged:
-      event_type = blink::WebInputEvent::kMouseMove;
+      event_type = blink::WebInputEvent::Type::kMouseMove;
       button = blink::WebMouseEvent::Button::kMiddle;
       break;
     case NSRightMouseDragged:
-      event_type = blink::WebInputEvent::kMouseMove;
+      event_type = blink::WebInputEvent::Type::kMouseMove;
       button = blink::WebMouseEvent::Button::kRight;
       break;
     default:
@@ -414,8 +414,8 @@ blink::WebMouseEvent WebMouseEventBuilder::Build(
     result.twist = twist;
   } else {
     event_type = [event isEnteringProximity]
-                     ? blink::WebInputEvent::kMouseMove
-                     : blink::WebInputEvent::kMouseLeave;
+                     ? blink::WebInputEvent::Type::kMouseMove
+                     : blink::WebInputEvent::Type::kMouseLeave;
     result.SetType(event_type);
   }
   return result;
@@ -438,7 +438,7 @@ blink::WebMouseWheelEvent WebMouseWheelEventBuilder::Build(
       base::TimeDelta::FromMilliseconds(1), base::TimeDelta::FromSeconds(60),
       50);
   blink::WebMouseWheelEvent result(
-      blink::WebInputEvent::kMouseWheel, ModifiersFromEvent(event),
+      blink::WebInputEvent::Type::kMouseWheel, ModifiersFromEvent(event),
       ui::EventTimeStampFromSeconds([event timestamp]));
   result.button = blink::WebMouseEvent::Button::kNoButton;
 
@@ -601,7 +601,7 @@ blink::WebGestureEvent WebGestureEventBuilder::Build(NSEvent* event,
       // We don't need to set the type based on |[event phase]| as the caller
       // must set the begin and end types in order to support older Mac
       // versions.
-      result.SetType(blink::WebInputEvent::kGesturePinchUpdate);
+      result.SetType(blink::WebInputEvent::Type::kGesturePinchUpdate);
       result.data.pinch_update.scale = [event magnification] + 1.0;
       result.SetNeedsWheelEvent(true);
       break;
@@ -610,7 +610,7 @@ blink::WebGestureEvent WebGestureEventBuilder::Build(NSEvent* event,
       // GestureDoubleTap, because the effect is similar to single-finger
       // double-tap zoom on mobile platforms. Note that tapCount is set to 1
       // because the gesture type already encodes that information.
-      result.SetType(blink::WebInputEvent::kGestureDoubleTap);
+      result.SetType(blink::WebInputEvent::Type::kGestureDoubleTap);
       result.data.tap.tap_count = 1;
       result.SetNeedsWheelEvent(true);
       break;
@@ -640,15 +640,16 @@ blink::WebTouchEvent WebTouchEventBuilder::Build(NSEvent* event, NSView* view) {
   blink::WebInputEvent::Type event_type =
       blink::WebInputEvent::Type::kUndefined;
   NSEventType type = [event type];
-  blink::WebTouchPoint::State state = blink::WebTouchPoint::kStateUndefined;
+  blink::WebTouchPoint::State state =
+      blink::WebTouchPoint::State::kStateUndefined;
   switch (type) {
     case NSLeftMouseDown:
-      event_type = blink::WebInputEvent::kTouchStart;
-      state = blink::WebTouchPoint::kStatePressed;
+      event_type = blink::WebInputEvent::Type::kTouchStart;
+      state = blink::WebTouchPoint::State::kStatePressed;
       break;
     case NSLeftMouseUp:
-      event_type = blink::WebInputEvent::kTouchEnd;
-      state = blink::WebTouchPoint::kStateReleased;
+      event_type = blink::WebInputEvent::Type::kTouchEnd;
+      state = blink::WebTouchPoint::State::kStateReleased;
       break;
     case NSLeftMouseDragged:
     case NSRightMouseDragged:
@@ -658,8 +659,8 @@ blink::WebTouchEvent WebTouchEventBuilder::Build(NSEvent* event, NSView* view) {
     case NSOtherMouseDown:
     case NSRightMouseUp:
     case NSOtherMouseUp:
-      event_type = blink::WebInputEvent::kTouchMove;
-      state = blink::WebTouchPoint::kStateMoved;
+      event_type = blink::WebInputEvent::Type::kTouchMove;
+      state = blink::WebTouchPoint::State::kStateMoved;
       break;
     default:
       NOTREACHED() << "Invalid types for touch events." << type;
@@ -680,7 +681,7 @@ blink::WebTouchEvent WebTouchEventBuilder::Build(NSEvent* event, NSView* view) {
         50);
   }
   ui::ComputeEventLatencyOS(event);
-  result.hovering = event_type == blink::WebInputEvent::kTouchEnd;
+  result.hovering = event_type == blink::WebInputEvent::Type::kTouchEnd;
   result.unique_touch_event_id = ui::GetNextTouchEventId();
   result.touches_length = 1;
 
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac_unittest.mm b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac_unittest.mm
index 48cfd56bb4a..54573ecd6e4 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac_unittest.mm
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac_unittest.mm
@@ -208,7 +208,7 @@ TEST(WebInputEventFactoryTestMac, SimultaneousModifierKeys) {
         left.mac_key_code, 0, left.left_or_right_mask | left.non_specific_mask,
         NSFlagsChanged);
     WebKeyboardEvent web_event = WebKeyboardEventBuilder::Build(mac_event);
-    EXPECT_EQ(WebInputEvent::kRawKeyDown, web_event.GetType());
+    EXPECT_EQ(WebInputEvent::Type::kRawKeyDown, web_event.GetType());
     // Press the right key
     mac_event =
         BuildFakeKeyEvent(right.mac_key_code, 0,
@@ -216,7 +216,7 @@ TEST(WebInputEventFactoryTestMac, SimultaneousModifierKeys) {
                               left.non_specific_mask,
                           NSFlagsChanged);
     web_event = WebKeyboardEventBuilder::Build(mac_event);
-    EXPECT_EQ(WebInputEvent::kRawKeyDown, web_event.GetType());
+    EXPECT_EQ(WebInputEvent::Type::kRawKeyDown, web_event.GetType());
     // Release the right key
     mac_event = BuildFakeKeyEvent(
         right.mac_key_code, 0, left.left_or_right_mask | left.non_specific_mask,
@@ -224,7 +224,7 @@ TEST(WebInputEventFactoryTestMac, SimultaneousModifierKeys) {
     // Release the left key
     mac_event = BuildFakeKeyEvent(left.mac_key_code, 0, 0, NSFlagsChanged);
     web_event = WebKeyboardEventBuilder::Build(mac_event);
-    EXPECT_EQ(WebInputEvent::kKeyUp, web_event.GetType());
+    EXPECT_EQ(WebInputEvent::Type::kKeyUp, web_event.GetType());
   }
 }
 
@@ -236,10 +236,10 @@ TEST(WebInputEventBuilderMacTest, MissingUndocumentedModifierFlags) {
     NSEvent* mac_event = BuildFakeKeyEvent(
         key.mac_key_code, 0, key.non_specific_mask, NSFlagsChanged);
     WebKeyboardEvent web_event = WebKeyboardEventBuilder::Build(mac_event);
-    EXPECT_EQ(WebInputEvent::kRawKeyDown, web_event.GetType());
+    EXPECT_EQ(WebInputEvent::Type::kRawKeyDown, web_event.GetType());
     mac_event = BuildFakeKeyEvent(key.mac_key_code, 0, 0, NSFlagsChanged);
     web_event = WebKeyboardEventBuilder::Build(mac_event);
-    EXPECT_EQ(WebInputEvent::kKeyUp, web_event.GetType());
+    EXPECT_EQ(WebInputEvent::Type::kKeyUp, web_event.GetType());
   }
 }
 
@@ -785,11 +785,12 @@ TEST(WebInputEventBuilderMacTest, BuildWebTouchEvents) {
                                       defer:NO];
   blink::WebTouchEvent touch_event =
       content::WebTouchEventBuilder::Build(mac_event, [window contentView]);
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart, touch_event.GetType());
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart, touch_event.GetType());
   EXPECT_FALSE(touch_event.hovering);
   EXPECT_EQ(1U, touch_event.touches_length);
   EXPECT_EQ(gfx::PointF(6, 9), touch_event.touches[0].PositionInScreen());
-  EXPECT_EQ(blink::WebTouchPoint::kStatePressed, touch_event.touches[0].state);
+  EXPECT_EQ(blink::WebTouchPoint::State::kStatePressed,
+            touch_event.touches[0].state);
   EXPECT_EQ(blink::WebPointerProperties::PointerType::kPen,
             touch_event.touches[0].pointer_type);
   EXPECT_EQ(0, touch_event.touches[0].id);
@@ -817,7 +818,7 @@ TEST(WebInputEventBuilderMacTest, BuildWebMouseEventsWithBackButton) {
                                       defer:NO];
   blink::WebMouseEvent mouse_event =
       content::WebMouseEventBuilder::Build(mac_event, [window contentView]);
-  EXPECT_EQ(blink::WebInputEvent::kMouseDown, mouse_event.GetType());
+  EXPECT_EQ(blink::WebInputEvent::Type::kMouseDown, mouse_event.GetType());
   EXPECT_EQ(gfx::PointF(6, 9), mouse_event.PositionInScreen());
   EXPECT_EQ(blink::WebPointerProperties::PointerType::kMouse,
             mouse_event.pointer_type);
@@ -839,7 +840,7 @@ TEST(WebInputEventBuilderMacTest, BuildWebMouseEventsWithForwardButton) {
                                       defer:NO];
   blink::WebMouseEvent mouse_event =
       content::WebMouseEventBuilder::Build(mac_event, [window contentView]);
-  EXPECT_EQ(blink::WebInputEvent::kMouseDown, mouse_event.GetType());
+  EXPECT_EQ(blink::WebInputEvent::Type::kMouseDown, mouse_event.GetType());
   EXPECT_EQ(gfx::PointF(6, 9), mouse_event.PositionInScreen());
   EXPECT_EQ(blink::WebPointerProperties::PointerType::kMouse,
             mouse_event.pointer_type);
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_util_unittest.cc b/chromium/content/browser/renderer_host/input/web_input_event_util_unittest.cc
index 13dd91b2fc4..7026fd449f7 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_util_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/web_input_event_util_unittest.cc
@@ -47,13 +47,13 @@ TEST(WebInputEventUtilTest, MotionEventConversion) {
     event.set_unique_event_id(123456U);
 
     WebTouchEvent expected_event(
-        WebInputEvent::kTouchStart,
+        WebInputEvent::Type::kTouchStart,
         WebInputEvent::kShiftKey | WebInputEvent::kAltKey,
         event.GetEventTime());
     expected_event.touches_length = 1;
     WebTouchPoint expected_pointer;
     expected_pointer.id = pointer.id;
-    expected_pointer.state = WebTouchPoint::kStatePressed;
+    expected_pointer.state = WebTouchPoint::State::kStatePressed;
     expected_pointer.SetPositionInWidget(pointer.x, pointer.y);
     expected_pointer.SetPositionInScreen(pointer.raw_x, pointer.raw_y);
     expected_pointer.radius_x = pointer.touch_major / 2.f;
@@ -109,7 +109,7 @@ TEST(WebInputEventUtilTest, ScrollUpdateConversion) {
 
   blink::WebGestureEvent web_event =
       ui::CreateWebGestureEventFromGestureEventData(event);
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, web_event.GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate, web_event.GetType());
   EXPECT_EQ(0, web_event.GetModifiers());
   EXPECT_EQ(timestamp, web_event.TimeStamp());
   EXPECT_EQ(pos, web_event.PositionInWidget());
diff --git a/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc b/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
index 3e516217778..cfbe402cf7e 100644
--- a/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -50,11 +51,8 @@ namespace content {
 
 class WheelEventListenerBrowserTest : public ContentBrowserTest {
  public:
-  WheelEventListenerBrowserTest() {
-    feature_list_.InitWithFeatures(
-        {features::kPassiveDocumentWheelEventListeners}, {});
-  }
-  ~WheelEventListenerBrowserTest() override {}
+  WheelEventListenerBrowserTest() = default;
+  ~WheelEventListenerBrowserTest() override = default;
 
  protected:
   RenderWidgetHostImpl* GetWidgetHost() {
@@ -80,7 +78,7 @@ class WheelEventListenerBrowserTest : public ContentBrowserTest {
   void ScrollByMouseWheel() {
     // Send a wheel event and wait for its ack.
     auto wheel_msg_watcher = std::make_unique<InputMsgWatcher>(
-        GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+        GetWidgetHost(), blink::WebInputEvent::Type::kMouseWheel);
     double x = 10;
     double y = 10;
     blink::WebMouseWheelEvent wheel_event =
@@ -89,7 +87,7 @@ class WheelEventListenerBrowserTest : public ContentBrowserTest {
             ui::ScrollGranularity::kScrollByPrecisePixel);
     wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
     GetWidgetHost()->ForwardWheelEvent(wheel_event);
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
+    EXPECT_EQ(blink::mojom::InputEventResultState::kSetNonBlocking,
               wheel_msg_watcher->WaitForAck());
   }
 
diff --git a/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc b/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
index 750ed7e8a6c..97e202bdc4c 100644
--- a/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -125,7 +126,7 @@ class WheelScrollLatchingBrowserTest : public ContentBrowserTest {
     return value;
   }
   std::string ExecuteScriptAndExtractString(const std::string& script) {
-    std::string value = "";
+    std::string value;
     EXPECT_TRUE(content::ExecuteScriptAndExtractString(
         shell(), "domAutomationController.send(" + script + ")", &value));
     return value;
@@ -153,7 +154,7 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest, MAYBE_WheelEventTarget) {
       shell()->web_contents()->GetRenderViewHost()->GetWidget());
 
   auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+      GetWidgetHost(), blink::WebInputEvent::Type::kMouseWheel);
 
   float scrollable_div_top = ExecuteScriptAndExtractDouble(
       "scrollableDiv.getBoundingClientRect().top");
@@ -175,7 +176,7 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest, MAYBE_WheelEventTarget) {
                                     ui::LatencyInfo());
 
   // Runs until we get the InputMsgAck callback.
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
             input_msg_watcher->WaitForAck());
 
   while (ExecuteScriptAndExtractDouble("document.scrollingElement.scrollTop") <
@@ -207,7 +208,7 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
   EXPECT_EQ(0, ExecuteScriptAndExtractInt("scrollableDivWheelEventCounter"));
 
   auto update_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kGestureScrollUpdate);
+      GetWidgetHost(), blink::WebInputEvent::Type::kGestureScrollUpdate);
 
   float scrollable_div_top = ExecuteScriptAndExtractDouble(
       "scrollableDiv.getBoundingClientRect().top");
@@ -228,7 +229,8 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
                                     ui::LatencyInfo());
 
   // Runs until we get the UpdateMsgAck callback.
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, update_msg_watcher->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            update_msg_watcher->WaitForAck());
 
   EXPECT_EQ(
       0, ExecuteScriptAndExtractDouble("document.scrollingElement.scrollTop"));
@@ -244,7 +246,8 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
                                     ui::LatencyInfo());
 
   // Runs until we get the UpdateMsgAck callbacks.
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, update_msg_watcher->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            update_msg_watcher->WaitForAck());
 
   // Wait for the document event listenr to handle the second wheel event.
   while (ExecuteScriptAndExtractInt("documentWheelEventCounter") != 1) {
@@ -285,7 +288,7 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
 #endif
   // Send a GSB event to start scrolling the scrollableDiv.
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchpad);
@@ -300,7 +303,8 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
 
   // Send the first GSU event.
   blink::WebGestureEvent gesture_scroll_update(gesture_scroll_begin);
-  gesture_scroll_update.SetType(blink::WebGestureEvent::kGestureScrollUpdate);
+  gesture_scroll_update.SetType(
+      blink::WebGestureEvent::Type::kGestureScrollUpdate);
   gesture_scroll_update.data.scroll_update.delta_units =
       precise ? ui::ScrollGranularity::kScrollByPrecisePixel
               : ui::ScrollGranularity::kScrollByPixel;
@@ -378,7 +382,7 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
 
   // Send the first wheel event.
   auto wheel_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+      GetWidgetHost(), blink::WebInputEvent::Type::kMouseWheel);
   blink::WebMouseWheelEvent wheel_event =
       SyntheticWebMouseWheelEventBuilder::Build(
           x, y, x, y, 1, 1, 0, ui::ScrollGranularity::kScrollByPrecisePixel);
@@ -387,18 +391,19 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
                                     ui::LatencyInfo());
 
   // Run until we get the callback, then check the target.
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED, wheel_msg_watcher->WaitForAck());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kConsumed,
+            wheel_msg_watcher->WaitForAck());
   EXPECT_EQ("blueDiv", ExecuteScriptAndExtractString("domTarget"));
 
   // Send the second wheel event.
   wheel_msg_watcher = std::make_unique<InputMsgWatcher>(
-      GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+      GetWidgetHost(), blink::WebInputEvent::Type::kMouseWheel);
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseChanged;
   GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
                                     ui::LatencyInfo());
 
   // Run until we get the callback, then check the target.
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
             wheel_msg_watcher->WaitForAck());
   EXPECT_EQ("redDiv", ExecuteScriptAndExtractString("domTarget"));
 }
diff --git a/chromium/content/browser/renderer_host/legacy_render_widget_host_win.cc b/chromium/content/browser/renderer_host/legacy_render_widget_host_win.cc
index 18473579fb5..62db60a3494 100644
--- a/chromium/content/browser/renderer_host/legacy_render_widget_host_win.cc
+++ b/chromium/content/browser/renderer_host/legacy_render_widget_host_win.cc
@@ -544,36 +544,20 @@ LegacyRenderWidgetHostHWND::GetOrCreateBrowserAccessibilityRoot() {
 
   BrowserAccessibility* root_node = manager->GetRoot();
 
-  // A datetime popup will have a second window with its own kRootWebArea.
-  // However, the BrowserAccessibilityManager is shared with the main window,
-  // and the popup window's kRootWebArea will be inserted as a sibling of the
-  // popup button. When this is called on a popup, we must return the popup
-  // window's kRootWebArea instead of the root document's kRootWebArea. This
-  // will ensure that we're not placing duplicate document roots in the
-  // accessibility tree.
+  // Popups with HTML content (such as <input type="date">) will create a new
+  // HWND with its own fragment root, but will also inject accessible nodes into
+  // the main document's accessibility tree, thus sharing a
+  // BrowserAccessibilityManager with the main document (see documentation for
+  // BrowserAccessibilityManager::child_root_id_). We can't return the same root
+  // node as the main document, as that will cause a cardinality problem - there
+  // would be two different HWND's pointing to the same root. The popup HWND
+  // should return the root of the popup, not the root of the main document
   if (host_->GetWidgetType() == WidgetType::kPopup) {
-    OneShotAccessibilityTreeSearch tree_search(root_node);
-    tree_search.SetStartNode(root_node);
-    tree_search.SetDirection(OneShotAccessibilityTreeSearch::FORWARDS);
-    tree_search.SetImmediateDescendantsOnly(false);
-    tree_search.SetCanWrapToLastElement(false);
-    tree_search.AddPredicate(AccessibilityPopupButtonPredicate);
-
-    size_t matches = tree_search.CountMatches();
-    for (size_t i = 0; i < matches; ++i) {
-      BrowserAccessibility* match = tree_search.GetMatchAtIndex(i);
-      DCHECK(match);
-
-      // The web root should be the next sibling of the popup node, however it
-      // is not created instantly, so sometimes the popup window exists before
-      // the popup's kRootWebArea has been added to the tree. In this case we
-      // will fall back to the main document's root.
-      BrowserAccessibility* popup_web_root = match->PlatformGetNextSibling();
-      if (popup_web_root &&
-          popup_web_root->GetRole() == ax::mojom::Role::kRootWebArea) {
-        return popup_web_root->GetNativeViewAccessible();
-      }
-    }
+    // Check to see if the manager has a child root (it's expected that there
+    // won't be in popups without HTML-based content such as <select> controls).
+    BrowserAccessibility* child_root = manager->GetPopupRoot();
+    if (child_root)
+      return child_root->GetNativeViewAccessible();
   }
 
   return root_node->GetNativeViewAccessible();
diff --git a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
index a5bcb6f1302..9733c1d6787 100644
--- a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
@@ -282,7 +282,7 @@ class MediaDevicesDispatcherHostTest
           enumerated_devices_[blink::MEDIA_DEVICE_TYPE_AUDIO_OUTPUT].empty());
 
     EXPECT_FALSE(DoesContainRawIds(enumerated_devices_));
-#if defined(OS_ANDROID)
+#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
     EXPECT_TRUE(DoesEveryDeviceMapToRawId(enumerated_devices_, origin_));
 #else
     EXPECT_EQ(DoesEveryDeviceMapToRawId(enumerated_devices_, origin_),
diff --git a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index 1a3b5b446bb..cf2716e593b 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
@@ -8,7 +8,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/task/post_task.h"
 #include "base/task_runner_util.h"
 #include "content/browser/bad_message.h"
diff --git a/chromium/content/browser/renderer_host/media/media_stream_manager.cc b/chromium/content/browser/renderer_host/media/media_stream_manager.cc
index b294ff66428..3d4610db625 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_manager.cc
@@ -527,7 +527,8 @@ class MediaStreamManager::DeviceRequest {
         requesting_process_id, requesting_frame_id, page_request_id,
         salt_and_origin.origin.GetURL(), user_gesture, request_type_,
         requested_audio_device_id, requested_video_device_id, audio_type_,
-        video_type_, controls.disable_local_echo));
+        video_type_, controls.disable_local_echo,
+        controls.request_pan_tilt_zoom_permission));
   }
 
   // Creates a tab capture specific MediaStreamRequest object that is used by
@@ -540,7 +541,8 @@ class MediaStreamManager::DeviceRequest {
     ui_request_.reset(new MediaStreamRequest(
         target_render_process_id, target_render_frame_id, page_request_id,
         salt_and_origin.origin.GetURL(), user_gesture, request_type_, "", "",
-        audio_type_, video_type_, controls.disable_local_echo));
+        audio_type_, video_type_, controls.disable_local_echo,
+        /*request_pan_tilt_zoom_permission=*/false));
   }
 
   bool HasUIRequest() const { return ui_request_.get() != nullptr; }
@@ -1945,6 +1947,8 @@ void MediaStreamManager::Opened(
     for (MediaStreamDevice& device : request->devices) {
       if (device.type == stream_type &&
           device.session_id() == capture_session_id) {
+        if (request->state(device.type) == MEDIA_REQUEST_STATE_DONE)
+          continue;
         CHECK_EQ(request->state(device.type), MEDIA_REQUEST_STATE_OPENING);
         // We've found a matching request.
         request->SetState(device.type, MEDIA_REQUEST_STATE_DONE);
diff --git a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy.cc b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy.cc
index a5d08e213be..4966540938f 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy.cc
@@ -48,14 +48,14 @@ void SetAndCheckAncestorFlag(MediaStreamRequest* request) {
     // RenderFrame destroyed before the request is handled?
     return;
   }
-  FrameTreeNode* node = rfh->frame_tree_node();
 
-  while (node->parent() != nullptr) {
-    if (!node->HasSameOrigin(*node->parent())) {
+  while (rfh->GetParent()) {
+    if (!rfh->GetLastCommittedOrigin().IsSameOriginWith(
+            rfh->GetParent()->GetLastCommittedOrigin())) {
       request->all_ancestors_have_same_origin =  false;
       return;
     }
-    node = node->parent();
+    rfh = rfh->GetParent();
   }
   request->all_ancestors_have_same_origin = true;
 }
diff --git a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
index 655de78a0a4..d8bd747edd1 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
@@ -117,7 +117,8 @@ TEST_F(MediaStreamUIProxyTest, Deny) {
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(),
       blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
-      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
   proxy_->RequestAccess(
       std::move(request),
@@ -149,7 +150,8 @@ TEST_F(MediaStreamUIProxyTest, AcceptAndStart) {
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(),
       blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
-      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
   proxy_->RequestAccess(
       std::move(request),
@@ -190,7 +192,8 @@ TEST_F(MediaStreamUIProxyTest, DeleteBeforeAccepted) {
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(),
       blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
-      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
   proxy_->RequestAccess(
       std::move(request),
@@ -218,7 +221,8 @@ TEST_F(MediaStreamUIProxyTest, StopFromUI) {
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(),
       blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
-      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
   proxy_->RequestAccess(
       std::move(request),
@@ -268,7 +272,8 @@ TEST_F(MediaStreamUIProxyTest, WindowIdCallbackCalled) {
   auto request = std::make_unique<MediaStreamRequest>(
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(), blink::mojom::MediaStreamType::NO_SERVICE,
-      blink::mojom::MediaStreamType::GUM_DESKTOP_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::GUM_DESKTOP_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
 
   proxy_->RequestAccess(
@@ -308,7 +313,8 @@ TEST_F(MediaStreamUIProxyTest, ChangeSourceFromUI) {
       0, 0, 0, GURL("http://origin/"), false, blink::MEDIA_GENERATE_STREAM,
       std::string(), std::string(),
       blink::mojom::MediaStreamType::GUM_DESKTOP_AUDIO_CAPTURE,
-      blink::mojom::MediaStreamType::GUM_DESKTOP_VIDEO_CAPTURE, false);
+      blink::mojom::MediaStreamType::GUM_DESKTOP_VIDEO_CAPTURE,
+      /*disable_local_echo=*/false, /*request_pan_tilt_zoom_permission=*/false);
   MediaStreamRequest* request_ptr = request.get();
   proxy_->RequestAccess(
       std::move(request),
@@ -404,7 +410,9 @@ class MediaStreamUIProxyFeaturePolicyTest
     return std::make_unique<MediaStreamRequest>(
         rfh->GetProcess()->GetID(), rfh->GetRoutingID(), 0,
         rfh->GetLastCommittedURL(), false, blink::MEDIA_GENERATE_STREAM,
-        std::string(), std::string(), mic_type, cam_type, false);
+        std::string(), std::string(), mic_type, cam_type,
+        /*disable_local_echo=*/false,
+        /*request_pan_tilt_zoom_permission=*/false);
   }
 
  private:
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
index 5f6204541d9..fd591ee5428 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
@@ -10,8 +10,8 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
 #include "base/task/post_task.h"
 #include "base/trace_event/trace_event.h"
@@ -34,7 +34,6 @@
 #include "media/base/audio_parameters.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "url/origin.h"
 
@@ -117,8 +116,7 @@ class RenderFrameAudioInputStreamFactory::Core final
       const base::UnguessableToken& session_id,
       const media::AudioParameters& audio_params,
       bool automatic_gain_control,
-      uint32_t shared_memory_count,
-      audio::mojom::AudioProcessingConfigPtr processing_config) final;
+      uint32_t shared_memory_count) final;
 
   void AssociateInputAndOutputForAec(
       const base::UnguessableToken& input_stream_id,
@@ -220,8 +218,7 @@ void RenderFrameAudioInputStreamFactory::Core::CreateStream(
     const base::UnguessableToken& session_id,
     const media::AudioParameters& audio_params,
     bool automatic_gain_control,
-    uint32_t shared_memory_count,
-    audio::mojom::AudioProcessingConfigPtr processing_config) {
+    uint32_t shared_memory_count) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   TRACE_EVENT1("audio", "RenderFrameAudioInputStreamFactory::CreateStream",
                "session id", session_id.ToString());
@@ -264,8 +261,7 @@ void RenderFrameAudioInputStreamFactory::Core::CreateStream(
   } else {
     forwarding_factory_->CreateInputStream(
         process_id_, frame_id_, device->id, audio_params, shared_memory_count,
-        automatic_gain_control, std::move(processing_config),
-        std::move(client));
+        automatic_gain_control, std::move(client));
 
     // Only count for captures from desktop media picker dialog and system loop
     // back audio.
@@ -326,12 +322,11 @@ void RenderFrameAudioInputStreamFactory::Core::
   } else {
     EnumerateOutputDevices(
         media_stream_manager_,
-        base::BindRepeating(
-            &TranslateDeviceId, output_device_id, salt_and_origin,
-            base::BindRepeating(&RenderFrameAudioInputStreamFactory::Core::
-                                    AssociateTranslatedOutputDeviceForAec,
-                                weak_ptr_factory_.GetWeakPtr(),
-                                input_stream_id)));
+        base::BindOnce(&TranslateDeviceId, output_device_id, salt_and_origin,
+                       base::BindRepeating(
+                           &RenderFrameAudioInputStreamFactory::Core::
+                               AssociateTranslatedOutputDeviceForAec,
+                           weak_ptr_factory_.GetWeakPtr(), input_stream_id)));
   }
 }
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
index bf23f7aa2df..115a2967682 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
@@ -107,7 +107,6 @@ class MAYBE_RenderFrameAudioInputStreamFactoryTest
         uint32_t shared_memory_count,
         bool enable_agc,
         base::ReadOnlySharedMemoryRegion key_press_count_buffer,
-        audio::mojom::AudioProcessingConfigPtr processing_config,
         CreateInputStreamCallback created_callback) override {
       last_created_callback = std::move(created_callback);
     }
@@ -212,7 +211,7 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
   mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
-                               kSharedMemoryCount, nullptr);
+                               kSharedMemoryCount);
 
   base::RunLoop().RunUntilIdle();
 
@@ -239,7 +238,7 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
   mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
-                               kSharedMemoryCount, nullptr);
+                               kSharedMemoryCount);
 
   base::RunLoop().RunUntilIdle();
 
@@ -267,7 +266,7 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
   mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
-                               kSharedMemoryCount, nullptr);
+                               kSharedMemoryCount);
 
   base::RunLoop().RunUntilIdle();
 
@@ -285,7 +284,7 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
   mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
-                               kSharedMemoryCount, nullptr);
+                               kSharedMemoryCount);
 
   base::RunLoop().RunUntilIdle();
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
index ed0cd88443d..6c2363b02ef 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
@@ -10,10 +10,10 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/containers/flat_set.h"
 #include "base/containers/unique_ptr_adapters.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
 #include "base/task/post_task.h"
@@ -74,8 +74,7 @@ class RenderFrameAudioOutputStreamFactory::Core final
     void Acquire(
         const media::AudioParameters& params,
         mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
-            provider_client,
-        const base::Optional<base::UnguessableToken>& processing_id) final {
+            provider_client) final {
       DCHECK_CURRENTLY_ON(BrowserThread::IO);
       TRACE_EVENT1("audio",
                    "RenderFrameAudioOutputStreamFactory::ProviderImpl::Acquire",
@@ -85,7 +84,7 @@ class RenderFrameAudioOutputStreamFactory::Core final
           owner_->forwarding_factory_;
       if (factory) {
         factory->CreateOutputStream(owner_->process_id_, owner_->frame_id_,
-                                    device_id_, params, processing_id,
+                                    device_id_, params,
                                     std::move(provider_client));
       }
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
index 07247f80b43..1950b393af9 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
@@ -97,7 +97,6 @@ class RenderFrameAudioOutputStreamFactoryTest
         const std::string& output_device_id,
         const media::AudioParameters& params,
         const base::UnguessableToken& group_id,
-        const base::Optional<base::UnguessableToken>& processing_id,
         CreateOutputStreamCallback created_callback) override {
       last_created_callback = std::move(created_callback);
     }
@@ -210,7 +209,7 @@ TEST_F(RenderFrameAudioOutputStreamFactoryTest,
   {
     mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
     ignore_result(client.InitWithNewPipeAndPassReceiver());
-    provider_remote->Acquire(kParams, std::move(client), base::nullopt);
+    provider_remote->Acquire(kParams, std::move(client));
   }
 
   audio::mojom::StreamFactory::CreateOutputStreamCallback created_callback;
@@ -247,7 +246,7 @@ TEST_F(RenderFrameAudioOutputStreamFactoryTest,
   {
     mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
     ignore_result(client.InitWithNewPipeAndPassReceiver());
-    provider_remote->Acquire(kParams, std::move(client), base::nullopt);
+    provider_remote->Acquire(kParams, std::move(client));
   }
 
   base::RunLoop().RunUntilIdle();
diff --git a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
index 21c851fb45f..9d85f8cbd22 100644
--- a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
+++ b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
@@ -143,7 +143,9 @@ void ServiceVideoCaptureDeviceLauncher::LaunchDeviceAsync(
 
   // GpuMemoryBuffer-based VideoCapture buffer works only on the Chrome OS
   // VideoCaptureDevice implementation.
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableVideoCaptureUseGpuMemoryBuffer) &&
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kVideoCaptureUseGpuMemoryBuffer)) {
     new_params.buffer_type = media::VideoCaptureBufferType::kGpuMemoryBuffer;
   }
diff --git a/chromium/content/browser/renderer_host/media/video_capture_browsertest.cc b/chromium/content/browser/renderer_host/media/video_capture_browsertest.cc
index 767a0dd4ec7..f0373bbb0b4 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_browsertest.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/media_switches.h"
diff --git a/chromium/content/browser/renderer_host/mock_render_widget_host.cc b/chromium/content/browser/renderer_host/mock_render_widget_host.cc
index a792ff92161..0f89709e10e 100644
--- a/chromium/content/browser/renderer_host/mock_render_widget_host.cc
+++ b/chromium/content/browser/renderer_host/mock_render_widget_host.cc
@@ -35,8 +35,8 @@ MockRenderWidgetHost::~MockRenderWidgetHost() {}
 
 void MockRenderWidgetHost::OnTouchEventAck(
     const TouchEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   // Sniff touch acks.
   acked_touch_event_type_ = event.event.GetType();
   RenderWidgetHostImpl::OnTouchEventAck(event, ack_source, ack_result);
@@ -102,7 +102,7 @@ MockRenderWidgetHost::MockRenderWidgetHost(
       new_content_rendering_timeout_fired_(false),
       widget_impl_(std::move(widget_impl)),
       fling_scheduler_(std::make_unique<FlingScheduler>(this)) {
-  acked_touch_event_type_ = blink::WebInputEvent::kUndefined;
+  acked_touch_event_type_ = blink::WebInputEvent::Type::kUndefined;
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/mock_render_widget_host.h b/chromium/content/browser/renderer_host/mock_render_widget_host.h
index 9ca0631ab04..4579309695f 100644
--- a/chromium/content/browser/renderer_host/mock_render_widget_host.h
+++ b/chromium/content/browser/renderer_host/mock_render_widget_host.h
@@ -10,12 +10,11 @@
 #include "content/browser/renderer_host/input/mock_input_router.h"
 #include "content/common/input/event_with_latency_info.h"
 #include "content/common/input/input_handler.mojom.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/mock_widget_input_handler.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace content {
 
@@ -34,8 +33,8 @@ class MockRenderWidgetHost : public RenderWidgetHostImpl {
   ~MockRenderWidgetHost() override;
 
   void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
 
   void reset_new_content_rendering_timeout_fired() {
     new_content_rendering_timeout_fired_ = false;
diff --git a/chromium/content/browser/renderer_host/native_web_keyboard_event_aura.cc b/chromium/content/browser/renderer_host/native_web_keyboard_event_aura.cc
index 7c416533c4a..efd25d602c1 100644
--- a/chromium/content/browser/renderer_host/native_web_keyboard_event_aura.cc
+++ b/chromium/content/browser/renderer_host/native_web_keyboard_event_aura.cc
@@ -4,7 +4,6 @@
 
 #include "content/public/browser/native_web_keyboard_event.h"
 
-#include "base/logging.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/web_input_event.h"
 #include "ui/events/event.h"
@@ -60,11 +59,11 @@ class TranslatedKeyEvent : public ui::KeyEvent {
   static TranslatedKeyEvent* Create(const blink::WebKeyboardEvent& web_event) {
     ui::EventType type = ui::ET_KEY_RELEASED;
     bool is_char = false;
-    if (web_event.GetType() == blink::WebInputEvent::kChar) {
+    if (web_event.GetType() == blink::WebInputEvent::Type::kChar) {
       is_char = true;
       type = ui::ET_KEY_PRESSED;
-    } else if (web_event.GetType() == blink::WebInputEvent::kRawKeyDown ||
-               web_event.GetType() == blink::WebInputEvent::kKeyDown) {
+    } else if (web_event.GetType() == blink::WebInputEvent::Type::kRawKeyDown ||
+               web_event.GetType() == blink::WebInputEvent::Type::kKeyDown) {
       type = ui::ET_KEY_PRESSED;
     }
     // look up the DomCode in the table because we can't trust the
@@ -130,7 +129,7 @@ NativeWebKeyboardEvent::NativeWebKeyboardEvent(const ui::KeyEvent& key_event,
     : WebKeyboardEvent(ui::MakeWebKeyboardEvent(key_event)),
       os_event(nullptr),
       skip_in_browser(false) {
-  type_ = blink::WebInputEvent::kChar;
+  type_ = blink::WebInputEvent::Type::kChar;
   windows_key_code = character;
   text[0] = character;
   unmodified_text[0] = character;
diff --git a/chromium/content/browser/renderer_host/native_web_keyboard_event_mac.mm b/chromium/content/browser/renderer_host/native_web_keyboard_event_mac.mm
index c6f69401fe4..3cb3ad63c1b 100644
--- a/chromium/content/browser/renderer_host/native_web_keyboard_event_mac.mm
+++ b/chromium/content/browser/renderer_host/native_web_keyboard_event_mac.mm
@@ -53,9 +53,9 @@ NativeWebKeyboardEvent::NativeWebKeyboardEvent(
     : WebKeyboardEvent(web_event), os_event(nullptr), skip_in_browser(false) {
   NSEventType type = NSKeyUp;
   int flags = modifiersForEvent(web_event.GetModifiers());
-  if (web_event.GetType() == blink::WebInputEvent::kChar ||
-      web_event.GetType() == blink::WebInputEvent::kRawKeyDown ||
-      web_event.GetType() == blink::WebInputEvent::kKeyDown) {
+  if (web_event.GetType() == blink::WebInputEvent::Type::kChar ||
+      web_event.GetType() == blink::WebInputEvent::Type::kRawKeyDown ||
+      web_event.GetType() == blink::WebInputEvent::Type::kKeyDown) {
     type = NSKeyDown;
   }
   size_t text_length = WebKeyboardEventTextLength(web_event.text);
diff --git a/chromium/content/browser/renderer_host/overscroll_configuration.cc b/chromium/content/browser/renderer_host/overscroll_configuration.cc
index 3a10d62c759..11930dd88da 100644
--- a/chromium/content/browser/renderer_host/overscroll_configuration.cc
+++ b/chromium/content/browser/renderer_host/overscroll_configuration.cc
@@ -5,7 +5,6 @@
 #include "content/public/browser/overscroll_configuration.h"
 
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
diff --git a/chromium/content/browser/renderer_host/overscroll_controller.cc b/chromium/content/browser/renderer_host/overscroll_controller.cc
index 38d10627af7..112ec65b73c 100644
--- a/chromium/content/browser/renderer_host/overscroll_controller.cc
+++ b/chromium/content/browser/renderer_host/overscroll_controller.cc
@@ -6,8 +6,9 @@
 
 #include <algorithm>
 
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/numerics/ranges.h"
 #include "content/browser/renderer_host/overscroll_controller_delegate.h"
 #include "content/public/browser/overscroll_configuration.h"
@@ -35,7 +36,7 @@ bool IsGestureEventFromAutoscroll(const blink::WebGestureEvent event) {
 }
 
 bool IsGestureScrollUpdateInertialEvent(const blink::WebInputEvent& event) {
-  if (event.GetType() != blink::WebInputEvent::kGestureScrollUpdate)
+  if (event.GetType() != blink::WebInputEvent::Type::kGestureScrollUpdate)
     return false;
 
   const blink::WebGestureEvent& gesture =
@@ -58,9 +59,9 @@ OverscrollController::~OverscrollController() {}
 bool OverscrollController::ShouldProcessEvent(
     const blink::WebInputEvent& event) {
   switch (event.GetType()) {
-    case blink::WebInputEvent::kGestureScrollBegin:
-    case blink::WebInputEvent::kGestureScrollUpdate:
-    case blink::WebInputEvent::kGestureScrollEnd: {
+    case blink::WebInputEvent::Type::kGestureScrollBegin:
+    case blink::WebInputEvent::Type::kGestureScrollUpdate:
+    case blink::WebInputEvent::Type::kGestureScrollEnd: {
       const blink::WebGestureEvent& gesture =
           static_cast<const blink::WebGestureEvent&>(event);
 
@@ -70,13 +71,13 @@ bool OverscrollController::ShouldProcessEvent(
 
       ui::ScrollGranularity granularity;
       switch (event.GetType()) {
-        case blink::WebInputEvent::kGestureScrollBegin:
+        case blink::WebInputEvent::Type::kGestureScrollBegin:
           granularity = gesture.data.scroll_begin.delta_hint_units;
           break;
-        case blink::WebInputEvent::kGestureScrollUpdate:
+        case blink::WebInputEvent::Type::kGestureScrollUpdate:
           granularity = gesture.data.scroll_update.delta_units;
           break;
-        case blink::WebInputEvent::kGestureScrollEnd:
+        case blink::WebInputEvent::Type::kGestureScrollEnd:
           granularity = gesture.data.scroll_end.delta_units;
           break;
         default:
@@ -104,10 +105,10 @@ bool OverscrollController::WillHandleEvent(const blink::WebInputEvent& event) {
 
   // TODO(mohsen): Consider filtering mouse-wheel events during overscroll. See
   // https://crbug.com/772106.
-  if (event.GetType() == blink::WebInputEvent::kMouseWheel)
+  if (event.GetType() == blink::WebInputEvent::Type::kMouseWheel)
     return false;
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
     ignore_following_inertial_events_ = false;
     first_inertial_event_time_.reset();
     time_since_last_ignored_scroll_ =
@@ -116,7 +117,7 @@ bool OverscrollController::WillHandleEvent(const blink::WebInputEvent& event) {
     return false;
   }
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd) {
     if (scroll_state_ == ScrollState::CONTENT_CONSUMING ||
         overscroll_ignored_) {
       last_ignored_scroll_time_ = event.TimeStamp();
@@ -134,7 +135,7 @@ bool OverscrollController::WillHandleEvent(const blink::WebInputEvent& event) {
   if (scroll_state_ != ScrollState::NONE || overscroll_delta_x_ ||
       overscroll_delta_y_) {
     switch (event.GetType()) {
-      case blink::WebInputEvent::kGestureFlingStart:
+      case blink::WebInputEvent::Type::kGestureFlingStart:
         reset_scroll_state = true;
         break;
 
@@ -175,8 +176,8 @@ bool OverscrollController::WillHandleEvent(const blink::WebInputEvent& event) {
   // In overscrolling state, consume scroll-update and fling-start events when
   // they do not contribute to overscroll in order to prevent content scroll.
   return scroll_state_ == ScrollState::OVERSCROLLING &&
-         (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-          event.GetType() == blink::WebInputEvent::kGestureFlingStart);
+         (event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate ||
+          event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart);
 }
 
 void OverscrollController::OnDidOverscroll(
@@ -203,8 +204,8 @@ void OverscrollController::ReceivedEventACK(const blink::WebInputEvent& event,
     // Similarly, if a mouse-wheel event is consumed, probably the page has
     // implemented its own scroll-like behavior and no overscroll should happen.
     if (scroll_state_ == ScrollState::NONE &&
-        (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-         event.GetType() == blink::WebInputEvent::kMouseWheel)) {
+        (event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate ||
+         event.GetType() == blink::WebInputEvent::Type::kMouseWheel)) {
       scroll_state_ = ScrollState::CONTENT_CONSUMING;
     }
     // In overscrolling state, only return if we are in an overscroll mode;
@@ -216,7 +217,7 @@ void OverscrollController::ReceivedEventACK(const blink::WebInputEvent& event,
     }
   }
 
-  if (event.GetType() == blink::WebInputEvent::kMouseWheel)
+  if (event.GetType() == blink::WebInputEvent::Type::kMouseWheel)
     return;
 
   ProcessEventForOverscroll(event);
@@ -243,15 +244,15 @@ bool OverscrollController::DispatchEventCompletesAction(
 
   // Complete the overscroll gesture if there was a mouse move or a scroll-end
   // after the threshold.
-  if (event.GetType() != blink::WebInputEvent::kMouseMove &&
-      event.GetType() != blink::WebInputEvent::kGestureScrollEnd &&
-      event.GetType() != blink::WebInputEvent::kGestureFlingStart &&
-      event.GetType() != blink::WebInputEvent::kGestureScrollUpdate)
+  if (event.GetType() != blink::WebInputEvent::Type::kMouseMove &&
+      event.GetType() != blink::WebInputEvent::Type::kGestureScrollEnd &&
+      event.GetType() != blink::WebInputEvent::Type::kGestureFlingStart &&
+      event.GetType() != blink::WebInputEvent::Type::kGestureScrollUpdate)
     return false;
 
   // Complete the overscroll gesture for inertial scroll (fling) event from
   // touchpad.
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate) {
     if (overscroll_source_ != OverscrollSource::TOUCHPAD)
       return false;
     DCHECK(IsGestureEventFromTouchpad(event));
@@ -262,7 +263,7 @@ bool OverscrollController::DispatchEventCompletesAction(
       return false;
   }
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd &&
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd &&
       overscroll_source_ == OverscrollSource::TOUCHPAD) {
     DCHECK(IsGestureEventFromTouchpad(event));
     // Complete the action for a GSE with touchpad source only when it is in
@@ -277,7 +278,7 @@ bool OverscrollController::DispatchEventCompletesAction(
   if (!delegate_)
     return false;
 
-  if (event.GetType() == blink::WebInputEvent::kGestureFlingStart) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart) {
     // Check to see if the fling is in the same direction of the overscroll.
     const blink::WebGestureEvent gesture =
         static_cast<const blink::WebGestureEvent&>(event);
@@ -323,10 +324,10 @@ bool OverscrollController::DispatchEventResetsState(
     const blink::WebInputEvent& event) const {
   switch (event.GetType()) {
     // GestureScrollBegin/End ACK will reset overscroll state when necessary.
-    case blink::WebInputEvent::kGestureScrollBegin:
-    case blink::WebInputEvent::kGestureScrollEnd:
-    case blink::WebInputEvent::kGestureScrollUpdate:
-    case blink::WebInputEvent::kGestureFlingCancel:
+    case blink::WebInputEvent::Type::kGestureScrollBegin:
+    case blink::WebInputEvent::Type::kGestureScrollEnd:
+    case blink::WebInputEvent::Type::kGestureScrollUpdate:
+    case blink::WebInputEvent::Type::kGestureFlingCancel:
       return false;
 
     default:
@@ -340,12 +341,12 @@ bool OverscrollController::ProcessEventForOverscroll(
     const blink::WebInputEvent& event) {
   bool event_processed = false;
   switch (event.GetType()) {
-    case blink::WebInputEvent::kGestureScrollBegin: {
+    case blink::WebInputEvent::Type::kGestureScrollBegin: {
       if (overscroll_mode_ != OVERSCROLL_NONE)
         SetOverscrollMode(OVERSCROLL_NONE, OverscrollSource::NONE);
       break;
     }
-    case blink::WebInputEvent::kGestureScrollEnd: {
+    case blink::WebInputEvent::Type::kGestureScrollEnd: {
       // Only reset the state on  GestureScrollEnd generated from the touchpad
       // when the scrolling is in inertial state.
       const blink::WebGestureEvent gesture_event =
@@ -373,7 +374,7 @@ bool OverscrollController::ProcessEventForOverscroll(
       }
       break;
     }
-    case blink::WebInputEvent::kGestureScrollUpdate: {
+    case blink::WebInputEvent::Type::kGestureScrollUpdate: {
       const blink::WebGestureEvent& gesture =
           static_cast<const blink::WebGestureEvent&>(event);
       bool is_gesture_scroll_update_inertial_event =
@@ -401,7 +402,7 @@ bool OverscrollController::ProcessEventForOverscroll(
       }
       break;
     }
-    case blink::WebInputEvent::kGestureFlingStart: {
+    case blink::WebInputEvent::Type::kGestureFlingStart: {
       const float kFlingVelocityThreshold = 1100.f;
       const blink::WebGestureEvent& gesture =
           static_cast<const blink::WebGestureEvent&>(event);
diff --git a/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc b/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
index 31f8a0e6cc4..39d9e76be2b 100644
--- a/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
@@ -175,9 +175,9 @@ TEST_F(OverscrollControllerTest,
   const base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchpad,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchpad, timestamp));
   SimulateAck(false);
 
   EXPECT_FALSE(SimulateGestureScrollUpdate(
@@ -222,9 +222,9 @@ TEST_F(OverscrollControllerTest, OnlyProcessLimitedInertialGSUEvents) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchpad,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchpad, timestamp));
   SimulateAck(false);
 
   EXPECT_FALSE(SimulateGestureScrollUpdate(
@@ -280,9 +280,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshDisabled) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchpad,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchpad, timestamp));
   SimulateAck(false);
 
   // Simulate a touchpad gesture scroll-update event that passes the start
@@ -310,9 +310,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshDisabled) {
 
   timestamp += base::TimeDelta::FromSeconds(1);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -330,9 +330,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshDisabled) {
 
   // Simulate a touchscreen gesture scroll-end which would normally end
   // pull-to-refresh, and ACK it as not processed. Nothing should happen.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -349,9 +349,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabled) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchpad,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchpad, timestamp));
   SimulateAck(false);
 
   // Simulate a touchpad gesture scroll-update event that passes the start
@@ -378,9 +378,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabled) {
 
   timestamp += base::TimeDelta::FromSeconds(1);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -397,9 +397,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabled) {
 
   // Simulate a touchscreen gesture scroll-end and ACK it as not processed. It
   // should abort pull-to-refresh.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -416,9 +416,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabledTouchscreen) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchpad,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchpad, timestamp));
   SimulateAck(false);
 
   // Simulate a touchpad gesture scroll-update event that passes the start
@@ -446,9 +446,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabledTouchscreen) {
 
   timestamp += base::TimeDelta::FromSeconds(1);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -465,9 +465,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshEnabledTouchscreen) {
 
   // Simulate a touchscreen gesture scroll-end and ACK it as not processed. It
   // should abort pull-to-refresh.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -512,9 +512,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -531,9 +531,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which would normally end
   // pull-to-refresh, and ACK it as not processed. Nothing should happen.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -543,9 +543,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
   // 2) Scroll before cool off -> PTR not triggered.
   timestamp += base::TimeDelta::FromMilliseconds(500);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -563,9 +563,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which would normally end
   // pull-to-refresh, and ACK it as not processed. Nothing should happen.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -575,9 +575,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
   // 3) Scroll before cool off -> PTR not triggered.
   timestamp += base::TimeDelta::FromMilliseconds(500);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -595,9 +595,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which would normally end
   // pull-to-refresh, and ACK it as not processed. Nothing should happen.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -607,9 +607,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
   // 4) Scroll after cool off -> PTR triggered.
   timestamp += base::TimeDelta::FromSeconds(1);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -626,9 +626,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which will end pull-to-refresh,
   // and ACK it as not processed. Pull-to-refresh should be aborted.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -638,9 +638,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
   // 5) Scroll before cool off -> PTR triggered.
   timestamp += base::TimeDelta::FromMilliseconds(500);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -657,9 +657,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshBeforeCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which will end pull-to-refresh,
   // and ACK it as not processed. Pull-to-refresh should be aborted.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -681,9 +681,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
   base::TimeTicks timestamp =
       blink::WebInputEvent::GetStaticTimeStampForTests();
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -700,9 +700,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which would normally end
   // pull-to-refresh, and ACK it as not processed. Nothing should happen.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -712,9 +712,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
   // 2) Scroll after cool off -> PTR triggered.
   timestamp += base::TimeDelta::FromSeconds(1);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -731,9 +731,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which will end pull-to-refresh,
   // and ACK it as not processed. Pull-to-refresh should be aborted.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
@@ -743,9 +743,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
   // 3) Scroll before cool off -> PTR triggered.
   timestamp += base::TimeDelta::FromMilliseconds(500);
 
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollBegin,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollBegin,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
 
   // Simulate a touchscreen gesture scroll-update event that passes the start
@@ -762,9 +762,9 @@ TEST_F(OverscrollControllerTest, PullToRefreshAfterCoolOff) {
 
   // Simulate a touchscreen gesture scroll-end which will end pull-to-refresh,
   // and ACK it as not processed. Pull-to-refresh should be aborted.
-  EXPECT_FALSE(SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebGestureDevice::kTouchscreen,
-                                    timestamp));
+  EXPECT_FALSE(
+      SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
+                           blink::WebGestureDevice::kTouchscreen, timestamp));
   SimulateAck(false);
   EXPECT_EQ(OVERSCROLL_NONE, controller_mode());
   EXPECT_EQ(OverscrollSource::NONE, controller_source());
diff --git a/chromium/content/browser/renderer_host/page_lifecycle_state_manager.cc b/chromium/content/browser/renderer_host/page_lifecycle_state_manager.cc
index df0a6641def..50acabe3752 100644
--- a/chromium/content/browser/renderer_host/page_lifecycle_state_manager.cc
+++ b/chromium/content/browser/renderer_host/page_lifecycle_state_manager.cc
@@ -11,27 +11,50 @@
 namespace content {
 
 PageLifecycleStateManager::PageLifecycleStateManager(
-    RenderViewHostImpl* render_view_host_impl)
-    : render_view_host_impl_(render_view_host_impl) {}
+    RenderViewHostImpl* render_view_host_impl,
+    blink::mojom::PageVisibilityState visibility_state)
+    : is_frozen_(false),
+      render_view_host_impl_(render_view_host_impl),
+      visibility_(visibility_state) {}
 
 PageLifecycleStateManager::~PageLifecycleStateManager() = default;
 
 void PageLifecycleStateManager::SetIsFrozen(bool frozen) {
+  if (is_frozen_ == frozen)
+    return;
+  is_frozen_ = frozen;
+  SendUpdatesToRenderer();
+}
+
+void PageLifecycleStateManager::SetVisibility(
+    blink::mojom::PageVisibilityState visibility) {
+  if (visibility_ == visibility)
+    return;
+  visibility_ = visibility;
+  SendUpdatesToRenderer();
+  // TODO(yuzus): When a page is frozen and made visible, the page should
+  // automatically resume.
+}
+
+void PageLifecycleStateManager::SendUpdatesToRenderer() {
   if (!render_view_host_impl_->GetAssociatedPageBroadcast()) {
     // For some tests, |render_view_host_impl_| does not have the associated
     // page.
     return;
   }
   auto state = blink::mojom::PageLifecycleState::New();
-  state->is_frozen = frozen;
+  state->is_frozen = is_frozen_;
+  state->visibility = visibility_;
 
   render_view_host_impl_->GetAssociatedPageBroadcast()->SetPageLifecycleState(
-      std::move(state), base::BindOnce(&PageLifecycleStateManager::OnFreezeAck,
-                                       weak_ptr_factory_.GetWeakPtr()));
+      std::move(state),
+      base::BindOnce(&PageLifecycleStateManager::OnLifecycleChangedAck,
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
-void PageLifecycleStateManager::OnFreezeAck() {
-  // TODO(yuzus): Implement OnPageFrozen and send changes to the observers.
+void PageLifecycleStateManager::OnLifecycleChangedAck() {
+  // TODO(yuzus): Implement OnLifecycleChangedAck and send changes to the
+  // observers.
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/page_lifecycle_state_manager.h b/chromium/content/browser/renderer_host/page_lifecycle_state_manager.h
index 79e14f69052..1203a1b5bee 100644
--- a/chromium/content/browser/renderer_host/page_lifecycle_state_manager.h
+++ b/chromium/content/browser/renderer_host/page_lifecycle_state_manager.h
@@ -6,6 +6,7 @@
 #define CONTENT_BROWSER_RENDERER_HOST_PAGE_LIFECYCLE_STATE_MANAGER_H_
 
 #include "content/common/content_export.h"
+#include "content/public/common/page_visibility_state.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/page/page.mojom.h"
 
@@ -17,15 +18,21 @@ class RenderViewHostImpl;
 // and communicating in to the RenderView. 1:1 with RenderViewHostImpl.
 class CONTENT_EXPORT PageLifecycleStateManager {
  public:
-  explicit PageLifecycleStateManager(RenderViewHostImpl* render_view_host_impl);
+  explicit PageLifecycleStateManager(
+      RenderViewHostImpl* render_view_host_impl,
+      blink::mojom::PageVisibilityState visibility_state);
   ~PageLifecycleStateManager();
 
   void SetIsFrozen(bool frozen);
+  void SetVisibility(blink::mojom::PageVisibilityState visibility_state);
 
  private:
-  void OnFreezeAck();
+  void SendUpdatesToRenderer();
+  void OnLifecycleChangedAck();
 
+  bool is_frozen_;
   RenderViewHostImpl* render_view_host_impl_;
+  blink::mojom::PageVisibilityState visibility_;
 
   // NOTE: This must be the last member.
   base::WeakPtrFactory<PageLifecycleStateManager> weak_ptr_factory_{this};
diff --git a/chromium/content/browser/renderer_host/page_lifecycle_state_manager_browsertest.cc b/chromium/content/browser/renderer_host/page_lifecycle_state_manager_browsertest.cc
index 0a10b77b046..8c2220541ec 100644
--- a/chromium/content/browser/renderer_host/page_lifecycle_state_manager_browsertest.cc
+++ b/chromium/content/browser/renderer_host/page_lifecycle_state_manager_browsertest.cc
@@ -8,10 +8,12 @@
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 
 namespace content {
@@ -21,6 +23,10 @@ class PageLifecycleStateManagerBrowserTest : public ContentBrowserTest {
   ~PageLifecycleStateManagerBrowserTest() override = default;
 
  protected:
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+  }
+
   WebContentsImpl* web_contents() const {
     return static_cast<WebContentsImpl*>(shell()->web_contents());
   }
@@ -31,6 +37,7 @@ class PageLifecycleStateManagerBrowserTest : public ContentBrowserTest {
       let event_list = [
         'freeze',
         'resume',
+        'visibilitychange',
       ];
       for (event_name of event_list) {
         let result = event_name;
@@ -65,16 +72,92 @@ IN_PROC_BROWSER_TEST_F(PageLifecycleStateManagerBrowserTest, SetFrozen) {
   EXPECT_TRUE(embedded_test_server()->Start());
   GURL test_url = embedded_test_server()->GetURL("/empty.html");
   EXPECT_TRUE(NavigateToURL(shell(), test_url));
-  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  RenderViewHostImpl* rvh = render_view_host();
   RenderFrameHostImpl* rfh = current_frame_host();
   StartRecordingEvents(rfh);
-  // TODO(yuzus):Use PageLifecycleStateManager for visibility change.
+
+  // Hide and freeze the page.
   shell()->web_contents()->WasHidden();
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh->GetVisibilityState());
+  shell()->web_contents()->SetPageFrozen(true);
+
+  // Resume the page.
+  shell()->web_contents()->SetPageFrozen(false);
+
+  MatchEventList(rfh, ListValueOf("document.visibilitychange",
+                                  "document.freeze", "document.resume"));
+}
+
+IN_PROC_BROWSER_TEST_F(PageLifecycleStateManagerBrowserTest, SetVisibility) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+  GURL test_url = embedded_test_server()->GetURL("/empty.html");
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  RenderFrameHostImpl* rfh = current_frame_host();
+  StartRecordingEvents(rfh);
+
+  // Hide the page.
+  shell()->web_contents()->WasHidden();
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh->GetVisibilityState());
+
+  MatchEventList(rfh, ListValueOf("document.visibilitychange"));
+}
+
+IN_PROC_BROWSER_TEST_F(PageLifecycleStateManagerBrowserTest,
+                       CrossProcessIframeHiddenAnFrozen) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+  // Load a page with a cross-process iframe.
+  GURL url_a_b(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_a_b));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+  StartRecordingEvents(rfh_a);
+  StartRecordingEvents(rfh_b);
+
+  // Hide and freeze the page.
+  shell()->web_contents()->WasHidden();
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh_a->GetVisibilityState());
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh_b->GetVisibilityState());
+
+  shell()->web_contents()->SetPageFrozen(true);
+
+  // Resume the page.
+  shell()->web_contents()->SetPageFrozen(false);
+
+  // Make sure that the cross-process iframe also got events.
+  MatchEventList(rfh_a, ListValueOf("document.visibilitychange",
+                                    "document.freeze", "document.resume"));
+  MatchEventList(rfh_b, ListValueOf("document.visibilitychange",
+                                    "document.freeze", "document.resume"));
+}
+
+IN_PROC_BROWSER_TEST_F(PageLifecycleStateManagerBrowserTest,
+                       CreateIframeInHiddenPage) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+  GURL test_url = embedded_test_server()->GetURL("/empty.html");
+
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+  RenderFrameHostImpl* rfh_parent = current_frame_host();
+
+  // Hide the page.
+  shell()->web_contents()->WasHidden();
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh_parent->GetVisibilityState());
+
+  // Create an iframe in a hidden page.
+  EXPECT_TRUE(ExecJs(rfh_parent, R"(
+    let iframe = document.createElement('iframe');
+    document.body.append(iframe);
+  )"));
+  ASSERT_EQ(1u, rfh_parent->child_count());
+
+  // Make sure that the created iframe's initial visibility is correctly set.
+  RenderFrameHostImpl* rfh_child =
+      rfh_parent->child_at(0)->current_frame_host();
+  EXPECT_EQ(PageVisibilityState::kHidden, rfh_child->GetVisibilityState());
 
-  rvh->SetIsFrozen(/*frozen*/ true);
-  rvh->SetIsFrozen(/*frozen*/ false);
-  MatchEventList(rfh, ListValueOf("document.freeze", "document.resume"));
+  // Show the page.
+  shell()->web_contents()->WasShown();
+  EXPECT_EQ(PageVisibilityState::kVisible, rfh_parent->GetVisibilityState());
+  EXPECT_EQ(PageVisibilityState::kVisible, rfh_child->GetVisibilityState());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/panel_rotation_browsertest.cc b/chromium/content/browser/renderer_host/panel_rotation_browsertest.cc
index cdae079cc31..3e40c6e45ff 100644
--- a/chromium/content/browser/renderer_host/panel_rotation_browsertest.cc
+++ b/chromium/content/browser/renderer_host/panel_rotation_browsertest.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/strings/stringprintf.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
index c425175b721..4504ed06d41 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
@@ -10,7 +10,8 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/task/post_task.h"
 #include "content/browser/renderer_host/pepper/browser_ppapi_host_impl.h"
 #include "content/browser/renderer_host/pepper/pepper_socket_utils.h"
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_message_filter.cc
index 0eaa5ec9bc1..8eb17f5f60a 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_message_filter.cc
@@ -4,7 +4,6 @@
 
 #include "content/browser/renderer_host/pepper/pepper_message_filter.h"
 
-#include "base/logging.h"
 #include "content/browser/renderer_host/pepper/pepper_socket_utils.h"
 #include "content/public/common/content_client.h"
 #include "ppapi/proxy/ppapi_messages.h"
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.cc b/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.cc
index 52ecd3b3b78..6a7e4f5eff7 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.cc
@@ -5,6 +5,7 @@
 #include "content/browser/renderer_host/pepper/pepper_print_settings_manager.h"
 
 #include "base/task/post_task.h"
+#include "build/build_config.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -12,6 +13,10 @@
 #include "ppapi/c/pp_errors.h"
 #include "printing/buildflags/buildflags.h"
 
+#if defined(OS_WIN)
+#include "base/threading/thread_restrictions.h"
+#endif
+
 #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
 #include "printing/printing_context.h"  // nogncheck
 #include "printing/units.h"  // nogncheck
@@ -59,11 +64,23 @@ class PrintingContextDelegate : public printing::PrintingContext::Delegate {
   }
 };
 
-PepperPrintSettingsManager::Result ComputeDefaultPrintSettings() {
+#endif
+
+}  // namespace
+
+PepperPrintSettingsManager::Result
+PepperPrintSettingsManagerImpl::ComputeDefaultPrintSettings() {
+#if BUILDFLAG(ENABLE_PRINT_PREVIEW)
   // This function should run on the UI thread because |PrintingContext| methods
   // call into platform APIs.
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
+#if defined(OS_WIN)
+  // Blocking is needed here because Windows printer drivers are oftentimes
+  // not thread-safe and have to be accessed on the UI thread.
+  base::ScopedAllowBlocking allow_blocking;
+#endif
+
   PrintingContextDelegate delegate;
   std::unique_ptr<printing::PrintingContext> context(
       printing::PrintingContext::Create(&delegate));
@@ -101,15 +118,11 @@ PepperPrintSettingsManager::Result ComputeDefaultPrintSettings() {
   // so just make it the default.
   settings.format = PP_PRINTOUTPUTFORMAT_PDF;
   return PepperPrintSettingsManager::Result(settings, PP_OK);
-}
 #else
-PepperPrintSettingsManager::Result ComputeDefaultPrintSettings() {
   return PepperPrintSettingsManager::Result(PP_PrintSettings_Dev(),
                                             PP_ERROR_NOTSUPPORTED);
-}
 #endif
-
-}  // namespace
+}
 
 void PepperPrintSettingsManagerImpl::GetDefaultPrintSettings(
     PepperPrintSettingsManager::Callback callback) {
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.h b/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.h
index 855fa2ab8c4..c099ee2200e 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_print_settings_manager.h
@@ -42,6 +42,8 @@ class CONTENT_EXPORT PepperPrintSettingsManagerImpl
       PepperPrintSettingsManager::Callback callback) override;
 
  private:
+  static PepperPrintSettingsManager::Result ComputeDefaultPrintSettings();
+
   DISALLOW_COPY_AND_ASSIGN(PepperPrintSettingsManagerImpl);
 };
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
index ec9dfd6b193..e00862f55d7 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
@@ -5,8 +5,8 @@
 #include "content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.h"
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/sequenced_task_runner.h"
 #include "base/task/post_task.h"
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
index 808d02c3089..df616d801d7 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
@@ -9,7 +9,7 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_security_helper.cc b/chromium/content/browser/renderer_host/pepper/pepper_security_helper.cc
index 3bb92bf8b48..ed9094b8805 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_security_helper.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_security_helper.cc
@@ -4,7 +4,6 @@
 
 #include "content/browser/renderer_host/pepper/pepper_security_helper.h"
 
-#include "base/logging.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "ppapi/c/ppb_file_io.h"
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_ozone.cc b/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_ozone.cc
index 12e2c61a8cf..3020c538e85 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_ozone.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_ozone.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "content/browser/renderer_host/pepper/pepper_truetype_font_list.h"
 
 namespace content {
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
index 26b8a948c6e..7cc8709182a 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
@@ -573,10 +573,10 @@ void PepperUDPSocketMessageFilter::DoBindCallback(
 #if defined(OS_CHROMEOS)
   pepper_socket_utils::OpenUDPFirewallHole(
       *local_addr_out,
-      base::BindRepeating(&PepperUDPSocketMessageFilter::OnFirewallHoleOpened,
-                          firewall_hole_weak_ptr_factory_.GetWeakPtr(),
-                          base::Passed(std::move(listener_receiver)), context,
-                          net_address));
+      base::BindOnce(&PepperUDPSocketMessageFilter::OnFirewallHoleOpened,
+                     firewall_hole_weak_ptr_factory_.GetWeakPtr(),
+                     base::Passed(std::move(listener_receiver)), context,
+                     net_address));
 #else   // !defined(OS_CHROMEOS)
   OnBindComplete(std::move(listener_receiver), context, net_address);
 #endif  // !defined(OS_CHROMEOS)
diff --git a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
index 7614941c0bd..a7bcc88c619 100644
--- a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
@@ -27,6 +27,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.cc b/chromium/content/browser/renderer_host/render_process_host_impl.cc
index 8d00b84a006..a37c3125a34 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.cc
@@ -27,6 +27,7 @@
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file.h"
+#include "base/files/file_util.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/memory_pressure_monitor.h"
@@ -134,7 +135,7 @@
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/text_input_client_message_filter.h"
 #include "content/browser/renderer_host/web_database_host_impl.h"
-#include "content/browser/resolve_proxy_msg_helper.h"
+#include "content/browser/resolve_proxy_helper.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/storage_partition_impl.h"
@@ -150,7 +151,6 @@
 #include "content/common/frame_messages.h"
 #include "content/common/in_process_child_thread_params.h"
 #include "content/common/resource_messages.h"
-#include "content/common/service_manager/service_manager_connection_impl.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/common/view_messages.h"
 #include "content/common/widget_messages.h"
@@ -224,6 +224,7 @@
 #include "storage/browser/file_system/sandbox_file_system_backend.h"
 #include "third_party/blink/public/common/page/launching_process_state.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
+#include "third_party/blink/public/mojom/disk_allocator.mojom.h"
 #include "third_party/blink/public/public_buildflags.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/accessibility/accessibility_switches.h"
@@ -294,7 +295,7 @@
 #endif
 
 #if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-#include "content/common/profiling_utils.h"
+#include "content/public/common/profiling_utils.h"
 #endif
 
 namespace content {
@@ -1555,7 +1556,13 @@ RenderProcessHostImpl::RenderProcessHostImpl(
       instance_weak_factory_(base::in_place, this),
       frame_sink_provider_(id_),
       shutdown_exit_code_(-1) {
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl", "render_process_host", this,
+               "id", GetID());
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN2("shutdown", "Browser.RenderProcessHostImpl",
+                                    this, "render_process_host", this,
+                                    "browser_context", browser_context_);
   widget_helper_ = new RenderWidgetHelper();
+  resolve_proxy_helper_ = new ResolveProxyHelper(GetID());
 
   ChildProcessSecurityPolicyImpl::GetInstance()->Add(GetID(), browser_context);
 
@@ -1653,6 +1660,8 @@ void RenderProcessHostImpl::SetCodeCacheHostReceiverHandlerForTesting(
 }
 
 RenderProcessHostImpl::~RenderProcessHostImpl() {
+  TRACE_EVENT2("shutdown", "~RenderProcessHostImpl", "render_process_host",
+               this, "id", GetID());
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 #ifndef NDEBUG
   DCHECK(is_self_deleted_)
@@ -1708,6 +1717,12 @@ RenderProcessHostImpl::~RenderProcessHostImpl() {
                                background_duration_);
     }
   }
+  TRACE_EVENT_NESTABLE_ASYNC_END2("shutdown", "Cleanup in progress", this,
+                                  "render_process_host", this,
+                                  "browser_context", browser_context_);
+  TRACE_EVENT_NESTABLE_ASYNC_END2("shutdown", "Browser.RenderProcessHostImpl",
+                                  this, "render_process_host", this,
+                                  "browser_context", browser_context_);
 }
 
 bool RenderProcessHostImpl::Init() {
@@ -1957,8 +1972,6 @@ void RenderProcessHostImpl::CreateMessageFilters() {
   p2p_socket_dispatcher_host_ =
       std::make_unique<P2PSocketDispatcherHost>(GetID());
 
-  AddFilter(new ResolveProxyMsgHelper(GetID()));
-
   scoped_refptr<ServiceWorkerContextWrapper> service_worker_context(
       static_cast<ServiceWorkerContextWrapper*>(
           storage_partition_impl_->GetServiceWorkerContext()));
@@ -2050,11 +2063,14 @@ void RenderProcessHostImpl::BindRestrictedCookieManagerForServiceWorker(
     const url::Origin& origin,
     mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  GetStoragePartition()->CreateRestrictedCookieManager(
+  StoragePartitionImpl* storage_partition =
+      static_cast<StoragePartitionImpl*>(GetStoragePartition());
+  storage_partition->CreateRestrictedCookieManager(
       network::mojom::RestrictedCookieManagerRole::SCRIPT, origin,
       net::SiteForCookies::FromOrigin(origin), origin,
       true /* is_service_worker */, GetID(), MSG_ROUTING_NONE,
-      std::move(receiver));
+      std::move(receiver),
+      storage_partition->CreateCookieAccessObserverForServiceWorker());
 }
 
 void RenderProcessHostImpl::BindVideoDecodePerfHistory(
@@ -2120,12 +2136,15 @@ void RenderProcessHostImpl::CreateWebSocketConnector(
   //
   // Shared Workers and service workers are not directly associated with a
   // frame, so the concept of "top-level frame" does not exist. Can use
-  // (origin, origin) for the NetworkIsolationKey for requests because these
+  // (origin, origin, origin) for the IsolationInfo for requests because these
   // workers can only be created when the site has cookie access.
-  mojo::MakeSelfOwnedReceiver(std::make_unique<WebSocketConnectorImpl>(
-                                  GetID(), MSG_ROUTING_NONE, origin,
-                                  net::NetworkIsolationKey(origin, origin)),
-                              std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<WebSocketConnectorImpl>(
+          GetID(), MSG_ROUTING_NONE, origin,
+          net::IsolationInfo::Create(
+              net::IsolationInfo::RedirectMode::kUpdateNothing, origin, origin,
+              net::SiteForCookies::FromOrigin(origin))),
+      std::move(receiver));
 }
 
 void RenderProcessHostImpl::CancelProcessShutdownDelayForUnload() {
@@ -2175,6 +2194,13 @@ void RenderProcessHostImpl::
   cleanup_network_service_plugin_exceptions_upon_destruction_ = true;
 }
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+void RenderProcessHostImpl::DumpProfilingData(base::OnceClosure callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  GetRendererInterface()->WriteClangProfilingProfile(std::move(callback));
+}
+#endif
+
 PeerConnectionTrackerHost*
 RenderProcessHostImpl::GetPeerConnectionTrackerHost() {
   if (!peer_connection_tracker_host_) {
@@ -2724,6 +2750,10 @@ void RenderProcessHostImpl::DecrementKeepAliveRefCount() {
 }
 
 void RenderProcessHostImpl::DisableKeepAliveRefCount() {
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl::DisableKeepAliveRefCount",
+               "browser_context", browser_context_, "render_process_host",
+               this);
+
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   if (is_keep_alive_ref_count_disabled_)
@@ -2804,12 +2834,16 @@ mojom::RouteProvider* RenderProcessHostImpl::GetRemoteRouteProvider() {
 
 void RenderProcessHostImpl::AddRoute(int32_t routing_id,
                                      IPC::Listener* listener) {
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl::AddRoute",
+               "render_process_host", this, "routing_id", routing_id);
   CHECK(!listeners_.Lookup(routing_id))
       << "Found Routing ID Conflict: " << routing_id;
   listeners_.AddWithID(listener, routing_id);
 }
 
 void RenderProcessHostImpl::RemoveRoute(int32_t routing_id) {
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl::RemoveRoute",
+               "render_process_host", this, "routing_id", routing_id);
   DCHECK(listeners_.Lookup(routing_id) != nullptr);
   listeners_.Remove(routing_id);
   Cleanup();
@@ -3198,6 +3232,9 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     service_manager::switches::kDisableInProcessStackTraces,
     service_manager::switches::kDisableSeccompFilterSandbox,
     service_manager::switches::kNoSandbox,
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+    switches::kDisableDevShmUsage,
+#endif
 #if defined(OS_MACOSX)
     // Allow this to be set when invoking the browser and relayed along.
     service_manager::switches::kEnableSandboxLogging,
@@ -3228,7 +3265,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kDisableHistogramCustomizer,
     switches::kDisableLCDText,
     switches::kDisableLogging,
-    switches::kDisableMediaSuspend,
+    switches::kDisableBackgroundMediaSuspend,
     switches::kDisableNotifications,
     switches::kDisableOopRasterization,
     switches::kEnableDeJelly,
@@ -3247,6 +3284,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kDisableTouchAdjustment,
     switches::kDisableTouchDragDrop,
     switches::kDisableV8IdleTasks,
+    switches::kDisableVideoCaptureUseGpuMemoryBuffer,
     switches::kDisableWebGLImageChromium,
     switches::kDomAutomationController,
     switches::kEnableAccessibilityObjectModel,
@@ -3259,7 +3297,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kEnableGpuMemoryBufferVideoFrames,
     switches::kEnableGPUServiceLogging,
     switches::kEnableLowResTiling,
-    switches::kEnableMediaSuspend,
     switches::kEnableLCDText,
     switches::kEnableLogging,
     switches::kEnableNetworkInformationDownlinkMax,
@@ -3280,7 +3317,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kEnableWebGLImageChromium,
     switches::kFileUrlPathAlias,
     switches::kForceDeviceScaleFactor,
-    switches::kForceDisableWebRtcApmInAudioService,
     switches::kForceDisplayColorProfile,
     switches::kForceGpuMemAvailableMb,
     switches::kForceHighContrast,
@@ -3341,6 +3377,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     cc::switches::kDisableCompositedAntialiasing,
     cc::switches::kDisableThreadedAnimation,
     cc::switches::kEnableGpuBenchmarking,
+    cc::switches::kHighlightNonLCDTextLayers,
     cc::switches::kShowCompositedLayerBorders,
     cc::switches::kShowFPSCounter,
     cc::switches::kShowLayerAnimationBounds,
@@ -3610,6 +3647,8 @@ void RenderProcessHostImpl::OnChannelConnected(int32_t peer_pid) {
     // MemoryUsageMonitor in blink.
     ProvideStatusFileForRenderer();
 #endif
+
+    ProvideSwapFileForRenderer();
   }
 
 #if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
@@ -3676,6 +3715,8 @@ RenderProcessHostImpl::RegisterBlockStateChangedCallback(
 }
 
 void RenderProcessHostImpl::Cleanup() {
+  TRACE_EVENT1("shutdown", "RenderProcessHostImpl::Cleanup",
+               "render_process_host", this);
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // Keep the one renderer thread around forever in single process mode.
   if (run_renderer_in_process())
@@ -3687,6 +3728,10 @@ void RenderProcessHostImpl::Cleanup() {
   // been made, and guarantee that the RenderProcessHostDestroyed observer
   // callback is always the last callback fired.
   if (within_process_died_observer_) {
+    TRACE_EVENT1(
+        "shutdown",
+        "RenderProcessHostImpl::Cleanup : within_process_died_observer",
+        "render_process_host", this);
     delayed_cleanup_needed_ = true;
     return;
   }
@@ -3701,8 +3746,24 @@ void RenderProcessHostImpl::Cleanup() {
 
   // Until there are no other owners of this object, we can't delete
   // ourselves.
-  if (!listeners_.IsEmpty() || keep_alive_ref_count_ != 0)
+  if (!listeners_.IsEmpty()) {
+    TRACE_EVENT2("shutdown", "RenderProcessHostImpl::Cleanup : Has listeners.",
+                 "render_process_host", this, "listener_count",
+                 listeners_.size());
+    return;
+  } else if (keep_alive_ref_count_ != 0) {
+    TRACE_EVENT2("shutdown",
+                 "RenderProcessHostImpl::Cleanup : Have keep_alive_ref.",
+                 "render_process_host", this, "keep_alive_ref_count_",
+                 keep_alive_ref_count_);
     return;
+  }
+
+  TRACE_EVENT1("shutdown", "RenderProcessHostImpl::Cleanup : Starting cleanup.",
+               "render_process_host", this);
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN2("shutdown", "Cleanup in progress", this,
+                                    "render_process_host", this,
+                                    "browser_context", browser_context_);
 
   if (is_initialized_) {
     base::PostTask(
@@ -3733,9 +3794,11 @@ void RenderProcessHostImpl::Cleanup() {
     info.status = base::TERMINATION_STATUS_NORMAL_TERMINATION;
     info.exit_code = 0;
     PopulateTerminationInfoRendererFields(&info);
+    within_cleanup_process_died_observer_ = true;
     for (auto& observer : observers_) {
       observer.RenderProcessExited(this, info);
     }
+    within_cleanup_process_died_observer_ = false;
   }
   for (auto& observer : observers_)
     observer.RenderProcessHostDestroyed(this);
@@ -3887,12 +3950,17 @@ bool RenderProcessHostImpl::FastShutdownStarted() {
 
 // static
 void RenderProcessHostImpl::RegisterHost(int host_id, RenderProcessHost* host) {
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl::RegisterHost",
+               "render_process_host", host, "host_id", host_id);
   GetAllHosts().AddWithID(host, host_id);
 }
 
 // static
 void RenderProcessHostImpl::UnregisterHost(int host_id) {
   RenderProcessHost* host = GetAllHosts().Lookup(host_id);
+  TRACE_EVENT2("shutdown", "RenderProcessHostImpl::UnregisterHost",
+               "render_process_host", host, "host_id", host_id);
+
   if (!host)
     return;
 
@@ -4189,12 +4257,11 @@ RenderProcessHost* RenderProcessHostImpl::GetUnusedProcessHostForServiceWorker(
 
 // static
 bool RenderProcessHost::ShouldUseProcessPerSite(BrowserContext* browser_context,
-                                                const GURL& url) {
+                                                const GURL& site_url) {
   // Returns true if we should use the process-per-site model.  This will be
   // the case if the --process-per-site switch is specified, or in
-  // process-per-site-instance for particular sites (e.g., WebUI).
-  // Note that --single-process is handled in
-  // ShouldTryToUseExistingProcessHost.
+  // process-per-site-instance for particular sites (e.g., NTP). Note that
+  // --single-process is handled in ShouldTryToUseExistingProcessHost.
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kProcessPerSite))
@@ -4203,12 +4270,12 @@ bool RenderProcessHost::ShouldUseProcessPerSite(BrowserContext* browser_context,
   // Error pages should use process-per-site model, as it is useful to
   // consolidate them to minimize resource usage and there is no security
   // drawback to combining them all in the same process.
-  if (url.SchemeIs(kChromeErrorScheme))
+  if (site_url.SchemeIs(kChromeErrorScheme))
     return true;
 
   // Otherwise let the content client decide, defaulting to false.
   return GetContentClient()->browser()->ShouldUseProcessPerSite(browser_context,
-                                                                url);
+                                                                site_url);
 }
 
 // static
@@ -4614,6 +4681,12 @@ void RenderProcessHostImpl::RecordUserMetricsAction(const std::string& action) {
   base::RecordComputedAction(action);
 }
 
+void RenderProcessHostImpl::ResolveProxy(
+    const GURL& url,
+    mojom::RendererHost::ResolveProxyCallback callback) {
+  resolve_proxy_helper_->ResolveProxy(url, std::move(callback));
+}
+
 void RenderProcessHostImpl::UpdateProcessPriorityInputs() {
   int32_t new_visible_widgets_count = 0;
   unsigned int new_frame_depth = kMaxFrameDepthForPriority;
@@ -5061,4 +5134,38 @@ void RenderProcessHostImpl::ProvideStatusFileForRenderer() {
 }
 #endif
 
+void RenderProcessHostImpl::ProvideSwapFileForRenderer() {
+  if (!base::FeatureList::IsEnabled(features::kParkableStringsToDisk))
+    return;
+  mojo::Remote<blink::mojom::DiskAllocator> allocator;
+  BindReceiver(allocator.BindNewPipeAndPassReceiver());
+
+  // In Incognito, nothing should be written to disk. Providing an invalid file
+  // prevents the renderer from doing so.
+  if (GetBrowserContext()->IsOffTheRecord()) {
+    allocator->ProvideTemporaryFile(base::File());
+    return;
+  }
+
+  // File creation done on a background thread. The renderer side will behave
+  // correctly even if the file is provided later or never.
+  base::ThreadPool::PostTaskAndReplyWithResult(
+      FROM_HERE, {base::MayBlock()}, base::BindOnce([]() {
+        base::FilePath path;
+        CHECK(base::CreateTemporaryFile(&path));
+
+        int flags = base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_READ |
+                    base::File::FLAG_WRITE | base::File::FLAG_DELETE_ON_CLOSE;
+        auto file = base::File(base::FilePath(path), flags);
+        CHECK(file.IsValid());
+        return file;
+      }),
+      base::BindOnce(
+          [](mojo::Remote<blink::mojom::DiskAllocator> allocator,
+             base::File file) {
+            allocator->ProvideTemporaryFile(std::move(file));
+          },
+          std::move(allocator)));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.h b/chromium/content/browser/renderer_host/render_process_host_impl.h
index 089fcd4351f..391355c38d1 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.h
@@ -124,6 +124,7 @@ class RenderProcessHostCreationObserver;
 class RenderProcessHostFactory;
 class RenderProcessHostTest;
 class RenderWidgetHelper;
+class ResolveProxyHelper;
 class SiteInstance;
 class SiteInstanceImpl;
 class StoragePartition;
@@ -265,6 +266,9 @@ class CONTENT_EXPORT RenderProcessHostImpl
       mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) override;
   void ForceCrash() override;
   void CleanupNetworkServicePluginExceptionsUponDestruction() override;
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  void DumpProfilingData(base::OnceClosure callback) override;
+#endif
 
   mojom::RouteProvider* GetRemoteRouteProvider();
 
@@ -303,6 +307,11 @@ class CONTENT_EXPORT RenderProcessHostImpl
     return within_process_died_observer_;
   }
 
+  // TODO(https://crbug.com/1006814): Delete this.
+  bool GetWithinCleanupProcessDiedObserverForCrbug1006814() {
+    return within_cleanup_process_died_observer_;
+  }
+
   // Used to extend the lifetime of the sessions until the render view
   // in the renderer is fully closed. This is static because its also called
   // with mock hosts as input in test cases. The RenderWidget routing associated
@@ -741,6 +750,9 @@ class CONTENT_EXPORT RenderProcessHostImpl
                            BrowserHistogramCallback callback) override;
   void SuddenTerminationChanged(bool enabled) override;
   void RecordUserMetricsAction(const std::string& action) override;
+  void ResolveProxy(
+      const GURL& url,
+      mojom::RendererHost::ResolveProxyCallback callback) override;
 
   void BindRouteProvider(
       mojo::PendingAssociatedReceiver<mojom::RouteProvider> receiver);
@@ -948,6 +960,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void ProvideStatusFileForRenderer();
 #endif
 
+  // Gives a DELETE_ON_CLOSE file descriptor to the renderer, to use for
+  // swapping. See blink::DiskDataAllocator for uses.
+  void ProvideSwapFileForRenderer();
+
   mojo::OutgoingInvitation mojo_invitation_;
 
   size_t keep_alive_ref_count_;
@@ -1031,6 +1047,8 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // IO thread.
   scoped_refptr<RenderWidgetHelper> widget_helper_;
 
+  scoped_refptr<ResolveProxyHelper> resolve_proxy_helper_;
+
   scoped_refptr<RenderFrameMessageFilter> render_frame_message_filter_;
 
   // Used in single-process mode.
@@ -1099,10 +1117,15 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // longer within the RenderProcessHostObserver::RenderProcessExited callbacks.
   bool delayed_cleanup_needed_;
 
-  // Indicates whether RenderProcessHostImpl is currently iterating and calling
-  // through RenderProcessHostObserver::RenderProcessExited.
+  // Indicates whether RenderProcessHostImpl::ProcessDied is currently iterating
+  // and calling through RenderProcessHostObserver::RenderProcessExited.
   bool within_process_died_observer_;
 
+  // Indicates whether RenderProcessHostImpl::Cleanup is currently iterating and
+  // calling through RenderProcessHostObserver::RenderProcessExited.
+  // TODO(https://crbug.com/1006814): Delete this.
+  bool within_cleanup_process_died_observer_ = false;
+
   std::unique_ptr<P2PSocketDispatcherHost> p2p_socket_dispatcher_host_;
 
   // Must be accessed on UI thread.
diff --git a/chromium/content/browser/renderer_host/render_process_host_unittest.cc b/chromium/content/browser/renderer_host/render_process_host_unittest.cc
index f29f62f3eec..6426b5865b2 100644
--- a/chromium/content/browser/renderer_host/render_process_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_unittest.cc
@@ -28,8 +28,8 @@
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
 #include "testing/gmock/include/gmock/gmock.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 
 namespace content {
@@ -137,10 +137,10 @@ TEST_F(RenderProcessHostUnitTest, ReuseCommittedSite) {
       process()->GetNextRoutingID(),
       TestRenderFrameHost::CreateStubInterfaceProviderReceiver(),
       TestRenderFrameHost::CreateStubBrowserInterfaceBrokerReceiver(),
-      blink::WebTreeScopeType::kDocument, std::string(), unique_name, false,
-      base::UnguessableToken::Create(), blink::FramePolicy(),
-      blink::mojom::FrameOwnerProperties(),
-      blink::FrameOwnerElementType::kIframe);
+      blink::mojom::TreeScopeType::kDocument, std::string(), unique_name, false,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      blink::FramePolicy(), blink::mojom::FrameOwnerProperties(),
+      blink::mojom::FrameOwnerElementType::kIframe);
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   subframe = static_cast<TestRenderFrameHost*>(
diff --git a/chromium/content/browser/renderer_host/render_view_host_browsertest.cc b/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
index b6c993a6720..178e4af16a5 100644
--- a/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/frame_navigate_params.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate.cc b/chromium/content/browser/renderer_host/render_view_host_delegate.cc
index b34eb60031c..1964096a357 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate.cc
@@ -69,7 +69,7 @@ RenderFrameHostImpl* RenderViewHostDelegate::GetPendingMainFrame() {
   return nullptr;
 }
 
-bool RenderViewHostDelegate::IsPortal() const {
+bool RenderViewHostDelegate::IsPortal() {
   return false;
 }
 
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate.h b/chromium/content/browser/renderer_host/render_view_host_delegate.h
index 4b87c4764e9..c34293bd704 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate.h
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate.h
@@ -180,7 +180,7 @@ class CONTENT_EXPORT RenderViewHostDelegate {
   virtual void DidFirstVisuallyNonEmptyPaint(RenderViewHostImpl* source) {}
 
   // Returns true if the render view is rendering a portal.
-  virtual bool IsPortal() const;
+  virtual bool IsPortal();
 
   // Called when the theme color for the underlying document as specified
   // by theme-color meta tag has changed.
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate_view.cc b/chromium/content/browser/renderer_host/render_view_host_delegate_view.cc
index 8bd0222a589..f6e6682fa81 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate_view.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate_view.cc
@@ -40,6 +40,6 @@ bool RenderViewHostDelegateView::DoBrowserControlsShrinkRendererSize() const {
 
 void RenderViewHostDelegateView::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {}
+    blink::mojom::InputEventResultState ack_result) {}
 
 }  //  namespace content
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate_view.h b/chromium/content/browser/renderer_host/render_view_host_delegate_view.h
index 1d3d9bb0b93..a0456b2020d 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate_view.h
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate_view.h
@@ -12,7 +12,8 @@
 #include "content/common/buildflags.h"
 #include "content/common/content_export.h"
 #include "content/common/drag_event_source_info.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
 
 namespace blink {
@@ -36,7 +37,6 @@ class RenderFrameHost;
 class RenderWidgetHostImpl;
 struct ContextMenuParams;
 struct DropData;
-struct MenuItem;
 
 // This class provides a way for the RenderViewHost to reach out to its
 // delegate's view.
@@ -95,23 +95,23 @@ class CONTENT_EXPORT RenderViewHostDelegateView {
 
   // Do post-event tasks for gesture events.
   virtual void GestureEventAck(const blink::WebGestureEvent& event,
-                               InputEventAckState ack_result);
+                               blink::mojom::InputEventResultState ack_result);
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
   // Shows a popup menu with the specified items.
-  // This method should call RenderFrameHost::DidSelectPopupMenuItem[s]() or
-  // RenderFrameHost::DidCancelPopupMenu() based on the user action.
-  virtual void ShowPopupMenu(RenderFrameHost* render_frame_host,
-                             const gfx::Rect& bounds,
-                             int item_height,
-                             double item_font_size,
-                             int selected_item,
-                             const std::vector<MenuItem>& items,
-                             bool right_aligned,
-                             bool allow_multiple_selection) {}
-
-  // Hides a popup menu opened by ShowPopupMenu().
-  virtual void HidePopupMenu() {}
+  // This method should call
+  // blink::mojom::PopupMenuClient::DidAcceptIndices() or
+  // blink::mojom::PopupMenuClient::DidCancel() based on the user action.
+  virtual void ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+      const gfx::Rect& bounds,
+      int item_height,
+      double item_font_size,
+      int selected_item,
+      std::vector<blink::mojom::MenuItemPtr> menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) {}
 #endif
 
 #if defined(OS_ANDROID)
diff --git a/chromium/content/browser/renderer_host/render_view_host_factory.cc b/chromium/content/browser/renderer_host/render_view_host_factory.cc
index f7e65761fff..305aba1bb7f 100644
--- a/chromium/content/browser/renderer_host/render_view_host_factory.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_factory.cc
@@ -6,7 +6,7 @@
 
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ptr_util.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_factory.h"
diff --git a/chromium/content/browser/renderer_host/render_view_host_impl.cc b/chromium/content/browser/renderer_host/render_view_host_impl.cc
index 01a4e3dc134..8c6deced5a7 100644
--- a/chromium/content/browser/renderer_host/render_view_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_impl.cc
@@ -89,7 +89,9 @@
 #include "ui/base/pointer/pointer_device.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/base/ui_base_switches.h"
+#include "ui/display/display.h"
 #include "ui/display/display_switches.h"
+#include "ui/display/screen.h"
 #include "ui/events/blink/blink_features.h"
 #include "ui/gfx/animation/animation.h"
 #include "ui/gfx/color_space.h"
@@ -137,6 +139,25 @@ void GetFontInfo(gfx::win::SystemFont system_font,
 }
 #endif  // OS_WIN
 
+#if defined(OS_ANDROID)
+float GetDeviceScaleAdjustment(int min_width) {
+  static const float kMinFSM = 1.05f;
+  static const int kWidthForMinFSM = 320;
+  static const float kMaxFSM = 1.3f;
+  static const int kWidthForMaxFSM = 800;
+
+  if (min_width <= kWidthForMinFSM)
+    return kMinFSM;
+  if (min_width >= kWidthForMaxFSM)
+    return kMaxFSM;
+
+  // The font scale multiplier varies linearly between kMinFSM and kMaxFSM.
+  float ratio = static_cast<float>(min_width - kWidthForMinFSM) /
+                (kWidthForMaxFSM - kWidthForMinFSM);
+  return ratio * (kMaxFSM - kMinFSM) + kMinFSM;
+}
+#endif
+
 }  // namespace
 
 // static
@@ -257,8 +278,10 @@ RenderViewHostImpl::RenderViewHostImpl(
   input_device_change_observer_ =
       std::make_unique<InputDeviceChangeObserver>(this);
 
-  page_lifecycle_state_manager_ =
-      std::make_unique<PageLifecycleStateManager>(this);
+  bool initially_visible = !GetWidget()->delegate()->IsHidden();
+  page_lifecycle_state_manager_ = std::make_unique<PageLifecycleStateManager>(
+      this, initially_visible ? blink::mojom::PageVisibilityState::kVisible
+                              : blink::mojom::PageVisibilityState::kHidden);
 
   GetWidget()->set_owner_delegate(this);
 }
@@ -310,6 +333,7 @@ SiteInstanceImpl* RenderViewHostImpl::GetSiteInstance() {
 bool RenderViewHostImpl::CreateRenderView(
     int opener_frame_route_id,
     int proxy_route_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const FrameReplicationState& replicated_frame_state,
     bool window_was_created_with_opener) {
@@ -339,7 +363,8 @@ bool RenderViewHostImpl::CreateRenderView(
     DCHECK(main_rfh);
   }
 
-  GetWidget()->set_renderer_initialized(true);
+  GetWidget()->SetRendererInitialized(
+      true, RenderWidgetHostImpl::RendererInitializer::kCreateRenderView);
 
   mojom::CreateViewParamsPtr params = mojom::CreateViewParams::New();
   params->renderer_preferences =
@@ -366,6 +391,7 @@ bool RenderViewHostImpl::CreateRenderView(
     std::tie(params->frame_widget_host, params->frame_widget) =
         main_rfh->GetRenderWidgetHost()->BindNewFrameWidgetInterfaces();
   }
+  params->main_frame_frame_token = frame_token;
   params->session_storage_namespace_id =
       delegate_->GetSessionStorageNamespace(instance_.get())->id();
   // Ensure the RenderView sets its opener correctly.
@@ -378,6 +404,7 @@ bool RenderViewHostImpl::CreateRenderView(
   if (main_rfh) {
     params->has_committed_real_load =
         main_rfh->frame_tree_node()->has_committed_real_load();
+    DCHECK_EQ(params->main_frame_frame_token, main_rfh->frame_token());
   }
   params->devtools_main_frame_token = devtools_frame_token;
   // GuestViews in the same StoragePartition need to find each other's frames.
@@ -449,6 +476,11 @@ void RenderViewHostImpl::SetIsFrozen(bool frozen) {
   page_lifecycle_state_manager_->SetIsFrozen(frozen);
 }
 
+void RenderViewHostImpl::SetVisibility(
+    blink::mojom::PageVisibilityState visibility) {
+  page_lifecycle_state_manager_->SetVisibility(visibility);
+}
+
 bool RenderViewHostImpl::IsRenderViewLive() {
   return GetProcess()->IsInitializedAndNotDead() &&
          GetWidget()->renderer_initialized();
@@ -521,6 +553,8 @@ const WebPreferences RenderViewHostImpl::ComputeWebPreferences() {
 
   prefs.accelerated_2d_canvas_enabled =
       !command_line.HasSwitch(switches::kDisableAccelerated2dCanvas);
+  prefs.new_canvas_2d_api_enabled =
+      command_line.HasSwitch(switches::kEnableNewCanvas2DAPI);
   prefs.antialiased_2d_canvas_disabled =
       command_line.HasSwitch(switches::kDisable2dCanvasAntialiasing);
   prefs.antialiased_clips_2d_canvas_enabled =
@@ -623,6 +657,14 @@ const WebPreferences RenderViewHostImpl::ComputeWebPreferences() {
   if (delegate_->HasPersistentVideo())
     prefs.media_controls_enabled = false;
 
+#if defined(OS_ANDROID)
+  display::Display display = display::Screen::GetScreen()->GetPrimaryDisplay();
+  gfx::Size size = display.GetSizeInPixel();
+  int min_width = size.width() < size.height() ? size.width() : size.height();
+  prefs.device_scale_adjustment = GetDeviceScaleAdjustment(
+      static_cast<int>(min_width / display.device_scale_factor()));
+#endif  // OS_ANDROID
+
   GetContentClient()->browser()->OverrideWebkitPrefs(this, &prefs);
   return prefs;
 }
@@ -929,7 +971,7 @@ RenderViewHostImpl::GetAssociatedPageBroadcast() {
 
 void RenderViewHostImpl::RenderWidgetDidForwardMouseEvent(
     const blink::WebMouseEvent& mouse_event) {
-  if (mouse_event.GetType() == WebInputEvent::kMouseWheel &&
+  if (mouse_event.GetType() == WebInputEvent::Type::kMouseWheel &&
       GetWidget()->IsIgnoringInputEvents()) {
     delegate_->OnIgnoredUIEvent();
   }
@@ -938,7 +980,7 @@ void RenderViewHostImpl::RenderWidgetDidForwardMouseEvent(
 bool RenderViewHostImpl::MayRenderWidgetForwardKeyboardEvent(
     const NativeWebKeyboardEvent& key_event) {
   if (GetWidget()->IsIgnoringInputEvents()) {
-    if (key_event.GetType() == WebInputEvent::kRawKeyDown)
+    if (key_event.GetType() == WebInputEvent::Type::kRawKeyDown)
       delegate_->OnIgnoredUIEvent();
     return false;
   }
diff --git a/chromium/content/browser/renderer_host/render_view_host_impl.h b/chromium/content/browser/renderer_host/render_view_host_impl.h
index 70f9ea0f650..9d3783d1b99 100644
--- a/chromium/content/browser/renderer_host/render_view_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_view_host_impl.h
@@ -123,19 +123,22 @@ class CONTENT_EXPORT RenderViewHostImpl
 
   // Set up the RenderView child process. Virtual because it is overridden by
   // TestRenderViewHost.
-  // The |opener_route_id| parameter indicates which RenderView created this
-  // (MSG_ROUTING_NONE if none).
+  // |opener_route_id| parameter indicates which RenderView created this
+  //   (MSG_ROUTING_NONE if none).
   // |window_was_created_with_opener| is true if this top-level frame was
-  // created with an opener. (The opener may have been closed since.)
-  // The |proxy_route_id| is only used when creating a RenderView in an inactive
-  // state.
-  // |devtools_frame_token| contains the devtools token for tagging requests and
-  // attributing them to the context frame.
-  // |replicated_frame_state| contains replicated data for the top-level frame,
-  // such as its name and sandbox flags.
+  //   created with an opener. (The opener may have been closed since.)
+  // |proxy_route_id| is only used when creating a RenderView in an inactive
+  //   state.
+  // |frame_token| contains the frame token for the associated
+  //   RenderFrameHostImpl or RenderFrameProxyHost.
+  // |devtools_frame_token| contains the devtools token for tagging requests
+  //   and attributing them to the context frame.
+  // |replicated_frame_state| contains replicated data for the top-level
+  //   frame, such as its name and sandbox flags.
   virtual bool CreateRenderView(
       int opener_frame_route_id,
       int proxy_route_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const FrameReplicationState& replicated_frame_state,
       bool window_was_created_with_opener);
@@ -223,6 +226,7 @@ class CONTENT_EXPORT RenderViewHostImpl
   void LeaveBackForwardCache(base::TimeTicks navigation_start);
 
   void SetIsFrozen(bool frozen);
+  void SetVisibility(blink::mojom::PageVisibilityState visibility);
 
   // Called during frame eviction to return all SurfaceIds in the frame tree.
   // Marks all views in the frame tree as evicted.
@@ -349,7 +353,7 @@ class CONTENT_EXPORT RenderViewHostImpl
                              WebPreferences* prefs);
 
   // The RenderWidgetHost.
-  std::unique_ptr<RenderWidgetHostImpl> render_widget_host_;
+  const std::unique_ptr<RenderWidgetHostImpl> render_widget_host_;
 
   // Our delegate, which wants to know about changes in the RenderView.
   RenderViewHostDelegate* delegate_;
diff --git a/chromium/content/browser/renderer_host/render_view_host_unittest.cc b/chromium/content/browser/renderer_host/render_view_host_unittest.cc
index a7f76eb7cda..bee3742a8ba 100644
--- a/chromium/content/browser/renderer_host/render_view_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_unittest.cc
@@ -102,6 +102,12 @@ class FakeFrameWidget : public blink::mojom::FrameWidget {
  private:
   void DragSourceSystemDragEnded() override {}
   void SetBackgroundOpaque(bool value) override { value_ = value; }
+  void SetInheritedEffectiveTouchActionForSubFrame(
+      const cc::TouchAction touch_action) override {}
+  void UpdateRenderThrottlingStatusForSubFrame(
+      bool is_throttled,
+      bool subtree_throttled) override {}
+  void SetIsInertForSubFrame(bool inert) override {}
 
   mojo::AssociatedReceiver<blink::mojom::FrameWidget> receiver_;
   int value_ = -1;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
index b3f58ea2a47..17927da5571 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
@@ -20,9 +20,11 @@
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/common/view_messages.h"
 #include "content/common/widget_messages.h"
+#include "content/public/browser/notification_types.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -40,6 +42,35 @@
 
 namespace content {
 
+// For tests that just need a browser opened/navigated to a simple web page.
+class RenderWidgetHostBrowserTest : public ContentBrowserTest {
+ public:
+  void SetUpOnMainThread() override {
+    ContentBrowserTest::SetUpOnMainThread();
+    EXPECT_TRUE(NavigateToURL(
+        shell(), GURL("data:text/html,<!doctype html>"
+                      "<body style='background-color: magenta;'></body>")));
+  }
+
+  WebContents* web_contents() const { return shell()->web_contents(); }
+  RenderWidgetHostViewBase* view() const {
+    return static_cast<RenderWidgetHostViewBase*>(
+        web_contents()->GetRenderWidgetHostView());
+  }
+  RenderWidgetHostImpl* host() const {
+    return static_cast<RenderWidgetHostImpl*>(view()->GetRenderWidgetHost());
+  }
+
+  void WaitForVisualPropertiesAck() {
+    while (host()->visual_properties_ack_pending_for_testing()) {
+      WindowedNotificationObserver(
+          NOTIFICATION_RENDER_WIDGET_HOST_DID_UPDATE_VISUAL_PROPERTIES,
+          Source<RenderWidgetHost>(host()))
+          .Wait();
+    }
+  }
+};
+
 // This test enables --site-per-porcess flag.
 class RenderWidgetHostSitePerProcessTest : public ContentBrowserTest {
  public:
@@ -75,8 +106,8 @@ class TestInputEventObserver : public RenderWidgetHost::InputEventObserver {
     dispatched_events_.push_back(event.GetType());
   }
 
-  void OnInputEventAck(InputEventAckSource source,
-                       InputEventAckState state,
+  void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                       blink::mojom::InputEventResultState state,
                        const blink::WebInputEvent& event) override {
     if (blink::WebInputEvent::IsTouchEventType(event.GetType()))
       acked_touch_event_type_ = event.GetType();
@@ -194,7 +225,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostTouchEmulatorBrowserTest,
         new SyntheticSmoothDragGesture(params));
 
     InputEventAckWaiter scroll_end_ack_waiter(
-        host(), blink::WebInputEvent::kGestureScrollEnd);
+        host(), blink::WebInputEvent::Type::kGestureScrollEnd);
     base::RunLoop run_loop;
     host()->QueueSyntheticGesture(
         std::move(gesture),
@@ -211,7 +242,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostTouchEmulatorBrowserTest,
     TestInputEventObserver::EventTypeVector dispatched_events =
         observer.GetAndResetDispatchedEventTypes();
     auto it_gse = std::find(dispatched_events.begin(), dispatched_events.end(),
-                            blink::WebInputEvent::kGestureScrollEnd);
+                            blink::WebInputEvent::Type::kGestureScrollEnd);
     EXPECT_NE(dispatched_events.end(), it_gse);
   } while (!touch_emulator->suppress_next_fling_cancel_for_testing());
 }
@@ -235,139 +266,163 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostTouchEmulatorBrowserTest,
 
   // Simulate a mouse move without any pressed buttons. This should not
   // generate any touch events.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 10, 0, false);
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 10, 0,
+                           false);
   TestInputEventObserver::EventTypeVector dispatched_events =
       observer.GetAndResetDispatchedEventTypes();
   EXPECT_EQ(0u, dispatched_events.size());
 
   // Mouse press becomes touch start which in turn becomes tap.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseDown, 10, 10, 0, true);
-  WaitForAckWith(blink::WebInputEvent::kTouchStart);
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseDown, 10, 10, 0,
+                           true);
+  WaitForAckWith(blink::WebInputEvent::Type::kTouchStart);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown, dispatched_events[1]);
 
   // Mouse drag generates touch move, cancels tap and starts scroll.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 30, 0, true);
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 30, 0,
+                           true);
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(4u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapCancel, dispatched_events[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin, dispatched_events[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate, dispatched_events[3]);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapCancel,
+            dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
+            dispatched_events[2]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
+            dispatched_events[3]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   EXPECT_EQ(0u, observer.GetAndResetDispatchedEventTypes().size());
 
   // Mouse drag with shift becomes pinch.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 35,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 35,
                            blink::WebInputEvent::kShiftKey, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
 
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchBegin, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchBegin,
+            dispatched_events[1]);
 
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 50,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 50,
                            blink::WebInputEvent::kShiftKey, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
 
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchUpdate, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchUpdate,
+            dispatched_events[1]);
 
   // Mouse drag without shift becomes scroll again.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 60, 0, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 60, 0,
+                           true);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
 
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(3u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchEnd, dispatched_events[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate, dispatched_events[2]);
-
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 70, 0, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchEnd, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
+            dispatched_events[2]);
+
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 70, 0,
+                           true);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
+            dispatched_events[1]);
 
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseUp, 10, 70, 0, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchEnd, observer.acked_touch_event_type());
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseUp, 10, 70, 0,
+                           true);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchEnd,
+            observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchEnd, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchEnd, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
+            dispatched_events[1]);
 
   // Mouse move does nothing.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 80, 0, false);
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 80, 0,
+                           false);
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   EXPECT_EQ(0u, dispatched_events.size());
 
   // Another mouse down continues scroll.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseDown, 10, 80, 0, true);
-  WaitForAckWith(blink::WebInputEvent::kTouchStart);
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseDown, 10, 80, 0,
+                           true);
+  WaitForAckWith(blink::WebInputEvent::Type::kTouchStart);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown, dispatched_events[1]);
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 100, 0, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown, dispatched_events[1]);
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 100, 0,
+                           true);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(4u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapCancel, dispatched_events[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin, dispatched_events[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate, dispatched_events[3]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapCancel,
+            dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
+            dispatched_events[2]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
+            dispatched_events[3]);
   EXPECT_EQ(0u, observer.GetAndResetDispatchedEventTypes().size());
 
   // Another pinch.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 110,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 110,
                            blink::WebInputEvent::kShiftKey, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   EXPECT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchBegin, dispatched_events[1]);
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 120,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchBegin,
+            dispatched_events[1]);
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 120,
                            blink::WebInputEvent::kShiftKey, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   EXPECT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchUpdate, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchUpdate,
+            dispatched_events[1]);
 
   // Turn off emulation during a pinch.
   host()->GetTouchEmulator()->Disable();
-  EXPECT_EQ(blink::WebInputEvent::kTouchCancel,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchCancel,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(3u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchCancel, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchEnd, dispatched_events[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd, dispatched_events[2]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchCancel, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchEnd, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
+            dispatched_events[2]);
 
   // Mouse event should pass untouched.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 10,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 10,
                            blink::WebInputEvent::kShiftKey, true);
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(1u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kMouseMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kMouseMove, dispatched_events[0]);
 
   // Turn on emulation.
   host()->GetTouchEmulator()->Enable(
@@ -375,36 +430,42 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostTouchEmulatorBrowserTest,
       ui::GestureProviderConfigType::GENERIC_MOBILE);
 
   // Another touch.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseDown, 10, 10, 0, true);
-  WaitForAckWith(blink::WebInputEvent::kTouchStart);
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseDown, 10, 10, 0,
+                           true);
+  WaitForAckWith(blink::WebInputEvent::Type::kTouchStart);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown, dispatched_events[1]);
 
   // Scroll.
-  SimulateRoutedMouseEvent(blink::WebInputEvent::kMouseMove, 10, 30, 0, true);
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove,
+  SimulateRoutedMouseEvent(blink::WebInputEvent::Type::kMouseMove, 10, 30, 0,
+                           true);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove,
             observer.acked_touch_event_type());
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(4u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchMove, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapCancel, dispatched_events[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin, dispatched_events[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate, dispatched_events[3]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchMove, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapCancel,
+            dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
+            dispatched_events[2]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
+            dispatched_events[3]);
   EXPECT_EQ(0u, observer.GetAndResetDispatchedEventTypes().size());
 
   // Turn off emulation during a scroll.
   host()->GetTouchEmulator()->Disable();
-  EXPECT_EQ(blink::WebInputEvent::kTouchCancel,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchCancel,
             observer.acked_touch_event_type());
 
   dispatched_events = observer.GetAndResetDispatchedEventTypes();
   ASSERT_EQ(2u, dispatched_events.size());
-  EXPECT_EQ(blink::WebInputEvent::kTouchCancel, dispatched_events[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd, dispatched_events[1]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchCancel, dispatched_events[0]);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
+            dispatched_events[1]);
 
   host()->RemoveInputEventObserver(&observer);
 }
@@ -480,7 +541,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostSitePerProcessTest,
   // Open the <select> menu by focusing it and sending a space key
   // at the focused node. This creates a popup widget.
   NativeWebKeyboardEvent event(
-      blink::WebKeyboardEvent::kChar, blink::WebInputEvent::kNoModifiers,
+      blink::WebKeyboardEvent::Type::kChar, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   event.text[0] = ' ';
 
@@ -563,4 +624,59 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostSitePerProcessTest,
 }
 #endif
 
+// Tests that the renderer receives the blink::WebScreenInfo size overrides
+// while the page is in fullscreen mode. This is a regression test for
+// https://crbug.com/1060795.
+IN_PROC_BROWSER_TEST_F(RenderWidgetHostBrowserTest,
+                       PropagatesFullscreenSizeOverrides) {
+  class FullscreenWaiter : public WebContentsObserver {
+   public:
+    explicit FullscreenWaiter(WebContents* wc) : WebContentsObserver(wc) {}
+
+    void Wait(bool enter) {
+      if (web_contents()->IsFullscreenForCurrentTab() != enter) {
+        run_loop_.Run();
+      }
+      EXPECT_EQ(enter, web_contents()->IsFullscreenForCurrentTab());
+    }
+
+   private:
+    void DidToggleFullscreenModeForTab(bool entered,
+                                       bool will_resize) override {
+      run_loop_.Quit();
+    }
+
+    base::RunLoop run_loop_;
+  };
+
+  // Sanity-check: Ensure the Shell and WebContents both agree the browser is
+  // not currently in fullscreen.
+  ASSERT_FALSE(shell()->IsFullscreenForTabOrPending(web_contents()));
+  ASSERT_FALSE(web_contents()->IsFullscreenForCurrentTab());
+
+  // While not fullscreened, expect the screen size to not be overridden.
+  ScreenInfo screen_info;
+  host()->GetScreenInfo(&screen_info);
+  WaitForVisualPropertiesAck();
+  EXPECT_EQ(screen_info.rect.size().ToString(),
+            EvalJs(web_contents(), "`${screen.width}x${screen.height}`"));
+
+  // Enter fullscreen mode. The Content Shell does not resize the view to fill
+  // the entire screen, and so the page will see the view's size as the screen
+  // size. This confirms the ScreenInfo override logic is working.
+  ASSERT_TRUE(ExecJs(web_contents(), "document.body.requestFullscreen();"));
+  FullscreenWaiter(web_contents()).Wait(true);
+  WaitForVisualPropertiesAck();
+  EXPECT_EQ(view()->GetRequestedRendererSize().ToString(),
+            EvalJs(web_contents(), "`${screen.width}x${screen.height}`"));
+
+  // Exit fullscreen mode, and then the page should see the screen size again.
+  ASSERT_TRUE(ExecJs(web_contents(), "document.exitFullscreen();"));
+  FullscreenWaiter(web_contents()).Wait(false);
+  host()->GetScreenInfo(&screen_info);
+  WaitForVisualPropertiesAck();
+  EXPECT_EQ(screen_info.rect.size().ToString(),
+            EvalJs(web_contents(), "`${screen.width}x${screen.height}`"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_delegate.cc b/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
index 62bd6725706..1c24e3dbe71 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
@@ -8,6 +8,7 @@
 #include "components/rappor/public/sample.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "ui/gfx/geometry/rect.h"
 
 namespace content {
@@ -87,8 +88,7 @@ bool RenderWidgetHostDelegate::ShouldShowStaleContentOnEviction() {
   return false;
 }
 
-blink::mojom::DisplayMode RenderWidgetHostDelegate::GetDisplayMode(
-    RenderWidgetHostImpl* render_widget_host) const {
+blink::mojom::DisplayMode RenderWidgetHostDelegate::GetDisplayMode() const {
   return blink::mojom::DisplayMode::kBrowser;
 }
 
@@ -141,8 +141,7 @@ bool RenderWidgetHostDelegate::AddDomainInfoToRapporSample(
   return false;
 }
 
-ukm::SourceId RenderWidgetHostDelegate::GetUkmSourceIdForLastCommittedSource()
-    const {
+ukm::SourceId RenderWidgetHostDelegate::GetCurrentPageUkmSourceId() {
   return ukm::kInvalidSourceId;
 }
 
@@ -159,7 +158,7 @@ RenderWidgetHostDelegate::GetFocusedFrameFromFocusedDelegate() {
   return nullptr;
 }
 
-bool RenderWidgetHostDelegate::IsPortal() const {
+bool RenderWidgetHostDelegate::IsPortal() {
   return false;
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_delegate.h b/chromium/content/browser/renderer_host/render_widget_host_delegate.h
index 234baaefaa3..2edad626684 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_delegate.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_delegate.h
@@ -148,9 +148,12 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
   virtual void ExecuteEditCommand(
       const std::string& command,
       const base::Optional<base::string16>& value) = 0;
+  virtual void Undo() = 0;
+  virtual void Redo() = 0;
   virtual void Cut() = 0;
   virtual void Copy() = 0;
   virtual void Paste() = 0;
+  virtual void PasteAndMatchStyle() = 0;
   virtual void SelectAll() = 0;
 
   // Requests the renderer to move the selection extent to a new position.
@@ -218,9 +221,9 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
   // solid color is displayed instead.
   virtual bool ShouldShowStaleContentOnEviction();
 
-  // Returns the display mode for the view.
-  virtual blink::mojom::DisplayMode GetDisplayMode(
-      RenderWidgetHostImpl* render_widget_host) const;
+  // Returns the display mode for all widgets in the frame tree. Only applies
+  // to frame-based widgets. Other widgets are always kBrowser.
+  virtual blink::mojom::DisplayMode GetDisplayMode() const;
 
   // Notification that the widget has lost capture.
   virtual void LostCapture(RenderWidgetHostImpl* render_widget_host) {}
@@ -304,15 +307,16 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
   // if the eTLD+1 is not known for |render_widget_host|.
   virtual bool AddDomainInfoToRapporSample(rappor::Sample* sample);
 
-  // Get the UKM source ID for current content. This is used for providing
-  // data about the content to the URL-keyed metrics service.
-  // Note: This is also exposed by the RenderFrameHostDelegate.
-  virtual ukm::SourceId GetUkmSourceIdForLastCommittedSource() const;
-
   // Return this object cast to a WebContents, if it is one. If the object is
   // not a WebContents, returns nullptr.
   virtual WebContents* GetAsWebContents();
 
+  // Get the UKM source ID for current content. This is used for providing
+  // data about the content to the URL-keyed metrics service.
+  // Note: Prefer using RenderFrameHost::GetPageUkmSourceId wherever
+  // possible.
+  virtual ukm::SourceId GetCurrentPageUkmSourceId();
+
   // Returns true if there is context menu shown on page.
   virtual bool IsShowingContextMenuOnPage() const;
 
@@ -329,7 +333,7 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
       viz::VerticalScrollDirection scroll_direction) {}
 
   // Returns true if the delegate is a portal.
-  virtual bool IsPortal() const;
+  virtual bool IsPortal();
 
   // Notify the delegate that the screen orientation has been changed.
   virtual void DidChangeScreenOrientation() {}
diff --git a/chromium/content/browser/renderer_host/render_widget_host_impl.cc b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
index fc06067480b..a0e62a06462 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
@@ -68,7 +68,6 @@
 #include "content/common/cursors/webcursor.h"
 #include "content/common/drag_messages.h"
 #include "content/common/frame_messages.h"
-#include "content/common/input/sync_compositor_messages.h"
 #include "content/common/input_messages.h"
 #include "content/common/text_input_state.h"
 #include "content/common/view_messages.h"
@@ -247,19 +246,13 @@ class UnboundWidgetInputHandler : public mojom::WidgetInputHandler {
   void MouseCaptureLost() override {
     DLOG(WARNING) << "Input request on unbound interface";
   }
-  void MouseLockLost() override {
-    DLOG(WARNING) << "Input request on unbound interface";
-  }
   void SetEditCommandsForNextKeyEvent(
-      const std::vector<content::EditCommand>& commands) override {
+      std::vector<blink::mojom::EditCommandPtr> commands) override {
     DLOG(WARNING) << "Input request on unbound interface";
   }
   void CursorVisibilityChanged(bool visible) override {
     DLOG(WARNING) << "Input request on unbound interface";
   }
-  void FallbackCursorModeToggled(bool is_on) override {
-    DLOG(WARNING) << "Input request on unbound interface";
-  }
   void ImeSetComposition(const base::string16& text,
                          const std::vector<ui::ImeTextSpan>& ime_text_spans,
                          const gfx::Range& range,
@@ -517,7 +510,7 @@ void RenderWidgetHostImpl::UpdatePriority() {
 void RenderWidgetHostImpl::Init() {
   DCHECK(process_->IsInitializedAndNotDead());
 
-  renderer_initialized_ = true;
+  SetRendererInitialized(true, RendererInitializer::kInit);
 
   SendScreenRects();
   SynchronizeVisualProperties();
@@ -578,7 +571,7 @@ void RenderWidgetHostImpl::BindFrameWidgetInterfaces(
 
 void RenderWidgetHostImpl::InitForFrame() {
   DCHECK(process_->IsInitializedAndNotDead());
-  renderer_initialized_ = true;
+  SetRendererInitialized(true, RendererInitializer::kInitForFrame);
 
   if (view_)
     view_->OnRenderWidgetInit();
@@ -616,10 +609,6 @@ bool RenderWidgetHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnUpdateScreenRectsAck)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_RequestSetBounds, OnRequestSetBounds)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_SetTooltipText, OnSetTooltipText)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_SetCursor, OnSetCursor)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_AutoscrollStart, OnAutoscrollStart)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_AutoscrollFling, OnAutoscrollFling)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_AutoscrollEnd, OnAutoscrollEnd)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_TextInputStateChanged,
                         OnTextInputStateChanged)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_SelectionBoundsChanged,
@@ -632,14 +621,6 @@ bool RenderWidgetHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnForceRedrawComplete)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_DidFirstVisuallyNonEmptyPaint,
                         OnFirstVisuallyNonEmptyPaint)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_HasTouchEventHandlers,
-                        OnHasTouchEventHandlers)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_IntrinsicSizingInfoChanged,
-                        OnIntrinsicSizingInfoChanged)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_AnimateDoubleTapZoomInMainFrame,
-                        OnAnimateDoubleTapZoomInMainFrame)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_ZoomToFindInPageRectInMainFrame,
-                        OnZoomToFindInPageRectInMainFrame)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
 
@@ -781,13 +762,24 @@ VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
   // which are to be sent to the renderer process.
   DCHECK(view_);
 
+  // Differentiate between widgets for frames vs widgets for popups/pepper.
+  // Historically this was done by finding the RenderViewHost for the widget,
+  // but a child local root would not convert to a RenderViewHost but is for a
+  // frame.
+  const bool is_frame_widget = owner_delegate_ || owned_by_render_frame_host_;
+
   VisualProperties visual_properties;
 
   GetScreenInfo(&visual_properties.screen_info);
+  // Note: Later in this method, ScreenInfo rects might be overridden!
 
   visual_properties.is_fullscreen_granted =
       delegate_->IsFullscreenForCurrentTab();
-  visual_properties.display_mode = delegate_->GetDisplayMode(this);
+
+  if (is_frame_widget)
+    visual_properties.display_mode = delegate_->GetDisplayMode();
+  else
+    visual_properties.display_mode = blink::mojom::DisplayMode::kBrowser;
   visual_properties.zoom_level = delegate_->GetPendingPageZoomLevel();
 
   RenderViewHostDelegateView* rvh_delegate_view = delegate_->GetDelegateView();
@@ -827,6 +819,17 @@ VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
 
   visual_properties.new_size = view_->GetRequestedRendererSize();
 
+  // While in fullscreen mode, set the ScreenInfo rects to match the view size.
+  // This is needed because web authors often assume screen.width/height are
+  // identical to window.innerWidth/innerHeight while a page is in fullscreen,
+  // and this is not always true for some browser UI features.
+  // https://crbug.com/1060795
+  if (visual_properties.is_fullscreen_granted) {
+    visual_properties.screen_info.rect.set_size(visual_properties.new_size);
+    visual_properties.screen_info.available_rect.set_size(
+        visual_properties.new_size);
+  }
+
   // This widget is for a frame that is the main frame of the outermost frame
   // tree. That makes it the top-most frame. OR this is a non-frame widget.
   const bool is_top_most_widget = !view_->IsRenderWidgetHostViewChildFrame();
@@ -1116,7 +1119,7 @@ void RenderWidgetHostImpl::LostMouseLock() {
 }
 
 void RenderWidgetHostImpl::SendMouseLockLost() {
-  widget_input_handler_->MouseLockLost();
+  mouse_lock_context_.reset();
 }
 
 void RenderWidgetHostImpl::ViewDestroyed() {
@@ -1227,8 +1230,8 @@ void RenderWidgetHostImpl::ForwardMouseEventWithLatencyInfo(
                mouse_event.PositionInWidget().x(), "y",
                mouse_event.PositionInWidget().y());
 
-  DCHECK_GE(mouse_event.GetType(), blink::WebInputEvent::kMouseTypeFirst);
-  DCHECK_LE(mouse_event.GetType(), blink::WebInputEvent::kMouseTypeLast);
+  DCHECK_GE(mouse_event.GetType(), blink::WebInputEvent::Type::kMouseTypeFirst);
+  DCHECK_LE(mouse_event.GetType(), blink::WebInputEvent::Type::kMouseTypeLast);
 
   for (size_t i = 0; i < mouse_event_callbacks_.size(); ++i) {
     if (mouse_event_callbacks_[i].Run(mouse_event))
@@ -1324,7 +1327,8 @@ void RenderWidgetHostImpl::ForwardGestureEventWithLatencyInfo(
   DCHECK_NE(gesture_event.SourceDevice(),
             blink::WebGestureDevice::kUninitialized);
 
-  if (gesture_event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+  if (gesture_event.GetType() ==
+      blink::WebInputEvent::Type::kGestureScrollBegin) {
     DCHECK(
         !is_in_gesture_scroll_[static_cast<int>(gesture_event.SourceDevice())]);
     is_in_gesture_scroll_[static_cast<int>(gesture_event.SourceDevice())] =
@@ -1332,7 +1336,7 @@ void RenderWidgetHostImpl::ForwardGestureEventWithLatencyInfo(
     scroll_peak_gpu_mem_tracker_ =
         PeakGpuMemoryTracker::Create(PeakGpuMemoryTracker::Usage::SCROLL);
   } else if (gesture_event.GetType() ==
-             blink::WebInputEvent::kGestureScrollEnd) {
+             blink::WebInputEvent::Type::kGestureScrollEnd) {
     DCHECK(
         is_in_gesture_scroll_[static_cast<int>(gesture_event.SourceDevice())]);
     is_in_gesture_scroll_[static_cast<int>(gesture_event.SourceDevice())] =
@@ -1353,7 +1357,7 @@ void RenderWidgetHostImpl::ForwardGestureEventWithLatencyInfo(
     }
     scroll_peak_gpu_mem_tracker_ = nullptr;
   } else if (gesture_event.GetType() ==
-             blink::WebInputEvent::kGestureFlingStart) {
+             blink::WebInputEvent::Type::kGestureFlingStart) {
     if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchpad) {
       // TODO(sahel): Remove the VR specific case when motion events are used
       // for Android VR event processing and VR touchpad scrolling is handled by
@@ -1422,8 +1426,8 @@ void RenderWidgetHostImpl::ForwardKeyboardEvent(
     const NativeWebKeyboardEvent& key_event) {
   ui::LatencyInfo latency_info;
 
-  if (key_event.GetType() == WebInputEvent::kRawKeyDown ||
-      key_event.GetType() == WebInputEvent::kChar) {
+  if (key_event.GetType() == WebInputEvent::Type::kRawKeyDown ||
+      key_event.GetType() == WebInputEvent::Type::kChar) {
     latency_info.set_source_event_type(ui::SourceEventType::KEY_PRESS);
   }
   ForwardKeyboardEventWithLatencyInfo(key_event, latency_info);
@@ -1432,13 +1436,14 @@ void RenderWidgetHostImpl::ForwardKeyboardEvent(
 void RenderWidgetHostImpl::ForwardKeyboardEventWithLatencyInfo(
     const NativeWebKeyboardEvent& key_event,
     const ui::LatencyInfo& latency) {
-  ForwardKeyboardEventWithCommands(key_event, latency, nullptr, nullptr);
+  ForwardKeyboardEventWithCommands(
+      key_event, latency, std::vector<blink::mojom::EditCommandPtr>(), nullptr);
 }
 
 void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
     const NativeWebKeyboardEvent& key_event,
     const ui::LatencyInfo& latency,
-    const std::vector<EditCommand>* commands,
+    std::vector<blink::mojom::EditCommandPtr> commands,
     bool* update_event) {
   DCHECK(WebInputEvent::IsKeyboardEventType(key_event.GetType()));
 
@@ -1459,7 +1464,7 @@ void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
   if (KeyPressListenersHandleEvent(key_event)) {
     // Some keypresses that are accepted by the listener may be followed by Char
     // and KeyUp events, which should be ignored.
-    if (key_event.GetType() == WebKeyboardEvent::kRawKeyDown)
+    if (key_event.GetType() == WebKeyboardEvent::Type::kRawKeyDown)
       suppress_events_until_keydown_ = true;
     return;
   }
@@ -1468,11 +1473,11 @@ void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
     // If the preceding RawKeyDown event was handled by the browser, then we
     // need to suppress all events generated by it until the next RawKeyDown or
     // KeyDown event.
-    if (key_event.GetType() == WebKeyboardEvent::kKeyUp ||
-        key_event.GetType() == WebKeyboardEvent::kChar)
+    if (key_event.GetType() == WebKeyboardEvent::Type::kKeyUp ||
+        key_event.GetType() == WebKeyboardEvent::Type::kChar)
       return;
-    DCHECK(key_event.GetType() == WebKeyboardEvent::kRawKeyDown ||
-           key_event.GetType() == WebKeyboardEvent::kKeyDown);
+    DCHECK(key_event.GetType() == WebKeyboardEvent::Type::kRawKeyDown ||
+           key_event.GetType() == WebKeyboardEvent::Type::kKeyDown);
     suppress_events_until_keydown_ = false;
   }
 
@@ -1484,7 +1489,7 @@ void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
     // PreHandleKeyboardEvent() handles the event, but |this| may already be
     // destroyed at that time. So set |suppress_events_until_keydown_| true
     // here, then revert it afterwards when necessary.
-    if (key_event.GetType() == WebKeyboardEvent::kRawKeyDown)
+    if (key_event.GetType() == WebKeyboardEvent::Type::kRawKeyDown)
       suppress_events_until_keydown_ = true;
 
     // Tab switching/closing accelerators aren't sent to the renderer to avoid
@@ -1505,7 +1510,7 @@ void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
         break;
     }
 
-    if (key_event.GetType() == WebKeyboardEvent::kRawKeyDown)
+    if (key_event.GetType() == WebKeyboardEvent::Type::kRawKeyDown)
       suppress_events_until_keydown_ = false;
   }
 
@@ -1521,8 +1526,9 @@ void RenderWidgetHostImpl::ForwardKeyboardEventWithCommands(
   // WidgetInputHandler::SetEditCommandsForNextKeyEvent should only be sent if
   // WidgetInputHandler::DispatchEvent is, but has to be sent first.
   // https://crbug.com/684298
-  if (commands && !commands->empty())
-    GetWidgetInputHandler()->SetEditCommandsForNextKeyEvent(*commands);
+  if (!commands.empty())
+    GetWidgetInputHandler()->SetEditCommandsForNextKeyEvent(
+        std::move(commands));
 
   input_router_->SendKeyboardEvent(
       key_event_with_latency,
@@ -1587,20 +1593,10 @@ void RenderWidgetHostImpl::SetCursor(const WebCursor& cursor) {
   view_->UpdateCursor(cursor);
 }
 
-void RenderWidgetHostImpl::ShowContextMenuAtPoint(
-    const gfx::Point& point,
-    const ui::MenuSourceType source_type) {
-  Send(new WidgetMsg_ShowContextMenu(GetRoutingID(), source_type, point));
-}
-
 void RenderWidgetHostImpl::OnCursorVisibilityStateChanged(bool is_visible) {
   GetWidgetInputHandler()->CursorVisibilityChanged(is_visible);
 }
 
-void RenderWidgetHostImpl::OnFallbackCursorModeToggled(bool is_on) {
-  GetWidgetInputHandler()->FallbackCursorModeToggled(is_on);
-}
-
 // static
 void RenderWidgetHostImpl::DisableResizeAckCheckForTesting() {
   g_check_for_pending_visual_properties_ack = false;
@@ -1672,6 +1668,10 @@ void RenderWidgetHostImpl::GetScreenInfo(ScreenInfo* result) {
     input_router_->SetDeviceScaleFactor(result->device_scale_factor);
 }
 
+base::Optional<cc::TouchAction> RenderWidgetHostImpl::GetAllowedTouchAction() {
+  return input_router_->AllowedTouchAction();
+}
+
 void RenderWidgetHostImpl::DragTargetDragEnter(
     const DropData& drop_data,
     const gfx::PointF& client_pt,
@@ -1751,6 +1751,12 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
   SetCursor(WebCursor(cursor));
 }
 
+void RenderWidgetHostImpl::ShowContextMenuAtPoint(
+    const gfx::Point& point,
+    const ui::MenuSourceType source_type) {
+  Send(new WidgetMsg_ShowContextMenu(GetRoutingID(), source_type, point));
+}
+
 RenderProcessHost::Priority RenderWidgetHostImpl::GetPriority() {
   RenderProcessHost::Priority priority = {
     is_hidden_,
@@ -1943,7 +1949,7 @@ void RenderWidgetHostImpl::RendererExited() {
 
   // Clearing this flag causes us to re-create the renderer when recovering
   // from a crashed renderer.
-  renderer_initialized_ = false;
+  SetRendererInitialized(false, RendererInitializer::kUnknown);
 
   // After the renderer crashes, the view is destroyed and so the
   // RenderWidgetHost cannot track its visibility anymore. We assume such
@@ -2054,7 +2060,8 @@ void RenderWidgetHostImpl::RejectMouseLockOrUnlockIfNecessary(
     DCHECK(request_mouse_callback_);
     pending_mouse_lock_request_ = false;
     mouse_lock_raw_movement_ = false;
-    std::move(request_mouse_callback_).Run(reason);
+    std::move(request_mouse_callback_)
+        .Run(reason, /*context=*/mojo::NullRemote());
 
   } else if (IsMouseLocked()) {
     view_->UnlockMouse();
@@ -2076,8 +2083,8 @@ void RenderWidgetHostImpl::GetContentRenderingTimeoutFrom(
 
 void RenderWidgetHostImpl::OnMouseEventAck(
     const MouseEventWithLatencyInfo& mouse_event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   latency_tracker_.OnInputEventAck(mouse_event.event, &mouse_event.latency,
                                    ack_result);
   for (auto& input_event_observer : input_event_observers_)
@@ -2086,7 +2093,9 @@ void RenderWidgetHostImpl::OnMouseEventAck(
 
   // Give the delegate the ability to handle a mouse event that wasn't consumed
   // by the renderer. eg. Back/Forward mouse buttons.
-  if (delegate_ && ack_result != INPUT_EVENT_ACK_STATE_CONSUMED && !is_hidden())
+  if (delegate_ &&
+      ack_result != blink::mojom::InputEventResultState::kConsumed &&
+      !is_hidden())
     delegate_->HandleMouseEvent(mouse_event.event);
 }
 
@@ -2191,18 +2200,14 @@ void RenderWidgetHostImpl::ClearDisplayedGraphics() {
 
 void RenderWidgetHostImpl::OnKeyboardEventAck(
     const NativeWebKeyboardEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   latency_tracker_.OnInputEventAck(event.event, &event.latency, ack_result);
   for (auto& input_event_observer : input_event_observers_)
     input_event_observer.OnInputEventAck(ack_source, ack_result, event.event);
 
-  bool processed = (INPUT_EVENT_ACK_STATE_CONSUMED == ack_result);
-
-  // The view may be destroyed by the time we get this ack, as is the case with
-  // portal activations.
-  if (!processed && GetView())
-    processed = GetView()->OnUnconsumedKeyboardEventAck(event);
+  bool processed =
+      (blink::mojom::InputEventResultState::kConsumed == ack_result);
 
   // We only send unprocessed key event upwards if we are not hidden,
   // because the user has moved away from us and no longer expect any effect
@@ -2417,11 +2422,7 @@ bool RenderWidgetHostImpl::StoredVisualPropertiesNeedsUpdate(
              new_visual_properties.is_pinch_gesture_active;
 }
 
-void RenderWidgetHostImpl::OnSetCursor(const WebCursor& cursor) {
-  SetCursor(cursor);
-}
-
-void RenderWidgetHostImpl::OnAutoscrollStart(const gfx::PointF& position) {
+void RenderWidgetHostImpl::AutoscrollStart(const gfx::PointF& position) {
   GetView()->OnAutoscrollStart();
   sent_autoscroll_scroll_begin_ = false;
   autoscroll_in_progress_ = true;
@@ -2430,12 +2431,12 @@ void RenderWidgetHostImpl::OnAutoscrollStart(const gfx::PointF& position) {
   autoscroll_start_position_ = position;
 }
 
-void RenderWidgetHostImpl::OnAutoscrollFling(const gfx::Vector2dF& velocity) {
+void RenderWidgetHostImpl::AutoscrollFling(const gfx::Vector2dF& velocity) {
   DCHECK(autoscroll_in_progress_);
   if (!sent_autoscroll_scroll_begin_ && velocity != gfx::Vector2dF()) {
     // Send a GSB event with valid delta hints.
     WebGestureEvent scroll_begin = SyntheticWebGestureEventBuilder::Build(
-        WebInputEvent::kGestureScrollBegin,
+        WebInputEvent::Type::kGestureScrollBegin,
         blink::WebGestureDevice::kSyntheticAutoscroll);
     scroll_begin.SetPositionInWidget(autoscroll_start_position_);
     scroll_begin.data.scroll_begin.delta_x_hint = velocity.x();
@@ -2447,7 +2448,7 @@ void RenderWidgetHostImpl::OnAutoscrollFling(const gfx::Vector2dF& velocity) {
   }
 
   WebGestureEvent event = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureFlingStart,
+      WebInputEvent::Type::kGestureFlingStart,
       blink::WebGestureDevice::kSyntheticAutoscroll);
   event.SetPositionInWidget(autoscroll_start_position_);
   event.data.fling_start.velocity_x = velocity.x();
@@ -2457,7 +2458,7 @@ void RenderWidgetHostImpl::OnAutoscrollFling(const gfx::Vector2dF& velocity) {
       event, ui::LatencyInfo(ui::SourceEventType::OTHER));
 }
 
-void RenderWidgetHostImpl::OnAutoscrollEnd() {
+void RenderWidgetHostImpl::AutoscrollEnd() {
   autoscroll_in_progress_ = false;
 
   delegate()->GetInputEventRouter()->SetAutoScrollInProgress(
@@ -2468,7 +2469,7 @@ void RenderWidgetHostImpl::OnAutoscrollEnd() {
 
   sent_autoscroll_scroll_begin_ = false;
   WebGestureEvent cancel_event = SyntheticWebGestureEventBuilder::Build(
-      WebInputEvent::kGestureFlingCancel,
+      WebInputEvent::Type::kGestureFlingCancel,
       blink::WebGestureDevice::kSyntheticAutoscroll);
   cancel_event.data.fling_cancel.prevent_boosting = true;
   cancel_event.SetPositionInWidget(autoscroll_start_position_);
@@ -2533,12 +2534,14 @@ void RenderWidgetHostImpl::RequestMouseLock(
     bool unadjusted_movement,
     InputRouterImpl::RequestMouseLockCallback response) {
   if (pending_mouse_lock_request_) {
-    std::move(response).Run(blink::mojom::PointerLockResult::kAlreadyLocked);
+    std::move(response).Run(blink::mojom::PointerLockResult::kAlreadyLocked,
+                            /*context=*/mojo::NullRemote());
     return;
   }
 
   if (!view_ || !view_->HasFocus()) {
-    std::move(response).Run(blink::mojom::PointerLockResult::kWrongDocument);
+    std::move(response).Run(blink::mojom::PointerLockResult::kWrongDocument,
+                            /*context=*/mojo::NullRemote());
     return;
   }
 
@@ -2566,7 +2569,7 @@ void RenderWidgetHostImpl::RequestMouseLock(
 
 void RenderWidgetHostImpl::RequestMouseLockChange(
     bool unadjusted_movement,
-    InputRouterImpl::RequestMouseLockCallback response) {
+    PointerLockContext::RequestMouseLockChangeCallback response) {
   if (pending_mouse_lock_request_) {
     std::move(response).Run(blink::mojom::PointerLockResult::kAlreadyLocked);
     return;
@@ -2590,17 +2593,6 @@ void RenderWidgetHostImpl::UnlockMouse() {
     is_last_unlocked_by_target_ = true;
 }
 
-void RenderWidgetHostImpl::FallbackCursorModeLockCursor(bool left,
-                                                        bool right,
-                                                        bool up,
-                                                        bool down) {
-  GetView()->FallbackCursorModeLockCursor(left, right, up, down);
-}
-
-void RenderWidgetHostImpl::FallbackCursorModeSetCursorVisibility(bool visible) {
-  GetView()->FallbackCursorModeSetCursorVisibility(visible);
-}
-
 void RenderWidgetHostImpl::OnInvalidFrameToken(uint32_t frame_token) {
   bad_message::ReceivedBadMessage(GetProcess(),
                                   bad_message::RWH_INVALID_FRAME_TOKEN);
@@ -2659,7 +2651,8 @@ RenderWidgetHostImpl::GetKeyboardLayoutMap() {
 
 bool RenderWidgetHostImpl::KeyPressListenersHandleEvent(
     const NativeWebKeyboardEvent& event) {
-  if (event.skip_in_browser || event.GetType() != WebKeyboardEvent::kRawKeyDown)
+  if (event.skip_in_browser ||
+      event.GetType() != WebKeyboardEvent::Type::kRawKeyDown)
     return false;
 
   for (size_t i = 0; i < key_press_event_callbacks_.size(); i++) {
@@ -2679,28 +2672,30 @@ bool RenderWidgetHostImpl::KeyPressListenersHandleEvent(
   return false;
 }
 
-InputEventAckState RenderWidgetHostImpl::FilterInputEvent(
-    const blink::WebInputEvent& event, const ui::LatencyInfo& latency_info) {
+blink::mojom::InputEventResultState RenderWidgetHostImpl::FilterInputEvent(
+    const blink::WebInputEvent& event,
+    const ui::LatencyInfo& latency_info) {
   // Don't ignore touch cancel events, since they may be sent while input
   // events are being ignored in order to keep the renderer from getting
   // confused about how many touches are active.
-  if (IsIgnoringInputEvents() && event.GetType() != WebInputEvent::kTouchCancel)
-    return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+  if (IsIgnoringInputEvents() &&
+      event.GetType() != WebInputEvent::Type::kTouchCancel)
+    return blink::mojom::InputEventResultState::kNoConsumerExists;
 
   if (!process_->IsInitializedAndNotDead())
-    return INPUT_EVENT_ACK_STATE_UNKNOWN;
+    return blink::mojom::InputEventResultState::kUnknown;
 
   if (delegate_) {
-    if (event.GetType() == WebInputEvent::kMouseDown ||
-        event.GetType() == WebInputEvent::kTouchStart ||
-        event.GetType() == WebInputEvent::kGestureTap) {
+    if (event.GetType() == WebInputEvent::Type::kMouseDown ||
+        event.GetType() == WebInputEvent::Type::kTouchStart ||
+        event.GetType() == WebInputEvent::Type::kGestureTap) {
       delegate_->FocusOwningWebContents(this);
     }
     delegate_->DidReceiveInputEvent(this, event.GetType());
   }
 
   return view_ ? view_->FilterInputEvent(event)
-               : INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+               : blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 void RenderWidgetHostImpl::IncrementInFlightEventCount() {
@@ -2710,7 +2705,7 @@ void RenderWidgetHostImpl::IncrementInFlightEventCount() {
 }
 
 void RenderWidgetHostImpl::DecrementInFlightEventCount(
-    InputEventAckSource ack_source) {
+    blink::mojom::InputEventResultSource ack_source) {
   --in_flight_event_count_;
   if (in_flight_event_count_ <= 0) {
     // Cancel pending hung renderer checks since the renderer is responsive.
@@ -2718,22 +2713,11 @@ void RenderWidgetHostImpl::DecrementInFlightEventCount(
   } else {
     // Only restart the hang monitor timer if we got a response from the
     // main thread.
-    if (ack_source == InputEventAckSource::MAIN_THREAD)
+    if (ack_source == blink::mojom::InputEventResultSource::kMainThread)
       RestartInputEventAckTimeoutIfNecessary();
   }
 }
 
-void RenderWidgetHostImpl::OnHasTouchEventHandlers(bool has_handlers) {
-  input_router_->OnHasTouchEventHandlers(has_handlers);
-  has_touch_handler_ = has_handlers;
-}
-
-void RenderWidgetHostImpl::OnIntrinsicSizingInfoChanged(
-    blink::WebIntrinsicSizingInfo info) {
-  if (view_)
-    view_->UpdateIntrinsicSizingInfo(info);
-}
-
 void RenderWidgetHostImpl::DidOverscroll(
     const ui::DidOverscrollParams& params) {
   if (view_)
@@ -2751,15 +2735,20 @@ void RenderWidgetHostImpl::DidStartScrollingViewport() {
     view_->set_is_currently_scrolling_viewport(true);
 }
 
+void RenderWidgetHostImpl::OnInvalidInputEventSource() {
+  bad_message::ReceivedBadMessage(
+      GetProcess(), bad_message::INPUT_ROUTER_INVALID_EVENT_SOURCE);
+}
+
 void RenderWidgetHostImpl::AddPendingUserActivation(
     const WebInputEvent& event) {
   if ((base::FeatureList::IsEnabled(
            features::kBrowserVerifiedUserActivationMouse) &&
-       event.GetType() == WebInputEvent::kMouseDown) ||
+       event.GetType() == WebInputEvent::Type::kMouseDown) ||
       (base::FeatureList::IsEnabled(
            features::kBrowserVerifiedUserActivationKeyboard) &&
-       (event.GetType() == WebInputEvent::kKeyDown ||
-        event.GetType() == WebInputEvent::kRawKeyDown))) {
+       (event.GetType() == WebInputEvent::Type::kKeyDown ||
+        event.GetType() == WebInputEvent::Type::kRawKeyDown))) {
     pending_user_activation_timer_.Start(
         FROM_HERE, kActivationNotificationExpireTime,
         base::BindOnce(&RenderWidgetHostImpl::ClearPendingUserActivation,
@@ -2797,8 +2786,8 @@ void RenderWidgetHostImpl::DispatchInputEventWithLatencyInfo(
 
 void RenderWidgetHostImpl::OnWheelEventAck(
     const MouseWheelEventWithLatencyInfo& wheel_event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   latency_tracker_.OnInputEventAck(wheel_event.event, &wheel_event.latency,
                                    ack_result);
   for (auto& input_event_observer : input_event_observers_)
@@ -2806,9 +2795,9 @@ void RenderWidgetHostImpl::OnWheelEventAck(
                                          wheel_event.event);
 
   if (!is_hidden() && view_) {
-    if (ack_result != INPUT_EVENT_ACK_STATE_CONSUMED &&
+    if (ack_result != blink::mojom::InputEventResultState::kConsumed &&
         delegate_ && delegate_->HandleWheelEvent(wheel_event.event)) {
-      ack_result = INPUT_EVENT_ACK_STATE_CONSUMED;
+      ack_result = blink::mojom::InputEventResultState::kConsumed;
     }
     view_->WheelEventAck(wheel_event.event, ack_result);
   }
@@ -2816,8 +2805,8 @@ void RenderWidgetHostImpl::OnWheelEventAck(
 
 void RenderWidgetHostImpl::OnGestureEventAck(
     const GestureEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   latency_tracker_.OnInputEventAck(event.event, &event.latency, ack_result);
   for (auto& input_event_observer : input_event_observers_)
     input_event_observer.OnInputEventAck(ack_source, ack_result, event.event);
@@ -2833,8 +2822,8 @@ void RenderWidgetHostImpl::OnGestureEventAck(
 
 void RenderWidgetHostImpl::OnTouchEventAck(
     const TouchEventWithLatencyInfo& event,
-    InputEventAckSource ack_source,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultSource ack_source,
+    blink::mojom::InputEventResultState ack_result) {
   latency_tracker_.OnInputEventAck(event.event, &event.latency, ack_result);
   for (auto& input_event_observer : input_event_observers_)
     input_event_observer.OnInputEventAck(ack_source, ack_result, event.event);
@@ -2870,16 +2859,30 @@ bool RenderWidgetHostImpl::GotResponseToLockMouseRequest(
 
   DCHECK(request_mouse_callback_);
   pending_mouse_lock_request_ = false;
-  if (view_ && view_->HasFocus()) {
-    blink::mojom::PointerLockResult result =
-        view_->LockMouse(mouse_lock_raw_movement_);
-    std::move(request_mouse_callback_).Run(result);
-    return result == blink::mojom::PointerLockResult::kSuccess;
+  if (!view_ || !view_->HasFocus()) {
+    std::move(request_mouse_callback_)
+        .Run(blink::mojom::PointerLockResult::kWrongDocument,
+             /*context=*/mojo::NullRemote());
+    return false;
+  }
+
+  blink::mojom::PointerLockResult result =
+      view_->LockMouse(mouse_lock_raw_movement_);
+
+  if (result != blink::mojom::PointerLockResult::kSuccess) {
+    std::move(request_mouse_callback_)
+        .Run(result, /*context=*/mojo::NullRemote());
+    return false;
   }
 
+  mojo::PendingRemote<blink::mojom::PointerLockContext> context =
+      mouse_lock_context_.BindNewPipeAndPassRemote();
+
   std::move(request_mouse_callback_)
-      .Run(blink::mojom::PointerLockResult::kWrongDocument);
-  return false;
+      .Run(blink::mojom::PointerLockResult::kSuccess, std::move(context));
+  mouse_lock_context_.set_disconnect_handler(base::BindOnce(
+      &RenderWidgetHostImpl::UnlockMouse, weak_factory_.GetWeakPtr()));
+  return true;
 }
 
 void RenderWidgetHostImpl::GotResponseToKeyboardLockRequest(bool allowed) {
@@ -3262,7 +3265,7 @@ bool TransformPointAndRectToRootView(RenderWidgetHostViewBase* view,
 
 }  // namespace
 
-void RenderWidgetHostImpl::OnAnimateDoubleTapZoomInMainFrame(
+void RenderWidgetHostImpl::AnimateDoubleTapZoomInMainFrame(
     const gfx::Point& point,
     const gfx::Rect& rect_to_zoom) {
   if (!view_)
@@ -3281,7 +3284,7 @@ void RenderWidgetHostImpl::OnAnimateDoubleTapZoomInMainFrame(
   root_rvhi->AnimateDoubleTapZoom(transformed_point, transformed_rect_to_zoom);
 }
 
-void RenderWidgetHostImpl::OnZoomToFindInPageRectInMainFrame(
+void RenderWidgetHostImpl::ZoomToFindInPageRectInMainFrame(
     const gfx::Rect& rect_to_zoom) {
   if (!view_)
     return;
@@ -3297,6 +3300,17 @@ void RenderWidgetHostImpl::OnZoomToFindInPageRectInMainFrame(
   root_rvhi->ZoomToFindInPageRect(transformed_rect_to_zoom);
 }
 
+void RenderWidgetHostImpl::SetHasTouchEventHandlers(bool has_handlers) {
+  input_router_->OnHasTouchEventHandlers(has_handlers);
+  has_touch_handler_ = has_handlers;
+}
+
+void RenderWidgetHostImpl::IntrinsicSizingInfoChanged(
+    blink::mojom::IntrinsicSizingInfoPtr sizing_info) {
+  if (view_)
+    view_->UpdateIntrinsicSizingInfo(std::move(sizing_info));
+}
+
 gfx::Size RenderWidgetHostImpl::GetRootWidgetViewportSize() {
   if (!view_)
     return gfx::Size();
@@ -3310,4 +3324,16 @@ gfx::Size RenderWidgetHostImpl::GetRootWidgetViewportSize() {
   return root_view->GetVisibleViewportSize();
 }
 
+void RenderWidgetHostImpl::SetRendererInitialized(
+    bool renderer_initialized,
+    RendererInitializer initializer) {
+  renderer_initialized_ = renderer_initialized;
+  // We want to record the first initializer. If this is called again, don't
+  // overwrite the existing value.
+  if (initializer != RendererInitializer::kUnknown &&
+      initializer_ != RendererInitializer::kUnknown)
+    return;
+  initializer_ = initializer;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_impl.h b/chromium/content/browser/renderer_host/render_widget_host_impl.h
index 013b2165038..950fc6e8e5e 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_impl.h
@@ -50,7 +50,6 @@
 #include "content/common/widget.mojom.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/render_widget_host.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/common/page_zoom.h"
 #include "content/public/common/url_constants.h"
 #include "ipc/ipc_listener.h"
@@ -61,6 +60,7 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
 #include "services/viz/public/mojom/hit_test/input_target_client.mojom.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/mojom/page/widget.mojom.h"
 #include "ui/base/ime/text_input_mode.h"
@@ -106,7 +106,6 @@ class SyntheticGestureController;
 class TimeoutMonitor;
 class TouchEmulator;
 class WebCursor;
-struct EditCommand;
 struct VisualProperties;
 struct ScreenInfo;
 struct TextInputState;
@@ -152,7 +151,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
       public IPC::Listener,
       public RenderFrameMetadataProvider::Observer,
       public blink::mojom::FrameWidgetHost,
-      public blink::mojom::WidgetHost {
+      public blink::mojom::WidgetHost,
+      public blink::mojom::PointerLockContext {
  public:
   // |routing_id| must not be MSG_ROUTING_NONE.
   // If this object outlives |delegate|, DetachDelegate() must be called when
@@ -227,6 +227,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void AddObserver(RenderWidgetHostObserver* observer) override;
   void RemoveObserver(RenderWidgetHostObserver* observer) override;
   void GetScreenInfo(content::ScreenInfo* result) override;
+  base::Optional<cc::TouchAction> GetAllowedTouchAction() override;
   // |drop_data| must have been filtered. The embedder should call
   // FilterDropData before passing the drop data to RWHI.
   void DragTargetDragEnter(const DropData& drop_data,
@@ -258,6 +259,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void DragSourceSystemDragEnded() override;
   void FilterDropData(DropData* drop_data) override;
   void SetCursor(const ui::Cursor& cursor) override;
+  void ShowContextMenuAtPoint(const gfx::Point& point,
+                              const ui::MenuSourceType source_type) override;
 
   // RenderProcessHostImpl::PriorityClient implementation.
   RenderProcessHost::Priority GetPriority() override;
@@ -399,9 +402,6 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // Notifies the RenderWidget of the current mouse cursor visibility state.
   void OnCursorVisibilityStateChanged(bool is_visible);
 
-  // Notifies the RenderWidget when toggle fallback cursor mode on/off.
-  void OnFallbackCursorModeToggled(bool is_on);
-
   // Notifies the RenderWidgetHost that the View was destroyed.
   void ViewDestroyed();
 
@@ -434,7 +434,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void ForwardKeyboardEventWithCommands(
       const NativeWebKeyboardEvent& key_event,
       const ui::LatencyInfo& latency,
-      const std::vector<EditCommand>* commands,
+      std::vector<blink::mojom::EditCommandPtr> commands,
       bool* update_event = nullptr);
 
   // Forwards the given message to the renderer. These are called by the view
@@ -474,8 +474,6 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   TouchEmulator* GetTouchEmulator();
 
   void SetCursor(const WebCursor& cursor);
-  void ShowContextMenuAtPoint(const gfx::Point& point,
-                              const ui::MenuSourceType source_type);
 
   // Queues a synthetic gesture for testing purposes.  Invokes the on_complete
   // callback when the gesture is finished running.
@@ -596,10 +594,23 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void RejectMouseLockOrUnlockIfNecessary(
       blink::mojom::PointerLockResult reason);
 
-  void set_renderer_initialized(bool renderer_initialized) {
-    renderer_initialized_ = renderer_initialized;
+  // The places in our codebase that call SetRendererInitialized or set the
+  // state to true directly.
+  // TODO(https://crbug.com/1006814): Delete this.
+  enum class RendererInitializer {
+    kUnknown,
+    kTest,  // We don't care about tests, this can be used for any test call.
+    kInit,  // RenderWidgetHostImpl
+    kInitForFrame,  // RenderWidgetHostImpl
+    kWebContentsInit,
+    kCreateRenderView,
+  };
+  void SetRendererInitialized(bool renderer_initialized,
+                              RendererInitializer initializer);
+  // TODO(https://crbug.com/1006814): Delete this.
+  RendererInitializer get_initializer_for_crbug_1006814() {
+    return initializer_;
   }
-
   // Store values received in a child frame RenderWidgetHost from a parent
   // RenderWidget, in order to pass them to the renderer and continue their
   // propagation down the RenderWidget tree.
@@ -713,16 +724,12 @@ class CONTENT_EXPORT RenderWidgetHostImpl
       bool privileged,
       bool unadjusted_movement,
       InputRouterImpl::RequestMouseLockCallback response) override;
+  gfx::Size GetRootWidgetViewportSize() override;
+
+  // PointerLockContext overrides
   void RequestMouseLockChange(
       bool unadjusted_movement,
-      InputRouterImpl::RequestMouseLockCallback response) override;
-  void UnlockMouse() override;
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override;
-  void FallbackCursorModeSetCursorVisibility(bool visible) override;
-  gfx::Size GetRootWidgetViewportSize() override;
+      PointerLockContext::RequestMouseLockChangeCallback response) override;
 
   // FrameTokenMessageQueue::Client:
   void OnInvalidFrameToken(uint32_t frame_token) override;
@@ -785,6 +792,18 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   const mojo::AssociatedRemote<blink::mojom::FrameWidget>&
   GetAssociatedFrameWidget();
 
+  // Exposed so that tests can swap the implementation and intercept calls.
+  mojo::AssociatedReceiver<blink::mojom::FrameWidgetHost>&
+  frame_widget_host_receiver_for_testing() {
+    return blink_frame_widget_host_receiver_;
+  }
+
+  // Exposed so that tests can swap the implementation and intercept calls.
+  mojo::AssociatedReceiver<blink::mojom::WidgetHost>&
+  widget_host_receiver_for_testing() {
+    return blink_widget_host_receiver_;
+  }
+
  protected:
   // ---------------------------------------------------------------------------
   // The following method is overridden by RenderViewHost to send upwards to
@@ -796,19 +815,20 @@ class CONTENT_EXPORT RenderWidgetHostImpl
 
   // InputDispositionHandler
   void OnWheelEventAck(const MouseWheelEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
   void OnTouchEventAck(const TouchEventWithLatencyInfo& event,
-                       InputEventAckSource ack_source,
-                       InputEventAckState ack_result) override;
-  void OnGestureEventAck(const GestureEventWithLatencyInfo& event,
-                         InputEventAckSource ack_source,
-                         InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultSource ack_source,
+                       blink::mojom::InputEventResultState ack_result) override;
+  void OnGestureEventAck(
+      const GestureEventWithLatencyInfo& event,
+      blink::mojom::InputEventResultSource ack_source,
+      blink::mojom::InputEventResultState ack_result) override;
 
   // virtual for testing.
   virtual void OnMouseEventAck(const MouseEventWithLatencyInfo& event,
-                               InputEventAckSource ack_source,
-                               InputEventAckState ack_result);
+                               blink::mojom::InputEventResultSource ack_source,
+                               blink::mojom::InputEventResultState ack_result);
   // ---------------------------------------------------------------------------
 
   bool IsMouseLocked() const;
@@ -833,6 +853,10 @@ class CONTENT_EXPORT RenderWidgetHostImpl
                            AddAndRemoveInputEventObserver);
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostTest,
                            AddAndRemoveImeInputEventObserver);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostTest,
+                           InputRouterReceivesHasTouchEventHandlers);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostTest, EventDispatchPostDetach);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostTest, InputEventRWHLatencyComponent);
   FRIEND_TEST_ALL_PREFIXES(DevToolsManagerTest,
                            NoUnresponsiveDialogInInspectedContents);
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewMacTest,
@@ -841,6 +865,16 @@ class CONTENT_EXPORT RenderWidgetHostImpl
                            ResizeAndCrossProcessPostMessagePreserveOrder);
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostInputEventRouterTest,
                            EnsureRendererDestroyedHandlesUnAckedTouchEvents);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraTest, TouchEventState);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraTest, TouchEventSyncAsync);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraOverscrollTest,
+                           OverscrollWithTouchEvents);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraOverscrollTest,
+                           TouchGestureEndDispatchedAfterOverscrollComplete);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraTest,
+                           InvalidEventsHaveSyncHandlingDisabled);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostInputEventRouterTest,
+                           EnsureRendererDestroyedHandlesUnAckedTouchEvents);
   friend class MockRenderWidgetHost;
   friend class OverscrollNavigationOverlayTest;
   friend class RenderViewHostTester;
@@ -858,8 +892,11 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // InputRouter::SendKeyboardEvent() callbacks to this. This may be called
   // synchronously.
   void OnKeyboardEventAck(const NativeWebKeyboardEventWithLatencyInfo& event,
-                          InputEventAckSource ack_source,
-                          InputEventAckState ack_result);
+                          blink::mojom::InputEventResultSource ack_source,
+                          blink::mojom::InputEventResultState ack_result);
+
+  // Release the mouse lock
+  void UnlockMouse();
 
   // IPC message handlers
   void OnClose();
@@ -867,10 +904,6 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void OnRequestSetBounds(const gfx::Rect& bounds);
   void OnSetTooltipText(const base::string16& tooltip_text,
                         base::i18n::TextDirection text_direction_hint);
-  void OnSetCursor(const WebCursor& cursor);
-  void OnAutoscrollStart(const gfx::PointF& position);
-  void OnAutoscrollFling(const gfx::Vector2dF& velocity);
-  void OnAutoscrollEnd();
   void OnTextInputStateChanged(const TextInputState& params);
   void OnSelectionBoundsChanged(
       const WidgetHostMsg_SelectionBounds_Params& params);
@@ -884,11 +917,17 @@ class CONTENT_EXPORT RenderWidgetHostImpl
                                    std::vector<IPC::Message> messages);
   void OnForceRedrawComplete(int snapshot_id);
   void OnFirstVisuallyNonEmptyPaint();
-  void OnHasTouchEventHandlers(bool has_handlers);
-  void OnIntrinsicSizingInfoChanged(blink::WebIntrinsicSizingInfo info);
-  void OnAnimateDoubleTapZoomInMainFrame(const gfx::Point& point,
-                                         const gfx::Rect& rect_to_zoom);
-  void OnZoomToFindInPageRectInMainFrame(const gfx::Rect& rect_to_zoom);
+
+  // blink::mojom::FrameWidgetHost overrides.
+  void AnimateDoubleTapZoomInMainFrame(const gfx::Point& tap_point,
+                                       const gfx::Rect& rect_to_zoom) override;
+  void ZoomToFindInPageRectInMainFrame(const gfx::Rect& rect_to_zoom) override;
+  void SetHasTouchEventHandlers(bool has_handlers) override;
+  void IntrinsicSizingInfoChanged(
+      blink::mojom::IntrinsicSizingInfoPtr sizing_info) override;
+  void AutoscrollStart(const gfx::PointF& position) override;
+  void AutoscrollFling(const gfx::Vector2dF& velocity) override;
+  void AutoscrollEnd() override;
 
   // When the RenderWidget is destroyed and recreated, this resets states in the
   // browser to match the clean start for the renderer side.
@@ -921,15 +960,17 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   bool KeyPressListenersHandleEvent(const NativeWebKeyboardEvent& event);
 
   // InputRouterClient
-  InputEventAckState FilterInputEvent(
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& event,
       const ui::LatencyInfo& latency_info) override;
   void IncrementInFlightEventCount() override;
-  void DecrementInFlightEventCount(InputEventAckSource ack_source) override;
+  void DecrementInFlightEventCount(
+      blink::mojom::InputEventResultSource ack_source) override;
   void DidOverscroll(const ui::DidOverscrollParams& params) override;
   void DidStartScrollingViewport() override;
   void OnSetWhiteListedTouchAction(
       cc::TouchAction white_listed_touch_action) override {}
+  void OnInvalidInputEventSource() override;
 
   // Dispatch input events with latency information
   void DispatchInputEventWithLatencyInfo(const blink::WebInputEvent& event,
@@ -1054,6 +1095,10 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // RenderFrame/View, assume false.
   bool intersects_viewport_ = false;
 
+  // One side of a pipe that is held open while the pointer is locked.
+  // The other side is held be the renderer.
+  mojo::Receiver<blink::mojom::PointerLockContext> mouse_lock_context_{this};
+
 #if defined(OS_ANDROID)
   // Tracks the current importance of widget.
   ChildProcessImportance importance_ = ChildProcessImportance::NORMAL;
@@ -1275,6 +1320,10 @@ class CONTENT_EXPORT RenderWidgetHostImpl
       blink_widget_host_receiver_{this};
   mojo::AssociatedRemote<blink::mojom::Widget> blink_widget_;
 
+  // Who initialized us.
+  // TODO(https://crbug.com/1006814): Delete this.
+  RendererInitializer initializer_ = RendererInitializer::kUnknown;
+
   base::WeakPtrFactory<RenderWidgetHostImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostImpl);
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
index dc315bb6385..879dd09fe5a 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
@@ -93,7 +93,7 @@ class TouchEventAckQueue {
     RenderWidgetHostViewBase* root_view;
     TouchEventSource touch_event_source;
     TouchEventAckStatus touch_event_ack_status;
-    InputEventAckState ack_result;
+    blink::mojom::InputEventResultState ack_result;
   };
 
   explicit TouchEventAckQueue(RenderWidgetHostInputEventRouter* client)
@@ -106,7 +106,7 @@ class TouchEventAckQueue {
            RenderWidgetHostViewBase* root_view,
            TouchEventSource touch_event_source,
            TouchEventAckStatus touch_event_ack_status,
-           InputEventAckState ack_result);
+           blink::mojom::InputEventResultState ack_result);
 
   void Add(const TouchEventWithLatencyInfo& touch_event,
            RenderWidgetHostViewBase* target_view,
@@ -114,7 +114,7 @@ class TouchEventAckQueue {
            TouchEventSource touch_event_source);
 
   void MarkAcked(const TouchEventWithLatencyInfo& touch_event,
-                 InputEventAckState ack_result,
+                 blink::mojom::InputEventResultState ack_result,
                  RenderWidgetHostViewBase* target_view);
 
   void UpdateQueueAfterTargetDestroyed(RenderWidgetHostViewBase* target_view);
@@ -134,7 +134,7 @@ void TouchEventAckQueue::Add(const TouchEventWithLatencyInfo& touch_event,
                              RenderWidgetHostViewBase* root_view,
                              TouchEventSource touch_event_source,
                              TouchEventAckStatus touch_event_ack_status,
-                             InputEventAckState ack_result) {
+                             blink::mojom::InputEventResultState ack_result) {
   AckData data = {touch_event,
                   target_view,
                   root_view,
@@ -152,12 +152,14 @@ void TouchEventAckQueue::Add(const TouchEventWithLatencyInfo& touch_event,
                              RenderWidgetHostViewBase* root_view,
                              TouchEventSource touch_event_source) {
   Add(touch_event, target_view, root_view, touch_event_source,
-      TouchEventAckStatus::TouchEventNotAcked, INPUT_EVENT_ACK_STATE_UNKNOWN);
+      TouchEventAckStatus::TouchEventNotAcked,
+      blink::mojom::InputEventResultState::kUnknown);
 }
 
-void TouchEventAckQueue::MarkAcked(const TouchEventWithLatencyInfo& touch_event,
-                                   InputEventAckState ack_result,
-                                   RenderWidgetHostViewBase* target_view) {
+void TouchEventAckQueue::MarkAcked(
+    const TouchEventWithLatencyInfo& touch_event,
+    blink::mojom::InputEventResultState ack_result,
+    RenderWidgetHostViewBase* target_view) {
   auto it = find_if(ack_queue_.begin(), ack_queue_.end(),
                     [touch_event](AckData data) {
                       return data.touch_event.event.unique_touch_event_id ==
@@ -223,7 +225,7 @@ void TouchEventAckQueue::UpdateQueueAfterTargetDestroyed(
   for_each(ack_queue_.begin(), ack_queue_.end(), [target_view](AckData& data) {
     if (data.target_view == target_view) {
       data.touch_event_ack_status = TouchEventAckStatus::TouchEventAcked;
-      data.ack_result = INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+      data.ack_result = blink::mojom::InputEventResultState::kNoConsumerExists;
     }
   });
 
@@ -462,7 +464,7 @@ RenderWidgetTargetResult RenderWidgetHostInputEventRouter::FindMouseEventTarget(
   // Ignore mouse_capture_target_ if there are no mouse buttons currently down
   // because this is only for the purpose of dragging.
   if (!target && mouse_capture_target_ &&
-      (event.GetType() == blink::WebInputEvent::kMouseUp ||
+      (event.GetType() == blink::WebInputEvent::Type::kMouseUp ||
        IsMouseButtonDown(event))) {
     target = mouse_capture_target_;
     // Hit testing is skipped for MouseUp with mouse capture which is enabled by
@@ -473,7 +475,7 @@ RenderWidgetTargetResult RenderWidgetHostInputEventRouter::FindMouseEventTarget(
     // transforms from browser process and renderer process. We need to fix it
     // so that we don't need to cache the transform from MouseDown.
     // https://crbug.com/934434.
-    if (event.GetType() == blink::WebInputEvent::kMouseUp &&
+    if (event.GetType() == blink::WebInputEvent::Type::kMouseUp &&
         target == last_mouse_down_target_ &&
         mouse_down_pre_transformed_coordinate_ == event.PositionInWidget()) {
       transformed_point = mouse_down_post_transformed_coordinate_;
@@ -486,7 +488,7 @@ RenderWidgetTargetResult RenderWidgetHostInputEventRouter::FindMouseEventTarget(
     auto result =
         FindViewAtLocation(root_view, event.PositionInWidget(),
                            viz::EventSource::MOUSE, &transformed_point);
-    if (event.GetType() == blink::WebInputEvent::kMouseDown) {
+    if (event.GetType() == blink::WebInputEvent::Type::kMouseDown) {
       mouse_down_pre_transformed_coordinate_ = event.PositionInWidget();
     }
     if (result.should_query_view)
@@ -613,7 +615,7 @@ void RenderWidgetHostInputEventRouter::DispatchMouseEvent(
   // browser window.
   // Also, this is strictly necessary for touch emulation.
   if (mouse_capture_target_ &&
-      (mouse_event.GetType() == blink::WebInputEvent::kMouseUp ||
+      (mouse_event.GetType() == blink::WebInputEvent::Type::kMouseUp ||
        !IsMouseButtonDown(mouse_event))) {
     mouse_capture_target_ = nullptr;
 
@@ -643,7 +645,7 @@ void RenderWidgetHostInputEventRouter::DispatchMouseEvent(
   // When touch emulation is active, mouse events have to act like touch
   // events, which requires that there be implicit capture between MouseDown
   // and MouseUp.
-  if (mouse_event.GetType() == blink::WebInputEvent::kMouseDown &&
+  if (mouse_event.GetType() == blink::WebInputEvent::Type::kMouseDown &&
       touch_emulator_ && touch_emulator_->enabled()) {
     mouse_capture_target_ = target;
   }
@@ -656,8 +658,8 @@ void RenderWidgetHostInputEventRouter::DispatchMouseEvent(
   // coordinates, which are transformed independently for each view that will
   // receive an event. Also, since the view under the mouse has changed,
   // notify the CursorManager that it might need to change the cursor.
-  if ((event.GetType() == blink::WebInputEvent::kMouseLeave ||
-       event.GetType() == blink::WebInputEvent::kMouseMove) &&
+  if ((event.GetType() == blink::WebInputEvent::Type::kMouseLeave ||
+       event.GetType() == blink::WebInputEvent::Type::kMouseMove) &&
       target != last_mouse_move_target_ && !root_view->IsMouseLocked()) {
     SendMouseEnterOrLeaveEvents(mouse_event, target, root_view);
     if (root_view->GetCursorManager())
@@ -705,8 +707,9 @@ void RenderWidgetHostInputEventRouter::DispatchMouseWheelEvent(
   }
 
   if (!target) {
-    root_view->WheelEventAck(mouse_wheel_event,
-                             INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    root_view->WheelEventAck(
+        mouse_wheel_event,
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     return;
   }
 
@@ -766,16 +769,16 @@ unsigned CountChangedTouchPoints(const blink::WebTouchEvent& event) {
   unsigned changed_count = 0;
 
   blink::WebTouchPoint::State required_state =
-      blink::WebTouchPoint::kStateUndefined;
+      blink::WebTouchPoint::State::kStateUndefined;
   switch (event.GetType()) {
-    case blink::WebInputEvent::kTouchStart:
-      required_state = blink::WebTouchPoint::kStatePressed;
+    case blink::WebInputEvent::Type::kTouchStart:
+      required_state = blink::WebTouchPoint::State::kStatePressed;
       break;
-    case blink::WebInputEvent::kTouchEnd:
-      required_state = blink::WebTouchPoint::kStateReleased;
+    case blink::WebInputEvent::Type::kTouchEnd:
+      required_state = blink::WebTouchPoint::State::kStateReleased;
       break;
-    case blink::WebInputEvent::kTouchCancel:
-      required_state = blink::WebTouchPoint::kStateCancelled;
+    case blink::WebInputEvent::Type::kTouchCancel:
+      required_state = blink::WebTouchPoint::State::kStateCancelled;
       break;
     default:
       // We'll only ever call this method for TouchStart, TouchEnd
@@ -787,7 +790,7 @@ unsigned CountChangedTouchPoints(const blink::WebTouchEvent& event) {
       ++changed_count;
   }
 
-  DCHECK(event.GetType() == blink::WebInputEvent::kTouchCancel ||
+  DCHECK(event.GetType() == blink::WebInputEvent::Type::kTouchCancel ||
          changed_count == 1);
   return changed_count;
 }
@@ -808,7 +811,8 @@ RenderWidgetTargetResult RenderWidgetHostInputEventRouter::FindTouchEventTarget(
     const blink::WebTouchEvent& event) {
   // Tests may call this without an initial TouchStart, so check event type
   // explicitly here.
-  if (active_touches_ || event.GetType() != blink::WebInputEvent::kTouchStart)
+  if (active_touches_ ||
+      event.GetType() != blink::WebInputEvent::Type::kTouchStart)
     return {nullptr, false, base::nullopt, true};
 
   active_touches_ += CountChangedTouchPoints(event);
@@ -827,7 +831,8 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
     const base::Optional<gfx::PointF>& target_location,
     bool is_emulated_touchevent) {
   DCHECK(blink::WebInputEvent::IsTouchEventType(touch_event.GetType()) &&
-         touch_event.GetType() != blink::WebInputEvent::kTouchScrollStarted);
+         touch_event.GetType() !=
+             blink::WebInputEvent::Type::kTouchScrollStarted);
 
   bool is_sequence_start = !touch_target_ && target;
   if (is_sequence_start) {
@@ -837,15 +842,15 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
            touchscreen_gesture_target_map_.end());
     touchscreen_gesture_target_map_[touch_event.unique_touch_event_id] =
         touch_target_;
-  } else if (touch_event.GetType() == blink::WebInputEvent::kTouchStart) {
+  } else if (touch_event.GetType() == blink::WebInputEvent::Type::kTouchStart) {
     active_touches_ += CountChangedTouchPoints(touch_event);
   }
 
   // Test active_touches_ before decrementing, since its value can be
   // reset to 0 in OnRenderWidgetHostViewBaseDestroyed, and this can
   // happen between the TouchStart and a subsequent TouchMove/End/Cancel.
-  if ((touch_event.GetType() == blink::WebInputEvent::kTouchEnd ||
-       touch_event.GetType() == blink::WebInputEvent::kTouchCancel) &&
+  if ((touch_event.GetType() == blink::WebInputEvent::Type::kTouchEnd ||
+       touch_event.GetType() == blink::WebInputEvent::Type::kTouchCancel) &&
       active_touches_) {
     active_touches_ -= CountChangedTouchPoints(touch_event);
   }
@@ -867,7 +872,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
     touch_event_ack_queue_->Add(
         TouchEventWithLatencyInfo(touch_event), nullptr, root_view,
         event_source, TouchEventAckQueue::TouchEventAckStatus::TouchEventAcked,
-        INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     return;
   }
 
@@ -909,7 +914,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchEvent(
 
 void RenderWidgetHostInputEventRouter::ProcessAckedTouchEvent(
     const TouchEventWithLatencyInfo& event,
-    InputEventAckState ack_result,
+    blink::mojom::InputEventResultState ack_result,
     RenderWidgetHostViewBase* view) {
   touch_event_ack_queue_->MarkAcked(event, ack_result, view);
 }
@@ -1008,7 +1013,7 @@ void RenderWidgetHostInputEventRouter::SendMouseEnterOrLeaveEvents(
   // Send MouseLeaves.
   for (auto* view : exited_views) {
     blink::WebMouseEvent mouse_leave(event);
-    mouse_leave.SetType(blink::WebInputEvent::kMouseLeave);
+    mouse_leave.SetType(blink::WebInputEvent::Type::kMouseLeave);
     mouse_leave.SetModifiers(mouse_leave.GetModifiers() | extra_modifiers);
     // There is a chance of a race if the last target has recently created a
     // new compositor surface. The SurfaceID for that might not have
@@ -1027,7 +1032,7 @@ void RenderWidgetHostInputEventRouter::SendMouseEnterOrLeaveEvents(
   if (common_ancestor && (include_target_view || common_ancestor != target)) {
     blink::WebMouseEvent mouse_move(event);
     mouse_move.SetModifiers(mouse_move.GetModifiers() | extra_modifiers);
-    mouse_move.SetType(blink::WebInputEvent::kMouseMove);
+    mouse_move.SetType(blink::WebInputEvent::Type::kMouseMove);
     if (!root_view->TransformPointToCoordSpaceForView(
             event.PositionInWidget(), common_ancestor, &transformed_point)) {
       transformed_point = gfx::PointF();
@@ -1043,7 +1048,7 @@ void RenderWidgetHostInputEventRouter::SendMouseEnterOrLeaveEvents(
       continue;
     blink::WebMouseEvent mouse_enter(event);
     mouse_enter.SetModifiers(mouse_enter.GetModifiers() | extra_modifiers);
-    mouse_enter.SetType(blink::WebInputEvent::kMouseMove);
+    mouse_enter.SetType(blink::WebInputEvent::Type::kMouseMove);
     if (!root_view->TransformPointToCoordSpaceForView(
             event.PositionInWidget(), view, &transformed_point)) {
       transformed_point = gfx::PointF();
@@ -1111,14 +1116,14 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     RenderWidgetHostViewChildFrame* resending_view,
     const blink::WebGestureEvent& event) {
   DCHECK(target_view);
-  DCHECK(event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
-         event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-         event.GetType() == blink::WebInputEvent::kGestureScrollEnd);
+  DCHECK(event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin ||
+         event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate ||
+         event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd);
 
   ui::LatencyInfo latency_info =
       ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(event);
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
     forced_last_fling_start_target_to_stop_flinging_for_test_ = false;
     // If target_view has unrelated gesture events in progress, do
     // not proceed. This could cause confusion between independent
@@ -1153,7 +1158,8 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
     bubbling_gesture_scroll_source_device_ = event.SourceDevice();
     DCHECK(IsAncestorView(bubbling_gesture_scroll_origin_,
                           bubbling_gesture_scroll_target_));
-  } else {  // !(event.GetType() == blink::WebInputEvent::kGestureScrollBegin)
+  } else {  // !(event.GetType() ==
+            // blink::WebInputEvent::Type::kGestureScrollBegin)
     if (!bubbling_gesture_scroll_target_) {
       // Drop any acked events that come in after bubbling has ended.
       // TODO(mcnee): If we inform |bubbling_gesture_scroll_origin_| and the
@@ -1164,7 +1170,7 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
 
     // Don't bubble the GSE events that are generated and sent to intermediate
     // bubbling targets.
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd &&
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd &&
         resending_view != bubbling_gesture_scroll_origin_) {
       return true;
     }
@@ -1187,7 +1193,7 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
       event.SourceDevice() == blink::WebGestureDevice::kTouchscreen &&
       !bubbling_gesture_scroll_target_->IsRenderWidgetHostViewChildFrame();
   if (touchscreen_bubble_to_root) {
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
       touchscreen_pinch_state_.DidStartBubblingToRoot();
 
       // If a pinch's scroll sequence is sent to an OOPIF and the pinch
@@ -1197,7 +1203,8 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
       if (touchscreen_pinch_state_.IsInPinch()) {
         return true;
       }
-    } else if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+    } else if (event.GetType() ==
+               blink::WebInputEvent::Type::kGestureScrollEnd) {
       touchscreen_pinch_state_.DidStopBubblingToRoot();
     }
   }
@@ -1206,7 +1213,7 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
       GestureEventInTarget(event, bubbling_gesture_scroll_target_),
       latency_info);
 
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd) {
     bubbling_gesture_scroll_origin_ = nullptr;
     bubbling_gesture_scroll_target_ = nullptr;
     bubbling_gesture_scroll_source_device_ =
@@ -1218,10 +1225,10 @@ bool RenderWidgetHostInputEventRouter::BubbleScrollEvent(
 void RenderWidgetHostInputEventRouter::SendGestureScrollBegin(
     RenderWidgetHostViewBase* view,
     const blink::WebGestureEvent& event) {
-  DCHECK_EQ(blink::WebInputEvent::kGesturePinchBegin, event.GetType());
+  DCHECK_EQ(blink::WebInputEvent::Type::kGesturePinchBegin, event.GetType());
   DCHECK_EQ(blink::WebGestureDevice::kTouchscreen, event.SourceDevice());
   blink::WebGestureEvent scroll_begin(event);
-  scroll_begin.SetType(blink::WebInputEvent::kGestureScrollBegin);
+  scroll_begin.SetType(blink::WebInputEvent::Type::kGestureScrollBegin);
   scroll_begin.data.scroll_begin.delta_x_hint = 0;
   scroll_begin.data.scroll_begin.delta_y_hint = 0;
   scroll_begin.data.scroll_begin.delta_hint_units =
@@ -1237,16 +1244,16 @@ void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
     RenderWidgetHostViewBase* view,
     const blink::WebGestureEvent& event) {
   blink::WebGestureEvent scroll_end(event);
-  scroll_end.SetType(blink::WebInputEvent::kGestureScrollEnd);
+  scroll_end.SetType(blink::WebInputEvent::Type::kGestureScrollEnd);
   scroll_end.SetTimeStamp(base::TimeTicks::Now());
   switch (event.GetType()) {
-    case blink::WebInputEvent::kGestureScrollBegin:
+    case blink::WebInputEvent::Type::kGestureScrollBegin:
       scroll_end.data.scroll_end.inertial_phase =
           event.data.scroll_begin.inertial_phase;
       scroll_end.data.scroll_end.delta_units =
           event.data.scroll_begin.delta_hint_units;
       break;
-    case blink::WebInputEvent::kGesturePinchEnd:
+    case blink::WebInputEvent::Type::kGesturePinchEnd:
       DCHECK_EQ(blink::WebGestureDevice::kTouchscreen, event.SourceDevice());
       scroll_end.data.scroll_end.inertial_phase =
           blink::WebGestureEvent::InertialPhaseState::kUnknownMomentum;
@@ -1264,9 +1271,10 @@ void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
 void RenderWidgetHostInputEventRouter::SendGestureScrollEnd(
     RenderWidgetHostViewBase* view,
     blink::WebGestureDevice source_device) {
-  blink::WebGestureEvent scroll_end(blink::WebInputEvent::kGestureScrollEnd,
-                                    blink::WebInputEvent::kNoModifiers,
-                                    base::TimeTicks::Now(), source_device);
+  blink::WebGestureEvent scroll_end(
+      blink::WebInputEvent::Type::kGestureScrollEnd,
+      blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now(),
+      source_device);
   scroll_end.data.scroll_end.inertial_phase =
       blink::WebGestureEvent::InertialPhaseState::kUnknownMomentum;
   scroll_end.data.scroll_end.delta_units =
@@ -1446,7 +1454,8 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
     const blink::WebGestureEvent& gesture_event,
     const ui::LatencyInfo& latency,
     const base::Optional<gfx::PointF>& target_location) {
-  if (gesture_event.GetType() == blink::WebInputEvent::kGesturePinchBegin) {
+  if (gesture_event.GetType() ==
+      blink::WebInputEvent::Type::kGesturePinchBegin) {
     if (root_view == touchscreen_gesture_target_) {
       // If the root view is the current gesture target, there is no need to
       // wrap the pinch events ourselves.
@@ -1478,7 +1487,8 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
   if (touchscreen_pinch_state_.IsInPinch()) {
     root_view->ProcessGestureEvent(gesture_event, latency);
 
-    if (gesture_event.GetType() == blink::WebInputEvent::kGesturePinchEnd) {
+    if (gesture_event.GetType() ==
+        blink::WebInputEvent::Type::kGesturePinchEnd) {
       const bool send_scroll_end =
           touchscreen_pinch_state_.NeedsWrappingScrollSequence();
       touchscreen_pinch_state_.DidStopPinch();
@@ -1494,7 +1504,8 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
     return;
   }
 
-  if (gesture_event.GetType() == blink::WebInputEvent::kGestureFlingCancel &&
+  if (gesture_event.GetType() ==
+          blink::WebInputEvent::Type::kGestureFlingCancel &&
       last_fling_start_target_) {
     last_fling_start_target_->ProcessGestureEvent(gesture_event, latency);
     return;
@@ -1508,7 +1519,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
   // We use GestureTapDown to detect the start of a gesture sequence since
   // there is no WebGestureEvent equivalent for ET_GESTURE_BEGIN.
   const bool is_gesture_start =
-      gesture_event.GetType() == blink::WebInputEvent::kGestureTapDown;
+      gesture_event.GetType() == blink::WebInputEvent::Type::kGestureTapDown;
 
   base::Optional<gfx::PointF> fallback_target_location;
 
@@ -1562,8 +1573,8 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
     SetTouchscreenGestureTarget(nullptr);
 
   if (!touchscreen_gesture_target_) {
-    root_view->GestureEventAck(gesture_event,
-                               INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    root_view->GestureEventAck(
+        gesture_event, blink::mojom::InputEventResultState::kNoConsumerExists);
     return;
   }
 
@@ -1593,18 +1604,21 @@ void RenderWidgetHostInputEventRouter::DispatchTouchscreenGestureEvent(
   }
   touchscreen_gesture_target_->ProcessGestureEvent(event, latency);
 
-  if (gesture_event.GetType() == blink::WebInputEvent::kGestureFlingStart)
+  if (gesture_event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart)
     last_fling_start_target_ = touchscreen_gesture_target_;
 
   // If we have one of the following events, then the user has lifted their
   // last finger.
   const bool is_gesture_end =
-      gesture_event.GetType() == blink::WebInputEvent::kGestureTap ||
-      gesture_event.GetType() == blink::WebInputEvent::kGestureLongTap ||
-      gesture_event.GetType() == blink::WebInputEvent::kGestureDoubleTap ||
-      gesture_event.GetType() == blink::WebInputEvent::kGestureTwoFingerTap ||
-      gesture_event.GetType() == blink::WebInputEvent::kGestureScrollEnd ||
-      gesture_event.GetType() == blink::WebInputEvent::kGestureFlingStart;
+      gesture_event.GetType() == blink::WebInputEvent::Type::kGestureTap ||
+      gesture_event.GetType() == blink::WebInputEvent::Type::kGestureLongTap ||
+      gesture_event.GetType() ==
+          blink::WebInputEvent::Type::kGestureDoubleTap ||
+      gesture_event.GetType() ==
+          blink::WebInputEvent::Type::kGestureTwoFingerTap ||
+      gesture_event.GetType() ==
+          blink::WebInputEvent::Type::kGestureScrollEnd ||
+      gesture_event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart;
 
   if (is_gesture_end)
     SetTouchscreenGestureTarget(nullptr);
@@ -1622,9 +1636,9 @@ RenderWidgetTargetResult
 RenderWidgetHostInputEventRouter::FindTouchpadGestureEventTarget(
     RenderWidgetHostViewBase* root_view,
     const blink::WebGestureEvent& event) const {
-  if (event.GetType() != blink::WebInputEvent::kGesturePinchBegin &&
-      event.GetType() != blink::WebInputEvent::kGestureFlingCancel &&
-      event.GetType() != blink::WebInputEvent::kGestureDoubleTap) {
+  if (event.GetType() != blink::WebInputEvent::Type::kGesturePinchBegin &&
+      event.GetType() != blink::WebInputEvent::Type::kGestureFlingCancel &&
+      event.GetType() != blink::WebInputEvent::Type::kGestureDoubleTap) {
     return {nullptr, false, base::nullopt, true};
   }
 
@@ -1650,7 +1664,7 @@ void RenderWidgetHostInputEventRouter::DispatchTouchpadGestureEvent(
   // Touchpad gesture flings should be treated as mouse wheels for the purpose
   // of routing.
   if (touchpad_gesture_event.GetType() ==
-      blink::WebInputEvent::kGestureFlingStart) {
+      blink::WebInputEvent::Type::kGestureFlingStart) {
     if (wheel_target_) {
       blink::WebGestureEvent gesture_fling = touchpad_gesture_event;
       gfx::PointF point_in_target =
@@ -1660,22 +1674,24 @@ void RenderWidgetHostInputEventRouter::DispatchTouchpadGestureEvent(
       wheel_target_->ProcessGestureEvent(gesture_fling, latency);
       last_fling_start_target_ = wheel_target_;
     } else {
-      root_view->GestureEventAck(touchpad_gesture_event,
-                                 INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      root_view->GestureEventAck(
+          touchpad_gesture_event,
+          blink::mojom::InputEventResultState::kNoConsumerExists);
     }
     return;
   }
 
   if (touchpad_gesture_event.GetType() ==
-      blink::WebInputEvent::kGestureFlingCancel) {
+      blink::WebInputEvent::Type::kGestureFlingCancel) {
     if (last_fling_start_target_) {
       last_fling_start_target_->ProcessGestureEvent(touchpad_gesture_event,
                                                     latency);
     } else if (target) {
       target->ProcessGestureEvent(touchpad_gesture_event, latency);
     } else {
-      root_view->GestureEventAck(touchpad_gesture_event,
-                                 INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+      root_view->GestureEventAck(
+          touchpad_gesture_event,
+          blink::mojom::InputEventResultState::kNoConsumerExists);
     }
     return;
   }
@@ -1688,8 +1704,9 @@ void RenderWidgetHostInputEventRouter::DispatchTouchpadGestureEvent(
   }
 
   if (!touchpad_gesture_target_) {
-    root_view->GestureEventAck(touchpad_gesture_event,
-                               INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+    root_view->GestureEventAck(
+        touchpad_gesture_event,
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     return;
   }
 
@@ -1706,9 +1723,9 @@ void RenderWidgetHostInputEventRouter::DispatchTouchpadGestureEvent(
   touchpad_gesture_target_->ProcessGestureEvent(gesture_event, latency);
 
   if (touchpad_gesture_event.GetType() ==
-          blink::WebInputEvent::kGesturePinchEnd ||
+          blink::WebInputEvent::Type::kGesturePinchEnd ||
       touchpad_gesture_event.GetType() ==
-          blink::WebInputEvent::kGestureDoubleTap) {
+          blink::WebInputEvent::Type::kGestureDoubleTap) {
     touchpad_gesture_target_ = nullptr;
   }
 }
@@ -1771,7 +1788,7 @@ RenderWidgetHostInputEventRouter::FindTargetSynchronously(
     return FindMouseEventTarget(
         root_view, static_cast<const blink::WebMouseEvent&>(event));
   }
-  if (event.GetType() == blink::WebInputEvent::kMouseWheel) {
+  if (event.GetType() == blink::WebInputEvent::Type::kMouseWheel) {
     return FindMouseWheelEventTarget(
         root_view, static_cast<const blink::WebMouseWheelEvent&>(event));
   }
@@ -1815,7 +1832,7 @@ void RenderWidgetHostInputEventRouter::DispatchEventToTarget(
   if (target && target->ScreenRectIsUnstableFor(*event))
     event->SetTargetFrameMovedRecently();
   if (blink::WebInputEvent::IsMouseEventType(event->GetType())) {
-    if (target && event->GetType() == blink::WebInputEvent::kMouseDown) {
+    if (target && event->GetType() == blink::WebInputEvent::Type::kMouseDown) {
       mouse_down_post_transformed_coordinate_.SetPoint(target_location->x(),
                                                        target_location->y());
       last_mouse_down_target_ = target;
@@ -1825,7 +1842,7 @@ void RenderWidgetHostInputEventRouter::DispatchEventToTarget(
                        target_location);
     return;
   }
-  if (event->GetType() == blink::WebInputEvent::kMouseWheel) {
+  if (event->GetType() == blink::WebInputEvent::Type::kMouseWheel) {
     DispatchMouseWheelEvent(root_view, target,
                             *static_cast<blink::WebMouseWheelEvent*>(event),
                             latency, target_location);
@@ -1836,11 +1853,11 @@ void RenderWidgetHostInputEventRouter::DispatchEventToTarget(
     TouchEventWithLatencyInfo touch_with_latency(touch_event, latency);
     if (touch_emulator_ &&
         touch_emulator_->HandleTouchEvent(touch_with_latency.event)) {
-      // We cheat a litle bit here, and assume that we know that even if the
+      // We cheat a little bit here, and assume that we know that even if the
       // target is a RenderWidgetHostViewChildFrame, that it would only try to
       // forward the ack to the root view anyways, so we send it there directly.
-      root_view->ProcessAckedTouchEvent(touch_with_latency,
-                                        INPUT_EVENT_ACK_STATE_CONSUMED);
+      root_view->ProcessAckedTouchEvent(
+          touch_with_latency, blink::mojom::InputEventResultState::kConsumed);
       return;
     }
     DispatchTouchEvent(root_view, target, touch_event, latency, target_location,
@@ -1897,7 +1914,7 @@ void RenderWidgetHostInputEventRouter::ForwardEmulatedTouchEvent(
   last_emulated_event_root_view_ =
       last_mouse_move_root_view_ ? last_mouse_move_root_view_ : target;
 
-  if (event.GetType() == blink::WebInputEvent::kTouchStart)
+  if (event.GetType() == blink::WebInputEvent::Type::kTouchStart)
     active_touches_ += CountChangedTouchPoints(event);
   gfx::PointF transformed_point = target->TransformRootPointToViewCoordSpace(
       event.touches[0].PositionInWidget());
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
index d03df31c797..42629b133b8 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
@@ -23,7 +23,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_base_observer.h"
 #include "content/browser/renderer_host/render_widget_targeter.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/gfx/geometry/vector2d_conversions.h"
 #include "ui/gfx/transform.h"
 
@@ -92,7 +92,7 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
                          const ui::LatencyInfo& latency);
   void OnHandledTouchStartOrFirstTouchMove(uint32_t unique_touch_event_id);
   void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& event,
-                              InputEventAckState ack_result,
+                              blink::mojom::InputEventResultState ack_result,
                               RenderWidgetHostViewBase* view);
   void RouteTouchEvent(RenderWidgetHostViewBase* root_view,
                        blink::WebTouchEvent *event,
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
index d1e575d151d..632b7742e1e 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
@@ -84,19 +84,20 @@ class TestRenderWidgetHostViewChildFrame
     last_gesture_seen_ = event.GetType();
   }
 
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override {
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override {
     unique_id_for_last_touch_ack_ = touch.event.unique_touch_event_id;
   }
 
   blink::WebInputEvent::Type last_gesture_seen() { return last_gesture_seen_; }
   uint32_t last_id_for_touch_ack() { return unique_id_for_last_touch_ack_; }
 
-  void Reset() { last_gesture_seen_ = blink::WebInputEvent::kUndefined; }
+  void Reset() { last_gesture_seen_ = blink::WebInputEvent::Type::kUndefined; }
 
  private:
   blink::WebInputEvent::Type last_gesture_seen_ =
-      blink::WebInputEvent::kUndefined;
+      blink::WebInputEvent::Type::kUndefined;
   uint32_t unique_id_for_last_touch_ack_ = 0;
 };
 
@@ -147,8 +148,9 @@ class MockRootRenderWidgetHostView : public TestRenderWidgetHostView {
     last_gesture_seen_ = event.GetType();
   }
 
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override {
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override {
     unique_id_for_last_touch_ack_ = touch.event.unique_touch_event_id;
   }
 
@@ -169,11 +171,11 @@ class MockRootRenderWidgetHostView : public TestRenderWidgetHostView {
         .SetDisplayHitTestQuery(std::move(hit_test_map));
   }
 
-  void Reset() { last_gesture_seen_ = blink::WebInputEvent::kUndefined; }
+  void Reset() { last_gesture_seen_ = blink::WebInputEvent::Type::kUndefined; }
 
  private:
   blink::WebInputEvent::Type last_gesture_seen_ =
-      blink::WebInputEvent::kUndefined;
+      blink::WebInputEvent::Type::kUndefined;
   uint32_t unique_id_for_last_touch_ack_ = 0;
 };
 
@@ -311,10 +313,11 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   view_root_->SetHittestResult(child.view.get(), false);
 
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 1;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
@@ -322,7 +325,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   EXPECT_EQ(child.view.get(), touch_target());
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -330,27 +334,27 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(child.view.get(), touchscreen_gesture_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown,
             child.view->last_gesture_seen());
-  EXPECT_NE(blink::WebInputEvent::kGestureTapDown,
+  EXPECT_NE(blink::WebInputEvent::Type::kGestureTapDown,
             view_root_->last_gesture_seen());
 
-  touch_event.SetType(blink::WebInputEvent::kTouchMove);
-  touch_event.touches[0].state = blink::WebTouchPoint::kStateMoved;
+  touch_event.SetType(blink::WebInputEvent::Type::kTouchMove);
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStateMoved;
   touch_event.unique_touch_event_id += 1;
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureTapCancel);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureTapCancel);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollBegin);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollBegin);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollUpdate);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollUpdate);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
@@ -379,25 +383,25 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
 
   EXPECT_EQ(child.view.get(), touch_target());
   EXPECT_EQ(child.view.get(), touchscreen_gesture_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
             child.view->last_gesture_seen());
-  EXPECT_NE(blink::WebInputEvent::kGestureScrollUpdate,
+  EXPECT_NE(blink::WebInputEvent::Type::kGestureScrollUpdate,
             view_root_->last_gesture_seen());
 
-  touch_event.SetType(blink::WebInputEvent::kTouchEnd);
-  touch_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_event.SetType(blink::WebInputEvent::Type::kTouchEnd);
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStateReleased;
   touch_event.unique_touch_event_id += 1;
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollEnd);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollEnd);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             child.view->last_gesture_seen());
-  EXPECT_NE(blink::WebInputEvent::kGestureScrollEnd,
+  EXPECT_NE(blink::WebInputEvent::Type::kGestureScrollEnd,
             view_root_->last_gesture_seen());
 }
 
@@ -407,7 +411,7 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
 
   // Tell the child that it has event handlers, to prevent the touch event
   // queue in the renderer host from acking the touch events immediately.
-  child.widget_host->OnHasTouchEventHandlers(true);
+  child.widget_host->SetHasTouchEventHandlers(true);
 
   // Make sure we route touch events to child. This will cause the RWH's
   // InputRouter to IPC the event into the ether, from which it will never
@@ -416,20 +420,23 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
 
   // Send a TouchStart/End sequence.
   blink::WebTouchEvent touch_start_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_start_event.touches_length = 1;
-  touch_start_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_start_event.touches[0].state =
+      blink::WebTouchPoint::State::kStatePressed;
   touch_start_event.unique_touch_event_id = 1;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_start_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
 
   blink::WebTouchEvent touch_end_event(
-      blink::WebInputEvent::kTouchEnd, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchEnd, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_end_event.touches_length = 1;
-  touch_end_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_end_event.touches[0].state =
+      blink::WebTouchPoint::State::kStateReleased;
   touch_end_event.unique_touch_event_id = 2;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_end_event,
@@ -451,10 +458,12 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
 TEST_F(RenderWidgetHostInputEventRouterTest, EnsureDroppedTouchEventsAreAcked) {
   // Send a touch move without a touch start.
   blink::WebTouchEvent touch_move_event(
-      blink::WebInputEvent::kTouchMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_move_event.touches_length = 1;
-  touch_move_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_move_event.touches[0].state =
+      blink::WebTouchPoint::State::kStatePressed;
   touch_move_event.unique_touch_event_id = 1;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_move_event,
@@ -463,10 +472,12 @@ TEST_F(RenderWidgetHostInputEventRouterTest, EnsureDroppedTouchEventsAreAcked) {
 
   // Send a touch cancel without a touch start.
   blink::WebTouchEvent touch_cancel_event(
-      blink::WebInputEvent::kTouchCancel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchCancel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_cancel_event.touches_length = 1;
-  touch_cancel_event.touches[0].state = blink::WebTouchPoint::kStateCancelled;
+  touch_cancel_event.touches[0].state =
+      blink::WebTouchPoint::State::kStateCancelled;
   touch_cancel_event.unique_touch_event_id = 2;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_cancel_event,
@@ -485,10 +496,11 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceTouchEvents) {
   // Send TouchStart, TouchMove, TouchMove, TouchMove, TouchEnd and make sure
   // the targeter doesn't attempt to coalesce.
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 1;
 
   EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
@@ -498,8 +510,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceTouchEvents) {
   EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  touch_event.SetType(blink::WebInputEvent::kTouchMove);
-  touch_event.touches[0].state = blink::WebTouchPoint::kStateMoved;
+  touch_event.SetType(blink::WebInputEvent::Type::kTouchMove);
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStateMoved;
   touch_event.unique_touch_event_id += 1;
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
@@ -512,8 +524,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceTouchEvents) {
   EXPECT_EQ(2u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  touch_event.SetType(blink::WebInputEvent::kTouchEnd);
-  touch_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_event.SetType(blink::WebInputEvent::Type::kTouchEnd);
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStateReleased;
   touch_event.unique_touch_event_id += 1;
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
@@ -534,10 +546,11 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceGestureEvents) {
   // GestureScrollUpdate (x2), GestureScrollEnd and make sure
   // the targeter doesn't attempt to coalesce.
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 1;
 
   EXPECT_EQ(0u, targeter->num_requests_in_queue_for_testing());
@@ -548,7 +561,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceGestureEvents) {
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -557,33 +571,33 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotCoalesceGestureEvents) {
   EXPECT_EQ(1u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  touch_event.SetType(blink::WebInputEvent::kTouchEnd);
-  touch_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_event.SetType(blink::WebInputEvent::Type::kTouchEnd);
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStateReleased;
   touch_event.unique_touch_event_id += 1;
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(2u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollBegin);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollBegin);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(3u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollUpdate);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollUpdate);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(4u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollUpdate);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollUpdate);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(5u, targeter->num_requests_in_queue_for_testing());
   EXPECT_TRUE(targeter->is_request_in_flight_for_testing());
 
-  gesture_event.SetType(blink::WebInputEvent::kGestureScrollEnd);
+  gesture_event.SetType(blink::WebInputEvent::Type::kGestureScrollEnd);
   rwhier()->RouteGestureEvent(view_root_.get(), &gesture_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
   EXPECT_EQ(6u, targeter->num_requests_in_queue_for_testing());
@@ -606,13 +620,13 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
                                             scroll_begin));
     EXPECT_EQ(child.view.get(), bubbling_gesture_scroll_origin());
     EXPECT_EQ(view_root_.get(), bubbling_gesture_scroll_target());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
               view_root_->last_gesture_seen());
 
     rwhier()->WillDetachChildView(child.view.get());
     EXPECT_EQ(nullptr, bubbling_gesture_scroll_origin());
     EXPECT_EQ(nullptr, bubbling_gesture_scroll_target());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
               view_root_->last_gesture_seen());
   }
 
@@ -624,21 +638,21 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
                                             scroll_begin));
     EXPECT_EQ(inner.view.get(), bubbling_gesture_scroll_origin());
     EXPECT_EQ(outer.view.get(), bubbling_gesture_scroll_target());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
               outer.view->last_gesture_seen());
     ASSERT_TRUE(rwhier()->BubbleScrollEvent(view_root_.get(), outer.view.get(),
                                             scroll_begin));
     EXPECT_EQ(inner.view.get(), bubbling_gesture_scroll_origin());
     EXPECT_EQ(view_root_.get(), bubbling_gesture_scroll_target());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
               outer.view->last_gesture_seen());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
               view_root_->last_gesture_seen());
 
     rwhier()->WillDetachChildView(outer.view.get());
     EXPECT_EQ(nullptr, bubbling_gesture_scroll_origin());
     EXPECT_EQ(nullptr, bubbling_gesture_scroll_target());
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
               view_root_->last_gesture_seen());
   }
 }
@@ -659,13 +673,13 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
                                           scroll_begin));
   EXPECT_EQ(outer.view.get(), bubbling_gesture_scroll_origin());
   EXPECT_EQ(view_root_.get(), bubbling_gesture_scroll_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             view_root_->last_gesture_seen());
 
   rwhier()->WillDetachChildView(inner.view.get());
   EXPECT_EQ(outer.view.get(), bubbling_gesture_scroll_origin());
   EXPECT_EQ(view_root_.get(), bubbling_gesture_scroll_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             view_root_->last_gesture_seen());
 }
 
@@ -685,21 +699,21 @@ void RenderWidgetHostInputEventRouterTest::TestSendNewGestureWhileBubbling(
     EXPECT_EQ(bubbling_origin, bubbling_gesture_scroll_origin());
     EXPECT_EQ(parent, bubbling_gesture_scroll_target());
     if (cur_target != bubbling_origin) {
-      EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+      EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
                 cur_target->last_gesture_seen());
     }
 
     if (parent->IsRenderWidgetHostViewChildFrame()) {
       TestRenderWidgetHostViewChildFrame* next_child =
           static_cast<TestRenderWidgetHostViewChildFrame*>(parent);
-      EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+      EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
                 next_child->last_gesture_seen());
       cur_target = next_child;
       parent = next_child->GetParentView();
     } else {
       MockRootRenderWidgetHostView* root =
           static_cast<MockRootRenderWidgetHostView*>(parent);
-      EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+      EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
                 root->last_gesture_seen());
       parent = nullptr;
     }
@@ -710,10 +724,11 @@ void RenderWidgetHostInputEventRouterTest::TestSendNewGestureWhileBubbling(
   view_root_->SetHittestResult(gesture_target, false);
 
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 123;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
@@ -721,7 +736,8 @@ void RenderWidgetHostInputEventRouterTest::TestSendNewGestureWhileBubbling(
   EXPECT_EQ(gesture_target, touch_target());
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -796,7 +812,7 @@ TEST_F(RenderWidgetHostInputEventRouterTest, DoNotBubbleMultipleSequences) {
                                           scroll_begin));
   EXPECT_EQ(inner1.view.get(), bubbling_gesture_scroll_origin());
   EXPECT_EQ(outer1.view.get(), bubbling_gesture_scroll_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             outer1.view->last_gesture_seen());
 
   EXPECT_FALSE(rwhier()->BubbleScrollEvent(outer2.view.get(), inner2.view.get(),
@@ -820,10 +836,11 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   view_root_->SetHittestResult(view_root_.get(), false);
 
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 123;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
@@ -831,7 +848,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   EXPECT_EQ(view_root_.get(), touch_target());
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -865,10 +883,11 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   view_root_->SetHittestResult(view_root_.get(), false);
 
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   touch_event.unique_touch_event_id = 123;
 
   rwhier()->RouteTouchEvent(view_root_.get(), &touch_event,
@@ -876,7 +895,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
   EXPECT_EQ(view_root_.get(), touch_target());
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -895,7 +915,7 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
                                           scroll_begin));
   EXPECT_EQ(inner.view.get(), bubbling_gesture_scroll_origin());
   EXPECT_EQ(outer.view.get(), bubbling_gesture_scroll_target());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             outer.view->last_gesture_seen());
 
   // We cannot bubble any further, as that would interfere with the gesture in
@@ -922,7 +942,8 @@ TEST_F(RenderWidgetHostInputEventRouterTest,
 
   // Simulate middle click mouse event.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kMiddle;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
index 5697455918f..9a0bdaba2d5 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -34,7 +34,6 @@
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/common/content_constants_internal.h"
-#include "content/common/edit_command.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/common/input_messages.h"
 #include "content/common/render_frame_metadata.mojom.h"
@@ -57,6 +56,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "ui/display/screen.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/blink_features.h"
@@ -123,9 +123,9 @@ class TestView : public TestRenderWidgetHostView {
       : TestRenderWidgetHostView(rwh),
         unhandled_wheel_event_count_(0),
         acked_event_count_(0),
-        gesture_event_type_(-1),
+        gesture_event_type_(WebInputEvent::Type::kUndefined),
         use_fake_compositor_viewport_pixel_size_(false),
-        ack_result_(INPUT_EVENT_ACK_STATE_UNKNOWN) {
+        ack_result_(blink::mojom::InputEventResultState::kUnknown) {
     local_surface_id_allocator_.GenerateId();
   }
 
@@ -153,7 +153,7 @@ class TestView : public TestRenderWidgetHostView {
   const WebTouchEvent& acked_event() const { return acked_event_; }
   int acked_event_count() const { return acked_event_count_; }
   void ClearAckedEvent() {
-    acked_event_.SetType(blink::WebInputEvent::kUndefined);
+    acked_event_.SetType(blink::WebInputEvent::Type::kUndefined);
     acked_event_count_ = 0;
   }
 
@@ -163,8 +163,8 @@ class TestView : public TestRenderWidgetHostView {
   int unhandled_wheel_event_count() const {
     return unhandled_wheel_event_count_;
   }
-  int gesture_event_type() const { return gesture_event_type_; }
-  InputEventAckState ack_result() const { return ack_result_; }
+  WebInputEvent::Type gesture_event_type() const { return gesture_event_type_; }
+  blink::mojom::InputEventResultState ack_result() const { return ack_result_; }
 
   void SetMockCompositorViewportPixelSize(
       const gfx::Size& mock_compositor_viewport_pixel_size) {
@@ -191,20 +191,22 @@ class TestView : public TestRenderWidgetHostView {
     return local_surface_id_allocator_.GetCurrentLocalSurfaceIdAllocation();
   }
 
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override {
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override {
     acked_event_ = touch.event;
     ++acked_event_count_;
   }
   void WheelEventAck(const WebMouseWheelEvent& event,
-                     InputEventAckState ack_result) override {
-    if (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED)
+                     blink::mojom::InputEventResultState ack_result) override {
+    if (ack_result == blink::mojom::InputEventResultState::kConsumed)
       return;
     unhandled_wheel_event_count_++;
     unhandled_wheel_event_ = event;
   }
-  void GestureEventAck(const WebGestureEvent& event,
-                       InputEventAckState ack_result) override {
+  void GestureEventAck(
+      const WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) override {
     gesture_event_type_ = event.GetType();
     ack_result_ = ack_result;
   }
@@ -219,11 +221,11 @@ class TestView : public TestRenderWidgetHostView {
   int unhandled_wheel_event_count_;
   WebTouchEvent acked_event_;
   int acked_event_count_;
-  int gesture_event_type_;
+  WebInputEvent::Type gesture_event_type_;
   gfx::Rect bounds_;
   bool use_fake_compositor_viewport_pixel_size_;
   gfx::Size mock_compositor_viewport_pixel_size_;
-  InputEventAckState ack_result_;
+  blink::mojom::InputEventResultState ack_result_;
   viz::ParentLocalSurfaceIdAllocator local_surface_id_allocator_;
   ScreenInfo screen_info_;
 
@@ -308,9 +310,9 @@ class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate {
       : prehandle_keyboard_event_(false),
         prehandle_keyboard_event_is_shortcut_(false),
         prehandle_keyboard_event_called_(false),
-        prehandle_keyboard_event_type_(WebInputEvent::kUndefined),
+        prehandle_keyboard_event_type_(WebInputEvent::Type::kUndefined),
         unhandled_keyboard_event_called_(false),
-        unhandled_keyboard_event_type_(WebInputEvent::kUndefined),
+        unhandled_keyboard_event_type_(WebInputEvent::Type::kUndefined),
         handle_wheel_event_(false),
         handle_wheel_event_called_(false),
         unresponsive_timer_fired_(false),
@@ -391,6 +393,12 @@ class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate {
     ignore_input_events_ = ignore_input_events;
   }
 
+  bool IsFullscreenForCurrentTab() override { return is_fullscreen_for_tab_; }
+
+  void set_is_fullscreen_for_current_tab(bool enabled) {
+    is_fullscreen_for_tab_ = enabled;
+  }
+
  protected:
   KeyboardEventProcessingResult PreHandleKeyboardEvent(
       const NativeWebKeyboardEvent& event) override {
@@ -426,9 +434,12 @@ class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate {
       const std::string& command,
       const base::Optional<base::string16>& value) override {}
 
+  void Undo() override {}
+  void Redo() override {}
   void Cut() override {}
   void Copy() override {}
   void Paste() override {}
+  void PasteAndMatchStyle() override {}
   void SelectAll() override {}
 
  private:
@@ -457,6 +468,8 @@ class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate {
   int on_vertical_scroll_direction_changed_call_count_ = 0;
   viz::VerticalScrollDirection last_vertical_scroll_direction_ =
       viz::VerticalScrollDirection::kNull;
+
+  bool is_fullscreen_for_tab_ = false;
 };
 
 class MockRenderWidgetHostOwnerDelegate
@@ -587,10 +600,10 @@ class RenderWidgetHostTest : public testing::Test {
 
   void SimulateKeyboardEventWithCommands(WebInputEvent::Type type) {
     NativeWebKeyboardEvent native_event(type, 0, GetNextSimulatedEventTime());
-    EditCommands commands;
-    commands.emplace_back("name", "value");
+    std::vector<blink::mojom::EditCommandPtr> edit_commands;
+    edit_commands.push_back(blink::mojom::EditCommand::New("name", "value"));
     host_->ForwardKeyboardEventWithCommands(native_event, ui::LatencyInfo(),
-                                            &commands, nullptr);
+                                            std::move(edit_commands), nullptr);
   }
 
   void SimulateMouseEvent(WebInputEvent::Type type) {
@@ -652,7 +665,7 @@ class RenderWidgetHostTest : public testing::Test {
   }
 
   void SimulateMouseMove(int x, int y, int modifiers) {
-    SimulateMouseEvent(WebInputEvent::kMouseMove, x, y, modifiers, false);
+    SimulateMouseEvent(WebInputEvent::Type::kMouseMove, x, y, modifiers, false);
   }
 
   void SimulateMouseEvent(
@@ -960,6 +973,58 @@ TEST_F(RenderWidgetHostTest, ResizeScreenInfo) {
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
 }
 
+// Tests that a resize event is sent when entering fullscreen mode, and the
+// screen_info rects are overridden to match the view bounds.
+TEST_F(RenderWidgetHostTest, OverrideScreenInfoDuringFullscreenMode) {
+  const gfx::Rect kScreenBounds(0, 0, 800, 600);
+  const gfx::Rect kViewBounds(55, 66, 600, 500);
+
+  ScreenInfo screen_info;
+  screen_info.device_scale_factor = 1.f;
+  screen_info.rect = kScreenBounds;
+  screen_info.available_rect = kScreenBounds;
+  screen_info.orientation_angle = 0;
+  screen_info.orientation_type = SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY;
+  view_->SetScreenInfo(screen_info);
+
+  sink_->ClearMessages();
+
+  // Do initial VisualProperties sync while not fullscreened.
+  view_->SetBounds(kViewBounds);
+  ASSERT_FALSE(delegate_->IsFullscreenForCurrentTab());
+  host_->SynchronizeVisualPropertiesIgnoringPendingAck();
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  WidgetMsg_UpdateVisualProperties::Param param;
+  ASSERT_TRUE(
+      WidgetMsg_UpdateVisualProperties::Read(sink_->GetMessageAt(0), &param));
+  VisualProperties props = std::get<0>(param);
+  EXPECT_EQ(kScreenBounds, props.screen_info.rect);
+  EXPECT_EQ(kScreenBounds, props.screen_info.available_rect);
+
+  // Enter fullscreen and do another VisualProperties sync.
+  delegate_->set_is_fullscreen_for_current_tab(true);
+  host_->SynchronizeVisualPropertiesIgnoringPendingAck();
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(2u, sink_->message_count());
+  ASSERT_TRUE(
+      WidgetMsg_UpdateVisualProperties::Read(sink_->GetMessageAt(1), &param));
+  props = std::get<0>(param);
+  EXPECT_EQ(kViewBounds.size(), props.screen_info.rect.size());
+  EXPECT_EQ(kViewBounds.size(), props.screen_info.available_rect.size());
+
+  // Exit fullscreen and do another VisualProperties sync.
+  delegate_->set_is_fullscreen_for_current_tab(false);
+  host_->SynchronizeVisualPropertiesIgnoringPendingAck();
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(3u, sink_->message_count());
+  ASSERT_TRUE(
+      WidgetMsg_UpdateVisualProperties::Read(sink_->GetMessageAt(2), &param));
+  props = std::get<0>(param);
+  EXPECT_EQ(kScreenBounds, props.screen_info.rect);
+  EXPECT_EQ(kScreenBounds, props.screen_info.available_rect);
+}
+
 TEST_F(RenderWidgetHostTest, ReceiveFrameTokenFromCrashedRenderer) {
   // The Renderer sends a monotonically increasing frame token.
   host_->DidProcessFrame(2);
@@ -1092,7 +1157,7 @@ TEST_F(RenderWidgetHostTest, HideShowMessages) {
 
 TEST_F(RenderWidgetHostTest, IgnoreKeyEventsHandledByRenderer) {
   // Simulate a keyboard event.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure we sent the input event to the renderer.
   MockWidgetInputHandler::MessageVector dispatched_events =
@@ -1101,13 +1166,14 @@ TEST_F(RenderWidgetHostTest, IgnoreKeyEventsHandledByRenderer) {
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
 
   // Send the simulated response from the renderer back.
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_FALSE(delegate_->unhandled_keyboard_event_called());
 }
 
 TEST_F(RenderWidgetHostTest, SendEditCommandsBeforeKeyEvent) {
   // Simulate a keyboard event.
-  SimulateKeyboardEventWithCommands(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEventWithCommands(WebInputEvent::Type::kRawKeyDown);
 
   // Make sure we sent commands and key event to the renderer.
   MockWidgetInputHandler::MessageVector dispatched_events =
@@ -1117,7 +1183,8 @@ TEST_F(RenderWidgetHostTest, SendEditCommandsBeforeKeyEvent) {
   ASSERT_TRUE(dispatched_events[0]->ToEditCommand());
   ASSERT_TRUE(dispatched_events[1]->ToEvent());
   // Send the simulated response from the renderer back.
-  dispatched_events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 }
 
 TEST_F(RenderWidgetHostTest, PreHandleRawKeyDownEvent) {
@@ -1126,10 +1193,10 @@ TEST_F(RenderWidgetHostTest, PreHandleRawKeyDownEvent) {
   delegate_->set_prehandle_keyboard_event(true);
 
   // Simulate a keyboard event.
-  SimulateKeyboardEventWithCommands(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEventWithCommands(WebInputEvent::Type::kRawKeyDown);
 
   EXPECT_TRUE(delegate_->prehandle_keyboard_event_called());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             delegate_->prehandle_keyboard_event_type());
 
   // Make sure the commands and key event are not sent to the renderer.
@@ -1141,7 +1208,7 @@ TEST_F(RenderWidgetHostTest, PreHandleRawKeyDownEvent) {
   delegate_->set_prehandle_keyboard_event(false);
 
   // Forward the Char event.
-  SimulateKeyboardEvent(WebInputEvent::kChar);
+  SimulateKeyboardEvent(WebInputEvent::Type::kChar);
 
   // Make sure the Char event is suppressed.
   dispatched_events =
@@ -1149,7 +1216,7 @@ TEST_F(RenderWidgetHostTest, PreHandleRawKeyDownEvent) {
   EXPECT_EQ(0u, dispatched_events.size());
 
   // Forward the KeyUp event.
-  SimulateKeyboardEvent(WebInputEvent::kKeyUp);
+  SimulateKeyboardEvent(WebInputEvent::Type::kKeyUp);
 
   // Make sure the KeyUp event is suppressed.
   dispatched_events =
@@ -1157,20 +1224,20 @@ TEST_F(RenderWidgetHostTest, PreHandleRawKeyDownEvent) {
   EXPECT_EQ(0u, dispatched_events.size());
 
   // Simulate a new RawKeyDown event.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_TRUE(delegate_->unhandled_keyboard_event_called());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             delegate_->unhandled_keyboard_event_type());
 }
 
@@ -1180,10 +1247,10 @@ TEST_F(RenderWidgetHostTest, RawKeyDownShortcutEvent) {
   delegate_->set_prehandle_keyboard_event_is_shortcut(true);
 
   // Simulate a keyboard event.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   EXPECT_TRUE(delegate_->prehandle_keyboard_event_called());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             delegate_->prehandle_keyboard_event_type());
 
   // Make sure the RawKeyDown event is sent to the renderer.
@@ -1191,20 +1258,20 @@ TEST_F(RenderWidgetHostTest, RawKeyDownShortcutEvent) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kRawKeyDown,
+      blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kRawKeyDown,
             delegate_->unhandled_keyboard_event_type());
 
   // The browser won't pre-handle a Char event.
   delegate_->set_prehandle_keyboard_event_is_shortcut(false);
 
   // Forward the Char event.
-  SimulateKeyboardEvent(WebInputEvent::kChar);
+  SimulateKeyboardEvent(WebInputEvent::Type::kChar);
 
   // The Char event is not suppressed; the renderer will ignore it
   // if the preceding RawKeyDown shortcut goes unhandled.
@@ -1212,29 +1279,31 @@ TEST_F(RenderWidgetHostTest, RawKeyDownShortcutEvent) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kChar,
+  EXPECT_EQ(WebInputEvent::Type::kChar,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kChar, delegate_->unhandled_keyboard_event_type());
+      blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kChar,
+            delegate_->unhandled_keyboard_event_type());
 
   // Forward the KeyUp event.
-  SimulateKeyboardEvent(WebInputEvent::kKeyUp);
+  SimulateKeyboardEvent(WebInputEvent::Type::kKeyUp);
 
   // Make sure only KeyUp was sent to the renderer.
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kKeyUp,
+  EXPECT_EQ(WebInputEvent::Type::kKeyUp,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kKeyUp, delegate_->unhandled_keyboard_event_type());
+      blink::mojom::InputEventResultState::kNotConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kKeyUp,
+            delegate_->unhandled_keyboard_event_type());
 }
 
 TEST_F(RenderWidgetHostTest, UnhandledWheelEvent) {
@@ -1244,12 +1313,12 @@ TEST_F(RenderWidgetHostTest, UnhandledWheelEvent) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kMouseWheel,
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_TRUE(delegate_->handle_wheel_event_called());
   EXPECT_EQ(1, view_->unhandled_wheel_event_count());
@@ -1266,12 +1335,12 @@ TEST_F(RenderWidgetHostTest, HandleWheelEvent) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kMouseWheel,
+  EXPECT_EQ(WebInputEvent::Type::kMouseWheel,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // ensure the wheel event handler was invoked
   EXPECT_TRUE(delegate_->handle_wheel_event_called());
@@ -1281,7 +1350,7 @@ TEST_F(RenderWidgetHostTest, HandleWheelEvent) {
 }
 
 TEST_F(RenderWidgetHostTest, EventsCausingFocus) {
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
   EXPECT_EQ(1, delegate_->GetFocusOwningWebContentsCallCount());
 
   PressTouchPoint(0, 1);
@@ -1292,32 +1361,34 @@ TEST_F(RenderWidgetHostTest, EventsCausingFocus) {
   SendTouchEvent();
   EXPECT_EQ(2, delegate_->GetFocusOwningWebContentsCallCount());
 
-  SimulateGestureEvent(WebInputEvent::kGestureTapDown,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTapDown,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(2, delegate_->GetFocusOwningWebContentsCallCount());
 
-  SimulateGestureEvent(WebInputEvent::kGestureTap,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTap,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(3, delegate_->GetFocusOwningWebContentsCallCount());
 }
 
 TEST_F(RenderWidgetHostTest, UnhandledGestureEvent) {
-  SimulateGestureEvent(WebInputEvent::kGestureTwoFingerTap,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureTwoFingerTap,
                        blink::WebGestureDevice::kTouchscreen);
 
   MockWidgetInputHandler::MessageVector dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kGestureTwoFingerTap,
+  EXPECT_EQ(WebInputEvent::Type::kGestureTwoFingerTap,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
   // Send the simulated response from the renderer back.
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
-  EXPECT_EQ(WebInputEvent::kGestureTwoFingerTap, view_->gesture_event_type());
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, view_->ack_result());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTwoFingerTap,
+            view_->gesture_event_type());
+  EXPECT_EQ(blink::mojom::InputEventResultState::kNotConsumed,
+            view_->ack_result());
 }
 
 // Test that the hang monitor timer expires properly if a new timer is started
@@ -1360,7 +1431,7 @@ TEST_F(RenderWidgetHostTest, StopAndStartInputEventAckTimeout) {
 // Test that the hang monitor timer is effectively disabled when the widget is
 // hidden.
 TEST_F(RenderWidgetHostTest, InputEventAckTimeoutDisabledForInputWhenHidden) {
-  SimulateMouseEvent(WebInputEvent::kMouseMove, 10, 10, 0, false);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseMove, 10, 10, 0, false);
 
   // Hiding the widget should deactivate the timeout.
   host_->WasHidden();
@@ -1372,7 +1443,7 @@ TEST_F(RenderWidgetHostTest, InputEventAckTimeoutDisabledForInputWhenHidden) {
   EXPECT_FALSE(delegate_->unresponsive_timer_fired());
 
   // The timeout should never reactivate while hidden.
-  SimulateMouseEvent(WebInputEvent::kMouseMove, 10, 10, 0, false);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseMove, 10, 10, 0, false);
   task_environment_.FastForwardBy(
       base::TimeDelta::FromMilliseconds(kHungRendererDelayMs + 10));
   EXPECT_FALSE(delegate_->unresponsive_timer_fired());
@@ -1390,10 +1461,10 @@ TEST_F(RenderWidgetHostTest, InputEventAckTimeoutDisabledForInputWhenHidden) {
 // This test will catch a regression of crbug.com/111185.
 TEST_F(RenderWidgetHostTest, MultipleInputEvents) {
   // Send two events but only one ack.
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   task_environment_.FastForwardBy(
       base::TimeDelta::FromMilliseconds(kHungRendererDelayMs / 2));
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   MockWidgetInputHandler::MessageVector dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
@@ -1401,7 +1472,8 @@ TEST_F(RenderWidgetHostTest, MultipleInputEvents) {
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
 
   // Send the simulated response from the renderer back.
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Wait long enough for second timeout and see if it fired.
   task_environment_.FastForwardBy(
@@ -1414,16 +1486,16 @@ TEST_F(RenderWidgetHostTest, IgnoreInputEvent) {
 
   delegate_->SetIgnoreInputEvents(true);
 
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   EXPECT_FALSE(host_->mock_input_router()->sent_keyboard_event_);
 
-  SimulateMouseEvent(WebInputEvent::kMouseMove);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseMove);
   EXPECT_FALSE(host_->mock_input_router()->sent_mouse_event_);
 
   SimulateWheelEvent(0, 100, 0, true);
   EXPECT_FALSE(host_->mock_input_router()->sent_wheel_event_);
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchpad);
   EXPECT_FALSE(host_->mock_input_router()->sent_gesture_event_);
 
@@ -1437,7 +1509,7 @@ TEST_F(RenderWidgetHostTest, KeyboardListenerIgnoresEvent) {
   host_->AddKeyPressEventCallback(base::BindRepeating(
       &RenderWidgetHostTest::KeyPressEventCallback, base::Unretained(this)));
   handle_key_press_event_ = false;
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   EXPECT_TRUE(host_->mock_input_router()->sent_keyboard_event_);
 }
@@ -1450,23 +1522,23 @@ TEST_F(RenderWidgetHostTest, KeyboardListenerSuppressFollowingEvents) {
 
   // The callback handles the first event
   handle_key_press_event_ = true;
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
 
   EXPECT_FALSE(host_->mock_input_router()->sent_keyboard_event_);
 
   // Following Char events should be suppressed
   handle_key_press_event_ = false;
-  SimulateKeyboardEvent(WebInputEvent::kChar);
+  SimulateKeyboardEvent(WebInputEvent::Type::kChar);
   EXPECT_FALSE(host_->mock_input_router()->sent_keyboard_event_);
-  SimulateKeyboardEvent(WebInputEvent::kChar);
+  SimulateKeyboardEvent(WebInputEvent::Type::kChar);
   EXPECT_FALSE(host_->mock_input_router()->sent_keyboard_event_);
 
   // Sending RawKeyDown event should stop suppression
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   EXPECT_TRUE(host_->mock_input_router()->sent_keyboard_event_);
 
   host_->mock_input_router()->sent_keyboard_event_ = false;
-  SimulateKeyboardEvent(WebInputEvent::kChar);
+  SimulateKeyboardEvent(WebInputEvent::Type::kChar);
   EXPECT_TRUE(host_->mock_input_router()->sent_keyboard_event_);
 }
 
@@ -1477,12 +1549,12 @@ TEST_F(RenderWidgetHostTest, MouseEventCallbackCanHandleEvent) {
       &RenderWidgetHostTest::MouseEventCallback, base::Unretained(this)));
 
   handle_mouse_event_ = true;
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
 
   EXPECT_FALSE(host_->mock_input_router()->sent_mouse_event_);
 
   handle_mouse_event_ = false;
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
 
   EXPECT_TRUE(host_->mock_input_router()->sent_mouse_event_);
 }
@@ -1492,7 +1564,7 @@ TEST_F(RenderWidgetHostTest, InputRouterReceivesHasTouchEventHandlers) {
 
   ASSERT_FALSE(host_->mock_input_router()->has_handlers_);
 
-  host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  host_->SetHasTouchEventHandlers(true);
   EXPECT_TRUE(host_->mock_input_router()->has_handlers_);
 }
 
@@ -1507,7 +1579,8 @@ void CheckLatencyInfoComponentInMessage(
   EXPECT_TRUE(
       dispatched_events[0]->ToEvent()->Event()->latency_info.FindLatency(
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 }
 
 void CheckLatencyInfoComponentInGestureScrollUpdate(
@@ -1515,15 +1588,16 @@ void CheckLatencyInfoComponentInGestureScrollUpdate(
   ASSERT_EQ(2u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
   ASSERT_TRUE(dispatched_events[1]->ToEvent());
-  EXPECT_EQ(WebInputEvent::kTouchScrollStarted,
+  EXPECT_EQ(WebInputEvent::Type::kTouchScrollStarted,
             dispatched_events[0]->ToEvent()->Event()->web_event->GetType());
 
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
             dispatched_events[1]->ToEvent()->Event()->web_event->GetType());
   EXPECT_TRUE(
       dispatched_events[1]->ToEvent()->Event()->latency_info.FindLatency(
           ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT, nullptr));
-  dispatched_events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 }
 
 // Tests that after input event passes through RWHI through ForwardXXXEvent()
@@ -1531,14 +1605,14 @@ void CheckLatencyInfoComponentInGestureScrollUpdate(
 // ui::INPUT_EVENT_LATENCY_BEGIN_RWH_COMPONENT will always present in the
 // event's LatencyInfo.
 TEST_F(RenderWidgetHostTest, InputEventRWHLatencyComponent) {
-  host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  host_->SetHasTouchEventHandlers(true);
 
   // Tests RWHI::ForwardWheelEvent().
   SimulateWheelEvent(-5, 0, 0, true, WebMouseWheelEvent::kPhaseBegan);
   MockWidgetInputHandler::MessageVector dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kMouseWheel);
+                                     WebInputEvent::Type::kMouseWheel);
 
   // Tests RWHI::ForwardWheelEventWithLatencyInfo().
   SimulateWheelEventWithLatencyInfo(-5, 0, 0, true, ui::LatencyInfo(),
@@ -1546,22 +1620,22 @@ TEST_F(RenderWidgetHostTest, InputEventRWHLatencyComponent) {
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kMouseWheel);
+                                     WebInputEvent::Type::kMouseWheel);
 
   // Tests RWHI::ForwardMouseEvent().
-  SimulateMouseEvent(WebInputEvent::kMouseMove);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseMove);
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kMouseMove);
+                                     WebInputEvent::Type::kMouseMove);
 
   // Tests RWHI::ForwardMouseEventWithLatencyInfo().
-  SimulateMouseEventWithLatencyInfo(WebInputEvent::kMouseMove,
+  SimulateMouseEventWithLatencyInfo(WebInputEvent::Type::kMouseMove,
                                     ui::LatencyInfo());
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kMouseMove);
+                                     WebInputEvent::Type::kMouseMove);
 
   // Tests RWHI::ForwardGestureEvent().
   PressTouchPoint(0, 1);
@@ -1570,17 +1644,17 @@ TEST_F(RenderWidgetHostTest, InputEventRWHLatencyComponent) {
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kTouchStart);
+                                     WebInputEvent::Type::kTouchStart);
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kGestureScrollBegin);
+                                     WebInputEvent::Type::kGestureScrollBegin);
 
   // Tests RWHI::ForwardGestureEventWithLatencyInfo().
-  SimulateGestureEventWithLatencyInfo(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEventWithLatencyInfo(WebInputEvent::Type::kGestureScrollUpdate,
                                       blink::WebGestureDevice::kTouchscreen,
                                       ui::LatencyInfo());
   dispatched_events =
@@ -1598,12 +1672,12 @@ TEST_F(RenderWidgetHostTest, InputEventRWHLatencyComponent) {
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   CheckLatencyInfoComponentInMessage(dispatched_events,
-                                     WebInputEvent::kTouchStart);
+                                     WebInputEvent::Type::kTouchStart);
 }
 
 TEST_F(RenderWidgetHostTest, RendererExitedResetsInputRouter) {
   EXPECT_EQ(0u, host_->in_flight_event_count());
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   EXPECT_EQ(1u, host_->in_flight_event_count());
 
   EXPECT_FALSE(host_->input_router()->HasPendingEvents());
@@ -1632,7 +1706,7 @@ TEST_F(RenderWidgetHostTest, RendererExitedResetsInputRouter) {
 
 TEST_F(RenderWidgetHostTest, DestroyingRenderWidgetResetsInputRouter) {
   EXPECT_EQ(0u, host_->in_flight_event_count());
-  SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kRawKeyDown);
   EXPECT_EQ(1u, host_->in_flight_event_count());
 
   EXPECT_FALSE(host_->input_router()->HasPendingEvents());
@@ -1838,13 +1912,13 @@ TEST_F(RenderWidgetHostTest, HideUnthrottlesResize) {
 // Tests that event dispatch after the delegate has been detached doesn't cause
 // a crash. See crbug.com/563237.
 TEST_F(RenderWidgetHostTest, EventDispatchPostDetach) {
-  host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  host_->SetHasTouchEventHandlers(true);
   process_->sink().ClearMessages();
 
   host_->DetachDelegate();
 
   // Tests RWHI::ForwardGestureEventWithLatencyInfo().
-  SimulateGestureEventWithLatencyInfo(WebInputEvent::kGestureScrollUpdate,
+  SimulateGestureEventWithLatencyInfo(WebInputEvent::Type::kGestureScrollUpdate,
                                       blink::WebGestureDevice::kTouchscreen,
                                       ui::LatencyInfo());
 
@@ -2040,14 +2114,14 @@ TEST_F(RenderWidgetHostTest, RendererHangRecordsMetrics) {
   input_router_client->IncrementInFlightEventCount();
   clock.Advance(base::TimeDelta::FromSeconds(3));
   input_router_client->DecrementInFlightEventCount(
-      InputEventAckSource::UNKNOWN);
+      blink::mojom::InputEventResultSource::kUnknown);
   tester.ExpectTotalCount("Renderer.Hung.Duration", 0u);
 
   // Do a 17s hang. This should affect metrics.
   input_router_client->IncrementInFlightEventCount();
   clock.Advance(base::TimeDelta::FromSeconds(17));
   input_router_client->DecrementInFlightEventCount(
-      InputEventAckSource::UNKNOWN);
+      blink::mojom::InputEventResultSource::kUnknown);
   tester.ExpectTotalCount("Renderer.Hung.Duration", 1u);
   tester.ExpectUniqueSample("Renderer.Hung.Duration", 17000, 1);
 }
@@ -2060,25 +2134,25 @@ TEST_F(RenderWidgetHostTest, PendingUserActivationTimeout) {
       {});
 
   // One event allows one activation notification.
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
   EXPECT_TRUE(host_->RemovePendingUserActivationIfAvailable());
   EXPECT_FALSE(host_->RemovePendingUserActivationIfAvailable());
 
   // Mouse move and up does not increase pending user activation counter.
-  SimulateMouseEvent(WebInputEvent::kMouseMove);
-  SimulateMouseEvent(WebInputEvent::kMouseUp);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseMove);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseUp);
   EXPECT_FALSE(host_->RemovePendingUserActivationIfAvailable());
 
   // 2 events allow 2 activation notifications.
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
-  SimulateKeyboardEvent(WebInputEvent::kKeyDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
+  SimulateKeyboardEvent(WebInputEvent::Type::kKeyDown);
   EXPECT_TRUE(host_->RemovePendingUserActivationIfAvailable());
   EXPECT_TRUE(host_->RemovePendingUserActivationIfAvailable());
   EXPECT_FALSE(host_->RemovePendingUserActivationIfAvailable());
 
   // Timer reset the pending activation.
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
-  SimulateMouseEvent(WebInputEvent::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
+  SimulateMouseEvent(WebInputEvent::Type::kMouseDown);
   task_environment_.FastForwardBy(
       RenderWidgetHostImpl::kActivationNotificationExpireTime);
   EXPECT_FALSE(host_->RemovePendingUserActivationIfAvailable());
@@ -2092,11 +2166,12 @@ TEST_F(RenderWidgetHostTest, NoFlingEventsWhenLastScrollEventConsumed) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // A GestureFlingStart event following a consumed scroll event should not be
   // dispatched.
-  SimulateGestureEvent(blink::WebInputEvent::kGestureFlingStart,
+  SimulateGestureEvent(blink::WebInputEvent::Type::kGestureFlingStart,
                        blink::WebGestureDevice::kTouchpad);
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
@@ -2112,7 +2187,8 @@ TEST_F(RenderWidgetHostTest, FlingEventsWhenSomeScrollEventsConsumed) {
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Followed by a not consumed wheel event.
   SimulateWheelEvent(10, 0, 0, true, WebMouseWheelEvent::kPhaseChanged);
@@ -2121,10 +2197,10 @@ TEST_F(RenderWidgetHostTest, FlingEventsWhenSomeScrollEventsConsumed) {
   ASSERT_EQ(1u, dispatched_events.size());
   ASSERT_TRUE(dispatched_events[0]->ToEvent());
   dispatched_events[0]->ToEvent()->CallCallback(
-      INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // A GestureFlingStart event following the scroll events should be dispatched.
-  SimulateGestureEvent(blink::WebInputEvent::kGestureFlingStart,
+  SimulateGestureEvent(blink::WebInputEvent::Type::kGestureFlingStart,
                        blink::WebGestureDevice::kTouchpad);
   dispatched_events =
       host_->mock_widget_input_handler_.GetAndResetDispatchedMessages();
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_android.cc b/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
index 019633ce1b3..34f614accf1 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
@@ -188,8 +188,8 @@ std::string CompressAndSaveBitmap(const std::string& dir,
   }
 
   base::FilePath screenshot_path;
-  base::ScopedFILE out_file(
-      base::CreateAndOpenTemporaryFileInDir(screenshot_dir, &screenshot_path));
+  base::ScopedFILE out_file(base::CreateAndOpenTemporaryStreamInDir(
+      screenshot_dir, &screenshot_path));
   if (!out_file) {
     LOG(ERROR) << "Failed to create temporary screenshot file";
     return std::string();
@@ -197,6 +197,7 @@ std::string CompressAndSaveBitmap(const std::string& dir,
   unsigned int bytes_written =
       fwrite(reinterpret_cast<const char*>(data.data()), 1, data.size(),
              out_file.get());
+  out_file.reset();  // Explicitly close before a possible Delete below.
 
   // If there were errors, don't leave a partial file around.
   if (bytes_written != data.size()) {
@@ -230,8 +231,6 @@ RenderWidgetHostViewAndroid::RenderWidgetHostViewAndroid(
       using_viz_for_webview_(features::IsUsingVizForWebView()),
       synchronous_compositor_client_(nullptr),
       observing_root_window_(false),
-      fallback_cursor_mode_enabled_(
-          base::FeatureList::IsEnabled(features::kFallbackCursorMode)),
       prev_top_shown_pix_(0.f),
       prev_top_controls_translate_(0.f),
       prev_bottom_shown_pix_(0.f),
@@ -861,7 +860,7 @@ bool RenderWidgetHostViewAndroid::OnTouchEvent(
   blink::WebTouchEvent web_event = ui::CreateWebTouchEventFromMotionEvent(
       event, result.moved_beyond_slop_region /* may_cause_scrolling */,
       false /* hovering */);
-  if (web_event.GetType() == blink::WebInputEvent::kUndefined)
+  if (web_event.GetType() == blink::WebInputEvent::Type::kUndefined)
     return false;
 
   ui::LatencyInfo latency_info(ui::SourceEventType::TOUCH);
@@ -1336,7 +1335,7 @@ bool RenderWidgetHostViewAndroid::UpdateControls(
       prev_bottom_controls_min_height_offset_pix_);
 
   if (bottom_changed || !controls_initialized_)
-    view_.OnBottomControlsChanged(bottom_translate, bottom_shown_pix,
+    view_.OnBottomControlsChanged(bottom_translate,
                                   bottom_min_height_offset_pix);
   prev_bottom_shown_pix_ = bottom_shown_pix;
   prev_bottom_controls_translate_ = bottom_translate;
@@ -1550,11 +1549,13 @@ gfx::Rect RenderWidgetHostViewAndroid::GetBoundsInRootWindow() {
 }
 
 void RenderWidgetHostViewAndroid::ProcessAckedTouchEvent(
-    const TouchEventWithLatencyInfo& touch, InputEventAckState ack_result) {
-  const bool event_consumed = ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
+    const TouchEventWithLatencyInfo& touch,
+    blink::mojom::InputEventResultState ack_result) {
+  const bool event_consumed =
+      ack_result == blink::mojom::InputEventResultState::kConsumed;
   gesture_provider_.OnTouchEventAck(
       touch.event.unique_touch_event_id, event_consumed,
-      InputEventAckStateIsSetNonBlocking(ack_result));
+      InputEventResultStateIsSetNonBlocking(ack_result));
   if (touch.event.touch_start_or_first_touch_move && event_consumed &&
       host()->delegate() && host()->delegate()->GetInputEventRouter()) {
     host()
@@ -1567,7 +1568,7 @@ void RenderWidgetHostViewAndroid::ProcessAckedTouchEvent(
 
 void RenderWidgetHostViewAndroid::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   if (overscroll_controller_)
     overscroll_controller_->OnGestureEventAck(event, ack_result);
   mouse_wheel_phase_handler_.GestureEventAck(event, ack_result);
@@ -1584,33 +1585,13 @@ void RenderWidgetHostViewAndroid::GestureEventAck(
 
 void RenderWidgetHostViewAndroid::ChildDidAckGestureEvent(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   if (gesture_listener_manager_)
     gesture_listener_manager_->GestureEventAck(event, ack_result);
 }
 
-bool RenderWidgetHostViewAndroid::OnUnconsumedKeyboardEventAck(
-    const NativeWebKeyboardEventWithLatencyInfo& event) {
-  return fallback_cursor_mode_enabled_ &&
-         event.event.GetType() == blink::WebInputEvent::kKeyDown &&
-         view_.OnUnconsumedKeyboardEventAck(event.event.native_key_code);
-}
-
-void RenderWidgetHostViewAndroid::FallbackCursorModeLockCursor(bool left,
-                                                               bool right,
-                                                               bool up,
-                                                               bool down) {
-  DCHECK(fallback_cursor_mode_enabled_);
-  view_.FallbackCursorModeLockCursor(left, right, up, down);
-}
-
-void RenderWidgetHostViewAndroid::FallbackCursorModeSetCursorVisibility(
-    bool visible) {
-  DCHECK(fallback_cursor_mode_enabled_);
-  view_.FallbackCursorModeSetCursorVisibility(visible);
-}
-
-InputEventAckState RenderWidgetHostViewAndroid::FilterInputEvent(
+blink::mojom::InputEventResultState
+RenderWidgetHostViewAndroid::FilterInputEvent(
     const blink::WebInputEvent& input_event) {
   if (overscroll_controller_ &&
       blink::WebInputEvent::IsGestureEventType(input_event.GetType())) {
@@ -1622,32 +1603,32 @@ InputEventAckState RenderWidgetHostViewAndroid::FilterInputEvent(
       // overscrolling mode is not |OVERSCROLL_NONE|. The early fling
       // termination generates a GSE which completes the overscroll action.
       if (gesture_event.GetType() ==
-              blink::WebInputEvent::kGestureScrollUpdate &&
+              blink::WebInputEvent::Type::kGestureScrollUpdate &&
           gesture_event.data.scroll_update.inertial_phase ==
               blink::WebGestureEvent::InertialPhaseState::kMomentum) {
         host_->StopFling();
       }
 
-      return INPUT_EVENT_ACK_STATE_CONSUMED;
+      return blink::mojom::InputEventResultState::kConsumed;
     }
   }
 
   if (gesture_listener_manager_ &&
       gesture_listener_manager_->FilterInputEvent(input_event)) {
-    return INPUT_EVENT_ACK_STATE_CONSUMED;
+    return blink::mojom::InputEventResultState::kConsumed;
   }
 
   if (!host())
-    return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+    return blink::mojom::InputEventResultState::kNotConsumed;
 
-  if (input_event.GetType() == blink::WebInputEvent::kGestureTapDown ||
-      input_event.GetType() == blink::WebInputEvent::kTouchStart) {
+  if (input_event.GetType() == blink::WebInputEvent::Type::kGestureTapDown ||
+      input_event.GetType() == blink::WebInputEvent::Type::kTouchStart) {
     GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED,
                              false /* force_create */,
                              base::BindOnce(&WakeUpGpu));
   }
 
-  return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+  return blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 BrowserAccessibilityManager*
@@ -1699,8 +1680,8 @@ void RenderWidgetHostViewAndroid::SendKeyEvent(
     text_suggestion_host_->OnKeyEvent();
 
   ui::LatencyInfo latency_info;
-  if (event.GetType() == blink::WebInputEvent::kRawKeyDown ||
-      event.GetType() == blink::WebInputEvent::kChar) {
+  if (event.GetType() == blink::WebInputEvent::Type::kRawKeyDown ||
+      event.GetType() == blink::WebInputEvent::Type::kChar) {
     latency_info.set_source_event_type(ui::SourceEventType::KEY_PRESS);
   }
   latency_info.AddLatencyNumber(ui::INPUT_EVENT_LATENCY_UI_COMPONENT);
@@ -1713,16 +1694,16 @@ void RenderWidgetHostViewAndroid::SendMouseEvent(
   blink::WebInputEvent::Type webMouseEventType =
       ui::ToWebMouseEventType(motion_event.GetAction());
 
-  if (webMouseEventType == blink::WebInputEvent::kUndefined)
+  if (webMouseEventType == blink::WebInputEvent::Type::kUndefined)
     return;
 
-  if (webMouseEventType == blink::WebInputEvent::kMouseDown)
+  if (webMouseEventType == blink::WebInputEvent::Type::kMouseDown)
     UpdateMouseState(action_button, motion_event.GetX(0), motion_event.GetY(0));
 
   int click_count = 0;
 
-  if (webMouseEventType == blink::WebInputEvent::kMouseDown ||
-      webMouseEventType == blink::WebInputEvent::kMouseUp)
+  if (webMouseEventType == blink::WebInputEvent::Type::kMouseDown ||
+      webMouseEventType == blink::WebInputEvent::Type::kMouseUp)
     click_count = (action_button == ui::MotionEventAndroid::BUTTON_PRIMARY)
                       ? left_click_count_
                       : 1;
@@ -1792,7 +1773,7 @@ void RenderWidgetHostViewAndroid::SendGestureEvent(
     overscroll_controller_->Enable();
 
   if (!host() || !host()->delegate() ||
-      event.GetType() == blink::WebInputEvent::kUndefined) {
+      event.GetType() == blink::WebInputEvent::Type::kUndefined) {
     return;
   }
 
@@ -1801,17 +1782,17 @@ void RenderWidgetHostViewAndroid::SendGestureEvent(
   if (touch_selection_controller_ &&
       event.SourceDevice() == blink::WebGestureDevice::kTouchscreen) {
     switch (event.GetType()) {
-      case blink::WebInputEvent::kGestureLongPress:
+      case blink::WebInputEvent::Type::kGestureLongPress:
         touch_selection_controller_->HandleLongPressEvent(
             event.TimeStamp(), event.PositionInWidget());
         break;
 
-      case blink::WebInputEvent::kGestureTap:
+      case blink::WebInputEvent::Type::kGestureTap:
         touch_selection_controller_->HandleTapEvent(event.PositionInWidget(),
                                                     event.data.tap.tap_count);
         break;
 
-      case blink::WebInputEvent::kGestureScrollBegin:
+      case blink::WebInputEvent::Type::kGestureScrollBegin:
         touch_selection_controller_->OnScrollBeginEvent();
         break;
 
@@ -1823,19 +1804,21 @@ void RenderWidgetHostViewAndroid::SendGestureEvent(
   ui::LatencyInfo latency_info =
       ui::WebInputEventTraits::CreateLatencyInfoForWebGestureEvent(event);
   if (event.SourceDevice() == blink::WebGestureDevice::kTouchscreen) {
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
       // If there is a current scroll going on and a new scroll that isn't
       // wheel based, send a synthetic wheel event with kPhaseEnded to cancel
       // the current scroll.
       mouse_wheel_phase_handler_.DispatchPendingWheelEndEvent();
-    } else if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+    } else if (event.GetType() ==
+               blink::WebInputEvent::Type::kGestureScrollEnd) {
       // Make sure that the next wheel event will have phase = |kPhaseBegan|.
       // This is for maintaining the correct phase info when some of the wheel
       // events get ignored while a touchscreen scroll is going on.
       mouse_wheel_phase_handler_.IgnorePendingWheelEndEvent();
     }
 
-  } else if (event.GetType() == blink::WebInputEvent::kGestureFlingStart &&
+  } else if (event.GetType() ==
+                 blink::WebInputEvent::Type::kGestureFlingStart &&
              event.SourceDevice() == blink::WebGestureDevice::kTouchpad) {
     // Ignore the pending wheel end event to avoid sending a wheel event with
     // kPhaseEnded before a GFS.
@@ -2047,7 +2030,7 @@ void RenderWidgetHostViewAndroid::OnGestureEvent(
   // stop providing shift meta values to synthetic MotionEvents. This prevents
   // unintended shift+click interpretation of all accessibility clicks.
   // See crbug.com/443247.
-  if (web_gesture.GetType() == blink::WebInputEvent::kGestureTap &&
+  if (web_gesture.GetType() == blink::WebInputEvent::Type::kGestureTap &&
       web_gesture.GetModifiers() == blink::WebInputEvent::kShiftKey) {
     web_gesture.SetModifiers(blink::WebInputEvent::kNoModifiers);
   }
@@ -2137,24 +2120,6 @@ void RenderWidgetHostViewAndroid::OnActivityStarted() {
   ShowInternal();
 }
 
-void RenderWidgetHostViewAndroid::OnCursorVisibilityChanged(bool visible) {
-  DCHECK(observing_root_window_);
-  // The fallback_cursor_mode check should really happen higher up in the
-  // stack. We do it here because the call comes from Java ui/touchless which
-  // can't access the value of the blink Feature.
-  if (host() && fallback_cursor_mode_enabled_)
-    host()->OnCursorVisibilityStateChanged(visible);
-}
-
-void RenderWidgetHostViewAndroid::OnFallbackCursorModeToggled(bool is_on) {
-  DCHECK(observing_root_window_);
-  // The fallback_cursor_mode check should really happen higher up in the
-  // stack. We do it here because the call comes from Java ui/touchless which
-  // can't access the value of the blink Feature.
-  if (host() && fallback_cursor_mode_enabled_)
-    host()->OnFallbackCursorModeToggled(is_on);
-}
-
 void RenderWidgetHostViewAndroid::OnLostResources() {
   EvictDelegatedFrame();
 }
@@ -2204,7 +2169,7 @@ void RenderWidgetHostViewAndroid::OnStylusSelectTap(base::TimeTicks time,
   // Treat the stylus tap as a long press, activating either a word selection or
   // context menu depending on the targetted content.
   blink::WebGestureEvent long_press = WebGestureEventBuilder::Build(
-      blink::WebInputEvent::kGestureLongPress, time, x, y);
+      blink::WebInputEvent::Type::kGestureLongPress, time, x, y);
   SendGestureEvent(long_press);
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_android.h b/chromium/content/browser/renderer_host/render_widget_host_view_android.h
index 886fd54abfc..86a35ef6f0f 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_android.h
@@ -129,21 +129,16 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
   void SetTooltipText(const base::string16& tooltip_text) override;
   void TransformPointToRootSurface(gfx::PointF* point) override;
   gfx::Rect GetBoundsInRootWindow() override;
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override;
-  InputEventAckState FilterInputEvent(
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override;
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event) override;
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result) override;
-  void ChildDidAckGestureEvent(const blink::WebGestureEvent& event,
-                               InputEventAckState ack_result) override;
-  bool OnUnconsumedKeyboardEventAck(
-      const NativeWebKeyboardEventWithLatencyInfo& event) override;
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override;
-  void FallbackCursorModeSetCursorVisibility(bool visible) override;
+                       blink::mojom::InputEventResultState ack_result) override;
+  void ChildDidAckGestureEvent(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) override;
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate,
       bool for_root_frame) override;
@@ -210,8 +205,6 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
   void OnAnimate(base::TimeTicks begin_frame_time) override;
   void OnActivityStopped() override;
   void OnActivityStarted() override;
-  void OnCursorVisibilityChanged(bool visible) override;
-  void OnFallbackCursorModeToggled(bool is_on) override;
 
   // StylusTextSelectorClient implementation.
   void OnStylusSelectBegin(float x0, float y0, float x1, float y1) override;
@@ -519,8 +512,6 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
 
   bool controls_initialized_ = false;
 
-  bool fallback_cursor_mode_enabled_;
-
   float prev_top_shown_pix_;
   float prev_top_controls_translate_;
   float prev_top_controls_min_height_offset_pix_;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
index f7f9dafb979..f22bf425526 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -56,7 +56,7 @@
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
 #include "ui/accessibility/accessibility_switches.h"
-#include "ui/accessibility/platform/aura_window_properties.h"
+#include "ui/accessibility/aura/aura_window_properties.h"
 #include "ui/accessibility/platform/ax_platform_node.h"
 #include "ui/aura/client/aura_constants.h"
 #include "ui/aura/client/cursor_client.h"
@@ -71,9 +71,9 @@
 #include "ui/aura/window_observer.h"
 #include "ui/aura/window_tree_host.h"
 #include "ui/base/clipboard/scoped_clipboard_writer.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/hit_test.h"
 #include "ui/base/ime/input_method.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/compositor/dip_util.h"
@@ -111,7 +111,7 @@
 #include "ui/gfx/gdi_util.h"
 #endif
 
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
 #include "content/browser/accessibility/browser_accessibility_auralinux.h"
 #endif
 
@@ -557,7 +557,7 @@ gfx::NativeViewAccessible RenderWidgetHostViewAura::GetNativeViewAccessible() {
   if (manager)
     return ToBrowserAccessibilityWin(manager->GetRoot())->GetCOM();
 
-#elif defined(USE_X11)
+#elif defined(OS_LINUX) && !defined(OS_CHROMEOS)
   BrowserAccessibilityManager* manager =
       host()->GetOrCreateRootBrowserAccessibilityManager();
   if (manager && manager->GetRoot())
@@ -959,10 +959,10 @@ gfx::Rect RenderWidgetHostViewAura::GetBoundsInRootWindow() {
 
 void RenderWidgetHostViewAura::WheelEventAck(
     const blink::WebMouseWheelEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   if (overscroll_controller_) {
     overscroll_controller_->ReceivedEventACK(
-        event, (INPUT_EVENT_ACK_STATE_CONSUMED == ack_result));
+        event, (blink::mojom::InputEventResultState::kConsumed == ack_result));
   }
 }
 
@@ -974,19 +974,19 @@ void RenderWidgetHostViewAura::DidOverscroll(
 
 void RenderWidgetHostViewAura::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   const blink::WebInputEvent::Type event_type = event.GetType();
-  if (event_type == blink::WebGestureEvent::kGestureScrollBegin ||
-      event_type == blink::WebGestureEvent::kGestureScrollEnd) {
+  if (event_type == blink::WebGestureEvent::Type::kGestureScrollBegin ||
+      event_type == blink::WebGestureEvent::Type::kGestureScrollEnd) {
     if (host()->delegate()) {
       host()->delegate()->SetTopControlsGestureScrollInProgress(
-          event_type == blink::WebGestureEvent::kGestureScrollBegin);
+          event_type == blink::WebGestureEvent::Type::kGestureScrollBegin);
     }
   }
 
   if (overscroll_controller_) {
     overscroll_controller_->ReceivedEventACK(
-        event, (INPUT_EVENT_ACK_STATE_CONSUMED == ack_result));
+        event, (blink::mojom::InputEventResultState::kConsumed == ack_result));
     // Terminate an active fling when the ACK for a GSU generated from the fling
     // progress (GSU with inertial state) is consumed and the overscrolling mode
     // is not |OVERSCROLL_NONE|. The early fling termination generates a GSE
@@ -994,7 +994,7 @@ void RenderWidgetHostViewAura::GestureEventAck(
     // action would complete at the end of the active fling progress which
     // causes noticeable delay in cases that the fling velocity is large.
     // https://crbug.com/797855
-    if (event_type == blink::WebInputEvent::kGestureScrollUpdate &&
+    if (event_type == blink::WebInputEvent::Type::kGestureScrollUpdate &&
         event.data.scroll_update.inertial_phase ==
             blink::WebGestureEvent::InertialPhaseState::kMomentum &&
         overscroll_controller_->overscroll_mode() != OVERSCROLL_NONE) {
@@ -1013,7 +1013,7 @@ void RenderWidgetHostViewAura::GestureEventAck(
 
 void RenderWidgetHostViewAura::ProcessAckedTouchEvent(
     const TouchEventWithLatencyInfo& touch,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   aura::WindowTreeHost* window_host = window_->GetHost();
   // |host| is NULL during tests.
   if (!window_host)
@@ -1021,28 +1021,30 @@ void RenderWidgetHostViewAura::ProcessAckedTouchEvent(
 
   // The TouchScrollStarted event is generated & consumed downstream from the
   // TouchEventQueue. So we don't expect an ACK up here.
-  DCHECK(touch.event.GetType() != blink::WebInputEvent::kTouchScrollStarted);
+  DCHECK(touch.event.GetType() !=
+         blink::WebInputEvent::Type::kTouchScrollStarted);
 
-  ui::EventResult result = (ack_result == INPUT_EVENT_ACK_STATE_CONSUMED)
-                               ? ui::ER_HANDLED
-                               : ui::ER_UNHANDLED;
+  ui::EventResult result =
+      (ack_result == blink::mojom::InputEventResultState::kConsumed)
+          ? ui::ER_HANDLED
+          : ui::ER_UNHANDLED;
 
   blink::WebTouchPoint::State required_state;
   switch (touch.event.GetType()) {
-    case blink::WebInputEvent::kTouchStart:
-      required_state = blink::WebTouchPoint::kStatePressed;
+    case blink::WebInputEvent::Type::kTouchStart:
+      required_state = blink::WebTouchPoint::State::kStatePressed;
       break;
-    case blink::WebInputEvent::kTouchEnd:
-      required_state = blink::WebTouchPoint::kStateReleased;
+    case blink::WebInputEvent::Type::kTouchEnd:
+      required_state = blink::WebTouchPoint::State::kStateReleased;
       break;
-    case blink::WebInputEvent::kTouchMove:
-      required_state = blink::WebTouchPoint::kStateMoved;
+    case blink::WebInputEvent::Type::kTouchMove:
+      required_state = blink::WebTouchPoint::State::kStateMoved;
       break;
-    case blink::WebInputEvent::kTouchCancel:
-      required_state = blink::WebTouchPoint::kStateCancelled;
+    case blink::WebInputEvent::Type::kTouchCancel:
+      required_state = blink::WebTouchPoint::State::kStateCancelled;
       break;
     default:
-      required_state = blink::WebTouchPoint::kStateUndefined;
+      required_state = blink::WebTouchPoint::State::kStateUndefined;
       NOTREACHED();
       break;
   }
@@ -1054,7 +1056,7 @@ void RenderWidgetHostViewAura::ProcessAckedTouchEvent(
       DCHECK(!sent_ack);
       window_host->dispatcher()->ProcessedTouchEvent(
           touch.event.unique_touch_event_id, window_, result,
-          InputEventAckStateIsSetNonBlocking(ack_result));
+          InputEventResultStateIsSetNonBlocking(ack_result));
       if (touch.event.touch_start_or_first_touch_move &&
           result == ui::ER_HANDLED && host()->delegate() &&
           host()->delegate()->GetInputEventRouter()) {
@@ -1075,10 +1077,10 @@ RenderWidgetHostViewAura::CreateSyntheticGestureTarget() {
       new SyntheticGestureTargetAura(host()));
 }
 
-InputEventAckState RenderWidgetHostViewAura::FilterInputEvent(
+blink::mojom::InputEventResultState RenderWidgetHostViewAura::FilterInputEvent(
     const blink::WebInputEvent& input_event) {
   bool consumed = false;
-  if (input_event.GetType() == WebInputEvent::kGestureFlingStart) {
+  if (input_event.GetType() == WebInputEvent::Type::kGestureFlingStart) {
     const WebGestureEvent& gesture_event =
         static_cast<const WebGestureEvent&>(input_event);
     // Zero-velocity touchpad flings are an Aura-specific signal that the
@@ -1095,10 +1097,10 @@ InputEventAckState RenderWidgetHostViewAura::FilterInputEvent(
 
   // Touch events should always propagate to the renderer.
   if (WebTouchEvent::IsTouchEventType(input_event.GetType()))
-    return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+    return blink::mojom::InputEventResultState::kNotConsumed;
 
   if (consumed &&
-      input_event.GetType() == blink::WebInputEvent::kGestureFlingStart) {
+      input_event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart) {
     // Here we indicate that there was no consumer for this event, as
     // otherwise the fling animation system will try to run an animation
     // and will also expect a notification when the fling ends. Since
@@ -1106,11 +1108,11 @@ InputEventAckState RenderWidgetHostViewAura::FilterInputEvent(
     // of indicating that touchpad scroll has ended, we don't actually want
     // a fling animation. Note: Similar code exists in
     // RenderWidgetHostViewChildFrame::FilterInputEvent()
-    return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+    return blink::mojom::InputEventResultState::kNoConsumerExists;
   }
 
-  return consumed ? INPUT_EVENT_ACK_STATE_CONSUMED
-                  : INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+  return consumed ? blink::mojom::InputEventResultState::kConsumed
+                  : blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 BrowserAccessibilityManager*
@@ -1352,11 +1354,11 @@ ui::TextInputClient::FocusReason RenderWidgetHostViewAura::GetFocusReason()
     return ui::TextInputClient::FOCUS_REASON_NONE;
 
   switch (last_pointer_type_before_focus_) {
-    case ui::EventPointerType::POINTER_TYPE_MOUSE:
+    case ui::EventPointerType::kMouse:
       return ui::TextInputClient::FOCUS_REASON_MOUSE;
-    case ui::EventPointerType::POINTER_TYPE_PEN:
+    case ui::EventPointerType::kPen:
       return ui::TextInputClient::FOCUS_REASON_PEN;
-    case ui::EventPointerType::POINTER_TYPE_TOUCH:
+    case ui::EventPointerType::kTouch:
       return ui::TextInputClient::FOCUS_REASON_TOUCH;
     default:
       return ui::TextInputClient::FOCUS_REASON_OTHER;
@@ -1504,9 +1506,7 @@ void RenderWidgetHostViewAura::SetTextEditCommandForNextKeyEvent(
 ukm::SourceId RenderWidgetHostViewAura::GetClientSourceForMetrics() const {
   RenderFrameHostImpl* frame = GetFocusedFrame();
   if (frame) {
-    return frame->GetRenderWidgetHost()
-        ->delegate()
-        ->GetUkmSourceIdForLastCommittedSource();
+    return frame->GetPageUkmSourceId();
   }
   return ukm::SourceId();
 }
@@ -1718,7 +1718,7 @@ bool RenderWidgetHostViewAura::RequiresDoubleTapGestureEvents() const {
 // RenderWidgetHostViewAura, ui::EventHandler implementation:
 
 void RenderWidgetHostViewAura::OnKeyEvent(ui::KeyEvent* event) {
-  last_pointer_type_ = ui::EventPointerType::POINTER_TYPE_UNKNOWN;
+  last_pointer_type_ = ui::EventPointerType::kUnknown;
   event_handler_->OnKeyEvent(event);
 }
 
@@ -1733,7 +1733,7 @@ void RenderWidgetHostViewAura::OnMouseEvent(ui::MouseEvent* event) {
     last_mouse_move_location_ = event->location();
   }
 #endif
-  last_pointer_type_ = ui::EventPointerType::POINTER_TYPE_MOUSE;
+  last_pointer_type_ = ui::EventPointerType::kMouse;
   event_handler_->OnMouseEvent(event);
 }
 
@@ -1785,7 +1785,7 @@ void RenderWidgetHostViewAura::FocusedNodeChanged(
 
 #if defined(OS_WIN)
   bool dismiss_virtual_keyboard =
-      last_pointer_type_ == ui::EventPointerType::POINTER_TYPE_TOUCH;
+      last_pointer_type_ == ui::EventPointerType::kTouch;
   if (dismiss_virtual_keyboard && !editable && virtual_keyboard_requested_ &&
       window_) {
     virtual_keyboard_requested_ = false;
@@ -2366,21 +2366,22 @@ void RenderWidgetHostViewAura::ForwardKeyboardEventWithLatencyInfo(
       event.os_event &&
       keybinding_delegate->MatchEvent(*event.os_event, &commands)) {
     // Transform from ui/ types to content/ types.
-    EditCommands edit_commands;
+    std::vector<blink::mojom::EditCommandPtr> edit_commands;
     for (std::vector<ui::TextEditCommandAuraLinux>::const_iterator it =
              commands.begin(); it != commands.end(); ++it) {
-      edit_commands.push_back(EditCommand(it->GetCommandString(),
-                                          it->argument()));
+      edit_commands.push_back(blink::mojom::EditCommand::New(
+          it->GetCommandString(), it->argument()));
     }
 
-    target_host->ForwardKeyboardEventWithCommands(event, latency,
-                                                  &edit_commands, update_event);
+    target_host->ForwardKeyboardEventWithCommands(
+        event, latency, std::move(edit_commands), update_event);
     return;
   }
 #endif
 
-  target_host->ForwardKeyboardEventWithCommands(event, latency, nullptr,
-                                                update_event);
+  target_host->ForwardKeyboardEventWithCommands(
+      event, latency, std::vector<blink::mojom::EditCommandPtr>(),
+      update_event);
 }
 
 void RenderWidgetHostViewAura::CreateSelectionController() {
@@ -2424,12 +2425,11 @@ void RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(
       state->mode != ui::TEXT_INPUT_MODE_NONE) {
     bool show_virtual_keyboard = true;
 #if defined(OS_FUCHSIA)
-    show_virtual_keyboard =
-        last_pointer_type_ == ui::EventPointerType::POINTER_TYPE_TOUCH;
+    show_virtual_keyboard = last_pointer_type_ == ui::EventPointerType::kTouch;
 #elif defined(OS_WIN)
     show_virtual_keyboard =
-        last_pointer_type_ == ui::EventPointerType::POINTER_TYPE_TOUCH ||
-        last_pointer_type_ == ui::EventPointerType::POINTER_TYPE_PEN;
+        last_pointer_type_ == ui::EventPointerType::kTouch ||
+        last_pointer_type_ == ui::EventPointerType::kPen;
 #endif
 
 #if !defined(OS_WIN)
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura.h b/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
index 38faf480526..8e6ff0ad899 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -134,15 +134,16 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   void TransformPointToRootSurface(gfx::PointF* point) override;
   gfx::Rect GetBoundsInRootWindow() override;
   void WheelEventAck(const blink::WebMouseWheelEvent& event,
-                     InputEventAckState ack_result) override;
+                     blink::mojom::InputEventResultState ack_result) override;
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultState ack_result) override;
   void DidOverscroll(const ui::DidOverscrollParams& params) override;
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override;
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override;
   std::unique_ptr<SyntheticGestureTarget> CreateSyntheticGestureTarget()
       override;
-  InputEventAckState FilterInputEvent(
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event) override;
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate,
@@ -671,12 +672,11 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   uint32_t latest_capture_sequence_number_ = 0u;
 
   // The pointer type of the most recent gesture/mouse/touch event.
-  ui::EventPointerType last_pointer_type_ =
-      ui::EventPointerType::POINTER_TYPE_UNKNOWN;
+  ui::EventPointerType last_pointer_type_ = ui::EventPointerType::kUnknown;
   // The pointer type that caused the most recent focus. This value will be
   // incorrect if the focus was not triggered by a user gesture.
   ui::EventPointerType last_pointer_type_before_focus_ =
-      ui::EventPointerType::POINTER_TYPE_UNKNOWN;
+      ui::EventPointerType::kUnknown;
 
   bool is_first_navigation_ = true;
   viz::LocalSurfaceIdAllocation inset_surface_id_allocation_;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
index 8e48f26839e..93acb8a567c 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index 7073a0959d2..a11075d66ff 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
@@ -650,13 +650,13 @@ class RenderWidgetHostViewAuraOverscrollTest
   void SetUp() override {}
 
   void SendScrollUpdateAck(MockWidgetInputHandler::MessageVector& messages,
-                           InputEventAckState ack_result) {
+                           blink::mojom::InputEventResultState ack_result) {
     for (size_t i = 0; i < messages.size(); ++i) {
       MockWidgetInputHandler::DispatchedEventMessage* event =
           messages[i]->ToEvent();
       if (event &&
           event->Event()->web_event->GetType() ==
-              WebInputEvent::kGestureScrollUpdate &&
+              WebInputEvent::Type::kGestureScrollUpdate &&
           event->HasCallback()) {
         event->CallCallback(ack_result);
         return;
@@ -667,20 +667,21 @@ class RenderWidgetHostViewAuraOverscrollTest
 
   void SendScrollBeginAckIfNeeded(
       MockWidgetInputHandler::MessageVector& messages,
-      InputEventAckState ack_result) {
+      blink::mojom::InputEventResultState ack_result) {
     for (size_t i = 0; i < messages.size(); ++i) {
       MockWidgetInputHandler::DispatchedEventMessage* event =
           messages[i]->ToEvent();
       // GSB events are blocking, send the ack.
       if (event && event->Event()->web_event->GetType() ==
-                       WebInputEvent::kGestureScrollBegin) {
+                       WebInputEvent::Type::kGestureScrollBegin) {
         event->CallCallback(ack_result);
         return;
       }
     }
   }
 
-  void SendScrollBeginAckIfNeeded(InputEventAckState ack_result) {
+  void SendScrollBeginAckIfNeeded(
+      blink::mojom::InputEventResultState ack_result) {
     MockWidgetInputHandler::MessageVector events =
         GetAndResetDispatchedMessages();
     SendScrollBeginAckIfNeeded(events, ack_result);
@@ -744,7 +745,7 @@ class RenderWidgetHostViewAuraOverscrollTest
   }
 
   void SimulateMouseMove(int x, int y, int modifiers) {
-    SimulateMouseEvent(WebInputEvent::kMouseMove, x, y, modifiers, false);
+    SimulateMouseEvent(WebInputEvent::Type::kMouseMove, x, y, modifiers, false);
   }
 
   void SimulateMouseEvent(WebInputEvent::Type type,
@@ -936,13 +937,13 @@ class RenderWidgetHostViewAuraOverscrollTest
       // The first sent must be the wheel event and the second one must be
       // GestureScrollUpdate since the ack for the wheel event is non-blocking.
       EXPECT_TRUE(events[0]->ToEvent());
-      EXPECT_EQ(WebInputEvent::kMouseWheel,
+      EXPECT_EQ(WebInputEvent::Type::kMouseWheel,
                 events[0]->ToEvent()->Event()->web_event->GetType());
       gesture_scroll_update_index = 1;
     }
     EXPECT_EQ(gesture_scroll_update_index + 1, events.size());
     EXPECT_TRUE(events[gesture_scroll_update_index]->ToEvent());
-    EXPECT_EQ(WebInputEvent::kGestureScrollUpdate,
+    EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
               events[gesture_scroll_update_index]
                   ->ToEvent()
                   ->Event()
@@ -1373,18 +1374,17 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchEventState) {
   view_->Show();
 
   // Start with no touch-event handler in the renderer.
-  widget_host_->OnMessageReceived(
-      WidgetHostMsg_HasTouchEventHandlers(0, false));
-
-  ui::TouchEvent press(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent move(
-      ui::ET_TOUCH_MOVED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent release(
-      ui::ET_TOUCH_RELEASED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  widget_host_->SetHasTouchEventHandlers(false);
+
+  ui::TouchEvent press(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent move(ui::ET_TOUCH_MOVED, gfx::Point(20, 20),
+                      ui::EventTimeForNow(),
+                      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent release(ui::ET_TOUCH_RELEASED, gfx::Point(20, 20),
+                         ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   // The touch events should get forwarded from the view but only the discrete
   // events should make it all the way to the renderer.
@@ -1416,7 +1416,7 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchEventState) {
   // Now install some touch-event handlers and do the same steps. The touch
   // events should now be consumed. However, the touch-event state should be
   // updated as before.
-  widget_host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  widget_host_->SetHasTouchEventHandlers(true);
 
   view_->OnTouchEvent(&press);
   base::RunLoop().RunUntilIdle();
@@ -1445,29 +1445,25 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchEventState) {
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(3U, events.size());
 
-  widget_host_->OnMessageReceived(
-      WidgetHostMsg_HasTouchEventHandlers(0, false));
+  widget_host_->SetHasTouchEventHandlers(false);
 
   // All outstanding events should have already been sent but no new events
   // should get sent.
-  InputEventAck ack(
-      InputEventAckSource::COMPOSITOR_THREAD, blink::WebInputEvent::kTouchStart,
-      INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS, press.unique_event_id());
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, events.size());
 
-  ui::TouchEvent move2(
-      ui::ET_TOUCH_MOVED, gfx::Point(20, 20), base::TimeTicks::Now(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent move2(ui::ET_TOUCH_MOVED, gfx::Point(20, 20),
+                       base::TimeTicks::Now(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   view_->OnTouchEvent(&move2);
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(press.synchronous_handling_disabled());
   EXPECT_EQ(ui::MotionEvent::Action::MOVE, pointer_state().GetAction());
   EXPECT_EQ(1U, pointer_state().GetPointerCount());
 
-  ui::TouchEvent release2(
-      ui::ET_TOUCH_RELEASED, gfx::Point(20, 20), base::TimeTicks::Now(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent release2(ui::ET_TOUCH_RELEASED, gfx::Point(20, 20),
+                          base::TimeTicks::Now(),
+                          ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   view_->OnTouchEvent(&release2);
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(press.synchronous_handling_disabled());
@@ -1698,24 +1694,28 @@ TEST_F(RenderWidgetHostViewAuraTest, TimerBasedWheelEventPhaseInfo) {
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   events = GetAndResetDispatchedMessages();
   const WebGestureEvent* gesture_event = static_cast<const WebGestureEvent*>(
       events[0]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin, gesture_event->GetType());
   EXPECT_TRUE(gesture_event->data.scroll_begin.synthetic);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            gesture_event->GetType());
   EXPECT_EQ(0U, gesture_event->data.scroll_update.delta_x);
   EXPECT_EQ(5U, gesture_event->data.scroll_update.delta_y);
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Send a ui::ScrollEvent instead of ui::MouseWheel event, the timer based
-  // phase info doesn't diffrentiate between the two types of events.
+  // phase info doesn't differentiate between the two types of events.
   ui::ScrollEvent scroll1(ui::ET_SCROLL, gfx::Point(2, 2),
                           ui::EventTimeForNow(), 0, 0, 2, 0, 2, 2);
   view_->OnScrollEvent(&scroll1);
@@ -1726,12 +1726,14 @@ TEST_F(RenderWidgetHostViewAuraTest, TimerBasedWheelEventPhaseInfo) {
   base::TimeTicks wheel_event_timestamp = wheel_event->TimeStamp();
   EXPECT_EQ(WebMouseWheelEvent::kPhaseChanged, wheel_event->phase);
 
-    gesture_event = static_cast<const WebGestureEvent*>(
-        events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, gesture_event->GetType());
+  gesture_event = static_cast<const WebGestureEvent*>(
+      events[1]->ToEvent()->Event()->web_event.get());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            gesture_event->GetType());
   EXPECT_EQ(0U, gesture_event->data.scroll_update.delta_x);
   EXPECT_EQ(2U, gesture_event->data.scroll_update.delta_y);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Let the MouseWheelPhaseHandler::mouse_wheel_end_dispatch_timer_ fire. A
   // synthetic wheel event with zero deltas and kPhaseEnded will be sent.
@@ -1751,7 +1753,7 @@ TEST_F(RenderWidgetHostViewAuraTest, TimerBasedWheelEventPhaseInfo) {
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd, gesture_event->GetType());
   EXPECT_TRUE(gesture_event->data.scroll_end.synthetic);
 }
 
@@ -1781,7 +1783,8 @@ TEST_F(RenderWidgetHostViewAuraTest, TimerBasedLatchingBreaksWithMouseMove) {
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
   events = GetAndResetDispatchedMessages();
 
   // Send the second wheel event with a location within the slop region. The
@@ -1846,7 +1849,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
   events = GetAndResetDispatchedMessages();
 
   // Send the second wheel event with the same modifiers. The second wheel event
@@ -1908,15 +1912,18 @@ TEST_F(RenderWidgetHostViewAuraTest,
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // ACK the GSU as NOT_CONSUMED.
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin GestureScrollUpdate", GetMessageNames(events));
   EXPECT_TRUE(events[0]->ToEvent());
   EXPECT_TRUE(events[1]->ToEvent());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // Send the second wheel event with different directions. This wheel event
   // will break the latching since the last GSU was NOT_CONSUMED and the
@@ -1959,7 +1966,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_TRUE(GetMouseWheelPhaseHandler()->HasPendingWheelEndEvent());
   events = GetAndResetDispatchedMessages();
 
@@ -2015,21 +2023,25 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchpadFlingStartResetsWheelPhaseState) {
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin GestureScrollUpdate", GetMessageNames(events));
   const WebGestureEvent* gesture_event = static_cast<const WebGestureEvent*>(
       events[0]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, gesture_event->GetType());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin, gesture_event->GetType());
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            gesture_event->GetType());
   EXPECT_EQ(0U, gesture_event->data.scroll_update.delta_x);
   EXPECT_EQ(5U, gesture_event->data.scroll_update.delta_y);
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Wait for some time and resume scrolling. The second scroll will latch since
   // the user hasn't lifted their fingers, yet.
@@ -2050,8 +2062,10 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchpadFlingStartResetsWheelPhaseState) {
   EXPECT_EQ("MouseWheel GestureScrollUpdate", GetMessageNames(events));
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, gesture_event->GetType());
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            gesture_event->GetType());
   EXPECT_EQ(0U, gesture_event->data.scroll_update.delta_x);
   EXPECT_EQ(15U, gesture_event->data.scroll_update.delta_y);
 
@@ -2177,7 +2191,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   // The mouse_wheel_phase_handler's timer won't be running during touchpad
   // scroll.
@@ -2188,12 +2203,15 @@ TEST_F(RenderWidgetHostViewAuraTest,
   EXPECT_EQ("GestureScrollBegin GestureScrollUpdate", GetMessageNames(events));
   const WebGestureEvent* gesture_event = static_cast<const WebGestureEvent*>(
       events[0]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, gesture_event->GetType());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin, gesture_event->GetType());
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollUpdate, gesture_event->GetType());
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollUpdate,
+            gesture_event->GetType());
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Start mouse wheel scrolling by sending a ui::ET_MOUSEWHEEL event. This
   // should end the touchpad scrolling sequence and start a new timer-based
@@ -2237,19 +2255,22 @@ TEST_F(RenderWidgetHostViewAuraTest,
       static_cast<const WebMouseWheelEvent*>(
           events[0]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(WebMouseWheelEvent::kPhaseBegan, wheel_event->phase);
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin GestureScrollUpdate", GetMessageNames(events));
   const WebGestureEvent* gesture_event = static_cast<const WebGestureEvent*>(
       events[0]->ToEvent()->Event()->web_event.get());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
   EXPECT_EQ(0U, gesture_event->data.scroll_update.delta_x);
   EXPECT_EQ(5U, gesture_event->data.scroll_update.delta_y);
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   ui::GestureEventDetails gesture_tap_down_details(ui::ET_GESTURE_TAP_DOWN);
   gesture_tap_down_details.set_is_source_touch_event_set_non_blocking(true);
@@ -2280,12 +2301,12 @@ TEST_F(RenderWidgetHostViewAuraTest,
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[1]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollEnd, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollEnd, gesture_event->GetType());
   EXPECT_EQ(blink::WebGestureDevice::kTouchpad, gesture_event->SourceDevice());
 
   gesture_event = static_cast<const WebGestureEvent*>(
       events[2]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureScrollBegin, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureScrollBegin, gesture_event->GetType());
   EXPECT_EQ(blink::WebGestureDevice::kTouchscreen,
             gesture_event->SourceDevice());
 }
@@ -2302,14 +2323,15 @@ TEST_F(RenderWidgetHostViewAuraTest,
   base::Optional<WebGestureEvent> last_gesture =
       widget_host_->GetAndResetLastForwardedGestureEvent();
   ASSERT_TRUE(last_gesture);
-  EXPECT_EQ(WebInputEvent::kGestureFlingCancel, last_gesture->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureFlingCancel, last_gesture->GetType());
 
   // Consume the wheel to prevent gesture scrolls from interfering with the
   // rest of the test.
   MockWidgetInputHandler::MessageVector dispatched_events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(dispatched_events));
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   dispatched_events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, dispatched_events.size());
 
@@ -2322,7 +2344,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
 
   dispatched_events = GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(dispatched_events));
-  dispatched_events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  dispatched_events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   dispatched_events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, dispatched_events.size());
 }
@@ -2334,9 +2357,9 @@ TEST_F(RenderWidgetHostViewAuraTest, MultiTouchPointsStates) {
   view_->Show();
   view_->UseFakeDispatcher();
 
-  ui::TouchEvent press0(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press0(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                        ui::EventTimeForNow(),
+                        ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   view_->OnTouchEvent(&press0);
   view_->GetFocusedWidget()->input_router()->OnSetTouchAction(
@@ -2346,35 +2369,38 @@ TEST_F(RenderWidgetHostViewAuraTest, MultiTouchPointsStates) {
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("SetFocus TouchStart", GetMessageNames(events));
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(ui::MotionEvent::Action::DOWN, pointer_state().GetAction());
   EXPECT_EQ(1U, pointer_state().GetPointerCount());
   EXPECT_EQ(1U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 
-  ui::TouchEvent move0(
-      ui::ET_TOUCH_MOVED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent move0(ui::ET_TOUCH_MOVED, gfx::Point(20, 20),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   view_->OnTouchEvent(&move0);
   base::RunLoop().RunUntilIdle();
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchMove", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(ui::MotionEvent::Action::MOVE, pointer_state().GetAction());
   EXPECT_EQ(1U, pointer_state().GetPointerCount());
   EXPECT_EQ(1U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 
   // For the second touchstart, only the state of the second touch point is
   // StatePressed, the state of the first touch point is StateStationary.
-  ui::TouchEvent press1(
-      ui::ET_TOUCH_PRESSED, gfx::Point(10, 10), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 1));
+  ui::TouchEvent press1(ui::ET_TOUCH_PRESSED, gfx::Point(10, 10),
+                        ui::EventTimeForNow(),
+                        ui::PointerDetails(ui::EventPointerType::kTouch, 1));
 
   view_->OnTouchEvent(&press1);
   base::RunLoop().RunUntilIdle();
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchStart", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(ui::MotionEvent::Action::POINTER_DOWN, pointer_state().GetAction());
   EXPECT_EQ(1, pointer_state().GetActionIndex());
   EXPECT_EQ(2U, pointer_state().GetPointerCount());
@@ -2382,37 +2408,39 @@ TEST_F(RenderWidgetHostViewAuraTest, MultiTouchPointsStates) {
 
   // For the touchmove of second point, the state of the second touch point is
   // StateMoved, the state of the first touch point is StateStationary.
-  ui::TouchEvent move1(
-      ui::ET_TOUCH_MOVED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 1));
+  ui::TouchEvent move1(ui::ET_TOUCH_MOVED, gfx::Point(30, 30),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 1));
 
   view_->OnTouchEvent(&move1);
   base::RunLoop().RunUntilIdle();
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchMove", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(ui::MotionEvent::Action::MOVE, pointer_state().GetAction());
   EXPECT_EQ(2U, pointer_state().GetPointerCount());
   EXPECT_EQ(1U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 
   // For the touchmove of first point, the state of the first touch point is
   // StateMoved, the state of the second touch point is StateStationary.
-  ui::TouchEvent move2(
-      ui::ET_TOUCH_MOVED, gfx::Point(10, 10), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent move2(ui::ET_TOUCH_MOVED, gfx::Point(10, 10),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   view_->OnTouchEvent(&move2);
   base::RunLoop().RunUntilIdle();
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchMove", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(ui::MotionEvent::Action::MOVE, pointer_state().GetAction());
   EXPECT_EQ(2U, pointer_state().GetPointerCount());
   EXPECT_EQ(1U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 
-  ui::TouchEvent cancel0(
-      ui::ET_TOUCH_CANCELLED, gfx::Point(10, 10), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent cancel0(ui::ET_TOUCH_CANCELLED, gfx::Point(10, 10),
+                         ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   // For the touchcancel, only the state of the current touch point is
   // StateCancelled, the state of the other touch point is StateStationary.
@@ -2423,9 +2451,9 @@ TEST_F(RenderWidgetHostViewAuraTest, MultiTouchPointsStates) {
   EXPECT_EQ(1U, pointer_state().GetPointerCount());
   EXPECT_EQ(1U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 
-  ui::TouchEvent cancel1(
-      ui::ET_TOUCH_CANCELLED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 1));
+  ui::TouchEvent cancel1(ui::ET_TOUCH_CANCELLED, gfx::Point(30, 30),
+                         ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 1));
 
   view_->OnTouchEvent(&cancel1);
   base::RunLoop().RunUntilIdle();
@@ -2441,17 +2469,17 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchEventSyncAsync) {
   view_->InitAsChild(nullptr);
   view_->Show();
 
-  widget_host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  widget_host_->SetHasTouchEventHandlers(true);
 
-  ui::TouchEvent press(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent move(
-      ui::ET_TOUCH_MOVED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent release(
-      ui::ET_TOUCH_RELEASED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent move(ui::ET_TOUCH_MOVED, gfx::Point(20, 20),
+                      ui::EventTimeForNow(),
+                      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent release(ui::ET_TOUCH_RELEASED, gfx::Point(20, 20),
+                         ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   view_->OnTouchEvent(&press);
   EXPECT_TRUE(press.synchronous_handling_disabled());
@@ -3322,15 +3350,15 @@ TEST_F(RenderWidgetHostViewAuraTest, SourceEventTypeExistsInLatencyInfo) {
             ui::SourceEventType::WHEEL);
 
   // TOUCH source exists.
-  ui::TouchEvent press(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent move(
-      ui::ET_TOUCH_MOVED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
-  ui::TouchEvent release(
-      ui::ET_TOUCH_RELEASED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent move(ui::ET_TOUCH_MOVED, gfx::Point(20, 20),
+                      ui::EventTimeForNow(),
+                      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
+  ui::TouchEvent release(ui::ET_TOUCH_RELEASED, gfx::Point(20, 20),
+                         ui::EventTimeForNow(),
+                         ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   view_->OnTouchEvent(&press);
   view_->OnTouchEvent(&move);
   EXPECT_EQ(widget_host_->lastWheelOrTouchEventLatencyInfo.source_event_type(),
@@ -3399,9 +3427,9 @@ TEST_F(RenderWidgetHostViewAuraTest, TouchEventPositionsArentRounded) {
   view_->InitAsChild(nullptr);
   view_->Show();
 
-  ui::TouchEvent press(
-      ui::ET_TOUCH_PRESSED, gfx::Point(), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press(ui::ET_TOUCH_PRESSED, gfx::Point(),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   press.set_location_f(gfx::PointF(kX, kY));
   press.set_root_location_f(gfx::PointF(kX, kY));
 
@@ -3431,13 +3459,15 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, WheelNotPreciseScrollEvent) {
   // Receive ACK the first wheel event as not processed.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 1);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
 
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   SimulateWheelEvent(0, 0, 0, true, WebMouseWheelEvent::kPhaseEnded);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel GestureScrollEnd", GetMessageNames(events));
@@ -3478,12 +3508,14 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, WheelScrollEventOverscrolls) {
   // Receive ACK the first wheel event as not processed.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 2);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   ExpectGestureScrollEndForWheelScrolling(false);
   SendNotConsumedAcks(events);
 
@@ -3539,7 +3571,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // Receive ACK the first wheel event as processed.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 2);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
@@ -3547,11 +3580,11 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 
     // The GSU events are coalesced. This is the ack for the coalesced event.
     // Since it is the first GSU, the ack should be consumed.
-    SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollUpdateAck(events, blink::mojom::InputEventResultState::kConsumed);
 
-    SimulateWheelEvent(0, 0, 0, true, WebMouseWheelEvent::kPhaseEnded);
-    events = GetAndResetDispatchedMessages();
-    EXPECT_EQ("MouseWheel GestureScrollEnd", GetMessageNames(events));
+  SimulateWheelEvent(0, 0, 0, true, WebMouseWheelEvent::kPhaseEnded);
+  events = GetAndResetDispatchedMessages();
+  EXPECT_EQ("MouseWheel GestureScrollEnd", GetMessageNames(events));
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
 }
@@ -3570,7 +3603,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, WheelScrollOverscrollToggle) {
   SendNotConsumedAcks(events);
 
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 0);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   SendNotConsumedAcks(events);
 
   ExpectGestureScrollEndForWheelScrolling(false);
@@ -3582,7 +3616,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, WheelScrollOverscrollToggle) {
   // Scroll some more so as to not overscroll.
   SimulateWheelEvent(10, 0, 0, true, WebMouseWheelEvent::kPhaseChanged);
   events = ExpectGestureScrollUpdateAfterNonBlockingMouseWheelACK(false);
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   ExpectGestureScrollEndForWheelScrolling(false);
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
@@ -3594,7 +3629,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, WheelScrollOverscrollToggle) {
 
   events = ExpectGestureScrollUpdateAfterNonBlockingMouseWheelACK(false);
 
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   ExpectGestureScrollEndForWheelScrolling(false);
 
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
@@ -3658,7 +3694,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 0);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   SendNotConsumedAcks(events);
   ExpectGestureScrollEndForWheelScrolling(false);
@@ -3738,7 +3775,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 0);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   SendNotConsumedAcks(events);
 
   ExpectGestureScrollEndForWheelScrolling(false);
@@ -3779,7 +3817,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   SimulateGestureFlingStartEvent(0.f, 0.f, blink::WebGestureDevice::kTouchpad);
   events = GetAndResetDispatchedMessages();
   for (const auto& event : events) {
-    EXPECT_NE(WebInputEvent::kGestureFlingStart,
+    EXPECT_NE(WebInputEvent::Type::kGestureFlingStart,
               event->ToEvent()->Event()->web_event->GetType());
   }
 
@@ -3787,7 +3825,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // sends a nonblocking wheel end event. The GSE generated from wheel end event
   // resets scroll state.
   EXPECT_EQ(
-      WebInputEvent::kGestureScrollEnd,
+      WebInputEvent::Type::kGestureScrollEnd,
       events[events.size() - 1]->ToEvent()->Event()->web_event->GetType());
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
@@ -3817,20 +3855,21 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
     // Start and end a gesture in the same direction without processing the
     // gesture events in the renderer. This should initiate and complete an
     // overscroll.
-    SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+    SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                          blink::WebGestureDevice::kTouchscreen);
     SimulateGestureScrollUpdateEvent(300, -5, 0);
     MockWidgetInputHandler::MessageVector events =
         GetAndResetDispatchedMessages();
     EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
               GetMessageNames(events));
-    SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+    SendScrollBeginAckIfNeeded(events,
+                               blink::mojom::InputEventResultState::kConsumed);
     SendNotConsumedAcks(events);
     EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
     EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
     EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
 
-    SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+    SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                          blink::WebGestureDevice::kTouchscreen);
     events = GetAndResetDispatchedMessages();
     EXPECT_EQ("GestureScrollEnd", GetMessageNames(events));
@@ -3846,14 +3885,15 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
     // initiate an overscroll, the overscroll mode should get reset after the
     // first GSU event generated by the fling controller.
     overscroll_delegate()->Reset();
-    SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+    SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                          blink::WebGestureDevice::kTouchscreen);
     SimulateGestureScrollUpdateEvent(-300, -5, 0);
     MockWidgetInputHandler::MessageVector events =
         GetAndResetDispatchedMessages();
     EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
               GetMessageNames(events));
-    SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+    SendScrollBeginAckIfNeeded(events,
+                               blink::mojom::InputEventResultState::kConsumed);
     SendNotConsumedAcks(events);
     EXPECT_EQ(OVERSCROLL_WEST, overscroll_mode());
     EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
@@ -3885,12 +3925,13 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, GestureScrollOverscrolls) {
   SetUpOverscrollEnvironment();
 
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -3900,7 +3941,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, GestureScrollOverscrolls) {
   SimulateGestureScrollUpdateEvent(55, -5, 0);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
   EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
@@ -3926,7 +3968,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, GestureScrollOverscrolls) {
   // Now send a scroll end. This should cancel the overscroll gesture, and send
   // the event to the renderer. The gesture-event filter should receive this
   // event.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollEnd", GetMessageNames(events));
@@ -3944,12 +3986,13 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollDeltaCap) {
   PressAndSetTouchActionAuto();
   // Set overscroll cap and start scrolling.
   overscroll_delegate()->set_delta_cap(50);
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -3958,7 +4001,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollDeltaCap) {
   SimulateGestureScrollUpdateEvent(55, -5, 0);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
   EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
@@ -3993,7 +4037,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollDeltaCap) {
   EXPECT_EQ(0.f, overscroll_delegate()->delta_y());
 
   // End overscrolling.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollEnd", GetMessageNames(events));
@@ -4009,17 +4053,18 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, GestureScrollConsumed) {
   SetUpOverscrollEnvironment();
 
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(10, 0, 0);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
             GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   // Start scrolling on content. ACK both events as being processed.
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollUpdateAck(events, blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -4045,11 +4090,12 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 
   PressAndSetTouchActionAuto();
   // Start scrolling. Receive ACK as it being processed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
 
   // Send update events.
@@ -4059,7 +4105,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 
   // Quickly end and restart the scroll gesture. These two events should get
   // discarded.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector second_scroll_update_events =
       GetAndResetDispatchedMessages();
@@ -4067,7 +4113,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   ReleaseAndResetDispatchedMessages();
 
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   second_scroll_update_events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, second_scroll_update_events.size());
@@ -4127,12 +4173,13 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 
   PressAndSetTouchActionAuto();
   // Start scrolling. Receive ACK as it being processed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   // Send update events.
   SimulateGestureScrollUpdateEvent(55, 0, 0);
@@ -4140,7 +4187,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
 
   // Send an end event. This should get in the debounce queue.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0U, GetAndResetDispatchedMessages().size());
   ReleaseAndResetDispatchedMessages();
@@ -4173,7 +4220,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 // gesture deals with them correctly.
 TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollWithTouchEvents) {
   SetUpOverscrollEnvironmentWithDebounce(10);
-  widget_host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  widget_host_->SetHasTouchEventHandlers(true);
 
   // The test sends an intermingled sequence of touch and gesture events.
   PressTouchPoint(0, 1);
@@ -4194,12 +4241,13 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollWithTouchEvents) {
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
   SimulateGestureScrollUpdateEvent(20, 0, 0);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
   SendNotConsumedAcks(events);
@@ -4280,7 +4328,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollWithTouchEvents) {
   EXPECT_EQ("TouchEnd", GetMessageNames(events));
   SendNotConsumedAcks(events);
 
-  SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(10));
   base::RunLoop().RunUntilIdle();
@@ -4298,16 +4346,17 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollWithTouchEvents) {
 TEST_F(RenderWidgetHostViewAuraOverscrollTest,
        DISABLED_TouchGestureEndDispatchedAfterOverscrollComplete) {
   SetUpOverscrollEnvironmentWithDebounce(10);
-  widget_host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  widget_host_->SetHasTouchEventHandlers(true);
 
   PressAndSetTouchActionAuto();
   // Start scrolling. Receive ACK as it being processed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   // The scroll begin event will have received a synthetic ack from the input
   // router.
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
@@ -4332,7 +4381,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ(0.f, overscroll_delegate()->delta_y());
 
   // Send end event.
-  SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, events.size());
@@ -4348,10 +4397,11 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
 
   PressAndSetTouchActionAuto();
   // Start scrolling. Receive ACK as it being processed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
@@ -4375,7 +4425,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ(0.f, overscroll_delegate()->delta_y());
 
   // Send end event.
-  SimulateGestureEvent(blink::WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(blink::WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, events.size());
@@ -4399,18 +4449,20 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollDirectionChange) {
 
   PressAndSetTouchActionAuto();
   // Start scrolling. Receive ACK as it being processed.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin", GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   // Send update events and receive ack as not consumed.
   SimulateGestureScrollUpdateEvent(125, -5, 0);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
   EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
@@ -4441,11 +4493,12 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   SetUpOverscrollEnvironment();
 
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -4455,7 +4508,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // Send GSU to trigger overscroll.
   SimulateGestureScrollUpdateEvent(300, -5, 0);
   // Send GSE immediately before ACKing GSU.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
 
   // Now ACK the GSU. Should see a completed overscroll.
@@ -4475,14 +4528,15 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   SetUpOverscrollEnvironment();
 
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(30, -5, 0);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
             GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   // Send the first GSU which shouldn't trigger overscroll.
   SendNotConsumedAcks(events);
@@ -4493,7 +4547,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   SimulateGestureScrollUpdateEvent(30, -5, 0);
 
   // Send GSE immediately before ACKing GSU.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
 
   events = GetAndResetDispatchedMessages();
@@ -4523,9 +4577,11 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
 
   // Receive ACK the first wheel event as not processed.
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
   if (events.size() > 1)
-    events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+    events[1]->ToEvent()->CallCallback(
+        blink::mojom::InputEventResultState::kConsumed);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 0);
   SendNotConsumedAcks(events);
   ExpectGestureScrollEndForWheelScrolling(false);
@@ -4588,7 +4644,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollMouseMoveCompletion) {
   // Receive ACK the first wheel event as not processed.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 1);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
@@ -4622,9 +4679,9 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollMouseMoveCompletion) {
 
   // Now try with gestures.
   PressAndSetTouchActionAuto();
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
-  SendScrollBeginAckIfNeeded(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(blink::mojom::InputEventResultState::kConsumed);
   SimulateGestureScrollUpdateEvent(300, -5, 0);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("TouchScrollStarted GestureScrollUpdate", GetMessageNames(events));
@@ -4645,7 +4702,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollMouseMoveCompletion) {
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
   SendNotConsumedAcks(events);
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -4688,18 +4745,19 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // The first wheel event is not consumed. Dispatches the queued wheel event.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 1);
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
+  SendScrollUpdateAck(events, blink::mojom::InputEventResultState::kConsumed);
   EXPECT_TRUE(ScrollStateIsContentConsuming());
 
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollUpdateAck(events, blink::mojom::InputEventResultState::kConsumed);
   EXPECT_TRUE(ScrollStateIsContentConsuming());
 
   // Touchpad scroll can end with a zero-velocity fling which is not dispatched.
   SimulateGestureFlingStartEvent(0.f, 0.f, blink::WebGestureDevice::kTouchpad);
   events = GetAndResetDispatchedMessages();
   for (const auto& event : events) {
-    EXPECT_NE(WebInputEvent::kGestureFlingStart,
+    EXPECT_NE(WebInputEvent::Type::kGestureFlingStart,
               event->ToEvent()->Event()->web_event->GetType());
   }
 
@@ -4707,7 +4765,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // sends a nonblocking wheel end event. The GSE generated from wheel end event
   // resets scroll state.
   EXPECT_EQ(
-      WebInputEvent::kGestureScrollEnd,
+      WebInputEvent::Type::kGestureScrollEnd,
       events[events.size() - 1]->ToEvent()->Event()->web_event->GetType());
   EXPECT_TRUE(ScrollStateIsUnknown());
 
@@ -4731,7 +4789,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // yet, since enough hasn't been scrolled.
   SendNotConsumedAcks(events);
   events = ExpectGestureScrollEventsAfterMouseWheelACK(true, 1);
-  SendScrollBeginAckIfNeeded(INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_TRUE(ScrollStateIsUnknown());
 
@@ -4746,7 +4804,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   events = GetAndResetDispatchedMessages();
 
   for (const auto& event : events) {
-    EXPECT_NE(WebInputEvent::kGestureFlingStart,
+    EXPECT_NE(WebInputEvent::Type::kGestureFlingStart,
               event->ToEvent()->Event()->web_event->GetType());
   }
 
@@ -4754,7 +4812,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest,
   // sends a nonblocking wheel end event. The GSE generated from wheel end event
   // resets scroll state.
   EXPECT_EQ(
-      WebInputEvent::kGestureScrollEnd,
+      WebInputEvent::Type::kGestureScrollEnd,
       events[events.size() - 1]->ToEvent()->Event()->web_event->GetType());
 
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
@@ -4773,15 +4831,17 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollResetsOnBlur) {
   PressAndSetTouchActionAuto();
   // Start an overscroll with gesture scroll. In the middle of the scroll, blur
   // the host.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(300, -5, 0);
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
             GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
   EXPECT_EQ(OverscrollSource::TOUCHSCREEN, overscroll_source());
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
@@ -4794,7 +4854,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollResetsOnBlur) {
   EXPECT_EQ(0.f, overscroll_delegate()->delta_x());
   EXPECT_EQ(0.f, overscroll_delegate()->delta_y());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("SetFocus GestureScrollEnd", GetMessageNames(events));
@@ -4803,13 +4863,14 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollResetsOnBlur) {
   PressAndSetTouchActionAuto();
   // Start a scroll gesture again. This should correctly start the overscroll
   // after the threshold.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(300, -5, 0);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureScrollBegin TouchScrollStarted GestureScrollUpdate",
             GetMessageNames(events));
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
 
   SendNotConsumedAcks(events);
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_mode());
@@ -4817,7 +4878,7 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, OverscrollResetsOnBlur) {
   EXPECT_EQ(OVERSCROLL_EAST, overscroll_delegate()->current_mode());
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->completed_mode());
 
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_delegate()->current_mode());
@@ -4873,16 +4934,16 @@ TEST_F(RenderWidgetHostViewAuraTest,
   view_->InitAsChild(nullptr);
   view_->Show();
 
-  widget_host_->OnMessageReceived(WidgetHostMsg_HasTouchEventHandlers(0, true));
+  widget_host_->SetHasTouchEventHandlers(true);
 
-  ui::TouchEvent press(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                       ui::EventTimeForNow(),
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   // Construct a move with a touch id which doesn't exist.
   ui::TouchEvent invalid_move(
       ui::ET_TOUCH_MOVED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 1));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 1));
 
   // Valid press is handled asynchronously.
   view_->OnTouchEvent(&press);
@@ -4891,7 +4952,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ(1U, events.size());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Invalid move is handled synchronously, but is consumed. It should not
   // be forwarded to the renderer.
@@ -4960,7 +5022,8 @@ TEST_F(RenderWidgetHostViewAuraTest, SetCanScrollForWebMouseWheelEvent) {
             wheel_event->event_action);
 
   // Ack'ing the outstanding event should flush the pending event queue.
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Simulates the mouse wheel event with no modifier applied.
   event = ui::MouseWheelEvent(gfx::Vector2d(1, 1), gfx::Point(), gfx::Point(),
@@ -4984,7 +5047,8 @@ TEST_F(RenderWidgetHostViewAuraTest, SetCanScrollForWebMouseWheelEvent) {
   EXPECT_NE(blink::WebMouseWheelEvent::EventAction::kPageZoom,
             wheel_event->event_action);
 
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Simulates the scroll event with ctrl modifier applied.
   ui::ScrollEvent scroll(ui::ET_SCROLL, gfx::Point(2, 2), ui::EventTimeForNow(),
@@ -5014,25 +5078,27 @@ TEST_F(RenderWidgetHostViewAuraTest, CorrectNumberOfAcksAreDispatched) {
   view_->Show();
   view_->UseFakeDispatcher();
 
-  ui::TouchEvent press1(
-      ui::ET_TOUCH_PRESSED, gfx::Point(30, 30), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+  ui::TouchEvent press1(ui::ET_TOUCH_PRESSED, gfx::Point(30, 30),
+                        ui::EventTimeForNow(),
+                        ui::PointerDetails(ui::EventPointerType::kTouch, 0));
 
   view_->OnTouchEvent(&press1);
   base::RunLoop().RunUntilIdle();
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("SetFocus TouchStart", GetMessageNames(events));
-  events[1]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[1]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
-  ui::TouchEvent press2(
-      ui::ET_TOUCH_PRESSED, gfx::Point(20, 20), ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 1));
+  ui::TouchEvent press2(ui::ET_TOUCH_PRESSED, gfx::Point(20, 20),
+                        ui::EventTimeForNow(),
+                        ui::PointerDetails(ui::EventPointerType::kTouch, 1));
   view_->OnTouchEvent(&press2);
   base::RunLoop().RunUntilIdle();
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(1u, events.size());
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   EXPECT_EQ(2U, view_->dispatcher_->GetAndResetProcessedTouchEventCount());
 }
@@ -5057,7 +5123,8 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, ScrollDeltasResetOnEnd) {
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   SendNotConsumedAcks(events);
   events = GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
   SendNotConsumedAcks(events);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
@@ -5074,17 +5141,19 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, ScrollDeltasResetOnEnd) {
   SendNotConsumedAcks(events);
 
   // Scroll gesture.
-  SimulateGestureEvent(WebInputEvent::kGestureScrollBegin,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollBegin,
                        blink::WebGestureDevice::kTouchscreen);
   SimulateGestureScrollUpdateEvent(-30, -5, 0);
   events = GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(OVERSCROLL_NONE, overscroll_mode());
   EXPECT_EQ(OverscrollSource::NONE, overscroll_source());
   EXPECT_EQ(-30.f, overscroll_delta_x());
   EXPECT_EQ(-5.f, overscroll_delta_y());
-  SimulateGestureEvent(WebInputEvent::kGestureScrollEnd,
+  SimulateGestureEvent(WebInputEvent::Type::kGestureScrollEnd,
                        blink::WebGestureDevice::kTouchscreen);
   EXPECT_EQ(0.f, overscroll_delta_x());
   EXPECT_EQ(0.f, overscroll_delta_y());
@@ -5100,8 +5169,10 @@ TEST_F(RenderWidgetHostViewAuraOverscrollTest, ScrollDeltasResetOnEnd) {
   SendNotConsumedAcks(events);
 
   events = GetAndResetDispatchedMessages();
-  SendScrollBeginAckIfNeeded(events, INPUT_EVENT_ACK_STATE_CONSUMED);
-  SendScrollUpdateAck(events, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  SendScrollBeginAckIfNeeded(events,
+                             blink::mojom::InputEventResultState::kConsumed);
+  SendScrollUpdateAck(events,
+                      blink::mojom::InputEventResultState::kNotConsumed);
 
   SimulateWheelEvent(10, -5, 0, true, WebMouseWheelEvent::kPhaseChanged);
   events = GetAndResetDispatchedMessages();
@@ -5215,7 +5286,8 @@ TEST_P(TouchpadRenderWidgetHostViewAuraTest, ElideEmptyTouchpadPinchSequence) {
 
   // If the page consumes the update, then no GesturePinchUpdate is sent and
   // we continue to postpone sending the GesturePinchBegin.
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, events.size());
 
@@ -5259,7 +5331,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
   MockWidgetInputHandler::MessageVector events =
       GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(5U, events.size());
@@ -5293,7 +5366,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
 
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNotConsumed);
 
   events = GetAndResetDispatchedMessages();
   EXPECT_EQ(4U, events.size());
@@ -5329,7 +5403,7 @@ TEST_F(RenderWidgetHostViewAuraTest, GestureTapFromStylusHasPointerType) {
             GetMessageNames(events));
   const WebGestureEvent* gesture_event = static_cast<const WebGestureEvent*>(
       events[2]->ToEvent()->Event()->web_event.get());
-  EXPECT_EQ(WebInputEvent::kGestureTap, gesture_event->GetType());
+  EXPECT_EQ(WebInputEvent::Type::kGestureTap, gesture_event->GetType());
   EXPECT_EQ(blink::WebPointerProperties::PointerType::kPen,
             gesture_event->primary_pointer_type);
 }
@@ -6145,8 +6219,7 @@ TEST_F(RenderWidgetHostViewAuraTest, FocusReasonTouch) {
 
   ui::GestureEventDetails tap_details(ui::ET_GESTURE_TAP_DOWN);
   tap_details.set_device_type(ui::GestureDeviceType::DEVICE_TOUCHSCREEN);
-  tap_details.set_primary_pointer_type(
-      ui::EventPointerType::POINTER_TYPE_TOUCH);
+  tap_details.set_primary_pointer_type(ui::EventPointerType::kTouch);
   ui::GestureEvent touch_event(0, 0, 0, base::TimeTicks(), tap_details);
 
   parent_view_->OnGestureEvent(&touch_event);
@@ -6162,7 +6235,7 @@ TEST_F(RenderWidgetHostViewAuraTest, FocusReasonPen) {
 
   ui::GestureEventDetails tap_details(ui::ET_GESTURE_TAP_DOWN);
   tap_details.set_device_type(ui::GestureDeviceType::DEVICE_TOUCHSCREEN);
-  tap_details.set_primary_pointer_type(ui::EventPointerType::POINTER_TYPE_PEN);
+  tap_details.set_primary_pointer_type(ui::EventPointerType::kPen);
   ui::GestureEvent pen_event(0, 0, 0, base::TimeTicks(), tap_details);
 
   parent_view_->OnGestureEvent(&pen_event);
@@ -6180,8 +6253,7 @@ TEST_F(RenderWidgetHostViewAuraTest, FocusReasonMultipleEventsOnSameNode) {
   {
     ui::GestureEventDetails tap_details(ui::ET_GESTURE_TAP_DOWN);
     tap_details.set_device_type(ui::GestureDeviceType::DEVICE_TOUCHSCREEN);
-    tap_details.set_primary_pointer_type(
-        ui::EventPointerType::POINTER_TYPE_TOUCH);
+    tap_details.set_primary_pointer_type(ui::EventPointerType::kTouch);
     ui::GestureEvent touch_event(0, 0, 0, base::TimeTicks(), tap_details);
 
     parent_view_->OnGestureEvent(&touch_event);
@@ -6191,8 +6263,7 @@ TEST_F(RenderWidgetHostViewAuraTest, FocusReasonMultipleEventsOnSameNode) {
   {
     ui::GestureEventDetails tap_details(ui::ET_GESTURE_TAP_DOWN);
     tap_details.set_device_type(ui::GestureDeviceType::DEVICE_TOUCHSCREEN);
-    tap_details.set_primary_pointer_type(
-        ui::EventPointerType::POINTER_TYPE_PEN);
+    tap_details.set_primary_pointer_type(ui::EventPointerType::kPen);
     ui::GestureEvent pen_event(0, 0, 0, base::TimeTicks(), tap_details);
 
     parent_view_->OnGestureEvent(&pen_event);
@@ -6345,7 +6416,7 @@ class RenderWidgetHostViewAuraKeyboardTest
 };
 
 TEST_F(RenderWidgetHostViewAuraKeyboardTest, KeyboardObserverDestroyed) {
-  parent_view_->SetLastPointerType(ui::EventPointerType::POINTER_TYPE_TOUCH);
+  parent_view_->SetLastPointerType(ui::EventPointerType::kTouch);
   ActivateViewForTextInputManager(parent_view_, ui::TEXT_INPUT_TYPE_TEXT);
   EXPECT_NE(parent_view_->keyboard_observer_.get(), nullptr);
   EXPECT_EQ(keyboard_controller_observer_count(), 1u);
@@ -6362,7 +6433,7 @@ TEST_F(RenderWidgetHostViewAuraKeyboardTest, NoKeyboardObserverForMouseInput) {
   // removed after it has been registered with a touch input and we received a
   // mouse event.
   // Do not show virtual keyboard for mouse inputs.
-  parent_view_->SetLastPointerType(ui::EventPointerType::POINTER_TYPE_MOUSE);
+  parent_view_->SetLastPointerType(ui::EventPointerType::kMouse);
   ActivateViewForTextInputManager(parent_view_, ui::TEXT_INPUT_TYPE_TEXT);
   EXPECT_EQ(parent_view_->keyboard_observer_.get(), nullptr);
   EXPECT_EQ(keyboard_controller_observer_count(), 0u);
@@ -6372,7 +6443,7 @@ TEST_F(RenderWidgetHostViewAuraKeyboardTest, NoKeyboardObserverForMouseInput) {
 TEST_F(RenderWidgetHostViewAuraKeyboardTest,
        KeyboardObserverForOnlyTouchInput) {
   // Show virtual keyboard for touch inputs.
-  parent_view_->SetLastPointerType(ui::EventPointerType::POINTER_TYPE_TOUCH);
+  parent_view_->SetLastPointerType(ui::EventPointerType::kTouch);
   ActivateViewForTextInputManager(parent_view_, ui::TEXT_INPUT_TYPE_TEXT);
   EXPECT_NE(parent_view_->keyboard_observer_.get(), nullptr);
   EXPECT_EQ(keyboard_controller_observer_count(), 1u);
@@ -6382,7 +6453,7 @@ TEST_F(RenderWidgetHostViewAuraKeyboardTest,
 TEST_F(RenderWidgetHostViewAuraKeyboardTest,
        KeyboardObserverForFocusedNodeChanged) {
   // Show virtual keyboard for touch inputs.
-  parent_view_->SetLastPointerType(ui::EventPointerType::POINTER_TYPE_TOUCH);
+  parent_view_->SetLastPointerType(ui::EventPointerType::kTouch);
   ActivateViewForTextInputManager(parent_view_, ui::TEXT_INPUT_TYPE_TEXT);
   EXPECT_EQ(IsKeyboardVisible(), true);
   EXPECT_NE(parent_view_->keyboard_observer_.get(), nullptr);
@@ -6402,7 +6473,7 @@ TEST_F(RenderWidgetHostViewAuraKeyboardTest,
 
 TEST_F(RenderWidgetHostViewAuraKeyboardTest, KeyboardObserverForPenInput) {
   // Show virtual keyboard for pen inputs.
-  parent_view_->SetLastPointerType(ui::EventPointerType::POINTER_TYPE_PEN);
+  parent_view_->SetLastPointerType(ui::EventPointerType::kPen);
   ActivateViewForTextInputManager(parent_view_, ui::TEXT_INPUT_TYPE_TEXT);
   EXPECT_NE(parent_view_->keyboard_observer_.get(), nullptr);
   EXPECT_EQ(keyboard_controller_observer_count(), 1u);
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_base.cc b/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
index 19c6b2e5c70..403a8c870a5 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
@@ -96,15 +96,15 @@ MouseWheelPhaseHandler* RenderWidgetHostViewBase::GetMouseWheelPhaseHandler() {
 
 void RenderWidgetHostViewBase::StopFlingingIfNecessary(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // Reset view_stopped_flinging_for_test_ at the beginning of the scroll
   // sequence.
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin)
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin)
     view_stopped_flinging_for_test_ = false;
 
-  bool processed = INPUT_EVENT_ACK_STATE_CONSUMED == ack_result;
+  bool processed = blink::mojom::InputEventResultState::kConsumed == ack_result;
   if (!processed &&
-      event.GetType() == blink::WebInputEvent::kGestureScrollUpdate &&
+      event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate &&
       event.data.scroll_update.inertial_phase ==
           blink::WebGestureEvent::InertialPhaseState::kMomentum &&
       event.SourceDevice() != blink::WebGestureDevice::kSyntheticAutoscroll) {
@@ -117,9 +117,14 @@ void RenderWidgetHostViewBase::OnRenderFrameMetadataChangedBeforeActivation(
     const cc::RenderFrameMetadata& metadata) {}
 
 void RenderWidgetHostViewBase::OnRenderFrameMetadataChangedAfterActivation() {
-  is_scroll_offset_at_top_ = host_->render_frame_metadata_provider()
-                                 ->LastRenderFrameMetadata()
-                                 .is_scroll_offset_at_top;
+  const cc::RenderFrameMetadata& metadata =
+      host()->render_frame_metadata_provider()->LastRenderFrameMetadata();
+  is_scroll_offset_at_top_ = metadata.is_scroll_offset_at_top;
+
+  BrowserAccessibilityManager* manager =
+      host()->GetRootBrowserAccessibilityManager();
+  if (manager)
+    manager->SetPageScaleFactor(metadata.page_scale_factor);
 }
 
 void RenderWidgetHostViewBase::OnRenderFrameSubmission() {}
@@ -128,7 +133,7 @@ void RenderWidgetHostViewBase::OnLocalSurfaceIdChanged(
     const cc::RenderFrameMetadata& metadata) {}
 
 void RenderWidgetHostViewBase::UpdateIntrinsicSizingInfo(
-    const blink::WebIntrinsicSizingInfo& sizing_info) {}
+    blink::mojom::IntrinsicSizingInfoPtr sizing_info) {}
 
 gfx::Size RenderWidgetHostViewBase::GetCompositorViewportPixelSize() {
   return gfx::ScaleToCeiledSize(GetRequestedRendererSize(),
@@ -353,56 +358,41 @@ RenderWidgetHostViewBase::GetKeyboardLayoutMap() {
   return base::flat_map<std::string, std::string>();
 }
 
-InputEventAckState RenderWidgetHostViewBase::FilterInputEvent(
+blink::mojom::InputEventResultState RenderWidgetHostViewBase::FilterInputEvent(
     const blink::WebInputEvent& input_event) {
   // By default, input events are simply forwarded to the renderer.
-  return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+  return blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 void RenderWidgetHostViewBase::WheelEventAck(
     const blink::WebMouseWheelEvent& event,
-    InputEventAckState ack_result) {
-}
+    blink::mojom::InputEventResultState ack_result) {}
 
 void RenderWidgetHostViewBase::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
-}
+    blink::mojom::InputEventResultState ack_result) {}
 
 void RenderWidgetHostViewBase::ChildDidAckGestureEvent(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {}
-
-bool RenderWidgetHostViewBase::OnUnconsumedKeyboardEventAck(
-    const NativeWebKeyboardEventWithLatencyInfo& event) {
-  return false;
-}
-
-void RenderWidgetHostViewBase::FallbackCursorModeLockCursor(bool left,
-                                                            bool right,
-                                                            bool up,
-                                                            bool down) {}
-
-void RenderWidgetHostViewBase::FallbackCursorModeSetCursorVisibility(
-    bool visible) {}
+    blink::mojom::InputEventResultState ack_result) {}
 
 void RenderWidgetHostViewBase::ForwardTouchpadZoomEventIfNecessary(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   if (!event.IsTouchpadZoomEvent())
     return;
   if (!event.NeedsWheelEvent())
     return;
 
   switch (event.GetType()) {
-    case blink::WebInputEvent::kGesturePinchBegin:
+    case blink::WebInputEvent::Type::kGesturePinchBegin:
       // Don't send the begin event until we get the first unconsumed update, so
       // that we elide pinch gesture steams consisting of only a begin and end.
       pending_touchpad_pinch_begin_ = event;
       pending_touchpad_pinch_begin_->SetNeedsWheelEvent(false);
       break;
-    case blink::WebInputEvent::kGesturePinchUpdate:
-      if (ack_result != INPUT_EVENT_ACK_STATE_CONSUMED &&
+    case blink::WebInputEvent::Type::kGesturePinchUpdate:
+      if (ack_result != blink::mojom::InputEventResultState::kConsumed &&
           !event.data.pinch_update.zoom_disabled) {
         if (pending_touchpad_pinch_begin_) {
           host()->ForwardGestureEvent(*pending_touchpad_pinch_begin_);
@@ -415,7 +405,7 @@ void RenderWidgetHostViewBase::ForwardTouchpadZoomEventIfNecessary(
         host()->ForwardGestureEvent(pinch_event);
       }
       break;
-    case blink::WebInputEvent::kGesturePinchEnd:
+    case blink::WebInputEvent::Type::kGesturePinchEnd:
       if (pending_touchpad_pinch_begin_) {
         pending_touchpad_pinch_begin_.reset();
       } else {
@@ -424,8 +414,8 @@ void RenderWidgetHostViewBase::ForwardTouchpadZoomEventIfNecessary(
         host()->ForwardGestureEvent(pinch_end_event);
       }
       break;
-    case blink::WebInputEvent::kGestureDoubleTap:
-      if (ack_result != INPUT_EVENT_ACK_STATE_CONSUMED) {
+    case blink::WebInputEvent::Type::kGestureDoubleTap:
+      if (ack_result != blink::mojom::InputEventResultState::kConsumed) {
         blink::WebGestureEvent double_tap(event);
         double_tap.SetNeedsWheelEvent(false);
         // TODO(mcnee): Support double-tap zoom gesture for OOPIFs. For now,
@@ -488,7 +478,7 @@ bool RenderWidgetHostViewBase::RequestRepaintForTesting() {
 
 void RenderWidgetHostViewBase::ProcessAckedTouchEvent(
     const TouchEventWithLatencyInfo& touch,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   NOTREACHED();
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_base.h b/chromium/content/browser/renderer_host/render_widget_host_view_base.h
index 27133fd9835..39f1c8d6ee4 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_base.h
@@ -27,12 +27,12 @@
 #include "content/common/content_to_visible_time_reporter.h"
 #include "content/public/browser/render_frame_metadata_provider.h"
 #include "content/public/browser/render_widget_host_view.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/common/screen_info.h"
 #include "content/public/common/widget_type.h"
 #include "services/viz/public/mojom/hit_test/hit_test_region_list.mojom.h"
 #include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
-#include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/skia/include/core/SkImageInfo.h"
 #include "ui/accessibility/ax_tree_id_registry.h"
 #include "ui/base/ime/text_input_mode.h"
@@ -142,7 +142,7 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
       const cc::RenderFrameMetadata& metadata) override;
 
   virtual void UpdateIntrinsicSizingInfo(
-      const blink::WebIntrinsicSizingInfo& sizing_info);
+      blink::mojom::IntrinsicSizingInfoPtr sizing_info);
 
   static void CopyMainAndPopupFromSurface(
       base::WeakPtr<RenderWidgetHostImpl> main_host,
@@ -225,28 +225,18 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
   // the view a chance to perform in-process event filtering or processing.
   // Return values of |NOT_CONSUMED| or |UNKNOWN| will result in |input_event|
   // being forwarded.
-  virtual InputEventAckState FilterInputEvent(
+  virtual blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event);
 
   virtual void WheelEventAck(const blink::WebMouseWheelEvent& event,
-                             InputEventAckState ack_result);
+                             blink::mojom::InputEventResultState ack_result);
 
   virtual void GestureEventAck(const blink::WebGestureEvent& event,
-                               InputEventAckState ack_result);
+                               blink::mojom::InputEventResultState ack_result);
 
-  virtual void ChildDidAckGestureEvent(const blink::WebGestureEvent& event,
-                                       InputEventAckState ack_result);
-
-  // When key event is not uncosumed in render, browser may want to consume it.
-  virtual bool OnUnconsumedKeyboardEventAck(
-      const NativeWebKeyboardEventWithLatencyInfo& event);
-
-  // Call platform APIs for Fallback Cursor Mode.
-  virtual void FallbackCursorModeLockCursor(bool left,
-                                            bool right,
-                                            bool up,
-                                            bool down);
-  virtual void FallbackCursorModeSetCursorVisibility(bool visible);
+  virtual void ChildDidAckGestureEvent(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result);
 
   // Create a platform specific SyntheticGestureTarget implementation that will
   // be used to inject synthetic input events.
@@ -285,8 +275,9 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
   // or ignored (when |ack_result| is CONSUMED).
   // |touch|'s coordinates are in the coordinate space of the view to which it
   // was targeted.
-  virtual void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                                      InputEventAckState ack_result);
+  virtual void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result);
 
   virtual void DidOverscroll(const ui::DidOverscrollParams& params) {}
 
@@ -554,15 +545,16 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
 
   // Stops flinging if a GSU event with momentum phase is sent to the renderer
   // but not consumed.
-  virtual void StopFlingingIfNecessary(const blink::WebGestureEvent& event,
-                                       InputEventAckState ack_result);
+  virtual void StopFlingingIfNecessary(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result);
 
   // If |event| is a touchpad pinch or double tap event for which we've sent a
   // synthetic wheel event, forward the |event| to the renderer, subject to
   // |ack_result| which is the ACK result of the synthetic wheel.
   virtual void ForwardTouchpadZoomEventIfNecessary(
       const blink::WebGestureEvent& event,
-      InputEventAckState ack_result);
+      blink::mojom::InputEventResultState ack_result);
 
   virtual bool HasFallbackSurface() const;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_browsertest.cc
index 5c4c17b3bed..7e74c428b32 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_browsertest.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.cc b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.cc
index ff6c12dfb66..379252e8e61 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.cc
@@ -146,9 +146,9 @@ void RenderWidgetHostViewChildFrame::SetFrameConnectorDelegate(
 }
 
 void RenderWidgetHostViewChildFrame::UpdateIntrinsicSizingInfo(
-    const blink::WebIntrinsicSizingInfo& sizing_info) {
+    blink::mojom::IntrinsicSizingInfoPtr sizing_info) {
   if (frame_connector_)
-    frame_connector_->SendIntrinsicSizingInfoToParent(sizing_info);
+    frame_connector_->SendIntrinsicSizingInfoToParent(std::move(sizing_info));
 }
 
 std::unique_ptr<SyntheticGestureTarget>
@@ -426,30 +426,30 @@ void RenderWidgetHostViewChildFrame::UpdateViewportIntersection(
 
 void RenderWidgetHostViewChildFrame::SetIsInert() {
   if (host() && frame_connector_) {
-    host()->Send(new WidgetMsg_SetIsInert(host()->GetRoutingID(),
-                                          frame_connector_->IsInert()));
+    host_->GetAssociatedFrameWidget()->SetIsInertForSubFrame(
+        frame_connector_->IsInert());
   }
 }
 
 void RenderWidgetHostViewChildFrame::UpdateInheritedEffectiveTouchAction() {
   if (host_ && frame_connector_) {
-    host_->Send(new WidgetMsg_SetInheritedEffectiveTouchAction(
-        host_->GetRoutingID(),
-        frame_connector_->InheritedEffectiveTouchAction()));
+    host_->GetAssociatedFrameWidget()
+        ->SetInheritedEffectiveTouchActionForSubFrame(
+            frame_connector_->InheritedEffectiveTouchAction());
   }
 }
 
 void RenderWidgetHostViewChildFrame::UpdateRenderThrottlingStatus() {
   if (host() && frame_connector_) {
-    host()->Send(new WidgetMsg_UpdateRenderThrottlingStatus(
-        host()->GetRoutingID(), frame_connector_->IsThrottled(),
-        frame_connector_->IsSubtreeThrottled()));
+    host_->GetAssociatedFrameWidget()->UpdateRenderThrottlingStatusForSubFrame(
+        frame_connector_->IsThrottled(),
+        frame_connector_->IsSubtreeThrottled());
   }
 }
 
 void RenderWidgetHostViewChildFrame::StopFlingingIfNecessary(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // In case of scroll bubbling the target view is in charge of stopping the
   // fling if needed.
   if (is_scroll_sequence_bubbling_)
@@ -460,7 +460,7 @@ void RenderWidgetHostViewChildFrame::StopFlingingIfNecessary(
 
 void RenderWidgetHostViewChildFrame::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // Stop flinging if a GSU event with momentum phase is sent to the renderer
   // but not consumed.
   StopFlingingIfNecessary(event, ack_result);
@@ -475,20 +475,21 @@ void RenderWidgetHostViewChildFrame::GestureEventAck(
   // its ack is not consumed. For the rest of the scroll events
   // (GestureScrollUpdate, GestureScrollEnd) are bubbled if the
   // GestureScrollBegin was bubbled.
-  if (event.GetType() == blink::WebInputEvent::kGestureScrollBegin) {
+  if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin) {
     DCHECK(!is_scroll_sequence_bubbling_);
     is_scroll_sequence_bubbling_ =
-        ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
-        ack_result == INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS ||
-        ack_result == INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
+        ack_result == blink::mojom::InputEventResultState::kNotConsumed ||
+        ack_result == blink::mojom::InputEventResultState::kNoConsumerExists ||
+        ack_result ==
+            blink::mojom::InputEventResultState::kConsumedShouldBubble;
   }
 
   if (is_scroll_sequence_bubbling_ &&
-      (event.GetType() == blink::WebInputEvent::kGestureScrollBegin ||
-       event.GetType() == blink::WebInputEvent::kGestureScrollUpdate ||
-       event.GetType() == blink::WebInputEvent::kGestureScrollEnd)) {
+      (event.GetType() == blink::WebInputEvent::Type::kGestureScrollBegin ||
+       event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate ||
+       event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd)) {
     const bool can_continue = frame_connector_->BubbleScrollEvent(event);
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd ||
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollEnd ||
         !can_continue) {
       is_scroll_sequence_bubbling_ = false;
     }
@@ -499,7 +500,7 @@ void RenderWidgetHostViewChildFrame::GestureEventAck(
 
 void RenderWidgetHostViewChildFrame::ProcessTouchpadZoomEventAckInRoot(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   DCHECK(event.IsTouchpadZoomEvent());
 
   frame_connector_->ForwardAckedTouchpadZoomEvent(event, ack_result);
@@ -507,7 +508,7 @@ void RenderWidgetHostViewChildFrame::ProcessTouchpadZoomEventAckInRoot(
 
 void RenderWidgetHostViewChildFrame::ForwardTouchpadZoomEventIfNecessary(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   // ACKs of synthetic wheel events for touchpad pinch or double tap are
   // processed in the root RWHV.
   NOTREACHED();
@@ -637,7 +638,7 @@ bool RenderWidgetHostViewChildFrame::ScreenRectIsUnstableFor(
 
 void RenderWidgetHostViewChildFrame::PreProcessTouchEvent(
     const blink::WebTouchEvent& event) {
-  if (event.GetType() == blink::WebInputEvent::kTouchStart &&
+  if (event.GetType() == blink::WebInputEvent::Type::kTouchStart &&
       frame_connector_ && !frame_connector_->HasFocus()) {
     frame_connector_->FocusRootView();
   }
@@ -823,7 +824,8 @@ void RenderWidgetHostViewChildFrame::TakeFallbackContentFrom(
   // This method only makes sense for top-level views.
 }
 
-InputEventAckState RenderWidgetHostViewChildFrame::FilterInputEvent(
+blink::mojom::InputEventResultState
+RenderWidgetHostViewChildFrame::FilterInputEvent(
     const blink::WebInputEvent& input_event) {
   // A child renderer should never receive a GesturePinch event. Pinch events
   // can still be targeted to a child, but they must be processed without
@@ -836,12 +838,12 @@ InputEventAckState RenderWidgetHostViewChildFrame::FilterInputEvent(
     // child's TouchActionFilter filter them, but we may encounter
     // https://crbug.com/771330 which would let the pinch events through.
     if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchscreen) {
-      return INPUT_EVENT_ACK_STATE_CONSUMED;
+      return blink::mojom::InputEventResultState::kConsumed;
     }
     NOTREACHED();
   }
 
-  if (input_event.GetType() == blink::WebInputEvent::kGestureFlingStart) {
+  if (input_event.GetType() == blink::WebInputEvent::Type::kGestureFlingStart) {
     const blink::WebGestureEvent& gesture_event =
         static_cast<const blink::WebGestureEvent&>(input_event);
     // Zero-velocity touchpad flings are an Aura-specific signal that the
@@ -857,12 +859,13 @@ InputEventAckState RenderWidgetHostViewChildFrame::FilterInputEvent(
       // a fling animation.
       // Note: this event handling is modeled on similar code in
       // TenderWidgetHostViewAura::FilterInputEvent().
-      return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+      return blink::mojom::InputEventResultState::kNoConsumerExists;
     }
   }
 
   if (is_scroll_sequence_bubbling_ &&
-      (input_event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) &&
+      (input_event.GetType() ==
+       blink::WebInputEvent::Type::kGestureScrollUpdate) &&
       frame_connector_) {
     // If we're bubbling, then to preserve latching behaviour, the child should
     // not consume this event. If the child has added its viewport to the scroll
@@ -872,10 +875,10 @@ InputEventAckState RenderWidgetHostViewChildFrame::FilterInputEvent(
     // If the child has not added its viewport to the scroll chain, then we
     // know that it will not attempt to consume the rest of the scroll
     // sequence.
-    return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
+    return blink::mojom::InputEventResultState::kNoConsumerExists;
   }
 
-  return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+  return blink::mojom::InputEventResultState::kNotConsumed;
 }
 
 BrowserAccessibilityManager*
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.h b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.h
index 5c77bc7aaa1..0f4dbe967da 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame.h
@@ -26,10 +26,10 @@
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/touch_selection_controller_client_manager.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
+#include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-forward.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
-#include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/native_widget_types.h"
 
@@ -99,7 +99,7 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   void Destroy() override;
   void SetTooltipText(const base::string16& tooltip_text) override;
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultState ack_result) override;
   // Since the URL of content rendered by this class is not displayed in
   // the URL bar, this method does not need an implementation.
   void ResetFallbackToFirstNavigationSurface() override {}
@@ -134,7 +134,7 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   GetTouchSelectionControllerClientManager() override;
   void OnRenderFrameMetadataChangedAfterActivation() override;
   void UpdateIntrinsicSizingInfo(
-      const blink::WebIntrinsicSizingInfo& sizing_info) override;
+      blink::mojom::IntrinsicSizingInfoPtr sizing_info) override;
   std::unique_ptr<SyntheticGestureTarget> CreateSyntheticGestureTarget()
       override;
 
@@ -149,7 +149,7 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   void SpeakSelection() override;
 #endif  // defined(OS_MACOSX)
 
-  InputEventAckState FilterInputEvent(
+  blink::mojom::InputEventResultState FilterInputEvent(
       const blink::WebInputEvent& input_event) override;
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate,
@@ -211,8 +211,9 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   // RenderWidgetHostViewBase:
   void UpdateBackgroundColor() override;
 
-  void StopFlingingIfNecessary(const blink::WebGestureEvent& event,
-                               InputEventAckState ack_result) override;
+  void StopFlingingIfNecessary(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result) override;
 
   // The ID for FrameSink associated with this view.
   viz::FrameSinkId frame_sink_id_;
@@ -250,11 +251,12 @@ class CONTENT_EXPORT RenderWidgetHostViewChildFrame
   void OnDidUpdateVisualPropertiesComplete(
       const cc::RenderFrameMetadata& metadata);
 
-  void ProcessTouchpadZoomEventAckInRoot(const blink::WebGestureEvent& event,
-                                         InputEventAckState ack_result);
+  void ProcessTouchpadZoomEventAckInRoot(
+      const blink::WebGestureEvent& event,
+      blink::mojom::InputEventResultState ack_result);
   void ForwardTouchpadZoomEventIfNecessary(
       const blink::WebGestureEvent& event,
-      InputEventAckState ack_result) override;
+      blink::mojom::InputEventResultState ack_result) override;
 
   std::vector<base::OnceClosure> frame_swapped_callbacks_;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
index 8ba01707333..e27673fe912 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/common/widget_messages.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -291,7 +292,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewChildFrameBrowserTest,
     EXPECT_EQ(initial_size, child_visible_viewport_size);
   }
 
-  // Same check as abvoe but for a nested WebContents.
+  // Same check as above but for a nested WebContents.
   {
     base::RunLoop loop;
 
@@ -496,4 +497,101 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewChildFrameBrowserTest,
                .size() != 1);
 }
 
+// Auto-resize is only implemented for Ash and GuestViews. So we need to inject
+// an implementation that actually resizes the top level widget.
+class DisplayModeControllingWebContentsDelegate : public WebContentsDelegate {
+ public:
+  blink::mojom::DisplayMode GetDisplayMode(
+      const WebContents* web_contents) override {
+    return mode_;
+  }
+
+  void set_display_mode(blink::mojom::DisplayMode mode) { mode_ = mode; }
+
+ private:
+  // The is the default value throughout the browser and renderer.
+  blink::mojom::DisplayMode mode_ = blink::mojom::DisplayMode::kBrowser;
+};
+
+// TODO(crbug.com/1060336): Unlike most VisualProperties, the DisplayMode does
+// not propagate down the tree of RenderWidgets, but is sent independently to
+// each RenderWidget.
+IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewChildFrameBrowserTest,
+                       VisualPropertiesPropagation_DisplayMode) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(a,b)"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  DisplayModeControllingWebContentsDelegate display_mode_delegate;
+  shell()->web_contents()->SetDelegate(&display_mode_delegate);
+
+  // Main frame.
+  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+  RenderWidgetHostImpl* root_widget =
+      root->current_frame_host()->GetRenderWidgetHost();
+  // In-process frame.
+  FrameTreeNode* ipchild = root->child_at(0);
+  RenderWidgetHostImpl* ipchild_widget =
+      ipchild->current_frame_host()->GetRenderWidgetHost();
+  // Out-of-process frame.
+  FrameTreeNode* oopchild = root->child_at(1);
+  RenderWidgetHostImpl* oopchild_widget =
+      oopchild->current_frame_host()->GetRenderWidgetHost();
+
+  // Check all frames for the initial value.
+  EXPECT_EQ(
+      true,
+      EvalJs(root, "window.matchMedia('(display-mode: browser)').matches"));
+  EXPECT_EQ(
+      true,
+      EvalJs(ipchild, "window.matchMedia('(display-mode: browser)').matches"));
+  EXPECT_EQ(
+      true,
+      EvalJs(oopchild, "window.matchMedia('(display-mode: browser)').matches"));
+
+  // The display mode changes.
+  display_mode_delegate.set_display_mode(
+      blink::mojom::DisplayMode::kStandalone);
+  // Each RenderWidgetHost would need to hear about that by having
+  // SynchronizeVisualProperties() called. It's not clear what triggers that but
+  // the place that changes the DisplayMode would be responsible.
+  root_widget->SynchronizeVisualProperties();
+  ipchild_widget->SynchronizeVisualProperties();
+  oopchild_widget->SynchronizeVisualProperties();
+
+  // Check all frames for the changed value.
+  EXPECT_EQ(
+      true,
+      EvalJsAfterLifecycleUpdate(
+          root, "", "window.matchMedia('(display-mode: standalone)').matches"));
+  EXPECT_EQ(true,
+            EvalJsAfterLifecycleUpdate(
+                ipchild, "",
+                "window.matchMedia('(display-mode: standalone)').matches"));
+  EXPECT_EQ(true,
+            EvalJsAfterLifecycleUpdate(
+                oopchild, "",
+                "window.matchMedia('(display-mode: standalone)').matches"));
+
+  // Navigate a frame to b.com, which we already have a process for.
+  GURL same_site_url(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  NavigateFrameToURL(root->child_at(0), same_site_url);
+
+  // The navigated frame sees the correct (non-default) value.
+  EXPECT_EQ(true,
+            EvalJs(root->child_at(0),
+                   "window.matchMedia('(display-mode: standalone)').matches"));
+
+  // Navigate the frame to c.com, which we don't have a process for.
+  GURL cross_site_url(embedded_test_server()->GetURL("c.com", "/title2.html"));
+  NavigateFrameToURL(root->child_at(0), cross_site_url);
+
+  // The navigated frame sees the correct (non-default) value.
+  EXPECT_EQ(true,
+            EvalJs(root->child_at(0),
+                   "window.matchMedia('(display-mode: standalone)').matches"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
index 628937d1cd5..276ad19cbbc 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
@@ -85,7 +85,7 @@ class MockFrameConnectorDelegate : public FrameConnectorDelegate {
 
   blink::WebInputEvent::Type GetAndResetLastBubbledEventType() {
     blink::WebInputEvent::Type last = last_bubbled_event_type_;
-    last_bubbled_event_type_ = blink::WebInputEvent::kUndefined;
+    last_bubbled_event_type_ = blink::WebInputEvent::Type::kUndefined;
     return last;
   }
 
@@ -95,7 +95,7 @@ class MockFrameConnectorDelegate : public FrameConnectorDelegate {
 
  private:
   blink::WebInputEvent::Type last_bubbled_event_type_ =
-      blink::WebInputEvent::kUndefined;
+      blink::WebInputEvent::Type::kUndefined;
   bool can_bubble_ = true;
 };
 
@@ -128,6 +128,16 @@ class RenderWidgetHostViewChildFrameTest : public testing::Test {
     widget_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host, routing_id, std::move(widget),
         /*hidden=*/false, std::make_unique<FrameTokenMessageQueue>());
+
+    mojo::AssociatedRemote<blink::mojom::FrameWidgetHost> frame_widget_host;
+    auto frame_widget_host_receiver =
+        frame_widget_host.BindNewEndpointAndPassDedicatedReceiverForTesting();
+    mojo::AssociatedRemote<blink::mojom::FrameWidget> frame_widget;
+    auto frame_widget_receiver =
+        frame_widget.BindNewEndpointAndPassDedicatedReceiverForTesting();
+    widget_host_->BindFrameWidgetInterfaces(
+        std::move(frame_widget_host_receiver), frame_widget.Unbind());
+
     view_ = RenderWidgetHostViewChildFrame::Create(widget_host_);
 
     test_frame_connector_ =
@@ -314,19 +324,20 @@ TEST_F(RenderWidgetHostViewChildFrameTest, UncomsumedGestureScrollBubbled) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(
           0.f, 10.f, 0, blink::WebGestureDevice::kTouchscreen);
   blink::WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      blink::WebInputEvent::kGestureScrollEnd,
+      blink::WebInputEvent::Type::kGestureScrollEnd,
       blink::WebGestureDevice::kTouchscreen);
 
-  view_->GestureEventAck(scroll_begin,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  view_->GestureEventAck(
+      scroll_begin, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_update,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate,
+  view_->GestureEventAck(
+      scroll_update, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_end, INPUT_EVENT_ACK_STATE_IGNORED);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  view_->GestureEventAck(scroll_end,
+                         blink::mojom::InputEventResultState::kIgnored);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 }
 
@@ -340,25 +351,28 @@ TEST_F(RenderWidgetHostViewChildFrameTest, ConsumedGestureScrollNotBubbled) {
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(
           0.f, 10.f, 0, blink::WebGestureDevice::kTouchscreen);
   blink::WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      blink::WebInputEvent::kGestureScrollEnd,
+      blink::WebInputEvent::Type::kGestureScrollEnd,
       blink::WebGestureDevice::kTouchscreen);
 
-  view_->GestureEventAck(scroll_begin, INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(scroll_begin,
+                         blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_update, INPUT_EVENT_ACK_STATE_CONSUMED);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(scroll_update,
+                         blink::mojom::InputEventResultState::kConsumed);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 
   // Scrolling in a child my reach its extent and no longer be consumed, however
   // scrolling is latched to the child so we do not bubble the update.
-  view_->GestureEventAck(scroll_update,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(
+      scroll_update, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 
-  view_->GestureEventAck(scroll_end, INPUT_EVENT_ACK_STATE_IGNORED);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(scroll_end,
+                         blink::mojom::InputEventResultState::kIgnored);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 }
 
@@ -373,39 +387,41 @@ TEST_F(RenderWidgetHostViewChildFrameTest,
       SyntheticWebGestureEventBuilder::BuildScrollUpdate(
           0.f, 10.f, 0, blink::WebGestureDevice::kTouchscreen);
   blink::WebGestureEvent scroll_end = SyntheticWebGestureEventBuilder::Build(
-      blink::WebInputEvent::kGestureScrollEnd,
+      blink::WebInputEvent::Type::kGestureScrollEnd,
       blink::WebGestureDevice::kTouchscreen);
 
   test_frame_connector_->SetCanBubble(false);
 
-  view_->GestureEventAck(scroll_begin,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  view_->GestureEventAck(
+      scroll_begin, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 
   // The GSB was rejected, so the child view must not attempt to bubble the
   // remaining events of the scroll sequence.
-  view_->GestureEventAck(scroll_update,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(
+      scroll_update, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_end, INPUT_EVENT_ACK_STATE_IGNORED);
-  EXPECT_EQ(blink::WebInputEvent::kUndefined,
+  view_->GestureEventAck(scroll_end,
+                         blink::mojom::InputEventResultState::kIgnored);
+  EXPECT_EQ(blink::WebInputEvent::Type::kUndefined,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 
   test_frame_connector_->SetCanBubble(true);
 
   // When we have a new scroll gesture, the view may try bubbling again.
-  view_->GestureEventAck(scroll_begin,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  view_->GestureEventAck(
+      scroll_begin, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_update,
-                         INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollUpdate,
+  view_->GestureEventAck(
+      scroll_update, blink::mojom::InputEventResultState::kNoConsumerExists);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollUpdate,
             test_frame_connector_->GetAndResetLastBubbledEventType());
-  view_->GestureEventAck(scroll_end, INPUT_EVENT_ACK_STATE_IGNORED);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  view_->GestureEventAck(scroll_end,
+                         blink::mojom::InputEventResultState::kIgnored);
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             test_frame_connector_->GetAndResetLastBubbledEventType());
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.cc b/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.cc
index 4b2067bc7f2..a21600fc77a 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.cc
@@ -84,11 +84,11 @@ bool ShouldGenerateAppCommand(const ui::MouseEvent* event) {
 // touchcancel.
 void MarkUnchangedTouchPointsAsStationary(blink::WebTouchEvent* event,
                                           int changed_touch_id) {
-  if (event->GetType() == blink::WebInputEvent::kTouchMove ||
-      event->GetType() == blink::WebInputEvent::kTouchCancel) {
+  if (event->GetType() == blink::WebInputEvent::Type::kTouchMove ||
+      event->GetType() == blink::WebInputEvent::Type::kTouchCancel) {
     for (size_t i = 0; i < event->touches_length; ++i) {
       if (event->touches[i].id != changed_touch_id)
-        event->touches[i].state = blink::WebTouchPoint::kStateStationary;
+        event->touches[i].state = blink::WebTouchPoint::State::kStateStationary;
     }
   }
 }
@@ -579,7 +579,7 @@ void RenderWidgetHostViewEventHandler::OnGestureEvent(ui::GestureEvent* event) {
     // Webkit does not stop a fling-scroll on tap-down. So explicitly send an
     // event to stop any in-progress flings.
     blink::WebGestureEvent fling_cancel = gesture;
-    fling_cancel.SetType(blink::WebInputEvent::kGestureFlingCancel);
+    fling_cancel.SetType(blink::WebInputEvent::Type::kGestureFlingCancel);
     fling_cancel.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
     if (ShouldRouteEvents()) {
       host_->delegate()->GetInputEventRouter()->RouteGestureEvent(
@@ -590,7 +590,7 @@ void RenderWidgetHostViewEventHandler::OnGestureEvent(ui::GestureEvent* event) {
     }
   }
 
-  if (gesture.GetType() != blink::WebInputEvent::kUndefined) {
+  if (gesture.GetType() != blink::WebInputEvent::Type::kUndefined) {
     if (event->type() == ui::ET_GESTURE_SCROLL_BEGIN) {
       // If there is a current scroll going on and a new scroll that isn't
       // wheel based send a synthetic wheel event with kPhaseEnded to cancel
@@ -627,7 +627,7 @@ void RenderWidgetHostViewEventHandler::OnGestureEvent(ui::GestureEvent* event) {
 
 void RenderWidgetHostViewEventHandler::GestureEventAck(
     const blink::WebGestureEvent& event,
-    InputEventAckState ack_result) {
+    blink::mojom::InputEventResultState ack_result) {
   mouse_wheel_phase_handler_.GestureEventAck(event, ack_result);
 }
 
@@ -896,7 +896,7 @@ void RenderWidgetHostViewEventHandler::MoveCursorToCenter(
 
 bool RenderWidgetHostViewEventHandler::MatchesSynthesizedMovePosition(
     const blink::WebMouseEvent& event) {
-  if (event.GetType() == blink::WebInputEvent::kMouseMove &&
+  if (event.GetType() == blink::WebInputEvent::Type::kMouseMove &&
       synthetic_move_position_.has_value()) {
     if (IsFractionalScaleFactor(host_view_->current_device_scale_factor())) {
       // For fractional scale factors, the conversion from pixels to dip and
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.h b/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.h
index 9b5fcd225c2..6c306f4a8de 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_event_handler.h
@@ -163,7 +163,7 @@ class CONTENT_EXPORT RenderWidgetHostViewEventHandler
   void OnGestureEvent(ui::GestureEvent* event) override;
 
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result);
+                       blink::mojom::InputEventResultState ack_result);
 
   // Used to set the mouse_wheel_phase_handler_ timer timeout for testing.
   void set_mouse_wheel_wheel_phase_handler_timeout(base::TimeDelta timeout) {
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac.h b/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
index 0d8a8e14328..336ac58d9f5 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
@@ -165,9 +165,10 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
   bool IsKeyboardLocked() override;
   base::flat_map<std::string, std::string> GetKeyboardLayoutMap() override;
   void GestureEventAck(const blink::WebGestureEvent& event,
-                       InputEventAckState ack_result) override;
-  void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
-                              InputEventAckState ack_result) override;
+                       blink::mojom::InputEventResultState ack_result) override;
+  void ProcessAckedTouchEvent(
+      const TouchEventWithLatencyInfo& touch,
+      blink::mojom::InputEventResultState ack_result) override;
 
   void DidOverscroll(const ui::DidOverscrollParams& params) override;
 
@@ -304,7 +305,7 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
   void ForwardKeyboardEventWithCommands(
       const NativeWebKeyboardEvent& key_event,
       const ui::LatencyInfo& latency_info,
-      const std::vector<EditCommand>& commands) override;
+      std::vector<blink::mojom::EditCommandPtr> commands) override;
   void RouteOrProcessMouseEvent(const blink::WebMouseEvent& web_event) override;
   void RouteOrProcessTouchEvent(const blink::WebTouchEvent& web_event) override;
   void RouteOrProcessWheelEvent(
@@ -335,7 +336,7 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
       std::unique_ptr<InputEvent> event,
       const std::vector<uint8_t>& native_event_data,
       bool skip_in_browser,
-      const std::vector<EditCommand>& commands) override;
+      std::vector<blink::mojom::EditCommandPtr> commands) override;
   void RouteOrProcessMouseEvent(std::unique_ptr<InputEvent> event) override;
   void RouteOrProcessTouchEvent(std::unique_ptr<InputEvent> event) override;
   void RouteOrProcessWheelEvent(std::unique_ptr<InputEvent> event) override;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
index 6c8313f7e09..aaa5daecf14 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -20,6 +20,7 @@
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
+#include "components/remote_cocoa/browser/ns_view_ids.h"
 #include "components/remote_cocoa/common/application.mojom.h"
 #include "components/viz/common/features.h"
 #include "components/viz/common/switches.h"
@@ -268,7 +269,11 @@ void RenderWidgetHostViewMac::MigrateNSViewBridge(
       std::move(stub_client), std::move(stub_bridge_receiver));
 
   ns_view_ = remote_ns_view_.get();
-  remote_ns_view_->SetParentWebContentsNSView(parent_ns_view_id);
+
+  // Popup windows will specify an invalid |parent_ns_view_id|, because popups
+  // have their own NSWindows (of which they are the content NSView).
+  if (parent_ns_view_id != remote_cocoa::kInvalidNSViewId)
+    remote_ns_view_->SetParentWebContentsNSView(parent_ns_view_id);
 }
 
 void RenderWidgetHostViewMac::SetParentUiLayer(ui::Layer* parent_ui_layer) {
@@ -1143,19 +1148,20 @@ RenderWidgetHostViewMac::GetKeyboardLayoutMap() {
   return ui::GenerateDomKeyboardLayoutMap();
 }
 
-void RenderWidgetHostViewMac::GestureEventAck(const WebGestureEvent& event,
-                                              InputEventAckState ack_result) {
+void RenderWidgetHostViewMac::GestureEventAck(
+    const WebGestureEvent& event,
+    blink::mojom::InputEventResultState ack_result) {
   ForwardTouchpadZoomEventIfNecessary(event, ack_result);
 
   // Stop flinging if a GSU event with momentum phase is sent to the renderer
   // but not consumed.
   StopFlingingIfNecessary(event, ack_result);
 
-  bool consumed = ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
+  bool consumed = ack_result == blink::mojom::InputEventResultState::kConsumed;
   switch (event.GetType()) {
-    case WebInputEvent::kGestureScrollBegin:
-    case WebInputEvent::kGestureScrollUpdate:
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureScrollEnd:
       [GetInProcessNSView() processedGestureScrollEvent:event
                                                consumed:consumed];
       return;
@@ -1167,11 +1173,12 @@ void RenderWidgetHostViewMac::GestureEventAck(const WebGestureEvent& event,
 
 void RenderWidgetHostViewMac::ProcessAckedTouchEvent(
     const TouchEventWithLatencyInfo& touch,
-    InputEventAckState ack_result) {
-  const bool event_consumed = ack_result == INPUT_EVENT_ACK_STATE_CONSUMED;
+    blink::mojom::InputEventResultState ack_result) {
+  const bool event_consumed =
+      ack_result == blink::mojom::InputEventResultState::kConsumed;
   gesture_provider_.OnTouchEventAck(
       touch.event.unique_touch_event_id, event_consumed,
-      InputEventAckStateIsSetNonBlocking(ack_result));
+      InputEventResultStateIsSetNonBlocking(ack_result));
   if (touch.event.touch_start_or_first_touch_move && event_consumed &&
       host()->delegate() && host()->delegate()->GetInputEventRouter()) {
     host()
@@ -1498,10 +1505,10 @@ void RenderWidgetHostViewMac::ForwardKeyboardEvent(
 void RenderWidgetHostViewMac::ForwardKeyboardEventWithCommands(
     const NativeWebKeyboardEvent& key_event,
     const ui::LatencyInfo& latency_info,
-    const std::vector<EditCommand>& commands) {
+    std::vector<blink::mojom::EditCommandPtr> commands) {
   if (auto* widget_host = GetWidgetForKeyboardEvent()) {
     widget_host->ForwardKeyboardEventWithCommands(key_event, latency_info,
-                                                  &commands);
+                                                  std::move(commands));
   }
 }
 
@@ -1562,7 +1569,7 @@ void RenderWidgetHostViewMac::ForwardMouseEvent(
   if (host())
     host()->ForwardMouseEvent(web_event);
 
-  if (web_event.GetType() == WebInputEvent::kMouseLeave)
+  if (web_event.GetType() == WebInputEvent::Type::kMouseLeave)
     ns_view_->SetTooltipText(base::string16());
 }
 
@@ -1608,7 +1615,7 @@ void RenderWidgetHostViewMac::GestureUpdate(
     // finish scrolling.
     mouse_wheel_phase_handler_.DispatchPendingWheelEndEvent();
     WebGestureEvent begin_event(*gesture_begin_event_);
-    begin_event.SetType(WebInputEvent::kGesturePinchBegin);
+    begin_event.SetType(WebInputEvent::Type::kGesturePinchBegin);
     begin_event.SetSourceDevice(blink::WebGestureDevice::kTouchpad);
     begin_event.SetNeedsWheelEvent(true);
     SendTouchpadZoomEvent(&begin_event);
@@ -1789,15 +1796,15 @@ void RenderWidgetHostViewMac::ExecuteEditCommand(const std::string& command) {
 }
 
 void RenderWidgetHostViewMac::Undo() {
-  WebContents* web_contents = GetWebContents();
-  if (web_contents)
-    web_contents->Undo();
+  if (auto* delegate = GetFocusedRenderWidgetHostDelegate()) {
+    delegate->Undo();
+  }
 }
 
 void RenderWidgetHostViewMac::Redo() {
-  WebContents* web_contents = GetWebContents();
-  if (web_contents)
-    web_contents->Redo();
+  if (auto* delegate = GetFocusedRenderWidgetHostDelegate()) {
+    delegate->Redo();
+  }
 }
 
 void RenderWidgetHostViewMac::Cut() {
@@ -1825,9 +1832,9 @@ void RenderWidgetHostViewMac::Paste() {
 }
 
 void RenderWidgetHostViewMac::PasteAndMatchStyle() {
-  WebContents* web_contents = GetWebContents();
-  if (web_contents)
-    web_contents->PasteAndMatchStyle();
+  if (auto* delegate = GetFocusedRenderWidgetHostDelegate()) {
+    delegate->PasteAndMatchStyle();
+  }
 }
 
 void RenderWidgetHostViewMac::SelectAll() {
@@ -1886,7 +1893,7 @@ void RenderWidgetHostViewMac::ForwardKeyboardEventWithCommands(
     std::unique_ptr<InputEvent> input_event,
     const std::vector<uint8_t>& native_event_data,
     bool skip_in_browser,
-    const std::vector<EditCommand>& commands) {
+    std::vector<blink::mojom::EditCommandPtr> edit_commands) {
   if (!input_event || !input_event->web_event ||
       !blink::WebInputEvent::IsKeyboardEventType(
           input_event->web_event->GetType())) {
@@ -1904,7 +1911,7 @@ void RenderWidgetHostViewMac::ForwardKeyboardEventWithCommands(
   [native_event.os_event release];
   native_event.os_event = [ui::EventFromData(native_event_data) retain];
   ForwardKeyboardEventWithCommands(native_event, input_event->latency_info,
-                                   commands);
+                                   std::move(edit_commands));
 }
 
 void RenderWidgetHostViewMac::RouteOrProcessMouseEvent(
@@ -1936,7 +1943,8 @@ void RenderWidgetHostViewMac::RouteOrProcessTouchEvent(
 void RenderWidgetHostViewMac::RouteOrProcessWheelEvent(
     std::unique_ptr<InputEvent> input_event) {
   if (!input_event || !input_event->web_event ||
-      input_event->web_event->GetType() != blink::WebInputEvent::kMouseWheel) {
+      input_event->web_event->GetType() !=
+          blink::WebInputEvent::Type::kMouseWheel) {
     DLOG(ERROR) << "Absent or non-MouseWheel event.";
     return;
   }
@@ -1961,7 +1969,8 @@ void RenderWidgetHostViewMac::ForwardMouseEvent(
 void RenderWidgetHostViewMac::ForwardWheelEvent(
     std::unique_ptr<InputEvent> input_event) {
   if (!input_event || !input_event->web_event ||
-      input_event->web_event->GetType() != blink::WebInputEvent::kMouseWheel) {
+      input_event->web_event->GetType() !=
+          blink::WebInputEvent::Type::kMouseWheel) {
     DLOG(ERROR) << "Absent or non-MouseWheel event.";
     return;
   }
@@ -1982,7 +1991,7 @@ void RenderWidgetHostViewMac::GestureBegin(
   blink::WebGestureEvent gesture_event =
       *static_cast<const blink::WebGestureEvent*>(input_event->web_event.get());
   // Strip the gesture type, because it is not known.
-  gesture_event.SetType(blink::WebInputEvent::kUndefined);
+  gesture_event.SetType(blink::WebInputEvent::Type::kUndefined);
   GestureBegin(gesture_event, is_synthetically_injected);
 }
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac_browsertest.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac_browsertest.mm
index 0c22ba9edb3..853b9469403 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac_browsertest.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac_browsertest.mm
@@ -10,8 +10,10 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #import "content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h"
+#include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -116,6 +118,12 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewMacTest,
   GURL url("data:text/html,Hello");
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
+  auto* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  auto* root = web_contents_impl->GetFrameTree()->root();
+  web_contents_impl->GetFrameTree()->SetFocusedFrame(
+      root, root->current_frame_host()->GetSiteInstance());
+
   RenderWidgetHostView* rwhv =
       shell()->web_contents()->GetMainFrame()->GetView();
   RenderWidgetHostViewMac* rwhv_mac =
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
index 760e47e9edd..2b0f1135e58 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
@@ -91,9 +91,12 @@ class RenderWidgetHostDelegateEditCommandCounter
       const base::Optional<base::string16>& value) override {
     edit_command_message_count_++;
   }
+  void Undo() override {}
+  void Redo() override {}
   void Cut() override {}
   void Copy() override {}
   void Paste() override {}
+  void PasteAndMatchStyle() override {}
   void SelectAll() override {}
 };
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
index 4e31d0a8805..6286ed4d9e3 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
@@ -119,7 +119,7 @@ using testing::_;
 - (void)rendererHandledGestureScrollEvent:(const blink::WebGestureEvent&)event
                                  consumed:(BOOL)consumed {
   if (!consumed &&
-      event.GetType() == blink::WebInputEvent::kGestureScrollUpdate)
+      event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate)
     _unhandledWheelEventReceived = true;
 }
 
@@ -371,7 +371,7 @@ class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
                              /*hidden=*/false,
                              std::make_unique<FrameTokenMessageQueue>()),
         widget_impl_(std::move(widget_impl)) {
-    set_renderer_initialized(true);
+    SetRendererInitialized(true, RendererInitializer::kTest);
     lastWheelEventLatencyInfo = ui::LatencyInfo();
 
     ON_CALL(*this, Focus())
@@ -977,7 +977,8 @@ TEST_F(RenderWidgetHostViewMacTest, ScrollWheelEndEventDelivery) {
       host_->GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
   // Send an ACK for the first wheel event, so that the queue will be flushed.
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   // Post the NSEventPhaseEnded wheel event to NSApp and check whether the
   // render view receives it.
@@ -1182,7 +1183,8 @@ TEST_F(RenderWidgetHostViewMacTest,
 
   // GestureEventQueue allows multiple in-flight events.
   ASSERT_EQ("GestureScrollBegin GestureScrollUpdate", GetMessageNames(events));
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   events.clear();
 
@@ -1527,7 +1529,7 @@ TEST_P(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
     // After acking the synthetic mouse wheel, no GesturePinch events are
     // produced.
     events[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     events = host_->GetAndResetDispatchedMessages();
     EXPECT_EQ(0U, events.size());
 
@@ -1544,7 +1546,7 @@ TEST_P(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
       EXPECT_EQ("MouseWheel", GetMessageNames(events));
       // Now acking the synthetic mouse wheel does produce GesturePinch events.
       events[0]->ToEvent()->CallCallback(
-          INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+          blink::mojom::InputEventResultState::kNoConsumerExists);
       events = host_->GetAndResetDispatchedMessages();
       EXPECT_EQ("GesturePinchBegin GesturePinchUpdate",
                 GetMessageNames(events));
@@ -1559,7 +1561,7 @@ TEST_P(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
     } else {
       EXPECT_EQ("MouseWheel", GetMessageNames(events));
       events[0]->ToEvent()->CallCallback(
-          INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+          blink::mojom::InputEventResultState::kNoConsumerExists);
       events = host_->GetAndResetDispatchedMessages();
       EXPECT_EQ("GesturePinchUpdate", GetMessageNames(events));
     }
@@ -1589,7 +1591,7 @@ TEST_P(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
     events = host_->GetAndResetDispatchedMessages();
     EXPECT_EQ("MouseWheel", GetMessageNames(events));
     events[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     events = host_->GetAndResetDispatchedMessages();
     EXPECT_EQ("GesturePinchBegin GesturePinchUpdate", GetMessageNames(events));
 
@@ -1623,7 +1625,7 @@ TEST_P(RenderWidgetHostViewMacPinchTest, PinchThresholding) {
     EXPECT_EQ("MouseWheel", GetMessageNames(events));
 
     events[0]->ToEvent()->CallCallback(
-        INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+        blink::mojom::InputEventResultState::kNoConsumerExists);
     events = host_->GetAndResetDispatchedMessages();
     EXPECT_EQ(0U, events.size());
 
@@ -1648,7 +1650,8 @@ TEST_F(RenderWidgetHostViewMacTest, DoubleTapZoom) {
       host_->GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
 
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kNoConsumerExists);
 
   events = host_->GetAndResetDispatchedMessages();
   EXPECT_EQ("GestureDoubleTap", GetMessageNames(events));
@@ -1665,7 +1668,8 @@ TEST_F(RenderWidgetHostViewMacTest, DoubleTapZoomConsumed) {
       host_->GetAndResetDispatchedMessages();
   EXPECT_EQ("MouseWheel", GetMessageNames(events));
 
-  events[0]->ToEvent()->CallCallback(INPUT_EVENT_ACK_STATE_CONSUMED);
+  events[0]->ToEvent()->CallCallback(
+      blink::mojom::InputEventResultState::kConsumed);
 
   events = host_->GetAndResetDispatchedMessages();
   EXPECT_EQ(0U, events.size());
diff --git a/chromium/content/browser/renderer_host/render_widget_targeter.cc b/chromium/content/browser/renderer_host/render_widget_targeter.cc
index 8a18f925b10..61923072729 100644
--- a/chromium/content/browser/renderer_host/render_widget_targeter.cc
+++ b/chromium/content/browser/renderer_host/render_widget_targeter.cc
@@ -24,7 +24,7 @@ namespace {
 
 gfx::PointF ComputeEventLocation(const blink::WebInputEvent& event) {
   if (blink::WebInputEvent::IsMouseEventType(event.GetType()) ||
-      event.GetType() == blink::WebInputEvent::kMouseWheel) {
+      event.GetType() == blink::WebInputEvent::Type::kMouseWheel) {
     return static_cast<const blink::WebMouseEvent&>(event).PositionInWidget();
   }
   if (blink::WebInputEvent::IsTouchEventType(event.GetType())) {
@@ -139,8 +139,8 @@ bool RenderWidgetTargeter::TargetingRequest::MergeEventIfPossible(
     const blink::WebInputEvent& new_event) {
   if (event && !blink::WebInputEvent::IsTouchEventType(new_event.GetType()) &&
       !blink::WebInputEvent::IsGestureEventType(new_event.GetType()) &&
-      ui::CanCoalesce(new_event, *event.get())) {
-    ui::Coalesce(new_event, event.get());
+      event->CanCoalesce(new_event)) {
+    event->Coalesce(new_event);
     return true;
   }
   return false;
@@ -183,7 +183,7 @@ void RenderWidgetTargeter::FindTargetAndDispatch(
     const blink::WebInputEvent& event,
     const ui::LatencyInfo& latency) {
   DCHECK(blink::WebInputEvent::IsMouseEventType(event.GetType()) ||
-         event.GetType() == blink::WebInputEvent::kMouseWheel ||
+         event.GetType() == blink::WebInputEvent::Type::kMouseWheel ||
          blink::WebInputEvent::IsTouchEventType(event.GetType()) ||
          (blink::WebInputEvent::IsGestureEventType(event.GetType()) &&
           (static_cast<const blink::WebGestureEvent&>(event).SourceDevice() ==
@@ -226,6 +226,13 @@ void RenderWidgetTargeter::ResolveTargetingRequest(TargetingRequest request) {
                  ? middle_click_result_
                  : delegate_->FindTargetSynchronously(request_target,
                                                       *request.GetEvent());
+    // |result.target_location| is utilized to update the position in widget for
+    // an event. If we are in autoscroll mode, we used cached data. So we need
+    // to update the target location of the |result|.
+    if (is_autoscroll_in_progress_) {
+      result.target_location = request_target_location;
+    }
+
     if (!is_autoscroll_in_progress_ &&
         IsMouseMiddleClick(*request.GetEvent())) {
       if (!result.should_query_view)
diff --git a/chromium/content/browser/renderer_host/text_input_client_mac.h b/chromium/content/browser/renderer_host/text_input_client_mac.h
index 4c43db5edcc..8efa3de2f68 100644
--- a/chromium/content/browser/renderer_host/text_input_client_mac.h
+++ b/chromium/content/browser/renderer_host/text_input_client_mac.h
@@ -5,10 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_CLIENT_MAC_H_
 #define CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_CLIENT_MAC_H_
 
-#import <Cocoa/Cocoa.h>
-
 #include "base/mac/scoped_block.h"
-#include "base/mac/scoped_nsobject.h"
 #include "base/macros.h"
 #include "base/synchronization/condition_variable.h"
 #include "base/synchronization/lock.h"
diff --git a/chromium/content/browser/renderer_host/text_input_client_mac.mm b/chromium/content/browser/renderer_host/text_input_client_mac.mm
index 294291736f1..dfeda3de781 100644
--- a/chromium/content/browser/renderer_host/text_input_client_mac.mm
+++ b/chromium/content/browser/renderer_host/text_input_client_mac.mm
@@ -4,10 +4,17 @@
 
 #import "content/browser/renderer_host/text_input_client_mac.h"
 
+#include "base/bind.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
+#include "content/browser/frame_host/frame_tree.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/renderer_host/render_view_host_delegate.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/common/text_input_client_messages.h"
@@ -33,6 +40,24 @@ bool SendMessageToRenderWidget(RenderWidgetHostImpl* widget,
   DCHECK_EQ(widget->GetRoutingID(), message->routing_id());
   return widget->Send(message);
 }
+
+bool IsFullScreenRenderWidget(RenderWidgetHost* widget) {
+  RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(widget);
+  if (!rwhi->delegate() ||
+      rwhi == rwhi->delegate()->GetFullscreenRenderWidgetHost()) {
+    return true;
+  }
+  return false;
+}
+
+RenderFrameHostImpl* GetFocusedRenderFrameHostImpl(RenderWidgetHost* widget) {
+  RenderViewHostImpl* rvhi = RenderViewHostImpl::From(widget);
+  if (!rvhi || !rvhi->GetDelegate()->GetFrameTree())
+    return nullptr;
+  FrameTreeNode* frame_tree_node =
+      rvhi->GetDelegate()->GetFrameTree()->GetFocusedFrame();
+  return frame_tree_node ? frame_tree_node->current_frame_host() : nullptr;
+}
 }
 
 // The amount of time in milliseconds that the browser process will wait for a
@@ -94,19 +119,23 @@ void TextInputClientMac::GetStringFromRangeReply(
 
 uint32_t TextInputClientMac::GetCharacterIndexAtPoint(RenderWidgetHost* rwh,
                                                       const gfx::Point& point) {
-  RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  if (!SendMessageToRenderWidget(rwhi,
-                                 new TextInputClientMsg_CharacterIndexForPoint(
-                                     rwhi->GetRoutingID(), point))) {
+  if (IsFullScreenRenderWidget(rwh))
     return UINT32_MAX;
-  }
+
+  RenderFrameHostImpl* rfhi = GetFocusedRenderFrameHostImpl(rwh);
+  // If it doesn't have a focused frame, it calls
+  // SetCharacterIndexAndSignal() with index 0.
+  if (!rfhi)
+    return 0;
+
+  rfhi->GetAssociatedLocalFrame()->GetCharacterIndexAtPoint(point);
 
   base::TimeTicks start = base::TimeTicks::Now();
 
   BeforeRequest();
 
   // http://crbug.com/121917
-  base::ScopedAllowBaseSyncPrimitives allow_wait;
+  base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope allow_wait;
   condition_.TimedWait(base::TimeDelta::FromMilliseconds(kWaitTimeout));
   AfterRequest();
 
@@ -119,19 +148,21 @@ uint32_t TextInputClientMac::GetCharacterIndexAtPoint(RenderWidgetHost* rwh,
 
 gfx::Rect TextInputClientMac::GetFirstRectForRange(RenderWidgetHost* rwh,
                                                    const gfx::Range& range) {
-  RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(rwh);
-  if (!SendMessageToRenderWidget(
-          rwhi, new TextInputClientMsg_FirstRectForCharacterRange(
-                    rwhi->GetRoutingID(), range))) {
+  if (IsFullScreenRenderWidget(rwh))
     return gfx::Rect();
-  }
+
+  RenderFrameHostImpl* rfhi = GetFocusedRenderFrameHostImpl(rwh);
+  if (!rfhi)
+    return gfx::Rect();
+
+  rfhi->GetAssociatedLocalFrame()->GetFirstRectForRange(range);
 
   base::TimeTicks start = base::TimeTicks::Now();
 
   BeforeRequest();
 
   // http://crbug.com/121917
-  base::ScopedAllowBaseSyncPrimitives allow_wait;
+  base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope allow_wait;
   condition_.TimedWait(base::TimeDelta::FromMilliseconds(kWaitTimeout));
   AfterRequest();
 
diff --git a/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm b/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
index 158e0507af7..feefe3cbcb2 100644
--- a/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
+++ b/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
@@ -11,70 +11,77 @@
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread.h"
-#include "content/browser/renderer_host/frame_token_message_queue.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
-#include "content/browser/renderer_host/render_widget_host_delegate.h"
-#include "content/browser/renderer_host/render_widget_host_impl.h"
-#include "content/browser/renderer_host/text_input_client_message_filter.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/text_input_client_messages.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents_observer.h"
 #include "content/public/test/browser_task_environment.h"
+#include "content/public/test/fake_local_frame.h"
 #include "content/public/test/mock_render_process_host.h"
-#include "content/public/test/test_browser_context.h"
-#include "content/test/mock_widget_impl.h"
+#include "content/public/test/test_renderer_host.h"
 #include "ipc/ipc_test_sink.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "testing/gtest_mac.h"
 
 namespace content {
 
 namespace {
 const int64_t kTaskDelayMs = 200;
 
-class MockRenderWidgetHostDelegate : public RenderWidgetHostDelegate {
+// Stub out local frame mojo binding. Intercepts calls for text input
+// and marks the message as received. This class attaches to the first
+// RenderFrameHostImpl created.
+class TextInputClientLocalFrame : public content::FakeLocalFrame,
+                                  public WebContentsObserver {
  public:
-  MockRenderWidgetHostDelegate() {}
-  ~MockRenderWidgetHostDelegate() override {}
+  explicit TextInputClientLocalFrame(WebContents* web_contents)
+      : WebContentsObserver(web_contents) {}
+
+  void RenderFrameCreated(RenderFrameHost* render_frame_host) override {
+    if (!initialized_) {
+      initialized_ = true;
+      Init(render_frame_host->GetRemoteAssociatedInterfaces());
+    }
+  }
+
+  void GetCharacterIndexAtPoint(const gfx::Point& point) override {
+    if (completion_callback_)
+      std::move(completion_callback_).Run();
+  }
+
+  void GetFirstRectForRange(const gfx::Range& range) override {
+    if (completion_callback_)
+      std::move(completion_callback_).Run();
+  }
+
+  void SetCallback(base::OnceClosure callback) {
+    completion_callback_ = std::move(callback);
+  }
 
  private:
-  void ExecuteEditCommand(
-      const std::string& command,
-      const base::Optional<base::string16>& value) override {}
-  void Cut() override {}
-  void Copy() override {}
-  void Paste() override {}
-  void SelectAll() override {}
+  bool initialized_ = false;
+  base::OnceClosure completion_callback_;
 };
 
 // This test does not test the WebKit side of the dictionary system (which
 // performs the actual data fetching), but rather this just tests that the
 // service's signaling system works.
-class TextInputClientMacTest : public testing::Test {
+class TextInputClientMacTest : public content::RenderViewHostTestHarness {
  public:
-  TextInputClientMacTest()
-      : browser_context_(),
-        process_factory_(),
-        delegate_(),
-        thread_("TextInputClientMacTestThread") {
-    RenderProcessHost* rph =
-        process_factory_.CreateRenderProcessHost(&browser_context_, nullptr);
-    int32_t routing_id = rph->GetNextRoutingID();
-    mojo::PendingRemote<mojom::Widget> widget;
-    mock_widget_impl_ = std::make_unique<MockWidgetImpl>(
-        widget.InitWithNewPipeAndPassReceiver());
-
-    widget_.reset(new RenderWidgetHostImpl(
-        &delegate_, rph, routing_id, std::move(widget), /*hidden=*/false,
-        std::make_unique<FrameTokenMessageQueue>()));
+  TextInputClientMacTest() : thread_("TextInputClientMacTestThread") {}
+
+  void SetUp() override {
+    content::RenderViewHostTestHarness::SetUp();
+    local_frame_ = std::make_unique<TextInputClientLocalFrame>(web_contents());
+    RenderViewHostTester::For(rvh())->CreateTestRenderView(
+        base::string16(), MSG_ROUTING_NONE, MSG_ROUTING_NONE, false);
+    widget_ = rvh()->GetWidget();
+    FocusWebContentsOnMainFrame();
   }
 
   void TearDown() override {
-    // |widget_| needs to be cleared before flushing the message loop, otherwise
-    // |widgets_|'s destructor calls MockRenderProcessHost::Cleanup, it
-    // schedules the MRPH deletion, and then MockRenderProcessHostFactory also
-    // deletes the MRPH before scheduled MRPH deletion is invoked.
-    widget_.reset();
     base::RunLoop().RunUntilIdle();
+    RenderViewHostTestHarness::TearDown();
   }
 
   // Accessor for the TextInputClientMac instance.
@@ -96,7 +103,8 @@ class TextInputClientMacTest : public testing::Test {
                                            std::move(task), delay);
   }
 
-  RenderWidgetHostImpl* widget() { return widget_.get(); }
+  RenderWidgetHost* widget() { return widget_; }
+  TextInputClientLocalFrame* local_frame() { return local_frame_.get(); }
 
   IPC::TestSink& ipc_sink() {
     return static_cast<MockRenderProcessHost*>(widget()->GetProcess())->sink();
@@ -105,16 +113,8 @@ class TextInputClientMacTest : public testing::Test {
  private:
   friend class ScopedTestingThread;
 
-  // ThreadPool is used by RenderWidgetHostImpl constructor.
-  BrowserTaskEnvironment task_environment_;
-
-  TestBrowserContext browser_context_;
-
-  // Gets deleted when the last RWH in the "process" gets destroyed.
-  MockRenderProcessHostFactory process_factory_;
-  MockRenderWidgetHostDelegate delegate_;
-  std::unique_ptr<RenderWidgetHostImpl> widget_;
-  std::unique_ptr<MockWidgetImpl> mock_widget_impl_;
+  RenderWidgetHost* widget_;
+  std::unique_ptr<TextInputClientLocalFrame> local_frame_;
 
   base::Thread thread_;
 };
@@ -136,13 +136,6 @@ class ScopedTestingThread {
   base::Thread& thread_;
 };
 
-// Adapter for OnMessageReceived to ignore return type so it can be posted
-// to a MessageLoop.
-void CallOnMessageReceived(scoped_refptr<TextInputClientMessageFilter> filter,
-                           const IPC::Message& message) {
-  filter->OnMessageReceived(message);
-}
-
 }  // namespace
 
 // Test Cases //////////////////////////////////////////////////////////////////
@@ -154,22 +147,23 @@ TEST_F(TextInputClientMacTest, GetCharacterIndex) {
   PostTask(FROM_HERE,
            base::BindOnce(&TextInputClientMac::SetCharacterIndexAndSignal,
                           base::Unretained(service()), kSuccessValue));
+  base::RunLoop run_loop;
+  local_frame()->SetCallback(run_loop.QuitClosure());
   NSUInteger index = service()->GetCharacterIndexAtPoint(
       widget(), gfx::Point(2, 2));
 
-  EXPECT_EQ(1U, ipc_sink().message_count());
-  EXPECT_TRUE(ipc_sink().GetUniqueMessageMatching(
-      TextInputClientMsg_CharacterIndexForPoint::ID));
   EXPECT_EQ(kSuccessValue, index);
+  run_loop.Run();
 }
 
 TEST_F(TextInputClientMacTest, TimeoutCharacterIndex) {
+  base::RunLoop run_loop;
+  local_frame()->SetCallback(run_loop.QuitClosure());
   uint32_t index =
       service()->GetCharacterIndexAtPoint(widget(), gfx::Point(2, 2));
-  EXPECT_EQ(1U, ipc_sink().message_count());
-  EXPECT_TRUE(ipc_sink().GetUniqueMessageMatching(
-      TextInputClientMsg_CharacterIndexForPoint::ID));
+
   EXPECT_EQ(UINT32_MAX, index);
+  run_loop.Run();
 }
 
 TEST_F(TextInputClientMacTest, NotFoundCharacterIndex) {
@@ -181,28 +175,24 @@ TEST_F(TextInputClientMacTest, NotFoundCharacterIndex) {
            base::BindOnce(&TextInputClientMac::SetCharacterIndexAndSignal,
                           base::Unretained(service()), kPreviousValue));
 
-  scoped_refptr<TextInputClientMessageFilter> filter(
-      new TextInputClientMessageFilter());
-  std::unique_ptr<IPC::Message> message(
-      new TextInputClientReplyMsg_GotCharacterIndexForPoint(
-          widget()->GetRoutingID(), UINT32_MAX));
-  // Set |WTF::notFound| to the index |kTaskDelayMs| after the previous
-  // setting.
-  PostTask(FROM_HERE, base::BindOnce(&CallOnMessageReceived, filter, *message),
+  // Set UINT32_MAX to the index |kTaskDelayMs| after the previous setting.
+  PostTask(FROM_HERE,
+           base::BindOnce(&TextInputClientMac::SetCharacterIndexAndSignal,
+                          base::Unretained(service()), UINT32_MAX),
            base::TimeDelta::FromMilliseconds(kTaskDelayMs) * 2);
 
+  base::RunLoop run_loop1;
+  local_frame()->SetCallback(run_loop1.QuitClosure());
   uint32_t index =
       service()->GetCharacterIndexAtPoint(widget(), gfx::Point(2, 2));
+  run_loop1.Run();
   EXPECT_EQ(kPreviousValue, index);
+
+  base::RunLoop run_loop2;
+  local_frame()->SetCallback(run_loop2.QuitClosure());
   index = service()->GetCharacterIndexAtPoint(widget(), gfx::Point(2, 2));
+  run_loop2.Run();
   EXPECT_EQ(UINT32_MAX, index);
-
-  EXPECT_EQ(2U, ipc_sink().message_count());
-  for (size_t i = 0; i < ipc_sink().message_count(); ++i) {
-    const IPC::Message* ipc_message = ipc_sink().GetMessageAt(i);
-    EXPECT_EQ(ipc_message->type(),
-              TextInputClientMsg_CharacterIndexForPoint::ID);
-  }
 }
 
 TEST_F(TextInputClientMacTest, GetRectForRange) {
@@ -212,21 +202,20 @@ TEST_F(TextInputClientMacTest, GetRectForRange) {
   PostTask(FROM_HERE,
            base::BindOnce(&TextInputClientMac::SetFirstRectAndSignal,
                           base::Unretained(service()), kSuccessValue));
+  base::RunLoop run_loop;
+  local_frame()->SetCallback(run_loop.QuitClosure());
   gfx::Rect rect =
       service()->GetFirstRectForRange(widget(), gfx::Range(NSMakeRange(0, 32)));
-
-  EXPECT_EQ(1U, ipc_sink().message_count());
-  EXPECT_TRUE(ipc_sink().GetUniqueMessageMatching(
-      TextInputClientMsg_FirstRectForCharacterRange::ID));
+  run_loop.Run();
   EXPECT_EQ(kSuccessValue, rect);
 }
 
 TEST_F(TextInputClientMacTest, TimeoutRectForRange) {
+  base::RunLoop run_loop;
+  local_frame()->SetCallback(run_loop.QuitClosure());
   gfx::Rect rect =
       service()->GetFirstRectForRange(widget(), gfx::Range(NSMakeRange(0, 32)));
-  EXPECT_EQ(1U, ipc_sink().message_count());
-  EXPECT_TRUE(ipc_sink().GetUniqueMessageMatching(
-      TextInputClientMsg_FirstRectForCharacterRange::ID));
+  run_loop.Run();
   EXPECT_EQ(gfx::Rect(), rect);
 }
 
diff --git a/chromium/content/browser/renderer_host/text_input_client_message_filter.h b/chromium/content/browser/renderer_host/text_input_client_message_filter.h
index 3dd6ab98135..218266845dc 100644
--- a/chromium/content/browser/renderer_host/text_input_client_message_filter.h
+++ b/chromium/content/browser/renderer_host/text_input_client_message_filter.h
@@ -14,7 +14,6 @@
 
 namespace gfx {
 class Point;
-class Rect;
 }
 
 namespace content {
@@ -40,8 +39,6 @@ class CONTENT_EXPORT TextInputClientMessageFilter
   void OnGotStringAtPoint(
       const mac::AttributedStringCoder::EncodedString& encoded_string,
       const gfx::Point& point);
-  void OnGotCharacterIndexForPoint(uint32_t index);
-  void OnGotFirstRectForRange(const gfx::Rect& rect);
   void OnGotStringFromRange(
       const mac::AttributedStringCoder::EncodedString& string,
       const gfx::Point& point);
diff --git a/chromium/content/browser/renderer_host/text_input_client_message_filter.mm b/chromium/content/browser/renderer_host/text_input_client_message_filter.mm
index cb4db8bc7a1..11c4f93d479 100644
--- a/chromium/content/browser/renderer_host/text_input_client_message_filter.mm
+++ b/chromium/content/browser/renderer_host/text_input_client_message_filter.mm
@@ -24,10 +24,6 @@ bool TextInputClientMessageFilter::OnMessageReceived(
   IPC_BEGIN_MESSAGE_MAP(TextInputClientMessageFilter, message)
     IPC_MESSAGE_HANDLER(TextInputClientReplyMsg_GotStringAtPoint,
                         OnGotStringAtPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientReplyMsg_GotCharacterIndexForPoint,
-                        OnGotCharacterIndexForPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientReplyMsg_GotFirstRectForRange,
-                        OnGotFirstRectForRange)
     IPC_MESSAGE_HANDLER(TextInputClientReplyMsg_GotStringForRange,
                         OnGotStringFromRange)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -55,17 +51,6 @@ void TextInputClientMessageFilter::OnGotStringAtPoint(
   service->GetStringAtPointReply(encoded_string, point);
 }
 
-void TextInputClientMessageFilter::OnGotCharacterIndexForPoint(uint32_t index) {
-  TextInputClientMac* service = TextInputClientMac::GetInstance();
-  service->SetCharacterIndexAndSignal(index);
-}
-
-void TextInputClientMessageFilter::OnGotFirstRectForRange(
-    const gfx::Rect& rect) {
-  TextInputClientMac* service = TextInputClientMac::GetInstance();
-  service->SetFirstRectAndSignal(rect);
-}
-
 void TextInputClientMessageFilter::OnGotStringFromRange(
     const mac::AttributedStringCoder::EncodedString& encoded_string,
     const gfx::Point& point) {
diff --git a/chromium/content/browser/renderer_host/text_input_host_impl.h b/chromium/content/browser/renderer_host/text_input_host_impl.h
new file mode 100644
index 00000000000..362cc685160
--- /dev/null
+++ b/chromium/content/browser/renderer_host/text_input_host_impl.h
@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_HOST_IMPL_H_
+#define CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_HOST_IMPL_H_
+
+#include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "third_party/blink/public/mojom/input/text_input_host.mojom.h"
+
+namespace content {
+
+// Note that the methods should run on BrowserThread::IO to get pumped because
+// BrowserThread::UI is being blocked on a semaphore at TextInputClientMac.
+// http://crbug.com/121917
+class CONTENT_EXPORT TextInputHostImpl : public blink::mojom::TextInputHost {
+ public:
+  TextInputHostImpl();
+  ~TextInputHostImpl() override;
+
+  static void Create(
+      mojo::PendingReceiver<blink::mojom::TextInputHost> receiver);
+
+  // blink::mojom::TextInputHost implementation.
+  void GotCharacterIndexAtPoint(uint32_t index) override;
+  void GotFirstRectForRange(const gfx::Rect& rect) override;
+
+ private:
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  DISALLOW_COPY_AND_ASSIGN(TextInputHostImpl);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_RENDERER_HOST_TEXT_INPUT_HOST_IMPL_H_
diff --git a/chromium/content/browser/renderer_host/text_input_host_impl.mm b/chromium/content/browser/renderer_host/text_input_host_impl.mm
new file mode 100644
index 00000000000..d721cf1f609
--- /dev/null
+++ b/chromium/content/browser/renderer_host/text_input_host_impl.mm
@@ -0,0 +1,37 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/renderer_host/text_input_host_impl.h"
+
+#include "content/browser/renderer_host/text_input_client_mac.h"
+#include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+
+namespace content {
+
+TextInputHostImpl::TextInputHostImpl() = default;
+TextInputHostImpl::~TextInputHostImpl() = default;
+
+void TextInputHostImpl::Create(
+    mojo::PendingReceiver<blink::mojom::TextInputHost> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  mojo::MakeSelfOwnedReceiver(std::make_unique<TextInputHostImpl>(),
+                              std::move(receiver));
+}
+
+void TextInputHostImpl::GotCharacterIndexAtPoint(uint32_t index) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  TextInputClientMac* service = TextInputClientMac::GetInstance();
+  service->SetCharacterIndexAndSignal(index);
+}
+
+void TextInputHostImpl::GotFirstRectForRange(const gfx::Rect& rect) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  TextInputClientMac* service = TextInputClientMac::GetInstance();
+  service->SetFirstRectAndSignal(rect);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/renderer_host/ui_events_helper.cc b/chromium/content/browser/renderer_host/ui_events_helper.cc
index df3a13769ba..9f2357f6fcf 100644
--- a/chromium/content/browser/renderer_host/ui_events_helper.cc
+++ b/chromium/content/browser/renderer_host/ui_events_helper.cc
@@ -19,16 +19,16 @@ namespace {
 ui::EventType WebTouchPointStateToEventType(
     blink::WebTouchPoint::State state) {
   switch (state) {
-    case blink::WebTouchPoint::kStateReleased:
+    case blink::WebTouchPoint::State::kStateReleased:
       return ui::ET_TOUCH_RELEASED;
 
-    case blink::WebTouchPoint::kStatePressed:
+    case blink::WebTouchPoint::State::kStatePressed:
       return ui::ET_TOUCH_PRESSED;
 
-    case blink::WebTouchPoint::kStateMoved:
+    case blink::WebTouchPoint::State::kStateMoved:
       return ui::ET_TOUCH_MOVED;
 
-    case blink::WebTouchPoint::kStateCancelled:
+    case blink::WebTouchPoint::State::kStateCancelled:
       return ui::ET_TOUCH_CANCELLED;
 
     default:
@@ -47,16 +47,16 @@ bool MakeUITouchEventsFromWebTouchEvents(
   const blink::WebTouchEvent& touch = touch_with_latency.event;
   ui::EventType type = ui::ET_UNKNOWN;
   switch (touch.GetType()) {
-    case blink::WebInputEvent::kTouchStart:
+    case blink::WebInputEvent::Type::kTouchStart:
       type = ui::ET_TOUCH_PRESSED;
       break;
-    case blink::WebInputEvent::kTouchEnd:
+    case blink::WebInputEvent::Type::kTouchEnd:
       type = ui::ET_TOUCH_RELEASED;
       break;
-    case blink::WebInputEvent::kTouchMove:
+    case blink::WebInputEvent::Type::kTouchMove:
       type = ui::ET_TOUCH_MOVED;
       break;
-    case blink::WebInputEvent::kTouchCancel:
+    case blink::WebInputEvent::Type::kTouchCancel:
       type = ui::ET_TOUCH_CANCELLED;
       break;
     default:
@@ -78,7 +78,7 @@ bool MakeUITouchEventsFromWebTouchEvents(
       location = point.PositionInScreen();
     auto uievent = std::make_unique<ui::TouchEvent>(
         type, gfx::Point(), timestamp,
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, point.id,
+        ui::PointerDetails(ui::EventPointerType::kTouch, point.id,
                            point.radius_x, point.radius_y, point.force,
                            point.rotation_angle),
         flags);
@@ -90,10 +90,11 @@ bool MakeUITouchEventsFromWebTouchEvents(
   return true;
 }
 
-bool InputEventAckStateIsSetNonBlocking(InputEventAckState ack_state) {
+bool InputEventResultStateIsSetNonBlocking(
+    blink::mojom::InputEventResultState ack_state) {
   switch (ack_state) {
-    case INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING:
-    case INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING:
+    case blink::mojom::InputEventResultState::kSetNonBlocking:
+    case blink::mojom::InputEventResultState::kSetNonBlockingDueToFling:
       return true;
     default:
       return false;
diff --git a/chromium/content/browser/renderer_host/ui_events_helper.h b/chromium/content/browser/renderer_host/ui_events_helper.h
index 147c7d0b0c5..961039f35f7 100644
--- a/chromium/content/browser/renderer_host/ui_events_helper.h
+++ b/chromium/content/browser/renderer_host/ui_events_helper.h
@@ -10,7 +10,7 @@
 
 #include "content/browser/renderer_host/event_with_latency_info.h"
 #include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 namespace ui {
 class TouchEvent;
@@ -40,7 +40,7 @@ CONTENT_EXPORT bool MakeUITouchEventsFromWebTouchEvents(
 
 // Utility to map the event ack state from the renderer, returns true if the
 // event could be handled non-blocking.
-bool InputEventAckStateIsSetNonBlocking(InputEventAckState);
+bool InputEventResultStateIsSetNonBlocking(blink::mojom::InputEventResultState);
 
 }  // namespace content
 
diff --git a/chromium/content/browser/renderer_host/web_database_host_impl.cc b/chromium/content/browser/renderer_host/web_database_host_impl.cc
index 755fc5e3824..4da497e7265 100644
--- a/chromium/content/browser/renderer_host/web_database_host_impl.cc
+++ b/chromium/content/browser/renderer_host/web_database_host_impl.cc
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
@@ -116,8 +116,8 @@ void WebDatabaseHostImpl::OpenFileValidated(const base::string16& vfs_file_name,
   std::string origin_identifier;
   base::string16 database_name;
 
-  // When in incognito mode, we want to make sure that all DB files are
-  // removed when the incognito browser context goes away, so we add the
+  // When in OffTheRecord mode, we want to make sure that all DB files are
+  // removed when the OffTheRecord browser context goes away, so we add the
   // SQLITE_OPEN_DELETEONCLOSE flag when opening all files, and keep
   // open handles to them in the database tracker to make sure they're
   // around for as long as needed.
@@ -131,14 +131,14 @@ void WebDatabaseHostImpl::OpenFileValidated(const base::string16& vfs_file_name,
     base::FilePath db_file = DatabaseUtil::GetFullFilePathForVfsFile(
         db_tracker_.get(), vfs_file_name);
     if (!db_file.empty()) {
-      if (db_tracker_->IsIncognitoProfile()) {
-        tracked_file = db_tracker_->GetIncognitoFile(vfs_file_name);
+      if (db_tracker_->IsOffTheRecordProfile()) {
+        tracked_file = db_tracker_->GetOffTheRecordFile(vfs_file_name);
         if (!tracked_file) {
           file = VfsBackend::OpenFile(
               db_file, desired_flags | SQLITE_OPEN_DELETEONCLOSE);
           if (!(desired_flags & SQLITE_OPEN_DELETEONCLOSE)) {
-            tracked_file =
-                db_tracker_->SaveIncognitoFile(vfs_file_name, std::move(file));
+            tracked_file = db_tracker_->SaveOffTheRecordFile(vfs_file_name,
+                                                             std::move(file));
           }
         }
       } else {
@@ -288,20 +288,20 @@ void WebDatabaseHostImpl::DatabaseDeleteFile(
   base::FilePath db_file =
       DatabaseUtil::GetFullFilePathForVfsFile(db_tracker_.get(), vfs_file_name);
   if (!db_file.empty()) {
-    // In order to delete a journal file in incognito mode, we only need to
+    // In order to delete a journal file in OffTheRecord mode, we only need to
     // close the open handle to it that's stored in the database tracker.
-    if (db_tracker_->IsIncognitoProfile()) {
+    if (db_tracker_->IsOffTheRecordProfile()) {
       const base::string16 wal_suffix(base::ASCIIToUTF16("-wal"));
       base::string16 sqlite_suffix;
 
       // WAL files can be deleted without having previously been opened.
-      if (!db_tracker_->HasSavedIncognitoFileHandle(vfs_file_name) &&
+      if (!db_tracker_->HasSavedOffTheRecordFileHandle(vfs_file_name) &&
           DatabaseUtil::CrackVfsFileName(vfs_file_name, nullptr, nullptr,
                                          &sqlite_suffix) &&
           sqlite_suffix == wal_suffix) {
         error_code = SQLITE_OK;
       } else {
-        db_tracker_->CloseIncognitoFileHandle(vfs_file_name);
+        db_tracker_->CloseOffTheRecordFileHandle(vfs_file_name);
         error_code = SQLITE_OK;
       }
     } else {
diff --git a/chromium/content/browser/renderer_host/web_database_host_impl_unittest.cc b/chromium/content/browser/renderer_host/web_database_host_impl_unittest.cc
index 0ef35aa877a..85e2788d6e2 100644
--- a/chromium/content/browser/renderer_host/web_database_host_impl_unittest.cc
+++ b/chromium/content/browser/renderer_host/web_database_host_impl_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/run_loop.h"
+#include "base/sequenced_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/bind_test_util.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ -47,26 +48,44 @@ class WebDatabaseHostImplTest : public ::testing::Test {
             base::FilePath(), /*is_incognito=*/false,
             /*special_storage_policy=*/nullptr,
             /*quota_manager_proxy=*/nullptr);
-    db_tracker->set_task_runner_for_testing(
-        base::ThreadTaskRunnerHandle::Get());
 
+    task_runner_ = db_tracker->task_runner();
     host_ = std::make_unique<WebDatabaseHostImpl>(process_id(),
                                                   std::move(db_tracker));
   }
 
+  void TearDown() override {
+    task_runner_->DeleteSoon(FROM_HERE, std::move(host_));
+    RunUntilIdle();
+  }
+
   template <typename Callable>
   void CheckUnauthorizedOrigin(const Callable& func) {
-    FakeMojoMessageDispatchContext fake_dispatch_context;
     mojo::test::BadMessageObserver bad_message_observer;
-    func();
+    base::RunLoop run_loop;
+    task_runner()->PostTask(
+        FROM_HERE, base::BindLambdaForTesting([&]() {
+          FakeMojoMessageDispatchContext fake_dispatch_context;
+          func();
+          run_loop.Quit();
+        }));
+    run_loop.Run();
+    RunUntilIdle();
     EXPECT_EQ("Unauthorized origin.", bad_message_observer.WaitForBadMessage());
   }
 
   template <typename Callable>
   void CheckInvalidOrigin(const Callable& func) {
-    FakeMojoMessageDispatchContext fake_dispatch_context;
     mojo::test::BadMessageObserver bad_message_observer;
-    func();
+    base::RunLoop run_loop;
+    task_runner()->PostTask(
+        FROM_HERE, base::BindLambdaForTesting([&]() {
+          FakeMojoMessageDispatchContext fake_dispatch_context;
+          func();
+          run_loop.Quit();
+        }));
+    run_loop.Run();
+    RunUntilIdle();
     EXPECT_EQ("Invalid origin.", bad_message_observer.WaitForBadMessage());
   }
 
@@ -78,15 +97,19 @@ class WebDatabaseHostImplTest : public ::testing::Test {
     render_process_host_.release();
   }
 
+  void RunUntilIdle() { task_environment_.RunUntilIdle(); }
+
   WebDatabaseHostImpl* host() { return host_.get(); }
   int process_id() const { return render_process_host_->GetID(); }
   BrowserContext* browser_context() { return &browser_context_; }
+  base::SequencedTaskRunner* task_runner() { return task_runner_.get(); }
 
  private:
   BrowserTaskEnvironment task_environment_;
   TestBrowserContext browser_context_;
   std::unique_ptr<MockRenderProcessHost> render_process_host_;
   std::unique_ptr<WebDatabaseHostImpl> host_;
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDatabaseHostImplTest);
 };
@@ -205,11 +228,16 @@ TEST_F(WebDatabaseHostImplTest, ProcessShutdown) {
 
   // Verify that an error occurs with OpenFile() call before process shutdown.
   {
-    FakeMojoMessageDispatchContext fake_dispatch_context;
-    host()->OpenFile(bad_vfs_file_name,
-                     /*desired_flags=*/0, success_callback);
-
-    base::RunLoop().RunUntilIdle();
+    base::RunLoop run_loop;
+    task_runner()->PostTask(
+        FROM_HERE, base::BindLambdaForTesting([&]() {
+          FakeMojoMessageDispatchContext fake_dispatch_context;
+          host()->OpenFile(bad_vfs_file_name,
+                           /*desired_flags=*/0, success_callback);
+          run_loop.Quit();
+        }));
+    run_loop.Run();
+    RunUntilIdle();
 
     EXPECT_FALSE(success_callback_was_called);
     EXPECT_TRUE(error_callback_message.has_value());
@@ -225,11 +253,16 @@ TEST_F(WebDatabaseHostImplTest, ProcessShutdown) {
 
   // Attempt the call again and verify that no callbacks were called.
   {
-    FakeMojoMessageDispatchContext fake_dispatch_context;
-    host()->OpenFile(bad_vfs_file_name,
-                     /*desired_flags=*/0, success_callback);
-
-    base::RunLoop().RunUntilIdle();
+    base::RunLoop run_loop;
+    task_runner()->PostTask(
+        FROM_HERE, base::BindLambdaForTesting([&]() {
+          FakeMojoMessageDispatchContext fake_dispatch_context;
+          host()->OpenFile(bad_vfs_file_name,
+                           /*desired_flags=*/0, success_callback);
+          run_loop.Quit();
+        }));
+    run_loop.Run();
+    RunUntilIdle();
 
     // Verify none of the callbacks were called.
     EXPECT_FALSE(success_callback_was_called);
diff --git a/chromium/content/browser/renderer_host/webmenurunner_mac.h b/chromium/content/browser/renderer_host/webmenurunner_mac.h
index 6f3ab4bc66c..f054cc799b3 100644
--- a/chromium/content/browser/renderer_host/webmenurunner_mac.h
+++ b/chromium/content/browser/renderer_host/webmenurunner_mac.h
@@ -11,7 +11,7 @@
 
 #include "base/mac/scoped_nsobject.h"
 #include "content/public/common/menu_item.h"
-
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 
 // WebMenuRunner ---------------------------------------------------------------
 // A class for determining whether an item was selected from an HTML select
@@ -39,7 +39,7 @@
 }
 
 // Initializes the MenuDelegate with a list of items sent from WebKit.
-- (id)initWithItems:(const std::vector<content::MenuItem>&)items
+- (id)initWithItems:(const std::vector<blink::mojom::MenuItemPtr>&)items
            fontSize:(CGFloat)fontSize
        rightAligned:(BOOL)rightAligned;
 
diff --git a/chromium/content/browser/renderer_host/webmenurunner_mac.mm b/chromium/content/browser/renderer_host/webmenurunner_mac.mm
index 27479b05ede..4540b8bf58f 100644
--- a/chromium/content/browser/renderer_host/webmenurunner_mac.mm
+++ b/chromium/content/browser/renderer_host/webmenurunner_mac.mm
@@ -11,7 +11,7 @@
 @interface WebMenuRunner (PrivateAPI)
 
 // Worker function used during initialization.
-- (void)addItem:(const content::MenuItem&)item;
+- (void)addItem:(const blink::mojom::MenuItemPtr&)item;
 
 // A callback for the menu controller object to call when an item is selected
 // from the menu. This is not called if the menu is dismissed without a
@@ -22,7 +22,7 @@
 
 @implementation WebMenuRunner
 
-- (id)initWithItems:(const std::vector<content::MenuItem>&)items
+- (id)initWithItems:(const std::vector<blink::mojom::MenuItemPtr>&)items
            fontSize:(CGFloat)fontSize
        rightAligned:(BOOL)rightAligned {
   if ((self = [super init])) {
@@ -37,21 +37,22 @@
   return self;
 }
 
-- (void)addItem:(const content::MenuItem&)item {
-  if (item.type == content::MenuItem::SEPARATOR) {
+- (void)addItem:(const blink::mojom::MenuItemPtr&)item {
+  if (item->type == blink::mojom::MenuItem::Type::kSeparator) {
     [_menu addItem:[NSMenuItem separatorItem]];
     return;
   }
 
-  NSString* title = base::SysUTF16ToNSString(item.label);
+  NSString* title = base::SysUTF8ToNSString(item->label.value_or(""));
   NSMenuItem* menuItem = [_menu addItemWithTitle:title
                                           action:@selector(menuItemSelected:)
                                    keyEquivalent:@""];
-  if (!item.tool_tip.empty()) {
-    NSString* toolTip = base::SysUTF16ToNSString(item.tool_tip);
+  if (item->tool_tip.has_value()) {
+    NSString* toolTip = base::SysUTF8ToNSString(item->tool_tip.value());
     [menuItem setToolTip:toolTip];
   }
-  [menuItem setEnabled:(item.enabled && item.type != content::MenuItem::GROUP)];
+  [menuItem setEnabled:(item->enabled &&
+                        item->type != blink::mojom::MenuItem::Type::kGroup)];
   [menuItem setTarget:self];
 
   // Set various alignment/language attributes. Note that many (if not most) of
@@ -63,12 +64,13 @@
   [paragraphStyle setAlignment:_rightAligned ? NSRightTextAlignment
                                              : NSLeftTextAlignment];
   NSWritingDirection writingDirection =
-      item.rtl ? NSWritingDirectionRightToLeft
-               : NSWritingDirectionLeftToRight;
+      item->text_direction == base::i18n::RIGHT_TO_LEFT
+          ? NSWritingDirectionRightToLeft
+          : NSWritingDirectionLeftToRight;
   [paragraphStyle setBaseWritingDirection:writingDirection];
   [attrs setObject:paragraphStyle forKey:NSParagraphStyleAttributeName];
 
-  if (item.has_directional_override) {
+  if (item->has_text_direction_override) {
     base::scoped_nsobject<NSNumber> directionValue(
         [[NSNumber alloc] initWithInteger:
             writingDirection + NSTextWritingDirectionOverride]);
diff --git a/chromium/content/browser/resolve_proxy_msg_helper.cc b/chromium/content/browser/resolve_proxy_helper.cc
index ee3c53b3d48..69e659d64e4 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper.cc
+++ b/chromium/content/browser/resolve_proxy_helper.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/resolve_proxy_msg_helper.h"
+#include "content/browser/resolve_proxy_helper.h"
 
 #include "base/bind.h"
 #include "base/compiler_specific.h"
@@ -16,32 +16,15 @@
 
 namespace content {
 
-ResolveProxyMsgHelper::ResolveProxyMsgHelper(int render_process_host_id)
-    : BrowserMessageFilter(ViewMsgStart),
-      render_process_host_id_(render_process_host_id) {}
+ResolveProxyHelper::ResolveProxyHelper(int render_process_host_id)
+    : render_process_host_id_(render_process_host_id) {}
 
-void ResolveProxyMsgHelper::OverrideThreadForMessage(
-    const IPC::Message& message,
-    BrowserThread::ID* thread) {
-  if (message.type() == ViewHostMsg_ResolveProxy::ID)
-    *thread = BrowserThread::UI;
-}
-
-bool ResolveProxyMsgHelper::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(ResolveProxyMsgHelper, message)
-    IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_ResolveProxy, OnResolveProxy)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void ResolveProxyMsgHelper::OnResolveProxy(const GURL& url,
-                                           IPC::Message* reply_msg) {
+void ResolveProxyHelper::ResolveProxy(const GURL& url,
+                                      ResolveProxyCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   // Enqueue the pending request.
-  pending_requests_.push_back(PendingRequest(url, reply_msg));
+  pending_requests_.push_back(PendingRequest(url, std::move(callback)));
 
   // If nothing is in progress, start.
   if (!receiver_.is_bound()) {
@@ -50,12 +33,12 @@ void ResolveProxyMsgHelper::OnResolveProxy(const GURL& url,
   }
 }
 
-ResolveProxyMsgHelper::~ResolveProxyMsgHelper() {
+ResolveProxyHelper::~ResolveProxyHelper() {
   DCHECK(!owned_self_);
   DCHECK(!receiver_.is_bound());
 }
 
-void ResolveProxyMsgHelper::StartPendingRequest() {
+void ResolveProxyHelper::StartPendingRequest() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!receiver_.is_bound());
   DCHECK(!pending_requests_.empty());
@@ -64,7 +47,7 @@ void ResolveProxyMsgHelper::StartPendingRequest() {
   mojo::PendingRemote<network::mojom::ProxyLookupClient> proxy_lookup_client =
       receiver_.BindNewPipeAndPassRemote();
   receiver_.set_disconnect_handler(
-      base::BindOnce(&ResolveProxyMsgHelper::OnProxyLookupComplete,
+      base::BindOnce(&ResolveProxyHelper::OnProxyLookupComplete,
                      base::Unretained(this), net::ERR_ABORTED, base::nullopt));
   owned_self_ = this;
   if (!SendRequestToNetworkService(pending_requests_.front().url,
@@ -73,7 +56,7 @@ void ResolveProxyMsgHelper::StartPendingRequest() {
   }
 }
 
-bool ResolveProxyMsgHelper::SendRequestToNetworkService(
+bool ResolveProxyHelper::SendRequestToNetworkService(
     const GURL& url,
     mojo::PendingRemote<network::mojom::ProxyLookupClient>
         proxy_lookup_client) {
@@ -92,7 +75,7 @@ bool ResolveProxyMsgHelper::SendRequestToNetworkService(
   return true;
 }
 
-void ResolveProxyMsgHelper::OnProxyLookupComplete(
+void ResolveProxyHelper::OnProxyLookupComplete(
     int32_t net_error,
     const base::Optional<net::ProxyInfo>& proxy_info) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -105,7 +88,7 @@ void ResolveProxyMsgHelper::OnProxyLookupComplete(
   // reference, and a reference may be owned by the IO thread or by other
   // posted tasks, so |this| may or may not be deleted at the end of this
   // method.
-  scoped_refptr<ResolveProxyMsgHelper> owned_self = std::move(owned_self_);
+  scoped_refptr<ResolveProxyHelper> owned_self = std::move(owned_self_);
 
   // If all references except |owned_self| have been released, then there's
   // nothing waiting for pending requests to complete. So just exit this method,
@@ -117,26 +100,27 @@ void ResolveProxyMsgHelper::OnProxyLookupComplete(
   PendingRequest completed_req = std::move(pending_requests_.front());
   pending_requests_.pop_front();
 
-  ViewHostMsg_ResolveProxy::WriteReplyParams(
-      completed_req.reply_msg.get(), !!proxy_info,
-      proxy_info ? proxy_info->ToPacString() : std::string());
-  Send(completed_req.reply_msg.release());
+  std::move(completed_req.callback)
+      .Run(proxy_info ? proxy_info->ToPacString()
+                      : base::Optional<std::string>());
 
   // Start the next request.
   if (!pending_requests_.empty())
     StartPendingRequest();
 }
 
-ResolveProxyMsgHelper::PendingRequest::PendingRequest(const GURL& url,
-                                                      IPC::Message* reply_msg)
-    : url(url), reply_msg(reply_msg) {}
+ResolveProxyHelper::PendingRequest::PendingRequest(
+    const GURL& url,
+    ResolveProxyCallback callback)
+    : url(url), callback(std::move(callback)) {}
 
-ResolveProxyMsgHelper::PendingRequest::PendingRequest(
+ResolveProxyHelper::PendingRequest::PendingRequest(
     PendingRequest&& pending_request) noexcept = default;
 
-ResolveProxyMsgHelper::PendingRequest::~PendingRequest() noexcept = default;
+ResolveProxyHelper::PendingRequest::~PendingRequest() noexcept = default;
 
-ResolveProxyMsgHelper::PendingRequest& ResolveProxyMsgHelper::PendingRequest::
-operator=(PendingRequest&& pending_request) noexcept = default;
+ResolveProxyHelper::PendingRequest&
+ResolveProxyHelper::PendingRequest::operator=(
+    PendingRequest&& pending_request) noexcept = default;
 
 }  // namespace content
diff --git a/chromium/content/browser/resolve_proxy_msg_helper.h b/chromium/content/browser/resolve_proxy_helper.h
index 30cfffafa6a..ec64f870ea2 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper.h
+++ b/chromium/content/browser/resolve_proxy_helper.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_BROWSER_RESOLVE_PROXY_MSG_HELPER_H_
-#define CONTENT_BROWSER_RESOLVE_PROXY_MSG_HELPER_H_
+#ifndef CONTENT_BROWSER_RESOLVE_PROXY_HELPER_H_
+#define CONTENT_BROWSER_RESOLVE_PROXY_HELPER_H_
 
 #include <string>
 
@@ -13,7 +13,7 @@
 #include "base/optional.h"
 #include "base/sequenced_task_runner_helpers.h"
 #include "content/common/content_export.h"
-#include "content/public/browser/browser_message_filter.h"
+#include "content/common/renderer_host.mojom.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "services/network/public/mojom/proxy_lookup_client.mojom.h"
@@ -25,12 +25,12 @@ class ProxyInfo;
 
 namespace content {
 
-// Responds to ChildProcessHostMsg_ResolveProxy, kicking off a proxy lookup
-// request on the UI thread using the specified proxy service.  Completion is
-// notified through the delegate.  If multiple requests are started at the same
-// time, they will run in FIFO order, with only 1 being outstanding at a time.
+// Responds to ResolveProxyCallback, kicking off a proxy lookup request on the
+// UI thread using the specified proxy service.  Completion is notified through
+// the delegate.  If multiple requests are started at the same time, they will
+// run in FIFO order, with only 1 being outstanding at a time.
 //
-// When an instance of ResolveProxyMsgHelper is destroyed, it cancels any
+// When an instance of ResolveProxyHelper is destroyed, it cancels any
 // outstanding proxy resolve requests with the proxy service. It also deletes
 // the stored IPC::Message pointers for pending requests.
 //
@@ -38,26 +38,24 @@ namespace content {
 // self-reference as long as there's a pending Mojo call, as losing its last
 // reference on the IO thread with an open mojo pipe that lives on the UI
 // thread leads to problems.
-class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
-                                             network::mojom::ProxyLookupClient {
+class CONTENT_EXPORT ResolveProxyHelper
+    : public base::RefCounted<ResolveProxyHelper>,
+      public network::mojom::ProxyLookupClient {
  public:
-  explicit ResolveProxyMsgHelper(int render_process_host_id);
+  explicit ResolveProxyHelper(int render_process_host_id);
 
-  // BrowserMessageFilter implementation
-  void OverrideThreadForMessage(const IPC::Message& message,
-                                BrowserThread::ID* thread) override;
-  bool OnMessageReceived(const IPC::Message& message) override;
-
-  void OnResolveProxy(const GURL& url, IPC::Message* reply_msg);
+  using ResolveProxyCallback = mojom::RendererHost::ResolveProxyCallback;
+  void ResolveProxy(const GURL& url, ResolveProxyCallback callback);
 
  protected:
   // Destruction cancels the current outstanding request, and clears the
   // pending queue.
-  ~ResolveProxyMsgHelper() override;
+  ~ResolveProxyHelper() override;
 
  private:
-  // Used to destroy the |ResolveProxyMsgHelper| on the UI thread.
-  friend class base::DeleteHelper<ResolveProxyMsgHelper>;
+  // Used to destroy the |ResolveProxyHelper| on the UI thread.
+  friend class base::DeleteHelper<ResolveProxyHelper>;
+  friend class base::RefCounted<ResolveProxyHelper>;
 
   // Starts the first pending request.
   void StartPendingRequest();
@@ -77,7 +75,7 @@ class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
   // A PendingRequest is a resolve request that is in progress, or queued.
   struct PendingRequest {
    public:
-    PendingRequest(const GURL& url, IPC::Message* reply_msg);
+    PendingRequest(const GURL& url, ResolveProxyCallback callback);
     PendingRequest(PendingRequest&& pending_request) noexcept;
     ~PendingRequest();
 
@@ -87,7 +85,7 @@ class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
     GURL url;
 
     // Data to pass back to the delegate on completion (we own it until then).
-    std::unique_ptr<IPC::Message> reply_msg;
+    ResolveProxyCallback callback;
 
    private:
     DISALLOW_COPY_AND_ASSIGN(PendingRequest);
@@ -103,14 +101,14 @@ class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
   // Needed to shut down safely, since this class is refcounted, with some
   // references owned on multiple threads, while |receiver_| lives on the UI
   // thread, and may receive callbacks there whenever there's a pending request.
-  scoped_refptr<ResolveProxyMsgHelper> owned_self_;
+  scoped_refptr<ResolveProxyHelper> owned_self_;
 
   // Receiver for the currently in-progress request, if any.
   mojo::Receiver<network::mojom::ProxyLookupClient> receiver_{this};
 
-  DISALLOW_COPY_AND_ASSIGN(ResolveProxyMsgHelper);
+  DISALLOW_COPY_AND_ASSIGN(ResolveProxyHelper);
 };
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_RESOLVE_PROXY_MSG_HELPER_H_
+#endif  // CONTENT_BROWSER_RESOLVE_PROXY_HELPER_H_
diff --git a/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc b/chromium/content/browser/resolve_proxy_helper_unittest.cc
index 56df64c4719..45b34c45316 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc
+++ b/chromium/content/browser/resolve_proxy_helper_unittest.cc
@@ -2,12 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/resolve_proxy_msg_helper.h"
+#include "content/browser/resolve_proxy_helper.h"
 
 #include <tuple>
 
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
+#include "base/test/bind_test_util.h"
 #include "content/common/view_messages.h"
 #include "content/public/test/browser_task_environment.h"
 #include "ipc/ipc_test_sink.h"
@@ -20,26 +21,15 @@
 
 namespace content {
 
-class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
+class TestResolveProxyHelper : public ResolveProxyHelper {
  public:
   // Incoming mojo::Remote<ProxyLookupClient>s are written to
   // |proxy_lookup_client|.
-  explicit TestResolveProxyMsgHelper(
-      IPC::Listener* listener,
+  explicit TestResolveProxyHelper(
       mojo::Remote<network::mojom::ProxyLookupClient>* proxy_lookup_client)
-      : ResolveProxyMsgHelper(0 /* renderer_process_host_id */),
-        listener_(listener),
+      : ResolveProxyHelper(0 /* renderer_process_host_id */),
         proxy_lookup_client_(proxy_lookup_client) {}
 
-  bool Send(IPC::Message* message) override {
-    // Shouldn't be calling Send() if there are no live references to |this|.
-    EXPECT_TRUE(HasAtLeastOneRef());
-
-    listener_->OnMessageReceived(*message);
-    delete message;
-    return true;
-  }
-
   bool SendRequestToNetworkService(
       const GURL& url,
       mojo::PendingRemote<network::mojom::ProxyLookupClient>
@@ -62,86 +52,50 @@ class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
   }
 
  protected:
-  ~TestResolveProxyMsgHelper() override {}
-
-  IPC::Listener* listener_;
+  ~TestResolveProxyHelper() override = default;
 
   bool fail_to_send_request_ = false;
 
   mojo::Remote<network::mojom::ProxyLookupClient>* proxy_lookup_client_;
   GURL pending_url_;
 
-  DISALLOW_COPY_AND_ASSIGN(TestResolveProxyMsgHelper);
+  DISALLOW_COPY_AND_ASSIGN(TestResolveProxyHelper);
 };
 
-class ResolveProxyMsgHelperTest : public testing::Test, public IPC::Listener {
+class ResolveProxyHelperTest : public testing::Test {
  public:
   struct PendingResult {
-    PendingResult(bool result,
-                  const std::string& proxy_list)
-        : result(result), proxy_list(proxy_list) {
-    }
+    PendingResult(bool result, const std::string& proxy_list)
+        : result(result), proxy_list(proxy_list) {}
 
     bool result;
     std::string proxy_list;
   };
 
-  ResolveProxyMsgHelperTest()
-      : helper_(base::MakeRefCounted<TestResolveProxyMsgHelper>(
-            this,
-            &proxy_lookup_client_)) {
-    test_sink_.AddFilter(this);
-  }
+  ResolveProxyHelperTest()
+      : helper_(base::MakeRefCounted<TestResolveProxyHelper>(
+            &proxy_lookup_client_)) {}
 
  protected:
-  const PendingResult* pending_result() const { return pending_result_.get(); }
-
-  void clear_pending_result() {
-    pending_result_.reset();
-  }
-
-  IPC::Message* GenerateReply() {
-    bool temp_bool;
-    std::string temp_string;
-    ViewHostMsg_ResolveProxy message(GURL(), &temp_bool, &temp_string);
-    return IPC::SyncMessage::GenerateReply(&message);
-  }
-
-  bool OnMessageReceived(const IPC::Message& msg) override {
-    ViewHostMsg_ResolveProxy::ReplyParam reply_data;
-    EXPECT_TRUE(ViewHostMsg_ResolveProxy::ReadReplyParam(&msg, &reply_data));
-    DCHECK(!pending_result_.get());
-    pending_result_.reset(
-        new PendingResult(std::get<0>(reply_data), std::get<1>(reply_data)));
-    test_sink_.ClearMessages();
-    return true;
-  }
-
   BrowserTaskEnvironment task_environment_;
-
-  scoped_refptr<TestResolveProxyMsgHelper> helper_;
-  std::unique_ptr<PendingResult> pending_result_;
-
+  scoped_refptr<TestResolveProxyHelper> helper_;
   mojo::Remote<network::mojom::ProxyLookupClient> proxy_lookup_client_;
-
-  IPC::TestSink test_sink_;
 };
 
 // Issue three sequential requests -- each should succeed.
-TEST_F(ResolveProxyMsgHelperTest, Sequential) {
+TEST_F(ResolveProxyHelperTest, Sequential) {
   GURL url1("http://www.google1.com/");
   GURL url2("http://www.google2.com/");
   GURL url3("http://www.google3.com/");
 
-  // Messages are deleted by the sink.
-  IPC::Message* msg1 = GenerateReply();
-  IPC::Message* msg2 = GenerateReply();
-  IPC::Message* msg3 = GenerateReply();
-
   // Execute each request sequentially (so there are never 2 requests
   // outstanding at the same time).
-
-  helper_->OnResolveProxy(url1, msg1);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url1,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // There should be a pending proxy lookup request. Respond to it.
   EXPECT_EQ(url1, helper_->pending_url());
@@ -153,11 +107,15 @@ TEST_F(ResolveProxyMsgHelperTest, Sequential) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result1:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result1:80", result_proxy_list.value());
+  result_proxy_list.reset();
 
-  helper_->OnResolveProxy(url2, msg2);
+  helper_->ResolveProxy(url2,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   EXPECT_EQ(url2, helper_->pending_url());
   ASSERT_TRUE(proxy_lookup_client_);
@@ -167,11 +125,15 @@ TEST_F(ResolveProxyMsgHelperTest, Sequential) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result2:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result2:80", result_proxy_list.value());
+  result_proxy_list.reset();
 
-  helper_->OnResolveProxy(url3, msg3);
+  helper_->ResolveProxy(url3,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   EXPECT_EQ(url3, helper_->pending_url());
   ASSERT_TRUE(proxy_lookup_client_);
@@ -180,26 +142,33 @@ TEST_F(ResolveProxyMsgHelperTest, Sequential) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result3:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result3:80", result_proxy_list.value());
 }
 
 // Issue a request while one is already in progress -- should be queued.
-TEST_F(ResolveProxyMsgHelperTest, QueueRequests) {
+TEST_F(ResolveProxyHelperTest, QueueRequests) {
   GURL url1("http://www.google1.com/");
   GURL url2("http://www.google2.com/");
   GURL url3("http://www.google3.com/");
 
-  IPC::Message* msg1 = GenerateReply();
-  IPC::Message* msg2 = GenerateReply();
-  IPC::Message* msg3 = GenerateReply();
-
   // Start three requests. All the requests will be pending.
-
-  helper_->OnResolveProxy(url1, msg1);
-  helper_->OnResolveProxy(url2, msg2);
-  helper_->OnResolveProxy(url3, msg3);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url1,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
+  helper_->ResolveProxy(url2,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
+  helper_->ResolveProxy(url3,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // Complete first request.
   EXPECT_EQ(url1, helper_->pending_url());
@@ -211,9 +180,9 @@ TEST_F(ResolveProxyMsgHelperTest, QueueRequests) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result1:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result1:80", result_proxy_list.value());
+  result_proxy_list.reset();
 
   // Complete second request.
   EXPECT_EQ(url2, helper_->pending_url());
@@ -224,9 +193,9 @@ TEST_F(ResolveProxyMsgHelperTest, QueueRequests) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result2:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result2:80", result_proxy_list.value());
+  result_proxy_list.reset();
 
   // Complete third request.
   EXPECT_EQ(url3, helper_->pending_url());
@@ -236,28 +205,35 @@ TEST_F(ResolveProxyMsgHelperTest, QueueRequests) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(true, pending_result()->result);
-  EXPECT_EQ("PROXY result3:80", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_TRUE(result_proxy_list.has_value());
+  EXPECT_EQ("PROXY result3:80", result_proxy_list.value());
 }
 
 // Delete the helper while a request is in progress and others are pending.
-TEST_F(ResolveProxyMsgHelperTest, CancelPendingRequests) {
+TEST_F(ResolveProxyHelperTest, CancelPendingRequests) {
   GURL url1("http://www.google1.com/");
   GURL url2("http://www.google2.com/");
   GURL url3("http://www.google3.com/");
 
-  // They will be deleted by the request's cancellation.
-  IPC::Message* msg1 = GenerateReply();
-  IPC::Message* msg2 = GenerateReply();
-  IPC::Message* msg3 = GenerateReply();
-
   // Start three requests. Since the proxy resolver is async, all the
   // requests will be pending.
 
-  helper_->OnResolveProxy(url1, msg1);
-  helper_->OnResolveProxy(url2, msg2);
-  helper_->OnResolveProxy(url3, msg3);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url1,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
+  helper_->ResolveProxy(url2,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
+  helper_->ResolveProxy(url3,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // Check the first request is pending.
   EXPECT_EQ(url1, helper_->pending_url());
@@ -281,20 +257,22 @@ TEST_F(ResolveProxyMsgHelperTest, CancelPendingRequests) {
   EXPECT_TRUE(!proxy_lookup_client_.is_bound() ||
               !proxy_lookup_client_.is_connected());
   // The result should not have been sent.
-  EXPECT_FALSE(pending_result());
+  EXPECT_FALSE(result_proxy_list.has_value());
 
   // It should also be the case that msg1, msg2, msg3 were deleted by the
   // cancellation. (Else will show up as a leak).
 }
 
 // Issue a request that fails.
-TEST_F(ResolveProxyMsgHelperTest, RequestFails) {
+TEST_F(ResolveProxyHelperTest, RequestFails) {
   GURL url("http://www.google.com/");
 
-  // Message will be deleted by the sink.
-  IPC::Message* msg = GenerateReply();
-
-  helper_->OnResolveProxy(url, msg);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // There should be a pending proxy lookup request. Respond to it.
   EXPECT_EQ(url, helper_->pending_url());
@@ -303,19 +281,19 @@ TEST_F(ResolveProxyMsgHelperTest, RequestFails) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(false, pending_result()->result);
-  EXPECT_EQ("", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_FALSE(result_proxy_list.has_value());
 }
 
 // Issue a request, only to have the Mojo pipe closed.
-TEST_F(ResolveProxyMsgHelperTest, PipeClosed) {
+TEST_F(ResolveProxyHelperTest, PipeClosed) {
   GURL url("http://www.google.com/");
 
-  // Message will be deleted by the sink.
-  IPC::Message* msg = GenerateReply();
-
-  helper_->OnResolveProxy(url, msg);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // There should be a pending proxy lookup request. Respond to it by closing
   // the pipe.
@@ -325,40 +303,40 @@ TEST_F(ResolveProxyMsgHelperTest, PipeClosed) {
   base::RunLoop().RunUntilIdle();
 
   // Check result.
-  EXPECT_EQ(false, pending_result()->result);
-  EXPECT_EQ("", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_FALSE(result_proxy_list.has_value());
 }
 
 // Fail to send a request to the network service.
-TEST_F(ResolveProxyMsgHelperTest, FailToSendRequest) {
+TEST_F(ResolveProxyHelperTest, FailToSendRequest) {
   GURL url("http://www.google.com/");
 
-  // Message will be deleted by the sink.
-  IPC::Message* msg = GenerateReply();
-
   helper_->set_fail_to_send_request(true);
 
-  helper_->OnResolveProxy(url, msg);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
   // No request should be pending.
   EXPECT_TRUE(helper_->pending_url().is_empty());
 
   // Check result.
-  EXPECT_EQ(false, pending_result()->result);
-  EXPECT_EQ("", pending_result()->proxy_list);
-  clear_pending_result();
+  EXPECT_FALSE(result_proxy_list.has_value());
 }
 
 // Make sure if mojo callback is invoked after last externally owned reference
 // is released, there is no crash.
 // Regression test for https://crbug.com/870675
-TEST_F(ResolveProxyMsgHelperTest, Lifetime) {
+TEST_F(ResolveProxyHelperTest, Lifetime) {
   GURL url("http://www.google1.com/");
 
-  // Messages are deleted by the sink.
-  IPC::Message* msg = GenerateReply();
-
-  helper_->OnResolveProxy(url, msg);
+  base::Optional<std::string> result_proxy_list;
+  helper_->ResolveProxy(url,
+                        base::BindLambdaForTesting(
+                            [&](const base::Optional<std::string>& proxy_list) {
+                              result_proxy_list = proxy_list;
+                            }));
 
   // There should be a pending proxy lookup request. Respond to it.
   EXPECT_EQ(url, helper_->pending_url());
@@ -382,7 +360,7 @@ TEST_F(ResolveProxyMsgHelperTest, Lifetime) {
   EXPECT_TRUE(!proxy_lookup_client_.is_bound() ||
               !proxy_lookup_client_.is_connected());
   // The result should not have been sent.
-  EXPECT_FALSE(pending_result());
+  EXPECT_FALSE(result_proxy_list.has_value());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/resource_context_impl.cc b/chromium/content/browser/resource_context_impl.cc
index 005dc4d2f55..270ae2d0ed6 100644
--- a/chromium/content/browser/resource_context_impl.cc
+++ b/chromium/content/browser/resource_context_impl.cc
@@ -4,37 +4,17 @@
 
 #include "content/browser/resource_context_impl.h"
 
-#include <stdint.h>
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "content/browser/webui/url_data_manager_backend.h"
 #include "content/public/browser/browser_context.h"
-#include "content/public/browser/browser_thread.h"
 
 using base::UserDataAdapter;
 
 namespace content {
 
-// Key names on ResourceContext.
-const char kURLDataManagerBackendKeyName[] = "url_data_manager_backend";
-
 ResourceContext::ResourceContext() {}
 
 ResourceContext::~ResourceContext() {
 }
 
-URLDataManagerBackend* GetURLDataManagerForResourceContext(
-    ResourceContext* context) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  if (!context->GetUserData(kURLDataManagerBackendKeyName)) {
-    context->SetUserData(kURLDataManagerBackendKeyName,
-                         std::make_unique<URLDataManagerBackend>());
-  }
-  return static_cast<URLDataManagerBackend*>(
-      context->GetUserData(kURLDataManagerBackendKeyName));
-}
-
 void InitializeResourceContext(BrowserContext* browser_context) {
   ResourceContext* resource_context = browser_context->GetResourceContext();
 
diff --git a/chromium/content/browser/resource_context_impl.h b/chromium/content/browser/resource_context_impl.h
index bf225e29d41..ddf75862414 100644
--- a/chromium/content/browser/resource_context_impl.h
+++ b/chromium/content/browser/resource_context_impl.h
@@ -11,15 +11,11 @@
 namespace content {
 
 class BrowserContext;
-class URLDataManagerBackend;
 
 // Getters for objects that are part of BrowserContext which are also used on
 // the IO thread. These are only accessed by content so they're not on the
 // public API.
 
-URLDataManagerBackend* GetURLDataManagerForResourceContext(
-    ResourceContext* context);
-
 // Initialize the above data on the ResourceContext from a given BrowserContext.
 CONTENT_EXPORT void InitializeResourceContext(BrowserContext* browser_context);
 
diff --git a/chromium/content/browser/resource_loading_browsertest.cc b/chromium/content/browser/resource_loading_browsertest.cc
index f04dbfe8d33..55ca905a61d 100644
--- a/chromium/content/browser/resource_loading_browsertest.cc
+++ b/chromium/content/browser/resource_loading_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include <stdlib.h>
 
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/resources/appcache/appcache_internals.css b/chromium/content/browser/resources/appcache/appcache_internals.css
index eb3908a3e24..2daa6f5961d 100644
--- a/chromium/content/browser/resources/appcache/appcache_internals.css
+++ b/chromium/content/browser/resources/appcache/appcache_internals.css
@@ -86,7 +86,3 @@
 .appcache-details td {
   width: 80px;
 }
-
-.appcache-details td.token-expires {
-  width: 500px;
-}
diff --git a/chromium/content/browser/resources/appcache/appcache_internals.html b/chromium/content/browser/resources/appcache/appcache_internals.html
index 951164fd6b7..f8ab5963a7d 100644
--- a/chromium/content/browser/resources/appcache/appcache_internals.html
+++ b/chromium/content/browser/resources/appcache/appcache_internals.html
@@ -104,7 +104,6 @@
             <th>Response</th>
             <th>Padding</th>
             <th>Properties</th>
-            <th>Token Expires</th>
           </tr>
         </thead>
         <tbody class="appcache-details"
@@ -119,9 +118,6 @@
             <td jscontent="responseSize"></td>
             <td jscontent="paddingSize"></td>
             <td jscontent="properties"></td>
-            <td class="token-expires" jscontent=
-              "tokenExpires ? new Date(tokenExpires) : '(unset)'">
-            </td>
           </tr>
         </tbody>
       </table>
diff --git a/chromium/content/browser/resources/appcache/appcache_internals.js b/chromium/content/browser/resources/appcache/appcache_internals.js
index 12eccae9eea..0003fe0a8b0 100644
--- a/chromium/content/browser/resources/appcache/appcache_internals.js
+++ b/chromium/content/browser/resources/appcache/appcache_internals.js
@@ -174,7 +174,6 @@ cr.define('appcache', function() {
         properties: properties,
         fileUrl: details.url,
         responseId: details.responseId,
-        tokenExpires: details.tokenExpires,
       });
     }
     return simpleVector;
diff --git a/chromium/content/browser/resources/conversions/OWNERS b/chromium/content/browser/resources/conversions/OWNERS
new file mode 100644
index 00000000000..d87b7f2fc74
--- /dev/null
+++ b/chromium/content/browser/resources/conversions/OWNERS
@@ -0,0 +1,4 @@
+file://content/browser/conversions/OWNERS
+
+# TEAM: privacy-sandbox-dev@chromium.org
+# COMPONENT: Internals>ConversionMeasurement
diff --git a/chromium/content/browser/resources/conversions/conversion_internals.css b/chromium/content/browser/resources/conversions/conversion_internals.css
new file mode 100644
index 00000000000..430398243ba
--- /dev/null
+++ b/chromium/content/browser/resources/conversions/conversion_internals.css
@@ -0,0 +1,75 @@
+/* Copyright 2020 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+* {
+  box-sizing: border-box;
+}
+
+html {
+  height: 100%;
+}
+
+body {
+  color: rgb(48, 57, 66);
+  display: flex;
+  flex-direction: column;
+  font-family: Roboto, sans-seriif;
+  font-size: 13px;
+  height: 100%;
+  margin: 15px;
+  overflow: auto;
+}
+
+#page-heading {
+  color: rgb(92, 97, 102);
+  font-size: 1.5rem;
+  padding-bottom: 10px;
+}
+
+#feature-status-content {
+  font-weight: bold;
+}
+
+.content {
+  background-color: #fbfbfb;
+  border: 1px solid #cecece;
+  border-radius: 3px;
+  line-height: 1.5;
+  padding: 19px;
+}
+
+.table-wrapper {
+  background-color: #fff;
+  border-color: rgba(0,0,0,.12);
+  border-radius: 4px;
+  border-style: solid;
+  border-width: 1px;
+  display: inline-block;
+
+}
+
+table {
+  border: 0;
+  border-collapse: collapse;
+}
+
+table tr {
+  border-top-color: rgba(0,0,0,.12);
+  border-top-style: solid;
+  border-top-width: 1px;
+}
+
+.header-row {
+  border: 0;
+}
+
+table td,
+table th {
+  padding-inline-end: 16px;
+  padding-inline-start: 16px;
+}
+
+button {
+  font: inherit;
+}
diff --git a/chromium/content/browser/resources/conversions/conversion_internals.html b/chromium/content/browser/resources/conversions/conversion_internals.html
new file mode 100644
index 00000000000..4513c8bb6e1
--- /dev/null
+++ b/chromium/content/browser/resources/conversions/conversion_internals.html
@@ -0,0 +1,135 @@
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+   Use of this source code is governed by a BSD-style license that can be
+   found in the LICENSE file.-->
+<!doctype html>
+<html dir="ltr" lang="en">
+<head>
+  <meta charset="utf-8">
+  <link rel="stylesheet" href="chrome://resources/css/text_defaults.css">
+  <link rel="stylesheet" href="chrome://resources/css/roboto.css">
+  <script src="chrome://resources/js/util.js"></script>
+  <script src="chrome://resources/js/cr.js"></script>
+  <script src="chrome://resources/js/cr/ui.js"></script>
+  <script src="chrome://resources/js/cr/ui/tree.js"></script>
+
+  <script src="chrome://resources/mojo/mojo/public/js/mojo_bindings_lite.js">
+  </script>
+  <script src="chrome://resources/mojo/mojo/public/mojom/base/unguessable_token.mojom-lite.js"></script>
+  <script src="chrome://resources/mojo/url/mojom/url.mojom-lite.js"></script>
+  <script src="chrome://resources/mojo/url/mojom/origin.mojom-lite.js"></script>
+
+  <link rel="stylesheet" href="conversion_internals.css">
+  <script src="conversion_internals.mojom-lite.js"></script>
+  <script src="conversion_internals.js"></script>
+  <title>Conversion Internals</title>
+</head>
+<body>
+
+<div id="page-heading">
+  Conversion Internals
+</div>
+<div id="page-content">
+  <h2> General Info </h2>
+  <div class="content">
+    <div>
+      Conversion measurement is currently <span id="feature-status-content"></span>.
+      For a detailed explanation of the API and it's behavior, see
+      <a href="https://github.com/WICG/conversion-measurement-api/blob/master/README.md" target="_blank">
+        the explainer
+      </a>.
+    </div>
+    <div>
+      <button id="refresh">Refresh all page data</button>
+      <button id="clear-data">Clear all conversions data</button>
+    </div>
+  </div>
+  <h2> Active Impressions </h2>
+  <div class="content">
+    <div class="table-wrapper">
+      <table id="impression-table">
+        <thead>
+          <tr class="header-row">
+            <th>
+            Impression Data
+            </th>
+            <th>
+              Impression origin
+            </th>
+            <th>
+              Conversion Destination
+            </th>
+            <th>
+              Reporting Origin
+            </th>
+            <th>
+              Impression Time
+            </th>
+            <th>
+              Expiry Time
+            </th>
+          </tr>
+        </thead>
+        <tbody id="impression-table-body">
+        </tbody>
+      </table>
+    </div>
+  </div>
+  <h2> Pending Reports </h2>
+  <div class="content">
+    <div class="table-wrapper">
+      <table id="report-table">
+        <thead>
+          <tr class="header-row">
+            <th>
+              Impression Data
+            </th>
+            <th>
+              Conversion Data
+            </th>
+            <th>
+              Conversion Origin
+            </th>
+            <th>
+              Reporting Origin
+            </th>
+            <th>
+              Report Time
+            </th>
+            <th>
+              Attribution Credit
+            </th>
+          </tr>
+        </thead>
+        <tbody id="report-table-body">
+        </tbody>
+      </table>
+    </div>
+    <div>
+      <button id="send-reports">Send All Reports</button>
+    </div>
+  </div>
+</div>
+
+<template id="impressionrow">
+  <tr>
+    <td class="impression-data-cell"></td>
+    <td class="impression-origin-cell"></td>
+    <td class="conversion-destination-cell"></td>
+    <td class="reporting-origin-cell"></td>
+    <td class="impression-time-cell"></td>
+    <td class="expiry-time-cell"></td>
+  </tr>
+</template>
+
+<template id="reportrow">
+  <tr>
+    <td class="impression-data-cell"></td>
+    <td class="conversion-data-cell"></td>
+    <td class="conversion-origin-cell"></td>
+    <td class="reporting-origin-cell"></td>
+    <td class="report-time-cell"></td>
+    <td class="attibution-credit-cell"></td>
+  </tr>
+</template>
+</body>
+</html>
diff --git a/chromium/content/browser/resources/conversions/conversion_internals.js b/chromium/content/browser/resources/conversions/conversion_internals.js
new file mode 100644
index 00000000000..9b87dfdf1ea
--- /dev/null
+++ b/chromium/content/browser/resources/conversions/conversion_internals.js
@@ -0,0 +1,187 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+'use strict';
+
+/**
+ * Reference to the backend providing all the data.
+ * @type {mojom.ConversionInternalsHandlerRemote}
+ */
+let pageHandler = null;
+
+/**
+ * All impressions held in storage at last update.
+ * @type {!Array<!mojom.Impression>}
+ */
+let impressions = null;
+
+/**
+ * All impressions held in storage at last update.
+ * @type {!Array<!mojom.Impression>}
+ */
+let reports = null;
+
+/**
+ * Remove all rows from the given table.
+ * @param {!HTMLElement} table DOM element corresponding to table body.
+ */
+function clearTable(table) {
+  table.innerHTML = '';
+}
+
+/**
+ * Converts a mojo origin into a user-readable string, omitting default ports.
+ * @param {url.mojom.Origin} origin Origin to convert
+ * @return {string}
+ */
+function UrlToText(origin) {
+  if (origin.host.length == 0) {
+    return 'Null';
+  }
+
+  let result = origin.scheme + '://' + origin.host;
+
+  if (origin.scheme == 'https' && origin.port != '443') {
+    result += ':' + origin.port;
+  }
+  return result;
+}
+
+/**
+ * Creates a single row for the impression table.
+ * @param {!mojom.Impression} impression The info to create the row.
+ * @return {!HTMLElement}
+ */
+function createImpressionRow(impression) {
+  const template = $('impressionrow').cloneNode(true);
+  const td = template.content.querySelectorAll('td');
+
+  td[0].textContent = '0x' + impression.impressionData;
+  td[1].textContent = UrlToText(impression.impressionOrigin);
+  td[2].textContent = UrlToText(impression.conversionDestination);
+  td[3].textContent = UrlToText(impression.reportingOrigin);
+  td[4].textContent = new Date(impression.impressionTime).toLocaleString();
+  td[5].textContent = new Date(impression.expiryTime).toLocaleString();
+  return document.importNode(template.content, true);
+}
+
+/**
+ * Creates a single row for the impression table.
+ * @param {!mojom.Impression} impression The info to create the row.
+ * @return {!HTMLElement}
+ */
+function createReportRow(report) {
+  const template = $('reportrow').cloneNode(true);
+  const td = template.content.querySelectorAll('td');
+
+  td[0].textContent = '0x' + report.impressionData;
+  td[1].textContent = '0x' + report.conversionData;
+  td[2].textContent = UrlToText(report.conversionOrigin);
+  td[3].textContent = UrlToText(report.reportingOrigin);
+  td[4].textContent = new Date(report.reportTime).toLocaleString();
+  td[5].textContent = report.attributionCredit;
+  return document.importNode(template.content, true);
+}
+
+/**
+ * Regenerates the impression table from |impressions|.
+ */
+function renderImpressionTable() {
+  const impressionTable = $('impression-table-body');
+  clearTable(impressionTable);
+  impressions.forEach(
+      impression =>
+          impressionTable.appendChild(createImpressionRow(impression)));
+
+  // If there are no impressions, add an empty row to indicate the table is
+  // purposefully empty.
+  if (!impressions.length) {
+    const template = $('impressionrow').cloneNode(true);
+    const td = template.content.querySelectorAll('td');
+    td[0].textContent = 'No active impressions.';
+    impressionTable.appendChild(document.importNode(template.content, true));
+  }
+}
+
+/**
+ * Regenerates the report table from |reports|.
+ */
+function renderReportTable() {
+  const reportTable = $('report-table-body');
+  clearTable(reportTable);
+  reports.forEach(report => reportTable.appendChild(createReportRow(report)));
+
+  // If there are no reports, add an empty row to indicate the table is
+  // purposefully empty.
+  if (!reports.length) {
+    const template = $('reportrow').cloneNode(true);
+    const td = template.content.querySelectorAll('td');
+    td[0].textContent = 'No pending reports.';
+    reportTable.appendChild(document.importNode(template.content, true));
+  }
+}
+
+/**
+ * Fetch all active impressions and pending reports from the backend and
+ * populate the tables. Also update measurement enabled status.
+ */
+function updatePageData() {
+  // Get the feature status for ConversionMeasurement and populate it.
+  pageHandler.isMeasurementEnabled().then((response) => {
+    $('feature-status-content').innerText =
+        response.enabled ? 'enabled' : 'disabled';
+  });
+
+  pageHandler.getActiveImpressions().then((response) => {
+    impressions = response.impressions;
+    renderImpressionTable();
+  });
+
+  pageHandler.getPendingReports().then((response) => {
+    reports = response.reports;
+    renderReportTable();
+  });
+}
+
+/**
+ * Deletes all data stored by the conversions backend, and refreshes
+ * page data once this operation has finished.
+ */
+function clearStorage() {
+  pageHandler.clearStorage().then(() => {
+    updatePageData();
+  });
+}
+
+/**
+ * Sends all conversion reports, and updates the page once they are sent.
+ * Disables the button while the reports are still being sent.
+ */
+function sendReports() {
+  const button = $('send-reports');
+  const previousText = $('send-reports').innerText;
+
+  button.disabled = true;
+  button.innerText = 'Sending...';
+  pageHandler.sendPendingReports().then(() => {
+    updatePageData();
+    button.disabled = false;
+    button.innerText = previousText;
+  });
+}
+
+document.addEventListener('DOMContentLoaded', function() {
+  // Setup the mojo interface.
+  pageHandler = mojom.ConversionInternalsHandler.getRemote();
+
+  $('refresh').addEventListener('click', updatePageData);
+  $('clear-data').addEventListener('click', clearStorage);
+  $('send-reports').addEventListener('click', sendReports);
+
+  // Automatically refresh every 2 minutes.
+  setInterval(updatePageData, 2 * 60 * 1000);
+  updatePageData();
+});
+})();
diff --git a/chromium/content/browser/resources/gpu/info_view.css b/chromium/content/browser/resources/gpu/info_view.css
index c3efb625d1b..0709d98218d 100644
--- a/chromium/content/browser/resources/gpu/info_view.css
+++ b/chromium/content/browser/resources/gpu/info_view.css
@@ -67,6 +67,10 @@
   color: rgb(128, 128, 128);
 }
 
+#info-view .bg-yellow {
+  background-color: yellow;
+}
+
 #vulkan-info-value {
   white-space: pre;
 }
diff --git a/chromium/content/browser/resources/gpu/info_view.js b/chromium/content/browser/resources/gpu/info_view.js
index f5f54ef30c4..8499070823b 100644
--- a/chromium/content/browser/resources/gpu/info_view.js
+++ b/chromium/content/browser/resources/gpu/info_view.js
@@ -358,7 +358,15 @@ cr.define('gpu', function() {
 
       // Description of issue
       const desc = document.createElement('a');
-      desc.textContent = problem.description;
+      let text = problem.description;
+      const pattern = ' Please update your graphics driver via this link: ';
+      const pos = text.search(pattern);
+      let url = '';
+      if (pos > 0) {
+        url = text.substring(pos + pattern.length);
+        text = text.substring(0, pos);
+      }
+      desc.textContent = text;
       problemEl.appendChild(desc);
 
       // Spacing ':' element
@@ -418,6 +426,25 @@ cr.define('gpu', function() {
         }
       }
 
+      // Append driver update link.
+      if (pos > 0) {
+        const brNode = document.createElement('br');
+        problemEl.appendChild(brNode);
+
+        const bNode = document.createElement('b');
+        bNode.classList.add('bg-yellow');
+        problemEl.appendChild(bNode);
+
+        const tmp = document.createElement('span');
+        tmp.textContent = 'Please update your graphics driver via ';
+        bNode.appendChild(tmp);
+
+        const link = document.createElement('a');
+        link.textContent = 'this link';
+        link.href = url;
+        bNode.appendChild(link);
+      }
+
       return problemEl;
     },
 
diff --git a/chromium/content/browser/resources/histograms/histograms_internals.html b/chromium/content/browser/resources/histograms/histograms_internals.html
index 37e45404843..4e224a80b30 100644
--- a/chromium/content/browser/resources/histograms/histograms_internals.html
+++ b/chromium/content/browser/resources/histograms/histograms_internals.html
@@ -16,4 +16,5 @@
 </p>
 <button id="refresh">Refresh</button>
 <div id="histograms"></div>
+<template id="histogram-template"><pre><h4></h4><p></p></pre><br><hr><br></template>
 </html>
diff --git a/chromium/content/browser/resources/histograms/histograms_internals.js b/chromium/content/browser/resources/histograms/histograms_internals.js
index 24c55fb23c9..8069d46c206 100644
--- a/chromium/content/browser/resources/histograms/histograms_internals.js
+++ b/chromium/content/browser/resources/histograms/histograms_internals.js
@@ -15,18 +15,19 @@ function requestHistograms() {
 
 /**
  * Callback from backend with the list of histograms. Builds the UI.
- * @param {!Array<string>} histograms A list of trusted HTML strings
- *     representing histograms.
+ * @param {!Array<{header: string, body: string}>} histograms A list
+ *     of header and body strings representing histograms.
  */
 function addHistograms(histograms) {
-  let htmlOutput = '';
+  // TBD(jar) Write a nice HTML bar chart, with divs an mouse-overs etc.
   for (const histogram of histograms) {
-    htmlOutput += histogram;
-  }
+    const {header, body} = histogram;
+    const clone = $('histogram-template').content.cloneNode(true);
 
-  // NOTE: This is generally unsafe due to XSS attacks. Make sure |htmlOutput|
-  // cannot be modified by an external party.
-  $('histograms').innerHTML = htmlOutput;
+    clone.querySelector('h4').textContent = header;
+    clone.querySelector('p').textContent = body;
+    $('histograms').appendChild(clone);
+  }
 }
 
 /**
diff --git a/chromium/content/browser/resources/media/manager_experiment_disabler.js b/chromium/content/browser/resources/media/manager_experiment_disabler.js
deleted file mode 100644
index a91c1062d65..00000000000
--- a/chromium/content/browser/resources/media/manager_experiment_disabler.js
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-/**
- * @fileoverview Keeps track of all the existing PlayerInfo and
- * audio stream objects and is the entry-point for messages from the backend.
- *
- * The events captured by Manager (add, remove, update) are relayed
- * to the clientRenderer which it can choose to use to modify the UI.
- */
-var Manager = (function() {
-  'use strict';
-
-  function createChild(parent, tag) {
-    const node = document.createElement(tag);
-    parent.appendChild(node);
-    node.createTextNode = function(text) {
-      const textNode = document.createTextNode(text);
-      node.appendChild(textNode);
-    };
-    return node;
-  }
-
-  function CreateNotice() {
-    const newContents = document.createElement('div');
-    createChild(newContents, 'h1')
-        .createTextNode('Media Internals Is being moved to devtools!');
-    createChild(newContents, 'h3').createTextNode('Here\'s how to use it:');
-
-    const directions = createChild(newContents, 'ol');
-
-    createChild(directions, 'li')
-        .createTextNode('In devtools (F12) press F1 (open settings).');
-    createChild(directions, 'li')
-        .createTextNode(
-            'Select the "Experiments" tab on the side,' +
-            ' and check the "Media Element Inspection" box');
-    createChild(directions, 'li')
-        .createTextNode(
-            'Restart devtools, and find "Media" under the "More Tools" menu.');
-    return newContents;
-  }
-
-  function Manager(clientRenderer) {
-    this.clientRenderer_ = clientRenderer;
-    // Remove contents and add message.
-    this.media_tab_ = $('players');
-    this.media_tab_.innerHTML = '';
-    this.media_tab_.appendChild(CreateNotice());
-  }
-
-  Manager.prototype = {};
-
-  return Manager;
-}());
diff --git a/chromium/content/browser/resources/media/media_internals.html b/chromium/content/browser/resources/media/media_internals.html
index a33cab63dff..70ad6b505a5 100644
--- a/chromium/content/browser/resources/media/media_internals.html
+++ b/chromium/content/browser/resources/media/media_internals.html
@@ -23,12 +23,11 @@ found in the LICENSE file.
   <div id="devtools-notice-window">
     <div>
     Media Internals functionality is now available in the media tab of the
-    developer tools. (click to dismiss)
+    developer tools.
     </div>
-      <div>
-      <a href="chrome://flags/#enable-media-internals-devtools">
-        To try it, enable the flag here.
-      </a>
+    <div>
+    Enable the experiment in devtools settings to try it!
+    (click to dismiss)
     </div>
   </div>
   <tabbox>
diff --git a/chromium/content/browser/resources/media/media_internals_disabled.js b/chromium/content/browser/resources/media/media_internals_disabled.js
deleted file mode 100644
index 61772987894..00000000000
--- a/chromium/content/browser/resources/media/media_internals_disabled.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var media = {};
-
-// <include src="main.js">
-// <include src="util.js">
-// <include src="player_info.js">
-// <include src="manager.js">
-// <include src="manager_experiment_disabler.js">
-// <include src="client_renderer.js">
-
-media.initialize(new Manager(new ClientRenderer()));
-if (cr.ui) {
-  cr.ui.decorate('tabbox', cr.ui.TabBox);
-}
diff --git a/chromium/content/browser/resources/media/media_internals_resources.grd b/chromium/content/browser/resources/media/media_internals_resources.grd
index cd3f5699b1b..09b41a4e56f 100644
--- a/chromium/content/browser/resources/media/media_internals_resources.grd
+++ b/chromium/content/browser/resources/media/media_internals_resources.grd
@@ -25,11 +25,6 @@
                flattenhtml="true"
                compress="gzip"
                type="BINDATA" />
-      <include name="IDR_MEDIA_INTERNALS_JS_DISABLED"
-               file="media_internals_disabled.js"
-               flattenhtml="true"
-               compress="gzip"
-               type="BINDATA" />
     </includes>
   </release>
 </grit>
diff --git a/chromium/content/browser/resources/process/process_internals.js b/chromium/content/browser/resources/process/process_internals.js
index b503b8efc2c..822fa3f5a2d 100644
--- a/chromium/content/browser/resources/process/process_internals.js
+++ b/chromium/content/browser/resources/process/process_internals.js
@@ -88,6 +88,9 @@ function getTreeViewRoot() {
 function frameToTreeItem(frame) {
   // Compose the string which will appear in the entry for this frame.
   let itemLabel = `Frame[${frame.processId}:${frame.routingId}]:`;
+  if (frame.isBfcached) {
+    itemLabel += ` bfcached`;
+  }
   itemLabel += ` SI:${frame.siteInstance.id}`;
   if (frame.siteInstance.locked) {
     itemLabel += ', locked';
@@ -139,11 +142,22 @@ function webContentsToTreeItem(webContents) {
   const result = frameToTreeItem(webContents.rootFrame);
   const rootItem = result[0];
   const count = result[1];
+  item.add(rootItem);
 
-  itemLabel += `${count} frame` + (count > 1 ? 's.' : '.');
+  // Add data for all root nodes retrieved from back-forward cache.
+  let cachedCount = 0;
+  for (const cachedRoot of webContents.bfcachedRootFrames) {
+    const cachedResult = frameToTreeItem(cachedRoot);
+    item.add(cachedResult[0]);
+    cachedCount++;
+  }
+
+  const totalCount = count + cachedCount;
+  itemLabel += `${totalCount} frame` + (totalCount > 1 ? 's, ' : ', ');
+  itemLabel += `(${count} active, ${cachedCount} bfcached root` +
+      (cachedCount > 1 ? 's' : ``) + `).`;
   item.label = itemLabel;
 
-  item.add(rootItem);
   return item;
 }
 
diff --git a/chromium/content/browser/sandbox_mac_unittest.mm b/chromium/content/browser/sandbox_mac_unittest.mm
index 0bee06a2857..ac7d17bcb46 100644
--- a/chromium/content/browser/sandbox_mac_unittest.mm
+++ b/chromium/content/browser/sandbox_mac_unittest.mm
@@ -229,9 +229,9 @@ MULTIPROCESS_TEST_MAIN(FontLoadingProcess) {
 
 TEST_F(SandboxMacTest, FontLoadingTest) {
   base::FilePath temp_file_path;
-  FILE* temp_file = base::CreateAndOpenTemporaryFile(&temp_file_path);
+  base::ScopedFILE temp_file =
+      base::CreateAndOpenTemporaryStream(&temp_file_path);
   ASSERT_TRUE(temp_file);
-  base::ScopedFILE temp_file_closer(temp_file);
 
   std::unique_ptr<FontLoader::ResultInternal> result =
       FontLoader::LoadFontForTesting(base::ASCIIToUTF16("Geeza Pro"), 16);
@@ -245,14 +245,14 @@ TEST_F(SandboxMacTest, FontLoadingTest) {
       result->font_data->Map(font_data_size);
   ASSERT_TRUE(mapping);
 
-  base::WriteFileDescriptor(fileno(temp_file),
+  base::WriteFileDescriptor(fileno(temp_file.get()),
                             static_cast<const char*>(mapping.get()),
                             font_data_size);
 
   extra_data_ = temp_file_path.value();
   ExecuteWithParams("FontLoadingProcess",
                     service_manager::SandboxType::kRenderer);
-  temp_file_closer.reset();
+  temp_file.reset();
   ASSERT_TRUE(base::DeleteFile(temp_file_path, false));
 }
 
diff --git a/chromium/content/browser/sandbox_parameters_mac.mm b/chromium/content/browser/sandbox_parameters_mac.mm
index 29825526728..93bf3c4314b 100644
--- a/chromium/content/browser/sandbox_parameters_mac.mm
+++ b/chromium/content/browser/sandbox_parameters_mac.mm
@@ -6,10 +6,10 @@
 
 #include <unistd.h>
 
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/files/file_util.h"
-#include "base/logging.h"
 #include "base/mac/bundle_locations.h"
 #include "base/mac/foundation_util.h"
 #include "base/mac/mac_util.h"
@@ -219,7 +219,7 @@ void SetupSandboxParameters(service_manager::SandboxType sandbox_type,
                             sandbox::SeatbeltExecClient* client) {
   switch (sandbox_type) {
     case service_manager::SandboxType::kAudio:
-    case service_manager::SandboxType::kSoda:
+    case service_manager::SandboxType::kSpeechRecognition:
     case service_manager::SandboxType::kNaClLoader:
     case service_manager::SandboxType::kPrintCompositor:
     case service_manager::SandboxType::kRenderer:
@@ -244,7 +244,7 @@ void SetupSandboxParameters(service_manager::SandboxType sandbox_type,
       SetupUtilitySandboxParameters(client, command_line);
       break;
     case service_manager::SandboxType::kNoSandbox:
-    case service_manager::SandboxType::kInvalid:
+    case service_manager::SandboxType::kVideoCapture:
       CHECK(false) << "Unhandled parameters for sandbox_type "
                    << static_cast<int>(sandbox_type);
   }
diff --git a/chromium/content/browser/scheduler/browser_ui_thread_scheduler.cc b/chromium/content/browser/scheduler/browser_ui_thread_scheduler.cc
index 0925f8f4c2b..b3617f92ecf 100644
--- a/chromium/content/browser/scheduler/browser_ui_thread_scheduler.cc
+++ b/chromium/content/browser/scheduler/browser_ui_thread_scheduler.cc
@@ -7,7 +7,6 @@
 #include <utility>
 
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_pump.h"
 #include "base/message_loop/message_pump_type.h"
diff --git a/chromium/content/browser/scheduler/responsiveness/calculator.cc b/chromium/content/browser/scheduler/responsiveness/calculator.cc
index 477d443b629..72479b7381a 100644
--- a/chromium/content/browser/scheduler/responsiveness/calculator.cc
+++ b/chromium/content/browser/scheduler/responsiveness/calculator.cc
@@ -141,7 +141,17 @@ void Calculator::TaskOrEventFinishedOnIOThread(
   }
 }
 
-void Calculator::EmitResponsiveness(JankType jank_type, size_t janky_slices) {
+void Calculator::SetProcessSuspended(bool suspended) {
+  // Keep track of the current power state.
+  is_process_suspended_ = suspended;
+  // Regardless of whether the process is entering or exiting suspension, the
+  // current 30-second interval should be flagged as containing suspended state.
+  was_process_suspended_ = true;
+}
+
+void Calculator::EmitResponsiveness(JankType jank_type,
+                                    size_t janky_slices,
+                                    bool was_process_suspended) {
   constexpr size_t kMaxJankySlices = 300;
   DCHECK_LE(janky_slices, kMaxJankySlices);
   switch (jank_type) {
@@ -149,6 +159,11 @@ void Calculator::EmitResponsiveness(JankType jank_type, size_t janky_slices) {
       UMA_HISTOGRAM_COUNTS_1000(
           "Browser.Responsiveness.JankyIntervalsPerThirtySeconds",
           janky_slices);
+      if (!was_process_suspended) {
+        UMA_HISTOGRAM_COUNTS_1000(
+            "Browser.Responsiveness.JankyIntervalsPerThirtySeconds.NoSuspend",
+            janky_slices);
+      }
       break;
     }
     case JankType::kQueueAndExecution: {
@@ -233,6 +248,7 @@ void Calculator::CalculateResponsivenessIfNecessary(
       last_calculation_time_, new_calculation_time);
 
   last_calculation_time_ = new_calculation_time;
+  was_process_suspended_ = is_process_suspended_;
 }
 
 void Calculator::CalculateResponsiveness(
@@ -261,7 +277,7 @@ void Calculator::CalculateResponsiveness(
       }
     }
 
-    EmitResponsiveness(jank_type, janky_slices.size());
+    EmitResponsiveness(jank_type, janky_slices.size(), was_process_suspended_);
 
     start_time = current_interval_end_time;
   }
diff --git a/chromium/content/browser/scheduler/responsiveness/calculator.h b/chromium/content/browser/scheduler/responsiveness/calculator.h
index 3b3ab07cad5..71e9ff02367 100644
--- a/chromium/content/browser/scheduler/responsiveness/calculator.h
+++ b/chromium/content/browser/scheduler/responsiveness/calculator.h
@@ -49,6 +49,9 @@ class CONTENT_EXPORT Calculator {
       base::TimeTicks execution_start_time,
       base::TimeTicks execution_finish_time);
 
+  // Change the Power state of the process. Must be called from the UI thread.
+  void SetProcessSuspended(bool suspended);
+
   // Each janking task/event is fully defined by |start_time| and |end_time|.
   // Note that |duration| = |end_time| - |start_time|.
   struct Jank {
@@ -67,7 +70,9 @@ class CONTENT_EXPORT Calculator {
  protected:
   // Emits an UMA metric for responsiveness of a single measurement interval.
   // Exposed for testing.
-  virtual void EmitResponsiveness(JankType jank_type, size_t janky_slices);
+  virtual void EmitResponsiveness(JankType jank_type,
+                                  size_t janky_slices,
+                                  bool was_process_suspended);
 
   // Exposed for testing.
   base::TimeTicks GetLastCalculationTime();
@@ -134,6 +139,14 @@ class CONTENT_EXPORT Calculator {
   bool is_application_visible_ = false;
 #endif
 
+  // Whether or not the process is suspended (Power management). Accessed only
+  // on the UI thread.
+  bool is_process_suspended_ = false;
+
+  // Stores whether to process was suspended since last metric computation.
+  // Accessed only on the UI thread.
+  bool was_process_suspended_ = false;
+
   // We expect there to be low contention and this lock to cause minimal
   // overhead. If performance of this lock proves to be a problem, we can move
   // to a lock-free data structure.
diff --git a/chromium/content/browser/scheduler/responsiveness/calculator_unittest.cc b/chromium/content/browser/scheduler/responsiveness/calculator_unittest.cc
index a68cc07010a..41599e691ef 100644
--- a/chromium/content/browser/scheduler/responsiveness/calculator_unittest.cc
+++ b/chromium/content/browser/scheduler/responsiveness/calculator_unittest.cc
@@ -22,8 +22,10 @@ constexpr int kJankThresholdInMs = 100;
 
 class FakeCalculator : public Calculator {
  public:
-  MOCK_METHOD2(EmitResponsiveness,
-               void(JankType jank_type, size_t janky_slices));
+  MOCK_METHOD3(EmitResponsiveness,
+               void(JankType jank_type,
+                    size_t janky_slices,
+                    bool was_process_suspended));
 
   using Calculator::GetLastCalculationTime;
 };
@@ -83,10 +85,10 @@ class ResponsivenessCalculatorTest : public testing::Test {
 
 #define EXPECT_EXECUTION_JANKY_SLICES(num_slices) \
   EXPECT_CALL(*calculator_,                       \
-              EmitResponsiveness(JankType::kExecution, num_slices));
-#define EXPECT_QUEUE_AND_EXECUTION_JANKY_SLICES(num_slices) \
-  EXPECT_CALL(*calculator_,                                 \
-              EmitResponsiveness(JankType::kQueueAndExecution, num_slices));
+              EmitResponsiveness(JankType::kExecution, num_slices, false));
+#define EXPECT_QUEUE_AND_EXECUTION_JANKY_SLICES(num_slices)                  \
+  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kQueueAndExecution, \
+                                               num_slices, false));
 
 // A single event executing slightly longer than kJankThresholdInMs.
 TEST_F(ResponsivenessCalculatorTest, ShortExecutionJank) {
@@ -132,9 +134,8 @@ TEST_F(ResponsivenessCalculatorTest, LongExecutionJank) {
   constexpr int kFinishTime = kStartTime + 10 * kJankThresholdInMs + 5;
 
   AddEventUI(kQueueTime, kStartTime, kFinishTime);
-  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kExecution, 10U));
-  EXPECT_CALL(*calculator_,
-              EmitResponsiveness(JankType::kQueueAndExecution, 10U));
+  EXPECT_EXECUTION_JANKY_SLICES(10u);
+  EXPECT_QUEUE_AND_EXECUTION_JANKY_SLICES(10u);
   TriggerCalculation();
 }
 
@@ -146,8 +147,7 @@ TEST_F(ResponsivenessCalculatorTest, LongQueueJank) {
 
   AddEventUI(kQueueTime, kStartTime, kFinishTime);
   EXPECT_EXECUTION_JANKY_SLICES(0u);
-  EXPECT_CALL(*calculator_,
-              EmitResponsiveness(JankType::kQueueAndExecution, 10U));
+  EXPECT_QUEUE_AND_EXECUTION_JANKY_SLICES(10u);
   TriggerCalculation();
 }
 
@@ -346,7 +346,7 @@ TEST_F(ResponsivenessCalculatorTest, LongDelay) {
   base_time += 10 * kMeasurementIntervalInMs;
   AddEventUI(base_time, base_time, base_time + 1);
 
-  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _)).Times(0);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _, _)).Times(0);
 }
 
 // A long event means that the machine likely went to sleep.
@@ -354,7 +354,7 @@ TEST_F(ResponsivenessCalculatorTest, LongEvent) {
   int base_time = 105;
   AddEventUI(base_time, base_time, base_time + 10 * kMeasurementIntervalInMs);
 
-  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _)).Times(0);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _, _)).Times(0);
 }
 
 #if defined(OS_ANDROID)
@@ -371,11 +371,64 @@ TEST_F(ResponsivenessCalculatorTest, ApplicationInBackground) {
 
   AddEventUI(kQueueTime, kStartTime + 1, kFinishTime + 1);
 
-  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _)).Times(0);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(_, _, _)).Times(0);
   TriggerCalculation();
 }
 #endif
 
+// The suspended state must be passed to EmitResponsiveness(...).
+// A single event executing slightly longer than 10 * kJankThresholdInMs.
+TEST_F(ResponsivenessCalculatorTest, JankWithPowerSuspend) {
+  constexpr int kQueueTime = 35;
+  constexpr int kStartTime = 40;
+  constexpr int kFinishTime = kStartTime + 10 * kJankThresholdInMs + 5;
+
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kExecution, 10, false));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, false));
+  TriggerCalculation();
+
+  calculator_->SetProcessSuspended(true);
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kExecution, 10, true));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, true));
+  TriggerCalculation();
+
+  calculator_->SetProcessSuspended(false);
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kExecution, 10, true));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, true));
+  TriggerCalculation();
+
+  calculator_->SetProcessSuspended(true);
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  calculator_->SetProcessSuspended(false);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kExecution, 10, true));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, true));
+  TriggerCalculation();
+
+  // The whole slice must be flagged as containing suspend/resume events.
+  calculator_->SetProcessSuspended(true);
+  calculator_->SetProcessSuspended(false);
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  EXPECT_CALL(*calculator_, EmitResponsiveness(JankType::kExecution, 10, true));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, true));
+  TriggerCalculation();
+
+  AddEventUI(kQueueTime, kStartTime, kFinishTime);
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kExecution, 10, false));
+  EXPECT_CALL(*calculator_,
+              EmitResponsiveness(JankType::kQueueAndExecution, 10, false));
+  TriggerCalculation();
+}
+
 // An event execution that crosses a measurement interval boundary should count
 // towards both measurement intervals.
 TEST_F(ResponsivenessCalculatorTest, ExecutionCrossesBoundary) {
diff --git a/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest.mm b/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest.mm
index a6b35794912..b75caba9ff3 100644
--- a/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest.mm
+++ b/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest.mm
@@ -5,6 +5,7 @@
 #include "content/browser/scheduler/responsiveness/native_event_observer.h"
 
 #include "base/bind_helpers.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "ui/events/test/cocoa_test_event_utils.h"
 
diff --git a/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest_win.cc b/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest_win.cc
index 6596784b353..aee88711457 100644
--- a/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest_win.cc
+++ b/chromium/content/browser/scheduler/responsiveness/native_event_observer_browsertest_win.cc
@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/win/message_window.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 
 namespace content {
diff --git a/chromium/content/browser/scheduler/responsiveness/watcher.cc b/chromium/content/browser/scheduler/responsiveness/watcher.cc
index 4f4a6e4337d..77d295b7bbb 100644
--- a/chromium/content/browser/scheduler/responsiveness/watcher.cc
+++ b/chromium/content/browser/scheduler/responsiveness/watcher.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/pending_task.h"
+#include "base/power_monitor/power_monitor.h"
 #include "base/task/post_task.h"
 #include "build/build_config.h"
 #include "content/browser/scheduler/responsiveness/calculator.h"
@@ -194,10 +195,22 @@ void Watcher::DidRunEventOnUIThread(const void* opaque_identifier) {
                                              execution_finish_time);
 }
 
+void Watcher::OnSuspend() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  calculator_->SetProcessSuspended(true);
+}
+
+void Watcher::OnResume() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  calculator_->SetProcessSuspended(false);
+}
+
 Watcher::Watcher() = default;
 Watcher::~Watcher() = default;
 
 void Watcher::SetUp() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
   // Set up |calculator_| before |metric_source_| because SetUpOnIOThread()
   // uses |calculator_|.
   calculator_ = CreateCalculator();
@@ -205,14 +218,20 @@ void Watcher::SetUp() {
 
   metric_source_ = CreateMetricSource();
   metric_source_->SetUp();
+
+  base::PowerMonitor::AddObserver(this);
 }
 
 void Watcher::Destroy() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
   // This holds a ref to |this| until the destroy flow completes.
   base::ScopedClosureRunner on_destroy_complete(base::BindOnce(
       &Watcher::FinishDestroyMetricSource, base::RetainedRef(this)));
 
   metric_source_->Destroy(std::move(on_destroy_complete));
+
+  base::PowerMonitor::RemoveObserver(this);
 }
 
 void Watcher::SetUpOnIOThread() {
diff --git a/chromium/content/browser/scheduler/responsiveness/watcher.h b/chromium/content/browser/scheduler/responsiveness/watcher.h
index 94b1da9dd4d..92c031a209c 100644
--- a/chromium/content/browser/scheduler/responsiveness/watcher.h
+++ b/chromium/content/browser/scheduler/responsiveness/watcher.h
@@ -7,6 +7,7 @@
 
 #include <vector>
 
+#include "base/power_monitor/power_observer.h"
 #include "content/browser/scheduler/responsiveness/metric_source.h"
 
 namespace content {
@@ -15,7 +16,8 @@ namespace responsiveness {
 class Calculator;
 
 class CONTENT_EXPORT Watcher : public base::RefCounted<Watcher>,
-                               public MetricSource::Delegate {
+                               public MetricSource::Delegate,
+                               public base::PowerObserver {
  public:
   Watcher();
   void SetUp();
@@ -46,6 +48,13 @@ class CONTENT_EXPORT Watcher : public base::RefCounted<Watcher>,
   void WillRunEventOnUIThread(const void* opaque_identifier) override;
   void DidRunEventOnUIThread(const void* opaque_identifier) override;
 
+  // base::PowerObserver interface implementation. The PowerObserver
+  // notifications are asynchronously callbacks on their registration sequence
+  // and may be delayed if there is a long queue of pending tasks to be
+  // executed.
+  void OnSuspend() override;
+  void OnResume() override;
+
  private:
   FRIEND_TEST_ALL_PREFIXES(ResponsivenessWatcherTest, TaskForwarding);
   FRIEND_TEST_ALL_PREFIXES(ResponsivenessWatcherTest, TaskNesting);
diff --git a/chromium/content/browser/screen_enumeration/screen_change_monitor.cc b/chromium/content/browser/screen_enumeration/screen_change_monitor.cc
new file mode 100644
index 00000000000..67d953c0822
--- /dev/null
+++ b/chromium/content/browser/screen_enumeration/screen_change_monitor.cc
@@ -0,0 +1,55 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/screen_enumeration/screen_change_monitor.h"
+
+#include "build/build_config.h"
+#include "ui/display/screen.h"
+
+namespace content {
+
+ScreenChangeMonitor::ScreenChangeMonitor(base::RepeatingClosure callback)
+    : callback_(callback) {
+// TODO(crbug.com/1071233): Investigate test failures (crashes?) on Fuchsia.
+#if !defined(OS_FUCHSIA)
+  if (display::Screen* screen = display::Screen::GetScreen()) {
+    cached_displays_ = screen->GetAllDisplays();
+    screen->AddObserver(this);
+  }
+#endif  // !OS_FUCHSIA
+}
+
+ScreenChangeMonitor::~ScreenChangeMonitor() {
+  if (display::Screen* screen = display::Screen::GetScreen())
+    screen->RemoveObserver(this);
+}
+
+void ScreenChangeMonitor::OnScreensChange() {
+  if (display::Screen* screen = display::Screen::GetScreen()) {
+    const auto& displays = screen->GetAllDisplays();
+    if (cached_displays_ == displays)
+      return;
+
+    cached_displays_ = displays;
+    callback_.Run();
+  }
+}
+
+void ScreenChangeMonitor::OnDisplayAdded(const display::Display& new_display) {
+  OnScreensChange();
+}
+
+void ScreenChangeMonitor::OnDisplayRemoved(
+    const display::Display& old_display) {
+  OnScreensChange();
+}
+
+void ScreenChangeMonitor::OnDisplayMetricsChanged(
+    const display::Display& display,
+    uint32_t changed_metrics) {
+  // TODO(msw): Use the |changed_metrics| parameter to disregard some changes.
+  OnScreensChange();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/screen_enumeration/screen_change_monitor.h b/chromium/content/browser/screen_enumeration/screen_change_monitor.h
new file mode 100644
index 00000000000..75def743fea
--- /dev/null
+++ b/chromium/content/browser/screen_enumeration/screen_change_monitor.h
@@ -0,0 +1,41 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SCREEN_ENUMERATION_SCREEN_CHANGE_MONITOR_H_
+#define CONTENT_BROWSER_SCREEN_ENUMERATION_SCREEN_CHANGE_MONITOR_H_
+
+#include "base/callback.h"
+#include "ui/display/display_observer.h"
+
+namespace content {
+
+// Monitors system screen information and runs a callback on changes.
+class ScreenChangeMonitor : public display::DisplayObserver {
+ public:
+  explicit ScreenChangeMonitor(base::RepeatingClosure callback);
+  ~ScreenChangeMonitor() override;
+
+  ScreenChangeMonitor(const ScreenChangeMonitor&) = delete;
+  ScreenChangeMonitor& operator=(const ScreenChangeMonitor&) = delete;
+
+ private:
+  // Run the callback if a meaningful display change took place.
+  void OnScreensChange();
+
+  // display::DisplayObserver:
+  void OnDisplayAdded(const display::Display& new_display) override;
+  void OnDisplayRemoved(const display::Display& old_display) override;
+  void OnDisplayMetricsChanged(const display::Display& display,
+                               uint32_t changed_metrics) override;
+
+  // The callback to run on screen change events.
+  base::RepeatingClosure callback_;
+
+  // The most recent display information, cached to detect meaningful changes.
+  std::vector<display::Display> cached_displays_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_SCREEN_ENUMERATION_SCREEN_CHANGE_MONITOR_H_
diff --git a/chromium/content/browser/screen_enumeration/screen_enumeration_browsertest.cc b/chromium/content/browser/screen_enumeration/screen_enumeration_browsertest.cc
new file mode 100644
index 00000000000..5d0eb010630
--- /dev/null
+++ b/chromium/content/browser/screen_enumeration/screen_enumeration_browsertest.cc
@@ -0,0 +1,197 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/command_line.h"
+#include "base/strings/string_number_conversions.h"
+#include "build/build_config.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "ui/display/screen_base.h"
+#include "ui/gfx/geometry/safe_integer_conversions.h"
+
+namespace content {
+
+namespace {
+
+// Used to get info about the screens in a list of dictionary values.
+constexpr char kGetScreensScript[] = R"(
+  (async () => {
+    const screens = await self.getScreens();
+    let result = [];
+    for (s of screens) {
+      result.push({ availHeight: s.availHeight,
+                    availLeft: s.availLeft,
+                    availTop: s.availTop,
+                    availWidth: s.availWidth,
+                    colorDepth: s.colorDepth,
+                    height: s.height,
+                    id: s.id,
+                    internal: s.internal,
+                    left: s.left,
+                    orientation: s.orientation != null,
+                    pixelDepth: s.pixelDepth,
+                    primary: s.primary,
+                    scaleFactor: s.scaleFactor,
+                    top: s.top,
+                    touchSupport: s.touchSupport,
+                    width: s.width });
+    }
+    return result;
+  })();
+)";
+
+// Returns a list of dictionary values from native screen information, intended
+// for comparison with the result of kGetScreensScript.
+base::ListValue GetExpectedScreens() {
+  base::ListValue expected_screens;
+  auto* screen = display::Screen::GetScreen();
+  size_t id = 0;
+  for (const auto& d : screen->GetAllDisplays()) {
+    base::DictionaryValue s;
+    s.SetIntKey("availHeight", d.work_area().height());
+    s.SetIntKey("availLeft", d.work_area().x());
+    s.SetIntKey("availTop", d.work_area().y());
+    s.SetIntKey("availWidth", d.work_area().width());
+    s.SetIntKey("colorDepth", d.color_depth());
+    s.SetIntKey("height", d.bounds().height());
+    s.SetStringKey("id", base::NumberToString(id++));
+    s.SetBoolKey("internal", d.IsInternal());
+    s.SetIntKey("left", d.bounds().x());
+    s.SetBoolKey("orientation", false);
+    s.SetIntKey("pixelDepth", d.color_depth());
+    s.SetBoolKey("primary", d.id() == screen->GetPrimaryDisplay().id());
+    // Handle JS's pattern for specifying integer and floating point numbers.
+    int int_scale_factor = gfx::ToCeiledInt(d.device_scale_factor());
+    if (int_scale_factor == d.device_scale_factor())
+      s.SetIntKey("scaleFactor", int_scale_factor);
+    else
+      s.SetDoubleKey("scaleFactor", d.device_scale_factor());
+    s.SetIntKey("top", d.bounds().y());
+    s.SetBoolKey("touchSupport", d.touch_support() ==
+                                     display::Display::TouchSupport::AVAILABLE);
+    s.SetIntKey("width", d.bounds().width());
+    expected_screens.Append(std::move(s));
+  }
+  return expected_screens;
+}
+
+}  // namespace
+
+// Tests screen enumeration aspects of the WindowPlacement feature.
+class ScreenEnumerationTest : public ContentBrowserTest {
+ public:
+  ScreenEnumerationTest() = default;
+  ~ScreenEnumerationTest() override = default;
+  ScreenEnumerationTest(const ScreenEnumerationTest&) = delete;
+  void operator=(const ScreenEnumerationTest&) = delete;
+
+ protected:
+  // ContentBrowserTest:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        switches::kEnableBlinkFeatures, "WindowPlacement");
+    ContentBrowserTest::SetUpCommandLine(command_line);
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(ScreenEnumerationTest, GetScreensBasic) {
+  ASSERT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "empty.html")));
+  ASSERT_EQ(true, EvalJs(shell()->web_contents(), "'getScreens' in self"));
+  auto result = EvalJs(shell()->web_contents(), kGetScreensScript);
+  EXPECT_EQ(GetExpectedScreens(), base::Value::AsListValue(result.value));
+}
+
+// Tests screen enumeration functionality with a fake Screen object.
+class FakeScreenEnumerationTest : public ScreenEnumerationTest {
+ public:
+  FakeScreenEnumerationTest() = default;
+  ~FakeScreenEnumerationTest() override = default;
+  FakeScreenEnumerationTest(const FakeScreenEnumerationTest&) = delete;
+  void operator=(const FakeScreenEnumerationTest&) = delete;
+
+ protected:
+  // ScreenEnumerationTest:
+  void SetUpOnMainThread() override {
+    ScreenEnumerationTest::SetUpOnMainThread();
+    original_screen_ = display::Screen::GetScreen();
+    display::Screen::SetScreenInstance(&screen_);
+
+    // Create a shell that observes the fake screen. A display is required.
+    screen()->display_list().AddDisplay({0, gfx::Rect(100, 100, 801, 802)},
+                                        display::DisplayList::Type::PRIMARY);
+    test_shell_ = CreateBrowser();
+  }
+  void TearDownOnMainThread() override {
+    display::Screen::SetScreenInstance(original_screen_);
+    ScreenEnumerationTest::TearDownOnMainThread();
+  }
+
+  display::ScreenBase* screen() { return &screen_; }
+  Shell* test_shell() { return test_shell_; }
+
+ private:
+  display::Screen* original_screen_ = nullptr;
+  display::ScreenBase screen_;
+  Shell* test_shell_ = nullptr;
+};
+
+// TODO(crbug.com/1042990): Windows crashes static casting to ScreenWin.
+// TODO(crbug.com/1042990): Android requires a GetDisplayNearestView overload.
+#if defined(OS_ANDROID) || defined(OS_WIN)
+#define MAYBE_GetScreensFaked DISABLED_GetScreensFaked
+#else
+#define MAYBE_GetScreensFaked GetScreensFaked
+#endif
+IN_PROC_BROWSER_TEST_F(FakeScreenEnumerationTest, MAYBE_GetScreensFaked) {
+  ASSERT_TRUE(NavigateToURL(test_shell(), GetTestUrl(nullptr, "empty.html")));
+  ASSERT_EQ(true, EvalJs(test_shell()->web_contents(), "'getScreens' in self"));
+
+  screen()->display_list().AddDisplay({1, gfx::Rect(100, 100, 801, 802)},
+                                      display::DisplayList::Type::PRIMARY);
+  screen()->display_list().AddDisplay({2, gfx::Rect(901, 100, 801, 802)},
+                                      display::DisplayList::Type::NOT_PRIMARY);
+
+  auto result = EvalJs(test_shell()->web_contents(), kGetScreensScript);
+  EXPECT_EQ(GetExpectedScreens(), base::Value::AsListValue(result.value));
+}
+
+// TODO(crbug.com/1042990): Windows crashes static casting to ScreenWin.
+// TODO(crbug.com/1042990): Android requires a GetDisplayNearestView overload.
+#if defined(OS_ANDROID) || defined(OS_WIN)
+#define MAYBE_OnScreensChange DISABLED_OnScreensChange
+#else
+#define MAYBE_OnScreensChange OnScreensChange
+#endif
+IN_PROC_BROWSER_TEST_F(FakeScreenEnumerationTest, MAYBE_OnScreensChange) {
+  ASSERT_TRUE(NavigateToURL(test_shell(), GetTestUrl(nullptr, "empty.html")));
+  ASSERT_EQ(true,
+            EvalJs(test_shell()->web_contents(), "'onscreenschange' in self"));
+  constexpr char kSetOnScreensChange[] = R"(
+    onscreenschange = function() { ++document.title; };
+    document.title = 0;
+  )";
+  EXPECT_EQ(0, EvalJs(test_shell()->web_contents(), kSetOnScreensChange));
+
+  screen()->display_list().AddDisplay({1, gfx::Rect(100, 100, 801, 802)},
+                                      display::DisplayList::Type::PRIMARY);
+  EXPECT_EQ("1", EvalJs(test_shell()->web_contents(), "document.title"));
+
+  screen()->display_list().AddDisplay({2, gfx::Rect(901, 100, 801, 802)},
+                                      display::DisplayList::Type::NOT_PRIMARY);
+  EXPECT_EQ("2", EvalJs(test_shell()->web_contents(), "document.title"));
+
+  EXPECT_NE(0u, screen()->display_list().UpdateDisplay(
+                    {2, gfx::Rect(902, 100, 801, 802)}));
+  EXPECT_EQ("3", EvalJs(test_shell()->web_contents(), "document.title"));
+
+  screen()->display_list().RemoveDisplay(2);
+  EXPECT_EQ("4", EvalJs(test_shell()->web_contents(), "document.title"));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/screen_enumeration/screen_enumeration_impl.cc b/chromium/content/browser/screen_enumeration/screen_enumeration_impl.cc
index 3f938aeee33..766d3d03e1e 100644
--- a/chromium/content/browser/screen_enumeration/screen_enumeration_impl.cc
+++ b/chromium/content/browser/screen_enumeration/screen_enumeration_impl.cc
@@ -4,32 +4,59 @@
 
 #include "content/browser/screen_enumeration/screen_enumeration_impl.h"
 
-#include <memory>
+#include <utility>
+#include <vector>
 
-#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "content/browser/permissions/permission_controller_impl.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "mojo/public/cpp/bindings/callback_helpers.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 
 namespace content {
 
-// static
-void ScreenEnumerationImpl::Create(
-    mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver) {
-  mojo::MakeSelfOwnedReceiver(std::make_unique<ScreenEnumerationImpl>(),
-                              std::move(receiver));
-}
+ScreenEnumerationImpl::ScreenEnumerationImpl(RenderFrameHost* render_frame_host)
+    : render_frame_host_(render_frame_host) {}
 
-ScreenEnumerationImpl::ScreenEnumerationImpl() = default;
 ScreenEnumerationImpl::~ScreenEnumerationImpl() = default;
 
+void ScreenEnumerationImpl::Bind(
+    mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver) {
+  receivers_.Add(this, std::move(receiver));
+}
+
 void ScreenEnumerationImpl::GetDisplays(GetDisplaysCallback callback) {
+  // Ensure the callback is run if this object is prematurely destroyed.
+  auto scoped_callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
+      std::move(callback), std::vector<display::Display>(),
+      display::kInvalidDisplayId, display::kInvalidDisplayId, false);
+
+  auto* permission_controller = PermissionControllerImpl::FromBrowserContext(
+      render_frame_host_->GetProcess()->GetBrowserContext());
+  permission_controller->RequestPermission(
+      PermissionType::WINDOW_PLACEMENT, render_frame_host_,
+      render_frame_host_->GetLastCommittedOrigin().GetURL(),
+      /*user_gesture=*/false,
+      base::BindOnce(&ScreenEnumerationImpl::GetDisplaysWithPermissionStatus,
+                     weak_factory_.GetWeakPtr(), std::move(scoped_callback)));
+}
+
+void ScreenEnumerationImpl::GetDisplaysWithPermissionStatus(
+    GetDisplaysCallback callback,
+    blink::mojom::PermissionStatus permission_status) {
+  if (permission_status != blink::mojom::PermissionStatus::GRANTED) {
+    std::move(callback).Run({}, display::kInvalidDisplayId,
+                            display::kInvalidDisplayId, false);
+    return;
+  }
+
   display::Screen* screen = display::Screen::GetScreen();
   const std::vector<display::Display> displays = screen->GetAllDisplays();
   const int64_t internal_id = display::Display::HasInternalDisplay()
                                   ? display::Display::InternalDisplayId()
                                   : display::kInvalidDisplayId;
   const int64_t primary_id = screen->GetPrimaryDisplay().id();
-  // TODO(msw): Return no data and |false| if a permission check fails.
   std::move(callback).Run(std::move(displays), internal_id, primary_id, true);
 }
 
diff --git a/chromium/content/browser/screen_enumeration/screen_enumeration_impl.h b/chromium/content/browser/screen_enumeration/screen_enumeration_impl.h
index c20c02ef114..442efe62b7e 100644
--- a/chromium/content/browser/screen_enumeration/screen_enumeration_impl.h
+++ b/chromium/content/browser/screen_enumeration/screen_enumeration_impl.h
@@ -5,24 +5,39 @@
 #ifndef CONTENT_BROWSER_SCREEN_ENUMERATION_SCREEN_ENUMERATION_IMPL_H_
 #define CONTENT_BROWSER_SCREEN_ENUMERATION_SCREEN_ENUMERATION_IMPL_H_
 
+#include "base/memory/weak_ptr.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
 #include "third_party/blink/public/mojom/screen_enumeration/screen_enumeration.mojom.h"
 
 namespace content {
 
+class RenderFrameHost;
+
 // A backend for the proposed interface to query the device's screen space.
 class ScreenEnumerationImpl : public blink::mojom::ScreenEnumeration {
  public:
-  static void Create(
-      mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver);
-
-  ScreenEnumerationImpl();
+  explicit ScreenEnumerationImpl(RenderFrameHost* render_frame_host);
   ~ScreenEnumerationImpl() override;
 
   ScreenEnumerationImpl(const ScreenEnumerationImpl&) = delete;
   ScreenEnumerationImpl& operator=(const ScreenEnumerationImpl&) = delete;
 
+  // Bind a pending receiver to this backend implementation.
+  void Bind(mojo::PendingReceiver<blink::mojom::ScreenEnumeration> receiver);
+
   // blink::mojom::ScreenEnumeration:
   void GetDisplays(GetDisplaysCallback callback) override;
+
+ private:
+  // Called with the result of the permission request in GetDisplays().
+  void GetDisplaysWithPermissionStatus(
+      GetDisplaysCallback callback,
+      blink::mojom::PermissionStatus permission_status);
+
+  RenderFrameHost* render_frame_host_;
+  mojo::ReceiverSet<blink::mojom::ScreenEnumeration> receivers_;
+  base::WeakPtrFactory<ScreenEnumerationImpl> weak_factory_{this};
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc b/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
index eeb4d0baaea..a1ea0bda8fd 100644
--- a/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
+++ b/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
@@ -18,6 +18,7 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -242,8 +243,9 @@ IN_PROC_BROWSER_TEST_F(ScreenOrientationBrowserTest, DISABLED_LockSmoke) {
 // This could be a web test if they were not using a mock screen orientation
 // controller.
 IN_PROC_BROWSER_TEST_F(ScreenOrientationBrowserTest, CrashTest_UseAfterDetach) {
-  GURL test_url = GetTestUrl("screen_orientation",
-                             "screen_orientation_use_after_detach.html");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL test_url(embedded_test_server()->GetURL(
+      "/screen_orientation/screen_orientation_use_after_detach.html"));
 
   TestNavigationObserver navigation_observer(shell()->web_contents(), 2);
   shell()->LoadURL(test_url);
diff --git a/chromium/content/browser/security_exploit_browsertest.cc b/chromium/content/browser/security_exploit_browsertest.cc
index d50b89df5b4..fe9275c119c 100644
--- a/chromium/content/browser/security_exploit_browsertest.cc
+++ b/chromium/content/browser/security_exploit_browsertest.cc
@@ -36,19 +36,21 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/file_select_listener.h"
-#include "content/public/browser/interstitial_page.h"
-#include "content/public/browser/interstitial_page_delegate.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/bindings_policy.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/navigation_policy.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/navigation_handle_observer.h"
 #include "content/public/test/test_navigation_observer.h"
+#include "content/public/test/test_renderer_host.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
@@ -56,6 +58,7 @@
 #include "content/test/frame_host_interceptor.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_content_browser_client.h"
+#include "ipc/ipc_message.h"
 #include "ipc/ipc_security_test_util.h"
 #include "mojo/core/embedder/embedder.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
@@ -75,6 +78,7 @@
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/trust_tokens.mojom.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/test/test_url_loader_client.h"
 #include "storage/browser/blob/blob_registry_impl.h"
@@ -87,6 +91,8 @@
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 
 using IPC::IpcSecurityTestUtil;
+using ::testing::HasSubstr;
+using ::testing::Optional;
 
 namespace content {
 
@@ -134,10 +140,11 @@ RenderFrameHostImpl* PrepareToDuplicateHosts(Shell* shell,
   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
   wc->GetFrameTree()->root()->navigator()->RequestOpenURL(
       wc->GetFrameTree()->root()->current_frame_host(), extension_url,
+      GlobalFrameRoutingId() /* initiator_routing_id */,
       url::Origin::Create(foo), nullptr, std::string(), Referrer(),
       WindowOpenDisposition::CURRENT_TAB, false, true,
       blink::TriggeringEventInfo::kFromTrustedEvent, std::string(),
-      nullptr /* blob_url_loader_factory */);
+      nullptr /* blob_url_loader_factory */, base::nullopt /* impression */);
 
   // Since the navigation above requires a cross-process swap, there will be a
   // speculative/pending RenderFrameHost. Ensure it exists and is in a different
@@ -424,97 +431,6 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, UnexpectedMethodsSequence) {
   // The test passes if it doesn't crash.
 }
 
-class SecurityExploitTestInterstitialPage : public InterstitialPageDelegate {
- public:
-  explicit SecurityExploitTestInterstitialPage(WebContents* contents) {
-    InterstitialPage* interstitial = InterstitialPage::Create(
-        contents, true, contents->GetLastCommittedURL(), this);
-    interstitial->Show();
-  }
-
-  // InterstitialPageDelegate implementation.
-  void CommandReceived(const std::string& command) override {
-    last_command_ = command;
-  }
-
-  std::string GetHTMLContents() override {
-    return "<html><head><script>"
-           "window.domAutomationController.send(\"okay\");"
-           "</script></head>"
-           "<body>this page is an interstitial</body></html>";
-  }
-
-  std::string last_command() { return last_command_; }
-
- private:
-  std::string last_command_;
-  DISALLOW_COPY_AND_ASSIGN(SecurityExploitTestInterstitialPage);
-};
-
-// Fails due to InterstitialPage's reliance on PostNonNestableTask
-// http://crbug.com/432737
-#if defined(OS_ANDROID)
-#define MAYBE_InterstitialCommandFromUnderlyingContent \
-  DISABLED_InterstitialCommandFromUnderlyingContent
-#else
-#define MAYBE_InterstitialCommandFromUnderlyingContent \
-  InterstitialCommandFromUnderlyingContent
-#endif
-
-// The interstitial should not be controllable by the underlying content.
-IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
-                       MAYBE_InterstitialCommandFromUnderlyingContent) {
-  // Start off with initial navigation, to allocate the process.
-  GURL foo("http://foo.com/simple_page.html");
-  EXPECT_TRUE(NavigateToURL(shell(), foo));
-  EXPECT_EQ(base::ASCIIToUTF16("OK"), shell()->web_contents()->GetTitle());
-
-  DOMMessageQueue message_queue;
-
-  // Install and show an interstitial page.
-  SecurityExploitTestInterstitialPage* interstitial =
-      new SecurityExploitTestInterstitialPage(shell()->web_contents());
-
-  ASSERT_EQ("", interstitial->last_command());
-  WaitForInterstitialAttach(shell()->web_contents());
-
-  InterstitialPage* interstitial_page =
-      shell()->web_contents()->GetInterstitialPage();
-  ASSERT_TRUE(interstitial_page != nullptr);
-  ASSERT_TRUE(shell()->web_contents()->ShowingInterstitialPage());
-  ASSERT_TRUE(interstitial_page->GetDelegateForTesting() == interstitial);
-
-  // The interstitial page ought to be able to send a message.
-  std::string message;
-  ASSERT_TRUE(message_queue.WaitForMessage(&message));
-  ASSERT_EQ("\"okay\"", message);
-  ASSERT_EQ("\"okay\"", interstitial->last_command());
-
-  // Send an automation message from the underlying content and wait for it to
-  // be dispatched on this thread. This message should not be received by the
-  // interstitial.
-  RenderFrameHost* compromised_renderer =
-      shell()->web_contents()->GetMainFrame();
-  FrameHostMsg_DomOperationResponse evil(compromised_renderer->GetRoutingID(),
-                                         "evil");
-  IpcSecurityTestUtil::PwnMessageReceived(
-      compromised_renderer->GetProcess()->GetChannel(), evil);
-
-  ASSERT_TRUE(message_queue.WaitForMessage(&message));
-  ASSERT_EQ("evil", message)
-      << "Automation message should be received by WebContents.";
-  ASSERT_EQ("\"okay\"", interstitial->last_command())
-      << "Interstitial should not be affected.";
-
-  // Send a second message from the interstitial page, and make sure that the
-  // "evil" message doesn't arrive in the intervening period.
-  ExecuteScriptAsync(interstitial_page->GetMainFrame(),
-                     "window.domAutomationController.send(\"okay2\");");
-  ASSERT_TRUE(message_queue.WaitForMessage(&message));
-  ASSERT_EQ("\"okay2\"", message);
-  ASSERT_EQ("\"okay2\"", interstitial->last_command());
-}
-
 class CorsExploitBrowserTest : public ContentBrowserTest {
  public:
   CorsExploitBrowserTest() = default;
@@ -716,8 +632,7 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
   std::string file_content("test-file-content");
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-  ASSERT_LT(
-      0, base::WriteFile(file_path, file_content.data(), file_content.size()));
+  ASSERT_TRUE(base::WriteFile(file_path, file_content));
 
   // Simulate an IPC message asking to POST a file that the renderer shouldn't
   // have access to.
@@ -1385,6 +1300,35 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
   EXPECT_EQ(bad_message::RFH_CAN_COMMIT_URL_BLOCKED, kill_waiter.Wait());
 }
 
+// Test that verifies that if a RenderFrameHost is incorrectly given WebUI
+// bindings, committing a non-WebUI URL in it is detected and the process is
+// correctly terminated.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
+                       DidCommitNonWebUIURLInProcessWithBindings) {
+  // Navigate to a web URL.
+  GURL initial_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), initial_url));
+
+  // Start a second navigation.
+  GURL web_url(embedded_test_server()->GetURL("foo.com", "/title2.html"));
+  TestNavigationManager navigation(shell()->web_contents(), web_url);
+  RenderProcessHostBadIpcMessageWaiter kill_waiter(
+      shell()->web_contents()->GetMainFrame()->GetProcess());
+
+  shell()->LoadURL(web_url);
+  EXPECT_TRUE(navigation.WaitForResponse());
+
+  // Grant WebUI bindings to the navigated frame to simulate a bug in the code
+  // that incorrectly does it for a navigation that does not require it.
+  navigation.GetNavigationHandle()->GetRenderFrameHost()->AllowBindings(
+      BINDINGS_POLICY_WEB_UI);
+
+  // Resume the navigation and upon receiving the commit message the renderer
+  // process will be terminated.
+  navigation.ResumeNavigation();
+  EXPECT_EQ(bad_message::RFH_CAN_COMMIT_URL_BLOCKED, kill_waiter.Wait());
+}
+
 class BeginNavigationTransitionReplacer : public FrameHostInterceptor {
  public:
   BeginNavigationTransitionReplacer(WebContents* web_contents,
@@ -1516,6 +1460,7 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
           base::TimeTicks());
   mojom::BeginNavigationParamsPtr begin_params =
       mojom::BeginNavigationParams::New(
+          MSG_ROUTING_NONE /* initiator_routing_id */,
           std::string() /* headers */, net::LOAD_NORMAL,
           false /* skip_service_worker */,
           blink::mojom::RequestContextType::LOCATION,
@@ -1527,8 +1472,8 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
           std::string() /* searchable_form_encoding */,
           GURL() /* client_side_redirect_url */,
           base::nullopt /* devtools_initiator_info */,
-          false /* attach_same_site_cookies */,
-          nullptr /* trust_token_params */);
+          false /* force_ignore_site_for_cookies */,
+          nullptr /* trust_token_params */, base::nullopt /* impression */);
 
   // Receiving the invalid IPC message should lead to renderer process
   // termination.
@@ -1640,4 +1585,169 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
   EXPECT_EQ(true, ExecJs(new_window, "!!window.opener"));
 }
 
+class BeginNavigationTrustTokenParamsReplacer : public FrameHostInterceptor {
+ public:
+  BeginNavigationTrustTokenParamsReplacer(
+      WebContents* web_contents,
+      network::mojom::TrustTokenParamsPtr params_to_inject)
+      : FrameHostInterceptor(web_contents),
+        params_to_inject_(std::move(params_to_inject)) {}
+
+  BeginNavigationTrustTokenParamsReplacer(
+      const BeginNavigationTrustTokenParamsReplacer&) = delete;
+  BeginNavigationTrustTokenParamsReplacer& operator=(
+      const BeginNavigationTrustTokenParamsReplacer&) = delete;
+
+  bool WillDispatchBeginNavigation(
+      RenderFrameHost* render_frame_host,
+      mojom::CommonNavigationParamsPtr* common_params,
+      mojom::BeginNavigationParamsPtr* begin_params,
+      mojo::PendingRemote<blink::mojom::BlobURLToken>* blob_url_token,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client,
+      mojo::PendingRemote<blink::mojom::NavigationInitiator>*
+          navigation_initiator) override {
+    if (is_activated_) {
+      (*begin_params)->trust_token_params = params_to_inject_.Clone();
+      is_activated_ = false;
+    }
+
+    return true;
+  }
+
+  void Activate() { is_activated_ = true; }
+
+ private:
+  network::mojom::TrustTokenParamsPtr params_to_inject_;
+  bool is_activated_ = false;
+};
+
+class SecurityExploitBrowserTestWithTrustTokensEnabled
+    : public SecurityExploitBrowserTest {
+ public:
+  SecurityExploitBrowserTestWithTrustTokensEnabled() {
+    feature_list_.InitAndEnableFeature(network::features::kTrustTokens);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Test that the browser correctly reports a bad message when a child frame
+// attempts to navigate with a Trust Tokens redemption operation associated with
+// the navigation, but its parent lacks the trust-token-redemption Feature
+// Policy feature.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTestWithTrustTokensEnabled,
+                       BrowserForbidsTrustTokenRedemptionWithoutFeaturePolicy) {
+  WebContents* web_contents = shell()->web_contents();
+
+  // Prepare to intercept BeginNavigation mojo IPC. This has to be done before
+  // the test creates the RenderFrameHostImpl that is the target of the IPC.
+  auto params = network::mojom::TrustTokenParams::New();
+  params->type = network::mojom::TrustTokenOperationType::kRedemption;
+  BeginNavigationTrustTokenParamsReplacer replacer(web_contents,
+                                                   std::move(params));
+
+  GURL start_url(embedded_test_server()->GetURL(
+      "/page-with-trust-token-feature-policy-disabled.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  RenderFrameHost* parent = web_contents->GetMainFrame();
+  ASSERT_FALSE(parent->IsFeatureEnabled(
+      blink::mojom::FeaturePolicyFeature::kTrustTokenRedemption));
+
+  RenderFrameHost* child = static_cast<WebContentsImpl*>(web_contents)
+                               ->GetFrameTree()
+                               ->root()
+                               ->child_at(0)
+                               ->current_frame_host();
+  RenderProcessHostBadMojoMessageWaiter kill_waiter(child->GetProcess());
+
+  replacer.Activate();
+
+  // Note: this can't use NavigateFrameToURL, because that method doesn't
+  // route through RFHI::BeginNavigation. It also can't use NavigateIframeToURL,
+  // because that navigation will hang.
+  //
+  // It also can't EXPECT_TRUE or EXPECT_FALSE: sometimes the ExecJs call will
+  // finish before the renderer gets killed, and sometimes it won't.
+  ignore_result(
+      ExecJs(child, JsReplace("location.href=$1;", GURL("/title2.html"))));
+
+  EXPECT_THAT(kill_waiter.Wait(),
+              Optional(HasSubstr("Feature Policy feature is absent")));
+}
+
+// Test that the browser correctly reports a bad message when a child frame
+// attempts to navigate with a Trust Tokens signing operation associated with
+// the navigation, but its parent lacks the trust-token-redemption (sic) Feature
+// Policy feature.
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTestWithTrustTokensEnabled,
+                       BrowserForbidsTrustTokenSigningWithoutFeaturePolicy) {
+  WebContents* web_contents = shell()->web_contents();
+
+  // Prepare to intercept BeginNavigation mojo IPC. This has to be done before
+  // the test creates the RenderFrameHostImpl that is the target of the IPC.
+  auto params = network::mojom::TrustTokenParams::New();
+  params->type = network::mojom::TrustTokenOperationType::kSigning;
+  BeginNavigationTrustTokenParamsReplacer replacer(web_contents,
+                                                   std::move(params));
+
+  GURL start_url(embedded_test_server()->GetURL(
+      "/page-with-trust-token-feature-policy-disabled.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  RenderFrameHost* parent = web_contents->GetMainFrame();
+  ASSERT_FALSE(parent->IsFeatureEnabled(
+      blink::mojom::FeaturePolicyFeature::kTrustTokenRedemption));
+
+  RenderFrameHost* child = static_cast<WebContentsImpl*>(web_contents)
+                               ->GetFrameTree()
+                               ->root()
+                               ->child_at(0)
+                               ->current_frame_host();
+  RenderProcessHostBadMojoMessageWaiter kill_waiter(child->GetProcess());
+
+  replacer.Activate();
+
+  // Note: this can't use NavigateFrameToURL, because that method doesn't
+  // route through RFHI::BeginNavigation. It also can't use NavigateIframeToURL,
+  // because that navigation will hang.
+  //
+  // It also can't EXPECT_TRUE or EXPECT_FALSE: sometimes the ExecJs call will
+  // finish before the renderer gets killed, and sometimes it won't.
+  ignore_result(
+      ExecJs(child, JsReplace("location.href=$1;", GURL("/title2.html"))));
+
+  EXPECT_THAT(kill_waiter.Wait(),
+              Optional(HasSubstr("Feature Policy feature is absent")));
+}
+
+IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTestWithTrustTokensEnabled,
+                       BrowserForbidsTrustTokenParamsOnMainFrameNav) {
+  WebContents* web_contents = shell()->web_contents();
+
+  // Prepare to intercept BeginNavigation mojo IPC. This has to be done before
+  // the test creates the RenderFrameHostImpl that is the target of the IPC.
+  BeginNavigationTrustTokenParamsReplacer replacer(
+      web_contents, network::mojom::TrustTokenParams::New());
+
+  GURL start_url(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  RenderFrameHost* compromised_renderer = web_contents->GetMainFrame();
+  RenderProcessHostBadMojoMessageWaiter kill_waiter(
+      compromised_renderer->GetProcess());
+
+  replacer.Activate();
+
+  // Can't use NavigateToURL here because it would hang. Additionally, we can't
+  // EXPECT_TRUE or EXPECT_FALSE: sometimes the ExecJs call will finish
+  // before the renderer gets killed, and sometimes it won't.
+  ignore_result(ExecJs(compromised_renderer,
+                       JsReplace("location.href=$1", GURL("/title2.html"))));
+
+  EXPECT_THAT(kill_waiter.Wait(),
+              Optional(HasSubstr("Trust Token params in main frame nav")));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/serial/serial_browsertest.cc b/chromium/content/browser/serial/serial_browsertest.cc
index c1cf0f182c5..92aa8b8f5a5 100644
--- a/chromium/content/browser/serial/serial_browsertest.cc
+++ b/chromium/content/browser/serial/serial_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/serial_delegate.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/service_process_host_browsertest.cc b/chromium/content/browser/service_process_host_browsertest.cc
index 85cd4b8042a..35ddabfd8ee 100644
--- a/chromium/content/browser/service_process_host_browsertest.cc
+++ b/chromium/content/browser/service_process_host_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/time/time.h"
 #include "base/timer/elapsed_timer.h"
 #include "content/public/browser/service_process_host.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "services/test/echo/public/mojom/echo.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/chromium/content/browser/service_sandbox_type.h b/chromium/content/browser/service_sandbox_type.h
new file mode 100644
index 00000000000..c238fb1a0b1
--- /dev/null
+++ b/chromium/content/browser/service_sandbox_type.h
@@ -0,0 +1,66 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SERVICE_SANDBOX_TYPE_H_
+#define CONTENT_BROWSER_SERVICE_SANDBOX_TYPE_H_
+
+#include "build/build_config.h"
+#include "content/public/browser/sandbox_type.h"
+#include "content/public/browser/service_process_host.h"
+
+// This file maps service classes to sandbox types.  Services which
+// require a non-utility sandbox can be added here.  See
+// ServiceProcessHost::Launch() for how these templates are consumed.
+
+// audio::mojom::AudioService
+namespace audio {
+namespace mojom {
+class AudioService;
+}
+}  // namespace audio
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<audio::mojom::AudioService>() {
+  return content::SandboxType::kAudio;
+}
+
+// media::mojom::CdmService
+namespace media {
+namespace mojom {
+class CdmService;
+}
+}  // namespace media
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<media::mojom::CdmService>() {
+  return content::SandboxType::kCdm;
+}
+
+// network::mojom::NetworkService
+namespace network {
+namespace mojom {
+class NetworkService;
+}
+}  // namespace network
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<network::mojom::NetworkService>() {
+  return content::SandboxType::kNetwork;
+}
+
+// device::mojom::XRDeviceService
+#if defined(OS_WIN)
+namespace device {
+namespace mojom {
+class XRDeviceService;
+}
+}  // namespace device
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<device::mojom::XRDeviceService>() {
+  return content::SandboxType::kXrCompositing;
+}
+#endif  // OS_WIN
+
+#endif  // CONTENT_BROWSER_SERVICE_SANDBOX_TYPE_H_
diff --git a/chromium/content/browser/service_worker/embedded_worker_instance.cc b/chromium/content/browser/service_worker/embedded_worker_instance.cc
index 6fa27c7c657..e91552b52fe 100644
--- a/chromium/content/browser/service_worker/embedded_worker_instance.cc
+++ b/chromium/content/browser/service_worker/embedded_worker_instance.cc
@@ -40,6 +40,8 @@
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/base/isolation_info.h"
+#include "net/cookies/site_for_cookies.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preference_watcher.mojom.h"
@@ -112,13 +114,17 @@ using CreateFactoryBundlesOnUICallback = base::OnceCallback<void(
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle> script_bundle,
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle> subresouce_bundle,
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
-        coep_reporter)>;
+        coep_reporter,
+    mojo::PendingReceiver<blink::mojom::ReportingObserver>
+        reporting_observer_receiver)>;
 void CreateFactoryBundlesOnUI(int process_id,
                               int routing_id,
                               const GURL& script_url,
                               base::Optional<network::CrossOriginEmbedderPolicy>
                                   cross_origin_embedder_policy,
                               CreateFactoryBundlesOnUICallback callback) {
+  mojo::PendingReceiver<blink::mojom::ReportingObserver>
+      reporting_observer_receiver;
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   auto* rph = RenderProcessHost::FromID(process_id);
   if (!rph) {
@@ -126,7 +132,8 @@ void CreateFactoryBundlesOnUI(int process_id,
     // missing renderer.
     ServiceWorkerContextWrapper::RunOrPostTaskOnCoreThread(
         FROM_HERE, base::BindOnce(std::move(callback), nullptr, nullptr,
-                                  mojo::NullRemote()));
+                                  mojo::NullRemote(),
+                                  std::move(reporting_observer_receiver)));
     return;
   }
 
@@ -142,12 +149,17 @@ void CreateFactoryBundlesOnUI(int process_id,
   // |cross_origin_embedder_policy| is nullopt in some unittests.
   // TODO(shimazu): Set COEP in those tests.
   if (cross_origin_embedder_policy) {
-    mojo::MakeSelfOwnedReceiver(
-        std::make_unique<CrossOriginEmbedderPolicyReporter>(
-            rph->GetStoragePartition(), script_url,
-            cross_origin_embedder_policy->reporting_endpoint,
-            cross_origin_embedder_policy->report_only_reporting_endpoint),
-        coep_reporter.BindNewPipeAndPassReceiver());
+    mojo::PendingRemote<blink::mojom::ReportingObserver>
+        reporting_observer_remote;
+    reporting_observer_receiver =
+        reporting_observer_remote.InitWithNewPipeAndPassReceiver();
+    auto reporter = std::make_unique<CrossOriginEmbedderPolicyReporter>(
+        rph->GetStoragePartition(), script_url,
+        cross_origin_embedder_policy->reporting_endpoint,
+        cross_origin_embedder_policy->report_only_reporting_endpoint);
+    reporter->BindObserver(std::move(reporting_observer_remote));
+    mojo::MakeSelfOwnedReceiver(std::move(reporter),
+                                coep_reporter.BindNewPipeAndPassReceiver());
     coep_reporter->Clone(
         coep_reporter_for_devtools.InitWithNewPipeAndPassReceiver());
     coep_reporter->Clone(
@@ -173,7 +185,8 @@ void CreateFactoryBundlesOnUI(int process_id,
       FROM_HERE, base::BindOnce(std::move(callback), std::move(script_bundle),
                                 std::move(subresource_bundle),
                                 coep_reporter ? coep_reporter.Unbind()
-                                              : mojo::NullRemote()));
+                                              : mojo::NullRemote(),
+                                std::move(reporting_observer_receiver)));
 }
 
 using SetupProcessCallback = base::OnceCallback<void(
@@ -188,6 +201,7 @@ using SetupProcessCallback = base::OnceCallback<void(
     std::unique_ptr<
         blink::PendingURLLoaderFactoryBundle> /* factory_bundle_for_renderer */,
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>,
+    mojo::PendingReceiver<blink::mojom::ReportingObserver>,
     const base::Optional<base::TimeDelta>& thread_hop_time,
     const base::Optional<base::Time>& ui_post_time)>;
 
@@ -225,6 +239,8 @@ void SetupOnUIThread(
       factory_bundle_for_new_scripts;
   std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
       factory_bundle_for_renderer;
+  mojo::PendingReceiver<blink::mojom::ReportingObserver>
+      reporting_observer_receiver;
 
   if (!process_manager) {
     base::Optional<base::Time> ui_post_time;
@@ -239,6 +255,7 @@ void SetupOnUIThread(
                                   std::move(factory_bundle_for_new_scripts),
                                   std::move(factory_bundle_for_renderer),
                                   /*coep_reporter=*/mojo::NullRemote(),
+                                  std::move(reporting_observer_receiver),
                                   thread_hop_time, ui_post_time));
     return;
   }
@@ -259,7 +276,8 @@ void SetupOnUIThread(
                        std::move(process_info), std::move(devtools_proxy),
                        std::move(factory_bundle_for_new_scripts),
                        std::move(factory_bundle_for_renderer),
-                       /*coep_reporter=*/mojo::NullRemote(), thread_hop_time,
+                       /*coep_reporter=*/mojo::NullRemote(),
+                       std::move(reporting_observer_receiver), thread_hop_time,
                        ui_post_time));
     return;
   }
@@ -286,12 +304,17 @@ void SetupOnUIThread(
   mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
       coep_reporter_for_subresources;
   if (cross_origin_embedder_policy) {
-    mojo::MakeSelfOwnedReceiver(
-        std::make_unique<CrossOriginEmbedderPolicyReporter>(
-            rph->GetStoragePartition(), params->script_url,
-            cross_origin_embedder_policy->reporting_endpoint,
-            cross_origin_embedder_policy->report_only_reporting_endpoint),
-        coep_reporter.BindNewPipeAndPassReceiver());
+    mojo::PendingRemote<blink::mojom::ReportingObserver>
+        reporting_observer_remote;
+    reporting_observer_receiver =
+        reporting_observer_remote.InitWithNewPipeAndPassReceiver();
+    auto reporter = std::make_unique<CrossOriginEmbedderPolicyReporter>(
+        rph->GetStoragePartition(), params->script_url,
+        cross_origin_embedder_policy->reporting_endpoint,
+        cross_origin_embedder_policy->report_only_reporting_endpoint);
+    reporter->BindObserver(std::move(reporting_observer_remote));
+    mojo::MakeSelfOwnedReceiver(std::move(reporter),
+                                coep_reporter.BindNewPipeAndPassReceiver());
     coep_reporter->Clone(
         coep_reporter_for_devtools.InitWithNewPipeAndPassReceiver());
     coep_reporter->Clone(
@@ -366,7 +389,8 @@ void SetupOnUIThread(
           std::move(factory_bundle_for_new_scripts),
           std::move(factory_bundle_for_renderer),
           coep_reporter ? coep_reporter.Unbind() : mojo::NullRemote(),
-          thread_hop_time, ui_post_time));
+          std::move(reporting_observer_receiver), thread_hop_time,
+          ui_post_time));
 }
 
 bool HasSentStartWorker(EmbeddedWorkerInstance::StartingPhase phase) {
@@ -708,10 +732,17 @@ class EmbeddedWorkerInstance::StartTask {
           factory_bundle_for_renderer,
       mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
           coep_reporter,
+      mojo::PendingReceiver<blink::mojom::ReportingObserver>
+          reporting_observer_receiver,
       const base::Optional<base::TimeDelta>& thread_hop_time,
       const base::Optional<base::Time>& ui_post_time) {
     DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
+    if (reporting_observer_receiver) {
+      instance_->owner_version_->set_reporting_observer_receiver(
+          std::move(reporting_observer_receiver));
+    }
+
     if (!ServiceWorkerContext::IsServiceWorkerOnUIEnabled())
       thread_hop_time_ =
           thread_hop_time.value() + (base::Time::Now() - ui_post_time.value());
@@ -1188,7 +1219,10 @@ EmbeddedWorkerInstance::CreateFactoryBundleOnUI(
                                      .InitWithNewPipeAndPassReceiver();
   network::mojom::URLLoaderFactoryParamsPtr factory_params =
       URLLoaderFactoryParamsHelper::CreateForWorker(
-          rph, origin, net::NetworkIsolationKey(origin, origin),
+          rph, origin,
+          net::IsolationInfo::Create(
+              net::IsolationInfo::RedirectMode::kUpdateNothing, origin, origin,
+              net::SiteForCookies::FromOrigin(origin)),
           std::move(coep_reporter));
   bool bypass_redirect_checks = false;
 
@@ -1483,12 +1517,18 @@ void EmbeddedWorkerInstance::OnCreatedFactoryBundles(
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle> script_bundle,
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle> subresource_bundle,
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
-        coep_reporter) {
+        coep_reporter,
+    mojo::PendingReceiver<blink::mojom::ReportingObserver>
+        reporting_observer_receiver) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
   if (coep_reporter) {
     coep_reporter_.Bind(std::move(coep_reporter));
   }
+  if (reporting_observer_receiver) {
+    owner_version_->set_reporting_observer_receiver(
+        std::move(reporting_observer_receiver));
+  }
   BindCacheStorageInternal();
   std::move(callback).Run(std::move(script_bundle),
                           std::move(subresource_bundle));
diff --git a/chromium/content/browser/service_worker/embedded_worker_instance.h b/chromium/content/browser/service_worker/embedded_worker_instance.h
index 5c4c6af0292..2849085fbb7 100644
--- a/chromium/content/browser/service_worker/embedded_worker_instance.h
+++ b/chromium/content/browser/service_worker/embedded_worker_instance.h
@@ -326,7 +326,9 @@ class CONTENT_EXPORT EmbeddedWorkerInstance
       std::unique_ptr<blink::PendingURLLoaderFactoryBundle> script_bundle,
       std::unique_ptr<blink::PendingURLLoaderFactoryBundle> subresouce_bundle,
       mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
-          coep_reporter);
+          coep_reporter,
+      mojo::PendingReceiver<blink::mojom::ReportingObserver>
+          reporting_observer_receiver);
 
   base::WeakPtr<ServiceWorkerContextCore> context_;
   ServiceWorkerVersion* owner_version_;
diff --git a/chromium/content/browser/service_worker/fake_service_worker.cc b/chromium/content/browser/service_worker/fake_service_worker.cc
index ac42b3debf6..541f2a5ea16 100644
--- a/chromium/content/browser/service_worker/fake_service_worker.cc
+++ b/chromium/content/browser/service_worker/fake_service_worker.cc
@@ -43,7 +43,9 @@ void FakeServiceWorker::InitializeGlobalScope(
     blink::mojom::ServiceWorkerObjectInfoPtr service_worker_info,
     blink::mojom::FetchHandlerExistence fetch_handler_existence,
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
-        subresource_loader_factories) {
+        subresource_loader_factories,
+    mojo::PendingReceiver<blink::mojom::ReportingObserver>
+        reporting_observer_receiver) {
   host_.Bind(std::move(service_worker_host));
 
   // Enable callers to use these endpoints without us actually binding them
diff --git a/chromium/content/browser/service_worker/fake_service_worker.h b/chromium/content/browser/service_worker/fake_service_worker.h
index e2df20ba8c4..7451f68f36f 100644
--- a/chromium/content/browser/service_worker/fake_service_worker.h
+++ b/chromium/content/browser/service_worker/fake_service_worker.h
@@ -59,7 +59,9 @@ class FakeServiceWorker : public blink::mojom::ServiceWorker {
       blink::mojom::ServiceWorkerObjectInfoPtr service_worker_info,
       FetchHandlerExistence fetch_handler_existence,
       std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
-          subresource_loader_factories) override;
+          subresource_loader_factories,
+      mojo::PendingReceiver<blink::mojom::ReportingObserver>
+          reporting_observer_receiver) override;
   void DispatchInstallEvent(DispatchInstallEventCallback callback) override;
   void DispatchActivateEvent(DispatchActivateEventCallback callback) override;
   void DispatchBackgroundFetchAbortEvent(
diff --git a/chromium/content/browser/service_worker/service_worker_accessed_callback.h b/chromium/content/browser/service_worker/service_worker_accessed_callback.h
new file mode 100644
index 00000000000..3c58a8be520
--- /dev/null
+++ b/chromium/content/browser/service_worker/service_worker_accessed_callback.h
@@ -0,0 +1,22 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_ACCESSED_CALLBACK_H_
+#define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_ACCESSED_CALLBACK_H_
+
+#include "base/callback.h"
+#include "content/public/browser/allow_service_worker_result.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// This callback is used by a few places in the code but these places don't
+// share a header which they all include, so this definition has to placed
+// in a dedicated header.
+using ServiceWorkerAccessedCallback =
+    base::RepeatingCallback<void(const GURL&, AllowServiceWorkerResult)>;
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_ACCESSED_CALLBACK_H_
diff --git a/chromium/content/browser/service_worker/service_worker_auth_browsertest.cc b/chromium/content/browser/service_worker/service_worker_auth_browsertest.cc
index 352e7b9f82f..4303d419a41 100644
--- a/chromium/content/browser/service_worker/service_worker_auth_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_auth_browsertest.cc
@@ -4,9 +4,9 @@
 
 #include "base/bind.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/service_worker/service_worker_browsertest.cc b/chromium/content/browser/service_worker/service_worker_browsertest.cc
index 52d5f837fa6..0d6f21c2ed9 100644
--- a/chromium/content/browser/service_worker/service_worker_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_browsertest.cc
@@ -60,6 +60,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -67,6 +68,7 @@
 #include "content/public/test/url_loader_interceptor.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/test_content_browser_client.h"
+#include "media/media_buildflags.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/default_handlers.h"
@@ -124,15 +126,16 @@ void ExpectResultAndRun(bool expected,
   continuation.Run();
 }
 
-class WorkerActivatedObserver
+class WorkerStateObserver
     : public ServiceWorkerContextCoreObserver,
-      public base::RefCountedThreadSafe<WorkerActivatedObserver> {
+      public base::RefCountedThreadSafe<WorkerStateObserver> {
  public:
-  explicit WorkerActivatedObserver(ServiceWorkerContextWrapper* context)
-      : context_(context) {}
+  WorkerStateObserver(ServiceWorkerContextWrapper* context,
+                      ServiceWorkerVersion::Status target)
+      : context_(context), target_(target) {}
   void Init() {
     RunOnCoreThread(
-        base::BindOnce(&WorkerActivatedObserver::InitOnCoreThread, this));
+        base::BindOnce(&WorkerStateObserver::InitOnCoreThread, this));
   }
   // ServiceWorkerContextCoreObserver overrides.
   void OnVersionStateChanged(int64_t version_id,
@@ -141,13 +144,12 @@ class WorkerActivatedObserver
     ASSERT_TRUE(
         BrowserThread::CurrentlyOn(ServiceWorkerContext::GetCoreThreadId()));
     const ServiceWorkerVersion* version = context_->GetLiveVersion(version_id);
-    if (version->status() == ServiceWorkerVersion::ACTIVATED) {
+    if (version->status() == target_) {
       context_->RemoveObserver(this);
       version_id_ = version_id;
       registration_id_ = version->registration_id();
-      RunOrPostTaskOnThread(
-          FROM_HERE, BrowserThread::UI,
-          base::BindOnce(&WorkerActivatedObserver::Quit, this));
+      RunOrPostTaskOnThread(FROM_HERE, BrowserThread::UI,
+                            base::BindOnce(&WorkerStateObserver::Quit, this));
     }
   }
   void Wait() { run_loop_.Run(); }
@@ -155,9 +157,11 @@ class WorkerActivatedObserver
   int64_t registration_id() { return registration_id_; }
   int64_t version_id() { return version_id_; }
 
+ protected:
+  friend class base::RefCountedThreadSafe<WorkerStateObserver>;
+  ~WorkerStateObserver() override = default;
+
  private:
-  friend class base::RefCountedThreadSafe<WorkerActivatedObserver>;
-  ~WorkerActivatedObserver() override {}
   void InitOnCoreThread() { context_->AddObserver(this); }
   void Quit() { run_loop_.Quit(); }
 
@@ -166,7 +170,8 @@ class WorkerActivatedObserver
 
   base::RunLoop run_loop_;
   ServiceWorkerContextWrapper* context_;
-  DISALLOW_COPY_AND_ASSIGN(WorkerActivatedObserver);
+  const ServiceWorkerVersion::Status target_;
+  DISALLOW_COPY_AND_ASSIGN(WorkerStateObserver);
 };
 
 std::unique_ptr<net::test_server::HttpResponse> VerifySaveDataHeaderInRequest(
@@ -505,9 +510,9 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, RequestOrigin) {
         auto it = expected_request_urls.find(params->url_request.url);
         if (it != expected_request_urls.end()) {
           EXPECT_TRUE(params->url_request.originated_from_service_worker);
-          EXPECT_FALSE(params->url_request.trusted_params.has_value() &&
-                       params->url_request.trusted_params->network_isolation_key
-                           .IsFullyPopulated());
+          EXPECT_FALSE(
+              params->url_request.trusted_params.has_value() &&
+              !params->url_request.trusted_params->isolation_info.IsEmpty());
           EXPECT_TRUE(params->url_request.request_initiator.has_value());
           EXPECT_EQ(params->url_request.request_initiator->GetURL(),
                     cross_origin_server.base_url());
@@ -546,8 +551,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, FetchPageWithSaveData) {
   ContentBrowserClient* old_client =
       SetBrowserClientForTesting(&content_browser_client);
   shell()->web_contents()->GetRenderViewHost()->OnWebkitPreferencesChanged();
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   blink::mojom::ServiceWorkerRegistrationOptions options(
       embedded_test_server()->GetURL(kPageUrl),
@@ -591,8 +596,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, CrossOriginFetchWithSaveData) {
   ContentBrowserClient* old_client =
       SetBrowserClientForTesting(&content_browser_client);
   shell()->web_contents()->GetRenderViewHost()->OnWebkitPreferencesChanged();
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   blink::mojom::ServiceWorkerRegistrationOptions options(
       embedded_test_server()->GetURL(kPageUrl),
@@ -632,8 +637,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
   ContentBrowserClient* old_client =
       SetBrowserClientForTesting(&content_browser_client);
   shell()->web_contents()->GetRenderViewHost()->OnWebkitPreferencesChanged();
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
 
   embedded_test_server()->RegisterRequestHandler(
@@ -666,8 +671,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, Reload) {
   StartServerAndNavigateToSetup();
   const char kPageUrl[] = "/service_worker/reload.html";
   const char kWorkerUrl[] = "/service_worker/fetch_event_reload.js";
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   blink::mojom::ServiceWorkerRegistrationOptions options(
       embedded_test_server()->GetURL(kPageUrl),
@@ -706,8 +711,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, IdleTimerWithDevTools) {
   StartServerAndNavigateToSetup();
 
   // Register a service worker.
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   const GURL scope =
       embedded_test_server()->GetURL("/service_worker/fetch_from_page.html");
@@ -800,7 +805,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
   // 1st attempt: install a service worker and open the controlled page.
   {
     // Register a service worker which controls |kPageUrl|.
-    auto observer = base::MakeRefCounted<WorkerActivatedObserver>(wrapper());
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(
+        wrapper(), ServiceWorkerVersion::ACTIVATED);
     observer->Init();
     blink::mojom::ServiceWorkerRegistrationOptions options(
         https_server.GetURL(kPageUrl), blink::mojom::ScriptType::kClassic,
@@ -827,7 +833,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
   // 2nd attempt: update the service worker and open the controlled page again.
   {
     // Update the service worker.
-    auto observer = base::MakeRefCounted<WorkerActivatedObserver>(wrapper());
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(
+        wrapper(), ServiceWorkerVersion::ACTIVATED);
     observer->Init();
     wrapper()->UpdateRegistration(https_server.GetURL(kPageUrl));
     observer->Wait();
@@ -856,8 +863,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
   StartServerAndNavigateToSetup();
   const char kPageUrl[] = "/service_worker/fetch_event_blob.html";
   const char kWorkerUrl[] = "/service_worker/fetch_event_blob.js";
-  scoped_refptr<WorkerActivatedObserver> observer =
-      new WorkerActivatedObserver(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   blink::mojom::ServiceWorkerRegistrationOptions options(
       embedded_test_server()->GetURL(kPageUrl),
@@ -946,8 +953,9 @@ class ServiceWorkerEagerCacheStorageSetupTest
 // Update the service worker by registering a worker with different script url.
 // This test makes sure the worker can handle the fetch event using CacheStorage
 // API.
+// TODO(crbug.com/1087869): flaky on all platforms.
 IN_PROC_BROWSER_TEST_F(ServiceWorkerEagerCacheStorageSetupTest,
-                       UpdateOnScriptUrlChange) {
+                       DISABLED_UpdateOnScriptUrlChange) {
   StartServerAndNavigateToSetup();
   EXPECT_TRUE(NavigateToURL(shell(),
                             embedded_test_server()->GetURL(
@@ -969,7 +977,8 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerEagerCacheStorageSetupTest,
   }
 
   // Update the service worker by changing the script url.
-  auto observer = base::MakeRefCounted<WorkerActivatedObserver>(wrapper());
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
   observer->Init();
   EXPECT_EQ("DONE", EvalJs(shell(),
                            "registerWithoutAwaitingReady('fetch_event_response_"
@@ -1027,8 +1036,8 @@ class ServiceWorkerNavigationPreloadTest : public ServiceWorkerBrowserTest {
 
   void SetupForNavigationPreloadTest(const GURL& scope,
                                      const GURL& worker_url) {
-    scoped_refptr<WorkerActivatedObserver> observer =
-        new WorkerActivatedObserver(wrapper());
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(
+        wrapper(), ServiceWorkerVersion::ACTIVATED);
     observer->Init();
 
     blink::mojom::ServiceWorkerRegistrationOptions options(
@@ -2037,8 +2046,8 @@ class ServiceWorkerV8CodeCacheForCacheStorageTest
   virtual std::string GetWorkerURL() { return kWorkerUrl; }
 
   void RegisterAndActivateServiceWorker() {
-    scoped_refptr<WorkerActivatedObserver> observer =
-        new WorkerActivatedObserver(wrapper());
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(
+        wrapper(), ServiceWorkerVersion::ACTIVATED);
     observer->Init();
     blink::mojom::ServiceWorkerRegistrationOptions options(
         embedded_test_server()->GetURL(kPageUrl),
@@ -2367,8 +2376,8 @@ class ServiceWorkerDisableWebSecurityTest : public ServiceWorkerBrowserTest {
 
   void RegisterServiceWorkerOnCrossOriginServer(const std::string& scope,
                                                 const std::string& script) {
-    scoped_refptr<WorkerActivatedObserver> observer =
-        new WorkerActivatedObserver(wrapper());
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(
+        wrapper(), ServiceWorkerVersion::ACTIVATED);
     observer->Init();
     blink::mojom::ServiceWorkerRegistrationOptions options(
         cross_origin_server_.GetURL(scope), blink::mojom::ScriptType::kClassic,
@@ -2533,8 +2542,16 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerURLLoaderThrottleTest,
   ASSERT_TRUE(dict);
 
   // Default headers are present.
+  const char* frame_accept_c_str = network::kFrameAcceptHeaderValue;
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+    frame_accept_c_str =
+        "text/html,application/xhtml+xml,application/xml;q=0.9,"
+        "image/avif,image/webp,image/apng,*/*;q=0.8";
+  }
+#endif
   EXPECT_TRUE(CheckHeader(*dict, "accept",
-                          std::string(network::kFrameAcceptHeaderValue) +
+                          std::string(frame_accept_c_str) +
                               std::string(kAcceptHeaderSignedExchangeSuffix)));
 
   // Injected headers are present.
@@ -2648,4 +2665,209 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerURLLoaderThrottleTest,
   SetBrowserClientForTesting(old_content_browser_client);
 }
 
+// Test fixture to support validating throttling from within an installing
+// service worker.
+class ServiceWorkerThrottlingTest : public ServiceWorkerBrowserTest {
+ protected:
+  ServiceWorkerThrottlingTest() {
+    // Configure the field trial param to trigger throttling after
+    // there are only 2 outstanding requests from an installiner
+    // service worker.
+    scoped_feature_list_.InitAndEnableFeatureWithParameters(
+        blink::features::kThrottleInstallingServiceWorker, {{"limit", "2"}});
+  }
+
+  void RegisterServiceWorkerAndWaitForState(
+      const std::string& script_url,
+      const std::string& scope,
+      ServiceWorkerVersion::Status state) {
+    auto observer = base::MakeRefCounted<WorkerStateObserver>(wrapper(), state);
+    observer->Init();
+    blink::mojom::ServiceWorkerRegistrationOptions options(
+        embedded_test_server()->GetURL(scope),
+        blink::mojom::ScriptType::kClassic,
+        blink::mojom::ServiceWorkerUpdateViaCache::kImports);
+    public_context()->RegisterServiceWorker(
+        embedded_test_server()->GetURL(script_url), options,
+        base::BindOnce(&ExpectResultAndRun, true, base::DoNothing()));
+    observer->Wait();
+  }
+
+  int GetBlockingResponseCount() { return blocking_response_list_.size(); }
+
+  void StopBlocking() {
+    std::vector<scoped_refptr<BlockingResponse>> list;
+    {
+      base::AutoLock auto_lock(lock_);
+      should_block_ = false;
+      list = std::move(blocking_response_list_);
+    }
+    for (const auto& response : list) {
+      response->StopBlocking();
+    }
+  }
+
+  void SetUpOnMainThread() override {
+    ServiceWorkerBrowserTest::SetUpOnMainThread();
+    // Configure the EmbeddedTestServer to use our custom request handler
+    // to return blocking responses where appropriate.
+    embedded_test_server()->RegisterRequestHandler(base::BindRepeating(
+        &ServiceWorkerThrottlingTest::HandleRequest, base::Unretained(this)));
+    StartServerAndNavigateToSetup();
+  }
+
+ private:
+  // An object representing an http response that blocks returning its status
+  // code until the test tells it to proceed.
+  class BlockingResponse : public base::RefCountedThreadSafe<BlockingResponse> {
+   public:
+    // We must return ownership of a net::test_server::HttpResponse from
+    // HandleRequest(), but we also want to track the Response in our test
+    // so that we can unblock the response.  In addition, the EmbeddedTestServer
+    // deletes its HttpResponse after calling SendResponse().  Therefore, we
+    // use an inner class to return to EmbeddedTestServer and hold the
+    // outer BlockingResponse alive in the test itself.  The inner class simply
+    // forwards the SendResponse() method to the outer class.
+    class Inner : public net::test_server::HttpResponse {
+     public:
+      explicit Inner(base::WeakPtr<BlockingResponse> owner)
+          : owner_(std::move(owner)) {}
+
+      ~Inner() override = default;
+      void SendResponse(const net::test_server::SendBytesCallback& send,
+                        base::OnceClosure done) override {
+        if (owner_)
+          owner_->SendResponse(std::move(send), std::move(done));
+      }
+
+     private:
+      base::WeakPtr<BlockingResponse> owner_;
+    };
+
+    BlockingResponse() : task_runner_(base::SequencedTaskRunnerHandle::Get()) {}
+
+    // Mint an HttpResponse suitable for returning to the EmbeddedTestServer
+    // that will forward to this BlockingResponse.
+    std::unique_ptr<net::test_server::HttpResponse> GetResponse() {
+      DCHECK(task_runner_->RunsTasksInCurrentSequence());
+      return std::make_unique<Inner>(weak_factory_.GetWeakPtr());
+    }
+
+    // Called by the EmbeddedTestServer via our inner class.  The callbacks
+    // are stored and invoked later when we've been told to unblock.
+    void SendResponse(const net::test_server::SendBytesCallback& send,
+                      base::OnceClosure done) {
+      DCHECK(task_runner_->RunsTasksInCurrentSequence());
+      send_ = send;
+      done_ = std::move(done);
+      if (should_block_) {
+        blocking_ = true;
+        return;
+      }
+      CompleteResponseOnTaskRunner();
+    }
+
+    // Called by the test when we want to unblock this response.
+    void StopBlocking() {
+      // Called on the main thread by the test.
+      task_runner_->PostTask(
+          FROM_HERE,
+          base::BindOnce(&BlockingResponse::StopBlockingOnTaskRunner, this));
+    }
+
+   private:
+    friend class base::RefCountedThreadSafe<BlockingResponse>;
+    ~BlockingResponse() = default;
+
+    void StopBlockingOnTaskRunner() {
+      DCHECK(task_runner_->RunsTasksInCurrentSequence());
+      should_block_ = false;
+      if (!blocking_)
+        return;
+      blocking_ = false;
+      CompleteResponseOnTaskRunner();
+    }
+
+    void CompleteResponseOnTaskRunner() {
+      DCHECK(task_runner_->RunsTasksInCurrentSequence());
+      const char kPageResponse[] =
+          "HTTP/1.1 200 HELLOWORLD\r\n"
+          "Connection: close\r\n"
+          "Content-Length: 32\r\n"
+          "Content-Type: text/html\r\n"
+          "\r\n"
+          "<title>ERROR</title>Hello world.";
+      std::move(send_).Run(kPageResponse, std::move(done_));
+    }
+
+    // Accessed on any thread.
+    scoped_refptr<base::SequencedTaskRunner> task_runner_;
+    // All other members only accessed on |task_runner_| sequence.
+    net::test_server::SendBytesCallback send_;
+    base::OnceClosure done_;
+    bool should_block_ = true;
+    bool blocking_ = false;
+    base::WeakPtrFactory<BlockingResponse> weak_factory_{this};
+  };
+
+  // Return a blocking response to the EmbeddedTestServer for any
+  // request where there is a search param named "block".
+  std::unique_ptr<net::test_server::HttpResponse> HandleRequest(
+      const net::test_server::HttpRequest& request) {
+    base::AutoLock auto_lock(lock_);
+    if (!should_block_ ||
+        request.GetURL().query().find("block") == std::string::npos) {
+      return nullptr;
+    }
+    auto response = base::MakeRefCounted<BlockingResponse>();
+    blocking_response_list_.push_back(std::move(response));
+    return blocking_response_list_.back()->GetResponse();
+  }
+
+  base::test::ScopedFeatureList scoped_feature_list_;
+  base::Lock lock_;
+  // Accessed from multiple threads, but protected by |lock_|.
+  std::vector<scoped_refptr<BlockingResponse>> blocking_response_list_;
+  // Accessed from multiple threads, but protected by |lock_|.
+  bool should_block_ = true;
+  base::WeakPtrFactory<ServiceWorkerThrottlingTest> weak_factory_{this};
+};
+
+IN_PROC_BROWSER_TEST_F(ServiceWorkerThrottlingTest, ThrottleInstalling) {
+  // Register a service worker that loads 3 resources in its install
+  // handler.  The test server will cause these loads to block which
+  // should trigger throttling on the third request.
+  RegisterServiceWorkerAndWaitForState(
+      "/service_worker/throttling_blocking_sw.js",
+      "/service_worker/throttling_blocking", ServiceWorkerVersion::INSTALLING);
+
+  // Register a second service worker that also loads 3 resources in
+  // its install handler.  The test server will not block these loads
+  // and the worker should progress to the activated state.
+  //
+  // This second service worker is used to wait for the first worker
+  // to potentially request its resources.  By the time the second worker
+  // activates the first worker should have requested its resources and
+  // triggered throttling.  This avoids the need for an arbitrary timeout.
+  RegisterServiceWorkerAndWaitForState(
+      "/service_worker/throttling_non_blocking_sw.js",
+      "/service_worker/throttling_non_blocking",
+      ServiceWorkerVersion::ACTIVATED);
+
+  // If throttling worked correctly then there should only be 2 outstanding
+  // requests blocked by the test server.
+  EXPECT_EQ(2, GetBlockingResponseCount());
+
+  auto observer = base::MakeRefCounted<WorkerStateObserver>(
+      wrapper(), ServiceWorkerVersion::ACTIVATED);
+  observer->Init();
+
+  // Stop blocking the resources loaded by the first service worker.
+  StopBlocking();
+
+  // Verify that throttling correctly notes when resources can load and
+  // the first service worker fully activates.
+  observer->Wait();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_cache_writer.cc b/chromium/content/browser/service_worker/service_worker_cache_writer.cc
index 41a1733f54e..cb817330492 100644
--- a/chromium/content/browser/service_worker/service_worker_cache_writer.cc
+++ b/chromium/content/browser/service_worker/service_worker_cache_writer.cc
@@ -9,15 +9,16 @@
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
-#include "content/browser/appcache/appcache_response_info.h"
 #include "content/browser/service_worker/service_worker_disk_cache.h"
+#include "content/common/service_worker/service_worker_utils.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace {
 
 const size_t kCopyBufferSize = 16 * 1024;
 
 // Shim class used to turn always-async functions into async-or-result
-// functions. See the comments below near ReadInfoHelper.
+// functions. See the comments below near ReadResponseHead.
 class AsyncOnlyCompletionCallbackAdaptor
     : public base::RefCounted<AsyncOnlyCompletionCallbackAdaptor> {
  public:
@@ -50,6 +51,41 @@ class AsyncOnlyCompletionCallbackAdaptor
 
 namespace content {
 
+// Similar to AsyncOnlyCompletionCallbackAdaptor but specialized for
+// ReadResponseHead.
+class ServiceWorkerCacheWriter::ReadResponseHeadCallbackAdapter
+    : public base::RefCounted<
+          ServiceWorkerCacheWriter::ReadResponseHeadCallbackAdapter> {
+ public:
+  explicit ReadResponseHeadCallbackAdapter(
+      base::WeakPtr<ServiceWorkerCacheWriter> owner)
+      : owner_(std::move(owner)) {
+    DCHECK(owner_);
+  }
+
+  void DidReadResponseInfo(int result,
+                           network::mojom::URLResponseHeadPtr response_head,
+                           scoped_refptr<net::IOBufferWithSize> /*metadata*/) {
+    result_ = result;
+    if (!owner_)
+      return;
+    owner_->response_head_to_read_ = std::move(response_head);
+    if (async_)
+      owner_->AsyncDoLoop(result);
+  }
+
+  void SetAsync() { async_ = true; }
+  int result() { return result_; }
+
+ private:
+  friend class base::RefCounted<ReadResponseHeadCallbackAdapter>;
+  virtual ~ReadResponseHeadCallbackAdapter() = default;
+
+  base::WeakPtr<ServiceWorkerCacheWriter> owner_;
+  bool async_ = false;
+  int result_ = net::ERR_IO_PENDING;
+};
+
 int ServiceWorkerCacheWriter::DoLoop(int status) {
   do {
     switch (state_) {
@@ -169,12 +205,12 @@ ServiceWorkerCacheWriter::CreateForComparison(
 }
 
 net::Error ServiceWorkerCacheWriter::MaybeWriteHeaders(
-    HttpResponseInfoIOBuffer* headers,
+    network::mojom::URLResponseHeadPtr response_head,
     OnWriteCompleteCallback callback) {
   DCHECK(!io_pending_);
   DCHECK(!IsCopying());
 
-  headers_to_write_ = headers;
+  response_head_to_write_ = std::move(response_head);
   pending_callback_ = std::move(callback);
   DCHECK_EQ(STATE_START, state_);
   int result = DoLoop(net::OK);
@@ -322,11 +358,10 @@ int ServiceWorkerCacheWriter::DoStart(int result) {
 
 int ServiceWorkerCacheWriter::DoReadHeadersForCompare(int result) {
   DCHECK_GE(result, 0);
-  DCHECK(headers_to_write_);
+  DCHECK(response_head_to_write_);
 
-  headers_to_read_ = new HttpResponseInfoIOBuffer;
   state_ = STATE_READ_HEADERS_FOR_COMPARE_DONE;
-  return ReadInfoHelper(compare_reader_, headers_to_read_.get());
+  return ReadResponseHead(compare_reader_);
 }
 
 int ServiceWorkerCacheWriter::DoReadHeadersForCompareDone(int result) {
@@ -334,7 +369,8 @@ int ServiceWorkerCacheWriter::DoReadHeadersForCompareDone(int result) {
     state_ = STATE_DONE;
     return result;
   }
-  cached_length_ = headers_to_read_->response_data_size;
+  DCHECK(response_head_to_read_);
+  cached_length_ = response_head_to_read_->content_length;
   bytes_compared_ = 0;
   state_ = STATE_DONE;
   return net::OK;
@@ -421,10 +457,9 @@ int ServiceWorkerCacheWriter::DoReadHeadersForCopy(int result) {
   DCHECK_GE(result, 0);
   DCHECK(copy_reader_);
   bytes_copied_ = 0;
-  headers_to_read_ = new HttpResponseInfoIOBuffer;
   data_to_copy_ = base::MakeRefCounted<net::IOBuffer>(kCopyBufferSize);
   state_ = STATE_READ_HEADERS_FOR_COPY_DONE;
-  return ReadInfoHelper(copy_reader_, headers_to_read_.get());
+  return ReadResponseHead(copy_reader_);
 }
 
 int ServiceWorkerCacheWriter::DoReadHeadersForCopyDone(int result) {
@@ -444,7 +479,13 @@ int ServiceWorkerCacheWriter::DoWriteHeadersForCopy(int result) {
   DCHECK_GE(result, 0);
   DCHECK(writer_);
   state_ = STATE_WRITE_HEADERS_FOR_COPY_DONE;
-  return WriteInfo(IsCopying() ? headers_to_read_ : headers_to_write_);
+  if (IsCopying()) {
+    DCHECK(response_head_to_read_);
+    return WriteResponseHead(*response_head_to_read_);
+  } else {
+    DCHECK(response_head_to_write_);
+    return WriteResponseHead(*response_head_to_write_);
+  }
 }
 
 int ServiceWorkerCacheWriter::DoWriteHeadersForCopyDone(int result) {
@@ -462,7 +503,7 @@ int ServiceWorkerCacheWriter::DoReadDataForCopy(int result) {
   // If the cache writer is only for copy, get the total size to read from
   // header data instead of |bytes_compared_| as no comparison is done.
   size_t total_size_to_read =
-      IsCopying() ? headers_to_read_->response_data_size : bytes_compared_;
+      IsCopying() ? response_head_to_read_->content_length : bytes_compared_;
   size_t to_read =
       std::min(kCopyBufferSize, total_size_to_read - bytes_copied_);
 
@@ -509,8 +550,9 @@ int ServiceWorkerCacheWriter::DoWriteDataForCopyDone(int result) {
 int ServiceWorkerCacheWriter::DoWriteHeadersForPassthrough(int result) {
   DCHECK_GE(result, 0);
   DCHECK(writer_);
+  DCHECK(response_head_to_write_);
   state_ = STATE_WRITE_HEADERS_FOR_PASSTHROUGH_DONE;
-  return WriteInfo(headers_to_write_);
+  return WriteResponseHead(*response_head_to_write_);
 }
 
 int ServiceWorkerCacheWriter::DoWriteHeadersForPassthroughDone(int result) {
@@ -541,26 +583,22 @@ int ServiceWorkerCacheWriter::DoDone(int result) {
   return result;
 }
 
-// These helpers adapt the AppCache "always use the callback" pattern to the
+// These methods adapt the AppCache "always use the callback" pattern to the
 // //net "only use the callback for async" pattern using
-// AsyncCompletionCallbackAdaptor.
+// AsyncCompletionCallbackAdaptor and ReadResponseHeadCallbackAdaptor.
 //
 // Specifically, these methods return result codes directly for synchronous
 // completions, and only run their callback (which is AsyncDoLoop) for
 // asynchronous completions.
 
-int ServiceWorkerCacheWriter::ReadInfoHelper(
-    const std::unique_ptr<ServiceWorkerResponseReader>& reader,
-    HttpResponseInfoIOBuffer* buf) {
-  net::CompletionOnceCallback run_callback = base::BindOnce(
-      &ServiceWorkerCacheWriter::AsyncDoLoop, weak_factory_.GetWeakPtr());
-  scoped_refptr<AsyncOnlyCompletionCallbackAdaptor> adaptor(
-      new AsyncOnlyCompletionCallbackAdaptor(std::move(run_callback)));
-  reader->ReadInfo(
-      buf, base::BindOnce(&AsyncOnlyCompletionCallbackAdaptor::WrappedCallback,
-                          adaptor));
-  adaptor->set_async(true);
-  return adaptor->result();
+int ServiceWorkerCacheWriter::ReadResponseHead(
+    const std::unique_ptr<ServiceWorkerResponseReader>& reader) {
+  auto adapter = base::MakeRefCounted<ReadResponseHeadCallbackAdapter>(
+      weak_factory_.GetWeakPtr());
+  reader->ReadResponseHead(base::BindOnce(
+      &ReadResponseHeadCallbackAdapter::DidReadResponseInfo, adapter));
+  adapter->SetAsync();
+  return adapter->result();
 }
 
 int ServiceWorkerCacheWriter::ReadDataHelper(
@@ -579,34 +617,34 @@ int ServiceWorkerCacheWriter::ReadDataHelper(
   return adaptor->result();
 }
 
-int ServiceWorkerCacheWriter::WriteInfoToResponseWriter(
-    scoped_refptr<HttpResponseInfoIOBuffer> response_info) {
+int ServiceWorkerCacheWriter::WriteResponseHeadToResponseWriter(
+    const network::mojom::URLResponseHead& response_head,
+    int response_data_size) {
   did_replace_ = true;
   net::CompletionOnceCallback run_callback = base::BindOnce(
       &ServiceWorkerCacheWriter::AsyncDoLoop, weak_factory_.GetWeakPtr());
   scoped_refptr<AsyncOnlyCompletionCallbackAdaptor> adaptor(
       new AsyncOnlyCompletionCallbackAdaptor(std::move(run_callback)));
-  writer_->WriteInfo(
-      response_info.get(),
+  writer_->WriteResponseHead(
+      response_head, response_data_size,
       base::BindOnce(&AsyncOnlyCompletionCallbackAdaptor::WrappedCallback,
                      adaptor));
   adaptor->set_async(true);
   return adaptor->result();
 }
 
-int ServiceWorkerCacheWriter::WriteInfo(
-    scoped_refptr<HttpResponseInfoIOBuffer> response_info) {
-  if (!write_observer_)
-    return WriteInfoToResponseWriter(std::move(response_info));
-
-  int result = write_observer_->WillWriteInfo(response_info);
-  if (result != net::OK) {
-    DCHECK_NE(result, net::ERR_IO_PENDING);
-    state_ = STATE_DONE;
-    return result;
+int ServiceWorkerCacheWriter::WriteResponseHead(
+    const network::mojom::URLResponseHead& response_head) {
+  if (write_observer_) {
+    int result = write_observer_->WillWriteResponseHead(response_head);
+    if (result != net::OK) {
+      DCHECK_NE(result, net::ERR_IO_PENDING);
+      state_ = STATE_DONE;
+      return result;
+    }
   }
-
-  return WriteInfoToResponseWriter(std::move(response_info));
+  return WriteResponseHeadToResponseWriter(response_head,
+                                           response_head.content_length);
 }
 
 int ServiceWorkerCacheWriter::WriteDataToResponseWriter(
diff --git a/chromium/content/browser/service_worker/service_worker_cache_writer.h b/chromium/content/browser/service_worker/service_worker_cache_writer.h
index ee94806f8df..8939d623ba6 100644
--- a/chromium/content/browser/service_worker/service_worker_cache_writer.h
+++ b/chromium/content/browser/service_worker/service_worker_cache_writer.h
@@ -16,10 +16,10 @@
 #include "content/common/content_export.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 
 namespace content {
 
-struct HttpResponseInfoIOBuffer;
 class ServiceWorkerResponseReader;
 class ServiceWorkerResponseWriter;
 
@@ -44,10 +44,10 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
   // will be written to storage.
   class WriteObserver {
    public:
-    // Called before response info is written to storage.
+    // Called before response headers are written to storage.
     // Returns net::OK if success. Other values are treated as errors.
-    virtual int WillWriteInfo(
-        scoped_refptr<HttpResponseInfoIOBuffer> response_info) = 0;
+    virtual int WillWriteResponseHead(
+        const network::mojom::URLResponseHead& response_head) = 0;
 
     // Called before response data is written to storage.
     // Return value is used by cache writer to decide what to do next. A net
@@ -90,14 +90,14 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
 
   ~ServiceWorkerCacheWriter();
 
-  // Writes the supplied |headers| back to the cache. Returns ERR_IO_PENDING if
-  // the write will complete asynchronously, in which case |callback| will be
-  // called when it completes. Otherwise, returns a code other than
-  // ERR_IO_PENDING and does not invoke |callback|. Note that this method will
-  // not necessarily write data back to the cache if the incoming data is
-  // equivalent to the existing cached data. See the source of this function for
-  // details about how this function drives the state machine.
-  net::Error MaybeWriteHeaders(HttpResponseInfoIOBuffer* headers,
+  // Writes the supplied |response_head| back to the cache. Returns
+  // ERR_IO_PENDING if the write will complete asynchronously, in which case
+  // |callback| will be called when it completes. Otherwise, returns a code
+  // other than ERR_IO_PENDING and does not invoke |callback|. Note that this
+  // method will not necessarily write data back to the cache if the incoming
+  // data is equivalent to the existing cached data. See the source of this
+  // function for details about how this function drives the state machine.
+  net::Error MaybeWriteHeaders(network::mojom::URLResponseHeadPtr response_head,
                                OnWriteCompleteCallback callback);
 
   // Writes the supplied body data |data| back to the cache. Returns
@@ -139,6 +139,8 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
   }
 
  private:
+  class ReadResponseHeadCallbackAdapter;
+
   friend class ServiceWorkerUpdateCheckTestUtils;
 
   // States for the state machine.
@@ -242,21 +244,23 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
   //   a) Return ERR_IO_PENDING, and schedule a callback to run the state
   //      machine's Run() later, or
   //   b) Return some other value and do not schedule a callback.
-  int ReadInfoHelper(const std::unique_ptr<ServiceWorkerResponseReader>& reader,
-                     HttpResponseInfoIOBuffer* buf);
+  int ReadResponseHead(
+      const std::unique_ptr<ServiceWorkerResponseReader>& reader);
   int ReadDataHelper(const std::unique_ptr<ServiceWorkerResponseReader>& reader,
                      net::IOBuffer* buf,
                      int buf_len);
   // If no write observer is set through set_write_observer(),
-  // WriteInfo() operates the same as WriteInfoToResponseWriter() and
-  // WriteData() operates the same as WriteDataToResponseWriter().
+  // WriteResponseHead() operates the same as
+  // WriteResponseHeadToResponseWriter() and WriteData() operates the same as
+  // WriteDataToResponseWriter().
   // If observer is set, the argument |response_info| or |data| is first sent
-  // to observer then WriteInfoToResponseWriter() or
+  // to observer then WriteResponseHeadToResponseWriter() or
   // WriteDataToResponseWriter() is called.
-  int WriteInfo(scoped_refptr<HttpResponseInfoIOBuffer> response_info);
+  int WriteResponseHead(const network::mojom::URLResponseHead& response_head);
   int WriteData(scoped_refptr<net::IOBuffer> data, int length);
-  int WriteInfoToResponseWriter(
-      scoped_refptr<HttpResponseInfoIOBuffer> response_info);
+  int WriteResponseHeadToResponseWriter(
+      const network::mojom::URLResponseHead& response_head,
+      int response_data_size);
   int WriteDataToResponseWriter(scoped_refptr<net::IOBuffer> data, int length);
 
   // Called when |write_observer_| finishes its WillWriteData() operation.
@@ -277,8 +281,8 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
   bool io_pending_;
   bool comparing_;
 
-  scoped_refptr<HttpResponseInfoIOBuffer> headers_to_read_;
-  scoped_refptr<HttpResponseInfoIOBuffer> headers_to_write_;
+  network::mojom::URLResponseHeadPtr response_head_to_read_;
+  network::mojom::URLResponseHeadPtr response_head_to_write_;
   scoped_refptr<net::IOBuffer> data_to_read_;
   int len_to_read_;
   scoped_refptr<net::IOBuffer> data_to_copy_;
diff --git a/chromium/content/browser/service_worker/service_worker_cache_writer_unittest.cc b/chromium/content/browser/service_worker/service_worker_cache_writer_unittest.cc
index a0a5fa8c026..b3e1810b360 100644
--- a/chromium/content/browser/service_worker/service_worker_cache_writer_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_cache_writer_unittest.cc
@@ -30,9 +30,9 @@ class MockServiceWorkerCacheWriterObserver
   MockServiceWorkerCacheWriterObserver() : data_length_(0), result_(net::OK) {}
   ~MockServiceWorkerCacheWriterObserver() {}
 
-  int WillWriteInfo(
-      scoped_refptr<HttpResponseInfoIOBuffer> response_info) override {
-    response_info_ = std::move(response_info);
+  int WillWriteResponseHead(
+      const network::mojom::URLResponseHead& response_head) override {
+    response_ = response_head.Clone();
     return net::OK;
   }
 
@@ -54,7 +54,7 @@ class MockServiceWorkerCacheWriterObserver
   // Set the return value of WillWriteData().
   void set_result(net::Error result) { result_ = result; }
 
-  scoped_refptr<HttpResponseInfoIOBuffer> response_info_;
+  network::mojom::URLResponseHeadPtr response_;
   scoped_refptr<net::IOBuffer> data_;
   size_t data_length_;
   base::OnceCallback<void(net::Error)> callback_;
@@ -146,12 +146,13 @@ class ServiceWorkerCacheWriterTest : public ::testing::Test {
   }
 
   net::Error WriteHeaders(size_t len) {
-    auto buf = base::MakeRefCounted<HttpResponseInfoIOBuffer>();
-    buf->response_data_size = len;
-    buf->http_info = std::make_unique<net::HttpResponseInfo>();
-    buf->http_info->headers =
-        base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.0 200 OK\0\0");
-    return cache_writer_->MaybeWriteHeaders(buf.get(), CreateWriteCallback());
+    auto response_head = network::mojom::URLResponseHead::New();
+    const char data[] = "HTTP/1.1 200 OK\0\0";
+    response_head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+        std::string(data, base::size(data)));
+    response_head->content_length = len;
+    return cache_writer_->MaybeWriteHeaders(std::move(response_head),
+                                            CreateWriteCallback());
   }
 
   net::Error WriteData(const std::string& data) {
@@ -479,7 +480,10 @@ TEST_F(ServiceWorkerCacheWriterTest, CompareDataOkAsync) {
 
 TEST_F(ServiceWorkerCacheWriterTest, CompareDataManyOkAsync) {
   const std::string expected_data[] = {
-      "abcdef", "ghijkl", "mnopqr", "stuvwxyz",
+      "abcdef",
+      "ghijkl",
+      "mnopqr",
+      "stuvwxyz",
   };
   size_t response_size = 0;
   for (size_t i = 0; i < base::size(expected_data); ++i)
@@ -1121,7 +1125,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverSyncResponseWriterSync) {
   cache_writer_->set_write_observer(&observer);
 
   net::Error error = WriteHeaders(kHeaderSize);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
   EXPECT_EQ(net::OK, error);
 
   error = WriteData(data);
@@ -1153,7 +1157,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverAsyncResponseWriterSync) {
 
   net::Error error = WriteHeaders(kHeaderSize);
   EXPECT_EQ(net::OK, error);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
 
   error = WriteData(data);
   EXPECT_EQ(net::ERR_IO_PENDING, error);
@@ -1186,7 +1190,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverSyncResponseWriterAsync) {
 
   net::Error error = WriteHeaders(kHeaderSize);
   EXPECT_EQ(net::ERR_IO_PENDING, error);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
   writer->CompletePendingWrite();
   EXPECT_TRUE(write_complete_);
   EXPECT_EQ(last_error_, net::OK);
@@ -1223,7 +1227,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverAsyncResponseWriterAsync) {
 
   net::Error error = WriteHeaders(kHeaderSize);
   EXPECT_EQ(net::ERR_IO_PENDING, error);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
   writer->CompletePendingWrite();
   EXPECT_TRUE(write_complete_);
   EXPECT_EQ(last_error_, net::OK);
@@ -1258,7 +1262,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverSyncFail) {
   cache_writer_->set_write_observer(&observer);
 
   net::Error error = WriteHeaders(kHeaderSize);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
   EXPECT_EQ(net::OK, error);
 
   observer.set_result(net::ERR_FAILED);
@@ -1286,7 +1290,7 @@ TEST_F(ServiceWorkerCacheWriterTest, ObserverAsyncFail) {
 
   net::Error error = WriteHeaders(kHeaderSize);
   EXPECT_EQ(net::OK, error);
-  EXPECT_TRUE(observer.response_info_);
+  EXPECT_TRUE(observer.response_);
 
   error = WriteData(data);
   EXPECT_EQ(net::ERR_IO_PENDING, error);
diff --git a/chromium/content/browser/service_worker/service_worker_client_info.cc b/chromium/content/browser/service_worker/service_worker_client_info.cc
index 7e8b9f140c5..54e413c3e3b 100644
--- a/chromium/content/browser/service_worker/service_worker_client_info.cc
+++ b/chromium/content/browser/service_worker/service_worker_client_info.cc
@@ -4,31 +4,18 @@
 
 #include "content/browser/service_worker/service_worker_client_info.h"
 
-#include "content/public/common/child_process_host.h"
-#include "ipc/ipc_message.h"
-
 namespace content {
 
-ServiceWorkerClientInfo::ServiceWorkerClientInfo()
-    : ServiceWorkerClientInfo(
-          ChildProcessHost::kInvalidUniqueID,
-          MSG_ROUTING_NONE,
-          base::RepeatingCallback<WebContents*(void)>(),
-          blink::mojom::ServiceWorkerContainerType::kUnknown) {}
-
 ServiceWorkerClientInfo::ServiceWorkerClientInfo(
-    int process_id,
-    int route_id,
-    const base::RepeatingCallback<WebContents*(void)>& web_contents_getter,
-    blink::mojom::ServiceWorkerContainerType type)
-    : process_id(process_id),
-      route_id(route_id),
-      web_contents_getter(web_contents_getter),
-      type(type) {}
+    blink::mojom::ServiceWorkerClientType type,
+    int frame_tree_node_id)
+    : type(type), frame_tree_node_id(frame_tree_node_id) {
+  DCHECK_NE(type, blink::mojom::ServiceWorkerClientType::kAll);
+}
 
 ServiceWorkerClientInfo::ServiceWorkerClientInfo(
     const ServiceWorkerClientInfo& other) = default;
 
-ServiceWorkerClientInfo::~ServiceWorkerClientInfo() {}
+ServiceWorkerClientInfo::~ServiceWorkerClientInfo() = default;
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_client_info.h b/chromium/content/browser/service_worker/service_worker_client_info.h
index d310446ef5e..2f7353e6da5 100644
--- a/chromium/content/browser/service_worker/service_worker_client_info.h
+++ b/chromium/content/browser/service_worker/service_worker_client_info.h
@@ -5,37 +5,23 @@
 #ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_CLIENT_INFO_H_
 #define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_CLIENT_INFO_H_
 
-#include "base/callback.h"
 #include "content/common/content_export.h"
-#include "content/public/browser/web_contents.h"
-#include "third_party/blink/public/mojom/service_worker/service_worker_container_type.mojom.h"
+#include "third_party/blink/public/mojom/service_worker/service_worker_client.mojom.h"
 
 namespace content {
 
 // Holds information about a single service worker client:
 // https://w3c.github.io/ServiceWorker/#client
 struct CONTENT_EXPORT ServiceWorkerClientInfo {
-  ServiceWorkerClientInfo();
-  ServiceWorkerClientInfo(
-      int process_id,
-      int route_id,
-      const base::RepeatingCallback<WebContents*(void)>& web_contents_getter,
-      blink::mojom::ServiceWorkerContainerType type);
+  ServiceWorkerClientInfo(blink::mojom::ServiceWorkerClientType type,
+                          int frame_tree_node_id);
   ServiceWorkerClientInfo(const ServiceWorkerClientInfo& other);
   ~ServiceWorkerClientInfo();
 
-  // The renderer process this client lives in.
-  int process_id;
-  // If this client is a document |route_id| is its frame id; otherwise it is
-  // MSG_ROUTING_NONE.
-  int route_id;
-  // Non-null if this client is a document and its corresponding
-  // ServiceWorkerProviderHost was pre-created for a navigation. Returns
-  // information indicating the tab where the navigation is occurring or
-  // occurred in.
-  base::RepeatingCallback<WebContents*(void)> web_contents_getter;
   // The client type.
-  blink::mojom::ServiceWorkerContainerType type;
+  blink::mojom::ServiceWorkerClientType type;
+
+  int frame_tree_node_id;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_client_utils.cc b/chromium/content/browser/service_worker/service_worker_client_utils.cc
index 04e50033436..52933cd0851 100644
--- a/chromium/content/browser/service_worker/service_worker_client_utils.cc
+++ b/chromium/content/browser/service_worker/service_worker_client_utils.cc
@@ -13,10 +13,12 @@
 #include "base/callback_helpers.h"
 #include "base/location.h"
 #include "base/macros.h"
+#include "base/optional.h"
 #include "base/single_thread_task_runner.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/service_worker/service_worker_container_host.h"
@@ -130,7 +132,7 @@ blink::mojom::ServiceWorkerClientInfoPtr GetWindowClientInfoOnUI(
     return nullptr;
 
   // Treat items in backforward cache as not existing.
-  if (render_frame_host->is_in_back_forward_cache())
+  if (render_frame_host->IsInBackForwardCache())
     return nullptr;
 
   // TODO(mlamouri,michaeln): it is possible to end up collecting information
@@ -246,7 +248,7 @@ void OpenWindowOnUI(
     return;
   }
 
-  // The following code is a rough copy of NavigatorImpl::RequestOpenURL. That
+  // The following code is a rough copy of Navigator::RequestOpenURL. That
   // function can't be used directly since there is no render frame host yet
   // that the navigation will occur in.
 
@@ -304,14 +306,15 @@ void NavigateClientOnUI(const GURL& url,
   int frame_tree_node_id = rfhi->frame_tree_node()->frame_tree_node_id();
   Navigator* navigator = rfhi->frame_tree_node()->navigator();
   navigator->RequestOpenURL(
-      rfhi, url, url::Origin::Create(script_url), nullptr /* post_body */,
+      rfhi, url, GlobalFrameRoutingId() /* initiator_routing_id */,
+      url::Origin::Create(script_url), nullptr /* post_body */,
       std::string() /* extra_headers */,
       Referrer::SanitizeForRequest(
           url, Referrer(script_url, network::mojom::ReferrerPolicy::kDefault)),
       WindowOpenDisposition::CURRENT_TAB,
       false /* should_replace_current_entry */, false /* user_gesture */,
       blink::TriggeringEventInfo::kUnknown, std::string() /* href_translate */,
-      nullptr /* blob_url_loader_factory */);
+      nullptr /* blob_url_loader_factory */, base::nullopt);
   new OpenURLObserver(web_contents, frame_tree_node_id, std::move(callback));
 }
 
@@ -320,8 +323,7 @@ void AddWindowClient(
     std::vector<std::tuple<int, int, base::TimeTicks, std::string>>*
         client_info) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  if (container_host->client_type() !=
-      blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!container_host->IsContainerForWindowClient()) {
     return;
   }
   if (!container_host->is_execution_ready())
@@ -337,7 +339,7 @@ void AddNonWindowClient(
     std::vector<blink::mojom::ServiceWorkerClientInfoPtr>* out_clients) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   blink::mojom::ServiceWorkerClientType host_client_type =
-      container_host->client_type();
+      container_host->GetClientType();
   if (host_client_type == blink::mojom::ServiceWorkerClientType::kWindow)
     return;
   if (client_type != blink::mojom::ServiceWorkerClientType::kAll &&
@@ -549,8 +551,7 @@ void DidGetExecutionReadyClient(
 void FocusWindowClient(ServiceWorkerContainerHost* container_host,
                        ClientCallback callback) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  DCHECK_EQ(blink::mojom::ServiceWorkerClientType::kWindow,
-            container_host->client_type());
+  DCHECK(container_host->IsContainerForWindowClient());
 
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     blink::mojom::ServiceWorkerClientInfoPtr info =
@@ -606,9 +607,9 @@ void GetClient(ServiceWorkerContainerHost* container_host,
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(container_host->IsContainerForClient());
 
-  blink::mojom::ServiceWorkerClientType client_type =
-      container_host->client_type();
-  if (client_type == blink::mojom::ServiceWorkerClientType::kWindow) {
+  blink::mojom::ServiceWorkerClientType host_client_type =
+      container_host->GetClientType();
+  if (host_client_type == blink::mojom::ServiceWorkerClientType::kWindow) {
     if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
       blink::mojom::ServiceWorkerClientInfoPtr info = GetWindowClientInfoOnUI(
           container_host->process_id(), container_host->frame_id(),
@@ -631,7 +632,7 @@ void GetClient(ServiceWorkerContainerHost* container_host,
   // DedicatedWorkerHost. crbug.com/968417
   auto client_info = blink::mojom::ServiceWorkerClientInfo::New(
       container_host->url(), blink::mojom::RequestContextFrameType::kNone,
-      container_host->client_uuid(), container_host->client_type(),
+      container_host->client_uuid(), host_client_type,
       /*page_hidden=*/true,
       /*is_focused=*/false,
       blink::mojom::ServiceWorkerClientLifecycleState::kActive,
diff --git a/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc b/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
index 6d1f0de5650..e4d7553e161 100644
--- a/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
@@ -8,7 +8,6 @@
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/callback_forward.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/optional.h"
@@ -27,6 +26,7 @@
 #include "content/public/browser/platform_notification_context.h"
 #include "content/public/browser/service_worker_context_observer.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/service_worker/service_worker_container_host.cc b/chromium/content/browser/service_worker/service_worker_container_host.cc
index 37b2527623c..ba6f1e4dcad 100644
--- a/chromium/content/browser/service_worker/service_worker_container_host.cc
+++ b/chromium/content/browser/service_worker/service_worker_container_host.cc
@@ -4,6 +4,9 @@
 
 #include "content/browser/service_worker/service_worker_container_host.h"
 
+#include <set>
+#include <utility>
+
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
 #include "base/guid.h"
@@ -80,100 +83,54 @@ class ServiceWorkerContainerHost::PendingUpdateVersion {
   DISALLOW_COPY_AND_ASSIGN(PendingUpdateVersion);
 };
 
-// static
-base::WeakPtr<ServiceWorkerContainerHost>
-ServiceWorkerContainerHost::CreateForWindow(
-    base::WeakPtr<ServiceWorkerContextCore> context,
-    bool are_ancestors_secure,
-    int frame_tree_node_id,
-    mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-        host_receiver,
-    mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
-        container_remote) {
-  DCHECK(context);
-  auto container_host = std::make_unique<ServiceWorkerContainerHost>(
-      blink::mojom::ServiceWorkerContainerType::kForWindow,
-      are_ancestors_secure, frame_tree_node_id, std::move(host_receiver),
-      std::move(container_remote), context);
-
-  std::string client_uuid = container_host->client_uuid();
-  base::WeakPtr<ServiceWorkerContainerHost> weak_ptr =
-      container_host->GetWeakPtr();
-  context->RegisterContainerHostByClientID(client_uuid,
-                                           std::move(container_host));
-  DCHECK(weak_ptr->receiver_.is_bound());
-  weak_ptr->receiver_.set_disconnect_handler(base::BindOnce(
-      &ServiceWorkerContextCore::UnregisterContainerHostByClientID, context,
-      client_uuid));
-  return weak_ptr;
-}
-
-// static
-base::WeakPtr<ServiceWorkerContainerHost>
-ServiceWorkerContainerHost::CreateForWebWorker(
-    base::WeakPtr<ServiceWorkerContextCore> context,
-    int process_id,
-    blink::mojom::ServiceWorkerContainerType container_type,
-    mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-        host_receiver,
-    mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
-        container_remote) {
-  DCHECK(context);
-  using ServiceWorkerContainerType = blink::mojom::ServiceWorkerContainerType;
-  DCHECK((base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker) &&
-          container_type == ServiceWorkerContainerType::kForDedicatedWorker) ||
-         container_type == ServiceWorkerContainerType::kForSharedWorker);
-  auto container_host = std::make_unique<ServiceWorkerContainerHost>(
-      container_type, /*is_parent_frame_secure=*/true,
-      FrameTreeNode::kFrameTreeNodeInvalidId, std::move(host_receiver),
-      std::move(container_remote), context);
-  container_host->SetContainerProcessId(process_id);
-
-  std::string client_uuid = container_host->client_uuid();
-  base::WeakPtr<ServiceWorkerContainerHost> weak_ptr =
-      container_host->GetWeakPtr();
-  context->RegisterContainerHostByClientID(client_uuid,
-                                           std::move(container_host));
-  DCHECK(weak_ptr->receiver_.is_bound());
-  weak_ptr->receiver_.set_disconnect_handler(base::BindOnce(
-      &ServiceWorkerContextCore::UnregisterContainerHostByClientID, context,
-      client_uuid));
-  return weak_ptr;
+ServiceWorkerContainerHost::ServiceWorkerContainerHost(
+    base::WeakPtr<ServiceWorkerContextCore> context)
+    : context_(std::move(context)), create_time_(base::TimeTicks::Now()) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForServiceWorker());
+  DCHECK(context_);
 }
 
 ServiceWorkerContainerHost::ServiceWorkerContainerHost(
-    blink::mojom::ServiceWorkerContainerType type,
+    base::WeakPtr<ServiceWorkerContextCore> context,
     bool is_parent_frame_secure,
-    int frame_tree_node_id,
-    mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-        host_receiver,
     mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
         container_remote,
-    base::WeakPtr<ServiceWorkerContextCore> context)
-    : type_(type),
+    int frame_tree_node_id)
+    : context_(std::move(context)),
       create_time_(base::TimeTicks::Now()),
+      client_uuid_(base::GenerateGUID()),
       is_parent_frame_secure_(is_parent_frame_secure),
-      frame_tree_node_id_(frame_tree_node_id),
-      web_contents_getter_(
-          frame_tree_node_id == FrameTreeNode::kFrameTreeNodeInvalidId
-              ? base::NullCallback()
-              : base::BindRepeating(&WebContents::FromFrameTreeNodeId,
-                                    frame_tree_node_id)),
-      client_uuid_(IsContainerForClient() ? base::GenerateGUID()
-                                          : std::string()),
-      context_(std::move(context)) {
+      container_(std::move(container_remote)),
+      client_type_(blink::mojom::ServiceWorkerClientType::kWindow),
+      frame_tree_node_id_(frame_tree_node_id) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForWindowClient());
   DCHECK(context_);
+  DCHECK(container_.is_bound());
+}
 
-  DCHECK(host_receiver.is_valid());
-  receiver_.Bind(std::move(host_receiver));
-
-  if (IsContainerForClient()) {
-    DCHECK(container_remote);
-    container_.Bind(std::move(container_remote));
-  } else {
-    DCHECK(IsContainerForServiceWorker());
-  }
+ServiceWorkerContainerHost::ServiceWorkerContainerHost(
+    base::WeakPtr<ServiceWorkerContextCore> context,
+    int process_id,
+    mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
+        container_remote,
+    blink::mojom::ServiceWorkerClientType client_type,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id)
+    : context_(std::move(context)),
+      create_time_(base::TimeTicks::Now()),
+      client_uuid_(base::GenerateGUID()),
+      process_id_(process_id),
+      container_(std::move(container_remote)),
+      client_type_(client_type),
+      dedicated_worker_id_(dedicated_worker_id),
+      shared_worker_id_(shared_worker_id) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForWorkerClient());
+  DCHECK(context_);
+  DCHECK_NE(process_id_, ChildProcessHost::kInvalidUniqueID);
+  DCHECK(container_.is_bound());
 }
 
 ServiceWorkerContainerHost::~ServiceWorkerContainerHost() {
@@ -203,7 +160,8 @@ ServiceWorkerContainerHost::~ServiceWorkerContainerHost() {
   controller_registration_.reset();
 
   // Ensure callbacks awaiting execution ready are notified.
-  RunExecutionReadyCallbacks();
+  if (IsContainerForClient())
+    RunExecutionReadyCallbacks();
 
   RemoveAllMatchingRegistrations();
 }
@@ -226,7 +184,7 @@ void ServiceWorkerContainerHost::Register(
     return;
   }
 
-  if (client_type() != blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!IsContainerForWindowClient()) {
     mojo::ReportBadMessage(ServiceWorkerConsts::kBadMessageFromNonWindow);
     std::move(callback).Run(blink::mojom::ServiceWorkerErrorType::kUnknown,
                             std::string(), nullptr);
@@ -445,8 +403,7 @@ void ServiceWorkerContainerHost::OnExecutionReady() {
 
 void ServiceWorkerContainerHost::OnVersionAttributesChanged(
     ServiceWorkerRegistration* registration,
-    blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-    const ServiceWorkerRegistrationInfo& /* info */) {
+    blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   if (!get_ready_callback_ || get_ready_callback_->is_null())
     return;
@@ -546,7 +503,7 @@ void ServiceWorkerContainerHost::AddServiceWorkerToUpdate(
 
   // This is only called for windows now, but it should be called for all
   // clients someday.
-  DCHECK_EQ(type(), blink::mojom::ServiceWorkerContainerType::kForWindow);
+  DCHECK(IsContainerForWindowClient());
 
   versions_to_update_.emplace(std::move(version));
 }
@@ -713,46 +670,58 @@ void ServiceWorkerContainerHost::RemoveServiceWorkerObjectHost(
     int64_t version_id) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(base::Contains(service_worker_object_hosts_, version_id));
+
+  // ServiceWorkerObjectHost to be deleted may have the last reference to
+  // ServiceWorkerVersion that indirectly owns this ServiceWorkerContainerHost.
+  // If we erase the object host directly from the map, |this| could be deleted
+  // during the map operation and may crash. To avoid the case, we take the
+  // ownership of the object host from the map first, and then erase the entry
+  // from the map. See https://crbug.com/1056598 for details.
+  std::unique_ptr<ServiceWorkerObjectHost> to_be_deleted =
+      std::move(service_worker_object_hosts_[version_id]);
+  DCHECK(to_be_deleted);
   service_worker_object_hosts_.erase(version_id);
 }
 
 bool ServiceWorkerContainerHost::IsContainerForServiceWorker() const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  return type_ == blink::mojom::ServiceWorkerContainerType::kForServiceWorker;
+  return client_type_ == base::nullopt;
 }
 
 bool ServiceWorkerContainerHost::IsContainerForClient() const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  switch (type_) {
-    case blink::mojom::ServiceWorkerContainerType::kForWindow:
-    case blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker:
-    case blink::mojom::ServiceWorkerContainerType::kForSharedWorker:
-      return true;
-    case blink::mojom::ServiceWorkerContainerType::kForServiceWorker:
-      return false;
-    case blink::mojom::ServiceWorkerContainerType::kUnknown:
-      break;
-  }
-  NOTREACHED() << type_;
-  return false;
+  return client_type_ != base::nullopt;
+}
+
+blink::mojom::ServiceWorkerClientType
+ServiceWorkerContainerHost::GetClientType() const {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(client_type_);
+  return *client_type_;
+}
+
+bool ServiceWorkerContainerHost::IsContainerForWindowClient() const {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  return client_type_ &&
+         *client_type_ == blink::mojom::ServiceWorkerClientType::kWindow;
+}
+
+bool ServiceWorkerContainerHost::IsContainerForWorkerClient() const {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  using blink::mojom::ServiceWorkerClientType;
+  if (!client_type_)
+    return false;
+
+  return *client_type_ == ServiceWorkerClientType::kDedicatedWorker ||
+         *client_type_ == ServiceWorkerClientType::kSharedWorker;
 }
 
-blink::mojom::ServiceWorkerClientType ServiceWorkerContainerHost::client_type()
+ServiceWorkerClientInfo ServiceWorkerContainerHost::GetServiceWorkerClientInfo()
     const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  switch (type_) {
-    case blink::mojom::ServiceWorkerContainerType::kForWindow:
-      return blink::mojom::ServiceWorkerClientType::kWindow;
-    case blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker:
-      return blink::mojom::ServiceWorkerClientType::kDedicatedWorker;
-    case blink::mojom::ServiceWorkerContainerType::kForSharedWorker:
-      return blink::mojom::ServiceWorkerClientType::kSharedWorker;
-    case blink::mojom::ServiceWorkerContainerType::kForServiceWorker:
-    case blink::mojom::ServiceWorkerContainerType::kUnknown:
-      break;
-  }
-  NOTREACHED() << type_;
-  return blink::mojom::ServiceWorkerClientType::kWindow;
+  DCHECK(IsContainerForClient());
+
+  return ServiceWorkerClientInfo(*client_type_, frame_tree_node_id_);
 }
 
 void ServiceWorkerContainerHost::OnBeginNavigationCommit(
@@ -762,9 +731,13 @@ void ServiceWorkerContainerHost::OnBeginNavigationCommit(
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
         coep_reporter) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  DCHECK_EQ(blink::mojom::ServiceWorkerContainerType::kForWindow, type());
+  DCHECK(IsContainerForWindowClient());
 
-  SetContainerProcessId(container_process_id);
+  DCHECK_EQ(ChildProcessHost::kInvalidUniqueID, process_id_);
+  DCHECK_NE(ChildProcessHost::kInvalidUniqueID, container_process_id);
+  process_id_ = container_process_id;
+  if (controller_)
+    controller_->UpdateForegroundPriority();
 
   DCHECK_EQ(MSG_ROUTING_NONE, frame_id_);
   DCHECK_NE(MSG_ROUTING_NONE, container_frame_id);
@@ -808,9 +781,7 @@ void ServiceWorkerContainerHost::OnBeginNavigationCommit(
 void ServiceWorkerContainerHost::CompleteWebWorkerPreparation(
     const network::CrossOriginEmbedderPolicy& cross_origin_embedder_policy) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  using ServiceWorkerContainerType = blink::mojom::ServiceWorkerContainerType;
-  DCHECK(type_ == ServiceWorkerContainerType::kForDedicatedWorker ||
-         type_ == ServiceWorkerContainerType::kForSharedWorker);
+  DCHECK(IsContainerForWorkerClient());
 
   DCHECK(!cross_origin_embedder_policy_.has_value());
   cross_origin_embedder_policy_ = cross_origin_embedder_policy;
@@ -848,7 +819,7 @@ void ServiceWorkerContainerHost::UpdateUrls(
     // Revoke the token on URL change since any service worker holding the token
     // may no longer be the potential controller of this frame and shouldn't
     // have the power to display SSL dialogs for it.
-    if (type_ == blink::mojom::ServiceWorkerContainerType::kForWindow) {
+    if (IsContainerForWindowClient()) {
       auto* registry = FrameTreeNodeIdRegistry::GetInstance();
       registry->Remove(fetch_request_window_id_);
       fetch_request_window_id_ = base::UnguessableToken::Create();
@@ -877,14 +848,8 @@ void ServiceWorkerContainerHost::UpdateUrls(
     // Set UUID to the new one.
     std::string previous_client_uuid = client_uuid_;
     client_uuid_ = base::GenerateGUID();
-    if (context_) {
+    if (context_)
       context_->UpdateContainerHostClientID(previous_client_uuid, client_uuid_);
-      // Update the disconnect handler, too.
-      DCHECK(receiver_.is_bound());
-      receiver_.set_disconnect_handler(base::BindOnce(
-          &ServiceWorkerContextCore::UnregisterContainerHostByClientID,
-          context_, client_uuid_));
-    }
   }
 
   SyncMatchingRegistrations();
@@ -911,6 +876,8 @@ void ServiceWorkerContainerHost::SetControllerRegistration(
 mojo::Remote<blink::mojom::ControllerServiceWorker>
 ServiceWorkerContainerHost::GetRemoteControllerServiceWorker() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForClient());
+
   DCHECK(controller_);
   if (controller_->fetch_handler_existence() ==
       ServiceWorkerVersion::FetchHandlerExistence::DOES_NOT_EXIST) {
@@ -927,20 +894,16 @@ ServiceWorkerContainerHost::GetRemoteControllerServiceWorker() {
     pending_controller_receiver_ =
         remote_controller.BindNewPipeAndPassReceiver();
   } else {
-    using ServiceWorkerContainerType = blink::mojom::ServiceWorkerContainerType;
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
         coep_reporter_to_be_passed;
     if (coep_reporter_) {
-      DCHECK_EQ(ServiceWorkerContainerType::kForWindow, type_);
+      DCHECK(IsContainerForWindowClient());
       coep_reporter_->Clone(
           coep_reporter_to_be_passed.InitWithNewPipeAndPassReceiver());
     } else {
       // TODO(https://crbug.com/999049): Implement DedicatedWorker and
       // SharedWorker cases.
-      DCHECK(
-          (base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker) &&
-           type_ == ServiceWorkerContainerType::kForDedicatedWorker) ||
-          type_ == ServiceWorkerContainerType::kForSharedWorker);
+      DCHECK(IsContainerForWorkerClient());
     }
 
     controller_->controller()->Clone(
@@ -951,31 +914,40 @@ ServiceWorkerContainerHost::GetRemoteControllerServiceWorker() {
   return remote_controller;
 }
 
+namespace {
+
+void ReportServiceWorkerAccess(int process_id,
+                               int frame_id,
+                               const GURL& scope,
+                               AllowServiceWorkerResult allowed) {
+  RenderFrameHost* rfh = RenderFrameHost::FromID(process_id, frame_id);
+  if (!rfh)
+    return;
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(WebContents::FromRenderFrameHost(rfh));
+  web_contents->OnServiceWorkerAccessed(rfh, scope, allowed);
+}
+
+}  // namespace
+
 bool ServiceWorkerContainerHost::AllowServiceWorker(const GURL& scope,
                                                     const GURL& script_url) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(context_);
+  AllowServiceWorkerResult allowed = AllowServiceWorkerResult::No();
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
-    return GetContentClient()->browser()->AllowServiceWorkerOnUI(
+    allowed = GetContentClient()->browser()->AllowServiceWorkerOnUI(
         scope, site_for_cookies().RepresentativeUrl(), top_frame_origin(),
-        script_url, context_->wrapper()->browser_context(),
-        base::BindRepeating(
-            [](int process_id, int frame_id) {
-              return WebContentsImpl::FromRenderFrameHostID(process_id,
-                                                            frame_id);
-            },
-            process_id_, frame_id_));
+        script_url, context_->wrapper()->browser_context());
   } else {
-    return GetContentClient()->browser()->AllowServiceWorkerOnIO(
+    allowed = GetContentClient()->browser()->AllowServiceWorkerOnIO(
         scope, site_for_cookies().RepresentativeUrl(), top_frame_origin(),
-        script_url, context_->wrapper()->resource_context(),
-        base::BindRepeating(
-            [](int process_id, int frame_id) {
-              return WebContentsImpl::FromRenderFrameHostID(process_id,
-                                                            frame_id);
-            },
-            process_id_, frame_id_));
+        script_url, context_->wrapper()->resource_context());
   }
+  RunOrPostTaskOnThread(FROM_HERE, BrowserThread::UI,
+                        base::BindOnce(&ReportServiceWorkerAccess, process_id_,
+                                       frame_id_, scope, allowed));
+  return allowed;
 }
 
 bool ServiceWorkerContainerHost::IsContextSecureForServiceWorker() const {
@@ -1013,6 +985,8 @@ bool ServiceWorkerContainerHost::is_response_committed() const {
 void ServiceWorkerContainerHost::AddExecutionReadyCallback(
     ExecutionReadyCallback callback) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForClient());
+
   DCHECK(!is_execution_ready());
   execution_ready_callbacks_.push_back(std::move(callback));
 }
@@ -1020,17 +994,8 @@ void ServiceWorkerContainerHost::AddExecutionReadyCallback(
 bool ServiceWorkerContainerHost::is_execution_ready() const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(IsContainerForClient());
-  return client_phase_ == ClientPhase::kExecutionReady;
-}
 
-void ServiceWorkerContainerHost::SetContainerProcessId(
-    int container_process_id) {
-  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  DCHECK_EQ(ChildProcessHost::kInvalidUniqueID, process_id_);
-  DCHECK_NE(ChildProcessHost::kInvalidUniqueID, container_process_id);
-  process_id_ = container_process_id;
-  if (controller_)
-    controller_->UpdateForegroundPriority();
+  return client_phase_ == ClientPhase::kExecutionReady;
 }
 
 const std::string& ServiceWorkerContainerHost::client_uuid() const {
@@ -1099,7 +1064,7 @@ void ServiceWorkerContainerHost::EvictFromBackForwardCache(
     BackForwardCacheMetrics::NotRestoredReason reason) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(IsBackForwardCacheEnabled());
-  DCHECK_EQ(type_, blink::mojom::ServiceWorkerContainerType::kForWindow);
+  DCHECK(IsContainerForWindowClient());
   is_in_back_forward_cache_ = false;
   RunOrPostTaskOnThread(
       FROM_HERE, BrowserThread::UI,
@@ -1108,7 +1073,7 @@ void ServiceWorkerContainerHost::EvictFromBackForwardCache(
              BackForwardCacheMetrics::NotRestoredReason reason) {
             auto* rfh = RenderFrameHostImpl::FromID(process_id, frame_id);
             // |rfh| could be evicted before this function is called.
-            if (!rfh || !rfh->is_in_back_forward_cache())
+            if (!rfh || !rfh->IsInBackForwardCache())
               return;
             rfh->EvictFromBackForwardCacheWithReason(reason);
           },
@@ -1118,7 +1083,7 @@ void ServiceWorkerContainerHost::EvictFromBackForwardCache(
 void ServiceWorkerContainerHost::OnEnterBackForwardCache() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(IsBackForwardCacheEnabled());
-  DCHECK_EQ(type_, blink::mojom::ServiceWorkerContainerType::kForWindow);
+  DCHECK(IsContainerForWindowClient());
   if (controller_)
     controller_->MoveControlleeToBackForwardCacheMap(client_uuid());
   is_in_back_forward_cache_ = true;
@@ -1127,7 +1092,7 @@ void ServiceWorkerContainerHost::OnEnterBackForwardCache() {
 void ServiceWorkerContainerHost::OnRestoreFromBackForwardCache() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(IsBackForwardCacheEnabled());
-  DCHECK_EQ(type_, blink::mojom::ServiceWorkerContainerType::kForWindow);
+  DCHECK(IsContainerForWindowClient());
   if (controller_)
     controller_->RestoreControlleeFromBackForwardCacheMap(client_uuid());
   is_in_back_forward_cache_ = false;
@@ -1212,6 +1177,8 @@ void ServiceWorkerContainerHost::SetExecutionReady() {
 
 void ServiceWorkerContainerHost::RunExecutionReadyCallbacks() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForClient());
+
   std::vector<ExecutionReadyCallback> callbacks;
   execution_ready_callbacks_.swap(callbacks);
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -1295,9 +1262,6 @@ void ServiceWorkerContainerHost::CheckControllerConsistency(
       break;
     case ServiceWorkerVersion::REDUNDANT: {
       if (should_crash) {
-        DEBUG_ALIAS_FOR_CSTR(
-            redundant_callstack_str,
-            controller_->redundant_state_callstack().ToString().c_str(), 1024);
         CHECK(false);
       }
       break;
@@ -1314,23 +1278,21 @@ void ServiceWorkerContainerHost::StartControllerComplete(
     mojo::PendingReceiver<blink::mojom::ControllerServiceWorker> receiver,
     blink::ServiceWorkerStatusCode status) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsContainerForClient());
+
   if (status == blink::ServiceWorkerStatusCode::kOk) {
     DCHECK(is_response_committed());
 
-    using ServiceWorkerContainerType = blink::mojom::ServiceWorkerContainerType;
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
         coep_reporter_to_be_passed;
     if (coep_reporter_) {
-      DCHECK_EQ(ServiceWorkerContainerType::kForWindow, type_);
+      DCHECK(IsContainerForWindowClient());
       coep_reporter_->Clone(
           coep_reporter_to_be_passed.InitWithNewPipeAndPassReceiver());
     } else {
       // TODO(https://crbug.com/999049): Implement DedicatedWorker and
       // SharedWorker cases.
-      DCHECK(
-          (base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker) &&
-           type_ == ServiceWorkerContainerType::kForDedicatedWorker) ||
-          type_ == ServiceWorkerContainerType::kForSharedWorker);
+      DCHECK(IsContainerForWorkerClient());
     }
 
     controller_->controller()->Clone(std::move(receiver),
@@ -1515,7 +1477,7 @@ bool ServiceWorkerContainerHost::IsValidGetRegistrationMessage(
     const GURL& client_url,
     std::string* out_error) const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  if (client_type() != blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!IsContainerForWindowClient()) {
     *out_error = ServiceWorkerConsts::kBadMessageFromNonWindow;
     return false;
   }
@@ -1535,7 +1497,7 @@ bool ServiceWorkerContainerHost::IsValidGetRegistrationMessage(
 bool ServiceWorkerContainerHost::IsValidGetRegistrationsMessage(
     std::string* out_error) const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  if (client_type() != blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!IsContainerForWindowClient()) {
     *out_error = ServiceWorkerConsts::kBadMessageFromNonWindow;
     return false;
   }
@@ -1550,7 +1512,7 @@ bool ServiceWorkerContainerHost::IsValidGetRegistrationsMessage(
 bool ServiceWorkerContainerHost::IsValidGetRegistrationForReadyMessage(
     std::string* out_error) const {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  if (client_type() != blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!IsContainerForWindowClient()) {
     *out_error = ServiceWorkerConsts::kBadMessageFromNonWindow;
     return false;
   }
diff --git a/chromium/content/browser/service_worker/service_worker_container_host.h b/chromium/content/browser/service_worker/service_worker_container_host.h
index ff1e50e2da2..9e904186115 100644
--- a/chromium/content/browser/service_worker/service_worker_container_host.h
+++ b/chromium/content/browser/service_worker/service_worker_container_host.h
@@ -7,13 +7,19 @@
 
 #include <map>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/time/time.h"
 #include "content/browser/frame_host/back_forward_cache_metrics.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "content/public/common/child_process_host.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
@@ -40,8 +46,6 @@ class ServiceWorkerObjectHost;
 class ServiceWorkerProviderHost;
 class ServiceWorkerRegistrationObjectHost;
 class ServiceWorkerVersion;
-class WebContents;
-struct ServiceWorkerRegistrationInfo;
 
 // ServiceWorkerContainerHost is the host of a service worker client (a window,
 // dedicated worker, or shared worker) or service worker execution context in
@@ -88,42 +92,29 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
       public ServiceWorkerRegistration::Listener {
  public:
   using ExecutionReadyCallback = base::OnceClosure;
-  using WebContentsGetter = base::RepeatingCallback<WebContents*()>;
-
-  // Used to create a ServiceWorkerContainerHost for a window during a
-  // navigation. |are_ancestors_secure| should be true for main frames.
-  // Otherwise it is true iff all ancestor frames of this frame have a secure
-  // origin. |frame_tree_node_id| is FrameTreeNode id. |web_contents_getter|
-  // indicates the tab where the navigation is occurring.
-  static base::WeakPtr<ServiceWorkerContainerHost> CreateForWindow(
-      base::WeakPtr<ServiceWorkerContextCore> context,
-      bool are_ancestors_secure,
-      int frame_tree_node_id,
-      mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-          host_receiver,
-      mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
-          container_remote);
 
-  // Used for starting a web worker (dedicated worker or shared worker). Returns
-  // a container host for the worker.
-  static base::WeakPtr<ServiceWorkerContainerHost> CreateForWebWorker(
+  // Constructor for service worker.
+  explicit ServiceWorkerContainerHost(
+      base::WeakPtr<ServiceWorkerContextCore> context);
+
+  // Constructor for window clients.
+  ServiceWorkerContainerHost(
       base::WeakPtr<ServiceWorkerContextCore> context,
-      int process_id,
-      blink::mojom::ServiceWorkerContainerType container_type,
-      mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-          host_receiver,
+      bool is_parent_frame_secure,
       mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
-          container_remote);
+          container_remote,
+      int frame_tree_node_id);
 
+  // Constructor for worker clients.
   ServiceWorkerContainerHost(
-      blink::mojom::ServiceWorkerContainerType type,
-      bool is_parent_frame_secure,
-      int frame_tree_node_id,
-      mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
-          host_receiver,
+      base::WeakPtr<ServiceWorkerContextCore> context,
+      int process_id,
       mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
           container_remote,
-      base::WeakPtr<ServiceWorkerContextCore> context);
+      blink::mojom::ServiceWorkerClientType client_type,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id);
+
   ~ServiceWorkerContainerHost() override;
 
   ServiceWorkerContainerHost(const ServiceWorkerContainerHost& other) = delete;
@@ -158,8 +149,7 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   // ServiceWorkerRegistration::Listener overrides.
   void OnVersionAttributesChanged(
       ServiceWorkerRegistration* registration,
-      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-      const ServiceWorkerRegistrationInfo& info) override;
+      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) override;
   void OnRegistrationFailed(ServiceWorkerRegistration* registration) override;
   void OnRegistrationFinishedUninstalling(
       ServiceWorkerRegistration* registration) override;
@@ -252,13 +242,24 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   // Removes the ServiceWorkerObjectHost corresponding to |version_id|.
   void RemoveServiceWorkerObjectHost(int64_t version_id);
 
+  // Returns true if this container host is for a service worker.
   bool IsContainerForServiceWorker() const;
+
+  // Returns true if this container host is for a service worker client.
   bool IsContainerForClient() const;
 
-  blink::mojom::ServiceWorkerContainerType type() const { return type_; }
+  // Returns the client type of this container host. Can only be called when
+  // IsContainerForClient() is true.
+  blink::mojom::ServiceWorkerClientType GetClientType() const;
 
-  // Can only be called when IsContainerForClient() is true.
-  blink::mojom::ServiceWorkerClientType client_type() const;
+  // Returns true if this container host is specifically for a window client.
+  bool IsContainerForWindowClient() const;
+
+  // Returns true if this container host is specifically for a worker client.
+  bool IsContainerForWorkerClient() const;
+
+  // Returns the client info for this container host.
+  ServiceWorkerClientInfo GetServiceWorkerClientInfo() const;
 
   // For service worker window clients. Called when the navigation is ready to
   // commit. Updates this host with information about the frame committed to.
@@ -403,17 +404,11 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
     return fetch_request_window_id_;
   }
 
-  void SetContainerProcessId(int process_id);
-
   base::TimeTicks create_time() const { return create_time_; }
   int process_id() const { return process_id_; }
   int frame_id() const { return frame_id_; }
   int frame_tree_node_id() const { return frame_tree_node_id_; }
 
-  const WebContentsGetter& web_contents_getter() const {
-    return web_contents_getter_;
-  }
-
   // For service worker clients.
   const std::string& client_uuid() const;
 
@@ -450,7 +445,7 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   base::WeakPtr<ServiceWorkerContainerHost> GetWeakPtr();
 
  private:
-  friend class ServiceWorkerProviderHostTest;
+  friend class ServiceWorkerContainerHostTest;
   friend class service_worker_object_host_unittest::ServiceWorkerObjectHostTest;
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, Unregister);
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, RegisterDuplicateScript);
@@ -546,32 +541,35 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
                                     const char* error_prefix,
                                     Args... args);
 
-  const blink::mojom::ServiceWorkerContainerType type_;
+  base::WeakPtr<ServiceWorkerContextCore> context_;
+
+  // The time when the container host is created.
+  const base::TimeTicks create_time_;
 
   // See comments for the getter functions.
   GURL url_;
   net::SiteForCookies site_for_cookies_;
   base::Optional<url::Origin> top_frame_origin_;
 
-  // For window clients. A token used internally to identify this context in
-  // requests. Corresponds to the Fetch specification's concept of a request's
-  // associated window: https://fetch.spec.whatwg.org/#concept-request-window
-  // This gets reset on redirects, unlike |client_uuid_|.
-  //
-  // TODO(falken): Consider using this for |client_uuid_| as well. We can't
-  // right now because this gets reset on redirects, and potentially sites rely
-  // on the GUID format.
-  base::UnguessableToken fetch_request_window_id_;
+  // Contains all ServiceWorkerRegistrationObjectHost instances corresponding to
+  // the service worker registration JavaScript objects for the hosted execution
+  // context (service worker global scope or service worker client) in the
+  // renderer process.
+  std::map<int64_t /* registration_id */,
+           std::unique_ptr<ServiceWorkerRegistrationObjectHost>>
+      registration_object_hosts_;
 
-  // The time when the container host is created.
-  const base::TimeTicks create_time_;
+  // Contains all ServiceWorkerObjectHost instances corresponding to
+  // the service worker JavaScript objects for the hosted execution
+  // context (service worker global scope or service worker client) in the
+  // renderer process.
+  std::map<int64_t /* version_id */, std::unique_ptr<ServiceWorkerObjectHost>>
+      service_worker_object_hosts_;
 
-  // The identifier of the process where the container lives.
-  int process_id_ = ChildProcessHost::kInvalidUniqueID;
+  // For all service worker clients --------------------------------------------
 
-  // The window's RenderFrame id, if this is a service worker window client.
-  // Otherwise, |MSG_ROUTING_NONE|.
-  int frame_id_ = MSG_ROUTING_NONE;
+  // A GUID that is web-exposed as FetchEvent.clientId.
+  std::string client_uuid_;
 
   // |is_parent_frame_secure_| is false if the container host is created for a
   // document whose parent frame is not secure. This doesn't mean the document
@@ -580,38 +578,17 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   // secure context check. If the container is not created for a document, or
   // the document does not have a parent frame, is_parent_frame_secure_| is
   // true.
-  const bool is_parent_frame_secure_;
-
-  // FrameTreeNode id if this is a service worker window client.
-  // Otherwise, |FrameTreeNode::kFrameTreeNodeInvalidId|.
-  const int frame_tree_node_id_;
-
-  // Only set when this object is pre-created for a navigation. It indicates the
-  // tab where the navigation occurs. Otherwise, a null callback.
-  const WebContentsGetter web_contents_getter_;
+  const bool is_parent_frame_secure_ = true;
 
-  // For service worker clients. A GUID that is web-exposed as
-  // FetchEvent.clientId.
-  std::string client_uuid_;
-
-  // For service worker clients.
+  // The phase that this container host is on.
   ClientPhase client_phase_ = ClientPhase::kInitial;
 
-  // For service worker clients. The embedder policy of the client. Set on
-  // response commit.
-  base::Optional<network::CrossOriginEmbedderPolicy>
-      cross_origin_embedder_policy_;
-  // An endpoint connected to the COEP reporter. A clone of this connection is
-  // passed to the service worker.
-  mojo::Remote<network::mojom::CrossOriginEmbedderPolicyReporter>
-      coep_reporter_;
-
-  // TODO(yuzus): This bit will be unnecessary once ServiceWorkerContainerHost
-  // and RenderFrameHost have the same lifetime.
-  bool is_in_back_forward_cache_ = false;
+  // The ID of the process where the container lives. For window clients, this
+  // is set on response commit, while it is set during initialization for worker
+  // clients.
+  int process_id_ = ChildProcessHost::kInvalidUniqueID;
 
-  // For service worker clients. Callbacks to run upon transition to
-  // kExecutionReady.
+  // Callbacks to run upon transition to kExecutionReady.
   std::vector<ExecutionReadyCallback> execution_ready_callbacks_;
 
   // The ready() promise is only allowed to be created once.
@@ -623,13 +600,13 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   //    been run.
   std::unique_ptr<GetRegistrationForReadyCallback> get_ready_callback_;
 
-  // For service worker clients. The controller service worker (i.e.,
-  // ServiceWorkerContainer#controller) and its registration. The controller is
-  // typically the same as the registration's active version, but during
-  // algorithms such as the update, skipWaiting(), and claim() steps, the active
-  // version and controller may temporarily differ. For example, to perform
-  // skipWaiting(), the registration's active version is updated first and then
-  // the container host's controller is updated to match it.
+  // The controller service worker (i.e., ServiceWorkerContainer#controller) and
+  // its registration. The controller is typically the same as the
+  // registration's active version, but during algorithms such as the update,
+  // skipWaiting(), and claim() steps, the active version and controller may
+  // temporarily differ. For example, to perform skipWaiting(), the
+  // registration's active version is updated first and then the container
+  // host's controller is updated to match it.
   scoped_refptr<ServiceWorkerVersion> controller_;
   scoped_refptr<ServiceWorkerRegistration> controller_registration_;
 
@@ -642,27 +619,12 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   // AddMatchingRegistration().
   ServiceWorkerRegistrationMap matching_registrations_;
 
-  // For service worker clients. The service workers in the chain of redirects
-  // during the main resource request for this client. These workers should be
-  // updated "soon". See AddServiceWorkerToUpdate() documentation.
+  // The service workers in the chain of redirects during the main resource
+  // request for this client. These workers should be updated "soon". See
+  // AddServiceWorkerToUpdate() documentation.
   class PendingUpdateVersion;
   base::flat_set<PendingUpdateVersion> versions_to_update_;
 
-  // Contains all ServiceWorkerRegistrationObjectHost instances corresponding to
-  // the service worker registration JavaScript objects for the hosted execution
-  // context (service worker global scope or service worker client) in the
-  // renderer process.
-  std::map<int64_t /* registration_id */,
-           std::unique_ptr<ServiceWorkerRegistrationObjectHost>>
-      registration_object_hosts_;
-
-  // Contains all ServiceWorkerObjectHost instances corresponding to
-  // the service worker JavaScript objects for the hosted execution
-  // context (service worker global scope or service worker client) in the
-  // renderer process.
-  std::map<int64_t /* version_id */, std::unique_ptr<ServiceWorkerObjectHost>>
-      service_worker_object_hosts_;
-
   // Mojo endpoint which will be be sent to the service worker just before
   // the response is committed, where |cross_origin_embedder_policy_| is ready.
   // We need to store this here because navigation code depends on having a
@@ -671,15 +633,6 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   mojo::PendingReceiver<blink::mojom::ControllerServiceWorker>
       pending_controller_receiver_;
 
-  // |receiver_| keeps the connection to the renderer-side counterpart
-  // (content::ServiceWorkerProviderContext). When the connection bound on
-  // |receiver_| gets killed from the renderer side, or the bound
-  // |ServiceWorkerProviderInfoForStartWorker::host_remote| is otherwise
-  // destroyed before being passed to the renderer, this
-  // content::ServiceWorkerContainerHost will be destroyed.
-  mojo::AssociatedReceiver<blink::mojom::ServiceWorkerContainerHost> receiver_{
-      this};
-
   // Container host receivers other than the original |receiver_|. These include
   // receivers used from (dedicated or shared) worker threads, or from
   // ServiceWorkerSubresourceLoaderFactory.
@@ -690,10 +643,55 @@ class CONTENT_EXPORT ServiceWorkerContainerHost final
   // is hosting.
   mojo::AssociatedRemote<blink::mojom::ServiceWorkerContainer> container_;
 
-  // For service worker execution contexts. This provider host owns |this|.
-  ServiceWorkerProviderHost* service_worker_host_ = nullptr;
+  // The type of client.
+  const base::Optional<blink::mojom::ServiceWorkerClientType> client_type_;
 
-  base::WeakPtr<ServiceWorkerContextCore> context_;
+  // For window clients only ---------------------------------------------------
+
+  // The ID of the frame tree node where the navigation occurs.
+  const int frame_tree_node_id_ = FrameTreeNode::kFrameTreeNodeInvalidId;
+
+  // A token used internally to identify this context in requests. Corresponds
+  // to the Fetch specification's concept of a request's associated window:
+  // https://fetch.spec.whatwg.org/#concept-request-window. This gets reset on
+  // redirects, unlike |client_uuid_|.
+  //
+  // TODO(falken): Consider using this for |client_uuid_| as well. We can't
+  // right now because this gets reset on redirects, and potentially sites rely
+  // on the GUID format.
+  base::UnguessableToken fetch_request_window_id_;
+
+  // The ID of the RenderFrameHost used for the navigation. Set on response
+  // commit.
+  int frame_id_ = MSG_ROUTING_NONE;
+
+  // The embedder policy of the client. Set on response commit.
+  base::Optional<network::CrossOriginEmbedderPolicy>
+      cross_origin_embedder_policy_;
+
+  // An endpoint connected to the COEP reporter. A clone of this connection is
+  // passed to the service worker. Bound on response commit.
+  mojo::Remote<network::mojom::CrossOriginEmbedderPolicyReporter>
+      coep_reporter_;
+
+  // Indicates if this container host is in the back-forward cache.
+  //
+  // TODO(yuzus): This bit will be unnecessary once ServiceWorkerContainerHost
+  // and RenderFrameHost have the same lifetime.
+  bool is_in_back_forward_cache_ = false;
+
+  // For worker clients only ---------------------------------------------------
+
+  // The ID of the client, if the client is a dedicated worker.
+  DedicatedWorkerId dedicated_worker_id_;
+
+  // The ID of the client, if the client is a shared worker.
+  SharedWorkerId shared_worker_id_;
+
+  // For service worker execution contexts -------------------------------------
+
+  // The ServiceWorkerProviderHost that owns |this|.
+  ServiceWorkerProviderHost* service_worker_host_ = nullptr;
 
   base::WeakPtrFactory<ServiceWorkerContainerHost> weak_factory_{this};
 };
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc b/chromium/content/browser/service_worker/service_worker_container_host_unittest.cc
index 8340c470af6..7142ed53fa4 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_container_host_unittest.cc
@@ -2,10 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/service_worker/service_worker_provider_host.h"
+#include "content/browser/service_worker/service_worker_container_host.h"
 
 #include <memory>
+#include <set>
 #include <utility>
+#include <vector>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ -16,8 +18,8 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
-#include "content/browser/service_worker/service_worker_container_host.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
+#include "content/browser/service_worker/service_worker_provider_host.h"
 #include "content/browser/service_worker/service_worker_register_job.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/service_worker/service_worker_test_utils.h"
@@ -71,26 +73,24 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
 
   ServiceWorkerTestContentBrowserClient() {}
 
-  bool AllowServiceWorkerOnIO(
+  AllowServiceWorkerResult AllowServiceWorkerOnIO(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::ResourceContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
+      content::ResourceContext* context) override {
     logs_.emplace_back(scope, site_for_cookies, top_frame_origin, script_url);
-    return false;
+    return AllowServiceWorkerResult::No();
   }
 
-  bool AllowServiceWorkerOnUI(
+  AllowServiceWorkerResult AllowServiceWorkerOnUI(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::BrowserContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
+      content::BrowserContext* context) override {
     logs_.emplace_back(scope, site_for_cookies, top_frame_origin, script_url);
-    return false;
+    return AllowServiceWorkerResult::No();
   }
 
   const std::vector<AllowServiceWorkerCallLog>& logs() const { return logs_; }
@@ -101,22 +101,20 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
 
 }  // namespace
 
-// TODO(https://crbug.com/931087): Rename ServiceWorkerProviderHostTest to
-// ServiceWorkerContainerHostTest.
-class ServiceWorkerProviderHostTest : public testing::Test {
+class ServiceWorkerContainerHostTest : public testing::Test {
  protected:
-  ServiceWorkerProviderHostTest()
+  ServiceWorkerContainerHostTest()
       : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {
     SetContentClient(&test_content_client_);
     ReRegisterContentSchemesForTests();
   }
-  ~ServiceWorkerProviderHostTest() override {}
+  ~ServiceWorkerContainerHostTest() override {}
 
   void SetUp() override {
     old_content_browser_client_ =
         SetBrowserClientForTesting(&test_content_browser_client_);
     mojo::core::SetDefaultProcessErrorCallback(base::BindRepeating(
-        &ServiceWorkerProviderHostTest::OnMojoError, base::Unretained(this)));
+        &ServiceWorkerContainerHostTest::OnMojoError, base::Unretained(this)));
 
     helper_.reset(new EmbeddedWorkerTestHelper(base::FilePath()));
     context_ = helper_->context();
@@ -306,15 +304,13 @@ class ServiceWorkerProviderHostTest : public testing::Test {
   }
 
   void TestReservedClientsAreNotExposed(
-      blink::mojom::ServiceWorkerContainerType provider_type,
+      blink::mojom::ServiceWorkerClientType client_type,
       const GURL& url);
   void TestClientPhaseTransition(
-      blink::mojom::ServiceWorkerContainerType provider_type,
+      blink::mojom::ServiceWorkerClientType client_type,
       const GURL& url);
 
-  void TestBackForwardCachedClientsAreNotExposed(
-      blink::mojom::ServiceWorkerContainerType provider_type,
-      const GURL& url);
+  void TestBackForwardCachedClientsAreNotExposed(const GURL& url);
 
   BrowserTaskEnvironment task_environment_;
 
@@ -348,17 +344,17 @@ class ServiceWorkerProviderHostTest : public testing::Test {
 
   url::ScopedSchemeRegistryForTests scoped_registry_;
 
-  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerProviderHostTest);
+  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerContainerHostTest);
 };
 
 // Run tests with PlzDedicatedWorker.
 // TODO(https://crbug.com/906991): Merge this test fixture into
-// ServiceWorkerProviderHostTest once PlzDedicatedWorker is enabled by default.
-class ServiceWorkerProviderHostTestWithPlzDedicatedWorker
-    : public ServiceWorkerProviderHostTest {
+// ServiceWorkerContainerHostTest once PlzDedicatedWorker is enabled by default.
+class ServiceWorkerContainerHostTestWithPlzDedicatedWorker
+    : public ServiceWorkerContainerHostTest {
  public:
-  ServiceWorkerProviderHostTestWithPlzDedicatedWorker() {
-    // ServiceWorkerProviderHost for dedicated workers is available only when
+  ServiceWorkerContainerHostTestWithPlzDedicatedWorker() {
+    // ServiceWorkerContainerHost for dedicated workers is available only when
     // PlzDedicatedWorker is enabled.
     scoped_feature_list_.InitAndEnableFeature(
         blink::features::kPlzDedicatedWorker);
@@ -368,7 +364,7 @@ class ServiceWorkerProviderHostTestWithPlzDedicatedWorker
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, MatchRegistration) {
+TEST_F(ServiceWorkerContainerHostTest, MatchRegistration) {
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
 
@@ -400,7 +396,7 @@ TEST_F(ServiceWorkerProviderHostTest, MatchRegistration) {
   ASSERT_EQ(nullptr, container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, ContextSecurity) {
+TEST_F(ServiceWorkerContainerHostTest, ContextSecurity) {
   base::WeakPtr<ServiceWorkerContainerHost> container_host_secure_parent =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
   base::WeakPtr<ServiceWorkerContainerHost> container_host_insecure_parent =
@@ -443,7 +439,7 @@ TEST_F(ServiceWorkerProviderHostTest, ContextSecurity) {
       container_host_insecure_parent->IsContextSecureForServiceWorker());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_SameOriginRedirect) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateUrls_SameOriginRedirect) {
   const GURL url1("https://origin1.example.com/page1.html");
   const GURL url2("https://origin1.example.com/page2.html");
 
@@ -465,7 +461,7 @@ TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_SameOriginRedirect) {
                                       container_host->client_uuid()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_CrossOriginRedirect) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateUrls_CrossOriginRedirect) {
   const GURL url1("https://origin1.example.com/page1.html");
   const GURL url2("https://origin2.example.com/page2.html");
 
@@ -515,7 +511,7 @@ class MockServiceWorkerRegistration : public ServiceWorkerRegistration {
   std::set<ServiceWorkerRegistration::Listener*> listeners_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, RemoveProvider) {
+TEST_F(ServiceWorkerContainerHostTest, RemoveProvider) {
   // Create a container host connected with the renderer process.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
@@ -553,7 +549,7 @@ class MockServiceWorkerContainer : public blink::mojom::ServiceWorkerContainer {
   mojo::AssociatedReceiver<blink::mojom::ServiceWorkerContainer> receiver_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, Controller) {
+TEST_F(ServiceWorkerContainerHostTest, Controller) {
   // Create a host.
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
@@ -589,7 +585,7 @@ TEST_F(ServiceWorkerProviderHostTest, Controller) {
   EXPECT_EQ(registration1_.get(), container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UncontrolledWithMatchingRegistration) {
+TEST_F(ServiceWorkerContainerHostTest, UncontrolledWithMatchingRegistration) {
   // Create a host.
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
@@ -624,7 +620,7 @@ TEST_F(ServiceWorkerProviderHostTest, UncontrolledWithMatchingRegistration) {
   EXPECT_EQ(registration1_.get(), container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        Register_ContentSettingsDisallowsServiceWorker) {
   ServiceWorkerTestContentBrowserClient test_browser_client;
   ContentBrowserClient* old_browser_client =
@@ -683,7 +679,7 @@ TEST_F(ServiceWorkerProviderHostTest,
   SetBrowserClientForTesting(old_browser_client);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, AllowsServiceWorker) {
+TEST_F(ServiceWorkerContainerHostTest, AllowsServiceWorker) {
   // Create an active version.
   scoped_refptr<ServiceWorkerVersion> version =
       base::MakeRefCounted<ServiceWorkerVersion>(
@@ -718,7 +714,7 @@ TEST_F(ServiceWorkerProviderHostTest, AllowsServiceWorker) {
   SetBrowserClientForTesting(old_browser_client);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_HTTPS) {
+TEST_F(ServiceWorkerContainerHostTest, Register_HTTPS) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -728,7 +724,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_HTTPS) {
                      GURL("https://www.example.com/bar")));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureTransportLocalhost) {
+TEST_F(ServiceWorkerContainerHostTest, Register_NonSecureTransportLocalhost) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://127.0.0.3:81/foo"));
 
@@ -738,7 +734,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureTransportLocalhost) {
                      GURL("http://127.0.0.3:81/baz")));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScopeShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_InvalidScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -748,7 +744,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScopeShouldFail) {
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScriptShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_InvalidScriptShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -758,7 +754,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScriptShouldFail) {
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
 
@@ -768,7 +764,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureOriginShouldFail) {
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_CrossOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_CrossOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -807,7 +803,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_CrossOriginShouldFail) {
   EXPECT_EQ(6u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_BadCharactersShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_BadCharactersShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com"));
 
@@ -843,7 +839,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_BadCharactersShouldFail) {
   EXPECT_EQ(6u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_FileSystemDocumentShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_FileSystemDocumentShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(
           GURL("filesystem:https://www.example.com/temporary/a"));
@@ -865,7 +861,7 @@ TEST_F(ServiceWorkerProviderHostTest, Register_FileSystemDocumentShouldFail) {
   EXPECT_EQ(3u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        Register_FileSystemScriptOrScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(
@@ -888,7 +884,7 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_EQ(3u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, EarlyContextDeletion) {
+TEST_F(ServiceWorkerContainerHostTest, EarlyContextDeletion) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -897,12 +893,12 @@ TEST_F(ServiceWorkerProviderHostTest, EarlyContextDeletion) {
   // Let the shutdown reach the simulated IO thread.
   base::RunLoop().RunUntilIdle();
 
-  // Because ServiceWorkerContextCore owns ServiceWorkerProviderHost, our
-  // ServiceWorkerProviderHost instance has destroyed.
+  // Because ServiceWorkerContextCore owns ServiceWorkerContainerHost, our
+  // ServiceWorkerContainerHost instance has destroyed.
   EXPECT_FALSE(remote_endpoint.host_remote()->is_connected());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_Success) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_Success) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -918,7 +914,7 @@ TEST_F(ServiceWorkerProviderHostTest, GetRegistration_Success) {
   EXPECT_EQ(kScope, info->scope);
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistration_NotFoundShouldReturnNull) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
@@ -930,7 +926,7 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_FALSE(info);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_CrossOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_CrossOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -940,7 +936,7 @@ TEST_F(ServiceWorkerProviderHostTest, GetRegistration_CrossOriginShouldFail) {
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_InvalidScopeShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_InvalidScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -949,7 +945,7 @@ TEST_F(ServiceWorkerProviderHostTest, GetRegistration_InvalidScopeShouldFail) {
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistration_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
@@ -960,7 +956,7 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistrations_SecureOrigin) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistrations_SecureOrigin) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -968,7 +964,7 @@ TEST_F(ServiceWorkerProviderHostTest, GetRegistrations_SecureOrigin) {
             GetRegistrations(remote_endpoint.host_remote()->get()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistrations_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
@@ -981,8 +977,8 @@ TEST_F(ServiceWorkerProviderHostTest,
 // Test that a "reserved" (i.e., not execution ready) client is not included
 // when iterating over client container hosts. If it were, it'd be undesirably
 // exposed via the Clients API.
-void ServiceWorkerProviderHostTest::TestReservedClientsAreNotExposed(
-    blink::mojom::ServiceWorkerContainerType provider_type,
+void ServiceWorkerContainerHostTest::TestReservedClientsAreNotExposed(
+    blink::mojom::ServiceWorkerClientType client_type,
     const GURL& url) {
   {
     mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
@@ -995,10 +991,12 @@ void ServiceWorkerProviderHostTest::TestReservedClientsAreNotExposed(
         client_remote.InitWithNewEndpointAndPassReceiver();
     host_receiver =
         provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
+
     base::WeakPtr<ServiceWorkerContainerHost> container_host =
-        ServiceWorkerContainerHost::CreateForWebWorker(
-            context_->AsWeakPtr(), helper_->mock_render_process_id(),
-            provider_type, std::move(host_receiver), std::move(client_remote));
+        context_->CreateContainerHostForWorker(
+            std::move(host_receiver), helper_->mock_render_process_id(),
+            std::move(client_remote), client_type, DedicatedWorkerId(),
+            SharedWorkerId());
     container_host->UpdateUrls(url, net::SiteForCookies::FromUrl(url),
                                url::Origin::Create(url));
     EXPECT_FALSE(CanFindClientContainerHost(container_host.get()));
@@ -1027,24 +1025,24 @@ void ServiceWorkerProviderHostTest::TestReservedClientsAreNotExposed(
   }
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithPlzDedicatedWorker,
+TEST_F(ServiceWorkerContainerHostTestWithPlzDedicatedWorker,
        ReservedClientsAreNotExposedToClientsApiForDedicatedWorker) {
   ASSERT_TRUE(
       base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
   TestReservedClientsAreNotExposed(
-      blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker,
+      blink::mojom::ServiceWorkerClientType::kDedicatedWorker,
       GURL("https://www.example.com/dedicated_worker.js"));
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        ReservedClientsAreNotExposedToClientsApiForSharedWorker) {
   TestReservedClientsAreNotExposed(
-      blink::mojom::ServiceWorkerContainerType::kForSharedWorker,
+      blink::mojom::ServiceWorkerClientType::kSharedWorker,
       GURL("https://www.example.com/shared_worker.js"));
 }
 
 // Tests the client phase transitions for a navigation.
-TEST_F(ServiceWorkerProviderHostTest, ClientPhaseForWindow) {
+TEST_F(ServiceWorkerContainerHostTest, ClientPhaseForWindow) {
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
                                           /*are_ancestors_secure=*/true);
@@ -1068,8 +1066,8 @@ TEST_F(ServiceWorkerProviderHostTest, ClientPhaseForWindow) {
 }
 
 // Tests the client phase transitions for workers.
-void ServiceWorkerProviderHostTest::TestClientPhaseTransition(
-    blink::mojom::ServiceWorkerContainerType provider_type,
+void ServiceWorkerContainerHostTest::TestClientPhaseTransition(
+    blink::mojom::ServiceWorkerClientType client_type,
     const GURL& url) {
   mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
       client_remote;
@@ -1080,10 +1078,12 @@ void ServiceWorkerProviderHostTest::TestClientPhaseTransition(
       client_remote.InitWithNewEndpointAndPassReceiver();
   host_receiver =
       provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
+
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
-      ServiceWorkerContainerHost::CreateForWebWorker(
-          helper_->context()->AsWeakPtr(), helper_->mock_render_process_id(),
-          provider_type, std::move(host_receiver), std::move(client_remote));
+      helper_->context()->CreateContainerHostForWorker(
+          std::move(host_receiver), helper_->mock_render_process_id(),
+          std::move(client_remote), client_type, DedicatedWorkerId(),
+          SharedWorkerId());
   EXPECT_FALSE(container_host->is_response_committed());
   EXPECT_FALSE(container_host->is_execution_ready());
 
@@ -1096,26 +1096,26 @@ void ServiceWorkerProviderHostTest::TestClientPhaseTransition(
   EXPECT_TRUE(container_host->is_execution_ready());
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithPlzDedicatedWorker,
+TEST_F(ServiceWorkerContainerHostTestWithPlzDedicatedWorker,
        ClientPhaseForDedicatedWorker) {
   ASSERT_TRUE(
       base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
   TestClientPhaseTransition(
-      blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker,
+      blink::mojom::ServiceWorkerClientType::kDedicatedWorker,
       GURL("https://www.example.com/dedicated_worker.js"));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, ClientPhaseForSharedWorker) {
+TEST_F(ServiceWorkerContainerHostTest, ClientPhaseForSharedWorker) {
   TestClientPhaseTransition(
-      blink::mojom::ServiceWorkerContainerType::kForSharedWorker,
+      blink::mojom::ServiceWorkerClientType::kSharedWorker,
       GURL("https://www.example.com/shared_worker.js"));
 }
 
 // Run tests with BackForwardCache.
-class ServiceWorkerProviderHostTestWithBackForwardCache
-    : public ServiceWorkerProviderHostTest {
+class ServiceWorkerContainerHostTestWithBackForwardCache
+    : public ServiceWorkerContainerHostTest {
  public:
-  ServiceWorkerProviderHostTestWithBackForwardCache() {
+  ServiceWorkerContainerHostTestWithBackForwardCache() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
         {{features::kBackForwardCache, {GetFeatureParams()}},
          {features::kServiceWorkerOnUI, {}}},
@@ -1135,8 +1135,7 @@ class ServiceWorkerProviderHostTestWithBackForwardCache
 // Test that a client in BackForwardCache is not included
 // when iterating over client container hosts. If it were, it'd be undesirably
 // exposed via the Clients API.
-void ServiceWorkerProviderHostTest::TestBackForwardCachedClientsAreNotExposed(
-    blink::mojom::ServiceWorkerContainerType provider_type,
+void ServiceWorkerContainerHostTest::TestBackForwardCachedClientsAreNotExposed(
     const GURL& url) {
   std::unique_ptr<ServiceWorkerProviderHost> provider_host;
   {
@@ -1177,20 +1176,19 @@ void ServiceWorkerProviderHostTest::TestBackForwardCachedClientsAreNotExposed(
   }
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithBackForwardCache,
+TEST_F(ServiceWorkerContainerHostTestWithBackForwardCache,
        SkipBackForwardCachedServiceWorker) {
   ASSERT_TRUE(IsBackForwardCacheEnabled());
   ASSERT_TRUE(ServiceWorkerContext::IsServiceWorkerOnUIEnabled());
 
   TestBackForwardCachedClientsAreNotExposed(
-      blink::mojom::ServiceWorkerContainerType::kForServiceWorker,
       GURL("https://www.example.com/sw.js"));
 }
 
 // Tests that the service worker involved with a navigation (via
 // AddServiceWorkerToUpdate) is updated when the host for the navigation is
 // destroyed.
-TEST_F(ServiceWorkerProviderHostTest, UpdateServiceWorkerOnDestruction) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateServiceWorkerOnDestruction) {
   // Make a window.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example.html"));
@@ -1231,7 +1229,7 @@ TEST_F(ServiceWorkerProviderHostTest, UpdateServiceWorkerOnDestruction) {
 
 // Tests that the service worker involved with a navigation is updated when the
 // host receives a HintToUpdateServiceWorker message.
-TEST_F(ServiceWorkerProviderHostTest, HintToUpdateServiceWorker) {
+TEST_F(ServiceWorkerContainerHostTest, HintToUpdateServiceWorker) {
   // Make an active version.
   auto version1 = base::MakeRefCounted<ServiceWorkerVersion>(
       registration1_.get(), GURL("https://www.example.com/sw.js"),
@@ -1264,7 +1262,7 @@ TEST_F(ServiceWorkerProviderHostTest, HintToUpdateServiceWorker) {
 // Tests that the host receives a HintToUpdateServiceWorker message but
 // there was no service worker at main resource request time. This
 // can happen due to claim().
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        HintToUpdateServiceWorkerButNoVersionToUpdate) {
   // Make a window.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
@@ -1296,7 +1294,7 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_FALSE(HasVersionToUpdate(container_host.get()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, HintToUpdateServiceWorkerMultiple) {
+TEST_F(ServiceWorkerContainerHostTest, HintToUpdateServiceWorkerMultiple) {
   // Make active versions.
   auto version1 = base::MakeRefCounted<ServiceWorkerVersion>(
       registration1_.get(), GURL("https://www.example.com/sw.js"),
diff --git a/chromium/content/browser/service_worker/service_worker_context_core.cc b/chromium/content/browser/service_worker/service_worker_context_core.cc
index 8bc8d300988..331e16f4a02 100644
--- a/chromium/content/browser/service_worker/service_worker_context_core.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_core.cc
@@ -20,6 +20,7 @@
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/log_console_message.h"
 #include "content/browser/service_worker/embedded_worker_status.h"
@@ -156,8 +157,7 @@ bool IsSameOriginWindowClientContainerHost(
     if (container_host->IsInBackForwardCache())
       return false;
   }
-  return container_host->type() ==
-             blink::mojom::ServiceWorkerContainerType::kForWindow &&
+  return container_host->IsContainerForWindowClient() &&
          container_host->url().GetOrigin() == origin &&
          (allow_reserved_client || container_host->is_execution_ready());
 }
@@ -280,7 +280,9 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
         observer_list,
     ServiceWorkerContextWrapper* wrapper)
     : wrapper_(wrapper),
-      container_host_by_uuid_(std::make_unique<ContainerHostByClientUUIDMap>()),
+      container_host_receivers_(std::make_unique<mojo::AssociatedReceiverSet<
+                                    blink::mojom::ServiceWorkerContainerHost,
+                                    ServiceWorkerContainerHost*>>()),
       registry_(std::make_unique<ServiceWorkerRegistry>(
           user_data_directory,
           this,
@@ -298,13 +300,19 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
         base::MakeRefCounted<blink::URLLoaderFactoryBundle>(std::move(
             non_network_pending_loader_factory_bundle_for_update_check));
   }
+
+  container_host_receivers_->set_disconnect_handler(base::BindRepeating(
+      &ServiceWorkerContextCore::OnContainerHostReceiverDisconnected,
+      base::Unretained(this)));
 }
 
 ServiceWorkerContextCore::ServiceWorkerContextCore(
     ServiceWorkerContextCore* old_context,
     ServiceWorkerContextWrapper* wrapper)
     : wrapper_(wrapper),
-      container_host_by_uuid_(old_context->container_host_by_uuid_.release()),
+      container_host_by_uuid_(std::move(old_context->container_host_by_uuid_)),
+      container_host_receivers_(
+          std::move(old_context->container_host_receivers_)),
       registry_(
           std::make_unique<ServiceWorkerRegistry>(this,
                                                   old_context->registry())),
@@ -315,7 +323,11 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
       was_service_worker_registered_(
           old_context->was_service_worker_registered_),
       observer_list_(old_context->observer_list_),
-      next_embedded_worker_id_(old_context->next_embedded_worker_id_) {}
+      next_embedded_worker_id_(old_context->next_embedded_worker_id_) {
+  container_host_receivers_->set_disconnect_handler(base::BindRepeating(
+      &ServiceWorkerContextCore::OnContainerHostReceiverDisconnected,
+      base::Unretained(this)));
+}
 
 ServiceWorkerContextCore::~ServiceWorkerContextCore() {
   DCHECK(registry_);
@@ -332,7 +344,7 @@ ServiceWorkerContextCore::GetClientContainerHostIterator(
     bool include_back_forward_cached_clients) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   return base::WrapUnique(new ContainerHostIterator(
-      container_host_by_uuid_.get(),
+      &container_host_by_uuid_,
       base::BindRepeating(IsSameOriginClientContainerHost, origin,
                           include_reserved_clients,
                           include_back_forward_cached_clients)));
@@ -344,7 +356,7 @@ ServiceWorkerContextCore::GetWindowClientContainerHostIterator(
     bool include_reserved_clients) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   return base::WrapUnique(new ContainerHostIterator(
-      container_host_by_uuid_.get(),
+      &container_host_by_uuid_,
       base::BindRepeating(IsSameOriginWindowClientContainerHost, origin,
                           include_reserved_clients)));
 }
@@ -368,8 +380,7 @@ void ServiceWorkerContextCore::HasMainFrameWindowClient(const GURL& origin,
   while (!container_host_iterator->IsAtEnd()) {
     ServiceWorkerContainerHost* container_host =
         container_host_iterator->GetContainerHost();
-    DCHECK_EQ(container_host->type(),
-              blink::mojom::ServiceWorkerContainerType::kForWindow);
+    DCHECK(container_host->IsContainerForWindowClient());
     render_frames->push_back(std::make_pair(container_host->process_id(),
                                             container_host->frame_id()));
     container_host_iterator->Advance();
@@ -388,38 +399,93 @@ void ServiceWorkerContextCore::HasMainFrameWindowClient(const GURL& origin,
   }
 }
 
-void ServiceWorkerContextCore::RegisterContainerHostByClientID(
-    const std::string& client_uuid,
-    std::unique_ptr<ServiceWorkerContainerHost> container_host) {
-  DCHECK(container_host->IsContainerForClient());
-  DCHECK(!base::Contains(*container_host_by_uuid_, client_uuid));
-  container_host_by_uuid_->emplace(client_uuid, std::move(container_host));
+base::WeakPtr<ServiceWorkerContainerHost>
+ServiceWorkerContextCore::CreateContainerHostForWindow(
+    mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
+        host_receiver,
+    bool are_ancestors_secure,
+    mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
+        container_remote,
+    int frame_tree_node_id) {
+  auto container_host = std::make_unique<ServiceWorkerContainerHost>(
+      AsWeakPtr(), are_ancestors_secure, std::move(container_remote),
+      frame_tree_node_id);
+
+  ServiceWorkerContainerHost* container_host_ptr = container_host.get();
+
+  auto inserted =
+      container_host_by_uuid_
+          .emplace(container_host_ptr->client_uuid(), std::move(container_host))
+          .second;
+  DCHECK(inserted);
+
+  // Bind the host receiver.
+  container_host_receivers_->Add(container_host_ptr, std::move(host_receiver),
+                                 container_host_ptr);
+
+  return container_host_ptr->GetWeakPtr();
 }
 
-void ServiceWorkerContextCore::UnregisterContainerHostByClientID(
-    const std::string& client_uuid) {
-  DCHECK(base::Contains(*container_host_by_uuid_, client_uuid));
-  container_host_by_uuid_->erase(client_uuid);
+base::WeakPtr<ServiceWorkerContainerHost>
+ServiceWorkerContextCore::CreateContainerHostForWorker(
+    mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
+        host_receiver,
+    int process_id,
+    mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
+        container_remote,
+    blink::mojom::ServiceWorkerClientType client_type,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id) {
+  auto container_host = std::make_unique<ServiceWorkerContainerHost>(
+      AsWeakPtr(), process_id, std::move(container_remote), client_type,
+      dedicated_worker_id, shared_worker_id);
+
+  ServiceWorkerContainerHost* container_host_ptr = container_host.get();
+
+  bool inserted =
+      container_host_by_uuid_
+          .emplace(container_host_ptr->client_uuid(), std::move(container_host))
+          .second;
+  DCHECK(inserted);
+
+  // Bind the host receiver.
+  container_host_receivers_->Add(container_host_ptr, std::move(host_receiver),
+                                 container_host_ptr);
+
+  return container_host_ptr->GetWeakPtr();
 }
 
 void ServiceWorkerContextCore::UpdateContainerHostClientID(
     const std::string& current_client_uuid,
     const std::string& new_client_uuid) {
-  DCHECK(base::Contains(*container_host_by_uuid_, current_client_uuid));
+  auto it = container_host_by_uuid_.find(current_client_uuid);
+  DCHECK(it != container_host_by_uuid_.end());
   std::unique_ptr<ServiceWorkerContainerHost> container_host =
-      std::move(container_host_by_uuid_->find(current_client_uuid)->second);
-  UnregisterContainerHostByClientID(current_client_uuid);
-  RegisterContainerHostByClientID(new_client_uuid, std::move(container_host));
+      std::move(it->second);
+  container_host_by_uuid_.erase(it);
+
+  bool inserted = container_host_by_uuid_
+                      .emplace(new_client_uuid, std::move(container_host))
+                      .second;
+  DCHECK(inserted);
 }
 
 ServiceWorkerContainerHost*
 ServiceWorkerContextCore::GetContainerHostByClientID(
     const std::string& client_uuid) {
-  auto found = container_host_by_uuid_->find(client_uuid);
-  if (found == container_host_by_uuid_->end())
+  auto it = container_host_by_uuid_.find(client_uuid);
+  if (it == container_host_by_uuid_.end())
     return nullptr;
-  DCHECK(found->second->IsContainerForClient());
-  return found->second.get();
+  DCHECK(it->second->IsContainerForClient());
+  return it->second.get();
+}
+
+void ServiceWorkerContextCore::OnContainerHostReceiverDisconnected() {
+  ServiceWorkerContainerHost* container_host =
+      container_host_receivers_->current_context();
+
+  size_t removed = container_host_by_uuid_.erase(container_host->client_uuid());
+  DCHECK_EQ(removed, 1u);
 }
 
 void ServiceWorkerContextCore::RegisterServiceWorker(
@@ -825,6 +891,38 @@ void ServiceWorkerContextCore::OnMainScriptResponseSet(
       version_id, response.response_time, response.last_modified);
 }
 
+void ServiceWorkerContextCore::OnControlleeAdded(
+    ServiceWorkerVersion* version,
+    const std::string& client_uuid,
+    const ServiceWorkerClientInfo& client_info) {
+  DCHECK_EQ(this, version->context().get());
+  observer_list_->Notify(
+      FROM_HERE, &ServiceWorkerContextCoreObserver::OnControlleeAdded,
+      version->version_id(), version->scope(), client_uuid, client_info);
+}
+
+void ServiceWorkerContextCore::OnControlleeRemoved(
+    ServiceWorkerVersion* version,
+    const std::string& client_uuid) {
+  DCHECK_EQ(this, version->context().get());
+  observer_list_->Notify(FROM_HERE,
+                         &ServiceWorkerContextCoreObserver::OnControlleeRemoved,
+                         version->version_id(), version->scope(), client_uuid);
+}
+
+void ServiceWorkerContextCore::OnNoControllees(ServiceWorkerVersion* version) {
+  DCHECK_EQ(this, version->context().get());
+
+  ServiceWorkerRegistration* registration =
+      GetLiveRegistration(version->registration_id());
+  if (registration)
+    registration->OnNoControllees(version);
+
+  observer_list_->Notify(FROM_HERE,
+                         &ServiceWorkerContextCoreObserver::OnNoControllees,
+                         version->version_id(), version->scope());
+}
+
 void ServiceWorkerContextCore::OnRunningStateChanged(
     ServiceWorkerVersion* version) {
   DCHECK_EQ(this, version->context().get());
@@ -913,32 +1011,6 @@ void ServiceWorkerContextCore::OnReportConsoleMessage(
       ConsoleMessage(source, message_level, message, line_number, source_url));
 }
 
-void ServiceWorkerContextCore::OnControlleeAdded(
-    ServiceWorkerVersion* version,
-    const std::string& client_uuid,
-    const ServiceWorkerClientInfo& client_info) {
-  DCHECK_EQ(this, version->context().get());
-  observer_list_->Notify(
-      FROM_HERE, &ServiceWorkerContextCoreObserver::OnControlleeAdded,
-      version->version_id(), version->scope(), client_uuid, client_info);
-}
-
-void ServiceWorkerContextCore::OnControlleeRemoved(
-    ServiceWorkerVersion* version,
-    const std::string& client_uuid) {
-  DCHECK_EQ(this, version->context().get());
-  observer_list_->Notify(FROM_HERE,
-                         &ServiceWorkerContextCoreObserver::OnControlleeRemoved,
-                         version->version_id(), version->scope(), client_uuid);
-}
-
-void ServiceWorkerContextCore::OnNoControllees(ServiceWorkerVersion* version) {
-  DCHECK_EQ(this, version->context().get());
-  observer_list_->Notify(FROM_HERE,
-                         &ServiceWorkerContextCoreObserver::OnNoControllees,
-                         version->version_id(), version->scope());
-}
-
 ServiceWorkerStorage* ServiceWorkerContextCore::storage() const {
   return registry_->storage();
 }
diff --git a/chromium/content/browser/service_worker/service_worker_context_core.h b/chromium/content/browser/service_worker/service_worker_context_core.h
index dd049377ab6..aa95543013b 100644
--- a/chromium/content/browser/service_worker/service_worker_context_core.h
+++ b/chromium/content/browser/service_worker/service_worker_context_core.h
@@ -24,7 +24,10 @@
 #include "content/browser/service_worker/service_worker_registry.h"
 #include "content/browser/service_worker/service_worker_storage.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/dedicated_worker_id.h"
 #include "content/public/browser/service_worker_context.h"
+#include "content/public/browser/shared_worker_id.h"
+#include "mojo/public/cpp/bindings/associated_receiver_set.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
 
 class GURL;
@@ -36,7 +39,7 @@ class FilePath;
 namespace storage {
 class QuotaManagerProxy;
 class SpecialStoragePolicy;
-}
+}  // namespace storage
 
 namespace content {
 
@@ -115,9 +118,8 @@ class CONTENT_EXPORT ServiceWorkerContextCore
           observer_list,
       ServiceWorkerContextWrapper* wrapper);
   // TODO(https://crbug.com/877356): Remove this copy mechanism.
-  ServiceWorkerContextCore(
-      ServiceWorkerContextCore* old_context,
-      ServiceWorkerContextWrapper* wrapper);
+  ServiceWorkerContextCore(ServiceWorkerContextCore* old_context,
+                           ServiceWorkerContextWrapper* wrapper);
   ~ServiceWorkerContextCore() override;
 
   void OnStorageWiped();
@@ -126,6 +128,24 @@ class CONTENT_EXPORT ServiceWorkerContextCore
       int64_t version_id,
       const ServiceWorkerVersion::MainScriptResponse& response);
 
+  // OnControlleeAdded/Removed are called asynchronously. It is possible the
+  // container host identified by |client_uuid| was already destroyed when they
+  // are called.
+  // Note regarding BackForwardCache integration:
+  // OnControlleeRemoved is called when a controllee enters back-forward
+  // cache, and OnControlleeAdded is called when a controllee is restored from
+  // back-forward cache.
+  void OnControlleeAdded(ServiceWorkerVersion* version,
+                         const std::string& client_uuid,
+                         const ServiceWorkerClientInfo& client_info);
+  void OnControlleeRemoved(ServiceWorkerVersion* version,
+                           const std::string& client_uuid);
+
+  // Called when all controllees are removed.
+  // Note regarding BackForwardCache integration:
+  // Clients in back-forward cache don't count as controllees.
+  void OnNoControllees(ServiceWorkerVersion* version);
+
   // ServiceWorkerVersion::Observer overrides.
   void OnRunningStateChanged(ServiceWorkerVersion* version) override;
   void OnVersionStateChanged(ServiceWorkerVersion* version) override;
@@ -141,12 +161,6 @@ class CONTENT_EXPORT ServiceWorkerContextCore
                               const base::string16& message,
                               int line_number,
                               const GURL& source_url) override;
-  void OnControlleeAdded(ServiceWorkerVersion* version,
-                         const std::string& client_uuid,
-                         const ServiceWorkerClientInfo& client_info) override;
-  void OnControlleeRemoved(ServiceWorkerVersion* version,
-                           const std::string& client_uuid) override;
-  void OnNoControllees(ServiceWorkerVersion* version) override;
 
   ServiceWorkerContextWrapper* wrapper() const { return wrapper_; }
   ServiceWorkerRegistry* registry() const { return registry_.get(); }
@@ -183,18 +197,40 @@ class CONTENT_EXPORT ServiceWorkerContextCore
   // thread is UI.
   void HasMainFrameWindowClient(const GURL& origin, BoolCallback callback);
 
-  // Maintains a map from Client UUID to ServiceWorkerContainerHost for service
-  // worker clients. |container_host| should not be for a service worker
-  // execution context.
-  void RegisterContainerHostByClientID(
-      const std::string& client_uuid,
-      std::unique_ptr<ServiceWorkerContainerHost> container_host);
-  void UnregisterContainerHostByClientID(const std::string& client_uuid);
+  // Used to create a ServiceWorkerContainerHost for a window during a
+  // navigation. |are_ancestors_secure| should be true for main frames.
+  // Otherwise it is true iff all ancestor frames of this frame have a secure
+  // origin. |frame_tree_node_id| is FrameTreeNode id.
+  base::WeakPtr<ServiceWorkerContainerHost> CreateContainerHostForWindow(
+      mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
+          host_receiver,
+      bool are_ancestors_secure,
+      mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
+          container_remote,
+      int frame_tree_node_id);
+
+  // Used for starting a web worker (dedicated worker or shared worker). Returns
+  // a container host for the worker.
+  base::WeakPtr<ServiceWorkerContainerHost> CreateContainerHostForWorker(
+      mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
+          host_receiver,
+      int process_id,
+      mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
+          container_remote,
+      blink::mojom::ServiceWorkerClientType client_type,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id);
+
+  // Updates the client UUID of an existing container host.
   void UpdateContainerHostClientID(const std::string& current_client_uuid,
                                    const std::string& new_client_uuid);
+
+  // Retrieves a container host given its client UUID.
   ServiceWorkerContainerHost* GetContainerHostByClientID(
       const std::string& client_uuid);
 
+  void OnContainerHostReceiverDisconnected();
+
   void RegisterServiceWorker(
       const GURL& script_url,
       const blink::mojom::ServiceWorkerRegistrationOptions& options,
@@ -367,7 +403,12 @@ class CONTENT_EXPORT ServiceWorkerContextCore
   // |container_host_by_uuid_| owns container hosts for service worker clients.
   // Container hosts for service worker execution contexts are owned by
   // ServiceWorkerProviderHost.
-  std::unique_ptr<ContainerHostByClientUUIDMap> container_host_by_uuid_;
+  ContainerHostByClientUUIDMap container_host_by_uuid_;
+
+  std::unique_ptr<
+      mojo::AssociatedReceiverSet<blink::mojom::ServiceWorkerContainerHost,
+                                  ServiceWorkerContainerHost*>>
+      container_host_receivers_;
 
   std::unique_ptr<ServiceWorkerRegistry> registry_;
   std::unique_ptr<ServiceWorkerJobCoordinator> job_coordinator_;
diff --git a/chromium/content/browser/service_worker/service_worker_context_unittest.cc b/chromium/content/browser/service_worker/service_worker_context_unittest.cc
index aff7af9e4e9..448978641cf 100644
--- a/chromium/content/browser/service_worker/service_worker_context_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_unittest.cc
@@ -8,7 +8,6 @@
 
 #include "base/bind.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/scoped_observer.h"
 #include "base/time/time.h"
@@ -1027,8 +1026,6 @@ TEST_F(ServiceWorkerContextTest, ContainerHostIterator) {
       CreateProviderHostForServiceWorkerContext(
           kRenderProcessId2, true /* is_parent_frame_secure */, version.get(),
           context()->AsWeakPtr(), &remote_endpoints.back());
-  EXPECT_NE(provider_host4->provider_id(),
-            blink::kInvalidServiceWorkerProviderId);
 
   ASSERT_TRUE(container_host1);
   ASSERT_TRUE(container_host2);
@@ -1058,10 +1055,6 @@ TEST_F(ServiceWorkerContextTest, ContainerHostIterator) {
   }
   EXPECT_EQ(1u, results.size());
   EXPECT_TRUE(base::Contains(results, container_host2.get()));
-
-  context()->UnregisterContainerHostByClientID(container_host1->client_uuid());
-  context()->UnregisterContainerHostByClientID(container_host2->client_uuid());
-  context()->UnregisterContainerHostByClientID(container_host3->client_uuid());
 }
 
 class ServiceWorkerContextRecoveryTest
diff --git a/chromium/content/browser/service_worker/service_worker_context_watcher.cc b/chromium/content/browser/service_worker/service_worker_context_watcher.cc
index cf2b47d9ddf..12c7fb7b89d 100644
--- a/chromium/content/browser/service_worker/service_worker_context_watcher.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_watcher.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/stl_util.h"
 #include "base/task/post_task.h"
 #include "content/browser/service_worker/embedded_worker_status.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
@@ -347,7 +348,9 @@ void ServiceWorkerContextWatcher::OnControlleeAdded(
   if (it == version_info_map_.end())
     return;
   ServiceWorkerVersionInfo* version = it->second.get();
-  version->clients[uuid] = info;
+
+  base::InsertOrAssign(version->clients, uuid, info);
+
   SendVersionInfo(*version);
 }
 
diff --git a/chromium/content/browser/service_worker/service_worker_context_wrapper.cc b/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
index ab9550b42e9..5deb12403ec 100644
--- a/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
@@ -509,7 +509,7 @@ ServiceWorkerContextWrapper::StartingExternalRequest(
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
   if (!context())
     return ServiceWorkerExternalRequestResult::kNullContext;
-  ServiceWorkerVersion* version =
+  scoped_refptr<ServiceWorkerVersion> version =
       context()->GetLiveVersion(service_worker_version_id);
   if (!version)
     return ServiceWorkerExternalRequestResult::kWorkerNotFound;
@@ -523,7 +523,7 @@ ServiceWorkerContextWrapper::FinishedExternalRequest(
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
   if (!context())
     return ServiceWorkerExternalRequestResult::kNullContext;
-  ServiceWorkerVersion* version =
+  scoped_refptr<ServiceWorkerVersion> version =
       context()->GetLiveVersion(service_worker_version_id);
   if (!version)
     return ServiceWorkerExternalRequestResult::kWorkerNotFound;
@@ -922,8 +922,7 @@ ServiceWorkerContextWrapper::GetWindowClientFrameRoutingIds(
                origin, /*include_reserved_clients=*/false);
        !it->IsAtEnd(); it->Advance()) {
     ServiceWorkerContainerHost* container_host = it->GetContainerHost();
-    DCHECK_EQ(container_host->type(),
-              blink::mojom::ServiceWorkerContainerType::kForWindow);
+    DCHECK(container_host->IsContainerForWindowClient());
     frame_routing_ids->push_back(GlobalFrameRoutingId(
         container_host->process_id(), container_host->frame_id()));
   }
diff --git a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
index b9bc81a07a0..679d926f14e 100644
--- a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
+++ b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
@@ -21,6 +21,8 @@
 #include "content/browser/service_worker/service_worker_object_host.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/browser/allow_service_worker_result.h"
+#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
@@ -67,12 +69,15 @@ ServiceWorkerControlleeRequestHandler::ServiceWorkerControlleeRequestHandler(
     base::WeakPtr<ServiceWorkerContextCore> context,
     base::WeakPtr<ServiceWorkerContainerHost> container_host,
     blink::mojom::ResourceType resource_type,
-    bool skip_service_worker)
+    bool skip_service_worker,
+    ServiceWorkerAccessedCallback service_worker_accessed_callback)
     : context_(std::move(context)),
       container_host_(std::move(container_host)),
       resource_type_(resource_type),
       skip_service_worker_(skip_service_worker),
-      force_update_started_(false) {
+      force_update_started_(false),
+      service_worker_accessed_callback_(
+          std::move(service_worker_accessed_callback)) {
   DCHECK(ServiceWorkerUtils::IsMainResourceType(resource_type));
   TRACE_EVENT_WITH_FLOW0("ServiceWorker",
                          "ServiceWorkerControlleeRequestHandler::"
@@ -228,12 +233,12 @@ bool ServiceWorkerControlleeRequestHandler::InitializeContainerHost(
   container_host_->SetControllerRegistration(nullptr,
                                              /*notify_controllerchange=*/false);
   stripped_url_ = net::SimplifyUrlForRequest(tentative_resource_request.url);
-  container_host_->UpdateUrls(
-      stripped_url_, tentative_resource_request.site_for_cookies,
-      tentative_resource_request.trusted_params
-          ? tentative_resource_request.trusted_params->network_isolation_key
-                .GetTopFrameOrigin()
-          : base::nullopt);
+  container_host_->UpdateUrls(stripped_url_,
+                              tentative_resource_request.site_for_cookies,
+                              tentative_resource_request.trusted_params
+                                  ? tentative_resource_request.trusted_params
+                                        ->isolation_info.top_frame_origin()
+                                  : base::nullopt);
   return true;
 }
 
@@ -278,23 +283,29 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
     return;
   }
 
-  bool allow_service_worker = false;
+  AllowServiceWorkerResult allow_service_worker =
+      AllowServiceWorkerResult::No();
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     allow_service_worker =
         GetContentClient()->browser()->AllowServiceWorkerOnUI(
             registration->scope(),
             container_host_->site_for_cookies().RepresentativeUrl(),
             container_host_->top_frame_origin(), /*script_url=*/GURL(),
-            browser_context_, container_host_->web_contents_getter());
+            browser_context_);
   } else {
     allow_service_worker =
         GetContentClient()->browser()->AllowServiceWorkerOnIO(
             registration->scope(),
             container_host_->site_for_cookies().RepresentativeUrl(),
             container_host_->top_frame_origin(), /*script_url=*/GURL(),
-            resource_context_, container_host_->web_contents_getter());
+            resource_context_);
   }
 
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(service_worker_accessed_callback_, registration->scope(),
+                     allow_service_worker));
+
   if (!allow_service_worker) {
     TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
diff --git a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.h b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.h
index 2e0a5553036..fe3b8be1ddd 100644
--- a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.h
+++ b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.h
@@ -16,6 +16,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
 #include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/service_worker/service_worker_accessed_callback.h"
 #include "content/browser/service_worker/service_worker_navigation_loader.h"
 #include "content/common/content_export.h"
 #include "services/network/public/cpp/resource_request.h"
@@ -45,7 +46,8 @@ class CONTENT_EXPORT ServiceWorkerControlleeRequestHandler final {
       base::WeakPtr<ServiceWorkerContextCore> context,
       base::WeakPtr<ServiceWorkerContainerHost> container_host,
       blink::mojom::ResourceType resource_type,
-      bool skip_service_worker);
+      bool skip_service_worker,
+      ServiceWorkerAccessedCallback service_worker_accessed_callback);
   ~ServiceWorkerControlleeRequestHandler();
 
   // This could get called multiple times during the lifetime in redirect
@@ -121,6 +123,8 @@ class CONTENT_EXPORT ServiceWorkerControlleeRequestHandler final {
   ServiceWorkerLoaderCallback loader_callback_;
   NavigationLoaderInterceptor::FallbackCallback fallback_callback_;
 
+  ServiceWorkerAccessedCallback service_worker_accessed_callback_;
+
   base::WeakPtrFactory<ServiceWorkerControlleeRequestHandler> weak_factory_{
       this};
 
diff --git a/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc b/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
index bb2a12efc97..bd1151b1658 100644
--- a/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
@@ -10,7 +10,6 @@
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/metrics/histogram_tester.h"
@@ -59,7 +58,8 @@ class ServiceWorkerControlleeRequestHandlerTest : public testing::Test {
               test->context()->AsWeakPtr(),
               test->container_host_,
               type,
-              /*skip_service_worker=*/false)) {}
+              /*skip_service_worker=*/false,
+              base::DoNothing())) {}
 
     void MaybeCreateLoader() {
       network::ResourceRequest resource_request;
@@ -130,6 +130,11 @@ class ServiceWorkerControlleeRequestHandlerTest : public testing::Test {
 
   ServiceWorkerContextCore* context() const { return helper_->context(); }
 
+  void CloseRemotes() {
+    for (auto& remote_endpoint : remote_endpoints_)
+      remote_endpoint.host_remote()->reset();
+  }
+
  protected:
   BrowserTaskEnvironment task_environment_;
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
@@ -145,25 +150,23 @@ class ServiceWorkerControlleeRequestHandlerTest : public testing::Test {
 
 class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
  public:
-  ServiceWorkerTestContentBrowserClient() {}
-  bool AllowServiceWorkerOnIO(
+  ServiceWorkerTestContentBrowserClient() = default;
+  AllowServiceWorkerResult AllowServiceWorkerOnIO(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::ResourceContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
-    return false;
+      content::ResourceContext* context) override {
+    return AllowServiceWorkerResult::No();
   }
 
-  bool AllowServiceWorkerOnUI(
+  AllowServiceWorkerResult AllowServiceWorkerOnUI(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::BrowserContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
-    return false;
+      content::BrowserContext* context) override {
+    return AllowServiceWorkerResult::No();
   }
 };
 
@@ -385,9 +388,9 @@ TEST_F(ServiceWorkerControlleeRequestHandlerTest, DeletedContainerHost) {
 
   // Shouldn't crash if the ProviderHost is deleted prior to completion of
   // the database lookup.
-  context()->UnregisterContainerHostByClientID(container_host_->client_uuid());
-  EXPECT_FALSE(container_host_);
+  CloseRemotes();
   base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(container_host_);
   EXPECT_FALSE(test_resources.loader());
 }
 
@@ -412,7 +415,7 @@ TEST_F(ServiceWorkerControlleeRequestHandlerTest, SkipServiceWorker) {
       std::make_unique<ServiceWorkerControlleeRequestHandler>(
           context()->AsWeakPtr(), container_host_,
           blink::mojom::ResourceType::kMainFrame,
-          /*skip_service_worker=*/true));
+          /*skip_service_worker=*/true, base::DoNothing()));
 
   // Conduct a main resource load.
   test_resources.MaybeCreateLoader();
@@ -453,7 +456,7 @@ TEST_F(ServiceWorkerControlleeRequestHandlerTest, NullContext) {
       std::make_unique<ServiceWorkerControlleeRequestHandler>(
           context()->AsWeakPtr(), container_host_,
           blink::mojom::ResourceType::kMainFrame,
-          /*skip_service_worker=*/false));
+          /*skip_service_worker=*/false, base::DoNothing()));
 
   // Destroy the context and make a new one.
   helper_->context_wrapper()->DeleteAndStartOver();
diff --git a/chromium/content/browser/service_worker/service_worker_database.cc b/chromium/content/browser/service_worker/service_worker_database.cc
index 27358da862b..54323ba4897 100644
--- a/chromium/content/browser/service_worker/service_worker_database.cc
+++ b/chromium/content/browser/service_worker/service_worker_database.cc
@@ -923,10 +923,10 @@ ServiceWorkerDatabase::ReadUserKeysAndDataByKeyPrefix(
 ServiceWorkerDatabase::Status ServiceWorkerDatabase::WriteUserData(
     int64_t registration_id,
     const GURL& origin,
-    const std::vector<std::pair<std::string, std::string>>& name_value_pairs) {
+    const std::vector<storage::mojom::ServiceWorkerUserDataPtr>& user_data) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId, registration_id);
-  DCHECK(!name_value_pairs.empty());
+  DCHECK(!user_data.empty());
 
   Status status = LazyOpen(false);
   if (IsNewOrNonexistentDatabase(status))
@@ -941,10 +941,10 @@ ServiceWorkerDatabase::Status ServiceWorkerDatabase::WriteUserData(
     return status;
 
   leveldb::WriteBatch batch;
-  for (const auto& pair : name_value_pairs) {
-    DCHECK(!pair.first.empty());
-    batch.Put(CreateUserDataKey(registration_id, pair.first), pair.second);
-    batch.Put(CreateHasUserDataKey(registration_id, pair.first), "");
+  for (const auto& entry : user_data) {
+    DCHECK(!entry->key.empty());
+    batch.Put(CreateUserDataKey(registration_id, entry->key), entry->value);
+    batch.Put(CreateHasUserDataKey(registration_id, entry->key), "");
   }
   return WriteBatch(&batch);
 }
diff --git a/chromium/content/browser/service_worker/service_worker_database.h b/chromium/content/browser/service_worker/service_worker_database.h
index c3f896aab7c..286a4286f7a 100644
--- a/chromium/content/browser/service_worker/service_worker_database.h
+++ b/chromium/content/browser/service_worker/service_worker_database.h
@@ -21,6 +21,7 @@
 #include "base/sequence_checker.h"
 #include "base/time/time.h"
 #include "components/services/storage/public/mojom/service_worker_database.mojom.h"
+#include "components/services/storage/public/mojom/service_worker_storage_control.mojom.h"
 #include "content/common/content_export.h"
 #include "services/network/public/mojom/cross_origin_embedder_policy.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/navigation_preload_state.mojom.h"
@@ -191,7 +192,7 @@ class CONTENT_EXPORT ServiceWorkerDatabase {
   Status WriteUserData(
       int64_t registration_id,
       const GURL& origin,
-      const std::vector<std::pair<std::string, std::string>>& name_value_pairs);
+      const std::vector<storage::mojom::ServiceWorkerUserDataPtr>& user_data);
 
   // Deletes user data for |registration_id| and |user_data_names| from the
   // database. Returns OK if all are successfully deleted or not found in the
diff --git a/chromium/content/browser/service_worker/service_worker_database_unittest.cc b/chromium/content/browser/service_worker/service_worker_database_unittest.cc
index 8406253ce2c..2595362644b 100644
--- a/chromium/content/browser/service_worker/service_worker_database_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_database_unittest.cc
@@ -105,6 +105,16 @@ network::CrossOriginEmbedderPolicy CrossOriginEmbedderPolicyRequireCorp() {
   return out;
 }
 
+std::vector<storage::mojom::ServiceWorkerUserDataPtr> CreateUserData(
+    const std::vector<std::pair<std::string, std::string>>& key_value_pairs) {
+  std::vector<storage::mojom::ServiceWorkerUserDataPtr> out;
+  for (auto& kv : key_value_pairs) {
+    out.push_back(
+        storage::mojom::ServiceWorkerUserData::New(kv.first, kv.second));
+  }
+  return out;
+}
+
 }  // namespace
 
 TEST(ServiceWorkerDatabaseTest, OpenDatabase) {
@@ -1077,7 +1087,7 @@ TEST(ServiceWorkerDatabaseTest, UserData_Basic) {
   std::vector<std::string> user_data_out;
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data.registration_id, kOrigin,
-                                    {{"key1", "data"}}));
+                                    CreateUserData({{"key1", "data"}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data.registration_id, {"key1"}, &user_data_out));
@@ -1087,12 +1097,13 @@ TEST(ServiceWorkerDatabaseTest, UserData_Basic) {
   // Writing user data not associated with the stored registration should be
   // failed.
   EXPECT_EQ(ServiceWorkerDatabase::Status::kErrorNotFound,
-            database->WriteUserData(300, kOrigin, {{"key1", "data"}}));
+            database->WriteUserData(300, kOrigin,
+                                    CreateUserData({{"key1", "data"}})));
 
   // Write empty user data for a different key.
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data.registration_id, kOrigin,
-                                    {{"key2", std::string()}}));
+                                    CreateUserData({{"key2", std::string()}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data.registration_id, {"key2"}, &user_data_out));
@@ -1107,7 +1118,7 @@ TEST(ServiceWorkerDatabaseTest, UserData_Basic) {
   // Overwrite the existing user data.
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data.registration_id, kOrigin,
-                                    {{"key1", "overwrite"}}));
+                                    CreateUserData({{"key1", "overwrite"}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data.registration_id, {"key1"}, &user_data_out));
@@ -1128,11 +1139,11 @@ TEST(ServiceWorkerDatabaseTest, UserData_Basic) {
   EXPECT_EQ(std::string(), user_data_out[0]);
 
   // Write/overwrite multiple user data keys.
-  EXPECT_EQ(
-      ServiceWorkerDatabase::Status::kOk,
-      database->WriteUserData(
-          data.registration_id, kOrigin,
-          {{"key2", "overwrite2"}, {"key3", "data3"}, {"key4", "data4"}}));
+  EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
+            database->WriteUserData(data.registration_id, kOrigin,
+                                    CreateUserData({{"key2", "overwrite2"},
+                                                    {"key3", "data3"},
+                                                    {"key4", "data4"}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kErrorNotFound,
       database->ReadUserData(data.registration_id, {"key1"}, &user_data_out));
@@ -1201,29 +1212,36 @@ TEST(ServiceWorkerDatabaseTest,
             database->WriteRegistration(data2, resources2, &deleted_version));
 
   // Write user data associated with the registration1.
-  ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value1"}}));
-  ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key_prefix:key2", "value2"}}));
-  ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key_prefix:key3", "value3"}}));
+  ASSERT_EQ(
+      ServiceWorkerDatabase::Status::kOk,
+      database->WriteUserData(data1.registration_id, kOrigin,
+                              CreateUserData({{"key_prefix:key1", "value1"}})));
+  ASSERT_EQ(
+      ServiceWorkerDatabase::Status::kOk,
+      database->WriteUserData(data1.registration_id, kOrigin,
+                              CreateUserData({{"key_prefix:key2", "value2"}})));
+  ASSERT_EQ(
+      ServiceWorkerDatabase::Status::kOk,
+      database->WriteUserData(data1.registration_id, kOrigin,
+                              CreateUserData({{"key_prefix:key3", "value3"}})));
 
   // Write user data associated with the registration2.
+  ASSERT_EQ(
+      ServiceWorkerDatabase::Status::kOk,
+      database->WriteUserData(data2.registration_id, kOrigin,
+                              CreateUserData({{"key_prefix:key1", "value1"}})));
+  ASSERT_EQ(
+      ServiceWorkerDatabase::Status::kOk,
+      database->WriteUserData(data2.registration_id, kOrigin,
+                              CreateUserData({{"key_prefix:key2", "value2"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value1"}}));
-  ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key_prefix:key2", "value2"}}));
-  ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"another_key_prefix:key1", "value1"}}));
+            database->WriteUserData(
+                data2.registration_id, kOrigin,
+                CreateUserData({{"another_key_prefix:key1", "value1"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"another_key_prefix:key2", "value2"}}));
+            database->WriteUserData(
+                data2.registration_id, kOrigin,
+                CreateUserData({{"another_key_prefix:key2", "value2"}})));
 
   // Get all registrations with user data by key prefix.
   std::vector<std::pair<int64_t, std::string>> user_data_list;
@@ -1263,11 +1281,12 @@ TEST(ServiceWorkerDatabaseTest, ReadUserDataByKeyPrefix) {
 
   // Write user data associated with the registration.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_c1"},
-                                     {"key_prefix:key2", "value_c2"},
-                                     {"other_key_prefix:k1", "value_d1"},
-                                     {"other_key_prefix:k2", "value_d2"}}));
+            database->WriteUserData(
+                data.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_c1"},
+                                {"key_prefix:key2", "value_c2"},
+                                {"other_key_prefix:k1", "value_d1"},
+                                {"other_key_prefix:k2", "value_d2"}})));
 
   std::vector<std::string> user_data;
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
@@ -1307,11 +1326,12 @@ TEST(ServiceWorkerDatabaseTest, ReadUserKeysAndDataByKeyPrefix) {
 
   // Write user data associated with the registration.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_c1"},
-                                     {"key_prefix:key2", "value_c2"},
-                                     {"other_key_prefix:k1", "value_d1"},
-                                     {"other_key_prefix:k2", "value_d2"}}));
+            database->WriteUserData(
+                data.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_c1"},
+                                {"key_prefix:key2", "value_c2"},
+                                {"other_key_prefix:k1", "value_d1"},
+                                {"other_key_prefix:k2", "value_d2"}})));
 
   base::flat_map<std::string, std::string> user_data_map;
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
@@ -1368,21 +1388,23 @@ TEST(ServiceWorkerDatabaseTest, UserData_DeleteUserDataByKeyPrefixes) {
 
   // Write user data associated with registration 1.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_a1"},
-                                     {"key_prefix:key2", "value_a2"},
-                                     {"key_prefix:key3", "value_a3"},
-                                     {"kept_key_prefix:key1", "value_b1"}}));
+            database->WriteUserData(
+                data1.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_a1"},
+                                {"key_prefix:key2", "value_a2"},
+                                {"key_prefix:key3", "value_a3"},
+                                {"kept_key_prefix:key1", "value_b1"}})));
 
   // Write user data associated with registration 2.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_c1"},
-                                     {"key_prefix:key2", "value_c2"},
-                                     {"other_key_prefix:key1", "value_d1"},
-                                     {"other_key_prefix:key2", "value_d2"},
-                                     {"kept_key_prefix:key1", "value_e1"},
-                                     {"kept_key_prefix:key2", "value_e2"}}));
+            database->WriteUserData(
+                data2.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_c1"},
+                                {"key_prefix:key2", "value_c2"},
+                                {"other_key_prefix:key1", "value_d1"},
+                                {"other_key_prefix:key2", "value_d2"},
+                                {"kept_key_prefix:key1", "value_e1"},
+                                {"kept_key_prefix:key2", "value_e2"}})));
 
   // Deleting user data by key prefixes should return Status::kOk (rather than
   // Status::kErrorNotFound) even if no keys match the prefixes and so nothing
@@ -1466,19 +1488,21 @@ TEST(ServiceWorkerDatabaseTest,
 
   // Write user data associated with registration 1.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_a1"},
-                                     {"key_prefix:key2", "value_a2"},
-                                     {"key_prefix:key3", "value_a3"},
-                                     {"kept_key_prefix:key1", "value_b1"}}));
+            database->WriteUserData(
+                data1.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_a1"},
+                                {"key_prefix:key2", "value_a2"},
+                                {"key_prefix:key3", "value_a3"},
+                                {"kept_key_prefix:key1", "value_b1"}})));
 
   // Write user data associated with registration 2.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
-            database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key_prefix:key1", "value_c1"},
-                                     {"key_prefix:key2", "value_c2"},
-                                     {"kept_key_prefix:key1", "value_d1"},
-                                     {"kept_key_prefix:key2", "value_d2"}}));
+            database->WriteUserData(
+                data2.registration_id, kOrigin,
+                CreateUserData({{"key_prefix:key1", "value_c1"},
+                                {"key_prefix:key2", "value_c2"},
+                                {"kept_key_prefix:key1", "value_d1"},
+                                {"kept_key_prefix:key2", "value_d2"}})));
 
   // Deleting user data by key prefixes should return Status::kOk (rather than
   // Status::kErrorNotFound) even if no keys match the prefixes and so nothing
@@ -1549,7 +1573,7 @@ TEST(ServiceWorkerDatabaseTest, UserData_DataIsolation) {
   std::vector<std::string> user_data_out;
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key", "data1"}}));
+                                    CreateUserData({{"key", "data1"}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data1.registration_id, {"key"}, &user_data_out));
@@ -1563,7 +1587,7 @@ TEST(ServiceWorkerDatabaseTest, UserData_DataIsolation) {
   // the data associated with registration1.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key", "data2"}}));
+                                    CreateUserData({{"key", "data2"}})));
   EXPECT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data1.registration_id, {"key"}, &user_data_out));
@@ -1641,10 +1665,10 @@ TEST(ServiceWorkerDatabaseTest, UserData_DeleteRegistration) {
   std::vector<std::string> user_data_out;
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key1", "data1"}}));
+                                    CreateUserData({{"key1", "data1"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data1.registration_id, kOrigin,
-                                    {{"key2", "data2"}}));
+                                    CreateUserData({{"key2", "data2"}})));
   ASSERT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data1.registration_id, {"key1"}, &user_data_out));
@@ -1659,7 +1683,7 @@ TEST(ServiceWorkerDatabaseTest, UserData_DeleteRegistration) {
   // Write user data associated with the registration2.
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data2.registration_id, kOrigin,
-                                    {{"key3", "data3"}}));
+                                    CreateUserData({{"key3", "data3"}})));
   ASSERT_EQ(
       ServiceWorkerDatabase::Status::kOk,
       database->ReadUserData(data2.registration_id, {"key3"}, &user_data_out));
@@ -1694,8 +1718,9 @@ TEST(ServiceWorkerDatabaseTest, UserData_UninitializedDatabase) {
             database->ReadUserData(100, {"key"}, &user_data_out));
 
   // Should be failed because the associated registration does not exist.
-  EXPECT_EQ(ServiceWorkerDatabase::Status::kErrorNotFound,
-            database->WriteUserData(100, kOrigin, {{"key", "data"}}));
+  EXPECT_EQ(
+      ServiceWorkerDatabase::Status::kErrorNotFound,
+      database->WriteUserData(100, kOrigin, CreateUserData({{"key", "data"}})));
 
   // Deleting non-existent entry should succeed.
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
@@ -1709,8 +1734,9 @@ TEST(ServiceWorkerDatabaseTest, UserData_UninitializedDatabase) {
             database->state_);
   EXPECT_EQ(ServiceWorkerDatabase::Status::kErrorNotFound,
             database->ReadUserData(100, {"key"}, &user_data_out));
-  EXPECT_EQ(ServiceWorkerDatabase::Status::kErrorNotFound,
-            database->WriteUserData(100, kOrigin, {{"key", "data"}}));
+  EXPECT_EQ(
+      ServiceWorkerDatabase::Status::kErrorNotFound,
+      database->WriteUserData(100, kOrigin, CreateUserData({{"key", "data"}})));
 
   // Deleting non-existent entry should succeed.
   EXPECT_EQ(ServiceWorkerDatabase::Status::kOk,
@@ -1909,10 +1935,10 @@ TEST(ServiceWorkerDatabaseTest, DeleteAllDataForOrigin) {
             database->WriteRegistration(data1, resources1, &deleted_version));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data1.registration_id, origin1,
-                                    {{"key1", "data1"}}));
+                                    CreateUserData({{"key1", "data1"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data1.registration_id, origin1,
-                                    {{"key2", "data2"}}));
+                                    CreateUserData({{"key2", "data2"}})));
 
   RegistrationData data2;
   data2.registration_id = 11;
@@ -1928,10 +1954,10 @@ TEST(ServiceWorkerDatabaseTest, DeleteAllDataForOrigin) {
             database->WriteRegistration(data2, resources2, &deleted_version));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data2.registration_id, origin1,
-                                    {{"key3", "data3"}}));
+                                    CreateUserData({{"key3", "data3"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data2.registration_id, origin1,
-                                    {{"key4", "data4"}}));
+                                    CreateUserData({{"key4", "data4"}})));
 
   // |origin2| has one registration (registration3).
   RegistrationData data3;
@@ -1948,10 +1974,10 @@ TEST(ServiceWorkerDatabaseTest, DeleteAllDataForOrigin) {
             database->WriteRegistration(data3, resources3, &deleted_version));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data3.registration_id, origin2,
-                                    {{"key5", "data5"}}));
+                                    CreateUserData({{"key5", "data5"}})));
   ASSERT_EQ(ServiceWorkerDatabase::Status::kOk,
             database->WriteUserData(data3.registration_id, origin2,
-                                    {{"key6", "data6"}}));
+                                    CreateUserData({{"key6", "data6"}})));
 
   std::set<GURL> origins_to_delete;
   std::vector<int64_t> newly_purgeable_resources;
diff --git a/chromium/content/browser/service_worker/service_worker_disk_cache.cc b/chromium/content/browser/service_worker/service_worker_disk_cache.cc
index 4ec1b562ced..01b485aaa6c 100644
--- a/chromium/content/browser/service_worker/service_worker_disk_cache.cc
+++ b/chromium/content/browser/service_worker/service_worker_disk_cache.cc
@@ -6,21 +6,85 @@
 
 #include <utility>
 
+#include "content/common/service_worker/service_worker_utils.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
+
 namespace content {
 
+namespace {
+
+void DidReadInfo(base::WeakPtr<AppCacheResponseIO> reader,
+                 scoped_refptr<HttpResponseInfoIOBuffer> io_buffer,
+                 ServiceWorkerResponseReader::ReadResponseHeadCallback callback,
+                 int result) {
+  DCHECK(io_buffer);
+  if (result < 0) {
+    std::move(callback).Run(result, /*response_head=*/nullptr,
+                            /*metadata=*/nullptr);
+    return;
+  }
+
+  DCHECK(io_buffer->http_info);
+  auto response_and_metadata =
+      ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
+          io_buffer->http_info.get(),
+          /*options=*/network::mojom::kURLLoadOptionSendSSLInfoWithResponse,
+          /*request_start_time=*/base::TimeTicks(),
+          /*response_start_time=*/base::TimeTicks::Now(),
+          io_buffer->response_data_size);
+  std::move(callback).Run(result, std::move(response_and_metadata.head),
+                          std::move(response_and_metadata.metadata));
+}
+
+}  // namespace
+
 ServiceWorkerDiskCache::ServiceWorkerDiskCache()
-    : AppCacheDiskCache("DiskCache.ServiceWorker", /*use_simple_cache=*/true) {}
+    : AppCacheDiskCache(/*use_simple_cache=*/true) {}
 
 ServiceWorkerResponseReader::ServiceWorkerResponseReader(
     int64_t resource_id,
     base::WeakPtr<AppCacheDiskCache> disk_cache)
     : AppCacheResponseReader(resource_id, std::move(disk_cache)) {}
 
+void ServiceWorkerResponseReader::ReadResponseHead(
+    ReadResponseHeadCallback callback) {
+  auto io_buffer = base::MakeRefCounted<HttpResponseInfoIOBuffer>();
+  ReadInfo(io_buffer.get(), base::BindOnce(&DidReadInfo, GetWeakPtr(),
+                                           io_buffer, std::move(callback)));
+}
+
 ServiceWorkerResponseWriter::ServiceWorkerResponseWriter(
     int64_t resource_id,
     base::WeakPtr<AppCacheDiskCache> disk_cache)
     : AppCacheResponseWriter(resource_id, std::move(disk_cache)) {}
 
+void ServiceWorkerResponseWriter::WriteResponseHead(
+    const network::mojom::URLResponseHead& response_head,
+    int response_data_size,
+    net::CompletionOnceCallback callback) {
+  // This is copied from CreateHttpResponseInfoAndCheckHeaders().
+  // TODO(bashi): Use CreateHttpResponseInfoAndCheckHeaders()
+  // once we remove URLResponseHead -> HttpResponseInfo -> URLResponseHead
+  // conversion, which drops some information needed for validation
+  // (e.g. mime type).
+  auto response_info = std::make_unique<net::HttpResponseInfo>();
+  response_info->headers = response_head.headers;
+  if (response_head.ssl_info.has_value())
+    response_info->ssl_info = *response_head.ssl_info;
+  response_info->was_fetched_via_spdy = response_head.was_fetched_via_spdy;
+  response_info->was_alpn_negotiated = response_head.was_alpn_negotiated;
+  response_info->alpn_negotiated_protocol =
+      response_head.alpn_negotiated_protocol;
+  response_info->connection_info = response_head.connection_info;
+  response_info->remote_endpoint = response_head.remote_endpoint;
+  response_info->response_time = response_head.response_time;
+
+  auto info_buffer =
+      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(response_info));
+  info_buffer->response_data_size = response_data_size;
+  WriteInfo(info_buffer.get(), std::move(callback));
+}
+
 ServiceWorkerResponseMetadataWriter::ServiceWorkerResponseMetadataWriter(
     int64_t resource_id,
     base::WeakPtr<AppCacheDiskCache> disk_cache)
diff --git a/chromium/content/browser/service_worker/service_worker_disk_cache.h b/chromium/content/browser/service_worker/service_worker_disk_cache.h
index fcf52f57b60..0f4669e9334 100644
--- a/chromium/content/browser/service_worker/service_worker_disk_cache.h
+++ b/chromium/content/browser/service_worker/service_worker_disk_cache.h
@@ -11,6 +11,7 @@
 #include "content/browser/appcache/appcache_disk_cache.h"
 #include "content/browser/appcache/appcache_disk_cache_ops.h"
 #include "content/common/content_export.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 
 namespace content {
 
@@ -25,8 +26,19 @@ class CONTENT_EXPORT ServiceWorkerDiskCache : public AppCacheDiskCache {
   ServiceWorkerDiskCache();
 };
 
+// TODO(crbug.com/1060076): Migrate to
+// storage::mojom::ServiceWorkerResourceReader.
 class CONTENT_EXPORT ServiceWorkerResponseReader
     : public AppCacheResponseReader {
+ public:
+  // Reads response headers and metadata associated with this reader from
+  // storage. This is an adaptor method of ReadInfo().
+  using ReadResponseHeadCallback =
+      base::OnceCallback<void(int result,
+                              network::mojom::URLResponseHeadPtr response_head,
+                              scoped_refptr<net::IOBufferWithSize> metadata)>;
+  void ReadResponseHead(ReadResponseHeadCallback callback);
+
  protected:
   // Should only be constructed by the storage class.
   friend class ServiceWorkerStorage;
@@ -35,8 +47,20 @@ class CONTENT_EXPORT ServiceWorkerResponseReader
                               base::WeakPtr<AppCacheDiskCache> disk_cache);
 };
 
+// TODO(crbug.com/1060076): Migrate to
+// storage::mojom::ServiceWorkerResourceWriter.
 class CONTENT_EXPORT ServiceWorkerResponseWriter
     : public AppCacheResponseWriter {
+ public:
+  // Writes response headers for a service worker script to storage. Currently
+  // this just converts |response_head| to HttpResponseInfo and calls
+  // WriteInfo(). |response_head| must be examined by
+  // service_worker_loader_helpers::CheckResponseHead() before calling this
+  // method.
+  void WriteResponseHead(const network::mojom::URLResponseHead& response_head,
+                         int response_data_size,
+                         net::CompletionOnceCallback callback);
+
  protected:
   // Should only be constructed by the storage class.
   friend class ServiceWorkerStorage;
diff --git a/chromium/content/browser/service_worker/service_worker_file_upload_browsertest.cc b/chromium/content/browser/service_worker/service_worker_file_upload_browsertest.cc
index dd6e6a60b47..a9ce49287db 100644
--- a/chromium/content/browser/service_worker/service_worker_file_upload_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_file_upload_browsertest.cc
@@ -5,7 +5,6 @@
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -15,6 +14,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -147,8 +147,8 @@ class ServiceWorkerFileUploadTest : public testing::WithParamInterface<bool>,
     base::FilePath file_path;
     ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
     ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-    ASSERT_EQ(static_cast<int>(kFileSize),
-              base::WriteFile(file_path, kFileContent, kFileSize));
+    ASSERT_TRUE(
+        base::WriteFile(file_path, base::StringPiece(kFileContent, kFileSize)));
 
     // Fill out the form to refer to the test file.
     base::RunLoop run_loop;
@@ -394,8 +394,8 @@ IN_PROC_BROWSER_TEST_P(ServiceWorkerFileUploadTest, Subresource) {
   base::FilePath file_path;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path));
-  ASSERT_EQ(static_cast<int>(kFileSize),
-            base::WriteFile(file_path, kFileContent, kFileSize));
+  ASSERT_TRUE(
+      base::WriteFile(file_path, base::StringPiece(kFileContent, kFileSize)));
 
   std::string result;
   RunSubresourceTest(file_path, &result);
@@ -419,8 +419,8 @@ IN_PROC_BROWSER_TEST_P(ServiceWorkerFileUploadTest,
   base::ScopedTempDir temp_dir;
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   base::FilePath file_path = temp_dir.GetPath().Append(nonAsciiFilename);
-  ASSERT_EQ(static_cast<int>(kFileSize),
-            base::WriteFile(file_path, kFileContent, kFileSize));
+  ASSERT_TRUE(
+      base::WriteFile(file_path, base::StringPiece(kFileContent, kFileSize)));
 
   std::string result;
   RunSubresourceTest(file_path, &result);
diff --git a/chromium/content/browser/service_worker/service_worker_installed_script_loader.cc b/chromium/content/browser/service_worker/service_worker_installed_script_loader.cc
index 59f9af8583b..9c8f2479ed2 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_script_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_installed_script_loader.cc
@@ -28,9 +28,7 @@ ServiceWorkerInstalledScriptLoader::ServiceWorkerInstalledScriptLoader(
     scoped_refptr<ServiceWorkerVersion>
         version_for_main_script_http_response_info,
     const GURL& request_url)
-    : options_(options),
-      client_(std::move(client)),
-      request_start_(base::TimeTicks::Now()) {
+    : client_(std::move(client)), request_start_(base::TimeTicks::Now()) {
   // Normally, the main script info is set by ServiceWorkerNewScriptLoader for
   // new service workers and ServiceWorkerInstalledScriptsSender for installed
   // service workes. But some embedders might preinstall scripts to the
@@ -54,15 +52,16 @@ ServiceWorkerInstalledScriptLoader::~ServiceWorkerInstalledScriptLoader() =
     default;
 
 void ServiceWorkerInstalledScriptLoader::OnStarted(
-    scoped_refptr<HttpResponseInfoIOBuffer> http_info,
+    network::mojom::URLResponseHeadPtr response_head,
+    scoped_refptr<net::IOBufferWithSize> metadata,
     mojo::ScopedDataPipeConsumerHandle body_handle,
     mojo::ScopedDataPipeConsumerHandle metadata_handle) {
-  DCHECK(http_info);
-  DCHECK(http_info->http_info->headers);
+  DCHECK(response_head);
+  DCHECK(response_head->headers);
   DCHECK(encoding_.empty());
-  http_info->http_info->headers->GetCharset(&encoding_);
+  response_head->headers->GetCharset(&encoding_);
   body_handle_ = std::move(body_handle);
-  body_size_ = http_info->response_data_size;
+  body_size_ = response_head->content_length;
 
   // Just drain the metadata (V8 code cache): this entire class is just to
   // handle a corner case for non-installed service workers and high performance
@@ -70,20 +69,18 @@ void ServiceWorkerInstalledScriptLoader::OnStarted(
   metadata_drainer_ =
       std::make_unique<mojo::DataPipeDrainer>(this, std::move(metadata_handle));
 
-  net::HttpResponseInfo* info = http_info->http_info.get();
-  DCHECK(info);
-
   if (version_for_main_script_http_response_info_) {
     version_for_main_script_http_response_info_->SetMainScriptResponse(
-        std::make_unique<ServiceWorkerVersion::MainScriptResponse>(*info));
+        std::make_unique<ServiceWorkerVersion::MainScriptResponse>(
+            *response_head));
   }
 
-  auto response = ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
-      info, options_, request_start_, base::TimeTicks::Now(),
-      http_info->response_data_size);
-  client_->OnReceiveResponse(std::move(response.head));
-  if (!response.metadata.empty())
-    client_->OnReceiveCachedMetadata(std::move(response.metadata));
+  client_->OnReceiveResponse(std::move(response_head));
+  if (metadata) {
+    mojo_base::BigBuffer metadata_buffer(
+        base::as_bytes(base::make_span(metadata->data(), metadata->size())));
+    client_->OnReceiveCachedMetadata(std::move(metadata_buffer));
+  }
   client_->OnStartLoadingResponseBody(std::move(body_handle_));
   // We continue in OnFinished().
 }
@@ -116,6 +113,7 @@ void ServiceWorkerInstalledScriptLoader::OnFinished(FinishedReason reason) {
 void ServiceWorkerInstalledScriptLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   // This class never returns a redirect response to its client, so should never
   // be asked to follow one.
diff --git a/chromium/content/browser/service_worker/service_worker_installed_script_loader.h b/chromium/content/browser/service_worker/service_worker_installed_script_loader.h
index a3a5e41368f..faddba06015 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_script_loader.h
+++ b/chromium/content/browser/service_worker/service_worker_installed_script_loader.h
@@ -42,16 +42,19 @@ class CONTENT_EXPORT ServiceWorkerInstalledScriptLoader
   ~ServiceWorkerInstalledScriptLoader() override;
 
   // ServiceWorkerInstalledScriptReader::Client overrides:
-  void OnStarted(scoped_refptr<HttpResponseInfoIOBuffer> http_info,
+  void OnStarted(network::mojom::URLResponseHeadPtr response_head,
+                 scoped_refptr<net::IOBufferWithSize> metadata,
                  mojo::ScopedDataPipeConsumerHandle body_handle,
                  mojo::ScopedDataPipeConsumerHandle meta_data_handle) override;
   void OnFinished(
       ServiceWorkerInstalledScriptReader::FinishedReason reason) override;
 
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
@@ -63,7 +66,6 @@ class CONTENT_EXPORT ServiceWorkerInstalledScriptLoader
   void OnDataAvailable(const void* data, size_t num_bytes) override {}
   void OnDataComplete() override {}
 
-  uint32_t options_ = network::mojom::kURLLoadOptionNone;
   mojo::Remote<network::mojom::URLLoaderClient> client_;
   scoped_refptr<ServiceWorkerVersion>
       version_for_main_script_http_response_info_;
diff --git a/chromium/content/browser/service_worker/service_worker_installed_script_reader.cc b/chromium/content/browser/service_worker/service_worker_installed_script_reader.cc
index f98eb37942d..8bedffb83ad 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_script_reader.cc
+++ b/chromium/content/browser/service_worker/service_worker_installed_script_reader.cc
@@ -104,21 +104,20 @@ ServiceWorkerInstalledScriptReader::~ServiceWorkerInstalledScriptReader() {}
 
 void ServiceWorkerInstalledScriptReader::Start() {
   TRACE_EVENT0("ServiceWorker", "ServiceWorkerInstalledScriptReader::Start");
-  auto info_buf = base::MakeRefCounted<HttpResponseInfoIOBuffer>();
-  reader_->ReadInfo(
-      info_buf.get(),
-      base::BindOnce(&ServiceWorkerInstalledScriptReader::OnReadInfoComplete,
-                     AsWeakPtr(), info_buf));
+  reader_->ReadResponseHead(base::BindOnce(
+      &ServiceWorkerInstalledScriptReader::OnReadResponseHeadComplete,
+      AsWeakPtr()));
 }
 
-void ServiceWorkerInstalledScriptReader::OnReadInfoComplete(
-    scoped_refptr<HttpResponseInfoIOBuffer> http_info,
-    int result) {
+void ServiceWorkerInstalledScriptReader::OnReadResponseHeadComplete(
+    int result,
+    network::mojom::URLResponseHeadPtr response_head,
+    scoped_refptr<net::IOBufferWithSize> metadata) {
   DCHECK(client_);
-  DCHECK(http_info);
-  TRACE_EVENT0("ServiceWorker",
-               "ServiceWorkerInstalledScriptReader::OnReadInfoComplete");
-  if (!http_info->http_info) {
+  TRACE_EVENT0(
+      "ServiceWorker",
+      "ServiceWorkerInstalledScriptReader::OnReadResponseInfoComplete");
+  if (!response_head) {
     DCHECK_LT(result, 0);
     ServiceWorkerMetrics::CountReadResponseResult(
         ServiceWorkerMetrics::READ_HEADERS_ERROR);
@@ -128,8 +127,8 @@ void ServiceWorkerInstalledScriptReader::OnReadInfoComplete(
 
   DCHECK_GE(result, 0);
   mojo::ScopedDataPipeConsumerHandle meta_data_consumer;
-  DCHECK_GE(http_info->response_data_size, 0);
-  body_size_ = http_info->response_data_size;
+  DCHECK_GE(response_head->content_length, 0);
+  body_size_ = response_head->content_length;
   uint64_t meta_data_size = 0;
 
   MojoCreateDataPipeOptions options;
@@ -148,9 +147,9 @@ void ServiceWorkerInstalledScriptReader::OnReadInfoComplete(
   }
 
   // Start sending meta data (V8 code cache data).
-  if (http_info->http_info->metadata) {
-    DCHECK_GE(http_info->http_info->metadata->size(), 0);
-    meta_data_size = http_info->http_info->metadata->size();
+  if (metadata) {
+    DCHECK_GT(metadata->size(), 0);
+    meta_data_size = metadata->size();
 
     mojo::ScopedDataPipeProducerHandle meta_producer_handle;
     options.capacity_num_bytes =
@@ -163,7 +162,7 @@ void ServiceWorkerInstalledScriptReader::OnReadInfoComplete(
     }
 
     meta_data_sender_ = std::make_unique<MetaDataSender>(
-        http_info->http_info->metadata, std::move(meta_producer_handle));
+        metadata, std::move(meta_producer_handle));
     meta_data_sender_->Start(base::BindOnce(
         &ServiceWorkerInstalledScriptReader::OnMetaDataSent, AsWeakPtr()));
   }
@@ -175,7 +174,8 @@ void ServiceWorkerInstalledScriptReader::OnReadInfoComplete(
                           AsWeakPtr()));
   body_watcher_.ArmOrNotify();
 
-  client_->OnStarted(http_info, std::move(body_consumer_handle),
+  client_->OnStarted(std::move(response_head), std::move(metadata),
+                     std::move(body_consumer_handle),
                      std::move(meta_data_consumer));
 }
 
diff --git a/chromium/content/browser/service_worker/service_worker_installed_script_reader.h b/chromium/content/browser/service_worker/service_worker_installed_script_reader.h
index 9fbb5c30ccb..238f0af62fe 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_script_reader.h
+++ b/chromium/content/browser/service_worker/service_worker_installed_script_reader.h
@@ -40,7 +40,8 @@ class ServiceWorkerInstalledScriptReader {
   class Client {
    public:
     virtual void OnStarted(
-        scoped_refptr<HttpResponseInfoIOBuffer> http_info,
+        network::mojom::URLResponseHeadPtr response_head,
+        scoped_refptr<net::IOBufferWithSize> metadata,
         mojo::ScopedDataPipeConsumerHandle body_handle,
         mojo::ScopedDataPipeConsumerHandle meta_data_handle) = 0;
     // Called after both body and metadata have finished being written to the
@@ -60,8 +61,10 @@ class ServiceWorkerInstalledScriptReader {
 
  private:
   class MetaDataSender;
-  void OnReadInfoComplete(scoped_refptr<HttpResponseInfoIOBuffer> http_info,
-                          int result);
+  void OnReadResponseHeadComplete(
+      int result,
+      network::mojom::URLResponseHeadPtr response_head,
+      scoped_refptr<net::IOBufferWithSize> metadata);
   void OnWritableBody(MojoResult);
   void OnResponseDataRead(int read_bytes);
   void OnMetaDataSent(bool success);
diff --git a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.cc b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.cc
index bd25381e101..692fd390152 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.cc
+++ b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.cc
@@ -86,22 +86,20 @@ void ServiceWorkerInstalledScriptsSender::StartSendingScript(
 }
 
 void ServiceWorkerInstalledScriptsSender::OnStarted(
-    scoped_refptr<HttpResponseInfoIOBuffer> http_info,
+    network::mojom::URLResponseHeadPtr response_head,
+    scoped_refptr<net::IOBufferWithSize> metadata,
     mojo::ScopedDataPipeConsumerHandle body_handle,
     mojo::ScopedDataPipeConsumerHandle meta_data_handle) {
-  DCHECK(http_info);
+  DCHECK(response_head);
   DCHECK(reader_);
   DCHECK_EQ(State::kSendingScripts, state_);
-  uint64_t meta_data_size = http_info->http_info->metadata
-                                ? http_info->http_info->metadata->size()
-                                : 0;
+  uint64_t meta_data_size = metadata ? metadata->size() : 0;
   TRACE_EVENT_NESTABLE_ASYNC_INSTANT2(
       "ServiceWorker", "OnStarted", this, "body_size",
-      http_info->response_data_size, "meta_data_size", meta_data_size);
+      response_head->content_length, "meta_data_size", meta_data_size);
 
   // Create a map of response headers.
-  scoped_refptr<net::HttpResponseHeaders> headers =
-      http_info->http_info->headers;
+  scoped_refptr<net::HttpResponseHeaders> headers = response_head->headers;
   DCHECK(headers);
   base::flat_map<std::string, std::string> header_strings;
   size_t iter = 0;
@@ -121,14 +119,14 @@ void ServiceWorkerInstalledScriptsSender::OnStarted(
   script_info->headers = std::move(header_strings);
   headers->GetCharset(&script_info->encoding);
   script_info->body = std::move(body_handle);
-  script_info->body_size = http_info->response_data_size;
+  script_info->body_size = response_head->content_length;
   script_info->meta_data = std::move(meta_data_handle);
   script_info->meta_data_size = meta_data_size;
   manager_->TransferInstalledScript(std::move(script_info));
   if (IsSendingMainScript()) {
     owner_->SetMainScriptResponse(
         std::make_unique<ServiceWorkerVersion::MainScriptResponse>(
-            *http_info->http_info));
+            *response_head));
   }
 }
 
diff --git a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.h b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.h
index aede04aa856..6fc06581b8b 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.h
+++ b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender.h
@@ -16,7 +16,6 @@
 
 namespace content {
 
-struct HttpResponseInfoIOBuffer;
 class ServiceWorkerVersion;
 
 // ServiceWorkerInstalledScriptsSender serves the service worker's installed
@@ -76,7 +75,8 @@ class CONTENT_EXPORT ServiceWorkerInstalledScriptsSender
       ServiceWorkerInstalledScriptReader::FinishedReason reason);
 
   // Implements ServiceWorkerInstalledScriptReader::Client.
-  void OnStarted(scoped_refptr<HttpResponseInfoIOBuffer> http_info,
+  void OnStarted(network::mojom::URLResponseHeadPtr response_head,
+                 scoped_refptr<net::IOBufferWithSize> metadata,
                  mojo::ScopedDataPipeConsumerHandle body_handle,
                  mojo::ScopedDataPipeConsumerHandle meta_data_handle) override;
   void OnFinished(
diff --git a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender_unittest.cc b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender_unittest.cc
index e75b104dd5d..3107253371c 100644
--- a/chromium/content/browser/service_worker/service_worker_installed_scripts_sender_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_installed_scripts_sender_unittest.cc
@@ -25,56 +25,6 @@
 
 namespace content {
 
-namespace {
-
-void ReadDataPipeInternal(mojo::DataPipeConsumerHandle handle,
-                          std::string* result,
-                          base::OnceClosure quit_closure) {
-  while (true) {
-    uint32_t num_bytes;
-    const void* buffer = nullptr;
-    MojoResult rv =
-        handle.BeginReadData(&buffer, &num_bytes, MOJO_READ_DATA_FLAG_NONE);
-    switch (rv) {
-      case MOJO_RESULT_BUSY:
-      case MOJO_RESULT_INVALID_ARGUMENT:
-        NOTREACHED();
-        return;
-      case MOJO_RESULT_FAILED_PRECONDITION:
-        std::move(quit_closure).Run();
-        return;
-      case MOJO_RESULT_SHOULD_WAIT:
-        base::ThreadTaskRunnerHandle::Get()->PostTask(
-            FROM_HERE, base::BindOnce(&ReadDataPipeInternal, handle, result,
-                                      std::move(quit_closure)));
-        return;
-      case MOJO_RESULT_OK:
-        EXPECT_NE(nullptr, buffer);
-        EXPECT_GT(num_bytes, 0u);
-        uint32_t before_size = result->size();
-        result->append(static_cast<const char*>(buffer), num_bytes);
-        uint32_t read_size = result->size() - before_size;
-        EXPECT_EQ(num_bytes, read_size);
-        rv = handle.EndReadData(read_size);
-        EXPECT_EQ(MOJO_RESULT_OK, rv);
-        break;
-    }
-  }
-  NOTREACHED();
-  return;
-}
-
-std::string ReadDataPipe(mojo::ScopedDataPipeConsumerHandle handle) {
-  EXPECT_TRUE(handle.is_valid());
-  std::string result;
-  base::RunLoop loop;
-  ReadDataPipeInternal(handle.get(), &result, loop.QuitClosure());
-  loop.Run();
-  return result;
-}
-
-}  // namespace
-
 class ExpectedScriptInfo {
  public:
   ExpectedScriptInfo(
diff --git a/chromium/content/browser/service_worker/service_worker_internals_ui.cc b/chromium/content/browser/service_worker/service_worker_internals_ui.cc
index f573d27f0ff..fada516d742 100644
--- a/chromium/content/browser/service_worker/service_worker_internals_ui.cc
+++ b/chromium/content/browser/service_worker/service_worker_internals_ui.cc
@@ -159,8 +159,9 @@ void UpdateVersionInfo(const ServiceWorkerVersionInfo& version,
   for (auto& it : version.clients) {
     auto client = DictionaryValue();
     client.SetStringPath("client_id", it.first);
-    if (it.second.web_contents_getter) {
-      WebContents* web_contents = it.second.web_contents_getter.Run();
+    if (it.second.type == blink::mojom::ServiceWorkerClientType::kWindow) {
+      WebContents* web_contents =
+          WebContents::FromFrameTreeNodeId(it.second.frame_tree_node_id);
       if (web_contents)
         client.SetStringPath("url", web_contents->GetURL().spec());
     }
diff --git a/chromium/content/browser/service_worker/service_worker_internals_ui.h b/chromium/content/browser/service_worker/service_worker_internals_ui.h
index 38dafe15874..8e02bf2a62d 100644
--- a/chromium/content/browser/service_worker/service_worker_internals_ui.h
+++ b/chromium/content/browser/service_worker/service_worker_internals_ui.h
@@ -9,6 +9,7 @@
 #include <set>
 #include <unordered_map>
 
+#include "base/callback_forward.h"
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
diff --git a/chromium/content/browser/service_worker/service_worker_job_unittest.cc b/chromium/content/browser/service_worker/service_worker_job_unittest.cc
index 1b45d5bf308..d51ddca1d09 100644
--- a/chromium/content/browser/service_worker/service_worker_job_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_job_unittest.cc
@@ -8,8 +8,8 @@
 #include "base/barrier_closure.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/stl_util.h"
@@ -1183,17 +1183,15 @@ void WriteResponse(ServiceWorkerResponseWriter* writer,
                    const std::string& headers,
                    IOBuffer* body,
                    int length) {
-  std::unique_ptr<net::HttpResponseInfo> info =
-      std::make_unique<net::HttpResponseInfo>();
-  info->request_time = base::Time::Now();
-  info->response_time = base::Time::Now();
-  info->was_cached = false;
-  info->headers = new net::HttpResponseHeaders(headers);
-  scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(info));
+  auto response_head = network::mojom::URLResponseHead::New();
+  response_head->request_time = base::Time::Now();
+  response_head->response_time = base::Time::Now();
+  response_head->headers = new net::HttpResponseHeaders(headers);
+  response_head->content_length = length;
 
   int rv = -1234;
-  writer->WriteInfo(info_buffer.get(), base::BindOnce(&OnIOComplete, &rv));
+  writer->WriteResponseHead(*response_head, length,
+                            base::BindOnce(&OnIOComplete, &rv));
   RunNestedUntilIdle();
   EXPECT_LT(0, rv);
 
@@ -1281,7 +1279,8 @@ class UpdateJobTestHelper : public EmbeddedWorkerTestHelper,
         blink::mojom::ServiceWorkerRegistrationObjectInfoPtr,
         blink::mojom::ServiceWorkerObjectInfoPtr,
         blink::mojom::FetchHandlerExistence,
-        std::unique_ptr<blink::PendingURLLoaderFactoryBundle>) override {
+        std::unique_ptr<blink::PendingURLLoaderFactoryBundle>,
+        mojo::PendingReceiver<blink::mojom::ReportingObserver>) override {
       client_->SimulateFailureOfScriptEvaluation();
     }
 
@@ -1366,12 +1365,11 @@ class UpdateJobTestHelper : public EmbeddedWorkerTestHelper,
   // ServiceWorkerRegistration::Listener overrides
   void OnVersionAttributesChanged(
       ServiceWorkerRegistration* registration,
-      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-      const ServiceWorkerRegistrationInfo& info) override {
+      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) override {
     AttributeChangeLogEntry entry;
     entry.registration_id = registration->id();
     entry.mask = std::move(changed_mask);
-    entry.info = info;
+    entry.info = registration->GetInfo();
     attribute_change_log_.push_back(std::move(entry));
   }
 
diff --git a/chromium/content/browser/service_worker/service_worker_loader_helpers.cc b/chromium/content/browser/service_worker/service_worker_loader_helpers.cc
index b794c929a79..30a6667acf8 100644
--- a/chromium/content/browser/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/browser/service_worker/service_worker_loader_helpers.cc
@@ -113,6 +113,27 @@ bool ShouldValidateBrowserCacheForScript(
           force_bypass_cache);
 }
 
+#if DCHECK_IS_ON()
+void CheckVersionStatusBeforeWorkerScriptLoad(
+    ServiceWorkerVersion::Status status,
+    network::mojom::RequestDestination resource_destination) {
+  switch (resource_destination) {
+    // The service worker main script should be fetched during worker startup.
+    case network::mojom::RequestDestination::kServiceWorker:
+      DCHECK_EQ(status, ServiceWorkerVersion::NEW);
+      break;
+    // importScripts() should be called until completion of the install event.
+    case network::mojom::RequestDestination::kScript:
+      DCHECK(status == ServiceWorkerVersion::NEW ||
+             status == ServiceWorkerVersion::INSTALLING);
+      break;
+    default:
+      NOTREACHED() << resource_destination;
+      break;
+  }
+}
+#endif  // DCHECK_IS_ON()
+
 }  // namespace service_worker_loader_helpers
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_loader_helpers.h b/chromium/content/browser/service_worker/service_worker_loader_helpers.h
index 4242d937aaa..30cc2d7f535 100644
--- a/chromium/content/browser/service_worker/service_worker_loader_helpers.h
+++ b/chromium/content/browser/service_worker/service_worker_loader_helpers.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "content/browser/service_worker/service_worker_version.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
@@ -55,6 +56,14 @@ bool ShouldValidateBrowserCacheForScript(
     blink::mojom::ServiceWorkerUpdateViaCache cache_mode,
     base::TimeDelta time_since_last_check);
 
+#if DCHECK_IS_ON()
+// Checks the consistency between the status of the service worker version and
+// the script resource destination to be fetched by the loaders.
+void CheckVersionStatusBeforeWorkerScriptLoad(
+    ServiceWorkerVersion::Status status,
+    network::mojom::RequestDestination resource_destination);
+#endif  // DCHECK_IS_ON()
+
 }  // namespace service_worker_loader_helpers
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_main_resource_handle.cc b/chromium/content/browser/service_worker/service_worker_main_resource_handle.cc
index 8983898541a..3fd46f7d7fe 100644
--- a/chromium/content/browser/service_worker/service_worker_main_resource_handle.cc
+++ b/chromium/content/browser/service_worker/service_worker_main_resource_handle.cc
@@ -18,11 +18,13 @@
 namespace content {
 
 ServiceWorkerMainResourceHandle::ServiceWorkerMainResourceHandle(
-    ServiceWorkerContextWrapper* context_wrapper)
+    ServiceWorkerContextWrapper* context_wrapper,
+    ServiceWorkerAccessedCallback on_service_worker_accessed)
     : context_wrapper_(context_wrapper) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  core_ = new ServiceWorkerMainResourceHandleCore(weak_factory_.GetWeakPtr(),
-                                                  context_wrapper);
+  core_ = new ServiceWorkerMainResourceHandleCore(
+      weak_factory_.GetWeakPtr(), context_wrapper,
+      std::move(on_service_worker_accessed));
 }
 
 ServiceWorkerMainResourceHandle::~ServiceWorkerMainResourceHandle() {
diff --git a/chromium/content/browser/service_worker/service_worker_main_resource_handle.h b/chromium/content/browser/service_worker/service_worker_main_resource_handle.h
index 0d739eb1c9c..c7786a29008 100644
--- a/chromium/content/browser/service_worker/service_worker_main_resource_handle.h
+++ b/chromium/content/browser/service_worker/service_worker_main_resource_handle.h
@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "content/browser/service_worker/service_worker_accessed_callback.h"
 #include "content/common/content_export.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
@@ -59,8 +60,9 @@ class ServiceWorkerMainResourceHandleCore;
 //   ServiceWorkerMainResourceHandleCore on the core thread.
 class CONTENT_EXPORT ServiceWorkerMainResourceHandle {
  public:
-  explicit ServiceWorkerMainResourceHandle(
-      ServiceWorkerContextWrapper* context_wrapper);
+  ServiceWorkerMainResourceHandle(
+      ServiceWorkerContextWrapper* context_wrapper,
+      ServiceWorkerAccessedCallback on_service_worker_accessed);
   ~ServiceWorkerMainResourceHandle();
 
   // Called after a ServiceWorkerProviderHost tied with |provider_info|
diff --git a/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.cc b/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.cc
index 9048297c3f3..7cd6d9022ee 100644
--- a/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.cc
+++ b/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.cc
@@ -12,8 +12,12 @@ namespace content {
 
 ServiceWorkerMainResourceHandleCore::ServiceWorkerMainResourceHandleCore(
     base::WeakPtr<ServiceWorkerMainResourceHandle> ui_handle,
-    ServiceWorkerContextWrapper* context_wrapper)
-    : context_wrapper_(context_wrapper), ui_handle_(ui_handle) {
+    ServiceWorkerContextWrapper* context_wrapper,
+    ServiceWorkerAccessedCallback service_worker_accessed_callback)
+    : context_wrapper_(context_wrapper),
+      ui_handle_(ui_handle),
+      service_worker_accessed_callback_(
+          std::move(service_worker_accessed_callback)) {
   // The ServiceWorkerMainResourceHandleCore is created on the UI thread but
   // should only be accessed from the core thread afterwards.
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.h b/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.h
index 43d2b51787c..aac0082f657 100644
--- a/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.h
+++ b/chromium/content/browser/service_worker/service_worker_main_resource_handle_core.h
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "content/browser/service_worker/service_worker_accessed_callback.h"
 #include "content/browser/service_worker/service_worker_container_host.h"
 #include "content/browser/service_worker/service_worker_controllee_request_handler.h"
 #include "content/common/content_export.h"
@@ -36,7 +37,8 @@ class CONTENT_EXPORT ServiceWorkerMainResourceHandleCore {
  public:
   ServiceWorkerMainResourceHandleCore(
       base::WeakPtr<ServiceWorkerMainResourceHandle> ui_handle,
-      ServiceWorkerContextWrapper* context_wrapper);
+      ServiceWorkerContextWrapper* context_wrapper,
+      ServiceWorkerAccessedCallback on_service_worker_accessed);
   ~ServiceWorkerMainResourceHandleCore();
 
   // Called by corresponding methods in ServiceWorkerMainResourceHandle. See
@@ -72,6 +74,10 @@ class CONTENT_EXPORT ServiceWorkerMainResourceHandleCore {
     return interceptor_.get();
   }
 
+  const ServiceWorkerAccessedCallback& service_worker_accessed_callback() {
+    return service_worker_accessed_callback_;
+  }
+
   base::WeakPtr<ServiceWorkerMainResourceHandleCore> AsWeakPtr() {
     return weak_factory_.GetWeakPtr();
   }
@@ -81,6 +87,8 @@ class CONTENT_EXPORT ServiceWorkerMainResourceHandleCore {
   base::WeakPtr<ServiceWorkerMainResourceHandle> ui_handle_;
   base::WeakPtr<ServiceWorkerContainerHost> container_host_;
   std::unique_ptr<ServiceWorkerControlleeRequestHandler> interceptor_;
+  ServiceWorkerAccessedCallback service_worker_accessed_callback_;
+
   base::WeakPtrFactory<ServiceWorkerMainResourceHandleCore> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerMainResourceHandleCore);
diff --git a/chromium/content/browser/service_worker/service_worker_metrics.cc b/chromium/content/browser/service_worker/service_worker_metrics.cc
index 99e8f8aa5a4..57b27dd84c8 100644
--- a/chromium/content/browser/service_worker/service_worker_metrics.cc
+++ b/chromium/content/browser/service_worker/service_worker_metrics.cc
@@ -199,7 +199,6 @@ const char* ServiceWorkerMetrics::StartSituationToString(
       return "Existing unready process";
     case StartSituation::EXISTING_READY_PROCESS:
       return "Existing ready process";
-      break;
   }
   NOTREACHED() << "Got unexpected start situation: "
                << static_cast<int>(start_situation);
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
index 957b63511dd..07b61ef023b 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
@@ -421,6 +421,7 @@ void ServiceWorkerNavigationLoader::StartResponse(
 void ServiceWorkerNavigationLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   NOTIMPLEMENTED();
 }
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader.h b/chromium/content/browser/service_worker/service_worker_navigation_loader.h
index 7e15b294bca..76796bb0b98 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader.h
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader.h
@@ -135,9 +135,11 @@ class CONTENT_EXPORT ServiceWorkerNavigationLoader
   void CommitCompleted(int error_code, const char* reason);
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
index c169a39176a..23166ec06e5 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
@@ -10,6 +10,7 @@
 #include "base/bind.h"
 #include "base/optional.h"
 #include "base/task/post_task.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
@@ -18,6 +19,8 @@
 #include "content/browser/service_worker/service_worker_main_resource_handle_core.h"
 #include "content/browser/service_worker/service_worker_provider_host.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "content/public/common/origin_util.h"
+#include "content/public/common/url_constants.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 
@@ -78,7 +81,13 @@ void InvokeRequestHandlerOnCoreThread(
 void MaybeCreateLoaderOnCoreThread(
     base::WeakPtr<ServiceWorkerNavigationLoaderInterceptor> interceptor_on_ui,
     ServiceWorkerMainResourceHandleCore* handle_core,
-    const ServiceWorkerNavigationLoaderInterceptorParams& params,
+    blink::mojom::ResourceType resource_type,
+    bool skip_service_worker,
+    bool are_ancestors_secure,
+    int frame_tree_node_id,
+    int process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
     mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
         host_receiver,
     mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
@@ -112,22 +121,21 @@ void MaybeCreateLoaderOnCoreThread(
     DCHECK(client_remote);
     base::WeakPtr<ServiceWorkerContainerHost> container_host;
 
-    if (params.resource_type == blink::mojom::ResourceType::kMainFrame ||
-        params.resource_type == blink::mojom::ResourceType::kSubFrame) {
-      container_host = ServiceWorkerContainerHost::CreateForWindow(
-          context_core->AsWeakPtr(), params.are_ancestors_secure,
-          params.frame_tree_node_id, std::move(host_receiver),
-          std::move(client_remote));
+    if (resource_type == blink::mojom::ResourceType::kMainFrame ||
+        resource_type == blink::mojom::ResourceType::kSubFrame) {
+      container_host = context_core->CreateContainerHostForWindow(
+          std::move(host_receiver), are_ancestors_secure,
+          std::move(client_remote), frame_tree_node_id);
     } else {
-      DCHECK(params.resource_type == blink::mojom::ResourceType::kWorker ||
-             params.resource_type == blink::mojom::ResourceType::kSharedWorker);
-      auto container_type =
-          params.resource_type == blink::mojom::ResourceType::kWorker
-              ? blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker
-              : blink::mojom::ServiceWorkerContainerType::kForSharedWorker;
-      container_host = ServiceWorkerContainerHost::CreateForWebWorker(
-          context_core->AsWeakPtr(), params.process_id, container_type,
-          std::move(host_receiver), std::move(client_remote));
+      DCHECK(resource_type == blink::mojom::ResourceType::kWorker ||
+             resource_type == blink::mojom::ResourceType::kSharedWorker);
+      auto client_type =
+          resource_type == blink::mojom::ResourceType::kWorker
+              ? blink::mojom::ServiceWorkerClientType::kDedicatedWorker
+              : blink::mojom::ServiceWorkerClientType::kSharedWorker;
+      container_host = context_core->CreateContainerHostForWorker(
+          std::move(host_receiver), process_id, std::move(client_remote),
+          client_type, dedicated_worker_id, shared_worker_id);
     }
     DCHECK(container_host);
     handle_core->set_container_host(container_host);
@@ -136,8 +144,9 @@ void MaybeCreateLoaderOnCoreThread(
     DCHECK(!handle_core->interceptor());
     handle_core->set_interceptor(
         std::make_unique<ServiceWorkerControlleeRequestHandler>(
-            context_core->AsWeakPtr(), container_host, params.resource_type,
-            params.skip_service_worker));
+            context_core->AsWeakPtr(), container_host, resource_type,
+            skip_service_worker,
+            handle_core->service_worker_accessed_callback()));
   }
 
   // If |initialize_container_host_only| is true, we have already determined
@@ -164,17 +173,74 @@ void MaybeCreateLoaderOnCoreThread(
       base::BindOnce(&FallbackCallbackWrapperOnCoreThread, interceptor_on_ui,
                      std::move(fallback_callback)));
 }
+
+bool SchemeMaySupportRedirectingToHTTPS(const GURL& url) {
+#if defined(OS_CHROMEOS)
+  return url.SchemeIs(kExternalFileScheme);
+#else   // OS_CHROMEOS
+  return false;
+#endif  // OS_CHROMEOS
+}
+
+// Returns true if a ServiceWorkerNavigationLoaderInterceptor should be created
+// for a worker with this |url|.
+bool ShouldCreateForWorker(const GURL& url) {
+  // Create the handler even for insecure HTTP since it's used in the
+  // case of redirect to HTTPS.
+  return url.SchemeIsHTTPOrHTTPS() || OriginCanAccessServiceWorkers(url);
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 
 }  // namespace
 
-ServiceWorkerNavigationLoaderInterceptor::
-    ServiceWorkerNavigationLoaderInterceptor(
-        const ServiceWorkerNavigationLoaderInterceptorParams& params,
-        base::WeakPtr<ServiceWorkerMainResourceHandle> handle)
-    : handle_(std::move(handle)), params_(params) {
+std::unique_ptr<NavigationLoaderInterceptor>
+ServiceWorkerNavigationLoaderInterceptor::CreateForNavigation(
+    const GURL& url,
+    base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle,
+    const NavigationRequestInfo& request_info) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(handle_);
+
+  if (!ShouldCreateForNavigation(url))
+    return nullptr;
+
+  return std::unique_ptr<ServiceWorkerNavigationLoaderInterceptor>(
+      new ServiceWorkerNavigationLoaderInterceptor(
+          std::move(navigation_handle),
+          request_info.is_main_frame ? blink::mojom::ResourceType::kMainFrame
+                                     : blink::mojom::ResourceType::kSubFrame,
+          request_info.begin_params->skip_service_worker,
+          request_info.are_ancestors_secure, request_info.frame_tree_node_id,
+          ChildProcessHost::kInvalidUniqueID, DedicatedWorkerId(),
+          SharedWorkerId()));
+}
+
+std::unique_ptr<NavigationLoaderInterceptor>
+ServiceWorkerNavigationLoaderInterceptor::CreateForWorker(
+    const network::ResourceRequest& resource_request,
+    int process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
+    base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  auto resource_type =
+      static_cast<blink::mojom::ResourceType>(resource_request.resource_type);
+  DCHECK(resource_type == blink::mojom::ResourceType::kWorker ||
+         resource_type == blink::mojom::ResourceType::kSharedWorker)
+      << resource_request.resource_type;
+
+  // Create the handler even for insecure HTTP since it's used in the
+  // case of redirect to HTTPS.
+  if (!ShouldCreateForWorker(resource_request.url))
+    return nullptr;
+
+  return std::unique_ptr<ServiceWorkerNavigationLoaderInterceptor>(
+      new ServiceWorkerNavigationLoaderInterceptor(
+          std::move(navigation_handle), resource_type,
+          resource_request.skip_service_worker, /*are_ancestors_secure=*/false,
+          FrameTreeNode::kFrameTreeNodeInvalidId, process_id,
+          dedicated_worker_id, shared_worker_id));
 }
 
 ServiceWorkerNavigationLoaderInterceptor::
@@ -227,10 +293,12 @@ void ServiceWorkerNavigationLoaderInterceptor::MaybeCreateLoader(
   ServiceWorkerContextWrapper::RunOrPostTaskOnCoreThread(
       FROM_HERE,
       base::BindOnce(&MaybeCreateLoaderOnCoreThread, GetWeakPtr(),
-                     handle_->core(), params_, std::move(host_receiver),
-                     std::move(client_remote), tentative_resource_request,
-                     browser_context, std::move(loader_callback),
-                     std::move(fallback_callback),
+                     handle_->core(), resource_type_, skip_service_worker_,
+                     are_ancestors_secure_, frame_tree_node_id_, process_id_,
+                     dedicated_worker_id_, shared_worker_id_,
+                     std::move(host_receiver), std::move(client_remote),
+                     tentative_resource_request, browser_context,
+                     std::move(loader_callback), std::move(fallback_callback),
                      initialize_container_host_only));
 
   if (original_callback)
@@ -288,6 +356,37 @@ ServiceWorkerNavigationLoaderInterceptor::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
 
+ServiceWorkerNavigationLoaderInterceptor::
+    ServiceWorkerNavigationLoaderInterceptor(
+        base::WeakPtr<ServiceWorkerMainResourceHandle> handle,
+        blink::mojom::ResourceType resource_type,
+        bool skip_service_worker,
+        bool are_ancestors_secure,
+        int frame_tree_node_id,
+        int process_id,
+        DedicatedWorkerId dedicated_worker_id,
+        SharedWorkerId shared_worker_id)
+    : handle_(std::move(handle)),
+      resource_type_(resource_type),
+      skip_service_worker_(skip_service_worker),
+      are_ancestors_secure_(are_ancestors_secure),
+      frame_tree_node_id_(frame_tree_node_id),
+      process_id_(process_id),
+      dedicated_worker_id_(dedicated_worker_id),
+      shared_worker_id_(shared_worker_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(handle_);
+}
+
+// static
+bool ServiceWorkerNavigationLoaderInterceptor::ShouldCreateForNavigation(
+    const GURL& url) {
+  // Create the handler even for insecure HTTP since it's used in the
+  // case of redirect to HTTPS.
+  return url.SchemeIsHTTPOrHTTPS() || OriginCanAccessServiceWorkers(url) ||
+         SchemeMaySupportRedirectingToHTTPS(url);
+}
+
 void ServiceWorkerNavigationLoaderInterceptor::RequestHandlerWrapper(
     SingleRequestURLLoaderFactory::RequestHandler handler_on_core_thread,
     const network::ResourceRequest& resource_request,
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
index ea5e3696c3b..f6afa906886 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
@@ -7,12 +7,15 @@
 
 #include <memory>
 
+#include "base/gtest_prod_util.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/loader/navigation_loader_interceptor.h"
 #include "content/browser/loader/single_request_url_loader_factory.h"
 #include "content/browser/navigation_subresource_loader_params.h"
+#include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "content/public/common/child_process_host.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
@@ -22,23 +25,7 @@
 namespace content {
 
 class ServiceWorkerMainResourceHandle;
-
-struct ServiceWorkerNavigationLoaderInterceptorParams {
-  // For all clients:
-  blink::mojom::ResourceType resource_type =
-      blink::mojom::ResourceType::kMainFrame;
-  bool skip_service_worker = false;
-
-  // For windows:
-  bool is_main_frame = false;
-  // Whether all ancestor frames of the frame that is navigating have a secure
-  // origin. True for main frames.
-  bool are_ancestors_secure = false;
-  int frame_tree_node_id = RenderFrameHost::kNoFrameTreeNodeId;
-
-  // For web workers:
-  int process_id = ChildProcessHost::kInvalidUniqueID;
-};
+struct NavigationRequestInfo;
 
 // Handles navigations for service worker clients (windows and web workers).
 // Lives on the UI thread.
@@ -46,12 +33,26 @@ struct ServiceWorkerNavigationLoaderInterceptorParams {
 // The corresponding legacy class is ServiceWorkerControlleeRequestHandler which
 // lives on the service worker context core thread. Currently, this class just
 // delegates to the legacy class by posting tasks to it on the core thread.
-class ServiceWorkerNavigationLoaderInterceptor final
+class CONTENT_EXPORT ServiceWorkerNavigationLoaderInterceptor final
     : public NavigationLoaderInterceptor {
  public:
-  ServiceWorkerNavigationLoaderInterceptor(
-      const ServiceWorkerNavigationLoaderInterceptorParams& params,
-      base::WeakPtr<ServiceWorkerMainResourceHandle> handle);
+  // Creates a ServiceWorkerNavigationLoaderInterceptor for a navigation.
+  // Returns nullptr if the interceptor could not be created for this |url|.
+  static std::unique_ptr<NavigationLoaderInterceptor> CreateForNavigation(
+      const GURL& url,
+      base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle,
+      const NavigationRequestInfo& request_info);
+
+  // Creates a ServiceWorkerNavigationLoaderInterceptor for a worker.
+  // Returns nullptr if the interceptor could not be created for the URL of the
+  // worker.
+  static std::unique_ptr<NavigationLoaderInterceptor> CreateForWorker(
+      const network::ResourceRequest& resource_request,
+      int process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id,
+      base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle);
+
   ~ServiceWorkerNavigationLoaderInterceptor() override;
 
   // NavigationLoaderInterceptor overrides:
@@ -80,6 +81,22 @@ class ServiceWorkerNavigationLoaderInterceptor final
   base::WeakPtr<ServiceWorkerNavigationLoaderInterceptor> GetWeakPtr();
 
  private:
+  friend class ServiceWorkerNavigationLoaderInterceptorTest;
+
+  ServiceWorkerNavigationLoaderInterceptor(
+      base::WeakPtr<ServiceWorkerMainResourceHandle> handle,
+      blink::mojom::ResourceType resource_type,
+      bool skip_service_worker,
+      bool are_ancestors_secure,
+      int frame_tree_node_id,
+      int process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id);
+
+  // Returns true if a ServiceWorkerNavigationLoaderInterceptor should be
+  // created for a navigation to |url|.
+  static bool ShouldCreateForNavigation(const GURL& url);
+
   // Given as a callback to NavigationURLLoaderImpl.
   void RequestHandlerWrapper(
       SingleRequestURLLoaderFactory::RequestHandler handler_on_core_thread,
@@ -95,7 +112,20 @@ class ServiceWorkerNavigationLoaderInterceptor final
   // TODO(falken): Arrange things so |handle_| outlives |this| for workers too.
   const base::WeakPtr<ServiceWorkerMainResourceHandle> handle_;
 
-  const ServiceWorkerNavigationLoaderInterceptorParams params_;
+  // For all clients:
+  const blink::mojom::ResourceType resource_type_;
+  const bool skip_service_worker_;
+
+  // For windows:
+  // Whether all ancestor frames of the frame that is navigating have a secure
+  // origin. True for main frames.
+  const bool are_ancestors_secure_;
+  const int frame_tree_node_id_;
+
+  // For web workers:
+  const int process_id_;
+  const DedicatedWorkerId dedicated_worker_id_;
+  const SharedWorkerId shared_worker_id_;
 
   base::Optional<SubresourceLoaderParams> subresource_loader_params_;
 
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor_unittest.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor_unittest.cc
new file mode 100644
index 00000000000..c19d457b71a
--- /dev/null
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor_unittest.cc
@@ -0,0 +1,45 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/service_worker/service_worker_navigation_loader_interceptor.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace content {
+
+class ServiceWorkerNavigationLoaderInterceptorTest : public testing::Test {
+ public:
+  bool ShouldCreateForNavigation(const GURL& url) {
+    return ServiceWorkerNavigationLoaderInterceptor::ShouldCreateForNavigation(
+        url);
+  }
+};
+
+TEST_F(ServiceWorkerNavigationLoaderInterceptorTest,
+       ShouldCreateForNavigation_HTTP) {
+  EXPECT_TRUE(ShouldCreateForNavigation(GURL("http://host/scope/doc")));
+}
+
+TEST_F(ServiceWorkerNavigationLoaderInterceptorTest,
+       ShouldCreateForNavigation_HTTPS) {
+  EXPECT_TRUE(ShouldCreateForNavigation(GURL("https://host/scope/doc")));
+}
+
+TEST_F(ServiceWorkerNavigationLoaderInterceptorTest,
+       ShouldCreateForNavigation_FTP) {
+  EXPECT_FALSE(ShouldCreateForNavigation(GURL("ftp://host/scope/doc")));
+}
+
+TEST_F(ServiceWorkerNavigationLoaderInterceptorTest,
+       ShouldCreateForNavigation_ExternalFileScheme) {
+  bool expected_handler_created = false;
+#if defined(OS_CHROMEOS)
+  expected_handler_created = true;
+#endif  // OS_CHROMEOS
+  EXPECT_EQ(expected_handler_created,
+            ShouldCreateForNavigation(GURL("externalfile:drive/doc")));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
index e1f3d1d2d65..a8b46fb282f 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
@@ -989,19 +989,5 @@ TEST_F(ServiceWorkerNavigationLoaderTest, CancelNavigationDuringFetchEvent) {
   EXPECT_EQ(net::ERR_ABORTED, client_.completion_status().error_code);
 }
 
-TEST_F(ServiceWorkerNavigationLoaderTest, ResponseWithCoop) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitWithFeatures({network::features::kCrossOriginOpenerPolicy},
-                                {});
-  service_worker_->RespondWithHeaders(
-      {{"Cross-Origin-Opener-Policy", "same-origin"}});
-
-  // Perform the request.
-  StartRequest(CreateRequest());
-  client_.RunUntilComplete();
-  EXPECT_EQ(network::mojom::CrossOriginOpenerPolicy::kSameOrigin,
-            client_.response_head()->cross_origin_opener_policy);
-}
-
 }  // namespace service_worker_navigation_loader_unittest
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_new_script_loader.cc b/chromium/content/browser/service_worker/service_worker_new_script_loader.cc
index e83ed74794e..5ce7b1c5c80 100644
--- a/chromium/content/browser/service_worker/service_worker_new_script_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_new_script_loader.cc
@@ -76,8 +76,7 @@ ServiceWorkerNewScriptLoader::ServiceWorkerNewScriptLoader(
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
     int64_t cache_resource_id)
     : request_url_(original_request.url),
-      resource_type_(static_cast<blink::mojom::ResourceType>(
-          original_request.resource_type)),
+      resource_destination_(original_request.destination),
       original_options_(options),
       version_(version),
       network_watcher_(FROM_HERE,
@@ -89,7 +88,8 @@ ServiceWorkerNewScriptLoader::ServiceWorkerNewScriptLoader(
 
   network::ResourceRequest resource_request(original_request);
 #if DCHECK_IS_ON()
-  CheckVersionStatusBeforeLoad();
+  service_worker_loader_helpers::CheckVersionStatusBeforeWorkerScriptLoad(
+      version_->status(), resource_destination_);
 #endif  // DCHECK_IS_ON()
 
   scoped_refptr<ServiceWorkerRegistration> registration =
@@ -98,7 +98,8 @@ ServiceWorkerNewScriptLoader::ServiceWorkerNewScriptLoader(
   // worker is starting up, and it must be starting up here.
   DCHECK(registration);
   const bool is_main_script =
-      resource_type_ == blink::mojom::ResourceType::kServiceWorker;
+      (resource_destination_ ==
+       network::mojom::RequestDestination::kServiceWorker);
   if (is_main_script) {
     // Request SSLInfo. It will be persisted in service worker storage and
     // may be used by ServiceWorkerNavigationLoader for navigations handled
@@ -155,6 +156,7 @@ ServiceWorkerNewScriptLoader::~ServiceWorkerNewScriptLoader() {
 void ServiceWorkerNewScriptLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   // Resource requests for service worker scripts should not follow redirects.
   // See comments in OnReceiveRedirect().
@@ -192,17 +194,16 @@ void ServiceWorkerNewScriptLoader::OnReceiveResponse(
       blink::ServiceWorkerStatusCode::kOk;
   network::URLLoaderCompletionStatus completion_status;
   std::string error_message;
-  std::unique_ptr<net::HttpResponseInfo> response_info =
-      service_worker_loader_helpers::CreateHttpResponseInfoAndCheckHeaders(
+  if (!service_worker_loader_helpers::CheckResponseHead(
           *response_head, &service_worker_state, &completion_status,
-          &error_message);
-  if (!response_info) {
+          &error_message)) {
     DCHECK_NE(net::OK, completion_status.error_code);
     CommitCompleted(completion_status, error_message);
     return;
   }
 
-  if (resource_type_ == blink::mojom::ResourceType::kServiceWorker) {
+  if (resource_destination_ ==
+      network::mojom::RequestDestination::kServiceWorker) {
     // Check the path restriction defined in the spec:
     // https://w3c.github.io/ServiceWorker/#service-worker-script-response
     std::string service_worker_allowed;
@@ -218,8 +219,14 @@ void ServiceWorkerNewScriptLoader::OnReceiveResponse(
       return;
     }
 
+    // TODO(arthursonzogni): Make the Cross-Origin-Embedder-Policy to be parsed
+    // when it reached this line, not matter what URLLoader it is coming from.
+    // The same mechanism as the one in NavigationURLLoader must be provided.
+    // Instead of being a "document", the main resource here is a "script".
     version_->set_cross_origin_embedder_policy(
-        response_head->cross_origin_embedder_policy);
+        response_head->parsed_headers
+            ? response_head->parsed_headers->cross_origin_embedder_policy
+            : network::CrossOriginEmbedderPolicy());
 
     if (response_head->network_accessed)
       version_->embedded_worker()->OnNetworkAccessedForScriptLoad();
@@ -231,8 +238,7 @@ void ServiceWorkerNewScriptLoader::OnReceiveResponse(
 
   network_loader_state_ = LoaderState::kWaitingForBody;
 
-  WriteHeaders(
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(response_info)));
+  WriteHeaders(response_head.Clone());
 
   // Don't pass SSLInfo to the client when the original request doesn't ask
   // to send it.
@@ -331,31 +337,12 @@ void ServiceWorkerNewScriptLoader::OnComplete(
 
 // End of URLLoaderClient ------------------------------------------------------
 
-#if DCHECK_IS_ON()
-void ServiceWorkerNewScriptLoader::CheckVersionStatusBeforeLoad() {
-  DCHECK(version_);
-
-  // ServiceWorkerNewScriptLoader is used for fetching the service worker main
-  // script (RESOURCE_TYPE_SERVICE_WORKER) during worker startup or
-  // importScripts() (RESOURCE_TYPE_SCRIPT).
-  // TODO(nhiroki): In the current implementation, importScripts() can be called
-  // in any ServiceWorkerVersion::Status except for REDUNDANT, but the spec
-  // defines importScripts() works only on the initial script evaluation and the
-  // install event. Update this check once importScripts() is fixed.
-  // (https://crbug.com/719052)
-  DCHECK((resource_type_ == blink::mojom::ResourceType::kServiceWorker &&
-          version_->status() == ServiceWorkerVersion::NEW) ||
-         (resource_type_ == blink::mojom::ResourceType::kScript &&
-          version_->status() != ServiceWorkerVersion::REDUNDANT));
-}
-#endif  // DCHECK_IS_ON()
-
 void ServiceWorkerNewScriptLoader::WriteHeaders(
-    scoped_refptr<HttpResponseInfoIOBuffer> info_buffer) {
+    network::mojom::URLResponseHeadPtr response_head) {
   DCHECK_EQ(WriterState::kNotStarted, header_writer_state_);
   header_writer_state_ = WriterState::kWriting;
   net::Error error = cache_writer_->MaybeWriteHeaders(
-      info_buffer.get(),
+      std::move(response_head),
       base::BindOnce(&ServiceWorkerNewScriptLoader::OnWriteHeadersComplete,
                      weak_factory_.GetWeakPtr()));
   if (error == net::ERR_IO_PENDING) {
diff --git a/chromium/content/browser/service_worker/service_worker_new_script_loader.h b/chromium/content/browser/service_worker/service_worker_new_script_loader.h
index 53253fcfa55..b4a1b7c0ab4 100644
--- a/chromium/content/browser/service_worker/service_worker_new_script_loader.h
+++ b/chromium/content/browser/service_worker/service_worker_new_script_loader.h
@@ -22,7 +22,6 @@
 namespace content {
 
 class ServiceWorkerVersion;
-struct HttpResponseInfoIOBuffer;
 
 // This is the URLLoader used for loading scripts for a new (installing) service
 // worker. It fetches the script (the main script or imported script) and
@@ -81,9 +80,11 @@ class CONTENT_EXPORT ServiceWorkerNewScriptLoader final
   ~ServiceWorkerNewScriptLoader() override;
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
@@ -122,7 +123,7 @@ class CONTENT_EXPORT ServiceWorkerNewScriptLoader final
       int64_t cache_resource_id);
 
   // Writes the given headers into the service worker script storage.
-  void WriteHeaders(scoped_refptr<HttpResponseInfoIOBuffer> info_buffer);
+  void WriteHeaders(network::mojom::URLResponseHeadPtr response_head);
   void OnWriteHeadersComplete(net::Error error);
 
   // Starts watching the data pipe for the network load (i.e.,
@@ -157,15 +158,12 @@ class CONTENT_EXPORT ServiceWorkerNewScriptLoader final
   // If not all data are received, it continues to download from network.
   void OnCacheWriterResumed(net::Error error);
 
-#if DCHECK_IS_ON()
-  void CheckVersionStatusBeforeLoad();
-#endif  // DCHECK_IS_ON()
-
   const GURL request_url_;
 
-  // This is blink::mojom::ResourceType::kServiceWorker for the main script or
-  // blink::mojom::ResourceType::kScript for an imported script.
-  const blink::mojom::ResourceType resource_type_;
+  // This is network::mojom::RequestDestination::kServiceWorker for the
+  // main script or network::mojom::RequestDestination::kScript for
+  // an imported script.
+  const network::mojom::RequestDestination resource_destination_;
 
   // Load options originally passed to this loader. The options passed to the
   // network loader might be different from this.
diff --git a/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc b/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
index 79cae1ee79b..e34bc5c5703 100644
--- a/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
@@ -223,10 +223,10 @@ class ServiceWorkerNewScriptLoaderTest : public testing::Test {
     network::ResourceRequest request;
     request.url = url;
     request.method = "GET";
-    request.resource_type =
-        static_cast<int>((url == version_->script_url())
-                             ? blink::mojom::ResourceType::kServiceWorker
-                             : blink::mojom::ResourceType::kScript);
+    request.destination =
+        (url == version_->script_url())
+            ? network::mojom::RequestDestination::kServiceWorker
+            : network::mojom::RequestDestination::kScript;
 
     *out_client = std::make_unique<network::TestURLLoaderClient>();
     *out_loader = ServiceWorkerNewScriptLoader::CreateAndStart(
diff --git a/chromium/content/browser/service_worker/service_worker_no_best_effort_tasks_browsertest.cc b/chromium/content/browser/service_worker/service_worker_no_best_effort_tasks_browsertest.cc
index 2c873106285..f204b0f819f 100644
--- a/chromium/content/browser/service_worker/service_worker_no_best_effort_tasks_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_no_best_effort_tasks_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/service_worker/service_worker_object_host.cc b/chromium/content/browser/service_worker/service_worker_object_host.cc
index 71a6e2c9806..8e8565665e0 100644
--- a/chromium/content/browser/service_worker/service_worker_object_host.cc
+++ b/chromium/content/browser/service_worker/service_worker_object_host.cc
@@ -285,37 +285,33 @@ void ServiceWorkerObjectHost::DispatchExtendableMessageEvent(
     return;
   }
   DCHECK_EQ(container_origin_, url::Origin::Create(container_host_->url()));
-  switch (container_host_->type()) {
-    case blink::mojom::ServiceWorkerContainerType::kForWindow:
-      service_worker_client_utils::GetClient(
-          container_host_,
-          base::BindOnce(&DispatchExtendableMessageEventFromClient, context_,
-                         version_, std::move(message), container_origin_,
-                         std::move(callback)));
-      return;
-    case blink::mojom::ServiceWorkerContainerType::kForServiceWorker: {
-      // Clamp timeout to the sending worker's remaining timeout, to prevent
-      // postMessage from keeping workers alive forever.
-      base::TimeDelta timeout = container_host_->service_worker_host()
-                                    ->running_hosted_version()
-                                    ->remaining_timeout();
-
-      base::ThreadTaskRunnerHandle::Get()->PostTask(
-          FROM_HERE,
-          base::BindOnce(&DispatchExtendableMessageEventFromServiceWorker,
-                         version_, std::move(message), container_origin_,
-                         base::make_optional(timeout), std::move(callback),
-                         container_host_->GetWeakPtr()));
-      return;
-    }
-    case blink::mojom::ServiceWorkerContainerType::kForDedicatedWorker:
-    case blink::mojom::ServiceWorkerContainerType::kForSharedWorker:
+
+  if (container_host_->IsContainerForServiceWorker()) {
+    // Clamp timeout to the sending worker's remaining timeout, to prevent
+    // postMessage from keeping workers alive forever.
+    base::TimeDelta timeout = container_host_->service_worker_host()
+                                  ->running_hosted_version()
+                                  ->remaining_timeout();
+
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&DispatchExtendableMessageEventFromServiceWorker,
+                       version_, std::move(message), container_origin_,
+                       base::make_optional(timeout), std::move(callback),
+                       container_host_->GetWeakPtr()));
+  } else if (container_host_->IsContainerForWindowClient()) {
+    service_worker_client_utils::GetClient(
+        container_host_,
+        base::BindOnce(&DispatchExtendableMessageEventFromClient, context_,
+                       version_, std::move(message), container_origin_,
+                       std::move(callback)));
+  } else {
+    DCHECK(container_host_->IsContainerForWorkerClient());
+
     // Web workers don't yet have access to ServiceWorker objects, so they
     // can't postMessage to one (https://crbug.com/371690).
-    case blink::mojom::ServiceWorkerContainerType::kUnknown:
-      break;
+    NOTREACHED();
   }
-  NOTREACHED() << container_host_->type();
 }
 
 void ServiceWorkerObjectHost::OnConnectionError() {
diff --git a/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc b/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
index ab6f327ae8e..6eab59040ab 100644
--- a/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
@@ -41,8 +41,8 @@ static void SaveStatusCallback(bool* called,
 
 void SetUpDummyMessagePort(std::vector<blink::MessagePortChannel>* ports) {
   // Let the other end of the pipe close.
-  mojo::MessagePipe pipe;
-  ports->push_back(blink::MessagePortChannel(std::move(pipe.handle0)));
+  blink::MessagePortDescriptorPair pipe;
+  ports->push_back(blink::MessagePortChannel(pipe.TakePort0()));
 }
 
 // A worker that holds on to ExtendableMessageEventPtr so it doesn't get
@@ -200,6 +200,19 @@ class ServiceWorkerObjectHostTest : public testing::Test {
     return registration_info;
   }
 
+  void CallOnConnectionError(ServiceWorkerContainerHost* container_host,
+                             int64_t version_id) {
+    // ServiceWorkerObjectHost has the last reference to the version.
+    ServiceWorkerObjectHost* object_host =
+        GetServiceWorkerObjectHost(container_host, version_id);
+    EXPECT_TRUE(object_host->version_->HasOneRef());
+
+    // Make sure that OnConnectionError induces destruction of the version and
+    // the object host.
+    object_host->receivers_.Clear();
+    object_host->OnConnectionError();
+  }
+
   BrowserTaskEnvironment task_environment_;
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
   scoped_refptr<ServiceWorkerRegistration> registration_;
@@ -405,9 +418,34 @@ TEST_F(ServiceWorkerObjectHostTest, DispatchExtendableMessageEvent_FromClient) {
   EXPECT_TRUE(events[0]->source_info_for_client);
   EXPECT_EQ(container_host->client_uuid(),
             events[0]->source_info_for_client->client_uuid);
-  EXPECT_EQ(container_host->client_type(),
+  EXPECT_EQ(container_host->GetClientType(),
             events[0]->source_info_for_client->client_type);
 }
 
+// This is a regression test for https://crbug.com/1056598.
+TEST_F(ServiceWorkerObjectHostTest, OnConnectionError) {
+  const GURL scope("https://www.example.com/");
+  const GURL script_url("https://www.example.com/service_worker.js");
+  Initialize(std::make_unique<EmbeddedWorkerTestHelper>(base::FilePath()));
+  SetUpRegistration(scope, script_url);
+
+  // Create the provider host.
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
+
+  // Set up the case where the last reference to the version is owned by the
+  // service worker object host.
+  ServiceWorkerContainerHost* container_host =
+      version_->provider_host()->container_host();
+  ServiceWorkerVersion* version_rawptr = version_.get();
+  version_ = nullptr;
+  ASSERT_TRUE(version_rawptr->HasOneRef());
+
+  // Simulate the connection error that induces the object host destruction.
+  // This shouldn't crash.
+  CallOnConnectionError(container_host, version_rawptr->version_id());
+  base::RunLoop().RunUntilIdle();
+}
+
 }  // namespace service_worker_object_host_unittest
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_offline_capability_check_browsertest.cc b/chromium/content/browser/service_worker/service_worker_offline_capability_check_browsertest.cc
index 2d9e7559ebd..9b3688bca19 100644
--- a/chromium/content/browser/service_worker/service_worker_offline_capability_check_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_offline_capability_check_browsertest.cc
@@ -18,6 +18,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -666,6 +667,9 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerOfflineCapabilityCheckBrowserTest,
   EXPECT_EQ(
       OfflineCapability::kSupported,
       CheckOfflineCapability("/service_worker/empty.html?fetch_or_offline"));
+
+  EXPECT_EQ(OfflineCapability::kUnsupported,
+            CheckOfflineCapability("/service_worker/empty.html?cache_add"));
 }
 
 // Sites with a service worker which is not activated yet are identified as
diff --git a/chromium/content/browser/service_worker/service_worker_process_browsertest.cc b/chromium/content/browser/service_worker/service_worker_process_browsertest.cc
index 9bf98b139fd..7f2a4d408ee 100644
--- a/chromium/content/browser/service_worker/service_worker_process_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_process_browsertest.cc
@@ -15,6 +15,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host.cc b/chromium/content/browser/service_worker/service_worker_provider_host.cc
index 68e512f57aa..18ca2aeffce 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host.cc
+++ b/chromium/content/browser/service_worker/service_worker_provider_host.cc
@@ -31,12 +31,6 @@ namespace content {
 
 namespace {
 
-// This function provides the next ServiceWorkerProviderHost ID.
-int NextProviderId() {
-  static int g_next_provider_id = 0;
-  return g_next_provider_id++;
-}
-
 void CreateQuicTransportConnectorImpl(
     int process_id,
     const url::Origin& origin,
@@ -46,10 +40,10 @@ void CreateQuicTransportConnectorImpl(
   if (!process)
     return;
 
-  mojo::MakeSelfOwnedReceiver(
-      std::make_unique<QuicTransportConnectorImpl>(
-          process_id, origin, net::NetworkIsolationKey(origin, origin)),
-      std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(std::make_unique<QuicTransportConnectorImpl>(
+                                  process_id, /*frame=*/nullptr, origin,
+                                  net::NetworkIsolationKey(origin, origin)),
+                              std::move(receiver));
 }
 
 }  // anonymous namespace
@@ -59,17 +53,13 @@ ServiceWorkerProviderHost::ServiceWorkerProviderHost(
         host_receiver,
     ServiceWorkerVersion* running_hosted_version,
     base::WeakPtr<ServiceWorkerContextCore> context)
-    : provider_id_(NextProviderId()),
-      running_hosted_version_(running_hosted_version),
+    : running_hosted_version_(running_hosted_version),
       container_host_(std::make_unique<content::ServiceWorkerContainerHost>(
-          blink::mojom::ServiceWorkerContainerType::kForServiceWorker,
-          /*is_parent_frame_secure=*/true,
-          FrameTreeNode::kFrameTreeNodeInvalidId,
-          std::move(host_receiver),
-          mojo::NullAssociatedRemote(),
-          context)) {
+          std::move(context))),
+      host_receiver_(container_host_.get(), std::move(host_receiver)) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(running_hosted_version_);
+
   container_host_->set_service_worker_host(this);
   container_host_->UpdateUrls(
       running_hosted_version_->script_url(),
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host.h b/chromium/content/browser/service_worker/service_worker_provider_host.h
index b65bd3cf9b8..d8afd0194ee 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host.h
+++ b/chromium/content/browser/service_worker/service_worker_provider_host.h
@@ -55,7 +55,6 @@ class CONTENT_EXPORT ServiceWorkerProviderHost {
       base::WeakPtr<ServiceWorkerContextCore> context);
   ~ServiceWorkerProviderHost();
 
-  int provider_id() const { return provider_id_; }
   int worker_process_id() const { return worker_process_id_; }
   ServiceWorkerVersion* running_hosted_version() const {
     return running_hosted_version_;
@@ -83,9 +82,6 @@ class CONTENT_EXPORT ServiceWorkerProviderHost {
   void ReportNoBinderForInterface(const std::string& error);
 
  private:
-  // Unique among all provider hosts.
-  const int provider_id_;
-
   int worker_process_id_ = ChildProcessHost::kInvalidUniqueID;
 
   // The instance of service worker this provider hosts.
@@ -100,6 +96,9 @@ class CONTENT_EXPORT ServiceWorkerProviderHost {
 
   std::unique_ptr<ServiceWorkerContainerHost> container_host_;
 
+  mojo::AssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
+      host_receiver_;
+
   base::WeakPtrFactory<ServiceWorkerProviderHost> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerProviderHost);
diff --git a/chromium/content/browser/service_worker/service_worker_quota_client.cc b/chromium/content/browser/service_worker/service_worker_quota_client.cc
index 0b5fde1511d..7cb9b81224c 100644
--- a/chromium/content/browser/service_worker/service_worker_quota_client.cc
+++ b/chromium/content/browser/service_worker/service_worker_quota_client.cc
@@ -53,8 +53,8 @@ ServiceWorkerQuotaClient::ServiceWorkerQuotaClient(
 ServiceWorkerQuotaClient::~ServiceWorkerQuotaClient() {
 }
 
-QuotaClient::ID ServiceWorkerQuotaClient::id() const {
-  return QuotaClient::kServiceWorker;
+storage::QuotaClientType ServiceWorkerQuotaClient::type() const {
+  return storage::QuotaClientType::kServiceWorker;
 }
 
 void ServiceWorkerQuotaClient::GetOriginUsage(const url::Origin& origin,
diff --git a/chromium/content/browser/service_worker/service_worker_quota_client.h b/chromium/content/browser/service_worker/service_worker_quota_client.h
index f022a304f77..3e4d51c20b8 100644
--- a/chromium/content/browser/service_worker/service_worker_quota_client.h
+++ b/chromium/content/browser/service_worker/service_worker_quota_client.h
@@ -9,6 +9,7 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "storage/browser/quota/quota_client.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 #include "url/origin.h"
 
@@ -21,7 +22,7 @@ class ServiceWorkerQuotaClient : public storage::QuotaClient {
       ServiceWorkerContextWrapper* context);
 
   // QuotaClient method overrides
-  ID id() const override;
+  storage::QuotaClientType type() const override;
   void OnQuotaManagerDestroyed() override {}
   void GetOriginUsage(const url::Origin& origin,
                       blink::mojom::StorageType type,
diff --git a/chromium/content/browser/service_worker/service_worker_registration.cc b/chromium/content/browser/service_worker/service_worker_registration.cc
index d32c939b37e..5375e02473d 100644
--- a/chromium/content/browser/service_worker/service_worker_registration.cc
+++ b/chromium/content/browser/service_worker/service_worker_registration.cc
@@ -65,8 +65,6 @@ ServiceWorkerRegistration::~ServiceWorkerRegistration() {
   DCHECK(!listeners_.might_have_observers());
   if (context_)
     context_->RemoveLiveRegistration(registration_id_);
-  if (active_version())
-    active_version()->RemoveObserver(this);
 }
 
 void ServiceWorkerRegistration::SetStatus(Status status) {
@@ -133,7 +131,7 @@ void ServiceWorkerRegistration::NotifyUpdateFound() {
 void ServiceWorkerRegistration::NotifyVersionAttributesChanged(
     blink::mojom::ChangedServiceWorkerObjectsMaskPtr mask) {
   for (auto& observer : listeners_)
-    observer.OnVersionAttributesChanged(this, mask.Clone(), GetInfo());
+    observer.OnVersionAttributesChanged(this, mask.Clone());
   if (mask->active || mask->waiting)
     NotifyRegistrationFinished();
 }
@@ -162,13 +160,9 @@ void ServiceWorkerRegistration::SetActiveVersion(
       blink::mojom::ChangedServiceWorkerObjectsMask::New(false, false, false);
   if (version)
     UnsetVersionInternal(version.get(), mask.get());
-  if (active_version_)
-    active_version_->RemoveObserver(this);
   active_version_ = version;
-  if (active_version_) {
-    active_version_->AddObserver(this);
+  if (active_version_)
     active_version_->SetNavigationPreloadState(navigation_preload_state_);
-  }
   mask->active = true;
 
   NotifyVersionAttributesChanged(std::move(mask));
@@ -227,7 +221,6 @@ void ServiceWorkerRegistration::UnsetVersionInternal(
     should_activate_when_ready_ = false;
     mask->waiting = true;
   } else if (active_version_.get() == version) {
-    active_version_->RemoveObserver(this);
     active_version_ = nullptr;
     mask->active = true;
   }
@@ -369,13 +362,13 @@ void ServiceWorkerRegistration::AbortPendingClear(StatusCallback callback) {
 }
 
 void ServiceWorkerRegistration::OnNoControllees(ServiceWorkerVersion* version) {
-  if (!context_)
+  DCHECK(context_);
+  if (version != active_version())
     return;
-  DCHECK_EQ(active_version(), version);
+
   if (is_uninstalling()) {
-    // TODO(falken): This can destroy the caller during this observer function
-    // call, which is impolite and dangerous. Try to make this async, or make
-    // OnNoControllees not an observer function.
+    // TODO(falken): This can destroy the caller (ServiceWorkerVersion). Try to
+    // make this async.
     Clear();
     return;
   }
@@ -398,10 +391,9 @@ void ServiceWorkerRegistration::OnNoControllees(ServiceWorkerVersion* version) {
 }
 
 void ServiceWorkerRegistration::OnNoWork(ServiceWorkerVersion* version) {
-  if (!context_)
-    return;
-  DCHECK_EQ(active_version(), version);
-  if (IsReadyToActivate())
+  DCHECK(context_);
+
+  if (version == active_version() && IsReadyToActivate())
     ActivateWaitingVersion(true /* delay */);
 }
 
@@ -706,7 +698,6 @@ void ServiceWorkerRegistration::Clear() {
   }
   if (active_version_.get()) {
     versions_to_doom.push_back(active_version_);
-    active_version_->RemoveObserver(this);
     active_version_ = nullptr;
     mask->active = true;
   }
diff --git a/chromium/content/browser/service_worker/service_worker_registration.h b/chromium/content/browser/service_worker/service_worker_registration.h
index 89a6d563296..6a504b87657 100644
--- a/chromium/content/browser/service_worker/service_worker_registration.h
+++ b/chromium/content/browser/service_worker/service_worker_registration.h
@@ -32,8 +32,7 @@ struct ServiceWorkerRegistrationInfo;
 // to this class. This is refcounted via ServiceWorkerRegistrationObjectHost to
 // facilitate multiple controllees being associated with the same registration.
 class CONTENT_EXPORT ServiceWorkerRegistration
-    : public base::RefCounted<ServiceWorkerRegistration>,
-      public ServiceWorkerVersion::Observer {
+    : public base::RefCounted<ServiceWorkerRegistration> {
  public:
   using StatusCallback =
       base::OnceCallback<void(blink::ServiceWorkerStatusCode status)>;
@@ -42,8 +41,7 @@ class CONTENT_EXPORT ServiceWorkerRegistration
    public:
     virtual void OnVersionAttributesChanged(
         ServiceWorkerRegistration* registration,
-        blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-        const ServiceWorkerRegistrationInfo& info) {}
+        blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) {}
     virtual void OnUpdateViaCacheChanged(
         ServiceWorkerRegistration* registation) {}
     virtual void OnRegistrationFailed(
@@ -52,8 +50,7 @@ class CONTENT_EXPORT ServiceWorkerRegistration
         ServiceWorkerRegistration* registration) {}
     virtual void OnRegistrationDeleted(
         ServiceWorkerRegistration* registration) {}
-    virtual void OnUpdateFound(
-        ServiceWorkerRegistration* registration) {}
+    virtual void OnUpdateFound(ServiceWorkerRegistration* registration) {}
     virtual void OnSkippedWaiting(ServiceWorkerRegistration* registation) {}
   };
 
@@ -207,8 +204,14 @@ class CONTENT_EXPORT ServiceWorkerRegistration
   void EnableNavigationPreload(bool enable);
   void SetNavigationPreloadHeader(const std::string& value);
 
+  // Called when all controllees are removed from |version|.
+  void OnNoControllees(ServiceWorkerVersion* version);
+
+  // Called when there is no work in |version|.
+  void OnNoWork(ServiceWorkerVersion* version);
+
  protected:
-  ~ServiceWorkerRegistration() override;
+  virtual ~ServiceWorkerRegistration();
 
  private:
   friend class base::RefCounted<ServiceWorkerRegistration>;
@@ -218,10 +221,6 @@ class CONTENT_EXPORT ServiceWorkerRegistration
       ServiceWorkerVersion* version,
       blink::mojom::ChangedServiceWorkerObjectsMask* mask);
 
-  // ServiceWorkerVersion::Observer override.
-  void OnNoControllees(ServiceWorkerVersion* version) override;
-  void OnNoWork(ServiceWorkerVersion* version) override;
-
   bool IsReadyToActivate() const;
   bool IsLameDuckActiveVersion() const;
   void StartLameDuckTimer();
diff --git a/chromium/content/browser/service_worker/service_worker_registration_object_host.cc b/chromium/content/browser/service_worker/service_worker_registration_object_host.cc
index 2b84b8b5d22..0d61c5f7dcf 100644
--- a/chromium/content/browser/service_worker/service_worker_registration_object_host.cc
+++ b/chromium/content/browser/service_worker/service_worker_registration_object_host.cc
@@ -125,8 +125,7 @@ ServiceWorkerRegistrationObjectHost::CreateObjectInfo() {
 
 void ServiceWorkerRegistrationObjectHost::OnVersionAttributesChanged(
     ServiceWorkerRegistration* registration,
-    blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-    const ServiceWorkerRegistrationInfo& info) {
+    blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) {
   DCHECK_EQ(registration->id(), registration_->id());
   SetServiceWorkerObjects(
       std::move(changed_mask), registration->installing_version(),
@@ -202,7 +201,7 @@ void ServiceWorkerRegistrationObjectHost::Update(
   }
 
   DelayUpdate(
-      container_host_->type(), registration, version,
+      container_host_->IsContainerForClient(), registration, version,
       base::BindOnce(
           &ExecuteUpdate, context_, registration->id(),
           false /* force_bypass_cache */, false /* skip_script_comparison */,
@@ -212,15 +211,13 @@ void ServiceWorkerRegistrationObjectHost::Update(
 }
 
 void ServiceWorkerRegistrationObjectHost::DelayUpdate(
-    blink::mojom::ServiceWorkerContainerType container_type,
+    bool is_container_for_client,
     ServiceWorkerRegistration* registration,
     ServiceWorkerVersion* version,
     StatusCallback update_function) {
   DCHECK(registration);
 
-  if (container_type !=
-          blink::mojom::ServiceWorkerContainerType::kForServiceWorker ||
-      (version && version->HasControllee())) {
+  if (is_container_for_client || (version && version->HasControllee())) {
     // Don't delay update() if called by non-workers or by workers with
     // controllees.
     std::move(update_function).Run(blink::ServiceWorkerStatusCode::kOk);
diff --git a/chromium/content/browser/service_worker/service_worker_registration_object_host.h b/chromium/content/browser/service_worker/service_worker_registration_object_host.h
index 8495cb3ede6..a6b77bfcf10 100644
--- a/chromium/content/browser/service_worker/service_worker_registration_object_host.h
+++ b/chromium/content/browser/service_worker/service_worker_registration_object_host.h
@@ -52,8 +52,7 @@ class CONTENT_EXPORT ServiceWorkerRegistrationObjectHost
   // ServiceWorkerRegistration::Listener overrides.
   void OnVersionAttributesChanged(
       ServiceWorkerRegistration* registration,
-      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-      const ServiceWorkerRegistrationInfo& info) override;
+      blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask) override;
   void OnUpdateViaCacheChanged(
       ServiceWorkerRegistration* registration) override;
   void OnRegistrationFailed(ServiceWorkerRegistration* registration) override;
@@ -83,11 +82,10 @@ class CONTENT_EXPORT ServiceWorkerRegistrationObjectHost
   //
   // TODO(falken): See if tests can call |Update| directly, then this separate
   // function isn't needed.
-  static void DelayUpdate(
-      blink::mojom::ServiceWorkerContainerType container_type,
-      ServiceWorkerRegistration* registration,
-      ServiceWorkerVersion* version,
-      StatusCallback update_function);
+  static void DelayUpdate(bool is_container_for_client,
+                          ServiceWorkerRegistration* registration,
+                          ServiceWorkerVersion* version,
+                          StatusCallback update_function);
   // Called back from ServiceWorkerContextCore when an update is complete.
   void UpdateComplete(UpdateCallback callback,
                       blink::ServiceWorkerStatusCode status,
diff --git a/chromium/content/browser/service_worker/service_worker_registration_status.cc b/chromium/content/browser/service_worker/service_worker_registration_status.cc
index 6d154ff4c48..2f8d3bb5b59 100644
--- a/chromium/content/browser/service_worker/service_worker_registration_status.cc
+++ b/chromium/content/browser/service_worker/service_worker_registration_status.cc
@@ -6,7 +6,7 @@
 
 #include <string>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/strings/utf_string_conversions.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_error_type.mojom.h"
 
@@ -34,6 +34,7 @@ void GetServiceWorkerErrorTypeForRegistration(
     case blink::ServiceWorkerStatusCode::kErrorProcessNotFound:
     case blink::ServiceWorkerStatusCode::kErrorRedundant:
     case blink::ServiceWorkerStatusCode::kErrorDisallowed:
+    case blink::ServiceWorkerStatusCode::kErrorDiskCache:
       *out_error = blink::mojom::ServiceWorkerErrorType::kInstall;
       return;
 
@@ -67,7 +68,6 @@ void GetServiceWorkerErrorTypeForRegistration(
     case blink::ServiceWorkerStatusCode::kErrorExists:
     case blink::ServiceWorkerStatusCode::kErrorEventWaitUntilRejected:
     case blink::ServiceWorkerStatusCode::kErrorState:
-    case blink::ServiceWorkerStatusCode::kErrorDiskCache:
     case blink::ServiceWorkerStatusCode::kErrorInvalidArguments:
       // Unexpected, or should have bailed out before calling this, or we don't
       // have a corresponding blink error code yet.
diff --git a/chromium/content/browser/service_worker/service_worker_registration_unittest.cc b/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
index 97e816390ae..ea7b997d4ae 100644
--- a/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
@@ -10,10 +10,11 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
+#include "base/check.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
@@ -77,24 +78,22 @@ void SaveStatusCallback(bool* called,
 
 class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
  public:
-  bool AllowServiceWorkerOnIO(
+  AllowServiceWorkerResult AllowServiceWorkerOnIO(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::ResourceContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
-    return false;
+      content::ResourceContext* context) override {
+    return AllowServiceWorkerResult::No();
   }
 
-  bool AllowServiceWorkerOnUI(
+  AllowServiceWorkerResult AllowServiceWorkerOnUI(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      content::BrowserContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter) override {
-    return false;
+      content::BrowserContext* context) override {
+    return AllowServiceWorkerResult::No();
   }
 };
 
@@ -205,11 +204,10 @@ class ServiceWorkerRegistrationTest : public testing::Test {
 
     void OnVersionAttributesChanged(
         ServiceWorkerRegistration* registration,
-        blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask,
-        const ServiceWorkerRegistrationInfo& info) override {
+        blink::mojom::ChangedServiceWorkerObjectsMaskPtr changed_mask)
+        override {
       observed_registration_ = registration;
       observed_changed_mask_ = std::move(changed_mask);
-      observed_info_ = info;
     }
 
     void OnRegistrationFailed(
@@ -224,12 +222,10 @@ class ServiceWorkerRegistrationTest : public testing::Test {
     void Reset() {
       observed_registration_ = nullptr;
       observed_changed_mask_ = nullptr;
-      observed_info_ = ServiceWorkerRegistrationInfo();
     }
 
     scoped_refptr<ServiceWorkerRegistration> observed_registration_;
     blink::mojom::ChangedServiceWorkerObjectsMaskPtr observed_changed_mask_;
-    ServiceWorkerRegistrationInfo observed_info_;
   };
 
  protected:
@@ -267,24 +263,25 @@ TEST_F(ServiceWorkerRegistrationTest, SetAndUnsetVersions) {
   EXPECT_EQ(version_1.get(), registration->active_version());
   EXPECT_EQ(registration, listener.observed_registration_);
   EXPECT_TRUE(listener.observed_changed_mask_->active);
-  EXPECT_EQ(kScope, listener.observed_info_.scope);
-  EXPECT_EQ(version_1_id, listener.observed_info_.active_version.version_id);
-  EXPECT_EQ(kScript, listener.observed_info_.active_version.script_url);
-  EXPECT_EQ(listener.observed_info_.installing_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
-  EXPECT_EQ(listener.observed_info_.waiting_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
+  EXPECT_EQ(kScope, listener.observed_registration_->scope());
+  EXPECT_EQ(version_1_id,
+            listener.observed_registration_->active_version()->version_id());
+  EXPECT_EQ(kScript,
+            listener.observed_registration_->active_version()->script_url());
+  EXPECT_FALSE(listener.observed_registration_->installing_version());
+  EXPECT_FALSE(listener.observed_registration_->waiting_version());
   listener.Reset();
 
   registration->SetInstallingVersion(version_2);
 
   EXPECT_EQ(version_2.get(), registration->installing_version());
   EXPECT_TRUE(listener.observed_changed_mask_->installing);
-  EXPECT_EQ(version_1_id, listener.observed_info_.active_version.version_id);
-  EXPECT_EQ(version_2_id,
-            listener.observed_info_.installing_version.version_id);
-  EXPECT_EQ(listener.observed_info_.waiting_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
+  EXPECT_EQ(version_1_id,
+            listener.observed_registration_->active_version()->version_id());
+  EXPECT_EQ(
+      version_2_id,
+      listener.observed_registration_->installing_version()->version_id());
+  EXPECT_FALSE(listener.observed_registration_->waiting_version());
   listener.Reset();
 
   registration->SetWaitingVersion(version_2);
@@ -293,21 +290,21 @@ TEST_F(ServiceWorkerRegistrationTest, SetAndUnsetVersions) {
   EXPECT_FALSE(registration->installing_version());
   EXPECT_TRUE(listener.observed_changed_mask_->waiting);
   EXPECT_TRUE(listener.observed_changed_mask_->installing);
-  EXPECT_EQ(version_1_id, listener.observed_info_.active_version.version_id);
-  EXPECT_EQ(version_2_id, listener.observed_info_.waiting_version.version_id);
-  EXPECT_EQ(listener.observed_info_.installing_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
+  EXPECT_EQ(version_1_id,
+            listener.observed_registration_->active_version()->version_id());
+  EXPECT_EQ(version_2_id,
+            listener.observed_registration_->waiting_version()->version_id());
+  EXPECT_FALSE(listener.observed_registration_->installing_version());
   listener.Reset();
 
   registration->UnsetVersion(version_2.get());
 
   EXPECT_FALSE(registration->waiting_version());
   EXPECT_TRUE(listener.observed_changed_mask_->waiting);
-  EXPECT_EQ(version_1_id, listener.observed_info_.active_version.version_id);
-  EXPECT_EQ(listener.observed_info_.waiting_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
-  EXPECT_EQ(listener.observed_info_.installing_version.version_id,
-            blink::mojom::kInvalidServiceWorkerVersionId);
+  EXPECT_EQ(version_1_id,
+            listener.observed_registration_->active_version()->version_id());
+  EXPECT_FALSE(listener.observed_registration_->waiting_version());
+  EXPECT_FALSE(listener.observed_registration_->installing_version());
 }
 
 TEST_F(ServiceWorkerRegistrationTest, FailedRegistrationNoCrash) {
@@ -485,7 +482,6 @@ class ServiceWorkerActivationTest : public ServiceWorkerRegistrationTest,
   }
 
   void TearDown() override {
-    registration_->active_version()->RemoveObserver(registration_.get());
     ServiceWorkerRegistrationTest::TearDown();
   }
 
@@ -832,9 +828,11 @@ class ServiceWorkerRegistrationObjectHostTest
       ServiceWorkerVersion* version) {
     base::Optional<blink::ServiceWorkerStatusCode> status;
     base::RunLoop run_loop;
+    const bool is_container_for_client =
+        provider_type !=
+        blink::mojom::ServiceWorkerContainerType::kForServiceWorker;
     ServiceWorkerRegistrationObjectHost::DelayUpdate(
-        blink::mojom::ServiceWorkerContainerType::kForServiceWorker,
-        registration, version,
+        is_container_for_client, registration, version,
         base::BindOnce(
             [](base::Optional<blink::ServiceWorkerStatusCode>* out_status,
                base::OnceClosure callback,
diff --git a/chromium/content/browser/service_worker/service_worker_registry.cc b/chromium/content/browser/service_worker/service_worker_registry.cc
index 892633ffc5e..363274a46d6 100644
--- a/chromium/content/browser/service_worker/service_worker_registry.cc
+++ b/chromium/content/browser/service_worker/service_worker_registry.cc
@@ -589,6 +589,10 @@ void ServiceWorkerRegistry::StoreUserData(
                            blink::ServiceWorkerStatusCode::kErrorFailed));
     return;
   }
+  std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data;
+  // TODO(crbug.com/1055677): Change this method to take a vector of
+  // storage::mojom::ServiceWorkerUserDataPtr instead of converting
+  //|key_value_pairs|.
   for (const auto& kv : key_value_pairs) {
     if (kv.first.empty()) {
       RunSoon(FROM_HERE,
@@ -596,10 +600,12 @@ void ServiceWorkerRegistry::StoreUserData(
                              blink::ServiceWorkerStatusCode::kErrorFailed));
       return;
     }
+    user_data.push_back(
+        storage::mojom::ServiceWorkerUserData::New(kv.first, kv.second));
   }
 
   storage()->StoreUserData(
-      registration_id, origin, key_value_pairs,
+      registration_id, origin, std::move(user_data),
       base::BindOnce(&ServiceWorkerRegistry::DidStoreUserData,
                      weak_factory_.GetWeakPtr(), std::move(callback)));
 }
diff --git a/chromium/content/browser/service_worker/service_worker_request_handler.cc b/chromium/content/browser/service_worker/service_worker_request_handler.cc
deleted file mode 100644
index 01d4f023c2a..00000000000
--- a/chromium/content/browser/service_worker/service_worker_request_handler.cc
+++ /dev/null
@@ -1,92 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/service_worker/service_worker_request_handler.h"
-
-#include <utility>
-
-#include "base/macros.h"
-#include "content/browser/frame_host/navigation_request_info.h"
-#include "content/browser/service_worker/service_worker_main_resource_handle.h"
-#include "content/browser/service_worker/service_worker_navigation_loader_interceptor.h"
-#include "content/browser/service_worker/service_worker_provider_host.h"
-#include "content/public/common/origin_util.h"
-#include "content/public/common/url_constants.h"
-#include "net/base/url_util.h"
-#include "services/network/public/cpp/resource_request.h"
-#include "url/gurl.h"
-
-namespace content {
-
-namespace {
-
-bool SchemeMaySupportRedirectingToHTTPS(const GURL& url) {
-#if defined(OS_CHROMEOS)
-  return url.SchemeIs(kExternalFileScheme);
-#else   // OS_CHROMEOS
-  return false;
-#endif  // OS_CHROMEOS
-}
-
-}  // namespace
-
-// static
-std::unique_ptr<NavigationLoaderInterceptor>
-ServiceWorkerRequestHandler::CreateForNavigation(
-    const GURL& url,
-    base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle,
-    const NavigationRequestInfo& request_info) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  // Create the handler even for insecure HTTP since it's used in the
-  // case of redirect to HTTPS.
-  if (!url.SchemeIsHTTPOrHTTPS() && !OriginCanAccessServiceWorkers(url) &&
-      !SchemeMaySupportRedirectingToHTTPS(url)) {
-    return nullptr;
-  }
-
-  ServiceWorkerNavigationLoaderInterceptorParams params;
-  params.resource_type = request_info.is_main_frame
-                             ? blink::mojom::ResourceType::kMainFrame
-                             : blink::mojom::ResourceType::kSubFrame;
-  params.skip_service_worker = request_info.begin_params->skip_service_worker;
-  params.is_main_frame = request_info.is_main_frame;
-  params.are_ancestors_secure = request_info.are_ancestors_secure;
-  params.frame_tree_node_id = request_info.frame_tree_node_id;
-
-  return std::make_unique<ServiceWorkerNavigationLoaderInterceptor>(
-      params, std::move(navigation_handle));
-}
-
-// static
-std::unique_ptr<NavigationLoaderInterceptor>
-ServiceWorkerRequestHandler::CreateForWorker(
-    const network::ResourceRequest& resource_request,
-    int process_id,
-    base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  auto resource_type =
-      static_cast<blink::mojom::ResourceType>(resource_request.resource_type);
-  DCHECK(resource_type == blink::mojom::ResourceType::kWorker ||
-         resource_type == blink::mojom::ResourceType::kSharedWorker)
-      << resource_request.resource_type;
-
-  // Create the handler even for insecure HTTP since it's used in the
-  // case of redirect to HTTPS.
-  if (!resource_request.url.SchemeIsHTTPOrHTTPS() &&
-      !OriginCanAccessServiceWorkers(resource_request.url)) {
-    return nullptr;
-  }
-
-  ServiceWorkerNavigationLoaderInterceptorParams params;
-  params.resource_type = resource_type;
-  params.skip_service_worker = resource_request.skip_service_worker;
-  params.process_id = process_id;
-
-  return std::make_unique<ServiceWorkerNavigationLoaderInterceptor>(
-      params, std::move(navigation_handle));
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_request_handler.h b/chromium/content/browser/service_worker/service_worker_request_handler.h
deleted file mode 100644
index 9bc1d215909..00000000000
--- a/chromium/content/browser/service_worker/service_worker_request_handler.h
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_REQUEST_HANDLER_H_
-#define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_REQUEST_HANDLER_H_
-
-#include <memory>
-
-#include "base/memory/weak_ptr.h"
-#include "content/browser/loader/navigation_loader_interceptor.h"
-#include "content/common/content_export.h"
-
-class GURL;
-
-namespace network {
-struct ResourceRequest;
-}  // namespace network
-
-namespace content {
-
-class ServiceWorkerMainResourceHandle;
-struct NavigationRequestInfo;
-
-// Contains factory methods for creating the NavigationLoaderInterceptors for
-// routing requests to service workers.
-// TODO(falken): This is just a collection of static functions. Move these to
-// non-member functions?
-class CONTENT_EXPORT ServiceWorkerRequestHandler {
- public:
-  // Returns a loader interceptor for a navigation. May return nullptr if the
-  // navigation cannot use service workers. Called on the UI thread.
-  static std::unique_ptr<NavigationLoaderInterceptor> CreateForNavigation(
-      const GURL& url,
-      base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle,
-      const NavigationRequestInfo& request_info);
-
-  // Returns a loader interceptor for a dedicated worker or shared worker. May
-  // return nullptr if the worker cannot use service workers. Called on the UI
-  // thread.
-  static std::unique_ptr<NavigationLoaderInterceptor> CreateForWorker(
-      const network::ResourceRequest& resource_request,
-      int process_id,
-      base::WeakPtr<ServiceWorkerMainResourceHandle> navigation_handle);
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerRequestHandler);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_REQUEST_HANDLER_H_
diff --git a/chromium/content/browser/service_worker/service_worker_request_handler_unittest.cc b/chromium/content/browser/service_worker/service_worker_request_handler_unittest.cc
deleted file mode 100644
index ec0ef0a6fc9..00000000000
--- a/chromium/content/browser/service_worker/service_worker_request_handler_unittest.cc
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/service_worker/service_worker_request_handler.h"
-
-#include <string>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/run_loop.h"
-#include "base/task/post_task.h"
-#include "content/browser/frame_host/navigation_request_info.h"
-#include "content/browser/service_worker/embedded_worker_test_helper.h"
-#include "content/browser/service_worker/service_worker_context_core.h"
-#include "content/browser/service_worker/service_worker_context_wrapper.h"
-#include "content/browser/service_worker/service_worker_main_resource_handle.h"
-#include "content/browser/service_worker/service_worker_provider_host.h"
-#include "content/browser/service_worker/service_worker_test_utils.h"
-#include "content/common/navigation_params.mojom.h"
-#include "content/common/service_worker/service_worker_utils.h"
-#include "content/public/browser/browser_task_traits.h"
-#include "content/public/test/browser_task_environment.h"
-#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "net/url_request/redirect_info.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_job.h"
-#include "net/url_request/url_request_test_util.h"
-#include "storage/browser/blob/blob_storage_context.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/common/service_worker/service_worker_utils.h"
-#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
-
-namespace content {
-namespace service_worker_request_handler_unittest {
-
-class ServiceWorkerRequestHandlerTest : public testing::Test {
- public:
-  ServiceWorkerRequestHandlerTest()
-      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {}
-
-  void SetUp() override {
-    helper_.reset(new EmbeddedWorkerTestHelper(base::FilePath()));
-  }
-
-  void TearDown() override { helper_.reset(); }
-
-  ServiceWorkerContextCore* context() const { return helper_->context(); }
-  ServiceWorkerContextWrapper* context_wrapper() const {
-    return helper_->context_wrapper();
-  }
-
- protected:
-  void InitializeHandlerForNavigationSimpleTest(const std::string& url,
-                                                bool expected_handler_created) {
-    auto navigation_handle =
-        std::make_unique<ServiceWorkerMainResourceHandle>(context_wrapper());
-    GURL gurl(url);
-    auto begin_params = mojom::BeginNavigationParams::New();
-    begin_params->request_context_type =
-        blink::mojom::RequestContextType::HYPERLINK;
-    url::Origin origin = url::Origin::Create(gurl);
-    NavigationRequestInfo request_info(
-        CreateCommonNavigationParams(), std::move(begin_params),
-        net::SiteForCookies::FromUrl(gurl),
-        net::NetworkIsolationKey(origin, origin), true /* is_main_frame */,
-        false /* parent_is_main_frame */, true /* are_ancestors_secure */,
-        -1 /* frame_tree_node_id */, false /* is_for_guests_only */,
-        false /* report_raw_headers */, false /* is_prerendering */,
-        false /* upgrade_if_insecure */, nullptr /* blob_url_loader_factory */,
-        base::UnguessableToken::Create() /* devtools_navigation_token */,
-        base::UnguessableToken::Create() /* devtools_frame_token */,
-        false /* obey_origin_policy */);
-    std::unique_ptr<NavigationLoaderInterceptor> interceptor =
-        ServiceWorkerRequestHandler::CreateForNavigation(
-            gurl, navigation_handle->AsWeakPtr(), request_info);
-    EXPECT_EQ(expected_handler_created, !!interceptor.get());
-  }
-
-  BrowserTaskEnvironment task_environment_;
-  std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
-  base::WeakPtr<ServiceWorkerProviderHost> provider_host_;
-  net::URLRequestContext url_request_context_;
-  net::TestDelegate url_request_delegate_;
-  storage::BlobStorageContext blob_storage_context_;
-  ServiceWorkerRemoteProviderEndpoint remote_endpoint_;
-};
-
-TEST_F(ServiceWorkerRequestHandlerTest, InitializeForNavigation_HTTP) {
-  InitializeHandlerForNavigationSimpleTest("http://host/scope/doc", true);
-}
-
-TEST_F(ServiceWorkerRequestHandlerTest, InitializeForNavigation_HTTPS) {
-  InitializeHandlerForNavigationSimpleTest("https://host/scope/doc", true);
-}
-
-TEST_F(ServiceWorkerRequestHandlerTest, InitializeForNavigation_FTP) {
-  InitializeHandlerForNavigationSimpleTest("ftp://host/scope/doc", false);
-}
-
-TEST_F(ServiceWorkerRequestHandlerTest,
-       InitializeForNavigation_ExternalFileScheme) {
-  bool expected_handler_created = false;
-#if defined(OS_CHROMEOS)
-  expected_handler_created = true;
-#endif  // OS_CHROMEOS
-  InitializeHandlerForNavigationSimpleTest("externalfile:drive/doc",
-                                           expected_handler_created);
-}
-
-}  // namespace service_worker_request_handler_unittest
-}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_resource_ops.cc b/chromium/content/browser/service_worker/service_worker_resource_ops.cc
new file mode 100644
index 00000000000..c8bcb5b30c1
--- /dev/null
+++ b/chromium/content/browser/service_worker/service_worker_resource_ops.cc
@@ -0,0 +1,282 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/service_worker/service_worker_resource_ops.h"
+
+#include "content/browser/service_worker/service_worker_loader_helpers.h"
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "services/network/public/cpp/net_adapters.h"
+#include "third_party/blink/public/common/blob/blob_utils.h"
+
+namespace content {
+
+namespace {
+
+// TODO(bashi): Don't duplicate. This is the same as the BigIObuffer defined in
+// //content/browser/code_cache/generated_code_cache.cc
+class BigIOBuffer : public net::IOBufferWithSize {
+ public:
+  explicit BigIOBuffer(mojo_base::BigBuffer buffer);
+
+  BigIOBuffer(const BigIOBuffer&) = delete;
+  BigIOBuffer& operator=(const BigIOBuffer&) = delete;
+
+ protected:
+  ~BigIOBuffer() override;
+
+ private:
+  mojo_base::BigBuffer buffer_;
+};
+
+BigIOBuffer::BigIOBuffer(mojo_base::BigBuffer buffer)
+    : net::IOBufferWithSize(nullptr, buffer.size()),
+      buffer_(std::move(buffer)) {
+  data_ = reinterpret_cast<char*>(buffer_.data());
+}
+
+BigIOBuffer::~BigIOBuffer() {
+  data_ = nullptr;
+  size_ = 0UL;
+}
+
+void DidReadInfo(
+    scoped_refptr<HttpResponseInfoIOBuffer> buffer,
+    ServiceWorkerResourceReaderImpl::ReadResponseHeadCallback callback,
+    int status) {
+  DCHECK(buffer);
+  const net::HttpResponseInfo* http_info = buffer->http_info.get();
+  if (!http_info) {
+    DCHECK_LT(status, 0);
+    std::move(callback).Run(status, /*response_head=*/nullptr,
+                            /*metadata=*/base::nullopt);
+    return;
+  }
+
+  // URLResponseHead fields filled here are the same as
+  // ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(). Once
+  // https://crbug.com/1060076 is done CreateResourceResponseHeadAndMetadata()
+  // will be removed, but we still need HttpResponseInfo -> URLResponseHead
+  // conversion to restore a response from the storage.
+  // TODO(bashi): Remove the above comment ater the issue is closed.
+  auto head = network::mojom::URLResponseHead::New();
+  head->request_time = http_info->request_time;
+  head->response_time = http_info->response_time;
+  head->headers = http_info->headers;
+  head->headers->GetMimeType(&head->mime_type);
+  head->headers->GetCharset(&head->charset);
+  head->content_length = buffer->response_data_size;
+  head->was_fetched_via_spdy = http_info->was_fetched_via_spdy;
+  head->was_alpn_negotiated = http_info->was_alpn_negotiated;
+  head->connection_info = http_info->connection_info;
+  head->alpn_negotiated_protocol = http_info->alpn_negotiated_protocol;
+  head->remote_endpoint = http_info->remote_endpoint;
+  head->cert_status = http_info->ssl_info.cert_status;
+  head->ssl_info = http_info->ssl_info;
+
+  base::Optional<mojo_base::BigBuffer> metadata;
+  if (http_info->metadata) {
+    metadata = mojo_base::BigBuffer(base::as_bytes(base::make_span(
+        http_info->metadata->data(), http_info->metadata->size())));
+  }
+
+  std::move(callback).Run(status, std::move(head), std::move(metadata));
+}
+
+}  // namespace
+
+class ServiceWorkerResourceReaderImpl::DataReader {
+ public:
+  DataReader(base::WeakPtr<ServiceWorkerResourceReaderImpl> owner,
+             size_t total_bytes_to_read,
+             mojo::ScopedDataPipeProducerHandle producer_handle)
+      : owner_(std::move(owner)),
+        total_bytes_to_read_(total_bytes_to_read),
+        producer_handle_(std::move(producer_handle)),
+        watcher_(FROM_HERE,
+                 mojo::SimpleWatcher::ArmingPolicy::MANUAL,
+                 base::SequencedTaskRunnerHandle::Get()) {
+    watcher_.Watch(producer_handle_.get(), MOJO_HANDLE_SIGNAL_WRITABLE,
+                   base::BindRepeating(&DataReader::OnWritable,
+                                       weak_factory_.GetWeakPtr()));
+    watcher_.ArmOrNotify();
+  }
+  ~DataReader() = default;
+
+  DataReader(const DataReader&) = delete;
+  DataReader operator=(const DataReader&) = delete;
+
+ private:
+  void OnWritable(MojoResult) {
+    DCHECK(producer_handle_.is_valid());
+    DCHECK(!pending_buffer_);
+
+    if (!owner_) {
+      Complete(net::ERR_ABORTED);
+      return;
+    }
+
+    uint32_t num_bytes = 0;
+    MojoResult rv = network::NetToMojoPendingBuffer::BeginWrite(
+        &producer_handle_, &pending_buffer_, &num_bytes);
+    switch (rv) {
+      case MOJO_RESULT_INVALID_ARGUMENT:
+      case MOJO_RESULT_BUSY:
+        NOTREACHED();
+        return;
+      case MOJO_RESULT_FAILED_PRECONDITION:
+        Complete(net::ERR_ABORTED);
+        return;
+      case MOJO_RESULT_SHOULD_WAIT:
+        watcher_.ArmOrNotify();
+        return;
+      case MOJO_RESULT_OK:
+        // |producer__handle_| must have been taken by |pending_buffer_|.
+        DCHECK(pending_buffer_);
+        DCHECK(!producer_handle_.is_valid());
+        break;
+    }
+
+    num_bytes = std::min(num_bytes, blink::BlobUtils::GetDataPipeChunkSize());
+    auto buffer =
+        base::MakeRefCounted<network::NetToMojoIOBuffer>(pending_buffer_.get());
+    owner_->reader_->ReadData(
+        buffer.get(), num_bytes,
+        base::BindOnce(&DataReader::DidReadData, weak_factory_.GetWeakPtr()));
+  }
+
+  void DidReadData(int read_bytes) {
+    if (read_bytes < 0) {
+      Complete(read_bytes);
+      return;
+    }
+
+    producer_handle_ = pending_buffer_->Complete(read_bytes);
+    DCHECK(producer_handle_.is_valid());
+    pending_buffer_.reset();
+    current_bytes_read_ += read_bytes;
+
+    if (read_bytes == 0 || current_bytes_read_ == total_bytes_to_read_) {
+      // All data has been read.
+      Complete(current_bytes_read_);
+      return;
+    }
+    watcher_.ArmOrNotify();
+  }
+
+  void Complete(int status) {
+    watcher_.Cancel();
+    producer_handle_.reset();
+    if (owner_) {
+      owner_->DidReadDataComplete();
+    }
+  }
+
+  base::WeakPtr<ServiceWorkerResourceReaderImpl> owner_;
+  const size_t total_bytes_to_read_;
+  size_t current_bytes_read_ = 0;
+  mojo::ScopedDataPipeProducerHandle producer_handle_;
+  mojo::SimpleWatcher watcher_;
+  scoped_refptr<network::NetToMojoPendingBuffer> pending_buffer_;
+
+  base::WeakPtrFactory<DataReader> weak_factory_{this};
+};
+
+ServiceWorkerResourceReaderImpl::ServiceWorkerResourceReaderImpl(
+    std::unique_ptr<ServiceWorkerResponseReader> reader)
+    : reader_(std::move(reader)) {
+  DCHECK(reader_);
+}
+
+ServiceWorkerResourceReaderImpl::~ServiceWorkerResourceReaderImpl() = default;
+
+void ServiceWorkerResourceReaderImpl::ReadResponseHead(
+    ReadResponseHeadCallback callback) {
+  auto buffer = base::MakeRefCounted<HttpResponseInfoIOBuffer>();
+  HttpResponseInfoIOBuffer* raw_buffer = buffer.get();
+  reader_->ReadInfo(raw_buffer, base::BindOnce(&DidReadInfo, std::move(buffer),
+                                               std::move(callback)));
+}
+
+void ServiceWorkerResourceReaderImpl::ReadData(int64_t size,
+                                               ReadDataCallback callback) {
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  options.capacity_num_bytes = blink::BlobUtils::GetDataPipeCapacity(size);
+
+  mojo::ScopedDataPipeConsumerHandle consumer_handle;
+  mojo::ScopedDataPipeProducerHandle producer_handle;
+  MojoResult rv =
+      mojo::CreateDataPipe(&options, &producer_handle, &consumer_handle);
+  if (rv != MOJO_RESULT_OK) {
+    std::move(callback).Run(mojo::ScopedDataPipeConsumerHandle());
+    return;
+  }
+
+  data_reader_ = std::make_unique<DataReader>(weak_factory_.GetWeakPtr(), size,
+                                              std::move(producer_handle));
+  std::move(callback).Run(std::move(consumer_handle));
+}
+
+void ServiceWorkerResourceReaderImpl::DidReadDataComplete() {
+  DCHECK(data_reader_);
+  data_reader_.reset();
+}
+
+ServiceWorkerResourceWriterImpl::ServiceWorkerResourceWriterImpl(
+    std::unique_ptr<ServiceWorkerResponseWriter> writer)
+    : writer_(std::move(writer)) {
+  DCHECK(writer_);
+}
+
+ServiceWorkerResourceWriterImpl::~ServiceWorkerResourceWriterImpl() = default;
+
+void ServiceWorkerResourceWriterImpl::WriteResponseHead(
+    network::mojom::URLResponseHeadPtr response_head,
+    WriteResponseHeadCallback callback) {
+  blink::ServiceWorkerStatusCode service_worker_status;
+  network::URLLoaderCompletionStatus completion_status;
+  std::string error_message;
+  std::unique_ptr<net::HttpResponseInfo> response_info =
+      service_worker_loader_helpers::CreateHttpResponseInfoAndCheckHeaders(
+          *response_head, &service_worker_status, &completion_status,
+          &error_message);
+  if (!response_info) {
+    DCHECK_NE(net::OK, completion_status.error_code);
+    std::move(callback).Run(completion_status.error_code);
+    return;
+  }
+
+  auto info_buffer =
+      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(response_info));
+  writer_->WriteInfo(info_buffer.get(), std::move(callback));
+}
+
+void ServiceWorkerResourceWriterImpl::WriteData(mojo_base::BigBuffer data,
+                                                WriteDataCallback callback) {
+  int buf_len = data.size();
+  auto buffer = base::MakeRefCounted<BigIOBuffer>(std::move(data));
+  writer_->WriteData(buffer.get(), buf_len, std::move(callback));
+}
+
+ServiceWorkerResourceMetadataWriterImpl::
+    ServiceWorkerResourceMetadataWriterImpl(
+        std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer)
+    : writer_(std::move(writer)) {
+  DCHECK(writer_);
+}
+
+ServiceWorkerResourceMetadataWriterImpl::
+    ~ServiceWorkerResourceMetadataWriterImpl() = default;
+
+void ServiceWorkerResourceMetadataWriterImpl::WriteMetadata(
+    mojo_base::BigBuffer data,
+    WriteMetadataCallback callback) {
+  int buf_len = data.size();
+  auto buffer = base::MakeRefCounted<BigIOBuffer>(std::move(data));
+  writer_->WriteMetadata(buffer.get(), buf_len, std::move(callback));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_resource_ops.h b/chromium/content/browser/service_worker/service_worker_resource_ops.h
new file mode 100644
index 00000000000..3a45fa8bf10
--- /dev/null
+++ b/chromium/content/browser/service_worker/service_worker_resource_ops.h
@@ -0,0 +1,103 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_OPS_H_
+#define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_OPS_H_
+
+#include "base/memory/weak_ptr.h"
+#include "components/services/storage/public/mojom/service_worker_storage_control.mojom.h"
+#include "content/browser/service_worker/service_worker_disk_cache.h"
+
+namespace content {
+
+// The implementation of storage::mojom::ServiceWorkerResourceReader.
+// Currently this class is an adaptor that uses ServiceWorkerResponseReader
+// internally.
+// TODO(crbug.com/1055677): Fork the implementation of
+// ServiceWorkerResponseReader and stop using it.
+class ServiceWorkerResourceReaderImpl
+    : public storage::mojom::ServiceWorkerResourceReader {
+ public:
+  explicit ServiceWorkerResourceReaderImpl(
+      std::unique_ptr<ServiceWorkerResponseReader> reader);
+
+  ServiceWorkerResourceReaderImpl(const ServiceWorkerResourceReaderImpl&) =
+      delete;
+  ServiceWorkerResourceReaderImpl& operator=(
+      const ServiceWorkerResourceReaderImpl&) = delete;
+
+  ~ServiceWorkerResourceReaderImpl() override;
+
+ private:
+  // storage::mojom::ServiceWorkerResourceReader implementations:
+  void ReadResponseHead(ReadResponseHeadCallback callback) override;
+  void ReadData(int64_t size, ReadDataCallback callback) override;
+
+  void DidReadDataComplete();
+
+  const std::unique_ptr<ServiceWorkerResponseReader> reader_;
+
+  class DataReader;
+  std::unique_ptr<DataReader> data_reader_;
+
+  base::WeakPtrFactory<ServiceWorkerResourceReaderImpl> weak_factory_{this};
+};
+
+// The implementation of storage::mojom::ServiceWorkerResourceWriter.
+// Currently this class is an adaptor that uses ServiceWorkerResponseWriter
+// internally.
+// TODO(crbug.com/1055677): Fork the implementation of
+// ServiceWorkerResponseWriter and stop using it.
+class ServiceWorkerResourceWriterImpl
+    : public storage::mojom::ServiceWorkerResourceWriter {
+ public:
+  explicit ServiceWorkerResourceWriterImpl(
+      std::unique_ptr<ServiceWorkerResponseWriter> writer);
+
+  ServiceWorkerResourceWriterImpl(const ServiceWorkerResourceWriterImpl&) =
+      delete;
+  ServiceWorkerResourceWriterImpl& operator=(
+      const ServiceWorkerResourceWriterImpl&) = delete;
+
+  ~ServiceWorkerResourceWriterImpl() override;
+
+ private:
+  // storage::mojom::ServiceWorkerResourceWriter implementations:
+  void WriteResponseHead(network::mojom::URLResponseHeadPtr response_head,
+                         WriteResponseHeadCallback callback) override;
+  void WriteData(mojo_base::BigBuffer data,
+                 WriteDataCallback callback) override;
+
+  const std::unique_ptr<ServiceWorkerResponseWriter> writer_;
+};
+
+// The implementation of storage::mojom::ServiceWorkerResourceMetadataWriter.
+// Currently this class is an adaptor that uses
+// ServiceWorkerResponseMetadataWriter internally.
+// TODO(crbug.com/1055677): Fork the implementation of
+// ServiceWorkerResponseMetadataWriter and stop using it.
+class ServiceWorkerResourceMetadataWriterImpl
+    : public storage::mojom::ServiceWorkerResourceMetadataWriter {
+ public:
+  explicit ServiceWorkerResourceMetadataWriterImpl(
+      std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer);
+
+  ServiceWorkerResourceMetadataWriterImpl(
+      const ServiceWorkerResourceMetadataWriterImpl&) = delete;
+  ServiceWorkerResourceMetadataWriterImpl& operator=(
+      const ServiceWorkerResourceMetadataWriterImpl&) = delete;
+
+  ~ServiceWorkerResourceMetadataWriterImpl() override;
+
+ private:
+  // storage::mojom::ServiceWorkerResourceMetadataWriter implementations:
+  void WriteMetadata(mojo_base::BigBuffer data,
+                     WriteMetadataCallback callback) override;
+
+  const std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_OPS_H_
diff --git a/chromium/content/browser/service_worker/service_worker_resource_writer_impl.cc b/chromium/content/browser/service_worker/service_worker_resource_writer_impl.cc
deleted file mode 100644
index 3deb399d060..00000000000
--- a/chromium/content/browser/service_worker/service_worker_resource_writer_impl.cc
+++ /dev/null
@@ -1,78 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/service_worker/service_worker_resource_writer_impl.h"
-
-#include "content/browser/service_worker/service_worker_loader_helpers.h"
-
-namespace content {
-
-namespace {
-
-// TODO(bashi): Don't duplicate. This is the same as the BigIObuffer defined in
-// //content/browser/code_cache/generated_code_cache.cc
-class BigIOBuffer : public net::IOBufferWithSize {
- public:
-  explicit BigIOBuffer(mojo_base::BigBuffer buffer);
-
-  BigIOBuffer(const BigIOBuffer&) = delete;
-  BigIOBuffer& operator=(const BigIOBuffer&) = delete;
-
- protected:
-  ~BigIOBuffer() override;
-
- private:
-  mojo_base::BigBuffer buffer_;
-};
-
-BigIOBuffer::BigIOBuffer(mojo_base::BigBuffer buffer)
-    : net::IOBufferWithSize(nullptr, buffer.size()),
-      buffer_(std::move(buffer)) {
-  data_ = reinterpret_cast<char*>(buffer_.data());
-}
-
-BigIOBuffer::~BigIOBuffer() {
-  data_ = nullptr;
-  size_ = 0UL;
-}
-
-}  // namespace
-
-ServiceWorkerResourceWriterImpl::ServiceWorkerResourceWriterImpl(
-    std::unique_ptr<ServiceWorkerResponseWriter> writer)
-    : writer_(std::move(writer)) {
-  DCHECK(writer_);
-}
-
-ServiceWorkerResourceWriterImpl::~ServiceWorkerResourceWriterImpl() = default;
-
-void ServiceWorkerResourceWriterImpl::WriteResponseHead(
-    network::mojom::URLResponseHeadPtr response_head,
-    WriteResponseHeadCallback callback) {
-  blink::ServiceWorkerStatusCode service_worker_status;
-  network::URLLoaderCompletionStatus completion_status;
-  std::string error_message;
-  std::unique_ptr<net::HttpResponseInfo> response_info =
-      service_worker_loader_helpers::CreateHttpResponseInfoAndCheckHeaders(
-          *response_head, &service_worker_status, &completion_status,
-          &error_message);
-  if (!response_info) {
-    DCHECK_NE(net::OK, completion_status.error_code);
-    std::move(callback).Run(completion_status.error_code);
-    return;
-  }
-
-  auto info_buffer =
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(response_info));
-  writer_->WriteInfo(info_buffer.get(), std::move(callback));
-}
-
-void ServiceWorkerResourceWriterImpl::WriteData(mojo_base::BigBuffer data,
-                                                WriteDataCallback callback) {
-  int buf_len = data.size();
-  auto buffer = base::MakeRefCounted<BigIOBuffer>(std::move(data));
-  writer_->WriteData(buffer.get(), buf_len, std::move(callback));
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_resource_writer_impl.h b/chromium/content/browser/service_worker/service_worker_resource_writer_impl.h
deleted file mode 100644
index d1d2f5b13bf..00000000000
--- a/chromium/content/browser/service_worker/service_worker_resource_writer_impl.h
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_WRITER_IMPL_H_
-#define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_WRITER_IMPL_H_
-
-#include "components/services/storage/public/mojom/service_worker_storage_control.mojom.h"
-#include "content/browser/service_worker/service_worker_disk_cache.h"
-
-namespace content {
-
-// The implementation of storage::mojom::ServiceWorkerResourceWriter.
-// Currently this class is an adaptor that uses ServiceWorkerResponseWriter
-// internally.
-// TODO(crbug.com/1055677): Fork the implementation of
-// ServiceWorkerResponseWriter and stop using it.
-class ServiceWorkerResourceWriterImpl
-    : public storage::mojom::ServiceWorkerResourceWriter {
- public:
-  explicit ServiceWorkerResourceWriterImpl(
-      std::unique_ptr<ServiceWorkerResponseWriter> writer);
-
-  ServiceWorkerResourceWriterImpl(const ServiceWorkerResourceWriterImpl&) =
-      delete;
-  ServiceWorkerResourceWriterImpl& operator=(
-      const ServiceWorkerResourceWriterImpl&) = delete;
-
-  ~ServiceWorkerResourceWriterImpl() override;
-
- private:
-  // storage::mojom::ServiceWorkerResourceWriter implementations:
-  void WriteResponseHead(network::mojom::URLResponseHeadPtr response_head,
-                         WriteResponseHeadCallback callback) override;
-  void WriteData(mojo_base::BigBuffer data,
-                 WriteDataCallback callback) override;
-
-  const std::unique_ptr<ServiceWorkerResponseWriter> writer_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_WRITER_IMPL_H_
diff --git a/chromium/content/browser/service_worker/service_worker_script_cache_map.cc b/chromium/content/browser/service_worker/service_worker_script_cache_map.cc
index da98c87af49..712c3f07fbc 100644
--- a/chromium/content/browser/service_worker/service_worker_script_cache_map.cc
+++ b/chromium/content/browser/service_worker/service_worker_script_cache_map.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/browser/service_worker/service_worker_consts.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_disk_cache.h"
diff --git a/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc b/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
index f405ba2d958..57335f6ad2c 100644
--- a/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
+++ b/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
@@ -19,6 +19,7 @@
 #include "content/browser/service_worker/service_worker_version.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "services/network/public/cpp/request_destination.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "third_party/blink/public/common/service_worker/service_worker_utils.h"
 
@@ -164,17 +165,17 @@ bool ServiceWorkerScriptLoaderFactory::CheckIfScriptRequestIsValid(
     return false;
 
   // Handle only the service worker main script
-  // (blink::mojom::ResourceType::kServiceWorker) or importScripts()
-  // (blink::mojom::ResourceType::kScript).
-  if (resource_request.resource_type !=
-          static_cast<int>(blink::mojom::ResourceType::kServiceWorker) &&
-      resource_request.resource_type !=
-          static_cast<int>(blink::mojom::ResourceType::kScript)) {
+  // (network::mojom::RequestDestination::kServiceWorker) or importScripts()
+  // (network::mojom::RequestDestination::kScript).
+  if (resource_request.destination !=
+          network::mojom::RequestDestination::kServiceWorker &&
+      resource_request.destination !=
+          network::mojom::RequestDestination::kScript) {
     static auto* key = base::debug::AllocateCrashKeyString(
         "swslf_bad_type", base::debug::CrashKeySize::Size32);
     base::debug::SetCrashKeyString(
-        key, base::NumberToString(resource_request.resource_type));
-    mojo::ReportBadMessage("SWSLF_BAD_RESOURCE_TYPE");
+        key, network::RequestDestinationToString(resource_request.destination));
+    mojo::ReportBadMessage("SWSLF_BAD_REQUEST_DESTINATION");
     return false;
   }
 
diff --git a/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc b/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
index 16fcfa2b8a3..4a739dfa676 100644
--- a/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
@@ -60,8 +60,8 @@ class ServiceWorkerScriptLoaderFactoryTest : public testing::Test {
     mojo::PendingRemote<network::mojom::URLLoader> loader;
     network::ResourceRequest resource_request;
     resource_request.url = script_url_;
-    resource_request.resource_type =
-        static_cast<int>(blink::mojom::ResourceType::kServiceWorker);
+    resource_request.destination =
+        network::mojom::RequestDestination::kServiceWorker;
     factory_->CreateLoaderAndStart(
         loader.InitWithNewPipeAndPassReceiver(), 0 /* routing_id */,
         0 /* request_id */, network::mojom::kURLLoadOptionNone,
@@ -187,7 +187,7 @@ TEST_F(ServiceWorkerScriptLoaderFactoryCopyResumeTest,
        CreateResumeTypeScriptLoader) {
   const std::string kNewHeaders =
       "HTTP/1.0 200 OK\0Content-Type: text/javascript\0Content-Length: 0\0\0";
-  const std::string kNewData = "";
+  const std::string kNewData;
 
   ServiceWorkerUpdateCheckTestUtils::CreateAndSetComparedScriptInfoForVersion(
       script_url_, 0, kNewHeaders, kNewData, kOldResourceId, kNewResourceId,
diff --git a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
index 6633084d1ad..f14d3f499f9 100644
--- a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
+++ b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
@@ -21,7 +21,9 @@
 #include "content/public/common/referrer.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/ip_endpoint.h"
+#include "net/base/isolation_info.h"
 #include "net/base/load_flags.h"
+#include "net/cookies/site_for_cookies.h"
 #include "net/http/http_response_info.h"
 #include "services/network/public/cpp/net_adapters.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -154,8 +156,9 @@ ServiceWorkerSingleScriptUpdateChecker::ServiceWorkerSingleScriptUpdateChecker(
   // This key is used to isolate requests from different contexts in accessing
   // shared network resources like the http cache.
   resource_request.trusted_params = network::ResourceRequest::TrustedParams();
-  resource_request.trusted_params->network_isolation_key =
-      net::NetworkIsolationKey(origin, origin);
+  resource_request.trusted_params->isolation_info = net::IsolationInfo::Create(
+      net::IsolationInfo::RedirectMode::kUpdateNothing, origin, origin,
+      net::SiteForCookies::FromOrigin(origin));
 
   if (is_main_script_) {
     // Set the "Service-Worker" header for the main script request:
@@ -169,12 +172,8 @@ ServiceWorkerSingleScriptUpdateChecker::ServiceWorkerSingleScriptUpdateChecker(
     resource_request.credentials_mode =
         network::mojom::CredentialsMode::kSameOrigin;
 
-    // |fetch_request_context_type| and |resource_type| roughly correspond to
-    // the request's |destination| in the Fetch spec.
-    // The destination is "serviceworker" for the main script.
+    // The request's destination is "serviceworker" for the main script.
     // https://w3c.github.io/ServiceWorker/#update-algorithm
-    resource_request.fetch_request_context_type =
-        static_cast<int>(blink::mojom::RequestContextType::SERVICE_WORKER);
     resource_request.destination =
         network::mojom::RequestDestination::kServiceWorker;
     resource_request.resource_type =
@@ -191,12 +190,8 @@ ServiceWorkerSingleScriptUpdateChecker::ServiceWorkerSingleScriptUpdateChecker(
     // https://html.spec.whatwg.org/C/#fetch-a-classic-worker-imported-script
     DCHECK_EQ(network::mojom::RequestMode::kNoCors, resource_request.mode);
 
-    // |fetch_request_context_type| and |resource_type| roughly correspond to
-    // the request's |destination| in the Fetch spec.
-    // The destination is "script" for the imported script.
+    // The request's destination is "script" for the imported script.
     // https://w3c.github.io/ServiceWorker/#update-algorithm
-    resource_request.fetch_request_context_type =
-        static_cast<int>(blink::mojom::RequestContextType::SCRIPT);
     resource_request.destination = network::mojom::RequestDestination::kScript;
     resource_request.resource_type =
         static_cast<int>(blink::mojom::ResourceType::kScript);
@@ -253,11 +248,9 @@ void ServiceWorkerSingleScriptUpdateChecker::OnReceiveResponse(
   blink::ServiceWorkerStatusCode service_worker_status;
   network::URLLoaderCompletionStatus completion_status;
   std::string error_message;
-  std::unique_ptr<net::HttpResponseInfo> response_info =
-      service_worker_loader_helpers::CreateHttpResponseInfoAndCheckHeaders(
+  if (!service_worker_loader_helpers::CheckResponseHead(
           *response_head, &service_worker_status, &completion_status,
-          &error_message);
-  if (!response_info) {
+          &error_message)) {
     DCHECK_NE(net::OK, completion_status.error_code);
     Fail(service_worker_status, error_message, completion_status);
     return;
@@ -278,15 +271,19 @@ void ServiceWorkerSingleScriptUpdateChecker::OnReceiveResponse(
            network::URLLoaderCompletionStatus(net::ERR_INSECURE_RESPONSE));
       return;
     }
-    cross_origin_embedder_policy_ = response_head->cross_origin_embedder_policy;
+    // TODO(arthursonzogni): Ensure CrossOriginEmbedderPolicy to be available
+    // here, not matter the URLLoader used to load it.
+    cross_origin_embedder_policy_ =
+        response_head->parsed_headers
+            ? response_head->parsed_headers->cross_origin_embedder_policy
+            : network::CrossOriginEmbedderPolicy();
   }
 
   network_loader_state_ =
       ServiceWorkerUpdatedScriptLoader::LoaderState::kWaitingForBody;
   network_accessed_ = response_head->network_accessed;
 
-  WriteHeaders(
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(response_info)));
+  WriteHeaders(std::move(response_head));
 }
 
 void ServiceWorkerSingleScriptUpdateChecker::OnReceiveRedirect(
@@ -428,7 +425,7 @@ const char* ServiceWorkerSingleScriptUpdateChecker::ResultToString(
 //------------------------------------------------------------------------------
 
 void ServiceWorkerSingleScriptUpdateChecker::WriteHeaders(
-    scoped_refptr<HttpResponseInfoIOBuffer> info_buffer) {
+    network::mojom::URLResponseHeadPtr response_head) {
   TRACE_EVENT_WITH_FLOW0(
       "ServiceWorker", "ServiceWorkerSingleScriptUpdateChecker::WriteHeaders",
       this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
@@ -441,7 +438,7 @@ void ServiceWorkerSingleScriptUpdateChecker::WriteHeaders(
   // Pass the header to the cache_writer_. This is written to the storage when
   // the body had changes.
   net::Error error = cache_writer_->MaybeWriteHeaders(
-      info_buffer.get(),
+      std::move(response_head),
       base::BindOnce(
           &ServiceWorkerSingleScriptUpdateChecker::OnWriteHeadersComplete,
           weak_factory_.GetWeakPtr()));
diff --git a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.h b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.h
index bdac3408817..ce33db49e3c 100644
--- a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.h
+++ b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.h
@@ -22,7 +22,6 @@ class SharedURLLoaderFactory;
 
 namespace content {
 
-struct HttpResponseInfoIOBuffer;
 class ServiceWorkerCacheWriter;
 
 // Executes byte-for-byte update check of one script. This loads the script from
@@ -155,7 +154,7 @@ class CONTENT_EXPORT ServiceWorkerSingleScriptUpdateChecker
  private:
   class WrappedIOBuffer;
 
-  void WriteHeaders(scoped_refptr<HttpResponseInfoIOBuffer> info_buffer);
+  void WriteHeaders(network::mojom::URLResponseHeadPtr response_head);
   void OnWriteHeadersComplete(net::Error error);
 
   void MaybeStartNetworkConsumerHandleWatcher();
diff --git a/chromium/content/browser/service_worker/service_worker_storage.cc b/chromium/content/browser/service_worker/service_worker_storage.cc
index c2feec2e9b1..7d0f4facc2b 100644
--- a/chromium/content/browser/service_worker/service_worker_storage.cc
+++ b/chromium/content/browser/service_worker/service_worker_storage.cc
@@ -56,8 +56,7 @@ void MaybeNotifyWriteFailed(
   }
 }
 
-const base::FilePath::CharType kDatabaseName[] =
-    FILE_PATH_LITERAL("Database");
+const base::FilePath::CharType kDatabaseName[] = FILE_PATH_LITERAL("Database");
 const base::FilePath::CharType kDiskCacheName[] =
     FILE_PATH_LITERAL("ScriptCache");
 
@@ -68,8 +67,7 @@ ServiceWorkerStorage::InitialData::InitialData()
       next_version_id(blink::mojom::kInvalidServiceWorkerVersionId),
       next_resource_id(blink::mojom::kInvalidServiceWorkerResourceId) {}
 
-ServiceWorkerStorage::InitialData::~InitialData() {
-}
+ServiceWorkerStorage::InitialData::~InitialData() = default;
 
 ServiceWorkerStorage::DidDeleteRegistrationParams::DidDeleteRegistrationParams(
     int64_t registration_id,
@@ -540,7 +538,7 @@ void ServiceWorkerStorage::DoomUncommittedResources(
 void ServiceWorkerStorage::StoreUserData(
     int64_t registration_id,
     const GURL& origin,
-    const std::vector<std::pair<std::string, std::string>>& key_value_pairs,
+    std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data,
     DatabaseStatusCallback callback) {
   switch (state_) {
     case STORAGE_STATE_DISABLED:
@@ -552,7 +550,7 @@ void ServiceWorkerStorage::StoreUserData(
     case STORAGE_STATE_UNINITIALIZED:
       LazyInitialize(base::BindOnce(
           &ServiceWorkerStorage::StoreUserData, weak_factory_.GetWeakPtr(),
-          registration_id, origin, key_value_pairs, std::move(callback)));
+          registration_id, origin, std::move(user_data), std::move(callback)));
       return;
     case STORAGE_STATE_INITIALIZED:
       break;
@@ -561,13 +559,13 @@ void ServiceWorkerStorage::StoreUserData(
   // TODO(bashi): Consider replacing these DCHECKs with returning errors once
   // this class is moved to the Storage Service.
   DCHECK_NE(registration_id, blink::mojom::kInvalidServiceWorkerRegistrationId);
-  DCHECK(!key_value_pairs.empty());
+  DCHECK(!user_data.empty());
 
   base::PostTaskAndReplyWithResult(
       database_task_runner_.get(), FROM_HERE,
       base::BindOnce(&ServiceWorkerDatabase::WriteUserData,
                      base::Unretained(database_.get()), registration_id, origin,
-                     key_value_pairs),
+                     std::move(user_data)),
       base::BindOnce(&ServiceWorkerStorage::DidStoreUserData,
                      weak_factory_.GetWeakPtr(), std::move(callback), origin));
 }
@@ -896,7 +894,8 @@ void ServiceWorkerStorage::PurgeResources(
 }
 
 void ServiceWorkerStorage::ApplyPolicyUpdates(
-    std::vector<storage::mojom::LocalStoragePolicyUpdatePtr> policy_updates) {
+    const std::vector<storage::mojom::LocalStoragePolicyUpdatePtr>&
+        policy_updates) {
   for (const auto& update : policy_updates) {
     GURL url = update->origin.GetURL();
     if (!update->purge_on_shutdown)
@@ -1028,7 +1027,7 @@ void ServiceWorkerStorage::DidStoreRegistrationData(
   if (quota_manager_proxy_) {
     // Can be nullptr in tests.
     quota_manager_proxy_->NotifyStorageModified(
-        storage::QuotaClient::kServiceWorker, url::Origin::Create(origin),
+        storage::QuotaClientType::kServiceWorker, url::Origin::Create(origin),
         blink::mojom::StorageType::kTemporary,
         new_resources_total_size_bytes -
             deleted_version.resources_total_size_bytes);
@@ -1062,7 +1061,7 @@ void ServiceWorkerStorage::DidDeleteRegistration(
   if (quota_manager_proxy_) {
     // Can be nullptr in tests.
     quota_manager_proxy_->NotifyStorageModified(
-        storage::QuotaClient::kServiceWorker,
+        storage::QuotaClientType::kServiceWorker,
         url::Origin::Create(params->origin),
         blink::mojom::StorageType::kTemporary,
         -deleted_version.resources_total_size_bytes);
@@ -1303,10 +1302,9 @@ void ServiceWorkerStorage::ReadInitialDataFromDB(
   std::unique_ptr<ServiceWorkerStorage::InitialData> data(
       new ServiceWorkerStorage::InitialData());
 
-  ServiceWorkerDatabase::Status status =
-      database->GetNextAvailableIds(&data->next_registration_id,
-                                    &data->next_version_id,
-                                    &data->next_resource_id);
+  ServiceWorkerDatabase::Status status = database->GetNextAvailableIds(
+      &data->next_registration_id, &data->next_version_id,
+      &data->next_resource_id);
   if (status != ServiceWorkerDatabase::Status::kOk) {
     original_task_runner->PostTask(
         FROM_HERE,
diff --git a/chromium/content/browser/service_worker/service_worker_storage.h b/chromium/content/browser/service_worker/service_worker_storage.h
index 3e6cf5cb8d7..0e9f0dcd321 100644
--- a/chromium/content/browser/service_worker/service_worker_storage.h
+++ b/chromium/content/browser/service_worker/service_worker_storage.h
@@ -225,7 +225,7 @@ class CONTENT_EXPORT ServiceWorkerStorage {
   void StoreUserData(
       int64_t registration_id,
       const GURL& origin,
-      const std::vector<std::pair<std::string, std::string>>& key_value_pairs,
+      std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data,
       DatabaseStatusCallback callback);
   // Responds OK if all are successfully deleted or not found in the database.
   void ClearUserData(int64_t registration_id,
@@ -295,7 +295,8 @@ class CONTENT_EXPORT ServiceWorkerStorage {
 
   // Applies |policy_updates|.
   void ApplyPolicyUpdates(
-      std::vector<storage::mojom::LocalStoragePolicyUpdatePtr> policy_updates);
+      const std::vector<storage::mojom::LocalStoragePolicyUpdatePtr>&
+          policy_updates);
 
   void LazyInitializeForTest();
 
@@ -500,9 +501,8 @@ class CONTENT_EXPORT ServiceWorkerStorage {
       scoped_refptr<base::SequencedTaskRunner> original_task_runner,
       const std::string& key_prefix,
       GetUserDataForAllRegistrationsInDBCallback callback);
-  static void DeleteAllDataForOriginsFromDB(
-      ServiceWorkerDatabase* database,
-      const std::set<GURL>& origins);
+  static void DeleteAllDataForOriginsFromDB(ServiceWorkerDatabase* database,
+                                            const std::set<GURL>& origins);
   static void PerformStorageCleanupInDB(ServiceWorkerDatabase* database);
 
   // Posted by the underlying cache implementation after it finishes making
diff --git a/chromium/content/browser/service_worker/service_worker_storage_control_impl.cc b/chromium/content/browser/service_worker/service_worker_storage_control_impl.cc
index 22f4041c53f..b771697e424 100644
--- a/chromium/content/browser/service_worker/service_worker_storage_control_impl.cc
+++ b/chromium/content/browser/service_worker/service_worker_storage_control_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/service_worker/service_worker_storage_control_impl.h"
 
-#include "content/browser/service_worker/service_worker_resource_writer_impl.h"
+#include "content/browser/service_worker/service_worker_resource_ops.h"
 #include "content/browser/service_worker/service_worker_storage.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
@@ -47,6 +47,61 @@ void DidDeleteRegistration(
   std::move(callback).Run(status, origin_state);
 }
 
+void DidGetRegistrationsForOrigin(
+    ServiceWorkerStorageControlImpl::GetRegistrationsForOriginCallback callback,
+    storage::mojom::ServiceWorkerDatabaseStatus status,
+    std::unique_ptr<ServiceWorkerStorage::RegistrationList>
+        registration_data_list,
+    std::unique_ptr<std::vector<ServiceWorkerStorage::ResourceList>>
+        resources_list) {
+  DCHECK_EQ(registration_data_list->size(), resources_list->size());
+
+  std::vector<storage::mojom::SerializedServiceWorkerRegistrationPtr>
+      registrations;
+  for (size_t i = 0; i < registration_data_list->size(); ++i) {
+    registrations.push_back(
+        storage::mojom::SerializedServiceWorkerRegistration::New(
+            std::move((*registration_data_list)[i]),
+            std::move((*resources_list)[i])));
+  }
+
+  std::move(callback).Run(status, std::move(registrations));
+}
+
+void DidGetUserData(
+    ServiceWorkerStorageControlImpl::GetUserDataCallback callback,
+    const std::vector<std::string>& values,
+    storage::mojom::ServiceWorkerDatabaseStatus status) {
+  // TODO(bashi): Change ServiceWorkerStorage::GetUserDataInDBCallback to remove
+  // this indirection (the order of |values| and |status| is different).
+  std::move(callback).Run(status, values);
+}
+
+void DidGetKeysAndUserData(
+    ServiceWorkerStorageControlImpl::GetUserKeysAndDataByKeyPrefixCallback
+        callback,
+    const base::flat_map<std::string, std::string>& user_data,
+    storage::mojom::ServiceWorkerDatabaseStatus status) {
+  // TODO(bashi): Change ServiceWorkerStorage::GetUserKeysAndDataInDBCallback to
+  // remove this indirection (the order of |user_data| and |status| is
+  // different).
+  std::move(callback).Run(status, user_data);
+}
+
+void DidGetUserDataForAllRegistrations(
+    ServiceWorkerStorageControlImpl::GetUserDataForAllRegistrationsCallback
+        callback,
+    const std::vector<std::pair<int64_t, std::string>>& user_data,
+    storage::mojom::ServiceWorkerDatabaseStatus status) {
+  // TODO(bashi): Change ServiceWorkerStorage::GetUserDataForAllRegistrations()
+  // to return base::flat_map.
+  base::flat_map<int64_t, std::string> values;
+  for (auto& entry : user_data) {
+    values[entry.first] = entry.second;
+  }
+  std::move(callback).Run(status, std::move(values));
+}
+
 }  // namespace
 
 ServiceWorkerStorageControlImpl::ServiceWorkerStorageControlImpl(
@@ -84,6 +139,14 @@ void ServiceWorkerStorageControlImpl::FindRegistrationForId(
       base::BindOnce(&DidFindRegistration, std::move(callback)));
 }
 
+void ServiceWorkerStorageControlImpl::GetRegistrationsForOrigin(
+    const GURL& origin,
+    GetRegistrationsForOriginCallback callback) {
+  storage_->GetRegistrationsForOrigin(
+      origin,
+      base::BindOnce(&DidGetRegistrationsForOrigin, std::move(callback)));
+}
+
 void ServiceWorkerStorageControlImpl::StoreRegistration(
     storage::mojom::ServiceWorkerRegistrationDataPtr registration,
     std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources,
@@ -106,11 +169,64 @@ void ServiceWorkerStorageControlImpl::DeleteRegistration(
       base::BindOnce(&DidDeleteRegistration, std::move(callback)));
 }
 
+void ServiceWorkerStorageControlImpl::UpdateToActiveState(
+    int64_t registration_id,
+    const GURL& origin,
+    UpdateToActiveStateCallback callback) {
+  storage_->UpdateToActiveState(registration_id, origin, std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::UpdateLastUpdateCheckTime(
+    int64_t registration_id,
+    const GURL& origin,
+    base::Time last_update_check_time,
+    UpdateLastUpdateCheckTimeCallback callback) {
+  storage_->UpdateLastUpdateCheckTime(
+      registration_id, origin, last_update_check_time, std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::UpdateNavigationPreloadEnabled(
+    int64_t registration_id,
+    const GURL& origin,
+    bool enable,
+    UpdateNavigationPreloadEnabledCallback callback) {
+  storage_->UpdateNavigationPreloadEnabled(registration_id, origin, enable,
+                                           std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::UpdateNavigationPreloadHeader(
+    int64_t registration_id,
+    const GURL& origin,
+    const std::string& value,
+    UpdateNavigationPreloadHeaderCallback callback) {
+  storage_->UpdateNavigationPreloadHeader(registration_id, origin, value,
+                                          std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::GetNewRegistrationId(
+    GetNewRegistrationIdCallback callback) {
+  storage_->GetNewRegistrationId(std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::GetNewVersionId(
+    GetNewVersionIdCallback callback) {
+  storage_->GetNewVersionId(std::move(callback));
+}
+
 void ServiceWorkerStorageControlImpl::GetNewResourceId(
     GetNewResourceIdCallback callback) {
   storage_->GetNewResourceId(std::move(callback));
 }
 
+void ServiceWorkerStorageControlImpl::CreateResourceReader(
+    int64_t resource_id,
+    mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceReader> reader) {
+  DCHECK_NE(resource_id, blink::mojom::kInvalidServiceWorkerResourceId);
+  mojo::MakeSelfOwnedReceiver(std::make_unique<ServiceWorkerResourceReaderImpl>(
+                                  storage_->CreateResponseReader(resource_id)),
+                              std::move(reader));
+}
+
 void ServiceWorkerStorageControlImpl::CreateResourceWriter(
     int64_t resource_id,
     mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceWriter> writer) {
@@ -120,4 +236,95 @@ void ServiceWorkerStorageControlImpl::CreateResourceWriter(
                               std::move(writer));
 }
 
+void ServiceWorkerStorageControlImpl::CreateResourceMetadataWriter(
+    int64_t resource_id,
+    mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceMetadataWriter>
+        writer) {
+  DCHECK_NE(resource_id, blink::mojom::kInvalidServiceWorkerResourceId);
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<ServiceWorkerResourceMetadataWriterImpl>(
+          storage_->CreateResponseMetadataWriter(resource_id)),
+      std::move(writer));
+}
+
+void ServiceWorkerStorageControlImpl::GetUserData(
+    int64_t registration_id,
+    const std::vector<std::string>& keys,
+    GetUserDataCallback callback) {
+  storage_->GetUserData(registration_id, keys,
+                        base::BindOnce(&DidGetUserData, std::move(callback)));
+}
+
+void ServiceWorkerStorageControlImpl::StoreUserData(
+    int64_t registration_id,
+    const GURL& origin,
+    std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data,
+    StoreUserDataCallback callback) {
+  storage_->StoreUserData(registration_id, origin, std::move(user_data),
+                          std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::ClearUserData(
+    int64_t registration_id,
+    const std::vector<std::string>& keys,
+    ClearUserDataCallback callback) {
+  storage_->ClearUserData(registration_id, keys, std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::GetUserDataByKeyPrefix(
+    int64_t registration_id,
+    const std::string& key_prefix,
+    GetUserDataByKeyPrefixCallback callback) {
+  storage_->GetUserDataByKeyPrefix(
+      registration_id, key_prefix,
+      base::BindOnce(&DidGetUserData, std::move(callback)));
+}
+
+void ServiceWorkerStorageControlImpl::GetUserKeysAndDataByKeyPrefix(
+    int64_t registration_id,
+    const std::string& key_prefix,
+    GetUserKeysAndDataByKeyPrefixCallback callback) {
+  storage_->GetUserKeysAndDataByKeyPrefix(
+      registration_id, key_prefix,
+      base::BindOnce(&DidGetKeysAndUserData, std::move(callback)));
+}
+
+void ServiceWorkerStorageControlImpl::ClearUserDataByKeyPrefixes(
+    int64_t registration_id,
+    const std::vector<std::string>& key_prefixes,
+    ClearUserDataByKeyPrefixesCallback callback) {
+  storage_->ClearUserDataByKeyPrefixes(registration_id, key_prefixes,
+                                       std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::GetUserDataForAllRegistrations(
+    const std::string& key,
+    GetUserDataForAllRegistrationsCallback callback) {
+  storage_->GetUserDataForAllRegistrations(
+      key,
+      base::BindOnce(&DidGetUserDataForAllRegistrations, std::move(callback)));
+}
+
+void ServiceWorkerStorageControlImpl::GetUserDataForAllRegistrationsByKeyPrefix(
+    const std::string& key_prefix,
+    GetUserDataForAllRegistrationsByKeyPrefixCallback callback) {
+  storage_->GetUserDataForAllRegistrationsByKeyPrefix(
+      key_prefix,
+      base::BindOnce(&DidGetUserDataForAllRegistrations, std::move(callback)));
+}
+
+void ServiceWorkerStorageControlImpl::
+    ClearUserDataForAllRegistrationsByKeyPrefix(
+        const std::string& key_prefix,
+        ClearUserDataForAllRegistrationsByKeyPrefixCallback callback) {
+  storage_->ClearUserDataForAllRegistrationsByKeyPrefix(key_prefix,
+                                                        std::move(callback));
+}
+
+void ServiceWorkerStorageControlImpl::ApplyPolicyUpdates(
+    const std::vector<storage::mojom::LocalStoragePolicyUpdatePtr>
+        policy_updates) {
+  storage_->ApplyPolicyUpdates(std::move(policy_updates));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_storage_control_impl.h b/chromium/content/browser/service_worker/service_worker_storage_control_impl.h
index a2d28bbc4db..63320c98b19 100644
--- a/chromium/content/browser/service_worker/service_worker_storage_control_impl.h
+++ b/chromium/content/browser/service_worker/service_worker_storage_control_impl.h
@@ -45,6 +45,9 @@ class CONTENT_EXPORT ServiceWorkerStorageControlImpl
   void FindRegistrationForId(int64_t registration_id,
                              const GURL& origin,
                              FindRegistrationForIdCallback callback) override;
+  void GetRegistrationsForOrigin(
+      const GURL& origin,
+      GetRegistrationsForOriginCallback callback) override;
   void StoreRegistration(
       storage::mojom::ServiceWorkerRegistrationDataPtr registration,
       std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources,
@@ -52,11 +55,73 @@ class CONTENT_EXPORT ServiceWorkerStorageControlImpl
   void DeleteRegistration(int64_t registration_id,
                           const GURL& origin,
                           DeleteRegistrationCallback callback) override;
+  void UpdateToActiveState(int64_t registration_id,
+                           const GURL& origin,
+                           UpdateToActiveStateCallback callback) override;
+  void UpdateLastUpdateCheckTime(
+      int64_t registration_id,
+      const GURL& origin,
+      base::Time last_update_check_time,
+      UpdateLastUpdateCheckTimeCallback callback) override;
+  void UpdateNavigationPreloadEnabled(
+      int64_t registration_id,
+      const GURL& origin,
+      bool enable,
+      UpdateNavigationPreloadEnabledCallback callback) override;
+  void UpdateNavigationPreloadHeader(
+      int64_t registration_id,
+      const GURL& origin,
+      const std::string& value,
+      UpdateNavigationPreloadHeaderCallback callback) override;
+  void GetNewRegistrationId(GetNewRegistrationIdCallback callback) override;
+  void GetNewVersionId(GetNewVersionIdCallback callback) override;
   void GetNewResourceId(GetNewResourceIdCallback callback) override;
+  void CreateResourceReader(
+      int64_t resource_id,
+      mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceReader> reader)
+      override;
   void CreateResourceWriter(
       int64_t resource_id,
       mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceWriter> writer)
       override;
+  void CreateResourceMetadataWriter(
+      int64_t resource_id,
+      mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceMetadataWriter>
+          writer) override;
+  void GetUserData(int64_t registration_id,
+                   const std::vector<std::string>& keys,
+                   GetUserDataCallback callback) override;
+  void StoreUserData(
+      int64_t registration_id,
+      const GURL& origin,
+      std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data,
+      StoreUserDataCallback callback) override;
+  void ClearUserData(int64_t registration_id,
+                     const std::vector<std::string>& keys,
+                     ClearUserDataCallback callback) override;
+  void GetUserDataByKeyPrefix(int64_t registration_id,
+                              const std::string& key_prefix,
+                              GetUserDataByKeyPrefixCallback callback) override;
+  void GetUserKeysAndDataByKeyPrefix(
+      int64_t registration_id,
+      const std::string& key_prefix,
+      GetUserKeysAndDataByKeyPrefixCallback callback) override;
+  void ClearUserDataByKeyPrefixes(
+      int64_t registration_id,
+      const std::vector<std::string>& key_prefixes,
+      ClearUserDataByKeyPrefixesCallback callback) override;
+  void GetUserDataForAllRegistrations(
+      const std::string& key,
+      GetUserDataForAllRegistrationsCallback callback) override;
+  void GetUserDataForAllRegistrationsByKeyPrefix(
+      const std::string& key_prefix,
+      GetUserDataForAllRegistrationsByKeyPrefixCallback callback) override;
+  void ClearUserDataForAllRegistrationsByKeyPrefix(
+      const std::string& key_prefix,
+      ClearUserDataForAllRegistrationsByKeyPrefixCallback callback) override;
+  void ApplyPolicyUpdates(
+      const std::vector<storage::mojom::LocalStoragePolicyUpdatePtr>
+          policy_updates) override;
 
   const std::unique_ptr<ServiceWorkerStorage> storage_;
 };
diff --git a/chromium/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc b/chromium/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
index 8284dd5e473..f6b40a65171 100644
--- a/chromium/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
@@ -4,17 +4,28 @@
 
 #include "content/browser/service_worker/service_worker_storage_control_impl.h"
 
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "base/containers/flat_map.h"
 #include "base/containers/span.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/test/bind_test_util.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
 #include "content/browser/service_worker/service_worker_storage.h"
+#include "content/browser/service_worker/service_worker_test_utils.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
+#include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/http/http_util.h"
+#include "net/test/cert_test_util.h"
+#include "net/test/test_data_directory.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/service_worker/navigation_preload_state.mojom.h"
+#include "url/gurl.h"
 
 namespace content {
 
@@ -24,6 +35,74 @@ using FindRegistrationResult =
 
 namespace {
 
+struct ReadResponseHeadResult {
+  int status;
+  network::mojom::URLResponseHeadPtr response_head;
+  base::Optional<mojo_base::BigBuffer> metadata;
+};
+
+struct GetRegistrationsForOriginResult {
+  DatabaseStatus status;
+  std::vector<storage::mojom::SerializedServiceWorkerRegistrationPtr>
+      registrations;
+};
+
+struct DeleteRegistrationResult {
+  DatabaseStatus status;
+  storage::mojom::ServiceWorkerStorageOriginState origin_state;
+};
+
+struct GetUserDataResult {
+  DatabaseStatus status;
+  std::vector<std::string> values;
+};
+
+struct GetUserDataByKeyPrefixResult {
+  DatabaseStatus status;
+  std::vector<std::string> values;
+};
+
+struct GetUserKeysAndDataByKeyPrefixResult {
+  DatabaseStatus status;
+  base::flat_map<std::string, std::string> user_data;
+};
+
+struct GetUserDataForAllRegistrationsResult {
+  DatabaseStatus status;
+  base::flat_map<int64_t, std::string> values;
+};
+
+ReadResponseHeadResult ReadResponseHead(
+    storage::mojom::ServiceWorkerResourceReader* reader) {
+  ReadResponseHeadResult result;
+  base::RunLoop loop;
+  reader->ReadResponseHead(base::BindLambdaForTesting(
+      [&](int status, network::mojom::URLResponseHeadPtr response_head,
+          base::Optional<mojo_base::BigBuffer> metadata) {
+        result.status = status;
+        result.response_head = std::move(response_head);
+        result.metadata = std::move(metadata);
+        loop.Quit();
+      }));
+  loop.Run();
+  return result;
+}
+
+std::string ReadResponseData(
+    storage::mojom::ServiceWorkerResourceReader* reader,
+    int data_size) {
+  mojo::ScopedDataPipeConsumerHandle data_consumer;
+  base::RunLoop loop;
+  reader->ReadData(data_size, base::BindLambdaForTesting(
+                                  [&](mojo::ScopedDataPipeConsumerHandle pipe) {
+                                    data_consumer = std::move(pipe);
+                                    loop.Quit();
+                                  }));
+  loop.Run();
+
+  return ReadDataPipe(std::move(data_consumer));
+}
+
 int WriteResponseHead(storage::mojom::ServiceWorkerResourceWriter* writer,
                       network::mojom::URLResponseHeadPtr response_head) {
   int return_value;
@@ -50,6 +129,20 @@ int WriteResponseData(storage::mojom::ServiceWorkerResourceWriter* writer,
   return return_value;
 }
 
+int WriteResponseMetadata(
+    storage::mojom::ServiceWorkerResourceMetadataWriter* writer,
+    mojo_base::BigBuffer metadata) {
+  int return_value;
+  base::RunLoop loop;
+  writer->WriteMetadata(std::move(metadata),
+                        base::BindLambdaForTesting([&](int result) {
+                          return_value = result;
+                          loop.Quit();
+                        }));
+  loop.Run();
+  return return_value;
+}
+
 }  // namespace
 
 class ServiceWorkerStorageControlImplTest : public testing::Test {
@@ -59,7 +152,12 @@ class ServiceWorkerStorageControlImplTest : public testing::Test {
 
   void SetUp() override {
     ASSERT_TRUE(user_data_directory_.CreateUniqueTempDir());
+    SetUpStorage();
+  }
 
+  void TearDown() override { DestroyStorage(); }
+
+  void SetUpStorage() {
     auto storage = ServiceWorkerStorage::Create(
         user_data_directory_.GetPath(),
         /*database_task_runner=*/base::ThreadTaskRunnerHandle::Get(),
@@ -68,12 +166,18 @@ class ServiceWorkerStorageControlImplTest : public testing::Test {
         std::make_unique<ServiceWorkerStorageControlImpl>(std::move(storage));
   }
 
-  void TearDown() override {
+  void DestroyStorage() {
     storage_impl_.reset();
     disk_cache::FlushCacheThreadForTesting();
     content::RunAllTasksUntilIdle();
   }
 
+  void RestartStorage() {
+    DestroyStorage();
+    SetUpStorage();
+    LazyInitializeForTest();
+  }
+
   storage::mojom::ServiceWorkerStorageControl* storage() {
     return storage_impl_.get();
   }
@@ -119,10 +223,29 @@ class ServiceWorkerStorageControlImplTest : public testing::Test {
     return return_value;
   }
 
-  void StoreRegistration(
+  GetRegistrationsForOriginResult GetRegistrationsForOrigin(
+      const GURL& origin) {
+    GetRegistrationsForOriginResult result;
+    base::RunLoop loop;
+    storage()->GetRegistrationsForOrigin(
+        origin,
+        base::BindLambdaForTesting(
+            [&](DatabaseStatus status,
+                std::vector<
+                    storage::mojom::SerializedServiceWorkerRegistrationPtr>
+                    registrations) {
+              result.status = status;
+              result.registrations = std::move(registrations);
+              loop.Quit();
+            }));
+    loop.Run();
+    return result;
+  }
+
+  DatabaseStatus StoreRegistration(
       storage::mojom::ServiceWorkerRegistrationDataPtr registration,
-      std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources,
-      DatabaseStatus& out_status) {
+      std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources) {
+    DatabaseStatus out_status;
     base::RunLoop loop;
     storage()->StoreRegistration(
         std::move(registration), std::move(resources),
@@ -131,24 +254,107 @@ class ServiceWorkerStorageControlImplTest : public testing::Test {
           loop.Quit();
         }));
     loop.Run();
+    return out_status;
   }
 
-  void DeleteRegistration(
-      int64_t registration_id,
-      const GURL& origin,
-      DatabaseStatus& out_status,
-      storage::mojom::ServiceWorkerStorageOriginState& out_origin_state) {
+  DeleteRegistrationResult DeleteRegistration(int64_t registration_id,
+                                              const GURL& origin) {
+    DeleteRegistrationResult result;
     base::RunLoop loop;
     storage()->DeleteRegistration(
         registration_id, origin,
         base::BindLambdaForTesting(
             [&](DatabaseStatus status,
                 storage::mojom::ServiceWorkerStorageOriginState origin_state) {
-              out_status = status;
-              out_origin_state = origin_state;
+              result.status = status;
+              result.origin_state = origin_state;
               loop.Quit();
             }));
     loop.Run();
+    return result;
+  }
+
+  DatabaseStatus UpdateToActiveState(int64_t registration_id,
+                                     const GURL& origin) {
+    DatabaseStatus out_status;
+    base::RunLoop loop;
+    storage()->UpdateToActiveState(
+        registration_id, origin,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          out_status = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return out_status;
+  }
+
+  DatabaseStatus UpdateLastUpdateCheckTime(int64_t registration_id,
+                                           const GURL& origin,
+                                           base::Time last_update_check_time) {
+    DatabaseStatus out_status;
+    base::RunLoop loop;
+    storage()->UpdateLastUpdateCheckTime(
+        registration_id, origin, last_update_check_time,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          out_status = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return out_status;
+  }
+
+  DatabaseStatus UpdateNavigationPreloadEnabled(int64_t registration_id,
+                                                const GURL& origin,
+                                                bool enable) {
+    DatabaseStatus out_status;
+    base::RunLoop loop;
+    storage()->UpdateNavigationPreloadEnabled(
+        registration_id, origin, enable,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          out_status = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return out_status;
+  }
+
+  DatabaseStatus UpdateNavigationPreloadHeader(int64_t registration_id,
+                                               const GURL& origin,
+                                               const std::string& value) {
+    DatabaseStatus out_status;
+    base::RunLoop loop;
+    storage()->UpdateNavigationPreloadHeader(
+        registration_id, origin, value,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          out_status = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return out_status;
+  }
+
+  int64_t GetNewRegistrationId() {
+    int64_t return_value;
+    base::RunLoop loop;
+    storage()->GetNewRegistrationId(
+        base::BindLambdaForTesting([&](int64_t registration_id) {
+          return_value = registration_id;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
+  }
+
+  int64_t GetNewVersionId() {
+    int64_t return_value;
+    base::RunLoop loop;
+    storage()->GetNewVersionId(
+        base::BindLambdaForTesting([&](int64_t version_id) {
+          return_value = version_id;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
   }
 
   int64_t GetNewResourceId() {
@@ -163,14 +369,202 @@ class ServiceWorkerStorageControlImplTest : public testing::Test {
     return return_value;
   }
 
+  GetUserDataResult GetUserData(int64_t registration_id,
+                                const std::vector<std::string>& keys) {
+    GetUserDataResult result;
+    base::RunLoop loop;
+    storage()->GetUserData(
+        registration_id, keys,
+        base::BindLambdaForTesting(
+            [&](DatabaseStatus status, const std::vector<std::string>& values) {
+              result.status = status;
+              result.values = values;
+              loop.Quit();
+            }));
+    loop.Run();
+    return result;
+  }
+
+  DatabaseStatus StoreUserData(
+      int64_t registration_id,
+      const GURL& origin,
+      std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data) {
+    DatabaseStatus return_value;
+    base::RunLoop loop;
+    storage()->StoreUserData(
+        registration_id, origin, std::move(user_data),
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          return_value = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
+  }
+
+  DatabaseStatus ClearUserData(int64_t registration_id,
+                               const std::vector<std::string>& keys) {
+    DatabaseStatus return_value;
+    base::RunLoop loop;
+    storage()->ClearUserData(
+        registration_id, keys,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          return_value = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
+  }
+
+  GetUserDataByKeyPrefixResult GetUserDataByKeyPrefix(
+      int64_t registration_id,
+      const std::string& key_prefix) {
+    GetUserDataByKeyPrefixResult result;
+    base::RunLoop loop;
+    storage()->GetUserDataByKeyPrefix(
+        registration_id, key_prefix,
+        base::BindLambdaForTesting(
+            [&](DatabaseStatus status, const std::vector<std::string>& values) {
+              result.status = status;
+              result.values = values;
+              loop.Quit();
+            }));
+    loop.Run();
+    return result;
+  }
+
+  GetUserKeysAndDataByKeyPrefixResult GetUserKeysAndDataByKeyPrefix(
+      int64_t registration_id,
+      const std::string& key_prefix) {
+    GetUserKeysAndDataByKeyPrefixResult result;
+    base::RunLoop loop;
+    storage()->GetUserKeysAndDataByKeyPrefix(
+        registration_id, key_prefix,
+        base::BindLambdaForTesting(
+            [&](DatabaseStatus status,
+                const base::flat_map<std::string, std::string>& user_data) {
+              result.status = status;
+              result.user_data = user_data;
+              loop.Quit();
+            }));
+    loop.Run();
+    return result;
+  }
+
+  DatabaseStatus ClearUserDataByKeyPrefixes(
+      int64_t registration_id,
+      const std::vector<std::string>& key_prefixes) {
+    DatabaseStatus return_value;
+    base::RunLoop loop;
+    storage()->ClearUserDataByKeyPrefixes(
+        registration_id, key_prefixes,
+        base::BindLambdaForTesting([&](DatabaseStatus status) {
+          return_value = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
+  }
+
+  GetUserDataForAllRegistrationsResult GetUserDataForAllRegistrations(
+      const std::string& key) {
+    GetUserDataForAllRegistrationsResult result;
+    base::RunLoop loop;
+    storage()->GetUserDataForAllRegistrations(
+        key, base::BindLambdaForTesting(
+                 [&](DatabaseStatus status,
+                     const base::flat_map<int64_t, std::string>& values) {
+                   result.status = status;
+                   result.values = values;
+                   loop.Quit();
+                 }));
+    loop.Run();
+    return result;
+  }
+
+  GetUserDataForAllRegistrationsResult
+  GetUserDataForAllRegistrationsByKeyPrefix(const std::string& key_prefix) {
+    GetUserDataForAllRegistrationsResult result;
+    base::RunLoop loop;
+    storage()->GetUserDataForAllRegistrationsByKeyPrefix(
+        key_prefix,
+        base::BindLambdaForTesting(
+            [&](DatabaseStatus status,
+                const base::flat_map<int64_t, std::string>& values) {
+              result.status = status;
+              result.values = values;
+              loop.Quit();
+            }));
+    loop.Run();
+    return result;
+  }
+
+  DatabaseStatus ClearUserDataForAllRegistrationsByKeyPrefix(
+      const std::string& key_prefix) {
+    DatabaseStatus return_value;
+    base::RunLoop loop;
+    storage()->ClearUserDataForAllRegistrationsByKeyPrefix(
+        key_prefix, base::BindLambdaForTesting([&](DatabaseStatus status) {
+          return_value = status;
+          loop.Quit();
+        }));
+    loop.Run();
+    return return_value;
+  }
+
+  // Create a registration with a single resource and stores the registration.
+  DatabaseStatus CreateAndStoreRegistration(int64_t registration_id,
+                                            int64_t version_id,
+                                            int64_t resource_id,
+                                            const GURL& scope,
+                                            const GURL& script_url,
+                                            int64_t script_size) {
+    std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources;
+    resources.push_back(storage::mojom::ServiceWorkerResourceRecord::New(
+        resource_id, script_url, script_size));
+
+    auto data = storage::mojom::ServiceWorkerRegistrationData::New();
+    data->registration_id = registration_id;
+    data->version_id = version_id;
+    data->scope = scope;
+    data->script = script_url;
+    data->navigation_preload_state =
+        blink::mojom::NavigationPreloadState::New();
+
+    int64_t resources_total_size_bytes = 0;
+    for (auto& resource : resources) {
+      resources_total_size_bytes += resource->size_bytes;
+    }
+    data->resources_total_size_bytes = resources_total_size_bytes;
+
+    DatabaseStatus status =
+        StoreRegistration(std::move(data), std::move(resources));
+    return status;
+  }
+
+  mojo::Remote<storage::mojom::ServiceWorkerResourceReader>
+  CreateResourceReader(int64_t resource_id) {
+    mojo::Remote<storage::mojom::ServiceWorkerResourceReader> reader;
+    storage()->CreateResourceReader(resource_id,
+                                    reader.BindNewPipeAndPassReceiver());
+    return reader;
+  }
+
   mojo::Remote<storage::mojom::ServiceWorkerResourceWriter>
-  CreateNewResourceWriter() {
+  CreateResourceWriter(int64_t resource_id) {
     mojo::Remote<storage::mojom::ServiceWorkerResourceWriter> writer;
-    storage()->CreateResourceWriter(GetNewResourceId(),
+    storage()->CreateResourceWriter(resource_id,
                                     writer.BindNewPipeAndPassReceiver());
     return writer;
   }
 
+  mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter>
+  CreateResourceMetadataWriter(int64_t resource_id) {
+    mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter> writer;
+    storage()->CreateResourceMetadataWriter(
+        resource_id, writer.BindNewPipeAndPassReceiver());
+    return writer;
+  }
+
  private:
   base::ScopedTempDir user_data_directory_;
   BrowserTaskEnvironment task_environment_;
@@ -208,11 +602,13 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
   const GURL kScope("https://www.example.com/scope/");
   const GURL kScriptUrl("https://www.example.com/scope/sw.js");
   const GURL kClientUrl("https://www.example.com/scope/document.html");
-  const int64_t kRegistrationId = 0;
   const int64_t kScriptSize = 10;
 
   LazyInitializeForTest();
 
+  const int64_t kRegistrationId = GetNewResourceId();
+  const int64_t kVersionId = GetNewVersionId();
+
   // Create a registration data with a single resource.
   std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources;
   resources.push_back(storage::mojom::ServiceWorkerResourceRecord::New(
@@ -222,6 +618,7 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
   data->registration_id = kRegistrationId;
   data->scope = kScope;
   data->script = kScriptUrl;
+  data->version_id = kVersionId;
   data->navigation_preload_state = blink::mojom::NavigationPreloadState::New();
 
   int64_t resources_total_size_bytes = 0;
@@ -232,8 +629,8 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
 
   // Store the registration data.
   {
-    DatabaseStatus status;
-    StoreRegistration(std::move(data), std::move(resources), status);
+    DatabaseStatus status =
+        StoreRegistration(std::move(data), std::move(resources));
     ASSERT_EQ(status, DatabaseStatus::kOk);
   }
 
@@ -244,6 +641,7 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
     EXPECT_EQ(result->registration->registration_id, kRegistrationId);
     EXPECT_EQ(result->registration->scope, kScope);
     EXPECT_EQ(result->registration->script, kScriptUrl);
+    EXPECT_EQ(result->registration->version_id, kVersionId);
     EXPECT_EQ(result->registration->resources_total_size_bytes,
               resources_total_size_bytes);
     EXPECT_EQ(result->resources.size(), 1UL);
@@ -256,12 +654,10 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
 
   // Delete the registration.
   {
-    DatabaseStatus status;
-    storage::mojom::ServiceWorkerStorageOriginState origin_state;
-    DeleteRegistration(kRegistrationId, kScope.GetOrigin(), status,
-                       origin_state);
-    ASSERT_EQ(status, DatabaseStatus::kOk);
-    EXPECT_EQ(origin_state,
+    DeleteRegistrationResult result =
+        DeleteRegistration(kRegistrationId, kScope.GetOrigin());
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.origin_state,
               storage::mojom::ServiceWorkerStorageOriginState::kDelete);
   }
 
@@ -277,12 +673,197 @@ TEST_F(ServiceWorkerStorageControlImplTest, StoreAndDeleteRegistration) {
   }
 }
 
-// Tests that writing a service worker script succeeds.
-TEST_F(ServiceWorkerStorageControlImplTest, WriteResource) {
+TEST_F(ServiceWorkerStorageControlImplTest, UpdateToActiveState) {
+  const GURL kScope("https://www.example.com/");
+  const GURL kScriptUrl("https://www.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  // Preparation: Store a registration.
+  const int64_t registration_id = GetNewRegistrationId();
+  const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // The stored registration shouldn't be activated yet.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_FALSE(result->registration->is_active);
+  }
+
+  // Set the registration is active in storage.
+  status = UpdateToActiveState(registration_id, kScope.GetOrigin());
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Now the stored registration should be active.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_TRUE(result->registration->is_active);
+  }
+}
+
+TEST_F(ServiceWorkerStorageControlImplTest, UpdateLastUpdateCheckTime) {
+  const GURL kScope("https://www.example.com/");
+  const GURL kScriptUrl("https://www.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  // Preparation: Store a registration.
+  const int64_t registration_id = GetNewRegistrationId();
+  const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // The stored registration shouldn't have the last update check time yet.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_EQ(result->registration->last_update_check, base::Time());
+  }
+
+  // Set the last update check time.
+  const base::Time now = base::Time::Now();
+  status = UpdateLastUpdateCheckTime(registration_id, kScope.GetOrigin(), now);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Now the stored registration should be active.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_EQ(result->registration->last_update_check, now);
+  }
+}
+
+TEST_F(ServiceWorkerStorageControlImplTest, Update) {
+  const GURL kScope("https://www.example.com/");
+  const GURL kScriptUrl("https://www.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  // Preparation: Store a registration.
+  const int64_t registration_id = GetNewRegistrationId();
+  const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Check the stored registration has default navigation preload fields.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_FALSE(result->registration->navigation_preload_state->enabled);
+    EXPECT_EQ(result->registration->navigation_preload_state->header, "true");
+  }
+
+  // Update navigation preload fields.
+  const std::string header_value = "my-header";
+  status =
+      UpdateNavigationPreloadEnabled(registration_id, kScope.GetOrigin(), true);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  status = UpdateNavigationPreloadHeader(registration_id, kScope.GetOrigin(),
+                                         header_value);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Check navigation preload fields are updated.
+  {
+    FindRegistrationResult result =
+        FindRegistrationForId(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+    EXPECT_TRUE(result->registration->navigation_preload_state->enabled);
+    EXPECT_EQ(result->registration->navigation_preload_state->header,
+              header_value);
+  }
+}
+
+// Tests that getting registrations works.
+TEST_F(ServiceWorkerStorageControlImplTest, GetRegistrationsForOrigin) {
+  const GURL kScope1("https://www.example.com/foo/");
+  const GURL kScriptUrl1("https://www.example.com/foo/sw.js");
+  const GURL kScope2("https://www.example.com/bar/");
+  const GURL kScriptUrl2("https://www.example.com/bar/sw.js");
+  const int64_t kScriptSize = 10;
+
   LazyInitializeForTest();
 
+  // Store two registrations which have the same origin.
+  DatabaseStatus status;
+  const int64_t registration_id1 = GetNewRegistrationId();
+  const int64_t version_id1 = GetNewVersionId();
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  const int64_t registration_id2 = GetNewRegistrationId();
+  const int64_t version_id2 = GetNewVersionId();
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Get registrations for the origin.
+  {
+    const GURL& origin = kScope1.GetOrigin();
+    std::vector<storage::mojom::SerializedServiceWorkerRegistrationPtr>
+        registrations;
+
+    GetRegistrationsForOriginResult result = GetRegistrationsForOrigin(origin);
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.registrations.size(), 2UL);
+
+    for (auto& registration : result.registrations) {
+      EXPECT_EQ(registration->registration_data->scope.GetOrigin(), origin);
+      EXPECT_EQ(registration->registration_data->resources_total_size_bytes,
+                kScriptSize);
+    }
+  }
+
+  // Getting registrations for another origin should succeed but shouldn't find
+  // anything.
+  {
+    const GURL& origin = GURL("https://www.example.test/");
+    std::vector<storage::mojom::SerializedServiceWorkerRegistrationPtr>
+        registrations;
+
+    GetRegistrationsForOriginResult result = GetRegistrationsForOrigin(origin);
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.registrations.size(), 0UL);
+  }
+}
+
+// Tests that writing/reading a service worker script succeed.
+TEST_F(ServiceWorkerStorageControlImplTest, WriteAndReadResource) {
+  LazyInitializeForTest();
+
+  // Create a SSLInfo to write/read.
+  net::SSLInfo ssl_info = net::SSLInfo();
+  ssl_info.cert =
+      net::ImportCertFromFile(net::GetTestCertsDirectory(), "ok_cert.pem");
+  ASSERT_TRUE(ssl_info.is_valid());
+
+  int64_t resource_id = GetNewResourceId();
+
   mojo::Remote<storage::mojom::ServiceWorkerResourceWriter> writer =
-      CreateNewResourceWriter();
+      CreateResourceWriter(resource_id);
 
   // Write a response head.
   {
@@ -292,14 +873,17 @@ TEST_F(ServiceWorkerStorageControlImplTest, WriteResource) {
             "HTTP/1.1 200 OK\n"
             "Content-Type: application/javascript\n"));
     response_head->headers->GetMimeType(&response_head->mime_type);
+    response_head->ssl_info = ssl_info;
 
     int result = WriteResponseHead(writer.get(), std::move(response_head));
     ASSERT_GT(result, 0);
   }
 
+  const std::string kData("/* script body */");
+  int data_size = kData.size();
+
   // Write content.
   {
-    const std::string kData("/* script body */");
     mojo_base::BigBuffer data(base::as_bytes(base::make_span(kData)));
     int data_size = data.size();
 
@@ -307,8 +891,361 @@ TEST_F(ServiceWorkerStorageControlImplTest, WriteResource) {
     ASSERT_EQ(data_size, result);
   }
 
-  // TODO(crbug.com/1055677): Read the resource and check the response head and
-  // content.
+  mojo::Remote<storage::mojom::ServiceWorkerResourceReader> reader =
+      CreateResourceReader(resource_id);
+
+  // Read the response head, metadata and the content.
+  {
+    ReadResponseHeadResult result = ReadResponseHead(reader.get());
+    ASSERT_GT(result.status, 0);
+
+    EXPECT_EQ(result.response_head->mime_type, "application/javascript");
+    EXPECT_EQ(result.response_head->content_length, data_size);
+    EXPECT_TRUE(result.response_head->ssl_info->is_valid());
+    EXPECT_EQ(result.response_head->ssl_info->cert->serial_number(),
+              ssl_info.cert->serial_number());
+    EXPECT_EQ(result.metadata, base::nullopt);
+
+    std::string data = ReadResponseData(reader.get(), data_size);
+    EXPECT_EQ(data, kData);
+  }
+
+  const auto kMetadata = base::as_bytes(base::make_span("metadata"));
+  int metadata_size = kMetadata.size();
+
+  // Write metadata.
+  {
+    mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter>
+        metadata_writer = CreateResourceMetadataWriter(resource_id);
+    int result = WriteResponseMetadata(metadata_writer.get(),
+                                       mojo_base::BigBuffer(kMetadata));
+    ASSERT_EQ(result, metadata_size);
+  }
+
+  // Read the response head again. This time metadata should be read.
+  {
+    ReadResponseHeadResult result = ReadResponseHead(reader.get());
+    ASSERT_GT(result.status, 0);
+    ASSERT_TRUE(result.metadata.has_value());
+    EXPECT_EQ(result.metadata->size(), kMetadata.size());
+    EXPECT_EQ(
+        memcmp(result.metadata->data(), kMetadata.data(), kMetadata.size()), 0);
+  }
+}
+
+// Tests that storing/getting user data for a registration work.
+TEST_F(ServiceWorkerStorageControlImplTest, StoreAndGetUserData) {
+  const GURL kScope("https://www.example.com/");
+  const GURL kScriptUrl("https://www.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  const int64_t registration_id = GetNewRegistrationId();
+  const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status;
+  status = CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                      kScope, kScriptUrl, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Store user data with two entries.
+  {
+    std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data;
+    user_data.push_back(
+        storage::mojom::ServiceWorkerUserData::New("key1", "value1"));
+    user_data.push_back(
+        storage::mojom::ServiceWorkerUserData::New("key2", "value2"));
+
+    status = StoreUserData(registration_id, kScope.GetOrigin(),
+                           std::move(user_data));
+    ASSERT_EQ(status, DatabaseStatus::kOk);
+  }
+
+  // Get user data.
+  {
+    std::vector<std::string> keys = {"key1", "key2"};
+    GetUserDataResult result = GetUserData(registration_id, keys);
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.values.size(), 2UL);
+    EXPECT_EQ("value1", result.values[0]);
+    EXPECT_EQ("value2", result.values[1]);
+  }
+
+  // Try to get user data with an unknown key should fail.
+  {
+    std::vector<std::string> keys = {"key1", "key2", "key3"};
+    GetUserDataResult result = GetUserData(registration_id, keys);
+    ASSERT_EQ(result.status, DatabaseStatus::kErrorNotFound);
+    EXPECT_EQ(result.values.size(), 0UL);
+  }
+
+  // Clear the first entry.
+  {
+    std::vector<std::string> keys = {"key1"};
+    status = ClearUserData(registration_id, keys);
+    ASSERT_EQ(status, DatabaseStatus::kOk);
+    GetUserDataResult result = GetUserData(registration_id, keys);
+    ASSERT_EQ(result.status, DatabaseStatus::kErrorNotFound);
+    EXPECT_EQ(result.values.size(), 0UL);
+  }
+
+  // Getting the second entry should succeed.
+  {
+    std::vector<std::string> keys = {"key2"};
+    GetUserDataResult result = GetUserData(registration_id, keys);
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.values.size(), 1UL);
+    EXPECT_EQ("value2", result.values[0]);
+  }
+
+  // Delete the registration and store a new registration for the same
+  // scope.
+  const int64_t new_registration_id = GetNewRegistrationId();
+  const int64_t new_version_id = GetNewVersionId();
+  const int64_t new_resource_id = GetNewResourceId();
+  {
+    DeleteRegistrationResult result =
+        DeleteRegistration(registration_id, kScope.GetOrigin());
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+
+    status = CreateAndStoreRegistration(new_registration_id, new_version_id,
+                                        new_resource_id, kScope, kScriptUrl,
+                                        kScriptSize);
+    ASSERT_EQ(status, DatabaseStatus::kOk);
+  }
+
+  // Try to get user data stored for the previous registration should fail.
+  {
+    std::vector<std::string> keys = {"key2"};
+    GetUserDataResult result = GetUserData(new_registration_id, keys);
+    ASSERT_EQ(result.status, DatabaseStatus::kErrorNotFound);
+    EXPECT_EQ(result.values.size(), 0UL);
+  }
+}
+
+// Tests that storing/getting user data by key prefix works.
+TEST_F(ServiceWorkerStorageControlImplTest, StoreAndGetUserDataByKeyPrefix) {
+  const GURL kScope("https://www.example.com/");
+  const GURL kScriptUrl("https://www.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  const int64_t registration_id = GetNewRegistrationId();
+  const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status;
+  status = CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                      kScope, kScriptUrl, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Store some user data with prefixes.
+  std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data;
+  user_data.push_back(
+      storage::mojom::ServiceWorkerUserData::New("prefixA", "value1"));
+  user_data.push_back(
+      storage::mojom::ServiceWorkerUserData::New("prefixA2", "value2"));
+  user_data.push_back(
+      storage::mojom::ServiceWorkerUserData::New("prefixB", "value3"));
+  user_data.push_back(
+      storage::mojom::ServiceWorkerUserData::New("prefixC", "value4"));
+  status =
+      StoreUserData(registration_id, kScope.GetOrigin(), std::move(user_data));
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  {
+    GetUserDataByKeyPrefixResult result =
+        GetUserDataByKeyPrefix(registration_id, "prefix");
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    EXPECT_EQ(result.values.size(), 4UL);
+    EXPECT_EQ(result.values[0], "value1");
+    EXPECT_EQ(result.values[1], "value2");
+    EXPECT_EQ(result.values[2], "value3");
+    EXPECT_EQ(result.values[3], "value4");
+  }
+
+  {
+    GetUserKeysAndDataByKeyPrefixResult result =
+        GetUserKeysAndDataByKeyPrefix(registration_id, "prefix");
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    ASSERT_EQ(result.user_data.size(), 4UL);
+    EXPECT_EQ(result.user_data["A"], "value1");
+    EXPECT_EQ(result.user_data["A2"], "value2");
+    EXPECT_EQ(result.user_data["B"], "value3");
+    EXPECT_EQ(result.user_data["C"], "value4");
+  }
+
+  {
+    GetUserDataByKeyPrefixResult result =
+        GetUserDataByKeyPrefix(registration_id, "prefixA");
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    ASSERT_EQ(result.values.size(), 2UL);
+    EXPECT_EQ(result.values[0], "value1");
+    EXPECT_EQ(result.values[1], "value2");
+  }
+
+  status = ClearUserDataByKeyPrefixes(registration_id, {"prefixA", "prefixC"});
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  {
+    GetUserDataByKeyPrefixResult result =
+        GetUserDataByKeyPrefix(registration_id, "prefix");
+    ASSERT_EQ(result.status, DatabaseStatus::kOk);
+    ASSERT_EQ(result.values.size(), 1UL);
+    EXPECT_EQ(result.values[0], "value3");
+  }
+}
+
+// Tests that storing/getting user data for multiple registrations work.
+TEST_F(ServiceWorkerStorageControlImplTest,
+       StoreAndGetUserDataForAllRegistrations) {
+  const GURL kScope1("https://www.example.com/foo");
+  const GURL kScriptUrl1("https://www.example.com/foo/sw.js");
+  const GURL kScope2("https://www.example.com/bar");
+  const GURL kScriptUrl2("https://www.example.com/bar/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  // Preparation: Create and store two registrations.
+  DatabaseStatus status;
+  const int64_t registration_id1 = GetNewRegistrationId();
+  const int64_t version_id1 = GetNewVersionId();
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  const int64_t registration_id2 = GetNewRegistrationId();
+  const int64_t version_id2 = GetNewVersionId();
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Preparation: Store some user data to registrations. Both registrations have
+  // "key1" and "prefixA" keys.
+  {
+    std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data;
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "key1", "registration1_value1"));
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "key2", "registration1_value2"));
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "prefix1", "registration1_prefix_value1"));
+    status = StoreUserData(registration_id1, kScope1.GetOrigin(),
+                           std::move(user_data));
+    ASSERT_EQ(status, DatabaseStatus::kOk);
+  }
+  {
+    std::vector<storage::mojom::ServiceWorkerUserDataPtr> user_data;
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "key1", "registration2_value1"));
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "key3", "registration2_value3"));
+    user_data.push_back(storage::mojom::ServiceWorkerUserData::New(
+        "prefix2", "registration2_prefix_value2"));
+    status = StoreUserData(registration_id2, kScope2.GetOrigin(),
+                           std::move(user_data));
+    ASSERT_EQ(status, DatabaseStatus::kOk);
+  }
+
+  // Get common user data.
+  GetUserDataForAllRegistrationsResult result;
+  result = GetUserDataForAllRegistrations("key1");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  ASSERT_EQ(result.values.size(), 2UL);
+  EXPECT_EQ(result.values[registration_id1], "registration1_value1");
+  EXPECT_EQ(result.values[registration_id2], "registration2_value1");
+
+  // Get uncommon user data.
+  result = GetUserDataForAllRegistrations("key2");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  ASSERT_EQ(result.values.size(), 1UL);
+  EXPECT_EQ(result.values[registration_id1], "registration1_value2");
+
+  result = GetUserDataForAllRegistrations("key3");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  ASSERT_EQ(result.values.size(), 1UL);
+  EXPECT_EQ(result.values[registration_id2], "registration2_value3");
+
+  // Getting unknown key succeeds but returns an empty value.
+  // TODO(bashi): Make sure this is an intentional behavior. The existing
+  // unittest expects this behavior.
+  result = GetUserDataForAllRegistrations("unknown_key");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  EXPECT_EQ(result.values.size(), 0UL);
+
+  // Clear common user data from one registration then get it again.
+  // This time only one user data should be found.
+  status = ClearUserData(registration_id1, {"key1"});
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  result = GetUserDataForAllRegistrations("key1");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  ASSERT_EQ(result.values.size(), 1UL);
+  EXPECT_EQ(result.values[registration_id2], "registration2_value1");
+
+  // Get prefixed user data.
+  result = GetUserDataForAllRegistrationsByKeyPrefix("prefix");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  ASSERT_EQ(result.values.size(), 2UL);
+  EXPECT_EQ(result.values[registration_id1], "registration1_prefix_value1");
+  EXPECT_EQ(result.values[registration_id2], "registration2_prefix_value2");
+
+  // Clear prefixed user data.
+  status = ClearUserDataForAllRegistrationsByKeyPrefix("prefix");
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  result = GetUserDataForAllRegistrationsByKeyPrefix("prefix");
+  ASSERT_EQ(result.status, DatabaseStatus::kOk);
+  EXPECT_EQ(result.values.size(), 0UL);
+}
+
+// Tests that apply policy updates work.
+TEST_F(ServiceWorkerStorageControlImplTest, ApplyPolicyUpdates) {
+  const GURL kScope1("https://foo.example.com/");
+  const GURL kScriptUrl1("https://foo.example.com/sw.js");
+  const GURL kScope2("https://bar.example.com/");
+  const GURL kScriptUrl2("https://bar.example.com/sw.js");
+  const int64_t kScriptSize = 10;
+
+  LazyInitializeForTest();
+
+  // Preparation: Create and store two registrations.
+  DatabaseStatus status;
+  const int64_t registration_id1 = GetNewRegistrationId();
+  const int64_t version_id1 = GetNewVersionId();
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+  const int64_t registration_id2 = GetNewRegistrationId();
+  const int64_t version_id2 = GetNewVersionId();
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
+  ASSERT_EQ(status, DatabaseStatus::kOk);
+
+  // Update policies to purge the registration for |kScope2| on shutdown.
+  std::vector<storage::mojom::LocalStoragePolicyUpdatePtr> updates;
+  updates.push_back(storage::mojom::LocalStoragePolicyUpdate::New(
+      url::Origin::Create(kScope2.GetOrigin()), /*purge_on_shutdown=*/true));
+  storage()->ApplyPolicyUpdates(std::move(updates));
+
+  // Restart the storage and check the registration for |kScope1| exists
+  // but not for |kScope2|.
+  RestartStorage();
+  {
+    FindRegistrationResult result = FindRegistrationForScope(kScope1);
+    ASSERT_EQ(result->status, DatabaseStatus::kOk);
+  }
+  {
+    FindRegistrationResult result = FindRegistrationForScope(kScope2);
+    ASSERT_EQ(result->status, DatabaseStatus::kErrorNotFound);
+  }
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_storage_unittest.cc b/chromium/content/browser/service_worker/service_worker_storage_unittest.cc
index e20e77fd2d9..281985eedec 100644
--- a/chromium/content/browser/service_worker/service_worker_storage_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_storage_unittest.cc
@@ -13,7 +13,6 @@
 #include "base/bind_helpers.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/test/bind_test_util.h"
@@ -59,6 +58,12 @@ using net::WrappedIOBuffer;
 namespace content {
 namespace service_worker_storage_unittest {
 
+struct ReadResponseHeadResult {
+  int result;
+  network::mojom::URLResponseHeadPtr response_head;
+  scoped_refptr<net::IOBufferWithSize> metadata;
+};
+
 using RegistrationData = storage::mojom::ServiceWorkerRegistrationData;
 using ResourceRecord = storage::mojom::ServiceWorkerResourceRecordPtr;
 
@@ -129,18 +134,16 @@ int WriteResponse(ServiceWorkerStorage* storage,
   std::unique_ptr<ServiceWorkerResponseWriter> writer =
       storage->CreateResponseWriter(id);
 
-  std::unique_ptr<net::HttpResponseInfo> info =
-      std::make_unique<net::HttpResponseInfo>();
-  info->request_time = base::Time::Now();
-  info->response_time = base::Time::Now();
-  info->was_cached = false;
-  info->headers = new net::HttpResponseHeaders(headers);
-  scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(info));
+  auto response_head = network::mojom::URLResponseHead::New();
+  response_head->request_time = base::Time::Now();
+  response_head->response_time = base::Time::Now();
+  response_head->headers = new net::HttpResponseHeaders(headers);
+  response_head->content_length = length;
+
   int rv = 0;
   {
     TestCompletionCallback cb;
-    writer->WriteInfo(info_buffer.get(), cb.callback());
+    writer->WriteResponseHead(*response_head, length, cb.callback());
     rv = cb.WaitForResult();
     if (rv < 0)
       return rv;
@@ -169,14 +172,22 @@ int WriteBasicResponse(ServiceWorkerStorage* storage, int64_t id) {
   return WriteStringResponse(storage, id, headers, std::string(kHttpBody));
 }
 
-int ReadResponseInfo(ServiceWorkerStorage* storage,
-                     int64_t id,
-                     HttpResponseInfoIOBuffer* info_buffer) {
+ReadResponseHeadResult ReadResponseHead(ServiceWorkerStorage* storage,
+                                        int64_t id) {
+  ReadResponseHeadResult out;
+  base::RunLoop loop;
   std::unique_ptr<ServiceWorkerResponseReader> reader =
       storage->CreateResponseReader(id);
-  TestCompletionCallback cb;
-  reader->ReadInfo(info_buffer, cb.callback());
-  return cb.WaitForResult();
+  reader->ReadResponseHead(base::BindLambdaForTesting(
+      [&](int result, network::mojom::URLResponseHeadPtr response_head,
+          scoped_refptr<net::IOBufferWithSize> metadata) {
+        out.result = result;
+        out.response_head = std::move(response_head);
+        out.metadata = std::move(metadata);
+        loop.Quit();
+      }));
+  loop.Run();
+  return out;
 }
 
 bool VerifyBasicResponse(ServiceWorkerStorage* storage,
@@ -185,12 +196,10 @@ bool VerifyBasicResponse(ServiceWorkerStorage* storage,
   const std::string kExpectedHttpBody("Hello");
   std::unique_ptr<ServiceWorkerResponseReader> reader =
       storage->CreateResponseReader(id);
-  scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
-      new HttpResponseInfoIOBuffer();
-  int rv = ReadResponseInfo(storage, id, info_buffer.get());
+  ReadResponseHeadResult out = ReadResponseHead(storage, id);
   if (expected_positive_result)
-    EXPECT_LT(0, rv);
-  if (rv <= 0)
+    EXPECT_LT(0, out.result);
+  if (out.result <= 0)
     return false;
 
   std::string received_body;
@@ -199,19 +208,18 @@ bool VerifyBasicResponse(ServiceWorkerStorage* storage,
       base::MakeRefCounted<IOBuffer>(kBigEnough);
   TestCompletionCallback cb;
   reader->ReadData(buffer.get(), kBigEnough, cb.callback());
-  rv = cb.WaitForResult();
+  int rv = cb.WaitForResult();
   EXPECT_EQ(static_cast<int>(kExpectedHttpBody.size()), rv);
   if (rv <= 0)
     return false;
   received_body.assign(buffer->data(), rv);
 
   bool status_match =
-      std::string("HONKYDORY") ==
-          info_buffer->http_info->headers->GetStatusText();
+      std::string("HONKYDORY") == out.response_head->headers->GetStatusText();
   bool data_match = kExpectedHttpBody == received_body;
 
-  EXPECT_TRUE(status_match);
-  EXPECT_TRUE(data_match);
+  EXPECT_EQ(out.response_head->headers->GetStatusText(), "HONKYDORY");
+  EXPECT_EQ(received_body, kExpectedHttpBody);
   return status_match && data_match;
 }
 
@@ -250,18 +258,10 @@ bool VerifyResponseMetadata(ServiceWorkerStorage* storage,
                             const std::string& expected_metadata) {
   std::unique_ptr<ServiceWorkerResponseReader> reader =
       storage->CreateResponseReader(id);
-  scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
-      new HttpResponseInfoIOBuffer();
-  {
-    TestCompletionCallback cb;
-    reader->ReadInfo(info_buffer.get(), cb.callback());
-    int rv = cb.WaitForResult();
-    EXPECT_LT(0, rv);
-  }
-  const net::HttpResponseInfo* read_head = info_buffer->http_info.get();
-  if (!read_head->metadata.get())
+  ReadResponseHeadResult out = ReadResponseHead(storage, id);
+  if (!out.metadata.get())
     return false;
-  EXPECT_EQ(0, memcmp(expected_metadata.data(), read_head->metadata->data(),
+  EXPECT_EQ(0, memcmp(expected_metadata.data(), out.metadata->data(),
                       expected_metadata.length()));
   return true;
 }
@@ -653,10 +653,8 @@ TEST_F(ServiceWorkerStorageTest, DisabledStorage) {
 
   // Response reader and writer created by the disabled storage should fail to
   // access the disk cache.
-  scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
-      new HttpResponseInfoIOBuffer();
-  EXPECT_EQ(net::ERR_CACHE_MISS,
-            ReadResponseInfo(storage(), kResourceId, info_buffer.get()));
+  ReadResponseHeadResult out = ReadResponseHead(storage(), kResourceId);
+  EXPECT_EQ(net::ERR_CACHE_MISS, out.result);
   EXPECT_EQ(net::ERR_FAILED, WriteBasicResponse(storage(), kResourceId));
   EXPECT_EQ(net::ERR_FAILED,
             WriteResponseMetadata(storage(), kResourceId, "foo"));
@@ -1585,8 +1583,8 @@ TEST_F(ServiceWorkerResourceStorageDiskTest,
   // Create an unrelated opened file in the database directory to make sure such
   // a file does not prevent DeleteAndStartOver on non-Windows platforms.
   base::FilePath file_path;
-  base::ScopedFILE file(base::CreateAndOpenTemporaryFileInDir(
-      storage()->GetDatabasePath(), &file_path));
+  base::ScopedFILE file = base::CreateAndOpenTemporaryStreamInDir(
+      storage()->GetDatabasePath(), &file_path);
   ASSERT_TRUE(file);
   ASSERT_TRUE(base::PathExists(file_path));
 
@@ -1884,7 +1882,7 @@ TEST_F(ServiceWorkerStorageOriginTrialsDiskTest, FromMainScript) {
   response_head.ssl_info->connection_status = 0x300039;
 
   const std::string kHTTPHeaderLine("HTTP/1.1 200 OK\n\n");
-  const std::string kOriginTrial("Origin-Trial: ");
+  const std::string kOriginTrial("Origin-Trial");
   // Token for Feature1 which expires 2033-05-18.
   // generate_token.py valid.example.com Feature1 --expire-timestamp=2000000000
   // TODO(horo): Generate this sample token during the build.
@@ -1913,10 +1911,10 @@ TEST_F(ServiceWorkerStorageOriginTrialsDiskTest, FromMainScript) {
       "ol2RFf+4Sdm1hQ4AAABYeyJvcmlnaW4iOiAiaHR0cHM6Ly92YWxpZC5leGFtcGxlLmNvbTo0"
       "NDMiLCAiZmVhdHVyZSI6ICJGZWF0dXJlMyIsICJleHBpcnkiOiAxMDAwMDAwMDAwfQ==");
   response_head.headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
-  response_head.headers->AddHeader(kOriginTrial + kFeature1Token);
-  response_head.headers->AddHeader(kOriginTrial + kFeature2Token1);
-  response_head.headers->AddHeader(kOriginTrial + kFeature2Token2);
-  response_head.headers->AddHeader(kOriginTrial + kFeature3ExpiredToken);
+  response_head.headers->AddHeader(kOriginTrial, kFeature1Token);
+  response_head.headers->AddHeader(kOriginTrial, kFeature2Token1);
+  response_head.headers->AddHeader(kOriginTrial, kFeature2Token2);
+  response_head.headers->AddHeader(kOriginTrial, kFeature3ExpiredToken);
   version->SetMainScriptResponse(
       std::make_unique<ServiceWorkerVersion::MainScriptResponse>(
           response_head));
diff --git a/chromium/content/browser/service_worker/service_worker_test_utils.cc b/chromium/content/browser/service_worker/service_worker_test_utils.cc
index 6874b503cb7..a99d755c05d 100644
--- a/chromium/content/browser/service_worker/service_worker_test_utils.cc
+++ b/chromium/content/browser/service_worker/service_worker_test_utils.cc
@@ -4,8 +4,12 @@
 
 #include "content/browser/service_worker/service_worker_test_utils.h"
 
+#include <algorithm>
+#include <map>
 #include <memory>
+#include <string>
 #include <utility>
+#include <vector>
 
 #include "base/barrier_closure.h"
 #include "base/run_loop.h"
@@ -102,7 +106,8 @@ class FakeNavigationClient : public mojom::NavigationClient {
   using ReceivedProviderInfoCallback = base::OnceCallback<void(
       blink::mojom::ServiceWorkerProviderInfoForClientPtr)>;
 
-  FakeNavigationClient(ReceivedProviderInfoCallback on_received_callback)
+  explicit FakeNavigationClient(
+      ReceivedProviderInfoCallback on_received_callback)
       : on_received_callback_(std::move(on_received_callback)) {}
   ~FakeNavigationClient() override = default;
 
@@ -211,7 +216,7 @@ void WriteToDiskCacheAsyncInternal(
   http_info->headers =
       base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.0 200 OK\0\0");
   for (const auto& header : headers)
-    http_info->headers->AddHeader(header.first + ": " + header.second);
+    http_info->headers->AddHeader(header.first, header.second);
 
   scoped_refptr<HttpResponseInfoIOBuffer> info_buffer =
       base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(http_info));
@@ -344,9 +349,9 @@ CreateContainerHostAndInfoForWindow(
   info->client_receiver = client_remote.InitWithNewEndpointAndPassReceiver();
   host_receiver = info->host_remote.InitWithNewEndpointAndPassReceiver();
   return std::make_unique<ServiceWorkerContainerHostAndInfo>(
-      ServiceWorkerContainerHost::CreateForWindow(
-          context, are_ancestors_secure, FrameTreeNode::kFrameTreeNodeInvalidId,
-          std::move(host_receiver), std::move(client_remote)),
+      context->CreateContainerHostForWindow(
+          std::move(host_receiver), are_ancestors_secure,
+          std::move(client_remote), FrameTreeNode::kFrameTreeNodeInvalidId),
       std::move(info));
 }
 
@@ -541,6 +546,17 @@ MockServiceWorkerResponseReader::~MockServiceWorkerResponseReader() {}
 void MockServiceWorkerResponseReader::ReadInfo(
     HttpResponseInfoIOBuffer* info_buf,
     net::CompletionOnceCallback callback) {
+  // We need to allocate HttpResponseInfo for
+  // ServiceWorkerCacheCacheWriterTest.CopyScript_Async to pass.
+  // It reads/writes response headers and the current implementation
+  // of ServiceWorkerCacheWriter::WriteInfo() requires a valid
+  // HttpResponseInfo. This workaround will be gone once we remove
+  // HttpResponseInfo dependencies from service worker codebase.
+  DCHECK(!info_buf->http_info);
+  info_buf->http_info = std::make_unique<net::HttpResponseInfo>();
+  info_buf->http_info->headers =
+      base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.0 200 OK\0\0");
+
   DCHECK(!expected_reads_.empty());
   ExpectedRead expected = expected_reads_.front();
   EXPECT_TRUE(expected.info);
@@ -727,13 +743,12 @@ ServiceWorkerUpdateCheckTestUtils::CreatePausedCacheWriter(
       worker_test_helper->context()->storage()->CreateResponseWriter(
           new_resource_id),
       true /* pause_when_not_identical */);
-  auto info = std::make_unique<net::HttpResponseInfo>();
-  info->request_time = base::Time::Now();
-  info->response_time = base::Time::Now();
-  info->was_cached = false;
-  info->headers = base::MakeRefCounted<net::HttpResponseHeaders>(new_headers);
-  cache_writer->headers_to_write_ =
-      base::MakeRefCounted<HttpResponseInfoIOBuffer>(std::move(info));
+  cache_writer->response_head_to_write_ =
+      network::mojom::URLResponseHead::New();
+  cache_writer->response_head_to_write_->request_time = base::Time::Now();
+  cache_writer->response_head_to_write_->response_time = base::Time::Now();
+  cache_writer->response_head_to_write_->headers =
+      base::MakeRefCounted<net::HttpResponseHeaders>(new_headers);
   cache_writer->bytes_compared_ = bytes_compared;
   cache_writer->data_to_write_ = base::MakeRefCounted<net::WrappedIOBuffer>(
       pending_network_buffer ? pending_network_buffer->buffer() : nullptr);
@@ -872,4 +887,50 @@ bool ServiceWorkerUpdateCheckTestUtils::VerifyStoredResponse(
   return true;
 }
 
+void ReadDataPipeInternal(mojo::DataPipeConsumerHandle handle,
+                          std::string* result,
+                          base::OnceClosure quit_closure) {
+  while (true) {
+    uint32_t num_bytes;
+    const void* buffer = nullptr;
+    MojoResult rv =
+        handle.BeginReadData(&buffer, &num_bytes, MOJO_READ_DATA_FLAG_NONE);
+    switch (rv) {
+      case MOJO_RESULT_BUSY:
+      case MOJO_RESULT_INVALID_ARGUMENT:
+        NOTREACHED();
+        return;
+      case MOJO_RESULT_FAILED_PRECONDITION:
+        std::move(quit_closure).Run();
+        return;
+      case MOJO_RESULT_SHOULD_WAIT:
+        base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(&ReadDataPipeInternal, handle, result,
+                                      std::move(quit_closure)));
+        return;
+      case MOJO_RESULT_OK:
+        EXPECT_NE(nullptr, buffer);
+        EXPECT_GT(num_bytes, 0u);
+        uint32_t before_size = result->size();
+        result->append(static_cast<const char*>(buffer), num_bytes);
+        uint32_t read_size = result->size() - before_size;
+        EXPECT_EQ(num_bytes, read_size);
+        rv = handle.EndReadData(read_size);
+        EXPECT_EQ(MOJO_RESULT_OK, rv);
+        break;
+    }
+  }
+  NOTREACHED();
+  return;
+}
+
+std::string ReadDataPipe(mojo::ScopedDataPipeConsumerHandle handle) {
+  EXPECT_TRUE(handle.is_valid());
+  std::string result;
+  base::RunLoop loop;
+  ReadDataPipeInternal(handle.get(), &result, loop.QuitClosure());
+  loop.Run();
+  return result;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_test_utils.h b/chromium/content/browser/service_worker/service_worker_test_utils.h
index 984c9d6bc3f..79e1ec6379e 100644
--- a/chromium/content/browser/service_worker/service_worker_test_utils.h
+++ b/chromium/content/browser/service_worker/service_worker_test_utils.h
@@ -417,6 +417,12 @@ class ServiceWorkerUpdateCheckTestUtils {
                                    const std::string& expected_body);
 };
 
+// Reads all data from the given |handle| and returns data as a string.
+// This is similar to mojo::BlockingCopyToString() but a bit different. This
+// doesn't wait synchronously but keep posting a task when |handle| returns
+// MOJO_RESULT_SHOULD_WAIT.
+std::string ReadDataPipe(mojo::ScopedDataPipeConsumerHandle handle);
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_TEST_UTILS_H_
diff --git a/chromium/content/browser/service_worker/service_worker_type_converters.cc b/chromium/content/browser/service_worker/service_worker_type_converters.cc
index 2bf509b0fea..e38f9a83a3c 100644
--- a/chromium/content/browser/service_worker/service_worker_type_converters.cc
+++ b/chromium/content/browser/service_worker/service_worker_type_converters.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/service_worker/service_worker_type_converters.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 
 namespace mojo {
 
diff --git a/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc b/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
index 6d760888237..5e2fd29c0cb 100644
--- a/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
@@ -12,6 +12,7 @@
 #include "base/numerics/safe_conversions.h"
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_disk_cache_ops.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/loader/url_loader_throttles.h"
 #include "content/browser/service_worker/service_worker_cache_writer.h"
 #include "content/browser/service_worker/service_worker_consts.h"
@@ -183,8 +184,7 @@ ServiceWorkerUpdatedScriptLoader::ServiceWorkerUpdatedScriptLoader(
     mojo::PendingRemote<network::mojom::URLLoaderClient> client,
     scoped_refptr<ServiceWorkerVersion> version)
     : request_url_(original_request.url),
-      resource_type_(static_cast<blink::mojom::ResourceType>(
-          original_request.resource_type)),
+      request_destination_(original_request.destination),
       options_(options),
       version_(std::move(version)),
       network_watcher_(FROM_HERE,
@@ -196,7 +196,8 @@ ServiceWorkerUpdatedScriptLoader::ServiceWorkerUpdatedScriptLoader(
                                base::SequencedTaskRunnerHandle::Get()),
       request_start_(base::TimeTicks::Now()) {
 #if DCHECK_IS_ON()
-  CheckVersionStatusBeforeLoad();
+  service_worker_loader_helpers::CheckVersionStatusBeforeWorkerScriptLoad(
+      version_->status(), request_destination_);
 #endif  // DCHECK_IS_ON()
 
   DCHECK(client_);
@@ -247,6 +248,7 @@ ServiceWorkerUpdatedScriptLoader::~ServiceWorkerUpdatedScriptLoader() = default;
 void ServiceWorkerUpdatedScriptLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   // Resource requests for service worker scripts should not follow redirects.
   // See comments in OnReceiveRedirect().
@@ -335,30 +337,26 @@ void ServiceWorkerUpdatedScriptLoader::OnComplete(
 
 // End of URLLoaderClient ------------------------------------------------------
 
-int ServiceWorkerUpdatedScriptLoader::WillWriteInfo(
-    scoped_refptr<HttpResponseInfoIOBuffer> response_info) {
-  DCHECK(response_info);
-  const net::HttpResponseInfo* info = response_info->http_info.get();
-  DCHECK(info);
+int ServiceWorkerUpdatedScriptLoader::WillWriteResponseHead(
+    const network::mojom::URLResponseHead& response_head) {
+  auto client_response = response_head.Clone();
+  client_response->request_start = request_start_;
 
-  if (resource_type_ == blink::mojom::ResourceType::kServiceWorker) {
+  if (request_destination_ ==
+      network::mojom::RequestDestination::kServiceWorker) {
     version_->SetMainScriptResponse(
-        std::make_unique<ServiceWorkerVersion::MainScriptResponse>(*info));
+        std::make_unique<ServiceWorkerVersion::MainScriptResponse>(
+            *client_response));
   }
 
-  auto response = ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
-      info, options_, request_start_, base::TimeTicks::Now(),
-      response_info->response_data_size);
   // Don't pass SSLInfo to the client when the original request doesn't ask
   // to send it.
-  if (response.head->ssl_info.has_value() &&
+  if (client_response->ssl_info.has_value() &&
       !(options_ & network::mojom::kURLLoadOptionSendSSLInfoWithResponse)) {
-    response.head->ssl_info.reset();
+    client_response->ssl_info.reset();
   }
 
-  client_->OnReceiveResponse(std::move(response.head));
-  if (!response.metadata.empty())
-    client_->OnReceiveCachedMetadata(std::move(response.metadata));
+  client_->OnReceiveResponse(std::move(client_response));
 
   mojo::ScopedDataPipeConsumerHandle client_consumer;
   if (mojo::CreateDataPipe(nullptr, &client_producer_, &client_consumer) !=
@@ -471,25 +469,6 @@ void ServiceWorkerUpdatedScriptLoader::OnCacheWriterResumed(
   network_watcher_.ArmOrNotify();
 }
 
-#if DCHECK_IS_ON()
-void ServiceWorkerUpdatedScriptLoader::CheckVersionStatusBeforeLoad() {
-  DCHECK(version_);
-
-  // ServiceWorkerUpdatedScriptLoader is used for fetching the service worker
-  // main script (RESOURCE_TYPE_SERVICE_WORKER) during worker startup or
-  // importScripts() (RESOURCE_TYPE_SCRIPT).
-  // TODO(nhiroki): In the current implementation, importScripts() can be called
-  // in any ServiceWorkerVersion::Status except for REDUNDANT, but the spec
-  // defines importScripts() works only on the initial script evaluation and the
-  // install event. Update this check once importScripts() is fixed.
-  // (https://crbug.com/719052)
-  DCHECK((resource_type_ == blink::mojom::ResourceType::kServiceWorker &&
-          version_->status() == ServiceWorkerVersion::NEW) ||
-         (resource_type_ == blink::mojom::ResourceType::kScript &&
-          version_->status() != ServiceWorkerVersion::REDUNDANT));
-}
-#endif  // DCHECK_IS_ON()
-
 void ServiceWorkerUpdatedScriptLoader::OnNetworkDataAvailable(MojoResult) {
   DCHECK_EQ(WriterState::kWriting, body_writer_state_);
   DCHECK(network_consumer_.is_valid());
diff --git a/chromium/content/browser/service_worker/service_worker_updated_script_loader.h b/chromium/content/browser/service_worker/service_worker_updated_script_loader.h
index 0d42e8c7e89..0e9b168b015 100644
--- a/chromium/content/browser/service_worker/service_worker_updated_script_loader.h
+++ b/chromium/content/browser/service_worker/service_worker_updated_script_loader.h
@@ -29,7 +29,6 @@ namespace content {
 
 class BrowserContext;
 class ServiceWorkerVersion;
-struct HttpResponseInfoIOBuffer;
 
 // Used only for ServiceWorkerImportedScriptUpdateCheck.
 //
@@ -140,9 +139,11 @@ class CONTENT_EXPORT ServiceWorkerUpdatedScriptLoader final
   ~ServiceWorkerUpdatedScriptLoader() override;
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
@@ -164,8 +165,8 @@ class CONTENT_EXPORT ServiceWorkerUpdatedScriptLoader final
   void OnComplete(const network::URLLoaderCompletionStatus& status) override;
 
   // Implements ServiceWorkerCacheWriter::WriteObserver.
-  int WillWriteInfo(
-      scoped_refptr<HttpResponseInfoIOBuffer> response_info) override;
+  int WillWriteResponseHead(
+      const network::mojom::URLResponseHead& response_head) override;
   int WillWriteData(scoped_refptr<net::IOBuffer> data,
                     int length,
                     base::OnceCallback<void(net::Error)> callback) override;
@@ -213,15 +214,12 @@ class CONTENT_EXPORT ServiceWorkerUpdatedScriptLoader final
       uint32_t consumed_bytes,
       net::Error error);
 
-#if DCHECK_IS_ON()
-  void CheckVersionStatusBeforeLoad();
-#endif  // DCHECK_IS_ON()
-
   const GURL request_url_;
 
-  // This is blink::mojom::ResourceType::kServiceWorker for the main script or
-  // blink::mojom::ResourceType::kScript for an imported script.
-  const blink::mojom::ResourceType resource_type_;
+  // This is network::mojom::RequestDestination::kServiceWorker for the main
+  // script or network::mojom::RequestDestination::kScript for an imported
+  // script.
+  const network::mojom::RequestDestination request_destination_;
 
   // Loader options to pass to the network loader.
   const uint32_t options_;
diff --git a/chromium/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc b/chromium/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc
index 0858faa1f91..20658682e9b 100644
--- a/chromium/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_updated_script_loader_unittest.cc
@@ -126,10 +126,10 @@ class ServiceWorkerUpdatedScriptLoaderTest : public testing::Test {
     network::ResourceRequest request;
     request.url = url;
     request.method = "GET";
-    request.resource_type =
-        static_cast<int>((url == version_->script_url())
-                             ? blink::mojom::ResourceType::kServiceWorker
-                             : blink::mojom::ResourceType::kScript);
+    request.destination =
+        url == version_->script_url()
+            ? network::mojom::RequestDestination::kServiceWorker
+            : network::mojom::RequestDestination::kScript;
 
     *out_client = std::make_unique<network::TestURLLoaderClient>();
     *out_loader = ServiceWorkerUpdatedScriptLoader::CreateAndStart(
@@ -337,7 +337,7 @@ TEST_F(ServiceWorkerUpdatedScriptLoaderTest, NewScriptLargerThanOld) {
 TEST_F(ServiceWorkerUpdatedScriptLoaderTest, NewScriptEmptyBody) {
   const std::string kNewHeaders =
       "HTTP/1.0 200 OK\0Content-Type: text/javascript\0Content-Length: 0\0\0";
-  const std::string kNewData = "";
+  const std::string kNewData;
 
   SetUpComparedScriptInfo(
       0, kNewHeaders, kNewData,
diff --git a/chromium/content/browser/service_worker/service_worker_version.cc b/chromium/content/browser/service_worker/service_worker_version.cc
index abdced415aa..ec5148ecd36 100644
--- a/chromium/content/browser/service_worker/service_worker_version.cc
+++ b/chromium/content/browser/service_worker/service_worker_version.cc
@@ -47,9 +47,10 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/result_codes.h"
+#include "ipc/ipc_message.h"
+#include "mojo/public/c/system/types.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
-#include "net/http/http_response_info.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "third_party/blink/public/common/service_worker/service_worker_type_converters.h"
@@ -212,15 +213,6 @@ constexpr base::TimeDelta ServiceWorkerVersion::kStartNewWorkerTimeout;
 constexpr base::TimeDelta ServiceWorkerVersion::kStopWorkerTimeout;
 
 ServiceWorkerVersion::MainScriptResponse::MainScriptResponse(
-    const net::HttpResponseInfo& http_info) {
-  response_time = http_info.response_time;
-  if (http_info.headers)
-    http_info.headers->GetLastModifiedValue(&last_modified);
-  headers = http_info.headers;
-  ssl_info = http_info.ssl_info;
-}
-
-ServiceWorkerVersion::MainScriptResponse::MainScriptResponse(
     const network::mojom::URLResponseHead& response_head) {
   response_time = response_head.response_time;
   if (response_head.headers)
@@ -376,10 +368,6 @@ void ServiceWorkerVersion::SetStatus(Status status) {
   } else if (status == REDUNDANT) {
     embedded_worker_->OnWorkerVersionDoomed();
 
-    // TODO(crbug.com/951571): Remove this once we figured out the cause of
-    // invalid controller status.
-    redundant_state_callstack_ = base::debug::StackTrace();
-
     // Tell the storage system that this worker's script resources can now be
     // deleted.
     std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources;
@@ -402,11 +390,8 @@ ServiceWorkerVersionInfo ServiceWorkerVersion::GetInfo() {
       embedded_worker()->worker_devtools_agent_route_id());
   for (const auto& controllee : controllee_map_) {
     ServiceWorkerContainerHost* container_host = controllee.second;
-    info.clients.insert(std::make_pair(
-        container_host->client_uuid(),
-        ServiceWorkerClientInfo(
-            container_host->process_id(), container_host->frame_id(),
-            container_host->web_contents_getter(), container_host->type())));
+    info.clients.emplace(container_host->client_uuid(),
+                         container_host->GetServiceWorkerClientInfo());
   }
 
   info.script_response_time = script_response_time_for_devtools_;
@@ -789,13 +774,9 @@ void ServiceWorkerVersion::AddControllee(
 
   // Notify observers asynchronously for consistency with RemoveControllee.
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &ServiceWorkerVersion::NotifyControlleeAdded,
-          weak_factory_.GetWeakPtr(), uuid,
-          ServiceWorkerClientInfo(
-              container_host->process_id(), container_host->frame_id(),
-              container_host->web_contents_getter(), container_host->type())));
+      FROM_HERE, base::BindOnce(&ServiceWorkerVersion::NotifyControlleeAdded,
+                                weak_factory_.GetWeakPtr(), uuid,
+                                container_host->GetServiceWorkerClientInfo()));
 }
 
 void ServiceWorkerVersion::RemoveControllee(const std::string& client_uuid) {
@@ -1024,7 +1005,8 @@ void ServiceWorkerVersion::InitializeGlobalScope(
           ->CreateServiceWorkerRegistrationObjectInfo(std::move(registration)),
       provider_host_->container_host()->CreateServiceWorkerObjectInfoToSend(
           this),
-      fetch_handler_existence_, std::move(subresource_loader_factories));
+      fetch_handler_existence_, std::move(subresource_loader_factories),
+      std::move(reporting_observer_receiver_));
 }
 
 void ServiceWorkerVersion::SetValidOriginTrialTokens(
@@ -1473,8 +1455,7 @@ void ServiceWorkerVersion::FocusClient(const std::string& client_uuid,
     receiver_.reset();
     return;
   }
-  if (container_host->client_type() !=
-      blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!container_host->IsContainerForWindowClient()) {
     // focus() should be called only for WindowClient.
     mojo::ReportBadMessage(
         "Received WindowClient#focus() request for a non-window client.");
@@ -1528,8 +1509,7 @@ void ServiceWorkerVersion::NavigateClient(const std::string& client_uuid,
     receiver_.reset();
     return;
   }
-  if (container_host->client_type() !=
-      blink::mojom::ServiceWorkerClientType::kWindow) {
+  if (!container_host->IsContainerForWindowClient()) {
     // navigate() should be called only for WindowClient.
     mojo::ReportBadMessage(
         "Received WindowClient#navigate() request for a non-window client.");
@@ -2258,9 +2238,11 @@ void ServiceWorkerVersion::CleanUpExternalRequest(
 
 void ServiceWorkerVersion::OnNoWorkInBrowser() {
   DCHECK(!HasWorkInBrowser());
-  if (worker_is_idle_on_renderer_) {
-    for (auto& observer : observers_)
-      observer.OnNoWork(this);
+  if (context_ && worker_is_idle_on_renderer_) {
+    ServiceWorkerRegistration* registration =
+        context_->GetLiveRegistration(registration_id());
+    if (registration)
+      registration->OnNoWork(this);
   }
 }
 
@@ -2280,7 +2262,7 @@ bool ServiceWorkerVersion::IsStartWorkerAllowed() const {
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     if (!GetContentClient()->browser()->AllowServiceWorkerOnUI(
             scope_, scope_, url::Origin::Create(scope_), script_url_,
-            context_->wrapper()->browser_context(), base::NullCallback())) {
+            context_->wrapper()->browser_context())) {
       return false;
     }
   } else {
@@ -2288,7 +2270,7 @@ bool ServiceWorkerVersion::IsStartWorkerAllowed() const {
     if ((context_->wrapper()->resource_context() &&
          !GetContentClient()->browser()->AllowServiceWorkerOnIO(
              scope_, scope_, url::Origin::Create(scope_), script_url_,
-             context_->wrapper()->resource_context(), base::NullCallback()))) {
+             context_->wrapper()->resource_context()))) {
       return false;
     }
   }
@@ -2299,22 +2281,20 @@ bool ServiceWorkerVersion::IsStartWorkerAllowed() const {
 void ServiceWorkerVersion::NotifyControlleeAdded(
     const std::string& uuid,
     const ServiceWorkerClientInfo& info) {
-  for (auto& observer : observers_)
-    observer.OnControlleeAdded(this, uuid, info);
+  if (context_)
+    context_->OnControlleeAdded(this, uuid, info);
 }
 
 void ServiceWorkerVersion::NotifyControlleeRemoved(const std::string& uuid) {
-  // The observers can destroy |this|, so protect it first.
-  // TODO(falken): Make OnNoControllees an explicit call to our registration
-  // instead of an observer callback, if it has dangerous side-effects like
-  // destroying the caller.
+  if (!context_)
+    return;
+
+  // The OnNoControllees() can destroy |this|, so protect it first.
   auto protect = base::WrapRefCounted(this);
-  for (auto& observer : observers_)
-    observer.OnControlleeRemoved(this, uuid);
+  context_->OnControlleeRemoved(this, uuid);
   if (!HasControllee()) {
     RestartTick(&no_controllees_time_);
-    for (auto& observer : observers_)
-      observer.OnNoControllees(this);
+    context_->OnNoControllees(this);
   }
 }
 
diff --git a/chromium/content/browser/service_worker/service_worker_version.h b/chromium/content/browser/service_worker/service_worker_version.h
index 307e7cf914d..3de68c59447 100644
--- a/chromium/content/browser/service_worker/service_worker_version.h
+++ b/chromium/content/browser/service_worker/service_worker_version.h
@@ -62,10 +62,6 @@ namespace blink {
 class PendingURLLoaderFactoryBundle;
 }
 
-namespace net {
-class HttpResponseInfo;
-}
-
 namespace content {
 
 class ServiceWorkerContainerHost;
@@ -156,8 +152,6 @@ class CONTENT_EXPORT ServiceWorkerVersion
 
   // Contains a subset of the main script's response information.
   struct CONTENT_EXPORT MainScriptResponse {
-    // TODO(crbug.com/1060076): Remove this constructor.
-    explicit MainScriptResponse(const net::HttpResponseInfo& http_info);
     explicit MainScriptResponse(
         const network::mojom::URLResponseHead& response_head);
     ~MainScriptResponse();
@@ -188,24 +182,6 @@ class CONTENT_EXPORT ServiceWorkerVersion
         const base::string16& message,
         int line_number,
         const GURL& source_url) {}
-    // OnControlleeAdded/Removed are called asynchronously. It is possible the
-    // provider host identified by |client_uuid| was already destroyed when they
-    // are called.
-    // Note regarding BackForwardCache integration:
-    // OnControlleeRemoved is called when a controllee enters back-forward
-    // cache, and OnControlleeAdded is called when a controllee is restored from
-    // back-forward cache.
-    virtual void OnControlleeAdded(ServiceWorkerVersion* version,
-                                   const std::string& client_uuid,
-                                   const ServiceWorkerClientInfo& client_info) {
-    }
-    virtual void OnControlleeRemoved(ServiceWorkerVersion* version,
-                                     const std::string& client_uuid) {}
-    // Called when all controllees are removed.
-    // Note regarding BackForwardCache integration:
-    // Clients in back-forward cache don't count as controllees.
-    virtual void OnNoControllees(ServiceWorkerVersion* version) {}
-    virtual void OnNoWork(ServiceWorkerVersion* version) {}
     virtual void OnCachedMetadataUpdated(ServiceWorkerVersion* version,
                                          size_t size) {}
 
@@ -599,21 +575,22 @@ class CONTENT_EXPORT ServiceWorkerVersion
       blink::mojom::ConsoleMessageLevel message_level,
       const std::string& message);
 
-  // TODO(crbug.com/951571): Remove once the bug is debugged.
-  const base::debug::StackTrace& redundant_state_callstack() const {
-    return redundant_state_callstack_;
-  }
-
   mojo::AssociatedReceiver<blink::mojom::ServiceWorkerHost>&
   service_worker_host_receiver_for_testing() {
     return receiver_;
   }
 
+  void set_reporting_observer_receiver(
+      mojo::PendingReceiver<blink::mojom::ReportingObserver>
+          reporting_observer_receiver) {
+    reporting_observer_receiver_ = std::move(reporting_observer_receiver);
+  }
+
  private:
   friend class base::RefCounted<ServiceWorkerVersion>;
   friend class EmbeddedWorkerInstanceTest;
   friend class ServiceWorkerPingController;
-  friend class ServiceWorkerProviderHostTest;
+  friend class ServiceWorkerContainerHostTest;
   friend class ServiceWorkerReadFromCacheJobTest;
   friend class ServiceWorkerVersionBrowserTest;
   friend class ServiceWorkerActivationTest;
@@ -627,8 +604,6 @@ class CONTENT_EXPORT ServiceWorkerVersion
   FRIEND_TEST_ALL_PREFIXES(service_worker_controllee_request_handler_unittest::
                                ServiceWorkerControlleeRequestHandlerTest,
                            FallbackWithNoFetchHandler);
-  FRIEND_TEST_ALL_PREFIXES(ServiceWorkerProviderHostTest,
-                           DontSetControllerInDestructor);
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, Register);
   FRIEND_TEST_ALL_PREFIXES(
       service_worker_version_unittest::ServiceWorkerVersionTest,
@@ -1089,16 +1064,15 @@ class CONTENT_EXPORT ServiceWorkerVersion
   blink::mojom::FetchClientSettingsObjectPtr
       outside_fetch_client_settings_object_;
 
-  // TODO(crbug.com/951571): Remove once the bug is debugged.
-  // This is set when this service worker becomes redundant.
-  base::debug::StackTrace redundant_state_callstack_;
-
   // Callback to stop service worker small seconds after all controllees are
   // gone. This callback can be canceled when the service worker starts to
   // control another client and we know the worker needs to be used more.
   // Used only when ServiceWorkerTerminationOnNoControllee is on.
   base::CancelableOnceClosure stop_on_no_controllee_callback_;
 
+  mojo::PendingReceiver<blink::mojom::ReportingObserver>
+      reporting_observer_receiver_;
+
   base::WeakPtrFactory<ServiceWorkerVersion> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerVersion);
diff --git a/chromium/content/browser/service_worker/service_worker_version_browsertest.cc b/chromium/content/browser/service_worker/service_worker_version_browsertest.cc
index 601c5d2eccc..d3705cc8d4c 100644
--- a/chromium/content/browser/service_worker/service_worker_version_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_version_browsertest.cc
@@ -48,6 +48,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/session_history_browsertest.cc b/chromium/content/browser/session_history_browsertest.cc
index df50a8c5607..80fb07cbd0d 100644
--- a/chromium/content/browser/session_history_browsertest.cc
+++ b/chromium/content/browser/session_history_browsertest.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/shape_detection/shape_detection_browsertest.cc b/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
index 00ac3332a4a..2912e10411d 100644
--- a/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
+++ b/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/command_line.h"
 #include "base/strings/string_tokenizer.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/site_instance_impl.cc b/chromium/content/browser/site_instance_impl.cc
index c1eb23c2390..91ae83aaf6a 100644
--- a/chromium/content/browser/site_instance_impl.cc
+++ b/chromium/content/browser/site_instance_impl.cc
@@ -403,7 +403,7 @@ void SiteInstanceImpl::SetSiteAndLockInternal(const GURL& site_url,
   url::Origin site_origin(url::Origin::Create(site_url));
   // At this point, this should be a simple lookup on the master list, since
   // this SiteInstance is new to the BrowsingInstance.
-  bool isolated = policy->DoesOriginRequestOptInIsolation(
+  bool isolated = policy->ShouldOriginGetOptInIsolation(
       browsing_instance_->isolation_context(), site_origin);
   if (isolated) {
     policy->AddOptInIsolatedOriginForBrowsingInstance(
@@ -746,6 +746,14 @@ bool SiteInstanceImpl::DoesSiteForURLMatch(const GURL& url) {
                                         true /* allow_default_site_url */);
 }
 
+void SiteInstanceImpl::PreventOptInOriginIsolation(
+    const url::Origin& previously_visited_origin) {
+  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+  policy->AddNonIsolatedOriginIfNeeded(GetIsolationContext(),
+                                       previously_visited_origin,
+                                       true /* is_global_walk */);
+}
+
 // static
 GURL SiteInstance::GetSiteForURL(BrowserContext* browser_context,
                                  const GURL& url) {
@@ -845,8 +853,7 @@ GURL SiteInstanceImpl::GetSiteForURLInternal(
     // site-keyed SiteInstance, regardless of what the base origin does.
     url::Origin base_origin = url::Origin::Create(site_url);
     if (IsolatedOriginUtil::IsStrictSubdomain(origin, base_origin) &&
-        policy->DoesOriginRequestOptInIsolation(isolation_context,
-                                                base_origin)) {
+        policy->ShouldOriginGetOptInIsolation(isolation_context, base_origin)) {
       return origin.GetURL();
     }
 
@@ -959,8 +966,7 @@ bool SiteInstanceImpl::CanBePlacedInDefaultSiteInstance(
 GURL SiteInstanceImpl::GetSiteForOrigin(const url::Origin& origin) {
   // Only keep the scheme and registered domain of |origin|.
   std::string domain = net::registry_controlled_domains::GetDomainAndRegistry(
-      origin.host(),
-      net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
+      origin, net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   return SchemeAndHostToSite(origin.scheme(),
                              domain.empty() ? origin.host() : domain);
 }
diff --git a/chromium/content/browser/site_instance_impl.h b/chromium/content/browser/site_instance_impl.h
index 85288dac0ac..2fbcc699cc3 100644
--- a/chromium/content/browser/site_instance_impl.h
+++ b/chromium/content/browser/site_instance_impl.h
@@ -348,6 +348,12 @@ class CONTENT_EXPORT SiteInstanceImpl final : public SiteInstance,
   // for this instance (i.e. GetSiteURL()). Otherwise returns false.
   bool DoesSiteForURLMatch(const GURL& url);
 
+  // Adds |origin| as a non-isolated origin within this BrowsingInstance due to
+  // an existing instance at the time of opt-in, so that future instances of it
+  // here won't be origin isolated.
+  void PreventOptInOriginIsolation(
+      const url::Origin& previously_visited_origin);
+
  private:
   friend class BrowsingInstance;
   friend class SiteInstanceTestBrowserClient;
diff --git a/chromium/content/browser/site_per_process_browsertest.cc b/chromium/content/browser/site_per_process_browsertest.cc
index 1e8f9b19e4b..d3b464d4667 100644
--- a/chromium/content/browser/site_per_process_browsertest.cc
+++ b/chromium/content/browser/site_per_process_browsertest.cc
@@ -19,11 +19,13 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/json/json_reader.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/scoped_refptr.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/scoped_observer.h"
@@ -52,9 +54,9 @@
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_navigation_entry.h"
 #include "content/browser/frame_host/frame_tree.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
@@ -84,7 +86,6 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/context_menu_params.h"
-#include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/javascript_dialog_manager.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/notification_observer.h"
@@ -95,6 +96,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/hit_test_region_observer.h"
@@ -117,12 +119,13 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/feature_policy/policy_value.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-test-utils.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
@@ -226,7 +229,8 @@ void NavigateNamedFrame(const ToRenderFrameHost& caller_frame,
 // hit-testing.
 void SimulateMouseClick(RenderWidgetHost* rwh, int x, int y) {
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   mouse_event.SetPositionInWidget(x, y);
@@ -447,12 +451,6 @@ class RenderWidgetHostVisibilityObserver : public RenderWidgetHostObserver {
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostVisibilityObserver);
 };
 
-class TestInterstitialDelegate : public InterstitialPageDelegate {
- private:
-  // InterstitialPageDelegate:
-  std::string GetHTMLContents() override { return "<p>Interstitial</p>"; }
-};
-
 bool ConvertJSONToPoint(const std::string& str, gfx::PointF* point) {
   base::Optional<base::Value> value = base::JSONReader::Read(str);
   if (!value.has_value())
@@ -496,20 +494,15 @@ blink::ParsedFeaturePolicyDeclaration CreateParsedFeaturePolicyDeclaration(
     const std::vector<GURL>& origins) {
   blink::ParsedFeaturePolicyDeclaration declaration;
 
-  const bool matches_all = origins.empty();
-
   declaration.feature = feature;
-  blink::mojom::PolicyValueType feature_type =
-      blink::FeaturePolicy::GetDefaultFeatureList().at(feature).second;
-  declaration.fallback_value =
-      matches_all ? blink::PolicyValue::CreateMaxPolicyValue(feature_type)
-                  : blink::PolicyValue::CreateMinPolicyValue(feature_type);
+  declaration.fallback_value = origins.empty();
   declaration.opaque_value = declaration.fallback_value;
 
   for (const auto& origin : origins)
-    declaration.values.insert(std::pair<url::Origin, blink::PolicyValue>(
-        url::Origin::Create(origin),
-        blink::PolicyValue::CreateMaxPolicyValue(feature_type)));
+    declaration.allowed_origins.push_back(url::Origin::Create(origin));
+
+  std::sort(declaration.allowed_origins.begin(),
+            declaration.allowed_origins.end());
 
   return declaration;
 }
@@ -569,7 +562,7 @@ void LayoutNonRecursiveForTestingViewportIntersection(
 
 void GenerateTapDownGesture(RenderWidgetHost* rwh) {
   blink::WebGestureEvent gesture_tap_down(
-      blink::WebGestureEvent::kGestureTapDown,
+      blink::WebGestureEvent::Type::kGestureTapDown,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -993,55 +986,61 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
 #endif
 
-class TextAutosizerPageInfoObserver : public WebContentsObserver {
+class TextAutosizerPageInfoInterceptor
+    : public blink::mojom::LocalMainFrameHostInterceptorForTesting {
  public:
-  explicit TextAutosizerPageInfoObserver(WebContents* web_contents)
-      : remote_page_info_seen_(false), remote_page_info_({0, 0, 1.f}) {
-    Observe(web_contents);
+  explicit TextAutosizerPageInfoInterceptor(
+      RenderFrameHostImpl* render_frame_host)
+      : render_frame_host_(render_frame_host) {
+    render_frame_host_->local_main_frame_host_receiver_for_testing()
+        .SwapImplForTesting(this);
   }
-  ~TextAutosizerPageInfoObserver() override { Observe(nullptr); }
 
-  bool OnMessageReceived(const IPC::Message& message) override {
-    IPC_BEGIN_MESSAGE_MAP(TextAutosizerPageInfoObserver, message)
-      IPC_MESSAGE_HANDLER(
-          ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame,
-          OnUpdateRemotePageInfo)
-    IPC_END_MESSAGE_MAP()
-    return false;
+  ~TextAutosizerPageInfoInterceptor() override = default;
+
+  LocalMainFrameHost* GetForwardingInterface() override {
+    return render_frame_host_;
   }
 
   void WaitForPageInfo(base::Optional<int> target_main_frame_width,
                        base::Optional<float> target_device_scale_adjustment) {
+    if (remote_page_info_seen_)
+      return;
     target_main_frame_width_ = target_main_frame_width;
     target_device_scale_adjustment_ = target_device_scale_adjustment;
-    remote_page_info_seen_ = false;
     run_loop_ = std::make_unique<base::RunLoop>();
     run_loop_->Run();
     run_loop_.reset();
   }
 
-  const blink::WebTextAutosizerPageInfo& GetTextAutosizerPageInfo() {
-    return remote_page_info_;
+  const blink::mojom::TextAutosizerPageInfo& GetTextAutosizerPageInfo() {
+    return *remote_page_info_;
   }
 
- private:
-  void OnUpdateRemotePageInfo(
-      const blink::WebTextAutosizerPageInfo& remote_page_info) {
-    remote_page_info_ = remote_page_info;
+  void TextAutosizerPageInfoChanged(
+      blink::mojom::TextAutosizerPageInfoPtr remote_page_info) override {
     if ((!target_main_frame_width_ ||
-         remote_page_info.main_frame_width != target_main_frame_width_) &&
+         remote_page_info->main_frame_width != target_main_frame_width_) &&
         (!target_device_scale_adjustment_ ||
-         remote_page_info.device_scale_adjustment !=
+         remote_page_info->device_scale_adjustment !=
              target_device_scale_adjustment_)) {
       return;
     }
+    remote_page_info_ = remote_page_info.Clone();
     remote_page_info_seen_ = true;
     if (run_loop_)
       run_loop_->Quit();
+    GetForwardingInterface()->TextAutosizerPageInfoChanged(
+        std::move(remote_page_info));
   }
 
-  bool remote_page_info_seen_;
-  blink::WebTextAutosizerPageInfo remote_page_info_;
+ private:
+  RenderFrameHostImpl* render_frame_host_;
+  bool remote_page_info_seen_ = false;
+  blink::mojom::TextAutosizerPageInfoPtr remote_page_info_ =
+      blink::mojom::TextAutosizerPageInfo::New(/*main_frame_width=*/0,
+                                               /*main_frame_layout_width=*/0,
+                                               /*device_scale_adjustment=*/1.f);
   std::unique_ptr<base::RunLoop> run_loop_;
   base::Optional<int> target_main_frame_width_;
   base::Optional<float> target_device_scale_adjustment_;
@@ -1126,9 +1125,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TextAutosizerPageInfo) {
   auto* child_rph = static_cast<RenderProcessHostImpl*>(
       b_child->current_frame_host()->GetProcess());
 
-  blink::WebTextAutosizerPageInfo received_page_info;
-  auto observer =
-      std::make_unique<TextAutosizerPageInfoObserver>(web_contents());
+  blink::mojom::TextAutosizerPageInfo received_page_info;
+  auto interceptor = std::make_unique<TextAutosizerPageInfoInterceptor>(
+      web_contents()->GetMainFrame());
 #if defined(OS_ANDROID)
   prefs.device_scale_adjustment += 0.05f;
   OutgoingTextAutosizerPageInfoIPCWatcher ipc_watcher(
@@ -1136,11 +1135,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TextAutosizerPageInfo) {
   // Change the device scale adjustment to trigger a RemotePageInfo update.
   web_contents()->GetRenderViewHost()->UpdateWebkitPreferences(prefs);
   // Make sure we receive a ViewHostMsg from the main frame's renderer.
-  observer->WaitForPageInfo(base::Optional<int>(),
-                            prefs.device_scale_adjustment);
+  interceptor->WaitForPageInfo(base::Optional<int>(),
+                               prefs.device_scale_adjustment);
   // Make sure the correct page message is sent to the child.
   ipc_watcher.WaitForIPC();
-  received_page_info = observer->GetTextAutosizerPageInfo();
+  received_page_info = interceptor->GetTextAutosizerPageInfo();
   EXPECT_EQ(prefs.device_scale_adjustment,
             received_page_info.device_scale_adjustment);
 #else
@@ -1155,10 +1154,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TextAutosizerPageInfo) {
       child_rph, new_bounds.width(), base::Optional<float>());
   view->SetBounds(new_bounds);
   // Make sure we receive a ViewHostMsg from the main frame's renderer.
-  observer->WaitForPageInfo(new_bounds.width(), base::Optional<float>());
+  interceptor->WaitForPageInfo(new_bounds.width(), base::Optional<float>());
   // Make sure the correct page message is sent to the child.
   ipc_watcher.WaitForIPC();
-  received_page_info = observer->GetTextAutosizerPageInfo();
+  received_page_info = interceptor->GetTextAutosizerPageInfo();
   EXPECT_EQ(new_bounds.width(), received_page_info.main_frame_width);
 #endif  // defined(OS_ANDROID)
 
@@ -1191,7 +1190,15 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TextAutosizerPageInfo) {
 
   // Ensure IPC is sent.
   c_ipc_watcher.WaitForIPC();
-  EXPECT_EQ(received_page_info, c_ipc_watcher.GetTextAutosizerPageInfo());
+  // TODO(hferreiro): use the comparison operator when
+  // PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames is migrated to
+  // Mojo.
+  EXPECT_EQ(received_page_info.main_frame_width,
+            c_ipc_watcher.GetTextAutosizerPageInfo().main_frame_width);
+  EXPECT_EQ(received_page_info.main_frame_layout_width,
+            c_ipc_watcher.GetTextAutosizerPageInfo().main_frame_layout_width);
+  EXPECT_EQ(received_page_info.device_scale_adjustment,
+            c_ipc_watcher.GetTextAutosizerPageInfo().device_scale_adjustment);
 }
 
 // Ensure that navigating subframes in --site-per-process mode works and the
@@ -1492,7 +1499,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ViewBoundsInNestedFrameTest) {
   // Scroll the parent frame downward to verify that the child rect gets updated
   // correctly.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
 
   scroll_event.SetPositionInWidget(
@@ -1534,7 +1542,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // The fling start won't bubble since its corresponding GSB hasn't bubbled.
   InputEventAckWaiter gesture_fling_start_ack_observer(
-      child_rwh, blink::WebInputEvent::kGestureFlingStart);
+      child_rwh, blink::WebInputEvent::Type::kGestureFlingStart);
 
   WaitForHitTestData(child_iframe_node->current_frame_host());
 
@@ -1544,7 +1552,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Send a GSB, GSU, GFS sequence and verify that the GFS bubbles.
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -1556,7 +1564,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   child_rwh->ForwardGestureEvent(gesture_scroll_begin);
 
   blink::WebGestureEvent gesture_scroll_update(
-      blink::WebGestureEvent::kGestureScrollUpdate,
+      blink::WebGestureEvent::Type::kGestureScrollUpdate,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -1569,7 +1577,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   child_rwh->ForwardGestureEvent(gesture_scroll_update);
 
   blink::WebGestureEvent gesture_fling_start(
-      blink::WebGestureEvent::kGestureFlingStart,
+      blink::WebGestureEvent::Type::kGestureFlingStart,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -1616,7 +1624,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
 
   InputEventAckWaiter ack_observer(
       parent_iframe_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollEnd);
+      blink::WebInputEvent::Type::kGestureScrollEnd);
 
   // Navigate the nested frame to a page large enough to have scrollbars.
   FrameTreeNode* nested_iframe_node = parent_iframe_node->child_at(0);
@@ -1655,7 +1663,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
 
   // Scroll the parent frame downward.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(1, 1);
   // Use precise pixels to keep these events off the animated scroll pathways,
@@ -1749,7 +1758,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
   // Scroll down the nested iframe via gesture. This requires 3 separate input
   // events.
   blink::WebGestureEvent gesture_event(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchpad);
@@ -1759,7 +1768,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
   rwhv_nested->GetRenderWidgetHost()->ForwardGestureEvent(gesture_event);
 
   gesture_event =
-      blink::WebGestureEvent(blink::WebGestureEvent::kGestureScrollUpdate,
+      blink::WebGestureEvent(blink::WebGestureEvent::Type::kGestureScrollUpdate,
                              blink::WebInputEvent::kNoModifiers,
                              blink::WebInputEvent::GetStaticTimeStampForTests(),
                              blink::WebGestureDevice::kTouchpad);
@@ -1771,7 +1780,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
   rwhv_nested->GetRenderWidgetHost()->ForwardGestureEvent(gesture_event);
 
   gesture_event =
-      blink::WebGestureEvent(blink::WebGestureEvent::kGestureScrollEnd,
+      blink::WebGestureEvent(blink::WebGestureEvent::Type::kGestureScrollEnd,
                              blink::WebInputEvent::kNoModifiers,
                              blink::WebInputEvent::GetStaticTimeStampForTests(),
                              blink::WebGestureDevice::kTouchpad);
@@ -1858,7 +1867,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   EXPECT_DOUBLE_EQ(0.0, initial_y);
 
   NativeWebKeyboardEvent key_event(
-      blink::WebKeyboardEvent::kRawKeyDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebKeyboardEvent::Type::kRawKeyDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   key_event.windows_key_code = ui::VKEY_DOWN;
   key_event.native_key_code =
@@ -1868,7 +1878,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   rwhv_child->GetRenderWidgetHost()->ForwardKeyboardEvent(key_event);
 
-  key_event.SetType(blink::WebKeyboardEvent::kKeyUp);
+  key_event.SetType(blink::WebKeyboardEvent::Type::kKeyUp);
   rwhv_child->GetRenderWidgetHost()->ForwardKeyboardEvent(key_event);
 
   double scrolled_y = 0.0;
@@ -1902,7 +1912,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   GenerateTapDownGesture(child_rwh);
   // Send a GSB to start scrolling sequence.
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gesture_scroll_begin.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
@@ -1915,10 +1925,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Send a GFS and wait for the ack of the first GSU generated from progressing
   // the fling on the browser.
   InputEventAckWaiter gesture_scroll_update_ack_observer(
-      child_rwh, blink::WebInputEvent::kGestureScrollUpdate);
+      child_rwh, blink::WebInputEvent::Type::kGestureScrollUpdate);
   gesture_scroll_update_ack_observer.Reset();
   blink::WebGestureEvent gesture_fling_start(
-      blink::WebGestureEvent::kGestureFlingStart,
+      blink::WebGestureEvent::Type::kGestureFlingStart,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gesture_fling_start.SetSourceDevice(blink::WebGestureDevice::kTouchscreen);
@@ -1946,9 +1956,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TouchpadGestureFlingStart) {
 
   // Send a wheel event with phaseBegan to start scrolling sequence.
   InputEventAckWaiter gesture_scroll_begin_ack_observer(
-      child_rwh, blink::WebInputEvent::kGestureScrollBegin);
+      child_rwh, blink::WebInputEvent::Type::kGestureScrollBegin);
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.delta_units = ui::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
@@ -1960,10 +1971,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TouchpadGestureFlingStart) {
   // Send a GFS and wait for the ack of the first GSU generated from progressing
   // the fling on the browser.
   InputEventAckWaiter gesture_scroll_update_ack_observer(
-      child_rwh, blink::WebInputEvent::kGestureScrollUpdate);
+      child_rwh, blink::WebInputEvent::Type::kGestureScrollUpdate);
   gesture_scroll_update_ack_observer.Reset();
   blink::WebGestureEvent gesture_fling_start(
-      blink::WebGestureEvent::kGestureFlingStart,
+      blink::WebGestureEvent::Type::kGestureFlingStart,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gesture_fling_start.SetSourceDevice(blink::WebGestureDevice::kTouchpad);
@@ -1981,12 +1992,13 @@ class ScrollObserver : public RenderWidgetHost::InputEventObserver {
   ~ScrollObserver() override {}
 
   void OnInputEvent(const blink::WebInputEvent& event) override {
-    if (event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
+    if (event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate) {
       blink::WebGestureEvent received_update =
           *static_cast<const blink::WebGestureEvent*>(&event);
       remaining_delta_x_ -= received_update.data.scroll_update.delta_x;
       remaining_delta_y_ -= received_update.data.scroll_update.delta_y;
-    } else if (event.GetType() == blink::WebInputEvent::kGestureScrollEnd) {
+    } else if (event.GetType() ==
+               blink::WebInputEvent::Type::kGestureScrollEnd) {
       if (message_loop_runner_->loop_running())
         message_loop_runner_->Quit();
       DCHECK_EQ(0, remaining_delta_x_);
@@ -2017,8 +2029,9 @@ class ScrollObserver : public RenderWidgetHost::InputEventObserver {
   DISALLOW_COPY_AND_ASSIGN(ScrollObserver);
 };
 
-// crbug.com/825629
-#if defined(OS_ANDROID)
+// Android: crbug.com/825629
+// NDEBUG: crbug.com/1063045
+#if defined(OS_ANDROID) || defined(NDEBUG)
 #define MAYBE_ScrollBubblingFromNestedOOPIFTest \
   DISABLED_ScrollBubblingFromNestedOOPIFTest
 #else
@@ -2061,7 +2074,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   InputEventAckWaiter ack_observer(
       root->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollBegin);
+      blink::WebInputEvent::Type::kGestureScrollBegin);
 
   std::unique_ptr<ScrollObserver> scroll_observer;
 
@@ -2075,7 +2088,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Now scroll the nested frame upward, this must bubble all the way up to the
   // root.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gfx::Rect bounds = rwhv_nested->GetViewBounds();
   float scale_factor =
@@ -2134,7 +2148,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Now scroll the nested frame downward, this must bubble to the root since
   // the iframe source body is not scrollable.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gfx::Rect bounds = child_view->GetViewBounds();
   float scale_factor =
@@ -2204,11 +2219,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollLocalSubframeInOOPIF) {
   // unconsumed.
   InputEventAckWaiter ack_observer(
       parent_iframe_node->current_frame_host()->GetRenderWidgetHost(),
-      base::BindRepeating([](content::InputEventAckSource,
-                             content::InputEventAckState state,
+      base::BindRepeating([](blink::mojom::InputEventResultSource,
+                             blink::mojom::InputEventResultState state,
                              const blink::WebInputEvent& event) {
-        return event.GetType() == blink::WebGestureEvent::kGestureScrollBegin &&
-               state == content::INPUT_EVENT_ACK_STATE_CONSUMED;
+        return event.GetType() ==
+                   blink::WebGestureEvent::Type::kGestureScrollBegin &&
+               state == blink::mojom::InputEventResultState::kConsumed;
       }));
 
   // Wait until renderer's compositor thread is synced. Otherwise the non fast
@@ -2218,7 +2234,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollLocalSubframeInOOPIF) {
 
   // Now scroll the inner frame downward.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(90, 110);
   scroll_event.delta_units = ui::ScrollGranularity::kScrollByPrecisePixel;
@@ -4320,13 +4337,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DynamicSandboxFlags) {
   EXPECT_EQ(baz_url, observer.last_navigation_url());
 
   // Both frames should not be sandboxed to start with.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
   // Dynamically update sandbox flags for the first frame.
@@ -4339,13 +4356,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, DynamicSandboxFlags) {
   // flags, because sandbox flag updates take place only after navigations.
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Navigate the first frame to a page on the same site.  The new sandbox
@@ -4437,13 +4454,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Check that the current sandbox flags are updated but the effective
   // sandbox flags are not.
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(1)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
   // Navigate the second subframe to a page on bar.com.  This will trigger a
@@ -4490,9 +4507,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
             root->child_at(0)->current_url());
 
   // The frame should not be sandboxed to start with.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Dynamically update the frame's sandbox flags.
@@ -4505,13 +4522,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // because sandbox flag updates take place only after navigations.
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Perform a renderer-initiated same-site navigation in the first frame. The
@@ -4598,13 +4615,14 @@ IN_PROC_BROWSER_TEST_F(
             EvalJs(bottom_child, "Array.from(location.ancestorOrigins);"));
 
   // Check that the sandbox flags in the browser process are correct.
-  // "allow-scripts" resets both WebSandboxFlags::Scripts and
-  // WebSandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kOrigin;
+  // "allow-scripts" resets both network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
+  // blink::parseSandboxPolicy().
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kOrigin;
   EXPECT_EQ(expected_flags,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
@@ -4729,23 +4747,21 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, OriginUpdatesReachProxies) {
   // JavaScript.  Instead, try to navigate the second frame from the first
   // frame.  This should fail with a console error message, which should
   // contain the second frame's updated origin (see blink::Frame::canNavigate).
-  std::unique_ptr<ConsoleObserverDelegate> console_delegate(
-      new ConsoleObserverDelegate(
-          shell()->web_contents(),
-          "Unsafe JavaScript attempt to initiate navigation*"));
-  shell()->web_contents()->SetDelegate(console_delegate.get());
+  WebContentsConsoleObserver console_observer(shell()->web_contents());
+  console_observer.SetPattern(
+      "Unsafe JavaScript attempt to initiate navigation*");
 
   // frames[1] can't be used due to a bug where RemoteFrames are created out of
   // order (https://crbug.com/478792).  Instead, target second frame by name.
   EXPECT_TRUE(ExecuteScript(root->child_at(0),
                             "try { parent.frames['frame2'].location.href = "
                             "'data:text/html,foo'; } catch (e) {}"));
-  console_delegate->Wait();
+  console_observer.Wait();
 
   std::string frame_origin = root->child_at(1)->current_origin().Serialize();
   EXPECT_EQ(frame_origin + "/", frame_url.GetOrigin().spec());
-  EXPECT_TRUE(
-      base::MatchPattern(console_delegate->message(), "*" + frame_origin + "*"))
+  EXPECT_TRUE(base::MatchPattern(console_observer.GetMessageAt(0u),
+                                 "*" + frame_origin + "*"))
       << "Error message does not contain the frame's latest origin ("
       << frame_origin << ")";
 }
@@ -4929,40 +4945,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SubframePostMessage) {
   EXPECT_EQ(1, GetReceivedMessages(root));
 }
 
-// Check that renderer initiated navigations which commit a new RenderFrameHost
-// do not crash if the original RenderFrameHost was being covered by an
-// interstitial. See crbug.com/607964.
-IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
-                       NavigateOpenerWithInterstitial) {
-  EXPECT_TRUE(NavigateToURL(
-      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
-
-  // Open a popup and navigate it to bar.com.
-  ShellAddedObserver new_shell_observer;
-  EXPECT_TRUE(ExecuteScript(web_contents(), "window.open('about:blank');"));
-  Shell* popup = new_shell_observer.GetShell();
-  EXPECT_TRUE(NavigateToURLFromRenderer(
-      popup,
-      embedded_test_server()->GetURL("bar.com", "/navigate_opener.html")));
-
-  // Show an interstitial in the opener.
-  TestInterstitialDelegate* delegate = new TestInterstitialDelegate;
-  WebContentsImpl* opener_contents =
-      static_cast<WebContentsImpl*>(web_contents());
-  GURL interstitial_url("http://interstitial");
-  InterstitialPageImpl* interstitial = new InterstitialPageImpl(
-      opener_contents, static_cast<RenderWidgetHostDelegate*>(opener_contents),
-      true, interstitial_url, delegate);
-  interstitial->Show();
-  WaitForInterstitialAttach(opener_contents);
-
-  // Now, navigate the opener cross-process using the popup while it still has
-  // an interstitial. This should not crash.
-  TestNavigationObserver navigation_observer(opener_contents);
-  EXPECT_TRUE(ExecuteScript(popup, "navigateOpener();"));
-  navigation_observer.Wait();
-}
-
 // Check that postMessage can be sent from a subframe on a cross-process opener
 // tab, and that its event.source points to a valid proxy.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
@@ -5266,9 +5248,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigatePopupToIllegalURL) {
   EXPECT_NE(popup->web_contents()->GetSiteInstance(),
             shell()->web_contents()->GetSiteInstance());
 
-  ConsoleObserverDelegate console_delegate(
-      web_contents(), "Not allowed to load local resource:*");
-  web_contents()->SetDelegate(&console_delegate);
+  WebContentsConsoleObserver console_observer(web_contents());
+  console_observer.SetPattern("Not allowed to load local resource:*");
 
   // From the opener, navigate the popup to a file:/// URL.  This should result
   // in a console error and stay on the old page.
@@ -5276,7 +5257,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigatePopupToIllegalURL) {
   NavigateNamedFrame(shell(), file_url, "foo");
   EXPECT_TRUE(WaitForLoadStop(popup->web_contents()));
   EXPECT_EQ(popup_url, popup->web_contents()->GetLastCommittedURL());
-  EXPECT_TRUE(base::MatchPattern(console_delegate.message(),
+  EXPECT_TRUE(base::MatchPattern(console_observer.GetMessageAt(0u),
                                  "Not allowed to load local resource: file:*"));
 
   // Now try the same test with a chrome:// URL.
@@ -5286,7 +5267,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, NavigatePopupToIllegalURL) {
   EXPECT_TRUE(WaitForLoadStop(popup->web_contents()));
   EXPECT_EQ(popup_url, popup->web_contents()->GetLastCommittedURL());
   EXPECT_TRUE(
-      base::MatchPattern(console_delegate.message(),
+      base::MatchPattern(console_observer.GetMessageAt(1u),
                          std::string("Not allowed to load local resource: ") +
                              kChromeUIScheme + ":*"));
 }
@@ -5641,7 +5622,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Since the FrameHostMsg_Unload_ACK for A->B is dropped, the first page's
   // RenderFrameHost should be pending deletion after the last navigation.
-  EXPECT_FALSE(rfh->is_active());
+  EXPECT_TRUE(rfh->IsPendingDeletion());
 
   // Without the FrameHostMsg_Unload_ACK and timer, the process A will never
   // shutdown. Simulate the process being killed now.
@@ -6150,7 +6131,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // anymore.
   process_a->GetRendererInterface()->CreateFrameProxy(
       new_routing_id, view_routing_id, MSG_ROUTING_NONE, parent_routing_id,
-      FrameReplicationState(), base::UnguessableToken::Create());
+      FrameReplicationState(), base::UnguessableToken::Create(),
+      base::UnguessableToken::Create());
 
   // Ensure the subframe is detached in the browser process.
   observer.Wait();
@@ -6174,7 +6156,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   FrameTreeNode* node = web_contents()->GetFrameTree()->root()->child_at(0);
   EXPECT_TRUE(node);
   EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
-            node->parent()->current_frame_host()->GetSiteInstance());
+            node->parent()->GetSiteInstance());
 
   // Navigate to the site of the parent, but to a page that will not commit.
   GURL same_site_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
@@ -6196,6 +6178,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   int frame_routing_id =
       node->render_manager()->speculative_frame_host()->GetRoutingID();
+  base::UnguessableToken frame_token =
+      node->render_manager()->speculative_frame_host()->frame_token();
   int previous_routing_id =
       node->render_manager()->GetProxyToParent()->GetRoutingID();
 
@@ -6218,6 +6202,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
         shell()->web_contents()->GetMainFrame()->GetRoutingID();
     params->previous_sibling_routing_id = IPC::mojom::kRoutingIdNone;
     params->frame_owner_properties = blink::mojom::FrameOwnerProperties::New();
+    params->frame_token = frame_token;
     params->devtools_frame_token = base::UnguessableToken::Create();
     process->GetRendererInterface()->CreateFrame(std::move(params));
   }
@@ -6248,7 +6233,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ParentDetachRemoteChild) {
   FrameTreeNode* node = contents->GetFrameTree()->root()->child_at(0);
   EXPECT_TRUE(node);
   EXPECT_NE(node->current_frame_host()->GetSiteInstance(),
-            node->parent()->current_frame_host()->GetSiteInstance());
+            node->parent()->GetSiteInstance());
 
   // Grab the routing id of the first child RenderFrameHost and set up a process
   // observer to ensure there is no crash when a new RenderFrame creation is
@@ -6257,11 +6242,16 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ParentDetachRemoteChild) {
   RenderProcessHostWatcher watcher(
       process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   int frame_routing_id = node->current_frame_host()->GetRoutingID();
+  base::UnguessableToken frame_token =
+      node->current_frame_host()->frame_token();
   int widget_routing_id =
       node->current_frame_host()->GetRenderWidgetHost()->GetRoutingID();
   int parent_routing_id =
-      node->parent()->render_manager()->GetRoutingIdForSiteInstance(
-          node->current_frame_host()->GetSiteInstance());
+      node->parent()
+          ->frame_tree_node()
+          ->render_manager()
+          ->GetRoutingIdForSiteInstance(
+              node->current_frame_host()->GetSiteInstance());
 
   // Have the parent frame remove the child frame from its DOM. This should
   // result in the child RenderFrame being deleted in the remote process.
@@ -6297,6 +6287,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ParentDetachRemoteChild) {
                       .InitWithNewEndpointAndPassReceiver());
     params->replication_state.name = "name";
     params->replication_state.unique_name = "name";
+    params->frame_token = frame_token;
     params->devtools_frame_token = base::UnguessableToken::Create();
     process->GetRendererInterface()->CreateFrame(std::move(params));
   }
@@ -6641,15 +6632,16 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SandboxFlagsInheritance) {
       root, "document.querySelector('iframe').sandbox = 'allow-scripts';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
-  // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
+  // network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Navigate child frame so that the sandbox flags take effect.  Use a page
@@ -6696,13 +6688,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // These flags should be pending but not take effect, since there's been no
   // navigation.
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   FrameTreeNode* child = root->child_at(0);
   EXPECT_EQ(expected_flags, child->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             child->effective_frame_policy().sandbox_flags);
 
   // Add a new grandchild frame and navigate it cross-site.
@@ -6719,9 +6711,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Since the update flags haven't yet taken effect in its parent, this
   // grandchild frame should not be sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             grandchild->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             grandchild->effective_frame_policy().sandbox_flags);
 
   // Check that the grandchild frame isn't sandboxed on the renderer side.  If
@@ -6748,13 +6740,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                      "    'allow-scripts allow-popups';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
-  // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
+  // network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kPopups;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kPopups;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
 
@@ -6858,14 +6851,15 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       "    'allow-scripts allow-popups allow-popups-to-escape-sandbox';"));
 
   // Set expected flags for the child frame.  Note that "allow-scripts" resets
-  // both WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits
-  // per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kPopups &
-      ~blink::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
+  // both network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
+  // blink::parseSandboxPolicy().
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kPopups &
+      ~network::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
 
@@ -6889,7 +6883,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Check that the sandbox flags for new popup are correct in the browser
   // process.  They should not have been inherited.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             foo_root->effective_frame_policy().sandbox_flags);
 
   // The popup's origin should match |b_url|, since it's not sandboxed.
@@ -7203,7 +7197,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
     // navigation.
     EXPECT_EQ(c_url.GetOrigin().spec(),
               root->child_at(0)->current_origin().Serialize() + "/");
-    EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+    EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
               root->child_at(0)->effective_frame_policy().sandbox_flags);
   }
 }
@@ -8151,7 +8145,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Wait for and then drop the ViewHostMsg_ShowWidget messages, so that both
   // widgets are left in pending-but-not-shown state.
   NativeWebKeyboardEvent event(
-      blink::WebKeyboardEvent::kChar, blink::WebInputEvent::kNoModifiers,
+      blink::WebKeyboardEvent::Type::kChar, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   event.text[0] = ' ';
 
@@ -8559,7 +8553,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // At this point, the subframe's old RFH for b.com should be pending
   // deletion, and the subframe's proxy in a.com should've been cleared.
-  EXPECT_FALSE(child_rfh->is_active());
+  EXPECT_TRUE(child_rfh->IsPendingDeletion());
   EXPECT_FALSE(child->render_manager()->GetProxyToParent());
 
   // Simulate that the load event is dispatched from |child_rfh| just after
@@ -9285,8 +9279,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // origin.
   const blink::ParsedFeaturePolicy initial_effective_policy =
       root->child_at(2)->effective_frame_policy().container_policy;
-  EXPECT_EQ(1UL, initial_effective_policy[0].values.size());
-  EXPECT_FALSE(initial_effective_policy[0].values.begin()->first.opaque());
+  EXPECT_EQ(1UL, initial_effective_policy[0].allowed_origins.size());
+  EXPECT_FALSE(initial_effective_policy[0].allowed_origins.begin()->opaque());
 
   // Set the "sandbox" attribute; pending policy should update, and should now
   // be flagged as matching the opaque origin of the frame (without containing
@@ -9298,17 +9292,17 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       root->child_at(2)->effective_frame_policy().container_policy;
   const blink::ParsedFeaturePolicy updated_pending_policy =
       root->child_at(2)->pending_frame_policy().container_policy;
-  EXPECT_EQ(1UL, updated_effective_policy[0].values.size());
-  EXPECT_FALSE(updated_effective_policy[0].values.begin()->first.opaque());
-  EXPECT_GE(updated_pending_policy[0].opaque_value, blink::PolicyValue(true));
-  EXPECT_EQ(0UL, updated_pending_policy[0].values.size());
+  EXPECT_EQ(1UL, updated_effective_policy[0].allowed_origins.size());
+  EXPECT_FALSE(updated_effective_policy[0].allowed_origins.begin()->opaque());
+  EXPECT_TRUE(updated_pending_policy[0].opaque_value);
+  EXPECT_EQ(0UL, updated_pending_policy[0].allowed_origins.size());
 
   // Navigate the frame; pending policy should now be committed.
   NavigateFrameToURL(root->child_at(2), nav_url);
   const blink::ParsedFeaturePolicy final_effective_policy =
       root->child_at(2)->effective_frame_policy().container_policy;
-  EXPECT_GE(final_effective_policy[0].opaque_value, blink::PolicyValue(true));
-  EXPECT_EQ(0UL, final_effective_policy[0].values.size());
+  EXPECT_TRUE(final_effective_policy[0].opaque_value);
+  EXPECT_EQ(0UL, final_effective_policy[0].allowed_origins.size());
 }
 
 // Test that creating a new remote frame at the same origin as its parent
@@ -10487,24 +10481,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TestChildProcessImportance) {
   EXPECT_NE(old_root_process_id, new_root_process_id);
   EXPECT_EQ(ChildProcessImportance::IMPORTANT,
             root->current_frame_host()->GetProcess()->GetEffectiveImportance());
-
-  // Check interstitial maintains importance.
-  TestInterstitialDelegate* delegate = new TestInterstitialDelegate;
-  WebContentsImpl* contents_impl =
-      static_cast<WebContentsImpl*>(web_contents());
-  GURL interstitial_url("http://interstitial");
-  InterstitialPageImpl* interstitial = new InterstitialPageImpl(
-      contents_impl, contents_impl, true, interstitial_url, delegate);
-  interstitial->Show();
-  WaitForInterstitialAttach(contents_impl);
-  RenderProcessHost* interstitial_process =
-      interstitial->GetMainFrame()->GetProcess();
-  EXPECT_EQ(ChildProcessImportance::IMPORTANT,
-            interstitial_process->GetEffectiveImportance());
-
-  web_contents()->SetMainFrameImportance(ChildProcessImportance::MODERATE);
-  EXPECT_EQ(ChildProcessImportance::MODERATE,
-            interstitial_process->GetEffectiveImportance());
 }
 
 // Tests for Android TouchSelectionEditing.
@@ -10939,7 +10915,7 @@ IN_PROC_BROWSER_TEST_F(TouchSelectionControllerClientAndroidSiteIsolationTest,
   auto* host =
       static_cast<RenderWidgetHostImpl*>(root_rwhv()->GetRenderWidgetHost());
   InputEventAckWaiter gesture_pinch_end_waiter(
-      host, blink::WebInputEvent::kGesturePinchEnd);
+      host, blink::WebInputEvent::Type::kGesturePinchEnd);
   host->QueueSyntheticGesture(
       std::move(synthetic_pinch_gesture),
       base::BindOnce(&TouchSelectionControllerClientAndroidSiteIsolationTest::
@@ -10976,8 +10952,8 @@ class TouchEventObserver : public RenderWidgetHost::InputEventObserver {
     outgoing_touch_event_ids_->push_back(touch_event.unique_touch_event_id);
   }
 
-  void OnInputEventAck(InputEventAckSource source,
-                       InputEventAckState state,
+  void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                       blink::mojom::InputEventResultState state,
                        const blink::WebInputEvent& event) override {
     if (!blink::WebInputEvent::IsTouchEventType(event.GetType()))
       return;
@@ -11048,11 +11024,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   child_host->AddInputEventObserver(&child_touch_event_observer);
 
   InputEventAckWaiter root_ack_waiter(root_host,
-                                      blink::WebInputEvent::kTouchEnd);
+                                      blink::WebInputEvent::Type::kTouchEnd);
   InputEventAckWaiter child_ack_waiter(child_host,
-                                       blink::WebInputEvent::kTouchEnd);
+                                       blink::WebInputEvent::Type::kTouchEnd);
   InputEventAckWaiter child_gesture_tap_ack_waiter(
-      child_host, blink::WebInputEvent::kGestureTap);
+      child_host, blink::WebInputEvent::Type::kGestureTap);
 
   // Create GestureTap for child.
   gfx::PointF child_tap_point;
@@ -11198,7 +11174,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 #endif
 
   // Send pinch gesture and verify we receive the ack.
-  InputEventAckWaiter ack_waiter(host, blink::WebInputEvent::kGesturePinchEnd);
+  InputEventAckWaiter ack_waiter(host,
+                                 blink::WebInputEvent::Type::kGesturePinchEnd);
   host->QueueSyntheticGesture(
       std::move(synthetic_pinch_gesture),
       base::BindOnce([](SyntheticGesture::Result result) {
@@ -11250,38 +11227,38 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Main page is served with a CSP header applying sandbox flags allow-popups,
   // allow-pointer-lock and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->active_sandbox_flags());
 
   // Child frame has iframe sandbox flags allow-popups, allow-scripts, and
   // allow-orientation-lock. It should receive the intersection of those with
   // the parent sandbox flags: allow-popups and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Document in child frame is served with a CSP header giving sandbox flags
   // allow-scripts, allow-popups and allow-pointer-lock. The final effective
   // flags should only include allow-scripts and allow-popups.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
 
   // Navigate the child frame to a new page. This should clear any CSP-applied
@@ -11294,20 +11271,20 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Navigating should reset the sandbox flags to the frame owner flags:
   // allow-popups and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 }
 
@@ -11327,11 +11304,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       static_cast<WebContentsImpl*>(shell()->web_contents())->GetMainFrame();
 
   // Check sandbox flags on RFH before navigating away.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             rfh->active_sandbox_flags());
 
   // Set up a slow unload handler to force the RFH to linger in the unloaded but
@@ -11352,19 +11329,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // The previous RFH should still be pending deletion, as we wait for either
   // the FrameHostMsg_Unload_ACK or a timeout.
   ASSERT_TRUE(rfh->IsRenderFrameLive());
-  ASSERT_FALSE(rfh->is_active());
+  ASSERT_TRUE(rfh->IsPendingDeletion());
   ASSERT_FALSE(rfh_observer.deleted());
 
   // Check sandbox flags on old RFH -- they should be unchanged.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             rfh->active_sandbox_flags());
 
   // The FrameTreeNode should have flags which represent the new state.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
 }
 
@@ -11431,9 +11408,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11466,9 +11443,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11519,9 +11496,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11547,9 +11524,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   NavigateFrameToURL(root->child_at(0)->child_at(0),
                      embedded_test_server()->GetURL("foo.com", "/title2.html"));
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11580,31 +11557,31 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // The second child has both iframe-attribute sandbox flags and CSP-set flags.
   // Verify that it the flags are combined correctly in the frame tree.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->active_sandbox_flags());
 
   NavigateFrameToURL(
       root->child_at(1),
       embedded_test_server()->GetURL("bar.com", "/sandboxed_child_frame.html"));
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->active_sandbox_flags());
 
   // Remove the sandbox attribute from the child frame.
@@ -11623,14 +11600,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
           "bar.com", "/cross_site_iframe_factory.html?bar(foo)"));
 
   // Check the sandbox flags on the child frame in the browser process.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->active_sandbox_flags());
 
   // Check the sandbox flags on the grandchid frame in the browser process.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags::kNone,
       root->child_at(1)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(1)->child_at(0)->active_sandbox_flags(),
@@ -11983,7 +11960,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // The old RenderFrameHost is now pending deletion.
   ASSERT_TRUE(rfh->IsRenderFrameLive());
-  ASSERT_FALSE(rfh->is_active());
+  ASSERT_TRUE(rfh->IsPendingDeletion());
 
   // Kill the b.com process.
   RenderProcessHost* b_process = popup_contents->GetMainFrame()->GetProcess();
@@ -12378,7 +12355,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       shell(), embedded_test_server()->GetURL("b.com", "/title3.html")));
 
   // The old RFH should be pending deletion.
-  EXPECT_FALSE(rfh->is_active());
+  EXPECT_TRUE(rfh->IsPendingDeletion());
   EXPECT_FALSE(rfh->IsCurrent());
   EXPECT_NE(rfh, web_contents()->GetMainFrame());
 
@@ -12588,7 +12565,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   }
 
   scoped_refptr<ShowWidgetMessageFilter> show_widget_filter =
-      new ShowWidgetMessageFilter();
+      base::MakeRefCounted<ShowWidgetMessageFilter>(web_contents());
+  base::ScopedClosureRunner shutdown_show_widget_filter(
+      base::BindOnce(&ShowWidgetMessageFilter::Shutdown, show_widget_filter));
   child_node->current_frame_host()->GetProcess()->AddFilter(
       show_widget_filter.get());
 
@@ -12647,7 +12626,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // listener manager records that its in a scroll.
   {
     blink::WebGestureEvent gesture_scroll_begin(
-        blink::WebGestureEvent::kGestureScrollBegin,
+        blink::WebGestureEvent::Type::kGestureScrollBegin,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -12659,7 +12638,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
     gesture_scroll_begin.data.scroll_begin.delta_y_hint = -5.f;
 
     blink::WebMouseEvent mouse_move(
-        blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kMouseMove,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
 
     // We wait for the dummy mouse move event since the GestureScrollEnd ACK is
@@ -12668,8 +12648,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
     // Thus we send a second event and when it's ACK'd we know the first has
     // already been processed (we do the same thing above but with a
     // ScrollUpdate).
-    InputEventAckWaiter mouse_move_waiter(child_rwh,
-                                          blink::WebInputEvent::kMouseMove);
+    InputEventAckWaiter mouse_move_waiter(
+        child_rwh, blink::WebInputEvent::Type::kMouseMove);
 
     child_rwh->ForwardGestureEvent(gesture_scroll_begin);
     child_rwh->ForwardMouseEvent(mouse_move);
@@ -12682,18 +12662,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Finish the scroll, ensure the gesture manager sees the scroll end.
   {
     blink::WebGestureEvent gesture_scroll_end(
-        blink::WebGestureEvent::kGestureScrollEnd,
+        blink::WebGestureEvent::Type::kGestureScrollEnd,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
 
     // See comment above for why this is sent.
     blink::WebMouseEvent mouse_move(
-        blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kMouseMove,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
 
-    InputEventAckWaiter mouse_move_waiter(child_rwh,
-                                          blink::WebInputEvent::kMouseMove);
+    InputEventAckWaiter mouse_move_waiter(
+        child_rwh, blink::WebInputEvent::Type::kMouseMove);
 
     child_rwh->ForwardGestureEvent(gesture_scroll_end);
     child_rwh->ForwardMouseEvent(mouse_move);
@@ -12930,9 +12911,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
 class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
  public:
-  SitePerProcessBrowserTouchActionTest()
-      : compositor_touch_action_enabled_(
-            base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {}
+  SitePerProcessBrowserTouchActionTest() = default;
 
   bool GetTouchActionForceEnableZoom(RenderWidgetHost* rwh) {
     InputRouterImpl* input_router = static_cast<InputRouterImpl*>(
@@ -12954,12 +12933,12 @@ class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
       base::Optional<cc::TouchAction>& whitelisted_touch_action) {
     InputEventAckWaiter ack_observer(
         rwhv_child->GetRenderWidgetHost(),
-        base::BindRepeating([](content::InputEventAckSource source,
-                               content::InputEventAckState state,
+        base::BindRepeating([](blink::mojom::InputEventResultSource source,
+                               blink::mojom::InputEventResultState state,
                                const blink::WebInputEvent& event) {
-          return event.GetType() == blink::WebGestureEvent::kTouchStart ||
-                 event.GetType() == blink::WebGestureEvent::kTouchMove ||
-                 event.GetType() == blink::WebGestureEvent::kTouchEnd;
+          return event.GetType() == blink::WebGestureEvent::Type::kTouchStart ||
+                 event.GetType() == blink::WebGestureEvent::Type::kTouchMove ||
+                 event.GetType() == blink::WebGestureEvent::Type::kTouchEnd;
         }));
 
     InputRouterImpl* input_router = static_cast<InputRouterImpl*>(
@@ -12985,15 +12964,6 @@ class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
     // touch start arrived because the ACK is from the main thread.
     whitelisted_touch_action =
         input_router->touch_action_filter_.white_listed_touch_action_;
-    // When flag is enabled, we may not have the value for the effective touch
-    // action when ack is received.
-    if (!compositor_touch_action_enabled_) {
-      while (!effective_touch_action.has_value()) {
-        GiveItSomeTime(TestTimeouts::tiny_timeout());
-        effective_touch_action =
-            input_router->touch_action_filter_.allowed_touch_action_;
-      }
-    }
 
     // Send a touch move and touch end to complete the sequence, this also
     // avoids triggering DCHECKs when sending followup events.
@@ -13036,9 +13006,6 @@ class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
     // thread, upon return it should have handled any touch action update.
     root_thread_observer->Wait();
   }
-
- protected:
-  const bool compositor_touch_action_enabled_;
 };
 
 #if defined(OS_ANDROID)
@@ -13162,11 +13129,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
   // TouchAction::kAuto in iframe's child.
   GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
                           effective_touch_action, whitelisted_touch_action);
-  if (!compositor_touch_action_enabled_) {
-    EXPECT_EQ(expected_touch_action, effective_touch_action.has_value()
-                                         ? effective_touch_action.value()
-                                         : cc::TouchAction::kAuto);
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 
@@ -13177,11 +13139,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
   expected_touch_action = cc::TouchAction::kAuto;
   GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
                           effective_touch_action, whitelisted_touch_action);
-  if (compositor_touch_action_enabled_) {
-    EXPECT_EQ(expected_touch_action, effective_touch_action.has_value()
-                                         ? effective_touch_action.value()
-                                         : cc::TouchAction::kAuto);
-  }
+  EXPECT_EQ(expected_touch_action, effective_touch_action.has_value()
+                                       ? effective_touch_action.value()
+                                       : cc::TouchAction::kAuto);
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 }
@@ -13248,17 +13208,6 @@ IN_PROC_BROWSER_TEST_F(
   cc::TouchAction effective_touch_action_result =
       effective_touch_action.has_value() ? effective_touch_action.value()
                                          : cc::TouchAction::kAuto;
-  // TouchAction might have not been propagated to child frames yet, loop until
-  // we get the expected touch action value.
-  if (!compositor_touch_action_enabled_) {
-    while (expected_touch_action != effective_touch_action_result) {
-      GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
-                              effective_touch_action, whitelisted_touch_action);
-      effective_touch_action_result = effective_touch_action.has_value()
-                                          ? effective_touch_action.value()
-                                          : cc::TouchAction::kAuto;
-    }
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 
@@ -13275,15 +13224,6 @@ IN_PROC_BROWSER_TEST_F(
   effective_touch_action_result = effective_touch_action.has_value()
                                       ? effective_touch_action.value()
                                       : cc::TouchAction::kAuto;
-  if (!compositor_touch_action_enabled_) {
-    while (expected_touch_action != effective_touch_action_result) {
-      GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
-                              effective_touch_action, whitelisted_touch_action);
-      effective_touch_action_result = effective_touch_action.has_value()
-                                          ? effective_touch_action.value()
-                                          : cc::TouchAction::kAuto;
-    }
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 
@@ -13299,15 +13239,6 @@ IN_PROC_BROWSER_TEST_F(
   effective_touch_action_result = effective_touch_action.has_value()
                                       ? effective_touch_action.value()
                                       : cc::TouchAction::kAuto;
-  if (!compositor_touch_action_enabled_) {
-    while (expected_touch_action != effective_touch_action_result) {
-      GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
-                              effective_touch_action, whitelisted_touch_action);
-      effective_touch_action_result = effective_touch_action.has_value()
-                                          ? effective_touch_action.value()
-                                          : cc::TouchAction::kAuto;
-    }
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 }
@@ -13363,11 +13294,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
   cc::TouchAction expected_touch_action = cc::TouchAction::kPan;
   GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
                           effective_touch_action, whitelisted_touch_action);
-  if (!compositor_touch_action_enabled_) {
-    EXPECT_EQ(expected_touch_action, effective_touch_action.has_value()
-                                         ? effective_touch_action.value()
-                                         : cc::TouchAction::kAuto);
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 
@@ -13391,11 +13317,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
                             child_thread_observer.get());
   GetTouchActionsForChild(router, rwhv_root, rwhv_child, point_inside_child,
                           effective_touch_action, whitelisted_touch_action);
-  if (!compositor_touch_action_enabled_) {
-    EXPECT_EQ(expected_touch_action, effective_touch_action.has_value()
-                                         ? effective_touch_action.value()
-                                         : cc::TouchAction::kAuto);
-  }
   if (whitelisted_touch_action.has_value())
     EXPECT_EQ(expected_touch_action, whitelisted_touch_action.value());
 }
@@ -14004,9 +13925,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   FrameTreeNode* subframe = root->child_at(0);
 
   // The subframe should not be sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Set the "sandbox" attribute on the subframe; pending policy should update.
@@ -14014,12 +13935,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       root, "document.querySelector('iframe').sandbox = 'allow-scripts';"));
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::ParseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Commit a same-document navigation with replaceState.  The new sandbox
@@ -14030,7 +13951,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   replace_state_observer.Wait();
 
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Also try a same-document navigation to a fragment, which also shouldn't
@@ -14045,7 +13966,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   }
 
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 }
 
@@ -14159,7 +14080,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   commit_observer.WaitForCommit();
 
   // At this point, popup's original RFH is pending deletion.
-  EXPECT_FALSE(rfh->is_active());
+  EXPECT_TRUE(rfh->IsPendingDeletion());
 
   // When the opener receives a postMessage from the popup's unload handler, it
   // should start a navigation back to b.com.  Wait for it.  This navigation
@@ -14372,15 +14293,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   GURL original_frame_url(child->current_frame_host()->GetLastCommittedURL());
   EXPECT_EQ("b.com", original_frame_url.host());
 
-  ConsoleObserverDelegate console_delegate(
-      web_contents(), "Not allowed to load local resource: file:*");
-  web_contents()->SetDelegate(&console_delegate);
+  WebContentsConsoleObserver console_observer(web_contents());
+  console_observer.SetPattern("Not allowed to load local resource: file:*");
 
   GURL file_url("file:///");
   EXPECT_TRUE(
       ExecJs(web_contents(),
              JsReplace("document.querySelector('iframe').src = $1", file_url)));
-  console_delegate.Wait();
+  console_observer.Wait();
 
   // The iframe should've stayed at the original URL.
   EXPECT_EQ(original_frame_url,
@@ -14466,7 +14386,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Queue the event and wait for it to be acked.
   InputEventAckWaiter ack_waiter(
       child_b->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureDoubleTap);
+      blink::WebInputEvent::Type::kGestureDoubleTap);
   auto* host = static_cast<RenderWidgetHostImpl*>(
       root->current_frame_host()->GetRenderWidgetHost());
   host->QueueSyntheticGesture(
@@ -14853,9 +14773,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   RenderFrameHostImpl* rfh_c =
       rfh_b->frame_tree_node()->render_manager()->speculative_frame_host();
 
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_c->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kSpeculative,
+            rfh_c->lifecycle_state());
 
   // 3) Deletion of B. The unload handler takes times to execute.
   RenderFrameDeletedObserver delete_b(rfh_b), delete_c(rfh_c);
@@ -14863,8 +14786,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       ExecJs(rfh_a, JsReplace("document.querySelector('iframe').remove();")));
   EXPECT_FALSE(delete_b.deleted());
   EXPECT_TRUE(delete_c.deleted());  // The speculative RFH is deleted.
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_b->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_b->lifecycle_state());
 
   // The navigation has been canceled.
   navigation_observer.WaitForNavigationFinished();
@@ -14906,10 +14831,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   RenderFrameHostImpl* rfh_d =
       rfh_c->frame_tree_node()->render_manager()->speculative_frame_host();
 
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_c->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_d->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_c->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kSpeculative,
+            rfh_d->lifecycle_state());
 
   // 3) Deletion of D. The unload handler takes times to execute.
   RenderFrameDeletedObserver delete_b(rfh_b), delete_c(rfh_c), delete_d(rfh_d);
@@ -14918,9 +14847,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   EXPECT_FALSE(delete_b.deleted());
   EXPECT_FALSE(delete_c.deleted());
   EXPECT_TRUE(delete_d.deleted());  // The speculative RFH is deleted.
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::Completed, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_c->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kReadyToBeDeleted,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_c->lifecycle_state());
 
   // The navigation has been canceled.
   navigation_observer.WaitForNavigationFinished();
@@ -15100,8 +15032,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   // Send pinch gesture and verify we receive the ack.
   {
-    InputEventAckWaiter ack_waiter(host,
-                                   blink::WebInputEvent::kGesturePinchEnd);
+    InputEventAckWaiter ack_waiter(
+        host, blink::WebInputEvent::Type::kGesturePinchEnd);
     host->QueueSyntheticGesture(
         std::move(synthetic_pinch_gesture),
         base::BindOnce([](SyntheticGesture::Result result) {
@@ -15166,8 +15098,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   {
     auto* child_host = static_cast<RenderWidgetHostImpl*>(
         child->current_frame_host()->GetRenderWidgetHost());
-    InputEventAckWaiter ack_waiter(child_host,
-                                   blink::WebInputEvent::kGestureScrollEnd);
+    InputEventAckWaiter ack_waiter(
+        child_host, blink::WebInputEvent::Type::kGestureScrollEnd);
     host->QueueSyntheticGesture(
         std::move(synthetic_scroll_gesture),
         base::BindOnce([](SyntheticGesture::Result result) {
@@ -15253,18 +15185,18 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicySandboxTest,
           "a.com",
           "/cross_site_iframe_factory.html?a(b{sandbox-allow-scripts})")));
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   // Validate sandbox flags bit-by-bit. This is equivalent to an equality check
   // when FeaturePolicyForSandbox is disabled, but when that feature is enabled,
   // this will check the appropriate policy-controlled feature for each expected
   // sandbox flag.
-  for (unsigned bit = 0; bit < sizeof(blink::mojom::WebSandboxFlags) * 8;
+  for (unsigned bit = 0; bit < sizeof(network::mojom::WebSandboxFlags) * 8;
        bit++) {
-    blink::mojom::WebSandboxFlags flag =
-        static_cast<blink::mojom::WebSandboxFlags>(1 << bit);
+    network::mojom::WebSandboxFlags flag =
+        static_cast<network::mojom::WebSandboxFlags>(1 << bit);
     if (static_cast<unsigned>(expected_flags) & (1 << bit)) {
       EXPECT_TRUE(root->child_at(0)->current_frame_host()->IsSandboxed(flag));
     } else {
@@ -15281,17 +15213,17 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicySandboxTest,
           "a.com",
           "/cross_site_iframe_factory.html?a(b{sandbox,allow-scripts})")));
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   // Validate sandbox flags bit-by-bit. This is equivalent to an equality check
   // when FeaturePolicyForSandbox is disabled, but when that feature is enabled,
   // this will check the appropriate policy-controlled feature for each expected
   // sandbox flag.
   for (int bit = 0; bit < 32; bit++) {
-    blink::mojom::WebSandboxFlags flag =
-        static_cast<blink::mojom::WebSandboxFlags>(1 << bit);
+    network::mojom::WebSandboxFlags flag =
+        static_cast<network::mojom::WebSandboxFlags>(1 << bit);
     if (static_cast<unsigned>(expected_flags) & (1 << bit)) {
       EXPECT_TRUE(root->child_at(0)->current_frame_host()->IsSandboxed(flag));
     } else {
@@ -15783,4 +15715,29 @@ INSTANTIATE_TEST_SUITE_P(SitePerProcess,
                          testing::Values(1.0, 1.5, 2.0));
 #endif
 
+// Check that initial navigations to renderer debug URLs mark the renderer
+// process as used, so that future navigations to sites that require a
+// dedicated process do not reuse that process.
+IN_PROC_BROWSER_TEST_F(
+    SitePerProcessBrowserTest,
+    ProcessNotReusedAfterInitialNavigationToRendererDebugURL) {
+  // Load a javascript URL, which is a renderer debug URL.  This navigation
+  // won't commit, but the renderer process will synchronously process the
+  // javascript URL and install an HTML document that contains "foo".
+  GURL javascript_url("javascript:'foo'");
+  shell()->LoadURL(javascript_url);
+  EXPECT_EQ("foo", EvalJs(shell(), "document.body.innerText"));
+
+  RenderProcessHost* js_process = web_contents()->GetMainFrame()->GetProcess();
+
+  // Because the javascript URL can run arbitrary scripts in the renderer
+  // process, it is unsafe to reuse the renderer process later for navigations
+  // to sites that require a dedicated process.  Ensure that this is the case.
+  EXPECT_FALSE(js_process->IsUnused());
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
+  EXPECT_NE(js_process, web_contents()->GetMainFrame()->GetProcess());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/site_per_process_hit_test_browsertest.cc b/chromium/content/browser/site_per_process_hit_test_browsertest.cc
index 0881847efbb..7a4b1fe7188 100644
--- a/chromium/content/browser/site_per_process_hit_test_browsertest.cc
+++ b/chromium/content/browser/site_per_process_hit_test_browsertest.cc
@@ -5,8 +5,10 @@
 #include <tuple>
 
 #include "base/bind.h"
+#include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/json/json_reader.h"
+#include "base/memory/scoped_refptr.h"
 #include "base/stl_util.h"
 #include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
@@ -20,6 +22,7 @@
 #include "content/browser/renderer_host/input/synthetic_tap_gesture.h"
 #include "content/browser/renderer_host/input/synthetic_touchpad_pinch_gesture.h"
 #include "content/browser/renderer_host/input/touch_emulator.h"
+#include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/site_per_process_browsertest.h"
@@ -35,6 +38,7 @@
 #include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/common/web_preferences.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/hit_test_region_observer.h"
@@ -43,8 +47,9 @@
 #include "content/shell/common/shell_switches.h"
 #include "content/test/mock_overscroll_observer.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
+#include "third_party/blink/public/mojom/page/widget.mojom-test-utils.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/display/display_switches.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/gesture_detection/gesture_configuration.h"
@@ -73,7 +78,9 @@ namespace content {
 
 namespace {
 
+// TODO(nzolghadr): We need to have a much lower tolerance across the board.
 constexpr float kHitTestTolerance = 1.f;
+constexpr float kHitTestLowTolerance = 0.2f;
 
 class TestInputEventObserver : public RenderWidgetHost::InputEventObserver {
  public:
@@ -100,12 +107,12 @@ class TestInputEventObserver : public RenderWidgetHost::InputEventObserver {
     event_ = event.Clone();
   }
 
-  const std::vector<InputEventAckSource>& events_acked() {
+  const std::vector<blink::mojom::InputEventResultSource>& events_acked() {
     return events_acked_;
   }
 
-  void OnInputEventAck(InputEventAckSource source,
-                       InputEventAckState state,
+  void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                       blink::mojom::InputEventResultState state,
                        const blink::WebInputEvent&) override {
     events_acked_.push_back(source);
   }
@@ -113,7 +120,7 @@ class TestInputEventObserver : public RenderWidgetHost::InputEventObserver {
  private:
   RenderWidgetHost* host_;
   std::vector<blink::WebInputEvent::Type> events_received_;
-  std::vector<InputEventAckSource> events_acked_;
+  std::vector<blink::mojom::InputEventResultSource> events_acked_;
   ui::WebScopedInputEvent event_;
 
   DISALLOW_COPY_AND_ASSIGN(TestInputEventObserver);
@@ -215,7 +222,8 @@ void DispatchMouseDownEventAndWaitUntilDispatch(
     RenderWidgetHostViewBase* expected_target,
     const gfx::PointF& expected_location) {
   blink::WebMouseEvent down_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   down_event.button = blink::WebPointerProperties::Button::kLeft;
   down_event.click_count = 1;
@@ -918,7 +926,7 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessInternalsHitTestBrowserTest,
 
   InputEventAckWaiter ack_observer(
       parent_iframe_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollUpdate);
+      blink::WebInputEvent::Type::kGestureScrollUpdate);
   rwhv_root->OnScrollEvent(&scroll_event);
   ack_observer.Wait();
 
@@ -1053,7 +1061,7 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessInternalsHitTestBrowserTest,
 
   InputEventAckWaiter ack_observer(
       parent_iframe_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollUpdate);
+      blink::WebInputEvent::Type::kGestureScrollUpdate);
   rwhv_root->OnScrollEvent(&scroll_event);
   ack_observer.Wait();
 
@@ -1141,14 +1149,15 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   InputEventAckWaiter scroll_begin_observer(
       root->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollBegin);
+      blink::WebInputEvent::Type::kGestureScrollBegin);
   InputEventAckWaiter scroll_end_observer(
       root->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollEnd);
+      blink::WebInputEvent::Type::kGestureScrollEnd);
 
   // Scroll the iframe upward, scroll events get bubbled up to the root.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gfx::Rect bounds = child_rwhv->GetViewBounds();
   float scale_factor =
@@ -1235,8 +1244,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   auto await_touch_event_with_position = base::BindRepeating(
       [](blink::WebInputEvent::Type expected_type,
          RenderWidgetHostViewBase* rwhv, gfx::PointF expected_position,
-         gfx::PointF expected_position_in_root, InputEventAckSource,
-         InputEventAckState, const blink::WebInputEvent& event) {
+         gfx::PointF expected_position_in_root,
+         blink::mojom::InputEventResultSource,
+         blink::mojom::InputEventResultState,
+         const blink::WebInputEvent& event) {
         if (event.GetType() != expected_type)
           return false;
 
@@ -1257,8 +1268,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   auto await_gesture_event_with_position = base::BindRepeating(
       [](blink::WebInputEvent::Type expected_type,
          RenderWidgetHostViewBase* rwhv, gfx::PointF expected_position,
-         gfx::PointF expected_position_in_root, InputEventAckSource,
-         InputEventAckState, const blink::WebInputEvent& event) {
+         gfx::PointF expected_position_in_root,
+         blink::mojom::InputEventResultSource,
+         blink::mojom::InputEventResultState,
+         const blink::WebInputEvent& event) {
         if (event.GetType() != expected_type)
           return false;
 
@@ -1289,17 +1302,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Touch start
   {
     blink::WebTouchEvent touch_start_event(
-        blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kTouchStart,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
     touch_start_event.touches_length = 1;
-    touch_start_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+    touch_start_event.touches[0].state =
+        blink::WebTouchPoint::State::kStatePressed;
     touch_start_event.touches[0].SetPositionInWidget(touch_start_point);
     touch_start_event.unique_touch_event_id = 1;
 
     InputEventAckWaiter await_begin_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_touch_event_with_position,
-                            blink::WebInputEvent::kTouchStart, child_rwhv,
+                            blink::WebInputEvent::Type::kTouchStart, child_rwhv,
                             touch_start_point_in_child, touch_start_point));
 
     router->RouteTouchEvent(root_rwhv, &touch_start_event,
@@ -1308,7 +1323,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     await_begin_in_child.Wait();
 
     blink::WebGestureEvent gesture_tap_event(
-        blink::WebInputEvent::kGestureTapDown,
+        blink::WebInputEvent::Type::kGestureTapDown,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -1317,8 +1332,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     InputEventAckWaiter await_tap_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureTapDown, child_rwhv,
-                            touch_start_point_in_child, touch_start_point));
+                            blink::WebInputEvent::Type::kGestureTapDown,
+                            child_rwhv, touch_start_point_in_child,
+                            touch_start_point));
     router->RouteGestureEvent(root_rwhv, &gesture_tap_event,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
     await_tap_in_child.Wait();
@@ -1327,16 +1343,18 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Touch move
   {
     blink::WebTouchEvent touch_move_event(
-        blink::WebInputEvent::kTouchMove, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kTouchMove,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
     touch_move_event.touches_length = 1;
-    touch_move_event.touches[0].state = blink::WebTouchPoint::kStateMoved;
+    touch_move_event.touches[0].state =
+        blink::WebTouchPoint::State::kStateMoved;
     touch_move_event.touches[0].SetPositionInWidget(touch_move_point);
     touch_move_event.unique_touch_event_id = 2;
     InputEventAckWaiter await_move_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_touch_event_with_position,
-                            blink::WebInputEvent::kTouchMove, child_rwhv,
+                            blink::WebInputEvent::Type::kTouchMove, child_rwhv,
                             touch_move_point_in_child, touch_move_point));
     router->RouteTouchEvent(root_rwhv, &touch_move_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
@@ -1346,7 +1364,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Gesture Begin and update
   {
     blink::WebGestureEvent gesture_scroll_begin(
-        blink::WebGestureEvent::kGestureScrollBegin,
+        blink::WebGestureEvent::Type::kGestureScrollBegin,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -1358,7 +1376,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     gesture_scroll_begin.SetPositionInWidget(touch_start_point);
 
     blink::WebGestureEvent gesture_scroll_update(
-        blink::WebGestureEvent::kGestureScrollUpdate,
+        blink::WebGestureEvent::Type::kGestureScrollUpdate,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -1372,19 +1390,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     InputEventAckWaiter await_begin_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollBegin,
+                            blink::WebInputEvent::Type::kGestureScrollBegin,
                             child_rwhv, touch_start_point_in_child,
                             touch_start_point));
     InputEventAckWaiter await_update_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             child_rwhv, touch_start_point_in_child,
                             touch_start_point));
     InputEventAckWaiter await_update_in_root(
         root_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             root_rwhv, touch_start_point, touch_start_point));
 
     router->RouteGestureEvent(root_rwhv, &gesture_scroll_begin,
@@ -1400,23 +1418,25 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Touch end & Scroll end
   {
     blink::WebTouchEvent touch_end_event(
-        blink::WebInputEvent::kTouchEnd, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kTouchEnd,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
     touch_end_event.touches_length = 1;
-    touch_end_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+    touch_end_event.touches[0].state =
+        blink::WebTouchPoint::State::kStateReleased;
     touch_end_event.touches[0].SetPositionInWidget(touch_move_point);
     touch_end_event.unique_touch_event_id = 3;
     InputEventAckWaiter await_end_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_touch_event_with_position,
-                            blink::WebInputEvent::kTouchEnd, child_rwhv,
+                            blink::WebInputEvent::Type::kTouchEnd, child_rwhv,
                             touch_start_point_in_child, touch_move_point));
     router->RouteTouchEvent(root_rwhv, &touch_end_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
     await_end_in_child.Wait();
 
     blink::WebGestureEvent gesture_scroll_end(
-        blink::WebGestureEvent::kGestureScrollEnd,
+        blink::WebGestureEvent::Type::kGestureScrollEnd,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -1428,8 +1448,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     InputEventAckWaiter await_scroll_end_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollEnd, child_rwhv,
-                            touch_start_point_in_child, touch_move_point));
+                            blink::WebInputEvent::Type::kGestureScrollEnd,
+                            child_rwhv, touch_start_point_in_child,
+                            touch_move_point));
     router->RouteGestureEvent(root_rwhv, &gesture_scroll_end,
                               ui::LatencyInfo(ui::SourceEventType::TOUCH));
     await_scroll_end_in_child.Wait();
@@ -1534,11 +1555,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   TestInputEventObserver child_event_observer(
       child_rwhv->GetRenderWidgetHost());
   InputEventAckWaiter child_touch_start_waiter(
-      child_rwhv->GetRenderWidgetHost(), blink::WebInputEvent::kTouchStart);
-  InputEventAckWaiter child_touch_move_waiter(child_rwhv->GetRenderWidgetHost(),
-                                              blink::WebInputEvent::kTouchMove);
-  InputEventAckWaiter child_touch_end_waiter(child_rwhv->GetRenderWidgetHost(),
-                                             blink::WebInputEvent::kTouchEnd);
+      child_rwhv->GetRenderWidgetHost(),
+      blink::WebInputEvent::Type::kTouchStart);
+  InputEventAckWaiter child_touch_move_waiter(
+      child_rwhv->GetRenderWidgetHost(),
+      blink::WebInputEvent::Type::kTouchMove);
+  InputEventAckWaiter child_touch_end_waiter(
+      child_rwhv->GetRenderWidgetHost(), blink::WebInputEvent::Type::kTouchEnd);
 
   // Send events and verify each one was sent to the child with correctly
   // transformed event coordinates.
@@ -1547,10 +1570,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // TouchStart.
   blink::WebTouchEvent touch_start_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_start_event.touches_length = 1;
-  touch_start_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_start_event.touches[0].state =
+      blink::WebTouchPoint::State::kStatePressed;
   SetWebEventPositions(&touch_start_event.touches[0], touch_start_point,
                        root_rwhv);
   touch_start_event.unique_touch_event_id = 1;
@@ -1559,7 +1584,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   child_touch_start_waiter.Wait();
 
   ASSERT_EQ(1U, child_event_observer.events_received().size());
-  ASSERT_EQ(blink::WebInputEvent::kTouchStart,
+  ASSERT_EQ(blink::WebInputEvent::Type::kTouchStart,
             child_event_observer.event().GetType());
   const blink::WebTouchEvent& touch_start_event_received =
       static_cast<const blink::WebTouchEvent&>(child_event_observer.event());
@@ -1572,10 +1597,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // TouchMove.
   blink::WebTouchEvent touch_move_event(
-      blink::WebInputEvent::kTouchMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_move_event.touches_length = 1;
-  touch_move_event.touches[0].state = blink::WebTouchPoint::kStateMoved;
+  touch_move_event.touches[0].state = blink::WebTouchPoint::State::kStateMoved;
   SetWebEventPositions(&touch_move_event.touches[0], touch_move_point,
                        root_rwhv);
   touch_move_event.unique_touch_event_id = 2;
@@ -1584,7 +1610,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   child_touch_move_waiter.Wait();
 
   ASSERT_EQ(2U, child_event_observer.events_received().size());
-  ASSERT_EQ(blink::WebInputEvent::kTouchMove,
+  ASSERT_EQ(blink::WebInputEvent::Type::kTouchMove,
             child_event_observer.event().GetType());
   const blink::WebTouchEvent& touch_move_event_received =
       static_cast<const blink::WebTouchEvent&>(child_event_observer.event());
@@ -1597,10 +1623,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // TouchEnd.
   blink::WebTouchEvent touch_end_event(
-      blink::WebInputEvent::kTouchEnd, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchEnd, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_end_event.touches_length = 1;
-  touch_end_event.touches[0].state = blink::WebTouchPoint::kStateReleased;
+  touch_end_event.touches[0].state =
+      blink::WebTouchPoint::State::kStateReleased;
   SetWebEventPositions(&touch_end_event.touches[0], touch_move_point,
                        root_rwhv);
   touch_end_event.unique_touch_event_id = 3;
@@ -1609,7 +1636,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   child_touch_end_waiter.Wait();
 
   ASSERT_EQ(3U, child_event_observer.events_received().size());
-  ASSERT_EQ(blink::WebInputEvent::kTouchEnd,
+  ASSERT_EQ(blink::WebInputEvent::Type::kTouchEnd,
             child_event_observer.event().GetType());
   const blink::WebTouchEvent& touch_end_event_received =
       static_cast<const blink::WebTouchEvent&>(child_event_observer.event());
@@ -1662,10 +1689,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   const gfx::Point position_in_root(gfx::ToCeiledInt(150 * scale_factor),
                                     gfx::ToCeiledInt(150 * scale_factor));
 
-  auto expect_gsb_with_position = base::BindRepeating(
-      [](const gfx::Point& expected_position, content::InputEventAckSource,
-         content::InputEventAckState, const blink::WebInputEvent& event) {
-        if (event.GetType() != blink::WebInputEvent::kGestureScrollBegin)
+  auto expect_gsb_with_position =
+      base::BindRepeating([](const gfx::Point& expected_position,
+                             blink::mojom::InputEventResultSource,
+                             blink::mojom::InputEventResultState,
+                             const blink::WebInputEvent& event) {
+        if (event.GetType() != blink::WebInputEvent::Type::kGestureScrollBegin)
           return false;
 
         const blink::WebGestureEvent& gesture_event =
@@ -1683,7 +1712,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Scroll the iframe upward, scroll events get bubbled up to the root.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&scroll_event, position_in_root, root_rwhv);
   scroll_event.delta_units = ui::ScrollGranularity::kScrollByPrecisePixel;
@@ -1799,13 +1829,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   OutgoingEventWaiter outgoing_touch_end_waiter(
       static_cast<RenderWidgetHostImpl*>(rwhv_nested->GetRenderWidgetHost()),
-      blink::WebInputEvent::kTouchEnd);
+      blink::WebInputEvent::Type::kTouchEnd);
   InputEventAckWaiter scroll_end_at_parent(
       rwhv_parent->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollEnd);
+      blink::WebInputEvent::Type::kGestureScrollEnd);
   BadInputEventObserver no_scroll_bubbling_to_root(
       static_cast<RenderWidgetHostImpl*>(root_rwhv->GetRenderWidgetHost()),
-      blink::WebInputEvent::kGestureScrollBegin);
+      blink::WebInputEvent::Type::kGestureScrollBegin);
 
   MainThreadFrameObserver synchronize_threads(
       rwhv_nested->GetRenderWidgetHost());
@@ -1835,20 +1865,23 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   const gfx::PointF point_in_root(1, 1);
   blink::WebTouchEvent touch_event(
-      blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kTouchStart,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   touch_event.touches_length = 1;
-  touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+  touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
   SetWebEventPositions(&touch_event.touches[0], point_in_root, root_rwhv);
   touch_event.unique_touch_event_id = 1;
-  InputEventAckWaiter root_touch_waiter(root_rwhv->GetRenderWidgetHost(),
-                                        blink::WebInputEvent::kTouchStart);
+  InputEventAckWaiter root_touch_waiter(
+      root_rwhv->GetRenderWidgetHost(),
+      blink::WebInputEvent::Type::kTouchStart);
   router->RouteTouchEvent(root_rwhv, &touch_event,
                           ui::LatencyInfo(ui::SourceEventType::TOUCH));
   root_touch_waiter.Wait();
 
   blink::WebGestureEvent gesture_event(
-      blink::WebInputEvent::kGestureTapDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kGestureTapDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
   gesture_event.unique_touch_event_id = touch_event.unique_touch_event_id;
@@ -1904,10 +1937,12 @@ class SitePerProcessEmulatedTouchBrowserTest
 
     WaitForHitTestData(iframe_node->current_frame_host());
 
-    auto expect_gesture_with_position = base::BindRepeating(
-        [](blink::WebInputEvent::Type expected_type,
-           const gfx::Point& expected_position, content::InputEventAckSource,
-           content::InputEventAckState, const blink::WebInputEvent& event) {
+    auto expect_gesture_with_position =
+        base::BindRepeating([](blink::WebInputEvent::Type expected_type,
+                               const gfx::Point& expected_position,
+                               blink::mojom::InputEventResultSource,
+                               blink::mojom::InputEventResultState,
+                               const blink::WebInputEvent& event) {
           if (event.GetType() != expected_type)
             return false;
 
@@ -1930,13 +1965,13 @@ class SitePerProcessEmulatedTouchBrowserTest
     switch (test_type) {
       case ScrollBubbling:
       case TouchActionBubbling:
-        expected_gesture_type = blink::WebInputEvent::kGestureScrollBegin;
+        expected_gesture_type = blink::WebInputEvent::Type::kGestureScrollBegin;
         break;
       case PinchGoesToMainFrame:
-        expected_gesture_type = blink::WebInputEvent::kGesturePinchBegin;
+        expected_gesture_type = blink::WebInputEvent::Type::kGesturePinchBegin;
         break;
       case ShowPressHasTouchID:
-        expected_gesture_type = blink::WebInputEvent::kGestureShowPress;
+        expected_gesture_type = blink::WebInputEvent::Type::kGestureShowPress;
         break;
       default:
         ASSERT_TRUE(false);
@@ -1976,9 +2011,9 @@ class SitePerProcessEmulatedTouchBrowserTest
     base::TimeDelta simulated_event_time_delta =
         base::TimeDelta::FromMilliseconds(100);
     blink::WebMouseEvent mouse_move_event =
-        SyntheticWebMouseEventBuilder::Build(blink::WebInputEvent::kMouseMove,
-                                             position_in_root.x(),
-                                             position_in_root.y(), 0);
+        SyntheticWebMouseEventBuilder::Build(
+            blink::WebInputEvent::Type::kMouseMove, position_in_root.x(),
+            position_in_root.y(), 0);
     mouse_move_event.SetTimeStamp(simulated_event_time);
 
     int mouse_modifier = (test_type == PinchGoesToMainFrame)
@@ -1987,7 +2022,7 @@ class SitePerProcessEmulatedTouchBrowserTest
     mouse_modifier |= blink::WebInputEvent::kLeftButtonDown;
     blink::WebMouseEvent mouse_down_event =
         SyntheticWebMouseEventBuilder::Build(
-            blink::WebInputEvent::kMouseDown, position_in_root.x(),
+            blink::WebInputEvent::Type::kMouseDown, position_in_root.x(),
             position_in_root.y(), mouse_modifier);
     mouse_down_event.button = blink::WebMouseEvent::Button::kLeft;
     simulated_event_time += simulated_event_time_delta;
@@ -1995,14 +2030,14 @@ class SitePerProcessEmulatedTouchBrowserTest
 
     blink::WebMouseEvent mouse_drag_event =
         SyntheticWebMouseEventBuilder::Build(
-            blink::WebInputEvent::kMouseMove, position_in_root.x(),
+            blink::WebInputEvent::Type::kMouseMove, position_in_root.x(),
             position_in_root.y() + 20, mouse_modifier);
     simulated_event_time += simulated_event_time_delta;
     mouse_drag_event.SetTimeStamp(simulated_event_time);
     mouse_drag_event.button = blink::WebMouseEvent::Button::kLeft;
 
     blink::WebMouseEvent mouse_up_event = SyntheticWebMouseEventBuilder::Build(
-        blink::WebInputEvent::kMouseUp, position_in_root.x(),
+        blink::WebInputEvent::Type::kMouseUp, position_in_root.x(),
         position_in_root.y() + 20, mouse_modifier);
     mouse_up_event.button = blink::WebMouseEvent::Button::kLeft;
     simulated_event_time += simulated_event_time_delta;
@@ -2102,10 +2137,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   InputEventAckWaiter ack_observer(
       child_frame_host->GetRenderWidgetHost(),
-      base::BindRepeating([](content::InputEventAckSource source,
-                             content::InputEventAckState state,
+      base::BindRepeating([](blink::mojom::InputEventResultSource source,
+                             blink::mojom::InputEventResultState state,
                              const blink::WebInputEvent& event) {
-        return event.GetType() == blink::WebGestureEvent::kGestureScrollEnd;
+        return event.GetType() ==
+               blink::WebGestureEvent::Type::kGestureScrollEnd;
       }));
   ack_observer.Reset();
 
@@ -2185,14 +2221,15 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
         (child_bounds.y() - root_bounds.y() + 10) * page_scale_factor);
 
     blink::WebTouchEvent touch_event(
-        blink::WebInputEvent::kTouchStart, blink::WebInputEvent::kNoModifiers,
+        blink::WebInputEvent::Type::kTouchStart,
+        blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests());
     touch_event.touches_length = 1;
-    touch_event.touches[0].state = blink::WebTouchPoint::kStatePressed;
+    touch_event.touches[0].state = blink::WebTouchPoint::State::kStatePressed;
     SetWebEventPositions(&touch_event.touches[0], point_in_root, rwhv_root);
     touch_event.unique_touch_event_id = 1;
     InputEventAckWaiter waiter(rwhv_child->GetRenderWidgetHost(),
-                               blink::WebInputEvent::kTouchStart);
+                               blink::WebInputEvent::Type::kTouchStart);
     router->RouteTouchEvent(rwhv_root, &touch_event,
                             ui::LatencyInfo(ui::SourceEventType::TOUCH));
     // With async hit testing, make sure the target for the initial TouchStart
@@ -2200,7 +2237,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     waiter.Wait();
 
     blink::WebGestureEvent gesture_event(
-        blink::WebInputEvent::kGestureTapDown,
+        blink::WebInputEvent::Type::kGestureTapDown,
         blink::WebInputEvent::kNoModifiers,
         blink::WebInputEvent::GetStaticTimeStampForTests(),
         blink::WebGestureDevice::kTouchscreen);
@@ -2231,10 +2268,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   InputEventAckWaiter gesture_begin_observer_child(
       child_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollBegin);
+      blink::WebInputEvent::Type::kGestureScrollBegin);
   InputEventAckWaiter gesture_end_observer_child(
       child_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollEnd);
+      blink::WebInputEvent::Type::kGestureScrollEnd);
 
 #if defined(USE_AURA)
   const float overscroll_threshold =
@@ -2246,7 +2283,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // First we need our scroll to initiate an overscroll gesture in the root
   // via unconsumed scrolls in the child.
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -2271,7 +2308,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   gesture_begin_observer_child.Wait();
 
   blink::WebGestureEvent gesture_scroll_update(
-      blink::WebGestureEvent::kGestureScrollUpdate,
+      blink::WebGestureEvent::Type::kGestureScrollUpdate,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -2312,7 +2349,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   mock_overscroll_observer->WaitForUpdate();
 
   blink::WebGestureEvent gesture_scroll_end(
-      blink::WebGestureEvent::kGestureScrollEnd,
+      blink::WebGestureEvent::Type::kGestureScrollEnd,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -2364,7 +2401,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, ScrollEventToOOPIF) {
   // Send a ui::ScrollEvent that will hit test to the child frame.
   InputEventAckWaiter waiter(
       child_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kMouseWheel);
+      blink::WebInputEvent::Type::kMouseWheel);
   ui::ScrollEvent scroll_event(ui::ET_SCROLL, gfx::Point(75, 75),
                                ui::EventTimeForNow(), ui::EF_NONE, 0,
                                10,     // Offsets
@@ -2377,7 +2414,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, ScrollEventToOOPIF) {
   // Verify that this a mouse wheel event was sent to the child frame renderer.
   EXPECT_TRUE(child_frame_monitor.EventWasReceived());
   EXPECT_TRUE(base::Contains(child_frame_monitor.events_received(),
-                             blink::WebInputEvent::kMouseWheel));
+                             blink::WebInputEvent::Type::kMouseWheel));
 }
 
 // Tests that touching an OOPIF editable element correctly resizes the
@@ -2433,7 +2470,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
                              .ExtractInt();
   const int inset_height = 200;
   parent_render_widget_host_aura->SetLastPointerType(
-      ui::EventPointerType::POINTER_TYPE_TOUCH);
+      ui::EventPointerType::kTouch);
   parent_render_widget_host_aura->SetInsets(gfx::Insets(0, 0, inset_height, 0));
 
   // After focus on editable element, we expect element to be scrolled
@@ -2485,11 +2522,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
       child_node->current_frame_host()->GetRenderWidgetHost());
   InputEventAckWaiter waiter(
       child_node->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kMouseWheel);
+      blink::WebInputEvent::Type::kMouseWheel);
 
   // Send a mouse wheel event to child.
   blink::WebMouseWheelEvent wheel_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&wheel_event, gfx::Point(75, 75), rwhv_parent);
   wheel_event.delta_x = 10;
@@ -2501,7 +2539,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // async targeting on the first event, these new mouse wheel events should
   // be coalesced properly.
   blink::WebMouseWheelEvent wheel_event1(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&wheel_event1, gfx::Point(70, 70), rwhv_parent);
   wheel_event1.delta_x = 12;
@@ -2510,7 +2549,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   router->RouteMouseWheelEvent(rwhv_parent, &wheel_event1, ui::LatencyInfo());
 
   blink::WebMouseWheelEvent wheel_event2(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&wheel_event2, gfx::Point(65, 65), rwhv_parent);
   wheel_event2.delta_x = 14;
@@ -2523,7 +2563,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // event immediately.
   waiter.Wait();
   EXPECT_TRUE(child_frame_monitor.EventWasReceived());
-  EXPECT_EQ(child_frame_monitor.EventType(), blink::WebInputEvent::kMouseWheel);
+  EXPECT_EQ(child_frame_monitor.EventType(),
+            blink::WebInputEvent::Type::kMouseWheel);
 
   // Check if the two mouse-wheel update events are coalesced correctly.
   const auto& gesture_event =
@@ -2698,7 +2739,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // whose main-thread is blocked because of the infinite-loop in the injected
   // javascript above.
   blink::WebMouseEvent down_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   down_event.button = blink::WebPointerProperties::Button::kLeft;
   down_event.click_count = 1;
@@ -2752,7 +2794,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target input event to child1 frame.
   blink::WebMouseEvent child_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   child_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&child_event, gfx::Point(75, 75), root_view);
@@ -2760,7 +2803,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   main_frame_monitor.ResetEventReceived();
   child_frame_monitor.ResetEventReceived();
   InputEventAckWaiter waiter(root->current_frame_host()->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kMouseDown);
+                             blink::WebInputEvent::Type::kMouseDown);
   router->RouteMouseEvent(root_view, &child_event, ui::LatencyInfo());
   waiter.Wait();
 
@@ -2795,7 +2838,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   child_frame_monitor.ResetEventReceived();
   InputEventAckWaiter child_waiter(
       child_node1->current_frame_host()->GetRenderWidgetHost(),
-      blink::WebInputEvent::kMouseDown);
+      blink::WebInputEvent::Type::kMouseDown);
   router->RouteMouseEvent(root_view, &child_event, ui::LatencyInfo());
   child_waiter.Wait();
 
@@ -3037,7 +3080,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Target input event to child frame. It should get delivered to the main
   // frame instead because the child frame main thread is non-responsive.
   blink::WebMouseEvent child_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   child_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&child_event, gfx::Point(75, 75), root_view);
@@ -3146,7 +3190,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Send mouse events to both A and B.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   auto* router = web_contents()->GetInputEventRouter();
 
@@ -3177,7 +3222,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     RouteMouseEventAndWaitUntilDispatch(router, rwhv_a, rwhv_b, &mouse_event);
     EXPECT_TRUE(a_frame_monitor.EventWasReceived());
     EXPECT_EQ(a_frame_monitor.event().GetType(),
-              blink::WebInputEvent::kMouseMove);
+              blink::WebInputEvent::Type::kMouseMove);
     a_frame_monitor.ResetEventReceived();
     EXPECT_TRUE(b_frame_monitor.EventWasReceived());
     b_frame_monitor.ResetEventReceived();
@@ -3250,7 +3295,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Send mouse events to both A and B.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   auto* router = web_contents()->GetInputEventRouter();
 
@@ -3278,7 +3324,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     RouteMouseEventAndWaitUntilDispatch(router, rwhv_a, rwhv_b, &mouse_event);
     EXPECT_TRUE(a_frame_monitor.EventWasReceived());
     EXPECT_EQ(a_frame_monitor.event().GetType(),
-              blink::WebInputEvent::kMouseMove);
+              blink::WebInputEvent::Type::kMouseMove);
     a_frame_monitor.ResetEventReceived();
     EXPECT_TRUE(b_frame_monitor.EventWasReceived());
     b_frame_monitor.ResetEventReceived();
@@ -3376,7 +3422,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
       gfx::ToCeiledInt((d_bounds.y() - a_bounds.y() + 25) * scale_factor));
 
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&mouse_event, point_in_a_frame, rwhv_a);
 
@@ -3397,7 +3444,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   RouteMouseEventAndWaitUntilDispatch(router, rwhv_a, rwhv_b, &mouse_event);
   EXPECT_TRUE(a_frame_monitor.EventWasReceived());
   EXPECT_EQ(a_frame_monitor.event().GetType(),
-            blink::WebInputEvent::kMouseMove);
+            blink::WebInputEvent::Type::kMouseMove);
   a_frame_monitor.ResetEventReceived();
   EXPECT_TRUE(b_frame_monitor.EventWasReceived());
   b_frame_monitor.ResetEventReceived();
@@ -3410,13 +3457,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   RouteMouseEventAndWaitUntilDispatch(router, rwhv_a, rwhv_d, &mouse_event);
   EXPECT_TRUE(a_frame_monitor.EventWasReceived());
   EXPECT_EQ(a_frame_monitor.event().GetType(),
-            blink::WebInputEvent::kMouseMove);
+            blink::WebInputEvent::Type::kMouseMove);
   EXPECT_TRUE(b_frame_monitor.EventWasReceived());
   EXPECT_EQ(b_frame_monitor.event().GetType(),
-            blink::WebInputEvent::kMouseLeave);
+            blink::WebInputEvent::Type::kMouseLeave);
   EXPECT_TRUE(c_frame_monitor.EventWasReceived());
   EXPECT_EQ(c_frame_monitor.event().GetType(),
-            blink::WebInputEvent::kMouseMove);
+            blink::WebInputEvent::Type::kMouseMove);
   EXPECT_TRUE(d_frame_monitor.EventWasReceived());
 }
 
@@ -3478,7 +3525,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // the child frame, but the parent frame should receive a MouseMove with
   // the kRelativeMotionEvent modifier set.
   blink::WebMouseEvent mouse_event;
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(blink::WebInputEvent::kNoModifiers);
   SetWebEventPositions(&mouse_event, gfx::Point(2, 2), root_view);
   RouteMouseEventAndWaitUntilDispatch(router, root_view, child_view,
@@ -3566,7 +3613,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // Send MouseUp to same location, which should still go to the C frame and
   // also release capture. No other frames should receive mouse events.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseUp, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseUp, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   DispatchMouseEventAndWaitUntilDispatch(web_contents(), mouse_event, C_view,
                                          gfx::PointF(5.0, 5.0), C_view,
@@ -3636,7 +3683,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseDown to child frame.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&mouse_event,
@@ -3660,7 +3708,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseMove at main frame. The child frame is now capturing input,
   // so it should receive the event instead.
-  mouse_event.SetType(blink::WebInputEvent::kMouseMove);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseMove);
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
   SetWebEventPositions(&mouse_event, gfx::Point(1, 1), root_view);
   RouteMouseEventAndWaitUntilDispatch(router, root_view, rwhv_child,
@@ -3676,7 +3724,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   EXPECT_TRUE(child_frame_monitor.EventWasReceived());
 
   // MouseUp releases capture.
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(blink::WebInputEvent::kNoModifiers);
   SetWebEventPositions(&mouse_event, gfx::Point(1, 1), root_view);
   RouteMouseEventAndWaitUntilDispatch(router, root_view, rwhv_child,
@@ -3686,7 +3734,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   EXPECT_FALSE(child_interceptor->Capturing());
 
   // Targeting a MouseDown to the main frame should not initiate capture.
-  mouse_event.SetType(blink::WebInputEvent::kMouseDown);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseDown);
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&mouse_event, gfx::Point(1, 1), root_view);
@@ -3701,7 +3749,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseMove at child frame. Without capture, this should be
   // dispatched to the child frame.
-  mouse_event.SetType(blink::WebInputEvent::kMouseMove);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseMove);
   SetWebEventPositions(&mouse_event,
                        gfx::Point(child_frame_target_x, child_frame_target_y),
                        root_view);
@@ -3719,7 +3767,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   EXPECT_FALSE(child_interceptor->Capturing());
 
   // No release capture events since the capture statu doesn't change.
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(blink::WebInputEvent::kNoModifiers);
   SetWebEventPositions(&mouse_event,
                        gfx::Point(child_frame_target_x, child_frame_target_y),
@@ -3738,7 +3786,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Now send a MouseDown to target the thumb part of the scroll bar, which
   // should initiate mouse capture for the main frame.
-  mouse_event.SetType(blink::WebInputEvent::kMouseDown);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseDown);
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
   SetWebEventPositions(&mouse_event, gfx::Point(100, 25), root_view);
   RouteMouseEventAndWaitUntilDispatch(router, root_view, root_view,
@@ -3755,7 +3803,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Now that the main frame is capturing, a MouseMove targeted to the child
   // frame should be received by the main frame.
-  mouse_event.SetType(blink::WebInputEvent::kMouseMove);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseMove);
   SetWebEventPositions(&mouse_event,
                        gfx::Point(child_frame_target_x, child_frame_target_y),
                        root_view);
@@ -3769,7 +3817,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   EXPECT_FALSE(child_frame_monitor.EventWasReceived());
 
   // A MouseUp sent anywhere should cancel the mouse capture.
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(blink::WebInputEvent::kNoModifiers);
   SetWebEventPositions(&mouse_event,
                        gfx::Point(child_frame_target_x, child_frame_target_y),
@@ -3820,7 +3868,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseDown to child frame.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   mouse_event.click_count = 1;
@@ -3841,7 +3890,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseMove to child frame to start drag. This should cause the
   // child to start capturing mouse input.
-  mouse_event.SetType(blink::WebInputEvent::kMouseMove);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseMove);
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
   DispatchMouseEventAndWaitUntilDispatch(web_contents(), mouse_event,
                                          rwhv_child, gfx::PointF(5.0, 5.0),
@@ -3882,7 +3931,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   child_frame_monitor.ResetEventReceived();
 
   // A MouseUp sent anywhere should cancel the mouse capture.
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(0);
   DispatchMouseEventAndWaitUntilDispatch(web_contents(), mouse_event,
                                          rwhv_child, gfx::PointF(-25.0, -25.0),
@@ -3926,7 +3975,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseDown to child frame.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   mouse_event.click_count = 1;
@@ -3950,7 +4000,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
                                   ->GetInputEventRouter()
                                   ->mouse_down_post_transformed_coordinate_;
 
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   mouse_event.SetModifiers(0);
 
   auto* root_view = static_cast<RenderWidgetHostViewBase*>(
@@ -4038,7 +4088,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
   // Target MouseDown to main frame.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
@@ -4067,7 +4118,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
       (bounds.x() - root_view->GetViewBounds().x() + 5) * scale_factor);
   int child_frame_target_y = gfx::ToCeiledInt(
       (bounds.y() - root_view->GetViewBounds().y() + 5) * scale_factor);
-  mouse_event.SetType(blink::WebInputEvent::kMouseMove);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseMove);
   mouse_event.SetModifiers(blink::WebInputEvent::kLeftButtonDown);
 
   SetWebEventPositions(&mouse_event,
@@ -4114,46 +4165,32 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
 
 // There are no cursors on Android.
 #if !defined(OS_ANDROID)
-class CursorMessageFilter : public content::BrowserMessageFilter {
- public:
-  CursorMessageFilter()
-      : content::BrowserMessageFilter(WidgetMsgStart),
-        message_loop_runner_(new content::MessageLoopRunner),
-        last_set_cursor_routing_id_(MSG_ROUTING_NONE) {}
-
-  bool OnMessageReceived(const IPC::Message& message) override {
-    if (message.type() == WidgetHostMsg_SetCursor::ID) {
-      base::PostTask(FROM_HERE, {content::BrowserThread::UI},
-                     base::BindOnce(&CursorMessageFilter::OnSetCursor, this,
-                                    message.routing_id()));
-    }
-    return false;
-  }
+namespace {
 
-  void OnSetCursor(int routing_id) {
-    last_set_cursor_routing_id_ = routing_id;
-    message_loop_runner_->Quit();
+class SetCursorInterceptor
+    : public blink::mojom::WidgetHostInterceptorForTesting {
+ public:
+  explicit SetCursorInterceptor(RenderWidgetHostImpl* render_widget_host)
+      : render_widget_host_(render_widget_host) {
+    render_widget_host_->widget_host_receiver_for_testing().SwapImplForTesting(
+        this);
   }
+  ~SetCursorInterceptor() override = default;
 
-  int last_set_cursor_routing_id() const { return last_set_cursor_routing_id_; }
+  WidgetHost* GetForwardingInterface() override { return render_widget_host_; }
 
-  void Wait() {
-    // Do not reset the cursor, as the cursor may already have been set (and
-    // Quit() already called on |message_loop_runner_|).
-    message_loop_runner_->Run();
+  void SetCursor(const ui::Cursor& cursor) override {
+    GetForwardingInterface()->SetCursor(cursor);
+    run_loop_.Quit();
   }
 
- private:
-  ~CursorMessageFilter() override {}
-
-  scoped_refptr<content::MessageLoopRunner> message_loop_runner_;
-  int last_set_cursor_routing_id_;
+  void Wait() { run_loop_.Run(); }
 
-  DISALLOW_COPY_AND_ASSIGN(CursorMessageFilter);
+ private:
+  base::RunLoop run_loop_;
+  RenderWidgetHostImpl* render_widget_host_;
 };
 
-namespace {
-
 // Verify that we receive a mouse cursor update message when we mouse over
 // a text field contained in an out-of-process iframe.
 void CursorUpdateReceivedFromCrossSiteIframeHelper(
@@ -4172,16 +4209,17 @@ void CursorUpdateReceivedFromCrossSiteIframeHelper(
 
   WaitForHitTestData(child_node->current_frame_host());
 
-  scoped_refptr<CursorMessageFilter> filter = new CursorMessageFilter();
-  child_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
-
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
-  RenderWidgetHost* rwh_child =
+  RenderWidgetHostImpl* rwh_child =
       root->child_at(0)->current_frame_host()->GetRenderWidgetHost();
   RenderWidgetHostViewBase* child_view =
       static_cast<RenderWidgetHostViewBase*>(rwh_child->GetView());
 
+  // Intercept SetCursor messages.
+  auto set_cursor_interceptor =
+      std::make_unique<SetCursorInterceptor>(rwh_child);
+
   // This should only return nullptr on Android.
   EXPECT_TRUE(root_view->GetCursorManager());
 
@@ -4194,7 +4232,8 @@ void CursorUpdateReceivedFromCrossSiteIframeHelper(
   // Send a MouseMove to the subframe. The frame contains text, and moving the
   // mouse over it should cause the renderer to send a mouse cursor update.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseMove, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseMove,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&mouse_event, gfx::Point(60, 60), root_view);
   auto* router = web_contents->GetInputEventRouter();
@@ -4206,7 +4245,8 @@ void CursorUpdateReceivedFromCrossSiteIframeHelper(
                                       &mouse_event);
   // The child_view should receive a mouse-move event.
   EXPECT_TRUE(child_monitor.EventWasReceived());
-  EXPECT_EQ(blink::WebInputEvent::kMouseMove, child_monitor.event().GetType());
+  EXPECT_EQ(blink::WebInputEvent::Type::kMouseMove,
+            child_monitor.event().GetType());
   EXPECT_NEAR(8, child_monitor.event().PositionInWidget().x(),
               kHitTestTolerance);
   EXPECT_NEAR(8, child_monitor.event().PositionInWidget().y(),
@@ -4214,24 +4254,15 @@ void CursorUpdateReceivedFromCrossSiteIframeHelper(
 
   // The root_view should also receive a mouse-move event.
   EXPECT_TRUE(root_monitor.EventWasReceived());
-  EXPECT_EQ(blink::WebInputEvent::kMouseMove, root_monitor.event().GetType());
+  EXPECT_EQ(blink::WebInputEvent::Type::kMouseMove,
+            root_monitor.event().GetType());
   EXPECT_EQ(60, root_monitor.event().PositionInWidget().x());
   EXPECT_EQ(60, root_monitor.event().PositionInWidget().y());
 
-  // CursorMessageFilter::Wait() implicitly tests whether we receive a
-  // WidgetHostMsg_SetCursor message from the renderer process, because it does
-  // does not return otherwise.
-  filter->Wait();
-  EXPECT_EQ(filter->last_set_cursor_routing_id(), rwh_child->GetRoutingID());
-
-  // Yield to ensure that the SetCursor message is processed by its real
-  // handler.
-  {
-    base::RunLoop loop;
-    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                  loop.QuitClosure());
-    loop.Run();
-  }
+  // SetCursorInterceptor::Wait() implicitly tests whether we receive a
+  // blink.mojom.WidgetHost SetCursor message from the renderer process,
+  // because it does does not return otherwise.
+  set_cursor_interceptor->Wait();
 
   // The root_view receives a mouse-move event on top of the iframe, which does
   // not send a cursor update.
@@ -4334,7 +4365,7 @@ class SitePerProcessMouseWheelHitTestBrowserTest
         TestTimeouts::action_max_timeout());
 
     InputEventAckWaiter waiter(expected_target->GetRenderWidgetHost(),
-                               blink::WebInputEvent::kMouseWheel);
+                               blink::WebInputEvent::Type::kMouseWheel);
     SendMouseWheel(pos);
     waiter.Wait();
 
@@ -4466,7 +4497,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
   gfx::Rect bounds = child_rwhv->GetViewBounds();
   gfx::Point pos(bounds.x() + 10, bounds.y() + 10);
   InputEventAckWaiter waiter(child_rwhv->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kMouseWheel);
+                             blink::WebInputEvent::Type::kMouseWheel);
   SendMouseWheel(pos);
   waiter.Wait();
 
@@ -4483,7 +4514,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
   // Verify that this a mouse wheel event was sent to the child frame renderer.
   EXPECT_TRUE(child_frame_monitor.EventWasReceived());
   EXPECT_TRUE(base::Contains(child_frame_monitor.events_received(),
-                             blink::WebInputEvent::kMouseWheel));
+                             blink::WebInputEvent::Type::kMouseWheel));
 
   // Kill the wheel target view process. This must reset the wheel_target_.
   RenderProcessHost* child_process =
@@ -4529,8 +4560,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
   auto await_gesture_event_with_position = base::BindRepeating(
       [](blink::WebInputEvent::Type expected_type,
          RenderWidgetHostViewBase* rwhv, gfx::PointF expected_position,
-         gfx::PointF expected_position_in_root, InputEventAckSource,
-         InputEventAckState, const blink::WebInputEvent& event) {
+         gfx::PointF expected_position_in_root,
+         blink::mojom::InputEventResultSource,
+         blink::mojom::InputEventResultState,
+         const blink::WebInputEvent& event) {
         if (event.GetType() != expected_type)
           return false;
 
@@ -4551,7 +4584,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
 
   // Send a mouse wheel begin event to child.
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gfx::Point child_point_in_root(90, 90);
   SetWebEventPositions(&scroll_event, child_point_in_root, rwhv_root);
@@ -4564,19 +4598,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
     InputEventAckWaiter await_begin_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollBegin,
+                            blink::WebInputEvent::Type::kGestureScrollBegin,
                             child_rwhv, gfx::PointF(38, 38),
                             gfx::PointF(child_point_in_root)));
     InputEventAckWaiter await_update_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             child_rwhv, gfx::PointF(38, 38),
                             gfx::PointF(child_point_in_root)));
     InputEventAckWaiter await_update_in_root(
         rwhv_root->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             rwhv_root, gfx::PointF(child_point_in_root),
                             gfx::PointF(child_point_in_root)));
     router->RouteMouseWheelEvent(rwhv_root, &scroll_event, ui::LatencyInfo());
@@ -4592,13 +4626,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
     InputEventAckWaiter await_update_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             child_rwhv, gfx::PointF(38, 58),
                             gfx::PointF(child_point_in_root)));
     InputEventAckWaiter await_update_in_root(
         rwhv_root->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureScrollUpdate,
+                            blink::WebInputEvent::Type::kGestureScrollUpdate,
                             rwhv_root, gfx::PointF(child_point_in_root),
                             gfx::PointF(child_point_in_root)));
     router->RouteMouseWheelEvent(rwhv_root, &scroll_event, ui::LatencyInfo());
@@ -4616,7 +4650,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMouseWheelHitTestBrowserTest,
     InputEventAckWaiter await_fling_start_in_child(
         child_rwhv->GetRenderWidgetHost(),
         base::BindRepeating(await_gesture_event_with_position,
-                            blink::WebInputEvent::kGestureFlingStart,
+                            blink::WebInputEvent::Type::kGestureFlingStart,
                             child_rwhv, gfx::PointF(38, 78),
                             gfx::PointF(child_point_in_root)));
     rwhv_root->OnScrollEvent(&fling_start);
@@ -4660,7 +4694,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
                    .has_value());
 
   InputEventAckWaiter waiter(child_render_widget_host,
-                             blink::WebInputEvent::kTouchStart);
+                             blink::WebInputEvent::Type::kTouchStart);
 
   // Simulate touch event to sub-frame.
   gfx::Point child_center(150, 150);
@@ -4673,13 +4707,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     observer.Wait();
   }
 
-  ui::TouchEvent touch_event(
-      ui::ET_TOUCH_PRESSED, child_center, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
-                         /* pointer_id*/ 0,
-                         /* radius_x */ 30.0f,
-                         /* radius_y */ 30.0f,
-                         /* force */ 0.0f));
+  ui::TouchEvent touch_event(ui::ET_TOUCH_PRESSED, child_center,
+                             ui::EventTimeForNow(),
+                             ui::PointerDetails(ui::EventPointerType::kTouch,
+                                                /* pointer_id*/ 0,
+                                                /* radius_x */ 30.0f,
+                                                /* radius_y */ 30.0f,
+                                                /* force */ 0.0f));
   UpdateEventRootLocation(&touch_event, rwhv);
   rwhv->OnTouchEvent(&touch_event);
   waiter.Wait();
@@ -4744,13 +4778,13 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
     observer->Wait();
   }
 
-  ui::TouchEvent touch_event(
-      ui::ET_TOUCH_PRESSED, frame_center, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
-                         /* pointer_id*/ 0,
-                         /* radius_x */ 30.0f,
-                         /* radius_y */ 30.0f,
-                         /* force */ 0.0f));
+  ui::TouchEvent touch_event(ui::ET_TOUCH_PRESSED, frame_center,
+                             ui::EventTimeForNow(),
+                             ui::PointerDetails(ui::EventPointerType::kTouch,
+                                                /* pointer_id*/ 0,
+                                                /* radius_x */ 30.0f,
+                                                /* radius_y */ 30.0f,
+                                                /* force */ 0.0f));
   UpdateEventRootLocation(&touch_event, rwhv);
   rwhv->OnTouchEvent(&touch_event);
   {
@@ -4810,7 +4844,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   RenderWidgetHostImpl* render_widget_host =
       root->current_frame_host()->GetRenderWidgetHost();
   InputEventAckWaiter ack_waiter(child_frame_host->GetRenderWidgetHost(),
-                                 blink::WebInputEvent::kGestureTap);
+                                 blink::WebInputEvent::Type::kGestureTap);
 
 #if defined(USE_AURA)
   // Allows the gesture events to go through under mash.
@@ -4854,14 +4888,14 @@ uint32_t SendTouchTapWithExpectedTarget(
   }
   ui::TouchEvent touch_event_pressed(
       ui::ET_TOUCH_PRESSED, touch_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
+      ui::PointerDetails(ui::EventPointerType::kTouch,
                          /* pointer_id*/ 0,
                          /* radius_x */ 30.0f,
                          /* radius_y */ 30.0f,
                          /* force */ 0.0f));
   UpdateEventRootLocation(&touch_event_pressed, root_view_aura);
   InputEventAckWaiter waiter(expected_target->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kTouchStart);
+                             blink::WebInputEvent::Type::kTouchStart);
   root_view_aura->OnTouchEvent(&touch_event_pressed);
   if (child_render_widget_host != nullptr) {
     MainThreadFrameObserver observer(child_render_widget_host);
@@ -4871,7 +4905,7 @@ uint32_t SendTouchTapWithExpectedTarget(
   EXPECT_EQ(expected_target, router_touch_target);
   ui::TouchEvent touch_event_released(
       ui::ET_TOUCH_RELEASED, touch_point, ui::EventTimeForNow(),
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
+      ui::PointerDetails(ui::EventPointerType::kTouch,
                          /* pointer_id*/ 0,
                          /* radius_x */ 30.0f,
                          /* radius_y */ 30.0f,
@@ -4959,7 +4993,7 @@ void SendTouchpadPinchSequenceWithExpectedTarget(
   UpdateEventRootLocation(&pinch_begin, root_view_aura);
   TestInputEventObserver target_monitor(expected_target->GetRenderWidgetHost());
   InputEventAckWaiter waiter(expected_target->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kGesturePinchBegin);
+                             blink::WebInputEvent::Type::kGesturePinchBegin);
   root_view_aura->OnGestureEvent(&pinch_begin);
   // If the expected target is not the root, then we should be doing async
   // targeting first. So event dispatch should not happen synchronously.
@@ -4980,7 +5014,7 @@ void SendTouchpadPinchSequenceWithExpectedTarget(
   EXPECT_EQ(expected_target, router_touchpad_gesture_target);
   EXPECT_TRUE(target_monitor.EventWasReceived());
   EXPECT_EQ(target_monitor.EventType(),
-            blink::WebInputEvent::kGesturePinchUpdate);
+            blink::WebInputEvent::Type::kGesturePinchUpdate);
   target_monitor.ResetEventsReceived();
 
   ui::GestureEventDetails pinch_end_details(ui::ET_GESTURE_PINCH_END);
@@ -4990,7 +5024,8 @@ void SendTouchpadPinchSequenceWithExpectedTarget(
   UpdateEventRootLocation(&pinch_end, root_view_aura);
   root_view_aura->OnGestureEvent(&pinch_end);
   EXPECT_TRUE(target_monitor.EventWasReceived());
-  EXPECT_EQ(target_monitor.EventType(), blink::WebInputEvent::kGesturePinchEnd);
+  EXPECT_EQ(target_monitor.EventType(),
+            blink::WebInputEvent::Type::kGesturePinchEnd);
   EXPECT_EQ(nullptr, router_touchpad_gesture_target);
 }
 
@@ -5014,10 +5049,10 @@ void SendTouchpadFlingSequenceWithExpectedTarget(
   TestInputEventObserver target_monitor(expected_target->GetRenderWidgetHost());
   InputEventAckWaiter fling_start_waiter(
       expected_target->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureFlingStart);
+      blink::WebInputEvent::Type::kGestureFlingStart);
   InputMsgWatcher gestrue_scroll_end_waiter(
       expected_target->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureScrollEnd);
+      blink::WebInputEvent::Type::kGestureScrollEnd);
   root_view_aura->OnScrollEvent(&fling_start);
   // If the expected target is not the root, then we should be doing async
   // targeting first. So event dispatch should not happen synchronously.
@@ -5033,7 +5068,7 @@ void SendTouchpadFlingSequenceWithExpectedTarget(
   // mouse_wheel_event_queue will process the wheel event and generate a GSE.
   InputEventAckWaiter fling_cancel_waiter(
       expected_target->GetRenderWidgetHost(),
-      blink::WebInputEvent::kGestureFlingCancel);
+      blink::WebInputEvent::Type::kGestureFlingCancel);
   ui::ScrollEvent fling_cancel(ui::ET_SCROLL_FLING_CANCEL, gesture_point,
                                ui::EventTimeForNow(), 0, 1, 0, 1, 0, 1);
   UpdateEventRootLocation(&fling_cancel, root_view_aura);
@@ -5247,11 +5282,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   auto wait_for_pinch_sequence_end = base::BindRepeating(
       [](RenderWidgetHost* rwh) {
         InputEventAckWaiter pinch_end_observer(
-            rwh, base::BindRepeating([](content::InputEventAckSource,
-                                        content::InputEventAckState,
+            rwh, base::BindRepeating([](blink::mojom::InputEventResultSource,
+                                        blink::mojom::InputEventResultState,
                                         const blink::WebInputEvent& event) {
               return event.GetType() ==
-                         blink::WebGestureEvent::kGesturePinchEnd &&
+                         blink::WebGestureEvent::Type::kGesturePinchEnd &&
                      !static_cast<const blink::WebGestureEvent&>(event)
                           .NeedsWheelEvent();
             }));
@@ -5461,7 +5496,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   RenderWidgetHostInputEventRouter* router = contents->GetInputEventRouter();
 
   blink::WebGestureEvent double_tap_zoom(
-      blink::WebInputEvent::kGestureDoubleTap,
+      blink::WebInputEvent::Type::kGestureDoubleTap,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchpad);
@@ -5583,7 +5618,8 @@ void CreateContextMenuTestHelper(
 
   // Target right-click event to child frame.
   blink::WebMouseEvent click_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   click_event.button = blink::WebPointerProperties::Button::kRight;
   SetWebEventPositions(&click_event, point, root_view);
@@ -5591,7 +5627,7 @@ void CreateContextMenuTestHelper(
   router->RouteMouseEvent(root_view, &click_event, ui::LatencyInfo());
 
   // We also need a MouseUp event, needed by Windows.
-  click_event.SetType(blink::WebInputEvent::kMouseUp);
+  click_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   SetWebEventPositions(&click_event, point, root_view);
   router->RouteMouseEvent(root_view, &click_event, ui::LatencyInfo());
 
@@ -5652,12 +5688,16 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, PopupMenuTest) {
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             child_node->current_frame_host()->GetSiteInstance());
 
-  scoped_refptr<ShowWidgetMessageFilter> filter = new ShowWidgetMessageFilter();
+  scoped_refptr<ShowWidgetMessageFilter> filter =
+      base::MakeRefCounted<ShowWidgetMessageFilter>(web_contents());
+  base::ScopedClosureRunner shut_down_filter(
+      base::BindOnce(&ShowWidgetMessageFilter::Shutdown, filter));
   child_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
 
   // Target left-click event to child frame.
   blink::WebMouseEvent click_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   click_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&click_event, gfx::Point(15, 15), rwhv_root);
@@ -5785,14 +5825,18 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
             c_node->current_frame_host()->GetSiteInstance());
 
-  scoped_refptr<ShowWidgetMessageFilter> filter = new ShowWidgetMessageFilter();
+  scoped_refptr<ShowWidgetMessageFilter> filter =
+      base::MakeRefCounted<ShowWidgetMessageFilter>(web_contents());
+  base::ScopedClosureRunner shut_down_filter(
+      base::BindOnce(&ShowWidgetMessageFilter::Shutdown, filter));
   c_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
 
   WaitForHitTestData(c_node->current_frame_host());
 
   // Target left-click event to child frame.
   blink::WebMouseEvent click_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   click_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&click_event, gfx::Point(15, 15), rwhv_root);
@@ -5923,7 +5967,10 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
               ->GetRenderWidgetHost()
               ->GetView());
 
-  scoped_refptr<ShowWidgetMessageFilter> filter = new ShowWidgetMessageFilter();
+  scoped_refptr<ShowWidgetMessageFilter> filter =
+      base::MakeRefCounted<ShowWidgetMessageFilter>(web_contents());
+  base::ScopedClosureRunner shut_down_filter(
+      base::BindOnce(&ShowWidgetMessageFilter::Shutdown, filter));
   grandchild_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
 
   // Target left-click event to the select element in the innermost frame.
@@ -5962,7 +6009,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest,
   // HitTestRegions needing to update post-scroll. The event won't hit test
   // correctly if it gets sent before a fresh compositor frame is received.
   blink::WebMouseEvent down_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   down_event.button = blink::WebPointerProperties::Button::kLeft;
   down_event.click_count = 1;
@@ -6003,14 +6051,14 @@ class SitePerProcessGestureHitTestBrowserTest
     // will crash in the renderer otherwise.
     ui::TouchEvent touch_pressed(
         ui::ET_TOUCH_PRESSED, position, ui::EventTimeForNow(),
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
+        ui::PointerDetails(ui::EventPointerType::kTouch,
                            /* pointer_id*/ 0,
                            /* radius_x */ 1.0f,
                            /* radius_y */ 1.0f,
                            /* force */ 1.0f));
     UpdateEventRootLocation(&touch_pressed, rwhva);
     InputEventAckWaiter waiter(expected_target_rwh,
-                               blink::WebInputEvent::kTouchStart);
+                               blink::WebInputEvent::Type::kTouchStart);
     rwhva->OnTouchEvent(&touch_pressed);
     waiter.Wait();
 
@@ -6068,13 +6116,13 @@ class SitePerProcessGestureHitTestBrowserTest
     // after pinch gestures.
     ui::TouchEvent touch_released(
         ui::ET_TOUCH_RELEASED, position, ui::EventTimeForNow(),
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH,
+        ui::PointerDetails(ui::EventPointerType::kTouch,
                            /* pointer_id*/ 0,
                            /* radius_x */ 1.0f,
                            /* radius_y */ 1.0f,
                            /* force */ 1.0f));
-    InputEventAckWaiter touch_released_waiter(expected_target_rwh,
-                                              blink::WebInputEvent::kTouchEnd);
+    InputEventAckWaiter touch_released_waiter(
+        expected_target_rwh, blink::WebInputEvent::Type::kTouchEnd);
     rwhva->OnTouchEvent(&touch_released);
     touch_released_waiter.Wait();
   }
@@ -6163,25 +6211,25 @@ class SitePerProcessGestureHitTestBrowserTest
     // Verify that root-RWHI gets nothing.
     EXPECT_FALSE(root_frame_monitor.EventWasReceived());
     // Verify that child-RWHI gets TS/GTD/GSB/GPB/GPE/GSE/TE.
-    EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+    EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
               child_frame_monitor.events_received()[0]);
-    EXPECT_EQ(blink::WebInputEvent::kGestureTapDown,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown,
               child_frame_monitor.events_received()[1]);
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
               child_frame_monitor.events_received()[2]);
-    EXPECT_EQ(blink::WebInputEvent::kGesturePinchBegin,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchBegin,
               child_frame_monitor.events_received()[3]);
-    EXPECT_EQ(blink::WebInputEvent::kGesturePinchEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchEnd,
               child_frame_monitor.events_received()[4]);
-    EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
               child_frame_monitor.events_received()[5]);
-    EXPECT_EQ(blink::WebInputEvent::kTouchEnd,
+    EXPECT_EQ(blink::WebInputEvent::Type::kTouchEnd,
               child_frame_monitor.events_received()[6]);
 
     // Verify that the pinch gestures are consumed by browser.
-    EXPECT_EQ(InputEventAckSource::BROWSER,
+    EXPECT_EQ(blink::mojom::InputEventResultSource::kBrowser,
               child_frame_monitor.events_acked()[3]);
-    EXPECT_EQ(InputEventAckSource::BROWSER,
+    EXPECT_EQ(blink::mojom::InputEventResultSource::kBrowser,
               child_frame_monitor.events_acked()[4]);
   }
 
@@ -6209,26 +6257,26 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessGestureHitTestBrowserTest,
 
   // Verify root-RWHI gets GSB/GPB/GPE/GSE.
   EXPECT_TRUE(root_frame_monitor.EventWasReceived());
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             root_frame_monitor.events_received()[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchBegin,
             root_frame_monitor.events_received()[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchEnd,
             root_frame_monitor.events_received()[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             root_frame_monitor.events_received()[3]);
 
   // Verify child-RWHI gets TS/TE, GTD/GSB/GSE.
   EXPECT_TRUE(child_frame_monitor.EventWasReceived());
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
             child_frame_monitor.events_received()[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown,
             child_frame_monitor.events_received()[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             child_frame_monitor.events_received()[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             child_frame_monitor.events_received()[3]);
-  EXPECT_EQ(blink::WebInputEvent::kTouchEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchEnd,
             child_frame_monitor.events_received()[4]);
 }
 
@@ -6249,19 +6297,19 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessGestureHitTestBrowserTest,
 
   // Verify root-RWHI gets TS/TE/GTD/GSB/GPB/GPE/GSE.
   EXPECT_TRUE(root_frame_monitor.EventWasReceived());
-  EXPECT_EQ(blink::WebInputEvent::kTouchStart,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchStart,
             root_frame_monitor.events_received()[0]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureTapDown,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureTapDown,
             root_frame_monitor.events_received()[1]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollBegin,
             root_frame_monitor.events_received()[2]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchBegin,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchBegin,
             root_frame_monitor.events_received()[3]);
-  EXPECT_EQ(blink::WebInputEvent::kGesturePinchEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGesturePinchEnd,
             root_frame_monitor.events_received()[4]);
-  EXPECT_EQ(blink::WebInputEvent::kGestureScrollEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kGestureScrollEnd,
             root_frame_monitor.events_received()[5]);
-  EXPECT_EQ(blink::WebInputEvent::kTouchEnd,
+  EXPECT_EQ(blink::WebInputEvent::Type::kTouchEnd,
             root_frame_monitor.events_received()[6]);
 
   // Verify child-RWHI gets no events.
@@ -6310,7 +6358,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessNonIntegerScaleFactorHitTestBrowserTest,
       root->current_frame_host()->GetRenderWidgetHost());
 
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   SetWebEventPositions(&mouse_event, gfx::Point(75, 75), rwhv);
@@ -6324,7 +6373,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessNonIntegerScaleFactorHitTestBrowserTest,
                  event_monitor.event().PositionInWidget().y());
   event_monitor.ResetEventReceived();
 
-  mouse_event.SetType(blink::WebInputEvent::kMouseUp);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseUp);
   SetWebEventPositions(&mouse_event, gfx::Point(75, 75), rwhv);
   router->RouteMouseEvent(rwhv, &mouse_event, ui::LatencyInfo());
 
@@ -6381,14 +6430,15 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, HitTestClippedFrame) {
   gfx::PointF point_in_child(100, 100);
 
   blink::WebMouseEvent down_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   down_event.button = blink::WebPointerProperties::Button::kLeft;
   down_event.click_count = 1;
   SetWebEventPositions(&down_event, point_in_root, rwhv_root);
 
   blink::WebMouseEvent up_event(
-      blink::WebInputEvent::kMouseUp, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseUp, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   up_event.button = blink::WebPointerProperties::Button::kLeft;
   up_event.click_count = 1;
@@ -6478,10 +6528,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, HitTestNestedFrames) {
   // Create two points to hit test: One in the child of the main frame, and
   // one in the frame nested within that. The hit test request is sent to the
   // child's renderer.
-  gfx::PointF point_in_child(1, 1);
-  gfx::PointF point_in_nested_child(5, 5);
+  gfx::PointF point_in_child(1.29, 1.59);
+  gfx::PointF point_in_nested_child(5.52, 5.62);
+  gfx::PointF point_in_nested_child_transformed;  // Transformed into child view
+                                                  // coordinate space.
   rwhv_grandchild->TransformPointToCoordSpaceForView(
-      point_in_nested_child, rwhv_child, &point_in_nested_child);
+      point_in_nested_child, rwhv_child, &point_in_nested_child_transformed);
 
   {
     base::RunLoop run_loop;
@@ -6502,7 +6554,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, HitTestNestedFrames) {
     content::RunThisRunLoop(&run_loop);
     // |point_in_child| should hit test to the view for |child_node|.
     ASSERT_EQ(rwhv_child->GetFrameSinkId(), received_frame_sink_id);
-    ASSERT_EQ(gfx::PointF(1, 1), returned_point);
+    EXPECT_NEAR(returned_point.x(), point_in_child.x(), kHitTestLowTolerance);
+    EXPECT_NEAR(returned_point.y(), point_in_child.y(), kHitTestLowTolerance);
   }
 
   {
@@ -6514,7 +6567,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, HitTestNestedFrames) {
     DCHECK_NE(child_node->current_frame_host()->GetInputTargetClient(),
               nullptr);
     child_node->current_frame_host()->GetInputTargetClient()->FrameSinkIdAt(
-        point_in_nested_child, 0,
+        point_in_nested_child_transformed, 0,
         base::BindLambdaForTesting(
             [&](const viz::FrameSinkId& id, const gfx::PointF& point) {
               received_frame_sink_id = id;
@@ -6522,10 +6575,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHitTestBrowserTest, HitTestNestedFrames) {
               std::move(quit_closure).Run();
             }));
     content::RunThisRunLoop(&run_loop);
-    // |point_in_nested_child| should hit test to |rwhv_grandchild|.
+    // |point_in_nested_child_transformed| should hit test to |rwhv_grandchild|.
     ASSERT_EQ(rwhv_grandchild->GetFrameSinkId(), received_frame_sink_id);
-    EXPECT_NEAR(returned_point.x(), 5, kHitTestTolerance);
-    EXPECT_NEAR(returned_point.y(), 5, kHitTestTolerance);
+    EXPECT_NEAR(returned_point.x(), point_in_nested_child.x(),
+                kHitTestLowTolerance);
+    EXPECT_NEAR(returned_point.y(), point_in_nested_child.y(),
+                kHitTestLowTolerance);
   }
 }
 
@@ -6643,7 +6698,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessUserActivationHitTestBrowserTest,
 
   // Send a mouse down event to main frame.
   blink::WebMouseEvent mouse_event(
-      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseDown,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   mouse_event.button = blink::WebPointerProperties::Button::kLeft;
   mouse_event.click_count = 1;
@@ -6674,7 +6730,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessUserActivationHitTestBrowserTest,
       blink::mojom::UserActivationUpdateType::kClearActivation);
 
   // Send a mouse down to child frame.
-  mouse_event.SetType(blink::WebInputEvent::kMouseDown);
+  mouse_event.SetType(blink::WebInputEvent::Type::kMouseDown);
   child_frame_monitor.ResetEventReceived();
   DispatchMouseEventAndWaitUntilDispatch(web_contents(), mouse_event,
                                          rwhv_child, click_point, rwhv_child,
diff --git a/chromium/content/browser/site_per_process_mac_browsertest.mm b/chromium/content/browser/site_per_process_mac_browsertest.mm
index 627733b2b5d..6b331c93d1e 100644
--- a/chromium/content/browser/site_per_process_mac_browsertest.mm
+++ b/chromium/content/browser/site_per_process_mac_browsertest.mm
@@ -13,6 +13,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_mac.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/hit_test_region_observer.h"
@@ -154,16 +155,20 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMacBrowserTest,
       child_iframe_node->current_frame_host()->GetRenderWidgetHost();
 
   InputEventAckWaiter gesture_scroll_begin_ack_observer(
-      child_rwh, base::BindRepeating([](InputEventAckSource, InputEventAckState,
+      child_rwh, base::BindRepeating([](blink::mojom::InputEventResultSource,
+                                        blink::mojom::InputEventResultState,
                                         const blink::WebInputEvent& event) {
-        return event.GetType() == blink::WebInputEvent::kGestureScrollBegin &&
+        return event.GetType() ==
+                   blink::WebInputEvent::Type::kGestureScrollBegin &&
                !static_cast<const blink::WebGestureEvent&>(event)
                     .data.scroll_begin.synthetic;
       }));
   InputEventAckWaiter gesture_scroll_end_ack_observer(
-      child_rwh, base::BindRepeating([](InputEventAckSource, InputEventAckState,
+      child_rwh, base::BindRepeating([](blink::mojom::InputEventResultSource,
+                                        blink::mojom::InputEventResultState,
                                         const blink::WebInputEvent& event) {
-        return event.GetType() == blink::WebInputEvent::kGestureScrollEnd &&
+        return event.GetType() ==
+                   blink::WebInputEvent::Type::kGestureScrollEnd &&
                !static_cast<const blink::WebGestureEvent&>(event)
                     .data.scroll_end.synthetic;
       }));
@@ -172,7 +177,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMacBrowserTest,
       static_cast<RenderWidgetHostViewBase*>(child_rwh->GetView());
 
   blink::WebMouseWheelEvent scroll_event(
-      blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::Type::kMouseWheel,
+      blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(1, 1);
   scroll_event.delta_units = ui::ScrollGranularity::kScrollByPrecisePixel;
@@ -268,7 +274,7 @@ void SendMacTouchpadPinchSequenceWithExpectedTarget(
   // isn't sent until the first PinchUpdate.
 
   InputEventAckWaiter waiter(expected_target->GetRenderWidgetHost(),
-                             blink::WebInputEvent::kGesturePinchBegin);
+                             blink::WebInputEvent::Type::kGesturePinchBegin);
   NSEvent* pinchUpdateEvent =
       MockGestureEvent(NSEventTypeMagnify, 0.25, gesture_point.x(),
                        gesture_point.y(), NSEventPhaseChanged);
diff --git a/chromium/content/browser/site_per_process_unload_browsertest.cc b/chromium/content/browser/site_per_process_unload_browsertest.cc
index 409b23ee5aa..64c47aa83a8 100644
--- a/chromium/content/browser/site_per_process_unload_browsertest.cc
+++ b/chromium/content/browser/site_per_process_unload_browsertest.cc
@@ -26,6 +26,7 @@
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
@@ -35,6 +36,7 @@
 #include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -560,9 +562,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UnloadNestedPendingDeletion) {
   RenderFrameHostImpl* rfh_a = web_contents()->GetMainFrame();
   RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
   RenderFrameHostImpl* rfh_c = rfh_b->child_at(0)->current_frame_host();
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_c->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_c->lifecycle_state());
 
   // Act as if there was a slow unload handler on rfh_b and rfh_c.
   // The navigating frames are waiting for FrameHostMsg_Unload_ACK.
@@ -581,9 +586,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UnloadNestedPendingDeletion) {
 
   // 2) Navigate rfh_c to D.
   NavigateFrameToURL(rfh_c->frame_tree_node(), url_d);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_c->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_c->lifecycle_state());
   RenderFrameHostImpl* rfh_d = rfh_b->child_at(0)->current_frame_host();
   // Set an arbitrarily long timeout to ensure the subframe unload timer doesn't
   // fire before we call OnDetach().
@@ -600,10 +608,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UnloadNestedPendingDeletion) {
 
   // 3) Navigate rfh_b to E.
   NavigateFrameToURL(rfh_b->frame_tree_node(), url_e);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::NotRun, rfh_a->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_b->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_c->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, rfh_d->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kActive,
+            rfh_a->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_b->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_c->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            rfh_d->lifecycle_state());
 
   // rfh_d completes its unload event. It deletes the frame, including rfh_c.
   EXPECT_FALSE(delete_c.deleted());
@@ -676,9 +688,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, PartialUnloadHandler) {
   EXPECT_FALSE(delete_a1.deleted());
   EXPECT_FALSE(delete_b1.deleted());
   EXPECT_FALSE(delete_a2.deleted());
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, a1->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::Completed, b1->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, a2->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            a1->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kReadyToBeDeleted,
+            b1->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            a2->lifecycle_state());
 
   // 3) B1 receives confirmation it has been deleted. This has no effect,
   //    because it is still waiting on A2 to be deleted.
@@ -686,16 +701,20 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, PartialUnloadHandler) {
   EXPECT_FALSE(delete_a1.deleted());
   EXPECT_FALSE(delete_b1.deleted());
   EXPECT_FALSE(delete_a2.deleted());
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, a1->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::Completed, b1->unload_state_);
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, a2->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            a1->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kReadyToBeDeleted,
+            b1->lifecycle_state());
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            a2->lifecycle_state());
 
   // 4) A2 received confirmation that it has been deleted and destroy B1 and A2.
   a2->OnDetach();
   EXPECT_FALSE(delete_a1.deleted());
   EXPECT_TRUE(delete_b1.deleted());
   EXPECT_TRUE(delete_a2.deleted());
-  EXPECT_EQ(RenderFrameHostImpl::UnloadState::InProgress, a1->unload_state_);
+  EXPECT_EQ(RenderFrameHostImpl::LifecycleState::kRunningUnloadHandlers,
+            a1->lifecycle_state());
 
   // 5) A1 receives FrameHostMsg_Unload_ACK and deletes itself.
   a1->OnUnloadACK();
@@ -1189,11 +1208,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, FocusedFrameUnload) {
   EXPECT_TRUE(B2->GetSuddenTerminationDisablerState(
       blink::mojom::SuddenTerminationDisablerType::kUnloadHandler));
 
-  EXPECT_TRUE(B2->is_active());
+  EXPECT_TRUE(B2->IsCurrent());
   EXPECT_TRUE(ExecJs(A1, "document.querySelector('iframe').remove()"));
   EXPECT_EQ(nullptr, frame_tree->GetFocusedFrame());
   EXPECT_EQ(2u, A1->child_count());
-  EXPECT_FALSE(B2->is_active());
+  EXPECT_TRUE(B2->IsPendingDeletion());
 
   // 3. C3 navigates.
   NavigateFrameToURL(C3->frame_tree_node(),
@@ -1430,8 +1449,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessSSLBrowserTest,
   // Navigate A1(B2) to A3.
   {
     // Prepare observers.
-    ConsoleObserverDelegate console(web_contents(), "console.log() sent");
-    web_contents()->SetDelegate(&console);
+    WebContentsConsoleObserver console_observer(web_contents());
+    console_observer.SetPattern("console.log() sent");
     RenderFrameDeletedObserver B2_deleted(B2);
 
     // Navigate
@@ -1440,7 +1459,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessSSLBrowserTest,
 
     // Observers must be reached.
     B2_deleted.WaitUntilDeleted();
-    console.Wait();
+    console_observer.Wait();
   }
 
   // Navigate back from A3 to A4(B5).
@@ -1523,8 +1542,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessSSLBrowserTest,
   // Navigate A1(B2(C3) to A4.
   {
     // Prepare observers.
-    ConsoleObserverDelegate console(web_contents(), "console.log() sent");
-    web_contents()->SetDelegate(&console);
+    WebContentsConsoleObserver console_observer(web_contents());
+    console_observer.SetPattern("console.log() sent");
     RenderFrameDeletedObserver B2_deleted(B2);
     RenderFrameDeletedObserver C3_deleted(C3);
 
@@ -1535,7 +1554,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessSSLBrowserTest,
     // Observers must be reached.
     B2_deleted.WaitUntilDeleted();
     C3_deleted.WaitUntilDeleted();
-    console.Wait();
+    console_observer.Wait();
   }
 
   // Navigate back from A4 to A5(B6(C7))
diff --git a/chromium/content/browser/sms/OWNERS b/chromium/content/browser/sms/OWNERS
index cbdee966b88..1b41f2968e4 100644
--- a/chromium/content/browser/sms/OWNERS
+++ b/chromium/content/browser/sms/OWNERS
@@ -1,6 +1,7 @@
-ayui@chromium.org
-jsbell@chromium.org
-juncai@chromium.org
+# Primary
+goto@chromium.org
+
+# Secondary
 reillyg@chromium.org
 
 # COMPONENT: Blink>SMS
diff --git a/chromium/content/browser/sms/sms_browsertest.cc b/chromium/content/browser/sms/sms_browsertest.cc
index c78c7aa2779..ce32f040cc6 100644
--- a/chromium/content/browser/sms/sms_browsertest.cc
+++ b/chromium/content/browser/sms/sms_browsertest.cc
@@ -3,7 +3,9 @@
 // found in the LICENSE file.
 
 #include <memory>
+#include <string>
 
+#include "base/test/bind_test_util.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "components/ukm/test_ukm_recorder.h"
 #include "content/browser/browser_main_loop.h"
@@ -13,6 +15,7 @@
 #include "content/browser/sms/test/mock_sms_web_contents_delegate.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -24,6 +27,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/common/sms/sms_receiver_outcome.h"
 
+using blink::mojom::SmsStatus;
 using ::testing::_;
 using ::testing::Invoke;
 using ::testing::NiceMock;
@@ -114,9 +118,8 @@ class SmsBrowserTest : public ContentBrowserTest {
     cert_verifier_.TearDownInProcessBrowserTestFixture();
   }
 
-  SmsFetcherImpl* GetSmsFetcher() {
-    return static_cast<SmsFetcherImpl*>(
-        SmsFetcher::Get(shell()->web_contents()->GetBrowserContext()));
+  SmsFetcher* GetSmsFetcher() {
+    return SmsFetcher::Get(shell()->web_contents()->GetBrowserContext());
   }
 
   ukm::TestAutoSetUkmRecorder* ukm_recorder() { return ukm_recorder_.get(); }
@@ -145,7 +148,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Receive) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   // Test that SMS content can be retrieved after navigator.credentials.get().
   std::string script = R"(
@@ -155,7 +158,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Receive) {
     }) ();
   )";
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&]() {
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).WillOnce(Invoke([&]() {
     mock_provider_ptr->NotifyReceive(url::Origin::Create(url), "hello");
     ConfirmPrompt();
   }));
@@ -187,7 +190,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AtMostOneSmsRequestPerOrigin) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   std::string script = R"(
     (async () => {
@@ -203,7 +206,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AtMostOneSmsRequestPerOrigin) {
     }) ();
   )";
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve())
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_))
       .WillOnce(Return())
       .WillOnce(Invoke([&]() {
         mock_provider_ptr->NotifyReceive(url::Origin::Create(url), "hello");
@@ -230,7 +233,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest,
                        DISABLED_AtMostOneSmsRequestPerOriginPerTab) {
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   Shell* tab1 = CreateBrowser();
   Shell* tab2 = CreateBrowser();
@@ -243,7 +246,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest,
   tab1->web_contents()->SetDelegate(&delegate_);
   tab2->web_contents()->SetDelegate(&delegate_);
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).Times(3);
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).Times(3);
 
   // Make 1 request on tab1 that is expected to be cancelled when the 2nd
   // request is made.
@@ -329,7 +332,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Reload) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   std::string script = R"(
     // kicks off the sms receiver, adding the service
@@ -339,7 +342,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Reload) {
 
   base::RunLoop loop;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&loop]() {
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).WillOnce(Invoke([&loop]() {
     // Deliberately avoid calling NotifyReceive() to simulate
     // a request that has been received but not fulfilled.
     loop.Quit();
@@ -373,11 +376,11 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Close) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   base::RunLoop loop;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&loop]() {
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).WillOnce(Invoke([&loop]() {
     loop.Quit();
   }));
 
@@ -402,7 +405,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Close) {
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, DISABLED_TwoTabsSameOrigin) {
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   Shell* tab1 = CreateBrowser();
   Shell* tab2 = CreateBrowser();
@@ -415,7 +418,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, DISABLED_TwoTabsSameOrigin) {
   tab1->web_contents()->SetDelegate(&delegate_);
   tab2->web_contents()->SetDelegate(&delegate_);
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).Times(2);
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).Times(2);
 
   std::string script = R"(
     var otp = navigator.credentials.get({otp: {transport: ["sms"]}})
@@ -483,7 +486,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, DISABLED_TwoTabsSameOrigin) {
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, DISABLED_TwoTabsDifferentOrigin) {
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   Shell* tab1 = CreateBrowser();
   Shell* tab2 = CreateBrowser();
@@ -507,7 +510,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, DISABLED_TwoTabsDifferentOrigin) {
 
   base::RunLoop loop;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).Times(2);
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).Times(2);
 
   tab1->web_contents()->SetDelegate(&delegate_);
   tab2->web_contents()->SetDelegate(&delegate_);
@@ -559,11 +562,11 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, SmsReceivedAfterTabIsClosed) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   base::RunLoop loop;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&loop]() {
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).WillOnce(Invoke([&loop]() {
     loop.Quit();
   }));
 
@@ -588,7 +591,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Cancels) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   shell()->web_contents()->SetDelegate(&delegate_);
 
@@ -596,7 +599,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Cancels) {
 
   ExpectSmsPrompt();
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&]() {
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_)).WillOnce(Invoke([&]() {
     mock_provider_ptr->NotifyReceive(url::Origin::Create(url), "hello");
     DismissPrompt();
   }));
@@ -628,13 +631,13 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AbortAfterSmsRetrieval) {
 
   auto provider = std::make_unique<MockSmsProvider>();
   MockSmsProvider* mock_provider_ptr = provider.get();
-  GetSmsFetcher()->SetSmsProviderForTesting(std::move(provider));
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(std::move(provider));
 
   shell()->web_contents()->SetDelegate(&delegate_);
 
   ExpectSmsPrompt();
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve())
+  EXPECT_CALL(*mock_provider_ptr, Retrieve(_))
       .WillOnce(Invoke([&mock_provider_ptr, &url]() {
         mock_provider_ptr->NotifyReceive(url::Origin::Create(url), "hello");
       }));
@@ -665,4 +668,56 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AbortAfterSmsRetrieval) {
   ExpectOutcomeUKM(url, blink::SMSReceiverOutcome::kAborted);
 }
 
+IN_PROC_BROWSER_TEST_F(SmsBrowserTest, SmsFetcherUAF) {
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+      switches::kWebOtpBackend, switches::kWebOtpBackendUserConsent);
+  GURL url = GetTestUrl(nullptr, "simple_page.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  auto* provider = new NiceMock<MockSmsProvider>();
+  BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(
+      base::WrapUnique(provider));
+
+  shell()->web_contents()->SetDelegate(&delegate_);
+
+  auto* fetcher = SmsFetcher::Get(shell()->web_contents()->GetBrowserContext());
+  auto* fetcher2 =
+      SmsFetcher::Get(shell()->web_contents()->GetBrowserContext());
+  mojo::Remote<blink::mojom::SmsReceiver> service;
+  mojo::Remote<blink::mojom::SmsReceiver> service2;
+
+  RenderFrameHost* render_frame_host = shell()->web_contents()->GetMainFrame();
+  SmsService::Create(fetcher, render_frame_host,
+                     service.BindNewPipeAndPassReceiver());
+  SmsService::Create(fetcher2, render_frame_host,
+                     service2.BindNewPipeAndPassReceiver());
+
+  base::RunLoop navigate;
+
+  EXPECT_CALL(*provider, Retrieve(_))
+      .WillOnce(Invoke([&]() {
+        static_cast<SmsFetcherImpl*>(fetcher)->OnReceive(
+            url::Origin::Create(url), "ABC234");
+      }))
+      .WillOnce(Invoke([&]() {
+        static_cast<SmsFetcherImpl*>(fetcher2)->OnReceive(
+            url::Origin::Create(url), "DEF567");
+      }));
+
+  service->Receive(base::BindLambdaForTesting(
+      [](SmsStatus status, const base::Optional<std::string>& otp) {
+        EXPECT_EQ(SmsStatus::kSuccess, status);
+        EXPECT_EQ("ABC234", otp);
+      }));
+
+  service2->Receive(base::BindLambdaForTesting(
+      [&navigate](SmsStatus status, const base::Optional<std::string>& otp) {
+        EXPECT_EQ(SmsStatus::kSuccess, status);
+        EXPECT_EQ("DEF567", otp);
+        navigate.Quit();
+      }));
+
+  navigate.Run();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/sms/sms_fetcher_impl.cc b/chromium/content/browser/sms/sms_fetcher_impl.cc
index 0f4ef7ae1be..cbbe00c3c84 100644
--- a/chromium/content/browser/sms/sms_fetcher_impl.cc
+++ b/chromium/content/browser/sms/sms_fetcher_impl.cc
@@ -15,9 +15,8 @@ namespace content {
 
 const char kSmsFetcherImplKeyName[] = "sms_fetcher";
 
-SmsFetcherImpl::SmsFetcherImpl(BrowserContext* context,
-                               std::unique_ptr<SmsProvider> provider)
-    : context_(context), provider_(std::move(provider)) {
+SmsFetcherImpl::SmsFetcherImpl(BrowserContext* context, SmsProvider* provider)
+    : context_(context), provider_(provider) {
   if (provider_)
     provider_->AddObserver(this);
 }
@@ -30,33 +29,30 @@ SmsFetcherImpl::~SmsFetcherImpl() {
 // static
 SmsFetcher* SmsFetcher::Get(BrowserContext* context) {
   if (!context->GetUserData(kSmsFetcherImplKeyName)) {
-    auto fetcher = std::make_unique<SmsFetcherImpl>(context, nullptr);
-    context->SetUserData(kSmsFetcherImplKeyName, std::move(fetcher));
-  }
-
-  return static_cast<SmsFetcherImpl*>(
-      context->GetUserData(kSmsFetcherImplKeyName));
-}
-
-SmsFetcher* SmsFetcher::Get(BrowserContext* context,
-                            base::WeakPtr<RenderFrameHost> rfh) {
-  auto* stored_fetcher = static_cast<SmsFetcherImpl*>(
-      context->GetUserData(kSmsFetcherImplKeyName));
-  if (!stored_fetcher || !stored_fetcher->CanReceiveSms()) {
     auto fetcher = std::make_unique<SmsFetcherImpl>(
-        context, SmsProvider::Create(std::move(rfh)));
+        context, BrowserMainLoop::GetInstance()->GetSmsProvider());
     context->SetUserData(kSmsFetcherImplKeyName, std::move(fetcher));
   }
+
   return static_cast<SmsFetcherImpl*>(
       context->GetUserData(kSmsFetcherImplKeyName));
 }
 
+// TODO(crbug.com/1015645): Add implementation.
 void SmsFetcherImpl::Subscribe(const url::Origin& origin,
                                SmsQueue::Subscriber* subscriber) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  NOTIMPLEMENTED();
+}
 
-  if (subscribers_.HasSubscriber(origin, subscriber))
-    return;
+void SmsFetcherImpl::Subscribe(const url::Origin& origin,
+                               SmsQueue::Subscriber* subscriber,
+                               RenderFrameHost* render_frame_host) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(subscriber);
+  DCHECK(render_frame_host);
+  // Should not be called multiple times for the same subscriber and origin.
+  DCHECK(!subscribers_.HasSubscriber(origin, subscriber));
 
   subscribers_.Push(origin, subscriber);
 
@@ -68,11 +64,13 @@ void SmsFetcherImpl::Subscribe(const url::Origin& origin,
 
   // Fetches a local SMS.
   if (provider_)
-    provider_->Retrieve();
+    provider_->Retrieve(render_frame_host);
 }
 
 void SmsFetcherImpl::Unsubscribe(const url::Origin& origin,
                                  SmsQueue::Subscriber* subscriber) {
+  // Unsubscribe does not make a call to the provider because currently there
+  // is no mechanism to cancel a subscription.
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   subscribers_.Remove(origin, subscriber);
 }
@@ -80,13 +78,13 @@ void SmsFetcherImpl::Unsubscribe(const url::Origin& origin,
 bool SmsFetcherImpl::Notify(const url::Origin& origin,
                             const std::string& one_time_code) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  // The received OTP is returned to the first subscriber for the origin.
   auto* subscriber = subscribers_.Pop(origin);
 
   if (!subscriber)
     return false;
 
   subscriber->OnReceive(one_time_code);
-
   return true;
 }
 
@@ -114,15 +112,4 @@ bool SmsFetcherImpl::HasSubscribers() {
   return subscribers_.HasSubscribers();
 }
 
-bool SmsFetcherImpl::CanReceiveSms() {
-  return provider_ != nullptr;
-}
-
-void SmsFetcherImpl::SetSmsProviderForTesting(
-    std::unique_ptr<SmsProvider> provider) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  provider_ = std::move(provider);
-  provider_->AddObserver(this);
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/sms/sms_fetcher_impl.h b/chromium/content/browser/sms/sms_fetcher_impl.h
index 1f47f0a38bf..39340b06009 100644
--- a/chromium/content/browser/sms/sms_fetcher_impl.h
+++ b/chromium/content/browser/sms/sms_fetcher_impl.h
@@ -29,11 +29,17 @@ class CONTENT_EXPORT SmsFetcherImpl : public content::SmsFetcher,
                                       public base::SupportsUserData::Data,
                                       public SmsProvider::Observer {
  public:
-  SmsFetcherImpl(BrowserContext* context,
-                 std::unique_ptr<SmsProvider> provider);
+  SmsFetcherImpl(BrowserContext* context, SmsProvider* provider);
   ~SmsFetcherImpl() override;
 
+  // Called by devices that do not have telephony capabilities and exclusively
+  // listen for SMSes received on other devices.
   void Subscribe(const url::Origin& origin, Subscriber* subscriber) override;
+  // Called by |SmsService| to fetch SMSes retrieved by the SmsProvider from the
+  // requested device.
+  void Subscribe(const url::Origin& origin,
+                 Subscriber* subscriber,
+                 RenderFrameHost* rfh) override;
   void Unsubscribe(const url::Origin& origin, Subscriber* subscriber) override;
 
   // content::SmsProvider::Observer:
@@ -41,9 +47,6 @@ class CONTENT_EXPORT SmsFetcherImpl : public content::SmsFetcher,
                  const std::string& one_time_code) override;
 
   bool HasSubscribers() override;
-  bool CanReceiveSms() override;
-
-  void SetSmsProviderForTesting(std::unique_ptr<SmsProvider> provider);
 
  private:
   void OnRemote(base::Optional<std::string> sms);
@@ -54,7 +57,9 @@ class CONTENT_EXPORT SmsFetcherImpl : public content::SmsFetcher,
   // the BrowserContext itself.
   BrowserContext* context_;
 
-  std::unique_ptr<SmsProvider> provider_;
+  // |provider_| is safe because all instances of SmsProvider are owned
+  // by the BrowserMainLoop, which outlive instances of this class.
+  SmsProvider* const provider_;
 
   SmsQueue subscribers_;
 
diff --git a/chromium/content/browser/sms/sms_fetcher_impl_unittest.cc b/chromium/content/browser/sms/sms_fetcher_impl_unittest.cc
index 83fde15c56c..f7f7d25f6f8 100644
--- a/chromium/content/browser/sms/sms_fetcher_impl_unittest.cc
+++ b/chromium/content/browser/sms/sms_fetcher_impl_unittest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/sms/test/mock_sms_provider.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/test_renderer_host.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -47,29 +48,30 @@ class MockSubscriber : public SmsFetcher::Subscriber {
   DISALLOW_COPY_AND_ASSIGN(MockSubscriber);
 };
 
-class SmsFetcherImplTest : public testing::Test {
+class SmsFetcherImplTest : public RenderViewHostTestHarness {
  public:
   SmsFetcherImplTest() = default;
   ~SmsFetcherImplTest() override = default;
 
   void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
     original_client_ = SetBrowserClientForTesting(&client_);
-    provider_ = new NiceMock<MockSmsProvider>();
   }
 
   void TearDown() override {
     if (original_client_)
       SetBrowserClientForTesting(original_client_);
+    RenderViewHostTestHarness::TearDown();
   }
 
  protected:
   MockContentBrowserClient* client() { return &client_; }
-  MockSmsProvider* provider() { return provider_; }
+  MockSmsProvider* provider() { return &provider_; }
 
  private:
   ContentBrowserClient* original_client_ = nullptr;
   NiceMock<MockContentBrowserClient> client_;
-  NiceMock<MockSmsProvider>* provider_;
+  NiceMock<MockSmsProvider> provider_;
 
   DISALLOW_COPY_AND_ASSIGN(SmsFetcherImplTest);
 };
@@ -80,20 +82,20 @@ TEST_F(SmsFetcherImplTest, ReceiveFromLocalSmsProvider) {
   const url::Origin kOrigin = url::Origin::Create(GURL("https://a.com"));
 
   StrictMock<MockSubscriber> subscriber;
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
-  EXPECT_CALL(*provider(), Retrieve()).WillOnce(Invoke([&]() {
+  EXPECT_CALL(*provider(), Retrieve(_)).WillOnce(Invoke([&]() {
     provider()->NotifyReceive(kOrigin, "123");
   }));
 
   EXPECT_CALL(subscriber, OnReceive("123"));
 
-  fetcher.Subscribe(kOrigin, &subscriber);
+  fetcher.Subscribe(kOrigin, &subscriber, main_rfh());
 }
 
 TEST_F(SmsFetcherImplTest, ReceiveFromRemoteProvider) {
   StrictMock<MockSubscriber> subscriber;
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
   const std::string& sms = "@a.com #123";
 
@@ -106,12 +108,13 @@ TEST_F(SmsFetcherImplTest, ReceiveFromRemoteProvider) {
 
   EXPECT_CALL(subscriber, OnReceive("123"));
 
-  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber);
+  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber,
+                    main_rfh());
 }
 
 TEST_F(SmsFetcherImplTest, RemoteProviderTimesOut) {
   StrictMock<MockSubscriber> subscriber;
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
   EXPECT_CALL(*client(), FetchRemoteSms(_, _, _))
       .WillOnce(Invoke(
@@ -122,12 +125,13 @@ TEST_F(SmsFetcherImplTest, RemoteProviderTimesOut) {
 
   EXPECT_CALL(subscriber, OnReceive(_)).Times(0);
 
-  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber);
+  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber,
+                    main_rfh());
 }
 
 TEST_F(SmsFetcherImplTest, ReceiveFromOtherOrigin) {
   StrictMock<MockSubscriber> subscriber;
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
   EXPECT_CALL(*client(), FetchRemoteSms(_, _, _))
       .WillOnce(Invoke(
@@ -138,12 +142,14 @@ TEST_F(SmsFetcherImplTest, ReceiveFromOtherOrigin) {
 
   EXPECT_CALL(subscriber, OnReceive(_)).Times(0);
 
-  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber);
+  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber,
+                    main_rfh());
 }
 
 TEST_F(SmsFetcherImplTest, ReceiveFromBothProviders) {
+  const url::Origin kOrigin = url::Origin::Create(GURL("https://a.com"));
   StrictMock<MockSubscriber> subscriber;
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
   const std::string& sms = "hello\n@a.com #123";
 
@@ -154,14 +160,14 @@ TEST_F(SmsFetcherImplTest, ReceiveFromBothProviders) {
             std::move(callback).Run(sms);
           }));
 
-  EXPECT_CALL(*provider(), Retrieve()).WillOnce(Invoke([&]() {
-    provider()->NotifyReceive(sms);
+  EXPECT_CALL(*provider(), Retrieve(_)).WillOnce(Invoke([&]() {
+    provider()->NotifyReceive(kOrigin, sms);
   }));
 
   // Expects subscriber to be notified just once.
   EXPECT_CALL(subscriber, OnReceive("123"));
 
-  fetcher.Subscribe(url::Origin::Create(GURL("https://a.com")), &subscriber);
+  fetcher.Subscribe(kOrigin, &subscriber, main_rfh());
 }
 
 TEST_F(SmsFetcherImplTest, OneOriginTwoSubscribers) {
@@ -170,10 +176,10 @@ TEST_F(SmsFetcherImplTest, OneOriginTwoSubscribers) {
   StrictMock<MockSubscriber> subscriber1;
   StrictMock<MockSubscriber> subscriber2;
 
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
+  SmsFetcherImpl fetcher(nullptr, provider());
 
-  fetcher.Subscribe(kOrigin, &subscriber1);
-  fetcher.Subscribe(kOrigin, &subscriber2);
+  fetcher.Subscribe(kOrigin, &subscriber1, main_rfh());
+  fetcher.Subscribe(kOrigin, &subscriber2, main_rfh());
 
   EXPECT_CALL(subscriber1, OnReceive("123"));
   provider()->NotifyReceive(kOrigin, "123");
@@ -189,9 +195,9 @@ TEST_F(SmsFetcherImplTest, TwoOriginsTwoSubscribers) {
   StrictMock<MockSubscriber> subscriber1;
   StrictMock<MockSubscriber> subscriber2;
 
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
-  fetcher.Subscribe(kOrigin1, &subscriber1);
-  fetcher.Subscribe(kOrigin2, &subscriber2);
+  SmsFetcherImpl fetcher(nullptr, provider());
+  fetcher.Subscribe(kOrigin1, &subscriber1, main_rfh());
+  fetcher.Subscribe(kOrigin2, &subscriber2, main_rfh());
 
   EXPECT_CALL(subscriber2, OnReceive("456"));
   provider()->NotifyReceive(kOrigin2, "456");
@@ -200,20 +206,4 @@ TEST_F(SmsFetcherImplTest, TwoOriginsTwoSubscribers) {
   provider()->NotifyReceive(kOrigin1, "123");
 }
 
-TEST_F(SmsFetcherImplTest, SubscribeIsIdempotent) {
-  const url::Origin kOrigin = url::Origin::Create(GURL("https://a.com"));
-
-  StrictMock<MockSubscriber> subscriber;
-
-  SmsFetcherImpl fetcher(nullptr, base::WrapUnique(provider()));
-  fetcher.Subscribe(kOrigin, &subscriber);
-  fetcher.Subscribe(kOrigin, &subscriber);
-
-  EXPECT_TRUE(fetcher.HasSubscribers());
-
-  fetcher.Unsubscribe(kOrigin, &subscriber);
-
-  EXPECT_FALSE(fetcher.HasSubscribers());
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/sms/sms_provider.cc b/chromium/content/browser/sms/sms_provider.cc
index 734a64b2fcb..b23af2aff4b 100644
--- a/chromium/content/browser/sms/sms_provider.cc
+++ b/chromium/content/browser/sms/sms_provider.cc
@@ -18,21 +18,18 @@
 
 namespace content {
 
-class RenderFrameHost;
-
 SmsProvider::SmsProvider() = default;
 SmsProvider::~SmsProvider() = default;
 
 // static
-std::unique_ptr<SmsProvider> SmsProvider::Create(
-    base::WeakPtr<RenderFrameHost> rfh) {
+std::unique_ptr<SmsProvider> SmsProvider::Create() {
 #if defined(OS_ANDROID)
   if (base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
           switches::kWebOtpBackend) ==
       switches::kWebOtpBackendSmsVerification) {
     return std::make_unique<SmsProviderGmsVerification>();
   }
-  return std::make_unique<SmsProviderGmsUserConsent>(std::move(rfh));
+  return std::make_unique<SmsProviderGmsUserConsent>();
 #else
   return nullptr;
 #endif
diff --git a/chromium/content/browser/sms/sms_provider.h b/chromium/content/browser/sms/sms_provider.h
index 63c69a83f79..3057158a786 100644
--- a/chromium/content/browser/sms/sms_provider.h
+++ b/chromium/content/browser/sms/sms_provider.h
@@ -38,18 +38,22 @@ class CONTENT_EXPORT SmsProvider {
   virtual ~SmsProvider();
 
   // Listen to the next incoming SMS and notify observers (exactly once) when
-  // it is received or (exclusively) when it timeouts.
-  virtual void Retrieve() = 0;
+  // it is received or (exclusively) when it timeouts. |render_frame_host|
+  // is the RenderFrameHost for the renderer that issued the request, and is
+  // passed in to support showing native permission confirmation prompt on the
+  // relevant window.
+  virtual void Retrieve(RenderFrameHost* render_frame_host) = 0;
 
-  static std::unique_ptr<SmsProvider> Create(
-      base::WeakPtr<RenderFrameHost> rfh);
+  static std::unique_ptr<SmsProvider> Create();
 
   void AddObserver(Observer*);
   void RemoveObserver(const Observer*);
   void NotifyReceive(const url::Origin&, const std::string& one_time_code);
-  void NotifyReceive(const std::string& sms);
   bool HasObservers();
 
+ protected:
+  void NotifyReceive(const std::string& sms);
+
  private:
   base::ObserverList<Observer> observers_;
   DISALLOW_COPY_AND_ASSIGN(SmsProvider);
diff --git a/chromium/content/browser/sms/sms_provider_gms_user_consent.cc b/chromium/content/browser/sms/sms_provider_gms_user_consent.cc
index 3164917db6d..4187ad93e28 100644
--- a/chromium/content/browser/sms/sms_provider_gms_user_consent.cc
+++ b/chromium/content/browser/sms/sms_provider_gms_user_consent.cc
@@ -19,9 +19,7 @@ using base::android::ConvertJavaStringToUTF8;
 
 namespace content {
 
-SmsProviderGmsUserConsent::SmsProviderGmsUserConsent(
-    base::WeakPtr<RenderFrameHost> rfh)
-    : SmsProvider(), render_frame_host_(std::move(rfh)) {
+SmsProviderGmsUserConsent::SmsProviderGmsUserConsent() : SmsProvider() {
   // This class is constructed a single time whenever the
   // first web page uses the SMS Retriever API to wait for
   // SMSes.
@@ -35,12 +33,11 @@ SmsProviderGmsUserConsent::~SmsProviderGmsUserConsent() {
   Java_SmsUserConsentReceiver_destroy(env, j_sms_receiver_);
 }
 
-void SmsProviderGmsUserConsent::Retrieve() {
-  if (!render_frame_host_)
-    return;
+void SmsProviderGmsUserConsent::Retrieve(RenderFrameHost* render_frame_host) {
+  DCHECK(render_frame_host);
 
   WebContents* web_contents =
-      WebContents::FromRenderFrameHost(render_frame_host_.get());
+      WebContents::FromRenderFrameHost(render_frame_host);
   if (!web_contents || !web_contents->GetTopLevelNativeWindow())
     return;
 
diff --git a/chromium/content/browser/sms/sms_provider_gms_user_consent.h b/chromium/content/browser/sms/sms_provider_gms_user_consent.h
index 6aea26b1475..309fa766897 100644
--- a/chromium/content/browser/sms/sms_provider_gms_user_consent.h
+++ b/chromium/content/browser/sms/sms_provider_gms_user_consent.h
@@ -17,20 +17,21 @@ namespace content {
 
 class CONTENT_EXPORT SmsProviderGmsUserConsent : public SmsProvider {
  public:
-  SmsProviderGmsUserConsent(base::WeakPtr<RenderFrameHost> rfh);
+  SmsProviderGmsUserConsent();
   ~SmsProviderGmsUserConsent() override;
 
-  void Retrieve() override;
+  void Retrieve(RenderFrameHost* render_frame_host) override;
 
+  // Implements JNI method SmsUserConsentReceiver.Natives.onReceive().
   void OnReceive(JNIEnv*, jstring message);
 
+  // Implements JNI method SmsUserConsentReceiver.Natives.onTimeout().
   void OnTimeout(JNIEnv* env);
 
   base::android::ScopedJavaGlobalRef<jobject> GetSmsReceiverForTesting() const;
 
  private:
   base::android::ScopedJavaGlobalRef<jobject> j_sms_receiver_;
-  const base::WeakPtr<RenderFrameHost> render_frame_host_;
 
   DISALLOW_COPY_AND_ASSIGN(SmsProviderGmsUserConsent);
 };
diff --git a/chromium/content/browser/sms/sms_provider_gms_user_consent_unittest.cc b/chromium/content/browser/sms/sms_provider_gms_user_consent_unittest.cc
index 7f6590376fb..62ef9357d4a 100644
--- a/chromium/content/browser/sms/sms_provider_gms_user_consent_unittest.cc
+++ b/chromium/content/browser/sms/sms_provider_gms_user_consent_unittest.cc
@@ -9,7 +9,6 @@
 #include "base/android/jni_string.h"
 #include "base/android/scoped_java_ref.h"
 #include "base/test/scoped_feature_list.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/sms/sms_provider.h"
 #include "content/browser/sms/sms_provider_gms_user_consent.h"
 #include "content/public/common/content_features.h"
@@ -49,8 +48,7 @@ class SmsProviderGmsUserConsentTest : public RenderViewHostTestHarness {
 
   void SetUp() {
     RenderViewHostTestHarness::SetUp();
-    provider_ = std::make_unique<SmsProviderGmsUserConsent>(
-        static_cast<RenderFrameHostImpl*>(main_rfh())->GetWeakPtr());
+    provider_ = std::make_unique<SmsProviderGmsUserConsent>();
     j_fake_sms_retriever_client_.Reset(
         Java_FakeSmsUserConsentRetrieverClient_create(AttachCurrentThread()));
     Java_SmsUserConsentFakes_setUserConsentClientForTesting(
@@ -91,7 +89,7 @@ class SmsProviderGmsUserConsentTest : public RenderViewHostTestHarness {
 TEST_F(SmsProviderGmsUserConsentTest, Retrieve) {
   EXPECT_CALL(*observer(),
               OnReceive(Origin::Create(GURL("https://google.com")), "ABC123"));
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerUserConsentSms("Hi\n@google.com #ABC123");
 }
 
@@ -102,14 +100,14 @@ TEST_F(SmsProviderGmsUserConsentTest, IgnoreBadSms) {
 
   EXPECT_CALL(*observer(), OnReceive(Origin::Create(GURL(test_url)), "ABC123"));
 
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerUserConsentSms(bad_sms);
   TriggerUserConsentSms(good_sms);
 }
 
 TEST_F(SmsProviderGmsUserConsentTest, TaskTimedOut) {
   EXPECT_CALL(*observer(), OnReceive(_, _)).Times(0);
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerTimeout();
 }
 
@@ -119,8 +117,8 @@ TEST_F(SmsProviderGmsUserConsentTest, OneObserverTwoTasks) {
   EXPECT_CALL(*observer(), OnReceive(Origin::Create(GURL(test_url)), "ABC123"));
 
   // Two tasks for when 1 request gets aborted but the task is still triggered.
-  provider()->Retrieve();
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
+  provider()->Retrieve(main_rfh());
 
   // First timeout should be ignored.
   TriggerTimeout();
diff --git a/chromium/content/browser/sms/sms_provider_gms_verification.cc b/chromium/content/browser/sms/sms_provider_gms_verification.cc
index 7caecf35722..bf75527d13c 100644
--- a/chromium/content/browser/sms/sms_provider_gms_verification.cc
+++ b/chromium/content/browser/sms/sms_provider_gms_verification.cc
@@ -33,7 +33,7 @@ SmsProviderGmsVerification::~SmsProviderGmsVerification() {
   Java_SmsVerificationReceiver_destroy(env, j_sms_receiver_);
 }
 
-void SmsProviderGmsVerification::Retrieve() {
+void SmsProviderGmsVerification::Retrieve(RenderFrameHost* render_frame_host) {
   JNIEnv* env = AttachCurrentThread();
   Java_SmsVerificationReceiver_listen(env, j_sms_receiver_);
 }
diff --git a/chromium/content/browser/sms/sms_provider_gms_verification.h b/chromium/content/browser/sms/sms_provider_gms_verification.h
index 9e9958ad00a..443931a8e69 100644
--- a/chromium/content/browser/sms/sms_provider_gms_verification.h
+++ b/chromium/content/browser/sms/sms_provider_gms_verification.h
@@ -15,15 +15,19 @@
 
 namespace content {
 
+class RenderFrameHost;
+
 class CONTENT_EXPORT SmsProviderGmsVerification : public SmsProvider {
  public:
   SmsProviderGmsVerification();
   ~SmsProviderGmsVerification() override;
 
-  void Retrieve() override;
+  void Retrieve(RenderFrameHost* rfh) override;
 
+  // Implements JNI method SmsVerificationReceiver.Natives.onReceive().
   void OnReceive(JNIEnv*, jstring message);
 
+  // Implements JNI method SmsVerificationReceiver.Natives.onTimeout().
   void OnTimeout(JNIEnv* env);
 
   base::android::ScopedJavaGlobalRef<jobject> GetSmsReceiverForTesting() const;
diff --git a/chromium/content/browser/sms/sms_provider_gms_verification_unittest.cc b/chromium/content/browser/sms/sms_provider_gms_verification_unittest.cc
index 60373460ee4..c18723be043 100644
--- a/chromium/content/browser/sms/sms_provider_gms_verification_unittest.cc
+++ b/chromium/content/browser/sms/sms_provider_gms_verification_unittest.cc
@@ -88,7 +88,7 @@ TEST_F(SmsProviderGmsVerificationTest, Retrieve) {
   std::string test_url = "https://google.com";
 
   EXPECT_CALL(*observer(), OnReceive(Origin::Create(GURL(test_url)), "ABC123"));
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerSmsVerificationSms("Hi\n@google.com #ABC123");
 }
 
@@ -99,14 +99,14 @@ TEST_F(SmsProviderGmsVerificationTest, IgnoreBadSms) {
 
   EXPECT_CALL(*observer(), OnReceive(Origin::Create(GURL(test_url)), "ABC123"));
 
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerSmsVerificationSms(bad_sms);
   TriggerSmsVerificationSms(good_sms);
 }
 
 TEST_F(SmsProviderGmsVerificationTest, TaskTimedOut) {
   EXPECT_CALL(*observer(), OnReceive(_, _)).Times(0);
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
   TriggerTimeout();
 }
 
@@ -116,8 +116,8 @@ TEST_F(SmsProviderGmsVerificationTest, OneObserverTwoTasks) {
   EXPECT_CALL(*observer(), OnReceive(Origin::Create(GURL(test_url)), "ABC123"));
 
   // Two tasks for when 1 request gets aborted but the task is still triggered.
-  provider()->Retrieve();
-  provider()->Retrieve();
+  provider()->Retrieve(main_rfh());
+  provider()->Retrieve(main_rfh());
 
   // First timeout should be ignored.
   TriggerTimeout();
diff --git a/chromium/content/browser/sms/sms_service.cc b/chromium/content/browser/sms/sms_service.cc
index ad2961d053d..f97f207c5ac 100644
--- a/chromium/content/browser/sms/sms_service.cc
+++ b/chromium/content/browser/sms/sms_service.cc
@@ -11,8 +11,8 @@
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/optional.h"
 #include "content/browser/sms/sms_metrics.h"
 #include "content/public/browser/navigation_details.h"
@@ -35,7 +35,9 @@ SmsService::SmsService(
     mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver)
     : FrameServiceBase(host, std::move(receiver)),
       fetcher_(fetcher),
-      origin_(origin) {}
+      origin_(origin) {
+  DCHECK(fetcher_);
+}
 
 SmsService::SmsService(
     SmsFetcher* fetcher,
@@ -49,6 +51,7 @@ SmsService::SmsService(
 SmsService::~SmsService() {
   if (callback_)
     Process(SmsStatus::kTimeout, base::nullopt);
+  DCHECK(!callback_);
 }
 
 // static
@@ -91,7 +94,7 @@ void SmsService::Receive(ReceiveCallback callback) {
     return;
   }
 
-  fetcher_->Subscribe(origin_, this);
+  fetcher_->Subscribe(origin_, this, render_frame_host());
 }
 
 void SmsService::OnReceive(const std::string& one_time_code) {
diff --git a/chromium/content/browser/sms/sms_service_unittest.cc b/chromium/content/browser/sms/sms_service_unittest.cc
index 65df3f119f0..4b24e4e4cff 100644
--- a/chromium/content/browser/sms/sms_service_unittest.cc
+++ b/chromium/content/browser/sms/sms_service_unittest.cc
@@ -23,14 +23,12 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/sms_fetcher.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/navigation_simulator.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_renderer_host.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/sms/sms_receiver_destroyed_reason.h"
@@ -43,9 +41,11 @@ using blink::mojom::SmsReceiver;
 using blink::mojom::SmsStatus;
 using std::string;
 using ::testing::_;
+using ::testing::ByMove;
 using ::testing::Invoke;
 using ::testing::NiceMock;
 using ::testing::Return;
+using ::testing::StrictMock;
 using url::Origin;
 
 namespace content {
@@ -64,17 +64,13 @@ const char kTestUrl[] = "https://www.google.com";
 // control the testing environment.
 class Service {
  public:
-  Service(WebContents* web_contents, const Origin& origin) {
-    auto provider = std::make_unique<NiceMock<MockSmsProvider>>();
-    provider_ = provider.get();
-    fetcher_ = static_cast<SmsFetcherImpl*>(
-        SmsFetcher::Get(web_contents->GetBrowserContext()));
-    fetcher_->SetSmsProviderForTesting(std::move(provider));
+  Service(WebContents* web_contents, const Origin& origin)
+      : fetcher_(web_contents->GetBrowserContext(), &provider_) {
     WebContentsImpl* web_contents_impl =
         reinterpret_cast<WebContentsImpl*>(web_contents);
     web_contents_impl->SetDelegate(&delegate_);
     service_ = std::make_unique<SmsService>(
-        fetcher_, origin, web_contents->GetMainFrame(),
+        &fetcher_, origin, web_contents->GetMainFrame(),
         service_remote_.BindNewPipeAndPassReceiver());
   }
 
@@ -82,8 +78,8 @@ class Service {
       : Service(web_contents,
                 web_contents->GetMainFrame()->GetLastCommittedOrigin()) {}
 
-  NiceMock<MockSmsProvider>* provider() { return provider_; }
-  SmsFetcherImpl* fetcher() { return fetcher_; }
+  NiceMock<MockSmsProvider>* provider() { return &provider_; }
+  SmsFetcher* fetcher() { return &fetcher_; }
 
   void CreateSmsPrompt(RenderFrameHost* rfh) {
     EXPECT_CALL(delegate_, CreateSmsPrompt(rfh, _, _, _, _))
@@ -124,13 +120,13 @@ class Service {
   void AbortRequest() { service_remote_->Abort(); }
 
   void NotifyReceive(const GURL& url, const string& otp) {
-    provider_->NotifyReceive(Origin::Create(url), otp);
+    provider_.NotifyReceive(Origin::Create(url), otp);
   }
 
  private:
   NiceMock<MockSmsWebContentsDelegate> delegate_;
-  NiceMock<MockSmsProvider>* provider_;
-  SmsFetcherImpl* fetcher_ = nullptr;
+  NiceMock<MockSmsProvider> provider_;
+  SmsFetcherImpl fetcher_;
   mojo::Remote<blink::mojom::SmsReceiver> service_remote_;
   std::unique_ptr<SmsService> service_;
   base::OnceClosure confirm_callback_;
@@ -175,7 +171,7 @@ TEST_F(SmsServiceTest, Basic) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "hi");
     service.ConfirmPrompt();
   }));
@@ -202,7 +198,7 @@ TEST_F(SmsServiceTest, HandlesMultipleCalls) {
 
     service.CreateSmsPrompt(main_rfh());
 
-    EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+    EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
       service.NotifyReceive(GURL(kTestUrl), "first");
       service.ConfirmPrompt();
     }));
@@ -222,7 +218,7 @@ TEST_F(SmsServiceTest, HandlesMultipleCalls) {
 
     service.CreateSmsPrompt(main_rfh());
 
-    EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+    EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
       service.NotifyReceive(GURL(kTestUrl), "second");
       service.ConfirmPrompt();
     }));
@@ -250,7 +246,7 @@ TEST_F(SmsServiceTest, IgnoreFromOtherOrigins) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     // Delivers an SMS from an unrelated origin first and expect the
     // receiver to ignore it.
     service.NotifyReceive(GURL("http://b.com"), "wrong");
@@ -284,7 +280,7 @@ TEST_F(SmsServiceTest, ExpectOneReceiveTwo) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     // Delivers two SMSes for the same origin, even if only one was being
     // expected.
     ASSERT_TRUE(service.fetcher()->HasSubscribers());
@@ -323,7 +319,7 @@ TEST_F(SmsServiceTest, AtMostOneSmsRequestPerOrigin) {
   // Expect SMS Prompt to be created once.
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve())
+  EXPECT_CALL(*service.provider(), Retrieve(_))
       .WillOnce(Return())
       .WillOnce(Invoke([&service]() {
         service.NotifyReceive(GURL(kTestUrl), "second");
@@ -373,7 +369,7 @@ TEST_F(SmsServiceTest, SecondRequestDuringPrompt) {
   // Expect SMS Prompt to be created once.
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "second");
   }));
 
@@ -412,17 +408,15 @@ TEST_F(SmsServiceTest, CleansUp) {
       reinterpret_cast<WebContentsImpl*>(web_contents());
   web_contents_impl->SetDelegate(&delegate);
 
-  auto provider = std::make_unique<MockSmsProvider>();
-  MockSmsProvider* mock_provider_ptr = provider.get();
-  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(),
-                         std::move(provider));
+  NiceMock<MockSmsProvider> provider;
+  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(), &provider);
   mojo::Remote<blink::mojom::SmsReceiver> service;
   SmsService::Create(&fetcher, main_rfh(),
                      service.BindNewPipeAndPassReceiver());
 
   base::RunLoop navigate;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&navigate]() {
+  EXPECT_CALL(provider, Retrieve(_)).WillOnce(Invoke([&navigate]() {
     navigate.Quit();
   }));
 
@@ -455,7 +449,7 @@ TEST_F(SmsServiceTest, PromptsDialog) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "hi");
     service.ConfirmPrompt();
   }));
@@ -488,7 +482,7 @@ TEST_F(SmsServiceTest, Cancel) {
         loop.Quit();
       }));
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "hi");
     service.DismissPrompt();
   }));
@@ -501,9 +495,8 @@ TEST_F(SmsServiceTest, Cancel) {
 TEST_F(SmsServiceTest, CancelForNoDelegate) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  auto provider = std::make_unique<MockSmsProvider>();
-  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(),
-                         std::move(provider));
+  NiceMock<MockSmsProvider> provider;
+  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(), &provider);
   mojo::Remote<blink::mojom::SmsReceiver> service;
   SmsService::Create(&fetcher, main_rfh(),
                      service.BindNewPipeAndPassReceiver());
@@ -559,7 +552,7 @@ TEST_F(SmsServiceTest, AbortWhilePrompt) {
         loop.Quit();
       }));
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "ABC");
     EXPECT_TRUE(service.IsPromptOpen());
     service.AbortRequest();
@@ -589,7 +582,7 @@ TEST_F(SmsServiceTest, RequestAfterAbortWhilePrompt) {
           loop.Quit();
         }));
 
-    EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+    EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
       service.NotifyReceive(GURL(kTestUrl), "hi");
       EXPECT_TRUE(service.IsPromptOpen());
       service.AbortRequest();
@@ -617,7 +610,7 @@ TEST_F(SmsServiceTest, RequestAfterAbortWhilePrompt) {
           loop.Quit();
         }));
 
-    EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+    EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
       service.NotifyReceive(GURL(kTestUrl), "hi2");
       service.ConfirmPrompt();
     }));
@@ -642,7 +635,7 @@ TEST_F(SmsServiceTest, SecondRequestWhilePrompt) {
         callback_loop1.Quit();
       }));
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "hi");
     service.AbortRequest();
   }));
@@ -679,7 +672,7 @@ TEST_F(SmsServiceTest, RecordTimeMetricsForContinueOnSuccess) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "ABC");
     service.ConfirmPrompt();
   }));
@@ -704,7 +697,7 @@ TEST_F(SmsServiceTest, RecordMetricsForCancelOnSuccess) {
 
   service.CreateSmsPrompt(main_rfh());
 
-  EXPECT_CALL(*service.provider(), Retrieve()).WillOnce(Invoke([&service]() {
+  EXPECT_CALL(*service.provider(), Retrieve(_)).WillOnce(Invoke([&service]() {
     service.NotifyReceive(GURL(kTestUrl), "hi");
     service.DismissPrompt();
   }));
@@ -729,17 +722,15 @@ TEST_F(SmsServiceTest, RecordMetricsForNewPage) {
       reinterpret_cast<WebContentsImpl*>(web_contents());
   web_contents_impl->SetDelegate(&delegate);
 
-  auto provider = std::make_unique<MockSmsProvider>();
-  MockSmsProvider* mock_provider_ptr = provider.get();
-  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(),
-                         std::move(provider));
+  NiceMock<MockSmsProvider> provider;
+  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(), &provider);
   mojo::Remote<blink::mojom::SmsReceiver> service;
   SmsService::Create(&fetcher, main_rfh(),
                      service.BindNewPipeAndPassReceiver());
 
   base::RunLoop navigate;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&navigate]() {
+  EXPECT_CALL(provider, Retrieve(_)).WillOnce(Invoke([&navigate]() {
     navigate.Quit();
   }));
 
@@ -769,17 +760,15 @@ TEST_F(SmsServiceTest, RecordMetricsForSamePage) {
       reinterpret_cast<WebContentsImpl*>(web_contents());
   web_contents_impl->SetDelegate(&delegate);
 
-  auto provider = std::make_unique<MockSmsProvider>();
-  MockSmsProvider* mock_provider_ptr = provider.get();
-  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(),
-                         std::move(provider));
+  NiceMock<MockSmsProvider> provider;
+  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(), &provider);
   mojo::Remote<blink::mojom::SmsReceiver> service;
   SmsService::Create(&fetcher, main_rfh(),
                      service.BindNewPipeAndPassReceiver());
 
   base::RunLoop navigate;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&navigate]() {
+  EXPECT_CALL(provider, Retrieve(_)).WillOnce(Invoke([&navigate]() {
     navigate.Quit();
   }));
 
@@ -814,17 +803,15 @@ TEST_F(SmsServiceTest, RecordMetricsForExistingPage) {
       reinterpret_cast<WebContentsImpl*>(web_contents());
   web_contents_impl->SetDelegate(&delegate);
 
-  auto provider = std::make_unique<MockSmsProvider>();
-  MockSmsProvider* mock_provider_ptr = provider.get();
-  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(),
-                         std::move(provider));
+  NiceMock<MockSmsProvider> provider;
+  SmsFetcherImpl fetcher(web_contents()->GetBrowserContext(), &provider);
   mojo::Remote<blink::mojom::SmsReceiver> service;
   SmsService::Create(&fetcher, main_rfh(),
                      service.BindNewPipeAndPassReceiver());
 
   base::RunLoop navigate;
 
-  EXPECT_CALL(*mock_provider_ptr, Retrieve()).WillOnce(Invoke([&navigate]() {
+  EXPECT_CALL(provider, Retrieve(_)).WillOnce(Invoke([&navigate]() {
     navigate.Quit();
   }));
 
diff --git a/chromium/content/browser/snapshot_browsertest.cc b/chromium/content/browser/snapshot_browsertest.cc
index 623bb50521f..560cd557faa 100644
--- a/chromium/content/browser/snapshot_browsertest.cc
+++ b/chromium/content/browser/snapshot_browsertest.cc
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "build/build_config.h"
-
 #include <stddef.h>
 
 #include <algorithm>
@@ -16,9 +14,11 @@
 #include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
+#include "build/build_config.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/speech/audio_buffer.cc b/chromium/content/browser/speech/audio_buffer.cc
index 1038ac938f1..5e74b7cf4b4 100644
--- a/chromium/content/browser/speech/audio_buffer.cc
+++ b/chromium/content/browser/speech/audio_buffer.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/speech/audio_buffer.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/speech/audio_encoder.cc b/chromium/content/browser/speech/audio_encoder.cc
index e32723b8543..151dbc5a609 100644
--- a/chromium/content/browser/speech/audio_encoder.cc
+++ b/chromium/content/browser/speech/audio_encoder.cc
@@ -8,7 +8,7 @@
 
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/strings/string_number_conversions.h"
 #include "content/browser/speech/audio_buffer.h"
 
diff --git a/chromium/content/browser/speech/chunked_byte_buffer.cc b/chromium/content/browser/speech/chunked_byte_buffer.cc
index 5e3f70c45c6..af6a35f83c6 100644
--- a/chromium/content/browser/speech/chunked_byte_buffer.cc
+++ b/chromium/content/browser/speech/chunked_byte_buffer.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/big_endian.h"
+#include "base/check_op.h"
 #include "base/lazy_instance.h"
-#include "base/logging.h"
 
 namespace {
 
diff --git a/chromium/content/browser/speech/speech_recognition_browsertest.cc b/chromium/content/browser/speech/speech_recognition_browsertest.cc
index a2143cfe3a8..bb688ed2d2e 100644
--- a/chromium/content/browser/speech/speech_recognition_browsertest.cc
+++ b/chromium/content/browser/speech/speech_recognition_browsertest.cc
@@ -28,6 +28,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/speech/tts_controller_impl.cc b/chromium/content/browser/speech/tts_controller_impl.cc
index 346118e4550..108a5a7d0a6 100644
--- a/chromium/content/browser/speech/tts_controller_impl.cc
+++ b/chromium/content/browser/speech/tts_controller_impl.cc
@@ -563,7 +563,7 @@ void TtsControllerImpl::StripSSMLHelper(
     return;
   }
 
-  std::string parsed_text = "";
+  std::string parsed_text;
   // Change from unique_ptr to base::Value* so recursion will work.
   PopulateParsedText(&parsed_text, &(*result.value));
 
diff --git a/chromium/content/browser/speech/tts_platform_fuzzer.cc b/chromium/content/browser/speech/tts_platform_fuzzer.cc
deleted file mode 100644
index d60a85c8d89..00000000000
--- a/chromium/content/browser/speech/tts_platform_fuzzer.cc
+++ /dev/null
@@ -1,111 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/bind.h"
-#include "build/build_config.h"
-#include "content/public/browser/tts_platform.h"
-
-#if defined(OS_WIN)
-#include <objbase.h>
-#endif
-
-namespace content {
-
-// Entry point for LibFuzzer.
-extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) {
-  int utterance_id = 0;
-  std::string utterance;
-  std::string lang;
-  VoiceData voice;
-  UtteranceContinuousParameters params;
-  params.pitch = 1.0;
-  params.rate = 1.0;
-  params.volume = 0.1;
-
-#if defined(OS_WIN)
-  static bool initialized = false;
-  if (!initialized) {
-    initialized = true;
-    CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);
-  }
-#endif
-
-  // First byte gives us the utterance ID.
-  size_t i = 0;
-  if (i < size)
-    utterance_id = data[i++];
-
-  // Decide whether we want to fuzz the language, rate, pitch,
-  // voice name, and all that. Half the time we'll just leave
-  // those empty and fuzz only the utterance, otherwise it's
-  // possible the fuzzer would never spend any effort fuzzing
-  // utteranes.
-  if (i < size && (data[i++] % 2 == 0)) {
-    // The next few bytes determine the language. Ensure that
-    // we frequently get some common real languages but allow
-    // arbitrary strings up to 10 characters.
-    if (i < size) {
-      int lang_choice = data[i++];
-      switch (lang_choice) {
-        case 0:
-          lang = "";
-          break;
-        case 1:
-          lang = "en";
-          break;
-        case 2:
-          lang = "fr";
-          break;
-        case 3:
-          lang = "es";
-          break;
-        default:
-          int lang_len = 1 + (lang_choice - 4) % 10;
-          for (int j = 0; j < lang_len; j++) {
-            if (i < size)
-              lang.append(1, data[i++]);
-          }
-      }
-    }
-
-    // Set native_voice_identifier
-    if (i < size) {
-      int voice_len = data[i++] % 10;
-      for (int j = 0; j < voice_len; j++) {
-        if (i < size)
-          voice.native_voice_identifier.append(1, data[i++]);
-      }
-    }
-
-    // Set rate, pitch.
-    if (i + 4 <= size) {
-      params.rate = *reinterpret_cast<const float*>(&data[i]);
-      i += 4;
-    }
-    if (i + 4 <= size) {
-      params.pitch = *reinterpret_cast<const float*>(&data[i]);
-      i += 4;
-    }
-  }
-
-  // The rest of the data becomes the utterance.
-  while (i < size)
-    utterance.append(1, data[i++]);
-
-  TtsPlatform* tts = TtsPlatform::GetInstance();
-  CHECK(tts->PlatformImplAvailable());
-
-  VLOG(1) << "id=" << utterance_id << " lang='" << lang << "'"
-          << " voice='" << voice.native_voice_identifier << "'"
-          << " pitch=" << params.pitch << " rate=" << params.rate
-          << " volume=" << params.volume << " utterance='" << utterance << "'";
-
-  tts->StopSpeaking();
-  tts->Speak(utterance_id, utterance, lang, voice, params,
-             base::BindOnce([](bool success) {}));
-
-  return 0;
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/speech/tts_ssml_browsertest.cc b/chromium/content/browser/speech/tts_ssml_browsertest.cc
index b5987cf001e..048fe3b9d0c 100644
--- a/chromium/content/browser/speech/tts_ssml_browsertest.cc
+++ b/chromium/content/browser/speech/tts_ssml_browsertest.cc
@@ -1,9 +1,11 @@
 // Copyright (c) 2019 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+
 #include "content/browser/speech/tts_controller_impl.h"
 
 #include "base/callback_helpers.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 
diff --git a/chromium/content/browser/ssl/ssl_client_auth_handler.cc b/chromium/content/browser/ssl/ssl_client_auth_handler.cc
index 9e04778680d..5fb893ba3d2 100644
--- a/chromium/content/browser/ssl/ssl_client_auth_handler.cc
+++ b/chromium/content/browser/ssl/ssl_client_auth_handler.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/macros.h"
 #include "base/task/post_task.h"
 #include "content/public/browser/browser_task_traits.h"
diff --git a/chromium/content/browser/ssl/ssl_manager.cc b/chromium/content/browser/ssl/ssl_manager.cc
index 3195a3395e7..8adc6888e93 100644
--- a/chromium/content/browser/ssl/ssl_manager.cc
+++ b/chromium/content/browser/ssl/ssl_manager.cc
@@ -16,6 +16,7 @@
 #include "base/task/post_task.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/ssl/ssl_error_handler.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
@@ -133,6 +134,13 @@ void SSLManager::OnSSLCertificateError(
     return;
   }
 
+  // Check if we should deny certificate errors using the main frame's URL.
+  if (GetContentClient()->browser()->ShouldDenyRequestOnCertificateError(
+          web_contents->GetLastCommittedURL())) {
+    handler->DenyRequest();
+    return;
+  }
+
   NavigationControllerImpl* controller =
       static_cast<NavigationControllerImpl*>(&web_contents->GetController());
   controller->SetPendingNavigationSSLError(true);
@@ -205,7 +213,7 @@ void SSLManager::DidDisplayMixedContent() {
       entry->GetSSL().certificate) {
     WebContentsImpl* contents = static_cast<WebContentsImpl*>(
         controller_->delegate()->GetWebContents());
-    ukm::SourceId source_id = contents->GetUkmSourceIdForLastCommittedSource();
+    ukm::SourceId source_id = contents->GetMainFrame()->GetPageUkmSourceId();
     LogMixedContentMetrics(MixedContentType::kDisplayMixedContent, source_id,
                            ukm::UkmRecorder::Get());
   }
@@ -218,7 +226,7 @@ void SSLManager::DidContainInsecureFormAction() {
       entry->GetSSL().certificate) {
     WebContentsImpl* contents = static_cast<WebContentsImpl*>(
         controller_->delegate()->GetWebContents());
-    ukm::SourceId source_id = contents->GetUkmSourceIdForLastCommittedSource();
+    ukm::SourceId source_id = contents->GetMainFrame()->GetPageUkmSourceId();
     LogMixedContentMetrics(MixedContentType::kMixedForm, source_id,
                            ukm::UkmRecorder::Get());
   }
@@ -234,7 +242,7 @@ void SSLManager::DidDisplayContentWithCertErrors() {
   if (entry->GetURL().SchemeIsCryptographic() && entry->GetSSL().certificate) {
     WebContentsImpl* contents = static_cast<WebContentsImpl*>(
         controller_->delegate()->GetWebContents());
-    ukm::SourceId source_id = contents->GetUkmSourceIdForLastCommittedSource();
+    ukm::SourceId source_id = contents->GetMainFrame()->GetPageUkmSourceId();
     LogMixedContentMetrics(MixedContentType::kDisplayWithCertErrors, source_id,
                            ukm::UkmRecorder::Get());
     UpdateLastCommittedEntry(SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS, 0);
@@ -249,7 +257,7 @@ void SSLManager::DidRunMixedContent(const GURL& security_origin) {
   if (entry->GetURL().SchemeIsCryptographic() && entry->GetSSL().certificate) {
     WebContentsImpl* contents = static_cast<WebContentsImpl*>(
         controller_->delegate()->GetWebContents());
-    ukm::SourceId source_id = contents->GetUkmSourceIdForLastCommittedSource();
+    ukm::SourceId source_id = contents->GetMainFrame()->GetPageUkmSourceId();
     LogMixedContentMetrics(MixedContentType::kScriptingMixedContent, source_id,
                            ukm::UkmRecorder::Get());
   }
@@ -275,7 +283,7 @@ void SSLManager::DidRunContentWithCertErrors(const GURL& security_origin) {
   if (entry->GetURL().SchemeIsCryptographic() && entry->GetSSL().certificate) {
     WebContentsImpl* contents = static_cast<WebContentsImpl*>(
         controller_->delegate()->GetWebContents());
-    ukm::SourceId source_id = contents->GetUkmSourceIdForLastCommittedSource();
+    ukm::SourceId source_id = contents->GetMainFrame()->GetPageUkmSourceId();
     LogMixedContentMetrics(MixedContentType::kScriptingWithCertErrors,
                            source_id, ukm::UkmRecorder::Get());
   }
diff --git a/chromium/content/browser/startup_data_impl.h b/chromium/content/browser/startup_data_impl.h
index ca0cb4ff328..56984f849e8 100644
--- a/chromium/content/browser/startup_data_impl.h
+++ b/chromium/content/browser/startup_data_impl.h
@@ -20,7 +20,7 @@ struct CONTENT_EXPORT StartupDataImpl : public StartupData {
   StartupDataImpl();
   ~StartupDataImpl() override;
 
-  std::unique_ptr<BrowserProcessSubThread> ipc_thread;
+  std::unique_ptr<BrowserProcessSubThread> io_thread;
   std::unique_ptr<mojo::core::ScopedIPCSupport> mojo_ipc_support;
   base::OnceClosure service_manager_shutdown_closure;
 };
diff --git a/chromium/content/browser/startup_helper.cc b/chromium/content/browser/startup_helper.cc
index b9e21c3bb4d..6f60a96a25c 100644
--- a/chromium/content/browser/startup_helper.cc
+++ b/chromium/content/browser/startup_helper.cc
@@ -11,6 +11,7 @@
 
 #include "base/base_switches.h"
 #include "base/command_line.h"
+#include "base/metrics/field_trial_params.h"
 #include "base/system/sys_info.h"
 #include "base/task/thread_pool/initialization_util.h"
 #include "base/task/thread_pool/thread_pool_instance.h"
@@ -46,18 +47,37 @@ std::unique_ptr<base::FieldTrialList> SetUpFieldTrialsAndFeatureList() {
   return field_trial_list;
 }
 
+namespace {
+#if defined(OS_ANDROID)
+// Mobile config, for iOS see ios/web/app/web_main_loop.cc.
+constexpr int kThreadPoolDefaultMin = 6;
+constexpr int kThreadPoolMax = 8;
+constexpr double kThreadPoolCoresMultiplier = 0.6;
+constexpr int kThreadPoolOffset = 0;
+#else
+// Desktop config.
+constexpr int kThreadPoolDefaultMin = 16;
+constexpr int kThreadPoolMax = 32;
+constexpr double kThreadPoolCoresMultiplier = 0.6;
+constexpr int kThreadPoolOffset = 0;
+#endif
+
+const base::Feature kBrowserThreadPoolAdjustment{
+    "BrowserThreadPoolAdjustment", base::FEATURE_DISABLED_BY_DEFAULT};
+
+const base::FeatureParam<int> kBrowserThreadPoolMin{
+    &kBrowserThreadPoolAdjustment, "min", kThreadPoolDefaultMin};
+}  // namespace
+
 // TODO(scheduler-dev): Standardize thread pool logic and remove the need for
 // specifying thread count manually.
 void StartBrowserThreadPool() {
+  // Ensure we always support at least one thread regardless of the field trial
+  // param setting.
+  int min = std::max(kBrowserThreadPoolMin.Get(), 1);
   base::ThreadPoolInstance::InitParams thread_pool_init_params = {
-#if defined(OS_ANDROID)
-    // Mobile config, for iOS see ios/web/app/web_main_loop.cc.
-    base::RecommendedMaxNumberOfThreadsInThreadGroup(6, 8, 0.6, 0)
-#else
-    // Desktop config.
-    base::RecommendedMaxNumberOfThreadsInThreadGroup(16, 32, 0.6, 0)
-#endif
-  };
+      base::RecommendedMaxNumberOfThreadsInThreadGroup(
+          min, kThreadPoolMax, kThreadPoolCoresMultiplier, kThreadPoolOffset)};
 
 #if defined(OS_WIN)
   thread_pool_init_params.common_thread_pool_environment = base::
diff --git a/chromium/content/browser/storage_partition_impl.cc b/chromium/content/browser/storage_partition_impl.cc
index 66a4f7c28b4..f06c5b51234 100644
--- a/chromium/content/browser/storage_partition_impl.cc
+++ b/chromium/content/browser/storage_partition_impl.cc
@@ -4,9 +4,9 @@
 
 #include "content/browser/storage_partition_impl.h"
 
-#include <stddef.h>
 #include <stdint.h>
 
+#include <functional>
 #include <set>
 #include <utility>
 #include <vector>
@@ -16,6 +16,7 @@
 #include "base/bind_helpers.h"
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
+#include "base/containers/flat_set.h"
 #include "base/feature_list.h"
 #include "base/location.h"
 #include "base/memory/ptr_util.h"
@@ -44,12 +45,13 @@
 #include "content/browser/browsing_data/storage_partition_code_cache_data_remover.h"
 #include "content/browser/code_cache/generated_code_cache.h"
 #include "content/browser/code_cache/generated_code_cache_context.h"
-#include "content/browser/conversions/conversion_manager.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
 #include "content/browser/cookie_store/cookie_store_context.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/devtools/devtools_url_loader_interceptor.h"
 #include "content/browser/file_system/browser_file_system_helper.h"
 #include "content/browser/gpu/shader_cache_factory.h"
+#include "content/browser/idle/idle_manager_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 #include "content/browser/native_io/native_io_context.h"
@@ -62,6 +64,7 @@
 #include "content/browser/ssl_private_key_impl.h"
 #include "content/browser/web_contents/frame_tree_node_id_registry.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/navigation_params.mojom.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
@@ -86,7 +89,6 @@
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/base/net_errors.h"
 #include "net/cookies/canonical_cookie.h"
-#include "net/cookies/cookie_options.h"
 #include "net/cookies/cookie_util.h"
 #include "net/http/http_auth_preferences.h"
 #include "net/ssl/client_cert_store.h"
@@ -95,14 +97,18 @@
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/network/public/cpp/cross_thread_pending_shared_url_loader_factory.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/mojom/cookie_access_observer.mojom.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
+#include "services/network/public/mojom/trust_tokens.mojom.h"
 #include "storage/browser/blob/blob_registry_impl.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/database/database_tracker.h"
+#include "storage/browser/quota/quota_client_type.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "storage/browser/quota/quota_settings.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/devtools/inspector_issue.mojom-shared.h"
 #include "third_party/blink/public/mojom/quota/quota_types.mojom.h"
 
 #if defined(OS_ANDROID)
@@ -265,10 +271,10 @@ void OnQuotaManagedOriginDeleted(const url::Origin& origin,
 void PerformQuotaManagerStorageCleanup(
     const scoped_refptr<storage::QuotaManager>& quota_manager,
     blink::mojom::StorageType quota_storage_type,
-    uint32_t remove_mask,
+    storage::QuotaClientTypes quota_client_types,
     base::OnceClosure callback) {
-  quota_manager->PerformStorageCleanup(quota_storage_type, remove_mask,
-                                       std::move(callback));
+  quota_manager->PerformStorageCleanup(
+      quota_storage_type, std::move(quota_client_types), std::move(callback));
 }
 
 void ClearedShaderCache(base::OnceClosure callback) {
@@ -320,16 +326,16 @@ void OnLocalStorageUsageInfo(
 
   base::RepeatingClosure barrier =
       base::BarrierClosure(infos.size(), std::move(done_callback));
-  for (size_t i = 0; i < infos.size(); ++i) {
+  for (const StorageUsageInfo& info : infos) {
     if (origin_matcher &&
-        !origin_matcher.Run(infos[i].origin, special_storage_policy.get())) {
+        !origin_matcher.Run(info.origin, special_storage_policy.get())) {
       barrier.Run();
       continue;
     }
 
-    if (infos[i].last_modified >= delete_begin &&
-        infos[i].last_modified <= delete_end) {
-      dom_storage_context->DeleteLocalStorage(infos[i].origin, barrier);
+    if (info.last_modified >= delete_begin &&
+        info.last_modified <= delete_end) {
+      dom_storage_context->DeleteLocalStorage(info.origin, barrier);
     } else {
       barrier.Run();
     }
@@ -355,14 +361,13 @@ void OnSessionStorageUsageInfo(
   base::RepeatingClosure barrier =
       base::BarrierClosure(infos.size(), std::move(done_callback));
 
-  for (size_t i = 0; i < infos.size(); ++i) {
-    if (origin_matcher &&
-        !origin_matcher.Run(url::Origin::Create(infos[i].origin),
-                            special_storage_policy.get())) {
+  for (const SessionStorageUsageInfo& info : infos) {
+    if (origin_matcher && !origin_matcher.Run(url::Origin::Create(info.origin),
+                                              special_storage_policy.get())) {
       barrier.Run();
       continue;
     }
-    dom_storage_context->DeleteSessionStorage(infos[i], barrier);
+    dom_storage_context->DeleteSessionStorage(info, barrier);
   }
 }
 
@@ -422,319 +427,6 @@ BrowserContext* GetBrowserContextFromStoragePartition(
   return weak_partition_ptr ? weak_partition_ptr->browser_context() : nullptr;
 }
 
-// TODO(crbug.com/977040): Remove when no longer needed.
-void DeprecateSameSiteCookies(int process_id,
-                              int routing_id,
-                              const net::CookieStatusList& cookie_list,
-                              const GURL& url,
-                              const GURL& site_for_cookies) {
-  // Navigation requests start in the browser, before process_id is assigned, so
-  // the id is set to network::mojom::kBrowserProcessId. In these situations,
-  // the routing_id is the frame tree node id, and can be used directly.
-  RenderFrameHostImpl* frame = nullptr;
-  if (process_id == network::mojom::kBrowserProcessId) {
-    FrameTreeNode* ftn = FrameTreeNode::GloballyFindByID(routing_id);
-    if (ftn)
-      frame = ftn->current_frame_host();
-  } else {
-    frame = RenderFrameHostImpl::FromID(process_id, routing_id);
-  }
-
-  if (!frame)
-    return;
-
-  // Because of the nature of mojo and calling cross process, there's the
-  // possibility of calling this method after the page has already been
-  // navigated away from, which is DCHECKed against in
-  // LogWebFeatureForCurrentPage. We're replicating the DCHECK here and
-  // returning early should this be the case.
-  WebContents* web_contents = WebContents::FromRenderFrameHost(frame);
-
-  // |web_contents| will be null on interstitial pages, which means the frame
-  // has been navigated away from and the function should return early.
-  if (!web_contents)
-    return;
-
-  RenderFrameHostImpl* root_frame_host = frame;
-  while (root_frame_host->GetParent() != nullptr)
-    root_frame_host = root_frame_host->GetParent();
-
-  if (root_frame_host != web_contents->GetMainFrame())
-    return;
-
-  bool samesite_treated_as_lax_cookies = false;
-  bool samesite_none_insecure_cookies = false;
-
-  bool messages_disabled_by_cmdline =
-      base::FeatureList::GetInstance()->IsFeatureOverriddenFromCommandLine(
-          features::kCookieDeprecationMessages.name,
-          base::FeatureList::OVERRIDE_DISABLE_FEATURE);
-  bool emit_messages =
-      !messages_disabled_by_cmdline &&
-      (net::cookie_util::IsSameSiteByDefaultCookiesEnabled() ||
-       net::cookie_util::IsCookiesWithoutSameSiteMustBeSecureEnabled() ||
-       base::FeatureList::IsEnabled(features::kCookieDeprecationMessages));
-
-  for (const net::CookieWithStatus& excluded_cookie : cookie_list) {
-    std::string cookie_url =
-        net::cookie_util::CookieOriginToURL(excluded_cookie.cookie.Domain(),
-                                            excluded_cookie.cookie.IsSecure())
-            .possibly_invalid_spec();
-
-    if (excluded_cookie.status.ShouldWarn()) {
-      if (excluded_cookie.status.HasWarningReason(
-              net::CanonicalCookie::CookieInclusionStatus::
-                  WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT)) {
-        samesite_treated_as_lax_cookies = true;
-      }
-
-      if (excluded_cookie.status.HasWarningReason(
-              net::CanonicalCookie::CookieInclusionStatus::
-                  WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE)) {
-        samesite_treated_as_lax_cookies = true;
-      }
-
-      if (excluded_cookie.status.HasWarningReason(
-              net::CanonicalCookie::CookieInclusionStatus::
-                  WARN_SAMESITE_NONE_INSECURE)) {
-        samesite_none_insecure_cookies = true;
-      }
-      devtools_instrumentation::ReportSameSiteCookieIssue(
-          root_frame_host, excluded_cookie, url, site_for_cookies);
-    }
-    if (emit_messages) {
-      root_frame_host->AddSameSiteCookieDeprecationMessage(
-          cookie_url, excluded_cookie.status,
-          net::cookie_util::IsSameSiteByDefaultCookiesEnabled(),
-          net::cookie_util::IsCookiesWithoutSameSiteMustBeSecureEnabled());
-    }
-  }
-
-  // TODO(crbug.com/990439): Do we need separate UseCounter metrics for
-  // Lax-allow-unsafe? We already have histograms in CanonicalCookie.
-  if (samesite_treated_as_lax_cookies) {
-    GetContentClient()->browser()->LogWebFeatureForCurrentPage(
-        frame, blink::mojom::WebFeature::kCookieNoSameSite);
-  }
-
-  if (samesite_none_insecure_cookies) {
-    GetContentClient()->browser()->LogWebFeatureForCurrentPage(
-        frame, blink::mojom::WebFeature::kCookieInsecureAndSameSiteNone);
-  }
-}
-
-int64_t CrossSchemeWarningToContextInt64(
-    net::CanonicalCookie::CookieInclusionStatus::WarningReason reason) {
-  // Convert from the status's WarningReason enum to a SameSiteCookieContext
-  // enum and cast to a int64_t for UKM. The UKMs are using the
-  // SameSiteCookieContext in order to match up with the UMAs which are
-  // recording similar information.
-  // TODO(https://crbug.com/1046456): Remove after deprecated.
-  net::CookieOptions::SameSiteCookieContext same_site_context;
-  switch (reason) {
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_LAX_METHOD_UNSAFE_CROSS_SCHEME_SECURE_URL:
-      same_site_context.context = net::CookieOptions::SameSiteCookieContext::
-          ContextType::SAME_SITE_LAX_METHOD_UNSAFE;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::INSECURE_SECURE;
-      return same_site_context.ConvertToMetricsValue();
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_LAX_CROSS_SCHEME_SECURE_URL:
-      same_site_context.context =
-          net::CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::INSECURE_SECURE;
-      return same_site_context.ConvertToMetricsValue();
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_STRICT_CROSS_SCHEME_SECURE_URL:
-      same_site_context.context = net::CookieOptions::SameSiteCookieContext::
-          ContextType::SAME_SITE_STRICT;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::INSECURE_SECURE;
-      return same_site_context.ConvertToMetricsValue();
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_LAX_METHOD_UNSAFE_CROSS_SCHEME_INSECURE_URL:
-      same_site_context.context = net::CookieOptions::SameSiteCookieContext::
-          ContextType::SAME_SITE_LAX_METHOD_UNSAFE;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::SECURE_INSECURE;
-      return same_site_context.ConvertToMetricsValue();
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_LAX_CROSS_SCHEME_INSECURE_URL:
-      same_site_context.context =
-          net::CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::SECURE_INSECURE;
-      return same_site_context.ConvertToMetricsValue();
-    case net::CanonicalCookie::CookieInclusionStatus::
-        WARN_SAMESITE_STRICT_CROSS_SCHEME_INSECURE_URL:
-      same_site_context.context = net::CookieOptions::SameSiteCookieContext::
-          ContextType::SAME_SITE_STRICT;
-      same_site_context.cross_schemeness = net::CookieOptions::
-          SameSiteCookieContext::CrossSchemeness::SECURE_INSECURE;
-      return same_site_context.ConvertToMetricsValue();
-    default:
-      // Return invalid value if there is no cross-scheme warning.
-      return -1;
-  }
-}
-
-void ReportCookiesChangedOnUI(
-    std::vector<GlobalFrameRoutingId> destinations,
-    const GURL& url,
-    const GURL& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  for (const GlobalFrameRoutingId& id : destinations) {
-    DeprecateSameSiteCookies(id.child_id, id.frame_routing_id, cookie_list, url,
-                             site_for_cookies);
-  }
-
-  for (const auto& cookie_and_status : cookie_list) {
-    if (cookie_and_status.status.HasExclusionReason(
-            net::CanonicalCookie::CookieInclusionStatus::
-                EXCLUDE_USER_PREFERENCES)) {
-      for (const GlobalFrameRoutingId& id : destinations) {
-        WebContents* web_contents =
-            GetWebContentsForStoragePartition(id.child_id, id.frame_routing_id);
-        if (!web_contents)
-          continue;
-        web_contents->OnCookieChange(url, site_for_cookies,
-                                     cookie_and_status.cookie,
-                                     /* blocked_by_policy =*/true);
-      }
-    } else if (cookie_and_status.status.IsInclude()) {
-      for (const GlobalFrameRoutingId& id : destinations) {
-        WebContents* web_contents =
-            GetWebContentsForStoragePartition(id.child_id, id.frame_routing_id);
-        if (!web_contents)
-          continue;
-        web_contents->OnCookieChange(url, site_for_cookies,
-                                     cookie_and_status.cookie,
-                                     /* blocked_by_policy =*/false);
-
-        // TODO(https://crbug.com/1046456): Remove after deprecated.
-        net::CanonicalCookie::CookieInclusionStatus::WarningReason
-            cross_scheme_warning;
-        if (cookie_and_status.status.HasCrossSchemeWarning(
-                &cross_scheme_warning)) {
-          ukm::SourceId source_id =
-              static_cast<WebContentsImpl*>(web_contents)
-                  ->GetUkmSourceIdForLastCommittedSource();
-
-          int64_t context =
-              CrossSchemeWarningToContextInt64(cross_scheme_warning);
-          ukm::builders::SameSiteDifferentSchemeRequest(source_id)
-              .SetSameSiteContextWithSchemes(context)
-              .Record(ukm::UkmRecorder::Get());
-        }
-      }
-    }
-  }
-}
-
-void ReportCookiesReadOnUI(
-    std::vector<GlobalFrameRoutingId> destinations,
-    const GURL& url,
-    const GURL& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  for (const GlobalFrameRoutingId& id : destinations) {
-    DeprecateSameSiteCookies(id.child_id, id.frame_routing_id, cookie_list, url,
-                             site_for_cookies);
-  }
-
-  net::CookieList accepted, blocked;
-  std::vector<net::CanonicalCookie::CookieInclusionStatus> accepted_status;
-  for (auto& cookie_and_status : cookie_list) {
-    if (cookie_and_status.status.HasExclusionReason(
-            net::CanonicalCookie::CookieInclusionStatus::
-                EXCLUDE_USER_PREFERENCES)) {
-      blocked.push_back(std::move(cookie_and_status.cookie));
-    } else if (cookie_and_status.status.IsInclude()) {
-      accepted.push_back(std::move(cookie_and_status.cookie));
-      accepted_status.push_back(std::move(cookie_and_status.status));
-    }
-  }
-
-  if (!accepted.empty()) {
-    for (const GlobalFrameRoutingId& id : destinations) {
-      WebContents* web_contents =
-          GetWebContentsForStoragePartition(id.child_id, id.frame_routing_id);
-      if (!web_contents)
-        continue;
-      web_contents->OnCookiesRead(url, site_for_cookies, accepted,
-                                  /* blocked_by_policy =*/false);
-
-      // TODO(https://crbug.com/1046456): Remove after deprecated.
-      for (const auto& status : accepted_status) {
-        net::CanonicalCookie::CookieInclusionStatus::WarningReason
-            cross_scheme_warning;
-        if (status.HasCrossSchemeWarning(&cross_scheme_warning)) {
-          ukm::SourceId source_id =
-              static_cast<WebContentsImpl*>(web_contents)
-                  ->GetUkmSourceIdForLastCommittedSource();
-
-          int64_t context =
-              CrossSchemeWarningToContextInt64(cross_scheme_warning);
-          ukm::builders::SameSiteDifferentSchemeResponse(source_id)
-              .SetSameSiteContextWithSchemes(context)
-              .Record(ukm::UkmRecorder::Get());
-        }
-      }
-    }
-  }
-
-  if (!blocked.empty()) {
-    for (const GlobalFrameRoutingId& id : destinations) {
-      WebContents* web_contents =
-          GetWebContentsForStoragePartition(id.child_id, id.frame_routing_id);
-      if (!web_contents)
-        continue;
-      web_contents->OnCookiesRead(url, site_for_cookies, blocked,
-                                  /* blocked_by_policy =*/true);
-    }
-  }
-}
-
-void OnServiceWorkerCookiesReadOnCoreThread(
-    scoped_refptr<ServiceWorkerContextWrapper> service_worker_context,
-    const GURL& url,
-    const GURL& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  // Notify all the frames associated with this service worker of its cookie
-  // activity.
-  std::unique_ptr<std::vector<GlobalFrameRoutingId>> frame_routing_ids =
-      service_worker_context->GetWindowClientFrameRoutingIds(url.GetOrigin());
-  if (!frame_routing_ids->empty()) {
-    RunOrPostTaskOnThread(
-        FROM_HERE, BrowserThread::UI,
-        base::BindOnce(ReportCookiesReadOnUI, *frame_routing_ids, url,
-                       site_for_cookies, cookie_list));
-  }
-}
-
-void OnServiceWorkerCookiesChangedOnCoreThread(
-    scoped_refptr<ServiceWorkerContextWrapper> service_worker_context,
-    const GURL& url,
-    const GURL& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  // Notify all the frames associated with this service worker of its cookie
-  // activity.
-  std::unique_ptr<std::vector<GlobalFrameRoutingId>> frame_routing_ids =
-      service_worker_context->GetWindowClientFrameRoutingIds(url.GetOrigin());
-  if (!frame_routing_ids->empty()) {
-    RunOrPostTaskOnThread(
-        FROM_HERE, BrowserThread::UI,
-        base::BindOnce(ReportCookiesChangedOnUI, *frame_routing_ids, url,
-                       site_for_cookies, cookie_list));
-  }
-}
-
 WebContents* GetWebContents(int process_id, int routing_id) {
   if (process_id != network::mojom::kBrowserProcessId) {
     return WebContentsImpl::FromRenderFrameHostID(process_id, routing_id);
@@ -1035,7 +727,7 @@ class SSLErrorDelegate : public SSLErrorHandler::Delegate {
       network::mojom::NetworkContextClient::OnSSLCertificateErrorCallback
           response)
       : response_(std::move(response)) {}
-  ~SSLErrorDelegate() override {}
+  ~SSLErrorDelegate() override = default;
   void CancelSSLRequest(int error, const net::SSLInfo* ssl_info) override {
     std::move(response_).Run(error);
     delete this;
@@ -1065,6 +757,44 @@ void FinishGenerateNegotiateAuthToken(
 }
 #endif
 
+// Conceptually, many downstream interfaces don't need to know about the
+// complexity of callers into StoragePartition, so this function reduces the API
+// surface to something simple and generic. It is designed to be used by
+// callsites in ClearDataImpl.
+//
+// Precondition: |matcher_func| and |storage_origin| cannot both be set.
+// If both |matcher_func| and |storage_origin| are null/empty, should return a
+// null callback that indicates all origins should match. This is an
+// optimization for backends to efficiently clear all data.
+//
+// TODO(csharrison, mek): Right now, the only storage backend that uses this is
+// is for conversion measurement. We should consider moving some of the
+// backends to use this if they can, and additionally we should consider
+// rethinking this approach if / when storage backends move out of process
+// (see crbug.com/1016065 for initial work here).
+base::RepeatingCallback<bool(const url::Origin&)> CreateGenericOriginMatcher(
+    const GURL& storage_origin,
+    StoragePartition::OriginMatcherFunction matcher_func,
+    scoped_refptr<storage::SpecialStoragePolicy> policy) {
+  DCHECK(storage_origin.is_empty() || matcher_func.is_null());
+
+  if (storage_origin.is_empty() && matcher_func.is_null())
+    return base::NullCallback();
+
+  if (matcher_func) {
+    return base::BindRepeating(
+        [](StoragePartition::OriginMatcherFunction matcher_func,
+           scoped_refptr<storage::SpecialStoragePolicy> policy,
+           const url::Origin& origin) -> bool {
+          return matcher_func.Run(origin, policy.get());
+        },
+        std::move(matcher_func), std::move(policy));
+  }
+  DCHECK(!storage_origin.is_empty());
+  return base::BindRepeating(std::equal_to<const url::Origin&>(),
+                             url::Origin::Create(storage_origin));
+}
+
 }  // namespace
 
 class StoragePartitionImpl::URLLoaderFactoryForBrowserProcess
@@ -1116,7 +846,7 @@ class StoragePartitionImpl::URLLoaderFactoryForBrowserProcess
 
  private:
   friend class base::RefCounted<URLLoaderFactoryForBrowserProcess>;
-  ~URLLoaderFactoryForBrowserProcess() override {}
+  ~URLLoaderFactoryForBrowserProcess() override = default;
 
   StoragePartitionImpl* storage_partition_;
   const bool corb_enabled_;
@@ -1125,25 +855,26 @@ class StoragePartitionImpl::URLLoaderFactoryForBrowserProcess
 };
 
 // Static.
-int StoragePartitionImpl::GenerateQuotaClientMask(uint32_t remove_mask) {
-  int quota_client_mask = 0;
+storage::QuotaClientTypes StoragePartitionImpl::GenerateQuotaClientTypes(
+    uint32_t remove_mask) {
+  storage::QuotaClientTypes quota_client_types;
 
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_FILE_SYSTEMS)
-    quota_client_mask |= storage::QuotaClient::kFileSystem;
+    quota_client_types.insert(storage::QuotaClientType::kFileSystem);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_WEBSQL)
-    quota_client_mask |= storage::QuotaClient::kDatabase;
+    quota_client_types.insert(storage::QuotaClientType::kDatabase);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_APPCACHE)
-    quota_client_mask |= storage::QuotaClient::kAppcache;
+    quota_client_types.insert(storage::QuotaClientType::kAppcache);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_INDEXEDDB)
-    quota_client_mask |= storage::QuotaClient::kIndexedDatabase;
+    quota_client_types.insert(storage::QuotaClientType::kIndexedDatabase);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_SERVICE_WORKERS)
-    quota_client_mask |= storage::QuotaClient::kServiceWorker;
+    quota_client_types.insert(storage::QuotaClientType::kServiceWorker);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_CACHE_STORAGE)
-    quota_client_mask |= storage::QuotaClient::kServiceWorkerCache;
+    quota_client_types.insert(storage::QuotaClientType::kServiceWorkerCache);
   if (remove_mask & StoragePartition::REMOVE_DATA_MASK_BACKGROUND_FETCH)
-    quota_client_mask |= storage::QuotaClient::kBackgroundFetch;
+    quota_client_types.insert(storage::QuotaClientType::kBackgroundFetch);
 
-  return quota_client_mask;
+  return quota_client_types;
 }
 
 // static
@@ -1229,7 +960,7 @@ class StoragePartitionImpl::DataDeletionHelper {
         callback_(std::move(callback)),
         task_count_(0) {}
 
-  ~DataDeletionHelper() {}
+  ~DataDeletionHelper() = default;
 
   void ClearDataOnUIThread(
       const GURL& storage_origin,
@@ -1241,6 +972,7 @@ class StoragePartitionImpl::DataDeletionHelper {
       storage::SpecialStoragePolicy* special_storage_policy,
       storage::FileSystemContext* filesystem_context,
       network::mojom::CookieManager* cookie_manager,
+      ConversionManagerImpl* conversion_manager,
       bool perform_storage_cleanup,
       const base::Time begin,
       const base::Time end);
@@ -1264,6 +996,7 @@ class StoragePartitionImpl::DataDeletionHelper {
     kSessionStorage = 5,
     kShaderCache = 6,
     kPluginPrivate = 7,
+    kConversions = 8,
   };
 
   base::OnceClosure CreateTaskCompletionClosure(TracingDataType data_type);
@@ -1302,6 +1035,60 @@ void StoragePartitionImpl::DataDeletionHelper::ClearQuotaManagedDataOnIOThread(
                               perform_storage_cleanup);
 }
 
+class StoragePartitionImpl::ServiceWorkerCookieAccessObserver
+    : public network::mojom::CookieAccessObserver {
+ public:
+  explicit ServiceWorkerCookieAccessObserver(
+      StoragePartitionImpl* storage_partition)
+      : storage_partition_(storage_partition) {}
+
+ private:
+  void Clone(mojo::PendingReceiver<network::mojom::CookieAccessObserver>
+                 observer) override {
+    storage_partition_->service_worker_cookie_observers_.Add(
+        std::make_unique<ServiceWorkerCookieAccessObserver>(storage_partition_),
+        std::move(observer));
+  }
+
+  void OnCookiesAccessed(
+      network::mojom::CookieAccessDetailsPtr details) override {
+    scoped_refptr<ServiceWorkerContextWrapper> service_worker_context =
+        storage_partition_->GetServiceWorkerContext();
+    RunOrPostTaskOnThread(
+        FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
+        base::BindOnce(&OnServiceWorkerCookiesAccessedOnCoreThread,
+                       service_worker_context, std::move(details)));
+  }
+
+  static void OnServiceWorkerCookiesAccessedOnCoreThread(
+      scoped_refptr<ServiceWorkerContextWrapper> service_worker_context,
+      network::mojom::CookieAccessDetailsPtr details) {
+    std::vector<GlobalFrameRoutingId> destinations =
+        *service_worker_context->GetWindowClientFrameRoutingIds(
+            details->url.GetOrigin());
+    if (destinations.empty())
+      return;
+    RunOrPostTaskOnThread(
+        FROM_HERE, BrowserThread::UI,
+        base::BindOnce(&ReportCookiesAccessedOnUI, std::move(destinations),
+                       std::move(details)));
+  }
+
+  static void ReportCookiesAccessedOnUI(
+      std::vector<GlobalFrameRoutingId> destinations,
+      network::mojom::CookieAccessDetailsPtr details) {
+    for (GlobalFrameRoutingId frame_id : destinations) {
+      if (RenderFrameHostImpl* rfh = RenderFrameHostImpl::FromID(frame_id)) {
+        rfh->OnCookiesAccessed(mojo::Clone(details));
+      }
+    }
+  }
+
+  // |storage_partition_| owns this object via UniqueReceiverSet
+  // (service_worker_cookie_observers_).
+  StoragePartitionImpl* storage_partition_;
+};
+
 StoragePartitionImpl::StoragePartitionImpl(
     BrowserContext* browser_context,
     const base::FilePath& partition_path,
@@ -1422,9 +1209,9 @@ void StoragePartitionImpl::Initialize() {
     base::RepeatingCallback<void(const url::Origin)>
         send_notification_function = base::BindRepeating(
             [](StorageNotificationService* service, const url::Origin origin) {
-              base::PostTask(FROM_HERE, {BrowserThread::UI},
-                             base::BindRepeating(
-                                 &StorageNotificationService::
+              base::PostTask(
+                  FROM_HERE, {BrowserThread::UI},
+                  base::BindOnce(&StorageNotificationService::
                                      MaybeShowStoragePressureNotification,
                                  base::Unretained(service), std::move(origin)));
             },
@@ -1446,7 +1233,7 @@ void StoragePartitionImpl::Initialize() {
   dom_storage_context_ = DOMStorageContextWrapper::Create(
       this, browser_context_->GetSpecialStoragePolicy());
 
-  idle_manager_ = std::make_unique<IdleManager>();
+  idle_manager_ = std::make_unique<IdleManagerImpl>(browser_context_);
   lock_manager_ = std::make_unique<LockManager>();
 
   scoped_refptr<ChromeBlobStorageContext> blob_context =
@@ -1463,13 +1250,15 @@ void StoragePartitionImpl::Initialize() {
   native_file_system_manager_->BindInternalsReceiver(
       native_file_system_context.InitWithNewPipeAndPassReceiver());
   base::FilePath path = is_in_memory_ ? base::FilePath() : partition_path_;
-  indexed_db_context_ = base::MakeRefCounted<IndexedDBContextImpl>(
+  auto indexed_db_context = base::MakeRefCounted<IndexedDBContextImpl>(
       path, browser_context_->GetSpecialStoragePolicy(), quota_manager_proxy,
       base::DefaultClock::GetInstance(),
       ChromeBlobStorageContext::GetRemoteFor(browser_context_),
       std::move(native_file_system_context),
       base::CreateSingleThreadTaskRunner({BrowserThread::IO}),
       /*task_runner=*/nullptr);
+  indexed_db_control_wrapper_ =
+      std::make_unique<IndexedDBControlWrapper>(std::move(indexed_db_context));
 
   cache_storage_context_ = new CacheStorageContextImpl(browser_context_);
   cache_storage_context_->Init(
@@ -1546,9 +1335,10 @@ void StoragePartitionImpl::Initialize() {
   // The Conversion Measurement API is not available in Incognito mode.
   if (!is_in_memory_ &&
       base::FeatureList::IsEnabled(features::kConversionMeasurement)) {
-    conversion_manager_ = std::make_unique<ConversionManager>(
-        path, base::ThreadPool::CreateSequencedTaskRunner(
-                  {base::MayBlock(), base::TaskPriority::BEST_EFFORT}));
+    conversion_manager_ = std::make_unique<ConversionManagerImpl>(
+        this, path,
+        base::ThreadPool::CreateSequencedTaskRunner(
+            {base::MayBlock(), base::TaskPriority::BEST_EFFORT}));
   }
 
   GeneratedCodeCacheSettings settings =
@@ -1645,17 +1435,26 @@ void StoragePartitionImpl::CreateRestrictedCookieManager(
     bool is_service_worker,
     int process_id,
     int routing_id,
-    mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver) {
+    mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver,
+    mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer) {
   DCHECK(initialized_);
   if (!GetContentClient()->browser()->WillCreateRestrictedCookieManager(
           role, browser_context_, origin, site_for_cookies, top_frame_origin,
           is_service_worker, process_id, routing_id, &receiver)) {
     GetNetworkContext()->GetRestrictedCookieManager(
         std::move(receiver), role, origin, site_for_cookies, top_frame_origin,
-        is_service_worker, process_id, routing_id);
+        std::move(cookie_observer));
   }
 }
 
+void StoragePartitionImpl::CreateHasTrustTokensAnswerer(
+    mojo::PendingReceiver<network::mojom::HasTrustTokensAnswerer> receiver,
+    const url::Origin& top_frame_origin) {
+  DCHECK(initialized_);
+  GetNetworkContext()->GetHasTrustTokensAnswerer(std::move(receiver),
+                                                 top_frame_origin);
+}
+
 storage::QuotaManager* StoragePartitionImpl::GetQuotaManager() {
   DCHECK(initialized_);
   return quota_manager_.get();
@@ -1698,26 +1497,12 @@ LockManager* StoragePartitionImpl::GetLockManager() {
 
 storage::mojom::IndexedDBControl& StoragePartitionImpl::GetIndexedDBControl() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(
-      !(indexed_db_control_.is_bound() && !indexed_db_control_.is_connected()))
-      << "Rebinding is not supported yet.";
-
-  if (indexed_db_control_.is_bound())
-    return *indexed_db_control_;
-
-  IndexedDBContextImpl* idb_context = GetIndexedDBContextInternal();
-  idb_context->IDBTaskRunner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&IndexedDBContextImpl::Bind,
-                     base::WrapRefCounted(idb_context),
-                     indexed_db_control_.BindNewPipeAndPassReceiver()));
-
-  return *indexed_db_control_;
+  return *indexed_db_control_wrapper_.get();
 }
 
 IndexedDBContextImpl* StoragePartitionImpl::GetIndexedDBContextInternal() {
   DCHECK(initialized_);
-  return indexed_db_context_.get();
+  return indexed_db_control_wrapper_->GetIndexedDBContextInternal();
 }
 
 NativeFileSystemEntryFactory*
@@ -1830,7 +1615,7 @@ StoragePartitionImpl::GetNativeFileSystemManager() {
   return native_file_system_manager_.get();
 }
 
-ConversionManager* StoragePartitionImpl::GetConversionManager() {
+ConversionManagerImpl* StoragePartitionImpl::GetConversionManager() {
   DCHECK(initialized_);
   return conversion_manager_.get();
 }
@@ -2033,52 +1818,6 @@ void StoragePartitionImpl::OnClearSiteData(int32_t process_id,
                                      load_flags, std::move(callback));
 }
 
-void StoragePartitionImpl::OnCookiesChanged(
-    bool is_service_worker,
-    int32_t process_id,
-    int32_t routing_id,
-    const GURL& url,
-    const net::SiteForCookies& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(initialized_);
-  if (is_service_worker) {
-    RunOrPostTaskOnThread(
-        FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
-        base::BindOnce(
-            &OnServiceWorkerCookiesChangedOnCoreThread, service_worker_context_,
-            url, site_for_cookies.RepresentativeUrl(), std::move(cookie_list)));
-  } else {
-    std::vector<GlobalFrameRoutingId> destination;
-    destination.emplace_back(process_id, routing_id);
-    ReportCookiesChangedOnUI(destination, url,
-                             site_for_cookies.RepresentativeUrl(), cookie_list);
-  }
-}
-
-void StoragePartitionImpl::OnCookiesRead(
-    bool is_service_worker,
-    int32_t process_id,
-    int32_t routing_id,
-    const GURL& url,
-    const net::SiteForCookies& site_for_cookies,
-    const std::vector<net::CookieWithStatus>& cookie_list) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(initialized_);
-  if (is_service_worker) {
-    RunOrPostTaskOnThread(
-        FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
-        base::BindOnce(
-            &OnServiceWorkerCookiesReadOnCoreThread, service_worker_context_,
-            url, site_for_cookies.RepresentativeUrl(), std::move(cookie_list)));
-  } else {
-    std::vector<GlobalFrameRoutingId> destination;
-    destination.emplace_back(process_id, routing_id);
-    ReportCookiesReadOnUI(destination, url,
-                          site_for_cookies.RepresentativeUrl(), cookie_list);
-  }
-}
-
 #if defined(OS_ANDROID)
 void StoragePartitionImpl::OnGenerateHttpNegotiateAuthToken(
     const std::string& server_auth_token,
@@ -2137,7 +1876,7 @@ void StoragePartitionImpl::ClearDataImpl(
       std::move(cookie_deletion_filter), GetPath(), dom_storage_context_.get(),
       quota_manager_.get(), special_storage_policy_.get(),
       filesystem_context_.get(), GetCookieManagerForBrowserProcess(),
-      perform_storage_cleanup, begin, end);
+      conversion_manager_.get(), perform_storage_cleanup, begin, end);
 }
 
 void StoragePartitionImpl::DeletionHelperDone(base::OnceClosure callback) {
@@ -2235,13 +1974,16 @@ void StoragePartitionImpl::QuotaManagedDataDeletionHelper::
     return;
   }
 
+  storage::QuotaClientTypes quota_client_types =
+      StoragePartitionImpl::GenerateQuotaClientTypes(remove_mask_);
+
   // The logic below (via CheckQuotaManagedDataDeletionStatus) only
   // invokes the callback when all processing is complete.
   base::RepeatingClosure done_callback = base::AdaptCallbackForRepeating(
       perform_storage_cleanup
           ? base::BindOnce(&PerformQuotaManagerStorageCleanup,
                            base::WrapRefCounted(quota_manager),
-                           quota_storage_type, remove_mask_,
+                           quota_storage_type, quota_client_types,
                            std::move(callback))
           : std::move(callback));
 
@@ -2259,8 +2001,7 @@ void StoragePartitionImpl::QuotaManagedDataDeletionHelper::
 
     (*deletion_task_count)++;
     quota_manager->DeleteOriginData(
-        origin, quota_storage_type,
-        StoragePartitionImpl::GenerateQuotaClientMask(remove_mask_),
+        origin, quota_storage_type, quota_client_types,
         base::BindOnce(&OnQuotaManagedOriginDeleted, origin, quota_storage_type,
                        deletion_task_count, done_callback));
   }
@@ -2310,15 +2051,22 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
     storage::SpecialStoragePolicy* special_storage_policy,
     storage::FileSystemContext* filesystem_context,
     network::mojom::CookieManager* cookie_manager,
+    ConversionManagerImpl* conversion_manager,
     bool perform_storage_cleanup,
     const base::Time begin,
     const base::Time end) {
   DCHECK_NE(remove_mask_, 0u);
   DCHECK(callback_);
 
+  // Only one of |storage_origin| and |origin_matcher| can be set.
+  DCHECK(storage_origin.is_empty() || origin_matcher.is_null());
+
   base::ScopedClosureRunner synchronous_clear_operations(
       CreateTaskCompletionClosure(TracingDataType::kSynchronous));
 
+  scoped_refptr<storage::SpecialStoragePolicy> storage_policy_ref =
+      base::WrapRefCounted(special_storage_policy);
+
   if (remove_mask_ & REMOVE_DATA_MASK_COOKIES) {
     // The CookieDeletionFilter has a redundant time interval to |begin| and
     // |end|. Ensure that the filter has no time interval specified to help
@@ -2349,19 +2097,18 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
       remove_mask_ & REMOVE_DATA_MASK_CACHE_STORAGE) {
     base::PostTask(
         FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(
-            &DataDeletionHelper::ClearQuotaManagedDataOnIOThread,
-            base::Unretained(this), base::WrapRefCounted(quota_manager), begin,
-            storage_origin, base::WrapRefCounted(special_storage_policy),
-            origin_matcher, perform_storage_cleanup,
-            CreateTaskCompletionClosure(TracingDataType::kQuota)));
+        base::BindOnce(&DataDeletionHelper::ClearQuotaManagedDataOnIOThread,
+                       base::Unretained(this),
+                       base::WrapRefCounted(quota_manager), begin,
+                       storage_origin, storage_policy_ref, origin_matcher,
+                       perform_storage_cleanup,
+                       CreateTaskCompletionClosure(TracingDataType::kQuota)));
   }
 
   if (remove_mask_ & REMOVE_DATA_MASK_LOCAL_STORAGE) {
     ClearLocalStorageOnUIThread(
-        base::WrapRefCounted(dom_storage_context),
-        base::WrapRefCounted(special_storage_policy), origin_matcher,
-        storage_origin, perform_storage_cleanup, begin, end,
+        base::WrapRefCounted(dom_storage_context), storage_policy_ref,
+        origin_matcher, storage_origin, perform_storage_cleanup, begin, end,
         mojo::WrapCallbackWithDefaultInvokeIfNotRun(
             CreateTaskCompletionClosure(TracingDataType::kLocalStorage)));
 
@@ -2372,9 +2119,8 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
       // TODO(crbug.com/960325): Sometimes SessionStorage fails to call its
       // callback. Figure out why.
       ClearSessionStorageOnUIThread(
-          base::WrapRefCounted(dom_storage_context),
-          base::WrapRefCounted(special_storage_policy), origin_matcher,
-          perform_storage_cleanup,
+          base::WrapRefCounted(dom_storage_context), storage_policy_ref,
+          origin_matcher, perform_storage_cleanup,
           mojo::WrapCallbackWithDefaultInvokeIfNotRun(
               CreateTaskCompletionClosure(TracingDataType::kSessionStorage)));
     }
@@ -2387,6 +2133,14 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
                                       TracingDataType::kShaderCache)));
   }
 
+  auto filter = CreateGenericOriginMatcher(storage_origin, origin_matcher,
+                                           storage_policy_ref);
+  if (conversion_manager && (remove_mask_ & REMOVE_DATA_MASK_CONVERSIONS)) {
+    conversion_manager->ClearData(
+        begin, end, std::move(filter),
+        CreateTaskCompletionClosure(TracingDataType::kConversions));
+  }
+
 #if BUILDFLAG(ENABLE_PLUGINS)
   if (remove_mask_ & REMOVE_DATA_MASK_PLUGIN_PRIVATE_DATA) {
     filesystem_context->default_file_task_runner()->PostTask(
@@ -2394,8 +2148,7 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
         base::BindOnce(
             &ClearPluginPrivateDataOnFileTaskRunner,
             base::WrapRefCounted(filesystem_context), storage_origin,
-            std::move(origin_matcher),
-            base::WrapRefCounted(special_storage_policy), begin, end,
+            origin_matcher, storage_policy_ref, begin, end,
             CreateTaskCompletionClosure(TracingDataType::kPluginPrivate)));
   }
 #endif  // BUILDFLAG(ENABLE_PLUGINS)
@@ -2517,6 +2270,13 @@ void StoragePartitionImpl::WaitForCodeCacheShutdownForTesting() {
   }
 }
 
+void StoragePartitionImpl::SetNetworkContextForTesting(
+    mojo::PendingRemote<network::mojom::NetworkContext>
+        network_context_remote) {
+  network_context_.reset();
+  network_context_.Bind(std::move(network_context_remote));
+}
+
 BrowserContext* StoragePartitionImpl::browser_context() const {
   return browser_context_;
 }
@@ -2609,8 +2369,24 @@ void StoragePartitionImpl::GetQuotaSettings(
 }
 
 void StoragePartitionImpl::InitNetworkContext() {
-  network_context_ = GetContentClient()->browser()->CreateNetworkContext(
-      browser_context_, is_in_memory_, relative_partition_path_);
+  network::mojom::NetworkContextParamsPtr context_params =
+      network::mojom::NetworkContextParams::New();
+  network::mojom::CertVerifierCreationParamsPtr cert_verifier_creation_params =
+      network::mojom::CertVerifierCreationParams::New();
+  GetContentClient()->browser()->ConfigureNetworkContextParams(
+      browser_context_, is_in_memory_, relative_partition_path_,
+      context_params.get(), cert_verifier_creation_params.get());
+  DCHECK(!context_params->cert_verifier_creation_params)
+      << "|cert_verifier_creation_params| should not be set in the "
+         "NetworkContextParams, as they will eventually be removed when the "
+         "CertVerifierService ships.";
+
+  context_params->cert_verifier_creation_params =
+      std::move(cert_verifier_creation_params);
+
+  network_context_.reset();
+  GetNetworkService()->CreateNetworkContext(
+      network_context_.BindNewPipeAndPassReceiver(), std::move(context_params));
   DCHECK(network_context_);
 
   network_context_client_receiver_.reset();
@@ -2640,6 +2416,7 @@ StoragePartitionImpl::GetURLLoaderFactoryForBrowserProcessInternal(
   network::mojom::URLLoaderFactoryParamsPtr params =
       network::mojom::URLLoaderFactoryParams::New();
   params->process_id = network::mojom::kBrowserProcessId;
+  params->automatically_assign_isolation_info = true;
   params->is_corb_enabled = corb_enabled;
   // Corb requests are likely made on behalf of untrusted renderers.
   if (!corb_enabled)
@@ -2699,4 +2476,13 @@ bool StoragePartition::IsAppCacheEnabled() {
   return base::FeatureList::IsEnabled(blink::features::kAppCache);
 }
 
+mojo::PendingRemote<network::mojom::CookieAccessObserver>
+StoragePartitionImpl::CreateCookieAccessObserverForServiceWorker() {
+  mojo::PendingRemote<network::mojom::CookieAccessObserver> remote;
+  service_worker_cookie_observers_.Add(
+      std::make_unique<ServiceWorkerCookieAccessObserver>(this),
+      remote.InitWithNewPipeAndPassReceiver());
+  return remote;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/storage_partition_impl.h b/chromium/content/browser/storage_partition_impl.h
index 310a9a8260e..965ebe62ce6 100644
--- a/chromium/content/browser/storage_partition_impl.h
+++ b/chromium/content/browser/storage_partition_impl.h
@@ -9,8 +9,10 @@
 
 #include <map>
 #include <memory>
+#include <string>
 
 #include "base/compiler_specific.h"
+#include "base/containers/flat_set.h"
 #include "base/files/file_path.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
@@ -30,8 +32,7 @@
 #include "content/browser/content_index/content_index_context_impl.h"
 #include "content/browser/devtools/devtools_background_services_context_impl.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
-#include "content/browser/idle/idle_manager.h"
-#include "content/browser/indexed_db/indexed_db_context_impl.h"
+#include "content/browser/indexed_db/indexed_db_control_wrapper.h"
 #include "content/browser/locks/lock_manager.h"
 #include "content/browser/notifications/platform_notification_context_impl.h"
 #include "content/browser/payments/payment_app_context_impl.h"
@@ -65,15 +66,17 @@ class ProtoDatabaseProvider;
 namespace content {
 
 class BackgroundFetchContext;
-class ConversionManager;
+class ConversionManagerImpl;
 class CookieStoreContext;
 class BlobRegistryWrapper;
+class IndexedDBContextImpl;
 class PrefetchURLLoaderService;
 class GeneratedCodeCacheContext;
 class NativeFileSystemEntryFactory;
 class NativeFileSystemManagerImpl;
 class NativeIOContext;
 class QuotaContext;
+class IdleManager;
 
 class CONTENT_EXPORT StoragePartitionImpl
     : public StoragePartition,
@@ -85,9 +88,10 @@ class CONTENT_EXPORT StoragePartitionImpl
   // (e.g. resource context).
   ~StoragePartitionImpl() override;
 
-  // Quota managed data uses a different bitmask for types than
-  // StoragePartition uses. This method generates that mask.
-  static int GenerateQuotaClientMask(uint32_t remove_mask);
+  // Quota managed data uses a different representation for storage types than
+  // StoragePartition uses. This method generates that representation.
+  static storage::QuotaClientTypes GenerateQuotaClientTypes(
+      uint32_t remove_mask);
 
   // Allows overriding the URLLoaderFactory creation for
   // GetURLLoaderFactoryForBrowserProcess.
@@ -121,23 +125,16 @@ class CONTENT_EXPORT StoragePartitionImpl
   std::unique_ptr<network::PendingSharedURLLoaderFactory>
   GetURLLoaderFactoryForBrowserProcessIOThread() override;
   network::mojom::CookieManager* GetCookieManagerForBrowserProcess() override;
-  void CreateRestrictedCookieManager(
-      network::mojom::RestrictedCookieManagerRole role,
-      const url::Origin& origin,
-      const net::SiteForCookies& site_for_cookies,
-      const url::Origin& top_frame_origin,
-      bool is_service_worker,
-      int process_id,
-      int routing_id,
-      mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver)
-      override;
+  void CreateHasTrustTokensAnswerer(
+      mojo::PendingReceiver<network::mojom::HasTrustTokensAnswerer> receiver,
+      const url::Origin& top_frame_origin) override;
   storage::QuotaManager* GetQuotaManager() override;
   ChromeAppCacheService* GetAppCacheService() override;
   BackgroundSyncContextImpl* GetBackgroundSyncContext() override;
   storage::FileSystemContext* GetFileSystemContext() override;
   storage::DatabaseTracker* GetDatabaseTracker() override;
   DOMStorageContextWrapper* GetDOMStorageContext() override;
-  IdleManager* GetIdleManager();
+  IdleManager* GetIdleManager() override;
   LockManager* GetLockManager();  // override; TODO: Add to interface
   storage::mojom::IndexedDBControl& GetIndexedDBControl() override;
   NativeFileSystemEntryFactory* GetNativeFileSystemEntryFactory() override;
@@ -187,6 +184,9 @@ class CONTENT_EXPORT StoragePartitionImpl
   void FlushNetworkInterfaceForTesting() override;
   void WaitForDeletionTasksForTesting() override;
   void WaitForCodeCacheShutdownForTesting() override;
+  void SetNetworkContextForTesting(
+      mojo::PendingRemote<network::mojom::NetworkContext>
+          network_context_remote) override;
   BackgroundFetchContext* GetBackgroundFetchContext();
   PaymentAppContextImpl* GetPaymentAppContext();
   BroadcastChannelProvider* GetBroadcastChannelProvider();
@@ -196,8 +196,8 @@ class CONTENT_EXPORT StoragePartitionImpl
   CookieStoreContext* GetCookieStoreContext();
   NativeFileSystemManagerImpl* GetNativeFileSystemManager();
   QuotaContext* GetQuotaContext();
-  ConversionManager* GetConversionManager();
   NativeIOContext* GetNativeIOContext();
+  ConversionManagerImpl* GetConversionManager();
 
   // blink::mojom::DomStorage interface.
   void OpenLocalStorage(
@@ -255,20 +255,6 @@ class CONTENT_EXPORT StoragePartitionImpl
                        const std::string& header_value,
                        int load_flags,
                        OnClearSiteDataCallback callback) override;
-  void OnCookiesChanged(
-      bool is_service_worker,
-      int32_t process_id,
-      int32_t routing_id,
-      const GURL& url,
-      const net::SiteForCookies& site_for_cookies,
-      const std::vector<net::CookieWithStatus>& cookie_list) override;
-  void OnCookiesRead(
-      bool is_service_worker,
-      int32_t process_id,
-      int32_t routing_id,
-      const GURL& url,
-      const net::SiteForCookies& site_for_cookies,
-      const std::vector<net::CookieWithStatus>& cookie_list) override;
 #if defined(OS_ANDROID)
   void OnGenerateHttpNegotiateAuthToken(
       const std::string& server_auth_token,
@@ -326,16 +312,35 @@ class CONTENT_EXPORT StoragePartitionImpl
   network::mojom::OriginPolicyManager*
   GetOriginPolicyManagerForBrowserProcess();
 
+  // We have to plumb |is_service_worker|, |process_id| and |routing_id| because
+  // they are plumbed to WebView via WillCreateRestrictedCookieManager, which
+  // makes some decision based on that.
+  void CreateRestrictedCookieManager(
+      network::mojom::RestrictedCookieManagerRole role,
+      const url::Origin& origin,
+      const net::SiteForCookies& site_for_cookies,
+      const url::Origin& top_frame_origin,
+      bool is_service_worker,
+      int process_id,
+      int routing_id,
+      mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver,
+      mojo::PendingRemote<network::mojom::CookieAccessObserver>
+          cookie_observer);
+
   // Override the origin policy manager for testing use only.
   void SetOriginPolicyManagerForBrowserProcessForTesting(
       mojo::PendingRemote<network::mojom::OriginPolicyManager>
           test_origin_policy_manager);
   void ResetOriginPolicyManagerForBrowserProcessForTesting();
 
+  mojo::PendingRemote<network::mojom::CookieAccessObserver>
+  CreateCookieAccessObserverForServiceWorker();
+
  private:
   class DataDeletionHelper;
   class QuotaManagedDataDeletionHelper;
   class URLLoaderFactoryForBrowserProcess;
+  class ServiceWorkerCookieAccessObserver;
 
   friend class BackgroundSyncManagerTest;
   friend class BackgroundSyncServiceImplTestHarness;
@@ -467,8 +472,7 @@ class CONTENT_EXPORT StoragePartitionImpl
   scoped_refptr<DOMStorageContextWrapper> dom_storage_context_;
   std::unique_ptr<IdleManager> idle_manager_;
   std::unique_ptr<LockManager> lock_manager_;
-  mojo::Remote<storage::mojom::IndexedDBControl> indexed_db_control_;
-  scoped_refptr<IndexedDBContextImpl> indexed_db_context_;
+  std::unique_ptr<IndexedDBControlWrapper> indexed_db_control_wrapper_;
   scoped_refptr<CacheStorageContextImpl> cache_storage_context_;
   scoped_refptr<ServiceWorkerContextWrapper> service_worker_context_;
   std::unique_ptr<DedicatedWorkerServiceImpl> dedicated_worker_service_;
@@ -495,8 +499,8 @@ class CONTENT_EXPORT StoragePartitionImpl
   std::unique_ptr<leveldb_proto::ProtoDatabaseProvider>
       proto_database_provider_;
   scoped_refptr<ContentIndexContextImpl> content_index_context_;
-  std::unique_ptr<ConversionManager> conversion_manager_;
   std::unique_ptr<NativeIOContext> native_io_context_;
+  std::unique_ptr<ConversionManagerImpl> conversion_manager_;
 
   // ReceiverSet for DomStorage, using the
   // ChildProcessSecurityPolicyImpl::Handle as the binding context type. The
@@ -551,6 +555,11 @@ class CONTENT_EXPORT StoragePartitionImpl
   // Called when all deletions are done. For test use only.
   base::OnceClosure on_deletion_helpers_done_callback_;
 
+  // A set of connections to the network service used to notify browser process
+  // about cookie reads and writes made by a service worker in this process.
+  mojo::UniqueReceiverSet<network::mojom::CookieAccessObserver>
+      service_worker_cookie_observers_;
+
   base::WeakPtrFactory<StoragePartitionImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(StoragePartitionImpl);
diff --git a/chromium/content/browser/storage_partition_impl_browsertest.cc b/chromium/content/browser/storage_partition_impl_browsertest.cc
index 91415226766..056cd26347e 100644
--- a/chromium/content/browser/storage_partition_impl_browsertest.cc
+++ b/chromium/content/browser/storage_partition_impl_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/simple_url_loader_test_helper.h"
 #include "content/public/test/url_loader_interceptor.h"
@@ -163,6 +164,7 @@ IN_PROC_BROWSER_TEST_F(StoragePartitionImplBrowsertest, NetworkContext) {
   network::mojom::URLLoaderFactoryParamsPtr params =
       network::mojom::URLLoaderFactoryParams::New();
   params->process_id = network::mojom::kBrowserProcessId;
+  params->automatically_assign_isolation_info = true;
   params->is_corb_enabled = false;
   mojo::Remote<network::mojom::URLLoaderFactory> loader_factory;
   BrowserContext::GetDefaultStoragePartition(
diff --git a/chromium/content/browser/storage_partition_impl_unittest.cc b/chromium/content/browser/storage_partition_impl_unittest.cc
index 9677816ec0f..7b85a92260e 100644
--- a/chromium/content/browser/storage_partition_impl_unittest.cc
+++ b/chromium/content/browser/storage_partition_impl_unittest.cc
@@ -28,6 +28,8 @@
 #include "components/services/storage/public/cpp/constants.h"
 #include "content/browser/code_cache/generated_code_cache.h"
 #include "content/browser/code_cache/generated_code_cache_context.h"
+#include "content/browser/conversions/conversion_manager_impl.h"
+#include "content/browser/conversions/conversion_test_utils.h"
 #include "content/browser/gpu/shader_cache_factory.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_task_traits.h"
@@ -48,6 +50,7 @@
 #include "storage/browser/quota/quota_manager.h"
 #include "storage/browser/test/mock_quota_manager.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/leveldatabase/env_chromium.h"
@@ -83,7 +86,8 @@ const blink::mojom::StorageType kTemporary =
 const blink::mojom::StorageType kPersistent =
     blink::mojom::StorageType::kPersistent;
 
-const storage::QuotaClient::ID kClientFile = storage::QuotaClient::kFileSystem;
+const storage::QuotaClientType kClientFile =
+    storage::QuotaClientType::kFileSystem;
 
 const uint32_t kAllQuotaRemoveMask =
     StoragePartition::REMOVE_DATA_MASK_APPCACHE |
@@ -149,7 +153,7 @@ class RemoveCookieTester {
         net::CanonicalCookie::Create(origin.GetURL(), "A=1", base::Time::Now(),
                                      base::nullopt /* server_time */, &status));
     storage_partition_->GetCookieManagerForBrowserProcess()->SetCanonicalCookie(
-        *cc, origin.scheme(), net::CookieOptions::MakeAllInclusive(),
+        *cc, origin.GetURL(), net::CookieOptions::MakeAllInclusive(),
         base::BindOnce(&RemoveCookieTester::SetCookieCallback,
                        base::Unretained(this)));
     await_completion_.BlockUntilNotified();
@@ -727,7 +731,9 @@ class StoragePartitionImplTest : public testing::Test {
  public:
   StoragePartitionImplTest()
       : task_environment_(content::BrowserTaskEnvironment::IO_MAINLOOP),
-        browser_context_(new TestBrowserContext()) {}
+        browser_context_(new TestBrowserContext()) {
+    feature_list_.InitAndEnableFeature(features::kConversionMeasurement);
+  }
 
   storage::MockQuotaManager* GetMockManager() {
     if (!quota_manager_.get()) {
@@ -750,6 +756,8 @@ class StoragePartitionImplTest : public testing::Test {
   std::unique_ptr<TestBrowserContext> browser_context_;
   scoped_refptr<storage::MockQuotaManager> quota_manager_;
 
+  base::test::ScopedFeatureList feature_list_;
+
   DISALLOW_COPY_AND_ASSIGN(StoragePartitionImplTest);
 };
 
@@ -812,31 +820,33 @@ TEST_F(StoragePartitionShaderClearTest, ClearShaderCache) {
   EXPECT_EQ(0u, Size());
 }
 
-TEST_F(StoragePartitionImplTest, QuotaClientMaskGeneration) {
-  EXPECT_EQ(storage::QuotaClient::kFileSystem,
-            StoragePartitionImpl::GenerateQuotaClientMask(
-                StoragePartition::REMOVE_DATA_MASK_FILE_SYSTEMS));
-  EXPECT_EQ(storage::QuotaClient::kDatabase,
-            StoragePartitionImpl::GenerateQuotaClientMask(
-                StoragePartition::REMOVE_DATA_MASK_WEBSQL));
-  EXPECT_EQ(storage::QuotaClient::kAppcache,
-            StoragePartitionImpl::GenerateQuotaClientMask(
-                StoragePartition::REMOVE_DATA_MASK_APPCACHE));
-  EXPECT_EQ(storage::QuotaClient::kIndexedDatabase,
-            StoragePartitionImpl::GenerateQuotaClientMask(
-                StoragePartition::REMOVE_DATA_MASK_INDEXEDDB));
-  EXPECT_EQ(storage::QuotaClient::kFileSystem |
-                storage::QuotaClient::kDatabase |
-                storage::QuotaClient::kAppcache |
-                storage::QuotaClient::kIndexedDatabase,
-            StoragePartitionImpl::GenerateQuotaClientMask(kAllQuotaRemoveMask));
+TEST_F(StoragePartitionImplTest, QuotaClientTypesGeneration) {
+  EXPECT_THAT(StoragePartitionImpl::GenerateQuotaClientTypes(
+                  StoragePartition::REMOVE_DATA_MASK_FILE_SYSTEMS),
+              testing::ElementsAre(storage::QuotaClientType::kFileSystem));
+  EXPECT_THAT(StoragePartitionImpl::GenerateQuotaClientTypes(
+                  StoragePartition::REMOVE_DATA_MASK_WEBSQL),
+              testing::ElementsAre(storage::QuotaClientType::kDatabase));
+  EXPECT_THAT(StoragePartitionImpl::GenerateQuotaClientTypes(
+                  StoragePartition::REMOVE_DATA_MASK_APPCACHE),
+              testing::ElementsAre(storage::QuotaClientType::kAppcache));
+  EXPECT_THAT(StoragePartitionImpl::GenerateQuotaClientTypes(
+                  StoragePartition::REMOVE_DATA_MASK_INDEXEDDB),
+              testing::ElementsAre(storage::QuotaClientType::kIndexedDatabase));
+  EXPECT_THAT(
+      StoragePartitionImpl::GenerateQuotaClientTypes(kAllQuotaRemoveMask),
+      testing::UnorderedElementsAre(
+          storage::QuotaClientType::kFileSystem,
+          storage::QuotaClientType::kDatabase,
+          storage::QuotaClientType::kAppcache,
+          storage::QuotaClientType::kIndexedDatabase));
 }
 
 void PopulateTestQuotaManagedPersistentData(storage::MockQuotaManager* manager,
                                             const url::Origin& origin1,
                                             const url::Origin& origin2) {
-  manager->AddOrigin(origin1, kPersistent, kClientFile, base::Time());
-  manager->AddOrigin(origin2, kPersistent, kClientFile,
+  manager->AddOrigin(origin1, kPersistent, {kClientFile}, base::Time());
+  manager->AddOrigin(origin2, kPersistent, {kClientFile},
                      base::Time::Now() - base::TimeDelta::FromDays(1));
 
   EXPECT_TRUE(manager->OriginHasData(origin1, kPersistent, kClientFile));
@@ -846,8 +856,8 @@ void PopulateTestQuotaManagedPersistentData(storage::MockQuotaManager* manager,
 void PopulateTestQuotaManagedTemporaryData(storage::MockQuotaManager* manager,
                                            const url::Origin& origin1,
                                            const url::Origin& origin2) {
-  manager->AddOrigin(origin1, kTemporary, kClientFile, base::Time::Now());
-  manager->AddOrigin(origin2, kTemporary, kClientFile,
+  manager->AddOrigin(origin1, kTemporary, {kClientFile}, base::Time::Now());
+  manager->AddOrigin(origin2, kTemporary, {kClientFile},
                      base::Time::Now() - base::TimeDelta::FromDays(1));
 
   EXPECT_TRUE(manager->OriginHasData(origin1, kTemporary, kClientFile));
@@ -870,8 +880,8 @@ void PopulateTestQuotaManagedData(storage::MockQuotaManager* manager,
 void PopulateTestQuotaManagedNonBrowsingData(
     const url::Origin& origin,
     storage::MockQuotaManager* manager) {
-  manager->AddOrigin(origin, kTemporary, kClientFile, base::Time());
-  manager->AddOrigin(origin, kPersistent, kClientFile, base::Time());
+  manager->AddOrigin(origin, kTemporary, {kClientFile}, base::Time());
+  manager->AddOrigin(origin, kPersistent, {kClientFile}, base::Time());
 }
 
 TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverBoth) {
@@ -1664,4 +1674,128 @@ TEST(StoragePartitionImplStaticTest, CreatePredicateForHostCookies) {
   }
 }
 
+TEST_F(StoragePartitionImplTest, ConversionsClearDataForOrigin) {
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(browser_context()));
+
+  ConversionManagerImpl* conversion_manager = partition->GetConversionManager();
+
+  base::Time now = base::Time::Now();
+  auto impression =
+      ImpressionBuilder(now).SetExpiry(base::TimeDelta::FromDays(2)).Build();
+  conversion_manager->HandleImpression(impression);
+  conversion_manager->HandleConversion(DefaultConversion());
+
+  base::RunLoop run_loop;
+  partition->ClearData(StoragePartition::REMOVE_DATA_MASK_CONVERSIONS, 0,
+                       impression.impression_origin().GetURL(), now, now,
+                       run_loop.QuitClosure());
+  run_loop.Run();
+
+  EXPECT_TRUE(
+      GetConversionsToReportForTesting(conversion_manager, base::Time::Max())
+          .empty());
+}
+
+TEST_F(StoragePartitionImplTest, ConversionsClearDataWrongMask) {
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(browser_context()));
+
+  ConversionManagerImpl* conversion_manager = partition->GetConversionManager();
+
+  base::Time now = base::Time::Now();
+  auto impression =
+      ImpressionBuilder(now).SetExpiry(base::TimeDelta::FromDays(2)).Build();
+  conversion_manager->HandleImpression(impression);
+  conversion_manager->HandleConversion(DefaultConversion());
+
+  EXPECT_FALSE(
+      GetConversionsToReportForTesting(conversion_manager, base::Time::Max())
+          .empty());
+
+  // Arbitrary non-conversions mask.
+  base::RunLoop run_loop;
+  partition->ClearData(StoragePartition::REMOVE_DATA_MASK_COOKIES, 0,
+                       impression.impression_origin().GetURL(), now, now,
+                       run_loop.QuitClosure());
+  run_loop.Run();
+  EXPECT_FALSE(
+      GetConversionsToReportForTesting(conversion_manager, base::Time::Max())
+          .empty());
+}
+
+TEST_F(StoragePartitionImplTest, ConversionsClearAllData) {
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(browser_context()));
+
+  ConversionManagerImpl* conversion_manager = partition->GetConversionManager();
+
+  base::Time now = base::Time::Now();
+  for (int i = 0; i < 20; i++) {
+    auto origin = url::Origin::Create(
+        GURL(base::StringPrintf("https://www.%d.test/", i)));
+    auto impression = ImpressionBuilder(now)
+                          .SetExpiry(base::TimeDelta::FromDays(2))
+                          .SetImpressionOrigin(origin)
+                          .SetReportingOrigin(origin)
+                          .SetConversionOrigin(origin)
+                          .Build();
+    conversion_manager->HandleImpression(impression);
+  }
+  base::RunLoop run_loop;
+  partition->ClearData(StoragePartition::REMOVE_DATA_MASK_CONVERSIONS, 0,
+                       GURL(), now, now, run_loop.QuitClosure());
+  run_loop.Run();
+
+  EXPECT_TRUE(
+      GetConversionsToReportForTesting(conversion_manager, base::Time::Max())
+          .empty());
+}
+
+TEST_F(StoragePartitionImplTest, ConversionsClearDataForFilter) {
+  StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
+      BrowserContext::GetDefaultStoragePartition(browser_context()));
+
+  ConversionManagerImpl* conversion_manager = partition->GetConversionManager();
+
+  base::Time now = base::Time::Now();
+  for (int i = 0; i < 5; i++) {
+    auto impression =
+        url::Origin::Create(GURL(base::StringPrintf("https://imp-%d.com/", i)));
+    auto reporter = url::Origin::Create(
+        GURL(base::StringPrintf("https://reporter-%d.com/", i)));
+    auto conv = url::Origin::Create(
+        GURL(base::StringPrintf("https://conv-%d.com/", i)));
+    conversion_manager->HandleImpression(
+        ImpressionBuilder(now)
+            .SetImpressionOrigin(impression)
+            .SetReportingOrigin(reporter)
+            .SetConversionOrigin(conv)
+            .SetExpiry(base::TimeDelta::FromDays(2))
+            .Build());
+    conversion_manager->HandleConversion(
+        StorableConversion("123", conv, reporter));
+  }
+
+  EXPECT_EQ(5u, GetConversionsToReportForTesting(conversion_manager,
+                                                 base::Time::Max())
+                    .size());
+
+  // Match against enough Origins to delete three of the imp/conv pairs.
+  base::RunLoop run_loop;
+  StoragePartition::OriginMatcherFunction func = base::BindRepeating(
+      [](const url::Origin& origin, storage::SpecialStoragePolicy* policy) {
+        return origin == url::Origin::Create(GURL("https://imp-2.com/")) ||
+               origin == url::Origin::Create(GURL("https://conv-3.com/")) ||
+               origin == url::Origin::Create(GURL("https://rep-4.com/")) ||
+               origin == url::Origin::Create(GURL("https://imp-4.com/"));
+      });
+  partition->ClearData(StoragePartition::REMOVE_DATA_MASK_CONVERSIONS, 0, func,
+                       nullptr, false, now, now, run_loop.QuitClosure());
+  run_loop.Run();
+  EXPECT_EQ(2u, GetConversionsToReportForTesting(conversion_manager,
+                                                 base::Time::Max())
+                    .size());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/storage_service_restart_browsertest.cc b/chromium/content/browser/storage_service_restart_browsertest.cc
index de207ff3d79..2bbb795ad49 100644
--- a/chromium/content/browser/storage_service_restart_browsertest.cc
+++ b/chromium/content/browser/storage_service_restart_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/storage_service_sandbox_browsertest.cc b/chromium/content/browser/storage_service_sandbox_browsertest.cc
index 45219926e39..ae0bc5d43bb 100644
--- a/chromium/content/browser/storage_service_sandbox_browsertest.cc
+++ b/chromium/content/browser/storage_service_sandbox_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/system_connector_impl.cc b/chromium/content/browser/system_connector_impl.cc
index 522ed7c121e..521afb66c7c 100644
--- a/chromium/content/browser/system_connector_impl.cc
+++ b/chromium/content/browser/system_connector_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/browser/system_connector_impl.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/no_destructor.h"
 #include "base/task/post_task.h"
 #include "base/threading/sequence_local_storage_slot.h"
diff --git a/chromium/content/browser/text_fragment_browsertest.cc b/chromium/content/browser/text_fragment_browsertest.cc
new file mode 100644
index 00000000000..2c6e0d5fdca
--- /dev/null
+++ b/chromium/content/browser/text_fragment_browsertest.cc
@@ -0,0 +1,453 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/test/scoped_feature_list.h"
+#include "base/test/test_timeouts.h"
+#include "content/browser/renderer_host/render_widget_host_impl.h"
+#include "content/public/browser/render_view_host.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/hit_test_region_observer.h"
+#include "content/public/test/test_navigation_observer.h"
+#include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/controllable_http_response.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "url/gurl.h"
+
+namespace content {
+
+class TextFragmentAnchorBrowserTest : public ContentBrowserTest {
+ public:
+  TextFragmentAnchorBrowserTest() {
+    feature_list_.InitAndEnableFeature(features::kDocumentPolicy);
+  }
+
+ protected:
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ContentBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
+                                    "TextFragmentIdentifiers");
+  }
+
+  // Simulates a click on the middle of the DOM element with the given |id|.
+  void ClickElementWithId(WebContents* web_contents, const std::string& id) {
+    // Get the center coordinates of the DOM element.
+    const int x = EvalJs(web_contents,
+                         JsReplace("const bounds = "
+                                   "document.getElementById($1)."
+                                   "getBoundingClientRect();"
+                                   "Math.floor(bounds.left + bounds.width / 2)",
+                                   id))
+                      .ExtractInt();
+    const int y = EvalJs(web_contents,
+                         JsReplace("const bounds = "
+                                   "document.getElementById($1)."
+                                   "getBoundingClientRect();"
+                                   "Math.floor(bounds.top + bounds.height / 2)",
+                                   id))
+                      .ExtractInt();
+
+    SimulateMouseClickAt(web_contents, 0, blink::WebMouseEvent::Button::kLeft,
+                         gfx::Point(x, y));
+  }
+
+  void WaitForPageLoad(WebContents* contents) {
+    EXPECT_TRUE(WaitForLoadStop(contents));
+    EXPECT_TRUE(WaitForRenderFrameReady(contents->GetMainFrame()));
+  }
+
+  RenderWidgetHostImpl* GetWidgetHost() {
+    return RenderWidgetHostImpl::From(
+        shell()->web_contents()->GetRenderViewHost()->GetWidget());
+  }
+
+  base::test::ScopedFeatureList feature_list_;
+};
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest, EnabledOnUserNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/target_text_link.html"));
+  GURL target_text_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WebContents* main_contents = shell()->web_contents();
+  TestNavigationObserver observer(main_contents);
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  // We need to wait until hit test data is available.
+  HitTestRegionObserver hittest_observer(GetWidgetHost()->GetFrameSinkId());
+  hittest_observer.WaitForHitTestData();
+
+  ClickElementWithId(main_contents, "link");
+  observer.Wait();
+  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(
+      /*expected_scroll_offset_at_top=*/false);
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(true, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       EnabledOnBrowserNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(
+      /*expected_scroll_offset_at_top=*/false);
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(true, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       EnabledOnUserGestureScriptNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/empty.html"));
+  GURL target_text_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WebContents* main_contents = shell()->web_contents();
+  TestNavigationObserver observer(main_contents);
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  // ExecuteScript executes with a user gesture
+  EXPECT_TRUE(ExecuteScript(main_contents,
+                            "location = '" + target_text_url.spec() + "';"));
+  observer.Wait();
+  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(
+      /*expected_scroll_offset_at_top=*/false);
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(true, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       DisabledOnScriptNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/empty.html"));
+  GURL target_text_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WebContents* main_contents = shell()->web_contents();
+  TestNavigationObserver observer(main_contents);
+  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
+      main_contents, "location = '" + target_text_url.spec() + "';"));
+  observer.Wait();
+  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
+
+  WaitForPageLoad(main_contents);
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(false, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       DisabledOnScriptHistoryNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL target_text_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+  GURL url(embedded_test_server()->GetURL("/empty.html"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), target_text_url));
+
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(false);
+
+  // Scroll the page back to top so scroll restoration does not scroll the
+  // target back into view.
+  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 0)"));
+  frame_observer.WaitForScrollOffsetAtTop(true);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  TestNavigationObserver observer(main_contents);
+  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(main_contents, "history.back()"));
+  observer.Wait();
+  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
+
+  WaitForPageLoad(main_contents);
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(GetWidgetHost());
+
+  // Note: we use a scroll handler in the page to check whether any scrolls
+  // happened at all, rather than checking the current scroll offset. This is
+  // to ensure that if the offset is reset back to the top for other reasons
+  // (e.g. history restoration) we still fail this test. See
+  // https://crbug.com/1042986 for why this matters.
+  EXPECT_EQ(false, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       EnabledOnSameDocumentBrowserNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(false);
+
+  // Scroll the page back to top. Make sure we reset the |did_scroll| variable
+  // we'll use below to ensure the same-document navigation invokes the text
+  // fragment.
+  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 0)"));
+  frame_observer.WaitForScrollOffsetAtTop(true);
+  EXPECT_TRUE(ExecJs(main_contents, "did_scroll = false;"));
+
+  // Perform a same-document browser initiated navigation
+  GURL same_doc_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=some"));
+  EXPECT_TRUE(NavigateToURL(shell(), same_doc_url));
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(
+      /*expected_scroll_offset_at_top=*/false);
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(true, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       DisabledOnSameDocumentScriptNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(
+      embedded_test_server()->GetURL("/scrollable_page_with_content.html"));
+  GURL target_text_url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=some"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WebContents* main_contents = shell()->web_contents();
+  TestNavigationObserver observer(main_contents);
+  EXPECT_TRUE(ExecuteScriptWithoutUserGesture(
+      main_contents, "location = '" + target_text_url.spec() + "';"));
+  observer.Wait();
+  EXPECT_EQ(target_text_url, main_contents->GetLastCommittedURL());
+
+  WaitForPageLoad(main_contents);
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(false, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest, EnabledByDocumentPolicy) {
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      "/target.html");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/target.html#:~:text=text"));
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  // Load the target document
+  TestNavigationManager navigation_manager(main_contents, url);
+  shell()->LoadURL(url);
+
+  // Start navigation
+  EXPECT_TRUE(navigation_manager.WaitForRequestStart());
+  navigation_manager.ResumeNavigation();
+
+  // Send Document-Policy header
+  response.WaitForRequest();
+  response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: text/html; charset=utf-8\r\n"
+      "Document-Policy: no-force-load-at-top\r\n"
+      "\r\n"
+      "<script>"
+      "  let did_scroll = false;"
+      "  window.addEventListener('scroll', () => {"
+      "    did_scroll = true;"
+      "  });"
+      "</script>"
+      "<p style='position: absolute; top: 10000px;'>Some text</p>");
+  response.Done();
+
+  EXPECT_TRUE(navigation_manager.WaitForResponse());
+  navigation_manager.ResumeNavigation();
+  navigation_manager.WaitForNavigationFinished();
+
+  WaitForPageLoad(main_contents);
+  frame_observer.WaitForScrollOffsetAtTop(
+      /*expected_scroll_offset_at_top=*/false);
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(true, EvalJs(main_contents, "did_scroll;"));
+}
+
+IN_PROC_BROWSER_TEST_F(TextFragmentAnchorBrowserTest,
+                       DisabledByDocumentPolicy) {
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      "/target.html");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/target.html#:~:text=text"));
+  WebContents* main_contents = shell()->web_contents();
+
+  // Load the target document
+  TestNavigationManager navigation_manager(main_contents, url);
+  shell()->LoadURL(url);
+
+  // Start navigation
+  EXPECT_TRUE(navigation_manager.WaitForRequestStart());
+  navigation_manager.ResumeNavigation();
+
+  // Send Document-Policy header
+  response.WaitForRequest();
+  response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: text/html; charset=utf-8\r\n"
+      "Document-Policy: force-load-at-top\r\n"
+      "\r\n"
+      "<script>"
+      "  let did_scroll = false;"
+      "  window.addEventListener('scroll', () => {"
+      "    did_scroll = true;"
+      "  });"
+      "</script>"
+      "<p style='position: absolute; top: 10000px;'>Some text</p>");
+  response.Done();
+
+  EXPECT_TRUE(navigation_manager.WaitForResponse());
+  navigation_manager.ResumeNavigation();
+  navigation_manager.WaitForNavigationFinished();
+
+  WaitForPageLoad(main_contents);
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(GetWidgetHost());
+  EXPECT_EQ(false, EvalJs(main_contents, "did_scroll;"));
+}
+
+class ForceLoadAtTopBrowserTest : public TextFragmentAnchorBrowserTest {
+ protected:
+  void SetUpOnMainThread() override {
+    TextFragmentAnchorBrowserTest::SetUpOnMainThread();
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    TextFragmentAnchorBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
+                                    "ForceLoadAtTop");
+  }
+};
+
+// Test that scroll restoration is disabled with ForceLoadAtTop
+IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, ScrollRestorationDisabled) {
+  GURL url(
+      embedded_test_server()->GetURL("/scrollable_page_with_content.html"));
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
+
+  // Scroll down the page a bit
+  EXPECT_TRUE(ExecuteScript(main_contents, "window.scrollTo(0, 1000)"));
+  frame_observer.WaitForScrollOffsetAtTop(false);
+
+  // Navigate away
+  EXPECT_TRUE(ExecuteScript(main_contents, "window.location = 'about:blank'"));
+  EXPECT_TRUE(WaitForLoadStop(main_contents));
+  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
+
+  // Navigate back
+  EXPECT_TRUE(ExecuteScript(main_contents, "history.back()"));
+  EXPECT_TRUE(WaitForLoadStop(main_contents));
+  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(RenderWidgetHostImpl::From(
+      main_contents->GetRenderViewHost()->GetWidget()));
+  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
+}
+
+// Test that element fragment anchor scrolling is disabled with ForceLoadAtTop
+IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, FragmentAnchorDisabled) {
+  GURL url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#text"));
+  WebContents* main_contents = shell()->web_contents();
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(RenderWidgetHostImpl::From(
+      main_contents->GetRenderViewHost()->GetWidget()));
+  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
+}
+
+IN_PROC_BROWSER_TEST_F(ForceLoadAtTopBrowserTest, TextFragmentAnchorDisabled) {
+  GURL url(embedded_test_server()->GetURL(
+      "/scrollable_page_with_content.html#:~:text=text"));
+  WebContents* main_contents = shell()->web_contents();
+  RenderFrameSubmissionObserver frame_observer(main_contents);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_TRUE(WaitForRenderFrameReady(main_contents->GetMainFrame()));
+
+  // Wait a short amount of time to ensure the page does not scroll.
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+  RunUntilInputProcessed(RenderWidgetHostImpl::From(
+      main_contents->GetRenderViewHost()->GetWidget()));
+  EXPECT_TRUE(main_contents->GetMainFrame()->GetView()->IsScrollOffsetAtTop());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/tracing/background_tracing_active_scenario.cc b/chromium/content/browser/tracing/background_tracing_active_scenario.cc
index c6d2bbaa2ba..ba985c5ff0f 100644
--- a/chromium/content/browser/tracing/background_tracing_active_scenario.cc
+++ b/chromium/content/browser/tracing/background_tracing_active_scenario.cc
@@ -269,7 +269,7 @@ class LegacyTracingSession
   void AbortScenario(const base::RepeatingClosure& on_abort_callback) override {
     if (TracingControllerImpl::GetInstance()->IsTracing()) {
       TracingControllerImpl::GetInstance()->StopTracing(
-          TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
+          TracingControllerImpl::CreateCallbackEndpoint(base::BindOnce(
               [](const base::RepeatingClosure& on_abort_callback,
                  std::unique_ptr<std::string>) { on_abort_callback.Run(); },
               std::move(on_abort_callback))));
diff --git a/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc b/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
index cbd31deba8e..9e96304ecbe 100644
--- a/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
+++ b/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
@@ -36,6 +36,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
@@ -351,8 +352,8 @@ class TestTriggerHelper {
  public:
   BackgroundTracingManager::StartedFinalizingCallback receive_closure(
       bool expected) {
-    return base::BindRepeating(&TestTriggerHelper::OnTriggerReceive,
-                               base::Unretained(this), expected);
+    return base::BindOnce(&TestTriggerHelper::OnTriggerReceive,
+                          base::Unretained(this), expected);
   }
 
   void WaitForTriggerReceived() { wait_for_trigger_received_.Run(); }
diff --git a/chromium/content/browser/tracing/cast_tracing_agent.cc b/chromium/content/browser/tracing/cast_tracing_agent.cc
index 67e1e566bef..d277f536965 100644
--- a/chromium/content/browser/tracing/cast_tracing_agent.cc
+++ b/chromium/content/browser/tracing/cast_tracing_agent.cc
@@ -9,7 +9,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/no_destructor.h"
 #include "base/sequence_checker.h"
 #include "base/strings/string_util.h"
diff --git a/chromium/content/browser/tracing/cros_tracing_agent.cc b/chromium/content/browser/tracing/cros_tracing_agent.cc
index 1f3cd1d8262..598d6ce2cb1 100644
--- a/chromium/content/browser/tracing/cros_tracing_agent.cc
+++ b/chromium/content/browser/tracing/cros_tracing_agent.cc
@@ -9,7 +9,7 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/no_destructor.h"
 #include "base/sequence_checker.h"
diff --git a/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc b/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
index c1b1f063b45..2b5a5f007c0 100644
--- a/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
+++ b/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/tracing/memory_tracing_browsertest.cc b/chromium/content/browser/tracing/memory_tracing_browsertest.cc
index c39fb7ae77e..16488e2ea0d 100644
--- a/chromium/content/browser/tracing/memory_tracing_browsertest.cc
+++ b/chromium/content/browser/tracing/memory_tracing_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/browser/tracing/tracing_controller_impl.h"
 #include "content/public/browser/tracing_controller.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/tracing/startup_tracing_browsertest.cc b/chromium/content/browser/tracing/startup_tracing_browsertest.cc
index edaf396dac8..a4f2b52925e 100644
--- a/chromium/content/browser/tracing/startup_tracing_browsertest.cc
+++ b/chromium/content/browser/tracing/startup_tracing_browsertest.cc
@@ -13,6 +13,7 @@
 #include "components/tracing/common/tracing_switches.h"
 #include "content/browser/tracing/perfetto_file_tracer.h"
 #include "content/browser/tracing/tracing_controller_impl.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "services/tracing/perfetto/privacy_filtering_check.h"
diff --git a/chromium/content/browser/tracing/tracing_controller_browsertest.cc b/chromium/content/browser/tracing/tracing_controller_browsertest.cc
index f07ab963cd7..586e2227f02 100644
--- a/chromium/content/browser/tracing/tracing_controller_browsertest.cc
+++ b/chromium/content/browser/tracing/tracing_controller_browsertest.cc
@@ -23,6 +23,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/trace_uploader.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -201,7 +202,7 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      TracingController::CompletionCallback callback = base::BindRepeating(
+      TracingController::CompletionCallback callback = base::BindOnce(
           &TracingControllerTest::StopTracingStringDoneCallbackTest,
           base::Unretained(this), run_loop.QuitClosure());
       bool result = controller->StopTracing(
@@ -235,7 +236,7 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      TracingController::CompletionCallback callback = base::BindRepeating(
+      TracingController::CompletionCallback callback = base::BindOnce(
           &TracingControllerTest::StopTracingStringDoneCallbackTest,
           base::Unretained(this), run_loop.QuitClosure());
 
@@ -465,7 +466,7 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest,
       TraceConfig(),
       TracingController::StartTracingDoneCallback()));
   EXPECT_TRUE(controller->StopTracing(
-      TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
+      TracingControllerImpl::CreateCallbackEndpoint(base::BindOnce(
           [](base::OnceClosure quit_closure,
              std::unique_ptr<std::string> trace_str) {
             std::move(quit_closure).Run();
diff --git a/chromium/content/browser/tracing/tracing_controller_impl.cc b/chromium/content/browser/tracing/tracing_controller_impl.cc
index 42ffc449423..fa4de6a4eb1 100644
--- a/chromium/content/browser/tracing/tracing_controller_impl.cc
+++ b/chromium/content/browser/tracing/tracing_controller_impl.cc
@@ -467,7 +467,7 @@ void TracingControllerImpl::EndStartupTracing() {
   // and we want the trace file to be written soon.
   StopTracing(CreateFileEndpoint(
       startup_trace_file_,
-      base::BindRepeating(OnStoppedStartupTracing, startup_trace_file_),
+      base::BindOnce(OnStoppedStartupTracing, startup_trace_file_),
       base::TaskPriority::USER_VISIBLE));
 }
 
@@ -498,7 +498,7 @@ void TracingControllerImpl::FinalizeStartupTracingIfNeeded() {
   const base::TaskPriority kWritePriority = base::TaskPriority::USER_VISIBLE;
   bool success = StopTracing(CreateFileEndpoint(
       startup_trace_file.value(),
-      base::BindRepeating(
+      base::BindOnce(
           [](base::FilePath trace_file, base::OnceClosure quit_closure) {
             OnStoppedStartupTracing(trace_file);
             std::move(quit_closure).Run();
diff --git a/chromium/content/browser/tracing/tracing_service_controller.cc b/chromium/content/browser/tracing/tracing_service_controller.cc
index 8ce3ade4891..a7646b2f94f 100644
--- a/chromium/content/browser/tracing/tracing_service_controller.cc
+++ b/chromium/content/browser/tracing/tracing_service_controller.cc
@@ -88,7 +88,6 @@ tracing::mojom::TracingService& TracingServiceController::GetService() {
       ServiceProcessHost::Launch(
           std::move(receiver),
           ServiceProcessHost::Options()
-              .WithSandboxType(service_manager::SandboxType::kUtility)
               .WithDisplayName("Tracing Service")
               .Pass());
     }
diff --git a/chromium/content/browser/url_loader_factory_getter.cc b/chromium/content/browser/url_loader_factory_getter.cc
index d8323a2cc05..5fb17a860c2 100644
--- a/chromium/content/browser/url_loader_factory_getter.cc
+++ b/chromium/content/browser/url_loader_factory_getter.cc
@@ -293,6 +293,7 @@ void URLLoaderFactoryGetter::HandleNetworkFactoryRequestOnUIThread(
   // The browser process is considered trusted.
   params->is_trusted = true;
   params->process_id = network::mojom::kBrowserProcessId;
+  params->automatically_assign_isolation_info = true;
   params->is_corb_enabled = is_corb_enabled;
   params->disable_web_security =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
diff --git a/chromium/content/browser/url_loader_factory_params_helper.cc b/chromium/content/browser/url_loader_factory_params_helper.cc
index 9f51bf68eb0..13af71a80ec 100644
--- a/chromium/content/browser/url_loader_factory_params_helper.cc
+++ b/chromium/content/browser/url_loader_factory_params_helper.cc
@@ -9,6 +9,7 @@
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
@@ -16,6 +17,8 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/web_preferences.h"
+#include "ipc/ipc_message.h"
+#include "net/base/isolation_info.h"
 #include "services/network/public/mojom/cross_origin_embedder_policy.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 
@@ -41,12 +44,13 @@ network::mojom::URLLoaderFactoryParamsPtr CreateParams(
     const base::Optional<url::Origin>& top_frame_origin,
     bool is_trusted,
     const base::Optional<base::UnguessableToken>& top_frame_token,
-    const base::Optional<net::NetworkIsolationKey>& network_isolation_key,
+    const net::IsolationInfo& isolation_info,
     network::mojom::ClientSecurityStatePtr client_security_state,
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
         coep_reporter,
     bool allow_universal_access_from_file_urls,
-    bool is_for_isolated_world) {
+    bool is_for_isolated_world,
+    mojo::PendingRemote<network::mojom::CookieAccessObserver> cookie_observer) {
   DCHECK(process);
 
   // "chrome-guest://..." is never used as a main or isolated world origin.
@@ -63,7 +67,7 @@ network::mojom::URLLoaderFactoryParamsPtr CreateParams(
 
   params->is_trusted = is_trusted;
   params->top_frame_id = top_frame_token;
-  params->network_isolation_key = network_isolation_key;
+  params->isolation_info = isolation_info;
 
   params->disable_web_security =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -89,6 +93,7 @@ network::mojom::URLLoaderFactoryParamsPtr CreateParams(
       process->GetBrowserContext(), origin, is_for_isolated_world,
       params.get());
 
+  params->cookie_observer = std::move(cookie_observer);
   return params;
 }
 
@@ -110,12 +115,13 @@ URLLoaderFactoryParamsHelper::CreateForFrame(
       // top_frame_origin
       frame->ComputeTopFrameOrigin(frame_origin),
       false,  // is_trusted
-      frame->GetTopFrameToken(), frame->GetNetworkIsolationKey(),
+      frame->GetTopFrameToken(), frame->GetIsolationInfoForSubresources(),
       std::move(client_security_state), std::move(coep_reporter),
       frame->GetRenderViewHost()
           ->GetWebkitPreferences()
           .allow_universal_access_from_file_urls,
-      false);  // is_for_isolated_world
+      false,  // is_for_isolated_world
+      frame->CreateCookieAccessObserver());
 }
 
 // static
@@ -131,13 +137,14 @@ URLLoaderFactoryParamsHelper::CreateForIsolatedWorld(
                       base::nullopt,          // top_frame_origin
                       false,                  // is_trusted
                       frame->GetTopFrameToken(),
-                      frame->GetNetworkIsolationKey(),
+                      frame->GetIsolationInfoForSubresources(),
                       std::move(client_security_state),
                       mojo::NullRemote(),  // coep_reporter
                       frame->GetRenderViewHost()
                           ->GetWebkitPreferences()
                           .allow_universal_access_from_file_urls,
-                      true);  // is_for_isolated_world
+                      true,  // is_for_isolated_world
+                      frame->CreateCookieAccessObserver());
 }
 
 network::mojom::URLLoaderFactoryParamsPtr
@@ -155,13 +162,14 @@ URLLoaderFactoryParamsHelper::CreateForPrefetch(
                       frame->ComputeTopFrameOrigin(frame_origin),
                       true,  // is_trusted
                       frame->GetTopFrameToken(),
-                      base::nullopt,  // network_isolation_key
+                      net::IsolationInfo(),  // isolation_info
                       std::move(client_security_state),
                       mojo::NullRemote(),  // coep_reporter
                       frame->GetRenderViewHost()
                           ->GetWebkitPreferences()
                           .allow_universal_access_from_file_urls,
-                      false);  // is_for_isolated_world
+                      false,  // is_for_isolated_world
+                      frame->CreateCookieAccessObserver());
 }
 
 // static
@@ -169,20 +177,23 @@ network::mojom::URLLoaderFactoryParamsPtr
 URLLoaderFactoryParamsHelper::CreateForWorker(
     RenderProcessHost* process,
     const url::Origin& request_initiator,
-    const net::NetworkIsolationKey& network_isolation_key,
+    const net::IsolationInfo& isolation_info,
     mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
         coep_reporter) {
-  return CreateParams(process,
-                      request_initiator,  // origin
-                      request_initiator,  // request_initiator_site_lock
-                      base::nullopt,      // top_frame_origin
-                      false,              // is_trusted
-                      base::nullopt,      // top_frame_token
-                      network_isolation_key,
-                      nullptr,  // client_security_state
-                      std::move(coep_reporter),
-                      false,   // allow_universal_access_from_file_urls
-                      false);  // is_for_isolated_world
+  return CreateParams(
+      process,
+      request_initiator,  // origin
+      request_initiator,  // request_initiator_site_lock
+      base::nullopt,      // top_frame_origin
+      false,              // is_trusted
+      base::nullopt,      // top_frame_token
+      isolation_info,
+      nullptr,  // client_security_state
+      std::move(coep_reporter),
+      false,  // allow_universal_access_from_file_urls
+      false,  // is_for_isolated_world
+      static_cast<StoragePartitionImpl*>(process->GetStoragePartition())
+          ->CreateCookieAccessObserverForServiceWorker());
 }
 
 // static
@@ -199,13 +210,12 @@ URLLoaderFactoryParamsHelper::CreateForRendererProcess(
   }
 
   // Since this function is about to get deprecated (crbug.com/891872), it
-  // should be fine to not add support for network isolation thus sending empty
-  // key.
+  // should be fine to not add support for isolation info thus using an empty
+  // NetworkIsolationKey.
   //
   // We may not be able to allow powerful APIs such as memory measurement APIs
   // (see https://crbug.com/887967) without removing this call.
-  base::Optional<net::NetworkIsolationKey> network_isolation_key =
-      base::nullopt;
+  net::IsolationInfo isolation_info;
   base::Optional<base::UnguessableToken> top_frame_token = base::nullopt;
 
   return CreateParams(
@@ -214,11 +224,12 @@ URLLoaderFactoryParamsHelper::CreateForRendererProcess(
       request_initiator_site_lock,  // request_initiator_site_lock
       base::nullopt,                // top_frame_origin
       false,                        // is_trusted
-      top_frame_token, network_isolation_key,
+      top_frame_token, isolation_info,
       nullptr,             // client_security_state
       mojo::NullRemote(),  // coep_reporter
       false,               // allow_universal_access_from_file_urls
-      false);              // is_for_isolated_world
+      false,               // is_for_isolated_world
+      mojo::NullRemote());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/url_loader_factory_params_helper.h b/chromium/content/browser/url_loader_factory_params_helper.h
index 5b94c02ddab..a9cdaaf2ee9 100644
--- a/chromium/content/browser/url_loader_factory_params_helper.h
+++ b/chromium/content/browser/url_loader_factory_params_helper.h
@@ -6,13 +6,12 @@
 #define CONTENT_BROWSER_URL_LOADER_FACTORY_PARAMS_HELPER_H_
 
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "net/base/network_isolation_key.h"
 #include "services/network/public/mojom/cross_origin_embedder_policy.mojom-forward.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "url/origin.h"
 
 namespace net {
-class NetworkIsolationKey;
+class IsolationInfo;
 }  // namespace net
 
 namespace content {
@@ -66,7 +65,7 @@ class URLLoaderFactoryParamsHelper {
   static network::mojom::URLLoaderFactoryParamsPtr CreateForWorker(
       RenderProcessHost* process,
       const url::Origin& request_initiator,
-      const net::NetworkIsolationKey& network_isolation_key,
+      const net::IsolationInfo& isolation_info,
       mojo::PendingRemote<network::mojom::CrossOriginEmbedderPolicyReporter>
           coep_reporter);
 
diff --git a/chromium/content/browser/utility_process_host.cc b/chromium/content/browser/utility_process_host.cc
index e2d12812677..8ccfbf0a602 100644
--- a/chromium/content/browser/utility_process_host.cc
+++ b/chromium/content/browser/utility_process_host.cc
@@ -88,6 +88,7 @@ class UtilitySandboxedProcessLauncherDelegate
         sandbox_type_ == service_manager::SandboxType::kCdm ||
         sandbox_type_ == service_manager::SandboxType::kPrintCompositor ||
         sandbox_type_ == service_manager::SandboxType::kPpapi ||
+        sandbox_type_ == service_manager::SandboxType::kVideoCapture ||
 #if defined(OS_CHROMEOS)
         sandbox_type_ == service_manager::SandboxType::kIme ||
 #endif  // OS_CHROMEOS
@@ -95,7 +96,7 @@ class UtilitySandboxedProcessLauncherDelegate
 #if !defined(OS_MACOSX)
         sandbox_type_ == service_manager::SandboxType::kSharingService ||
 #endif
-        sandbox_type_ == service_manager::SandboxType::kSoda;
+        sandbox_type_ == service_manager::SandboxType::kSpeechRecognition;
     DCHECK(supported_sandbox_type);
 #endif  // DCHECK_IS_ON()
   }
@@ -210,7 +211,7 @@ class UtilitySandboxedProcessLauncherDelegate
         sandbox_type_ == service_manager::SandboxType::kIme ||
 #endif  // OS_CHROMEOS
         sandbox_type_ == service_manager::SandboxType::kAudio ||
-        sandbox_type_ == service_manager::SandboxType::kSoda) {
+        sandbox_type_ == service_manager::SandboxType::kSpeechRecognition) {
       return service_manager::GetUnsandboxedZygote();
     }
 
@@ -230,7 +231,7 @@ class UtilitySandboxedProcessLauncherDelegate
  private:
 #if defined(OS_POSIX)
   base::EnvironmentMap env_;
-#endif  // OS_WIN
+#endif  // OS_POSIX
   service_manager::SandboxType sandbox_type_;
   base::CommandLine cmd_line_;
 };
@@ -278,7 +279,6 @@ bool UtilityProcessHost::Send(IPC::Message* message) {
 
 void UtilityProcessHost::SetSandboxType(
     service_manager::SandboxType sandbox_type) {
-  DCHECK(sandbox_type != service_manager::SandboxType::kInvalid);
   sandbox_type_ = sandbox_type;
 }
 
@@ -395,6 +395,8 @@ bool UtilityProcessHost::StartProcess() {
 
     cmd_line->AppendSwitchASCII(switches::kProcessType,
                                 switches::kUtilityProcess);
+    // Specify the type of utility process for debugging/profiling purposes.
+    cmd_line->AppendSwitchASCII(switches::kUtilitySubType, metrics_name_);
     BrowserChildProcessHostImpl::CopyFeatureAndFieldTrialFlags(cmd_line.get());
     BrowserChildProcessHostImpl::CopyTraceStartupFlags(cmd_line.get());
     std::string locale = GetContentClient()->browser()->GetApplicationLocale();
@@ -409,6 +411,7 @@ bool UtilityProcessHost::StartProcess() {
 
     // Browser command-line switches to propagate to the utility process.
     static const char* const kSwitchNames[] = {
+      network::switches::kAdditionalTrustTokenKeyCommitments,
       network::switches::kForceEffectiveConnectionType,
       network::switches::kHostResolverRules,
       network::switches::kIgnoreCertificateErrorsSPKIList,
@@ -417,12 +420,16 @@ bool UtilityProcessHost::StartProcess() {
       network::switches::kNetLogCaptureMode,
       network::switches::kExplicitlyAllowedPorts,
       service_manager::switches::kNoSandbox,
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
+      switches::kDisableDevShmUsage,
+#endif
       service_manager::switches::kEnableAudioServiceSandbox,
 #if defined(OS_MACOSX)
       service_manager::switches::kEnableSandboxLogging,
       os_crypt::switches::kUseMockKeychain,
 #endif
       switches::kDisableTestCerts,
+      switches::kEnableExperimentalCookieFeatures,
       switches::kEnableLogging,
       switches::kForceTextDirection,
       switches::kForceUIDirection,
@@ -450,7 +457,6 @@ bool UtilityProcessHost::StartProcess() {
       switches::kAudioServiceQuitTimeoutMs,
       switches::kDisableAudioOutput,
       switches::kFailAudioStreamCreation,
-      switches::kForceDisableWebRtcApmInAudioService,
       switches::kMuteAudio,
       switches::kUseFileForFakeAudioCapture,
       switches::kAgcStartupMinVolume,
diff --git a/chromium/content/browser/utility_process_host_browsertest.cc b/chromium/content/browser/utility_process_host_browsertest.cc
index 283f4bf3186..caef381d9ac 100644
--- a/chromium/content/browser/utility_process_host_browsertest.cc
+++ b/chromium/content/browser/utility_process_host_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/child_process_termination_info.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_service.mojom.h"
diff --git a/chromium/content/browser/utility_process_sandbox_browsertest.cc b/chromium/content/browser/utility_process_sandbox_browsertest.cc
index 1f025e6aee2..100c3008df1 100644
--- a/chromium/content/browser/utility_process_sandbox_browsertest.cc
+++ b/chromium/content/browser/utility_process_sandbox_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/browser/utility_process_host.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_service.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -38,6 +39,10 @@ std::vector<SandboxType> GetSandboxTypesToTest() {
     // These sandbox types can't be spawned in a utility process.
     if (t == SandboxType::kRenderer || t == SandboxType::kGpu)
       continue;
+#if defined(OS_LINUX)
+    if (t == SandboxType::kZygoteIntermediateSandbox)
+      continue;
+#endif
 
     types.push_back(t);
   }
@@ -91,10 +96,13 @@ class UtilityProcessSandboxBrowserTest
   void OnGotSandboxStatusOnIOThread(int32_t sandbox_status) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-    // Aside from kNoSandox, every utility process launched explicitly with a
+    // Aside from kNoSandbox, every utility process launched explicitly with a
     // sandbox type should always end up with a sandbox.
+    // kVideoCapture is equivalent to kNoSandbox on all platforms except
+    // Fuchsia.
     switch (GetParam()) {
       case SandboxType::kNoSandbox:
+      case SandboxType::kVideoCapture:
         EXPECT_EQ(sandbox_status, 0);
         break;
 
@@ -116,7 +124,7 @@ class UtilityProcessSandboxBrowserTest
       case SandboxType::kIme:
 #endif
       case SandboxType::kNetwork:
-      case SandboxType::kSoda: {
+      case SandboxType::kSpeechRecognition: {
         constexpr int kExpectedPartialSandboxFlags =
             SandboxLinux::kSeccompBPF | SandboxLinux::kYama |
             SandboxLinux::kSeccompTSYNC;
@@ -125,8 +133,8 @@ class UtilityProcessSandboxBrowserTest
       }
 
       case SandboxType::kGpu:
-      case SandboxType::kInvalid:
       case SandboxType::kRenderer:
+      case SandboxType::kZygoteIntermediateSandbox:
         NOTREACHED();
         break;
     }
diff --git a/chromium/content/browser/vibration_browsertest.cc b/chromium/content/browser/vibration_browsertest.cc
index 698c21539aa..93d23d2e1f8 100644
--- a/chromium/content/browser/vibration_browsertest.cc
+++ b/chromium/content/browser/vibration_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/browser/browser_interface_binders.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/video_capture_service.cc b/chromium/content/browser/video_capture_service.cc
index b12afbbc852..75652f93a8f 100644
--- a/chromium/content/browser/video_capture_service.cc
+++ b/chromium/content/browser/video_capture_service.cc
@@ -112,7 +112,7 @@ video_capture::mojom::VideoCaptureService& GetVideoCaptureService() {
           std::move(receiver),
           ServiceProcessHost::Options()
               .WithDisplayName("Video Capture")
-              .WithSandboxType(service_manager::SandboxType::kNoSandbox)
+              .WithSandboxType(service_manager::SandboxType::kVideoCapture)
 #if defined(OS_MACOSX)
               // On Mac, the service requires a CFRunLoop which is provided by a
               // UI message loop. See https://crbug.com/834581.
diff --git a/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc b/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
index 80b5e49e676..2427831be86 100644
--- a/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
+++ b/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
@@ -7,6 +7,7 @@
 #include "base/strings/stringprintf.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/web_contents/web_contents_android.cc b/chromium/content/browser/web_contents/web_contents_android.cc
index cd92dc818cc..fdcf78a8b29 100644
--- a/chromium/content/browser/web_contents/web_contents_android.cc
+++ b/chromium/content/browser/web_contents/web_contents_android.cc
@@ -24,7 +24,6 @@
 #include "content/browser/accessibility/browser_accessibility_android.h"
 #include "content/browser/accessibility/browser_accessibility_manager_android.h"
 #include "content/browser/android/java/gin_java_bridge_dispatcher_host.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/media/media_web_contents_observer.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -385,13 +384,6 @@ RenderWidgetHostViewAndroid*
     WebContentsAndroid::GetRenderWidgetHostViewAndroid() {
   RenderWidgetHostView* rwhv = NULL;
   rwhv = web_contents_->GetRenderWidgetHostView();
-  if (web_contents_->ShowingInterstitialPage()) {
-    rwhv = web_contents_->GetInterstitialPage()
-               ->GetMainFrame()
-               ->GetRenderViewHost()
-               ->GetWidget()
-               ->GetView();
-  }
   return static_cast<RenderWidgetHostViewAndroid*>(rwhv);
 }
 
@@ -514,6 +506,17 @@ void WebContentsAndroid::AdjustSelectionByCharacterOffset(
                                                   show_selection_menu);
 }
 
+bool WebContentsAndroid::InitializeRenderFrameForJavaScript() {
+  if (!web_contents_->GetFrameTree()
+           ->root()
+           ->render_manager()
+           ->InitializeRenderFrameForImmediateUse()) {
+    LOG(ERROR) << "Failed to initialize RenderFrame to evaluate javascript";
+    return false;
+  }
+  return true;
+}
+
 void WebContentsAndroid::EvaluateJavaScript(
     JNIEnv* env,
     const JavaParamRef<jobject>& obj,
@@ -522,13 +525,8 @@ void WebContentsAndroid::EvaluateJavaScript(
   RenderViewHost* rvh = web_contents_->GetRenderViewHost();
   DCHECK(rvh);
 
-  if (!rvh->IsRenderViewLive()) {
-    if (!static_cast<WebContentsImpl*>(web_contents_)->
-        CreateRenderViewForInitialEmptyDocument()) {
-      LOG(ERROR) << "Failed to create RenderView in EvaluateJavaScript";
-      return;
-    }
-  }
+  if (!InitializeRenderFrameForJavaScript())
+    return;
 
   if (!callback) {
     // No callback requested.
@@ -555,13 +553,8 @@ void WebContentsAndroid::EvaluateJavaScriptForTests(
   RenderViewHost* rvh = web_contents_->GetRenderViewHost();
   DCHECK(rvh);
 
-  if (!rvh->IsRenderViewLive()) {
-    if (!static_cast<WebContentsImpl*>(web_contents_)->
-        CreateRenderViewForInitialEmptyDocument()) {
-      LOG(ERROR) << "Failed to create RenderView in EvaluateJavaScriptForTests";
-      return;
-    }
-  }
+  if (!InitializeRenderFrameForJavaScript())
+    return;
 
   if (!callback) {
     // No callback requested.
diff --git a/chromium/content/browser/web_contents/web_contents_android.h b/chromium/content/browser/web_contents/web_contents_android.h
index fe03e8707c8..b846fb0758a 100644
--- a/chromium/content/browser/web_contents/web_contents_android.h
+++ b/chromium/content/browser/web_contents/web_contents_android.h
@@ -35,6 +35,10 @@ class CONTENT_EXPORT WebContentsAndroid {
 
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject();
 
+  // Ensure that the render frame host etc are ready to handle JS eval
+  // (e.g. recover from a crashed state).
+  bool InitializeRenderFrameForJavaScript();
+
   // Methods called from Java
   void ClearNativeReference(JNIEnv* env,
                             const base::android::JavaParamRef<jobject>& obj);
diff --git a/chromium/content/browser/web_contents/web_contents_impl.cc b/chromium/content/browser/web_contents/web_contents_impl.cc
index 0fe5a498d69..7908a60e174 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl.cc
@@ -59,10 +59,9 @@
 #include "content/browser/find_request_manager.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/navigator_impl.h"
+#include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/gpu/gpu_data_manager_impl.h"
@@ -72,7 +71,7 @@
 #include "content/browser/media/capture/web_contents_audio_muter.h"
 #include "content/browser/media/media_web_contents_observer.h"
 #include "content/browser/media/session/media_session_impl.h"
-#include "content/browser/plugin_content_origin_whitelist.h"
+#include "content/browser/plugin_content_origin_allowlist.h"
 #include "content/browser/renderer_host/frame_token_message_queue.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
@@ -82,6 +81,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/renderer_host/text_input_manager.h"
+#include "content/browser/screen_enumeration/screen_change_monitor.h"
 #include "content/browser/screen_orientation/screen_orientation_provider.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/javascript_dialog_navigation_deferrer.h"
@@ -149,9 +149,10 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/common/security/security_style.h"
@@ -248,10 +249,10 @@ RenderFrameHostImpl* FindOpenerRFH(const WebContents::CreateParams& params) {
 bool IsUserInteractionInputType(blink::WebInputEvent::Type type) {
   // Ideally, this list would be based more off of
   // https://whatwg.org/C/interaction.html#triggered-by-user-activation.
-  return type == blink::WebInputEvent::kMouseDown ||
-         type == blink::WebInputEvent::kGestureScrollBegin ||
-         type == blink::WebInputEvent::kTouchStart ||
-         type == blink::WebInputEvent::kRawKeyDown;
+  return type == blink::WebInputEvent::Type::kMouseDown ||
+         type == blink::WebInputEvent::Type::kGestureScrollBegin ||
+         type == blink::WebInputEvent::Type::kTouchStart ||
+         type == blink::WebInputEvent::Type::kRawKeyDown;
 }
 
 // Ensures that OnDialogClosed is only called once.
@@ -308,6 +309,14 @@ void RecordMaxFrameCountUMA(size_t max_frame_count) {
 
 }  // namespace
 
+CreatedWindow::CreatedWindow() = default;
+CreatedWindow::CreatedWindow(std::unique_ptr<WebContentsImpl> contents,
+                             GURL target_url)
+    : contents(std::move(contents)), target_url(std::move(target_url)) {}
+CreatedWindow::~CreatedWindow() = default;
+CreatedWindow::CreatedWindow(CreatedWindow&&) = default;
+CreatedWindow& CreatedWindow::operator=(CreatedWindow&&) = default;
+
 std::unique_ptr<WebContents> WebContents::Create(
     const WebContents::CreateParams& params) {
   return WebContentsImpl::Create(params);
@@ -559,11 +568,7 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
       render_view_host_delegate_view_(nullptr),
       created_with_opener_(false),
       node_(this),
-      frame_tree_(new NavigatorImpl(&controller_, this),
-                  this,
-                  this,
-                  this,
-                  this),
+      frame_tree_(new Navigator(&controller_, this), this, this, this, this),
       is_load_to_different_document_(false),
       crashed_status_(base::TERMINATION_STATUS_STILL_RUNNING),
       crashed_error_code_(0),
@@ -572,7 +577,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
       upload_size_(0),
       upload_position_(0),
       is_resume_pending_(false),
-      interstitial_page_(nullptr),
       has_accessed_initial_document_(false),
       visible_capturer_count_(0),
       hidden_capturer_count_(0),
@@ -621,9 +625,15 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
   using_dark_colors_ = native_theme->ShouldUseDarkColors();
   preferred_color_scheme_ = native_theme->GetPreferredColorScheme();
 
+  screen_change_monitor_ =
+      std::make_unique<ScreenChangeMonitor>(base::BindRepeating(
+          &WebContentsImpl::OnScreensChange, base::Unretained(this)));
+
   // ConversionHost takes a weak ref on |this|, so it must be created outside of
   // the initializer list.
-  conversion_host_ = std::make_unique<ConversionHost>(this);
+  if (base::FeatureList::IsEnabled(features::kConversionMeasurement)) {
+    conversion_host_ = std::make_unique<ConversionHost>(this);
+  }
 }
 
 WebContentsImpl::~WebContentsImpl() {
@@ -766,17 +776,17 @@ std::unique_ptr<WebContentsImpl> WebContentsImpl::CreateWithOpener(
   // See https://html.spec.whatwg.org/#attr-iframe-sandbox.
   FrameTreeNode* new_root = new_contents->GetFrameTree()->root();
   if (opener) {
-    blink::mojom::WebSandboxFlags opener_flags =
+    network::mojom::WebSandboxFlags opener_flags =
         opener_rfh->active_sandbox_flags();
-    const blink::mojom::WebSandboxFlags inherit_flag =
-        blink::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
+    const network::mojom::WebSandboxFlags inherit_flag =
+        network::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
     bool sandbox_propagates_to_auxilary_context =
         (opener_flags & inherit_flag) == inherit_flag;
     if (sandbox_propagates_to_auxilary_context)
       new_root->SetPendingFramePolicy({opener_flags,
                                        {} /* container_policy */,
                                        {} /* required_document_policy */});
-    if (opener_flags == blink::mojom::WebSandboxFlags::kNone ||
+    if (opener_flags == network::mojom::WebSandboxFlags::kNone ||
         sandbox_propagates_to_auxilary_context) {
       // TODO(ekaramad, iclelland): Do not propagate feature policies from non-
       // sandboxed disowned openers (rel=noopener).
@@ -884,19 +894,17 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHostImpl* render_view_host,
       return true;
   }
 
+#if BUILDFLAG(ENABLE_PLUGINS)
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(WebContentsImpl, message, render_view_host)
-    IPC_MESSAGE_HANDLER(
-        ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame,
-        OnTextAutosizerPageInfoChanged)
-#if BUILDFLAG(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER(ViewHostMsg_RequestPpapiBrokerPermission,
                         OnRequestPpapiBrokerPermission)
-#endif
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
-
   return handled;
+#else
+  return false;
+#endif
 }
 
 bool WebContentsImpl::OnMessageReceived(RenderFrameHostImpl* render_frame_host,
@@ -914,10 +922,6 @@ bool WebContentsImpl::OnMessageReceived(RenderFrameHostImpl* render_frame_host,
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(WebContentsImpl, message, render_frame_host)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DomOperationResponse,
-                        OnDomOperationResponse)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DidLoadResourceFromMemoryCache,
-                        OnDidLoadResourceFromMemoryCache)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidRunInsecureContent,
                         OnDidRunInsecureContent)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidDisplayContentWithCertificateErrors,
@@ -1090,6 +1094,13 @@ WebContentsView* WebContentsImpl::GetView() const {
   return view_.get();
 }
 
+void WebContentsImpl::OnScreensChange() {
+  for (FrameTreeNode* node : frame_tree_.Nodes()) {
+    RenderFrameHostImpl* rfh = node->current_frame_host();
+    rfh->GetAssociatedLocalFrame()->OnScreensChange();
+  }
+}
+
 void WebContentsImpl::OnScreenOrientationChange() {
   DCHECK(screen_orientation_provider_);
   DidChangeScreenOrientation();
@@ -1301,20 +1312,45 @@ void WebContentsImpl::SetUserAgentOverride(
 
   // Reload the page if a load is currently in progress to avoid having
   // different parts of the page loaded using different user agents.
+  // No need to reload if the current entry matches that of the
+  // NavigationRequest supplied to DidStartNavigation() as NavigationRequest
+  // handles it.
   NavigationEntry* entry = controller_.GetVisibleEntry();
-  if (IsLoading() && entry != nullptr && entry->GetIsOverridingUserAgent())
+  if (IsLoading() && entry != nullptr && entry->GetIsOverridingUserAgent() &&
+      (!frame_tree_.root()->navigation_request() ||
+       frame_tree_.root()->navigation_request()->ua_change_requires_reload())) {
     controller_.Reload(ReloadType::BYPASSING_CACHE, true);
+  }
 
   for (auto& observer : observers_)
     observer.UserAgentOverrideSet(ua_override);
 }
 
+void WebContentsImpl::SetRendererInitiatedUserAgentOverrideOption(
+    NavigationController::UserAgentOverrideOption option) {
+  renderer_initiated_user_agent_override_option_ = option;
+}
+
 const blink::UserAgentOverride& WebContentsImpl::GetUserAgentOverride() {
   return renderer_preferences_.user_agent_override;
 }
 
-bool WebContentsImpl::ShouldOverrideUserAgentInNewTabs() {
-  return should_override_user_agent_in_new_tabs_;
+bool WebContentsImpl::ShouldOverrideUserAgentForRendererInitiatedNavigation() {
+  NavigationEntryImpl* current_entry = controller_.GetLastCommittedEntry();
+  if (!current_entry)
+    return should_override_user_agent_in_new_tabs_;
+
+  switch (renderer_initiated_user_agent_override_option_) {
+    case NavigationController::UA_OVERRIDE_INHERIT:
+      return current_entry->GetIsOverridingUserAgent();
+    case NavigationController::UA_OVERRIDE_TRUE:
+      return true;
+    case NavigationController::UA_OVERRIDE_FALSE:
+      return false;
+    default:
+      break;
+  }
+  return false;
 }
 
 void WebContentsImpl::EnableWebContentsOnlyAccessibilityMode() {
@@ -1410,8 +1446,7 @@ SiteInstanceImpl* WebContentsImpl::GetSiteInstance() {
 }
 
 bool WebContentsImpl::IsLoading() {
-  return frame_tree_.IsLoading() &&
-         !(ShowingInterstitialPage() && interstitial_page_->pause_throbber());
+  return frame_tree_.IsLoading();
 }
 
 double WebContentsImpl::GetLoadProgress() {
@@ -1713,11 +1748,6 @@ void WebContentsImpl::SetIgnoreInputEvents(bool ignore_input_events) {
 void WebContentsImpl::SetMainFrameImportance(
     ChildProcessImportance importance) {
   GetMainFrame()->GetRenderWidgetHost()->SetImportance(importance);
-  if (ShowingInterstitialPage()) {
-    static_cast<RenderFrameHostImpl*>(interstitial_page_->GetMainFrame())
-        ->GetRenderWidgetHost()
-        ->SetImportance(importance);
-  }
 }
 #endif
 
@@ -1929,6 +1959,14 @@ void WebContentsImpl::ReattachToOuterWebContentsFrame() {
   GetMainFrame()->UpdateAXTreeData();
 }
 
+void WebContentsImpl::DidActivatePortal(WebContents* predecessor_contents) {
+  DCHECK(predecessor_contents);
+  NotifyInsidePortal(false);
+  GetDelegate()->WebContentsBecamePortal(predecessor_contents);
+  for (auto& observer : observers_)
+    observer.DidActivatePortal(predecessor_contents);
+}
+
 void WebContentsImpl::NotifyInsidePortal(bool inside_portal) {
   SendPageMessage(new PageMsg_SetInsidePortal(MSG_ROUTING_NONE, inside_portal));
 }
@@ -1959,22 +1997,17 @@ void WebContentsImpl::SyncRendererPrefs() {
       new PageMsg_SetRendererPrefs(MSG_ROUTING_NONE, renderer_preferences));
 }
 
-void WebContentsImpl::OnCookiesRead(const GURL& url,
-                                    const GURL& first_party_url,
-                                    const net::CookieList& cookie_list,
-                                    bool blocked_by_policy) {
+void WebContentsImpl::OnCookiesAccessed(NavigationHandle* navigation,
+                                        const CookieAccessDetails& details) {
   for (auto& observer : observers_) {
-    observer.OnCookiesRead(url, first_party_url, cookie_list,
-                           blocked_by_policy);
+    observer.OnCookiesAccessed(navigation, details);
   }
 }
 
-void WebContentsImpl::OnCookieChange(const GURL& url,
-                                     const GURL& first_party_url,
-                                     const net::CanonicalCookie& cookie,
-                                     bool blocked_by_policy) {
+void WebContentsImpl::OnCookiesAccessed(RenderFrameHostImpl* rfh,
+                                        const CookieAccessDetails& details) {
   for (auto& observer : observers_) {
-    observer.OnCookieChange(url, first_party_url, cookie, blocked_by_policy);
+    observer.OnCookiesAccessed(rfh, details);
   }
 }
 
@@ -2085,8 +2118,8 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
   view_->CreateView(params.context);
 
 #if BUILDFLAG(ENABLE_PLUGINS)
-  plugin_content_origin_whitelist_.reset(
-      new PluginContentOriginWhitelist(this));
+  plugin_content_origin_allowlist_.reset(
+      new PluginContentOriginAllowlist(this));
 #endif
 
   registrar_.Add(this,
@@ -2095,8 +2128,6 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
 
   screen_orientation_provider_.reset(new ScreenOrientationProvider(this));
 
-  manifest_manager_host_.reset(new ManifestManagerHost(this));
-
 #if defined(OS_ANDROID)
   DateTimeChooserAndroid::CreateForWebContents(this);
 #endif
@@ -2113,7 +2144,8 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
   // corresponding RenderView and main RenderFrame have already been created.
   // Ensure observers are notified about this.
   if (params.renderer_initiated_creation) {
-    GetRenderViewHost()->GetWidget()->set_renderer_initialized(true);
+    GetRenderViewHost()->GetWidget()->SetRendererInitialized(
+        true, RenderWidgetHostImpl::RendererInitializer::kWebContentsInit);
     GetRenderViewHost()->DispatchRenderViewCreated();
     GetRenderManager()->current_frame_host()->SetRenderFrameCreated(true);
   }
@@ -2148,12 +2180,12 @@ void WebContentsImpl::OnWebContentsDestroyed(WebContentsImpl* web_contents) {
   // Clear a pending contents that has been closed before being shown.
   for (auto iter = pending_contents_.begin(); iter != pending_contents_.end();
        ++iter) {
-    if (iter->second.get() != web_contents)
+    if (iter->second.contents.get() != web_contents)
       continue;
 
     // Someone else has deleted the WebContents. That should never happen!
     // TODO(erikchen): Fix semantics here. https://crbug.com/832879.
-    iter->second.release();
+    iter->second.contents.release();
     pending_contents_.erase(iter);
     return;
   }
@@ -2228,10 +2260,6 @@ void WebContentsImpl::LostCapture(RenderWidgetHostImpl* render_widget_host) {
     delegate_->LostCapture();
 }
 
-ukm::SourceId WebContentsImpl::GetUkmSourceIdForLastCommittedSource() const {
-  return last_committed_source_id_;
-}
-
 ukm::SourceId
 WebContentsImpl::GetUkmSourceIdForLastCommittedSourceIncludingSameDocument()
     const {
@@ -2422,16 +2450,6 @@ RenderWidgetHostImpl* WebContentsImpl::GetFocusedRenderWidgetHost(
   if (receiving_widget != GetMainFrame()->GetRenderWidgetHost())
     return receiving_widget;
 
-  WebContentsImpl* focused_contents = GetFocusedWebContents();
-
-  // If the focused WebContents is showing an interstitial, return the
-  // interstitial's widget.
-  if (focused_contents->ShowingInterstitialPage()) {
-    return static_cast<RenderFrameHostImpl*>(
-               focused_contents->interstitial_page_->GetMainFrame())
-        ->GetRenderWidgetHost();
-  }
-
   // If the focused WebContents is a guest WebContents, then get the focused
   // frame in the embedder WebContents instead.
   FrameTreeNode* focused_frame =
@@ -2454,12 +2472,6 @@ RenderWidgetHostImpl* WebContentsImpl::GetFocusedRenderWidgetHost(
 RenderWidgetHostImpl* WebContentsImpl::GetRenderWidgetHostWithPageFocus() {
   WebContentsImpl* focused_web_contents = GetFocusedWebContents();
 
-  if (focused_web_contents->ShowingInterstitialPage()) {
-    return static_cast<RenderFrameHostImpl*>(
-               focused_web_contents->interstitial_page_->GetMainFrame())
-        ->GetRenderWidgetHost();
-  }
-
   return focused_web_contents->GetMainFrame()->GetRenderWidgetHost();
 }
 
@@ -2619,8 +2631,12 @@ void WebContentsImpl::UpdateVisibilityAndNotifyPageAndView(
     // as soon as they are shown. But the Page and other classes do not expect
     // to be producing frames when the Page is hidden. So we make sure the Page
     // is shown first.
-    SendPageMessage(
-        new PageMsg_VisibilityChanged(MSG_ROUTING_NONE, page_visibility));
+    // TODO(yuzus): We should include RenderViewHosts in BackForwardCache in
+    // this iteration. Add a special method to get all RenderViewHosts in
+    // BackForwardCache in WebContentsImpl.
+    for (auto& entry : frame_tree_.render_view_hosts()) {
+      entry.second->SetVisibility(page_visibility);
+    }
   }
 
   // |GetRenderWidgetHostView()| can be null if the user middle clicks a link to
@@ -2652,8 +2668,10 @@ void WebContentsImpl::UpdateVisibilityAndNotifyPageAndView(
   if (page_visibility == PageVisibilityState::kHidden) {
     // Similar to when showing the page, we only hide the page after
     // hiding the individual RenderWidgets.
-    SendPageMessage(new PageMsg_VisibilityChanged(
-        MSG_ROUTING_NONE, PageVisibilityState::kHidden));
+    for (auto& entry : frame_tree_.render_view_hosts()) {
+      entry.second->SetVisibility(page_visibility);
+    }
+
   } else {
     for (FrameTreeNode* node : frame_tree_.Nodes()) {
       RenderFrameProxyHost* parent = node->render_manager()->GetProxyToParent();
@@ -2687,11 +2705,7 @@ bool WebContentsImpl::IsFullscreen() {
   return IsFullscreenForCurrentTab();
 }
 
-blink::mojom::DisplayMode WebContentsImpl::GetDisplayMode(
-    RenderWidgetHostImpl* render_widget_host) const {
-  if (!RenderViewHostImpl::From(render_widget_host))
-    return blink::mojom::DisplayMode::kBrowser;
-
+blink::mojom::DisplayMode WebContentsImpl::GetDisplayMode() const {
   return delegate_ ? delegate_->GetDisplayMode(this)
                    : blink::mojom::DisplayMode::kBrowser;
 }
@@ -2943,7 +2957,8 @@ RenderFrameHostDelegate* WebContentsImpl::CreateNewWindow(
                                         ->GetRenderWidgetHost()
                                         ->GetRoutingID();
     GlobalRoutingID id(render_process_id, main_frame_routing_id);
-    pending_contents_[id] = std::move(new_contents);
+    pending_contents_[id] =
+        CreatedWindow(std::move(new_contents), params.target_url);
     AddDestructionObserver(new_contents_impl);
   }
 
@@ -2979,8 +2994,8 @@ RenderFrameHostDelegate* WebContentsImpl::CreateNewWindow(
 
       gfx::Rect initial_rect;  // Report an empty initial rect.
       delegate_->AddNewContents(this, std::move(new_contents),
-                                params.disposition, initial_rect,
-                                has_user_gesture, &was_blocked);
+                                params.target_url, params.disposition,
+                                initial_rect, has_user_gesture, &was_blocked);
       // The delegate may delete |new_contents_impl| during AddNewContents().
       if (!weak_new_contents)
         return nullptr;
@@ -3083,14 +3098,16 @@ void WebContentsImpl::ShowCreatedWindow(int process_id,
   // TODO(danakj): Why do we defer this show step until the renderer asks for it
   // when it will always do so. What needs to happen in the renderer before we
   // reach here?
-  std::unique_ptr<WebContentsImpl> owned_created =
+  base::Optional<CreatedWindow> owned_created =
       GetCreatedWindow(process_id, main_frame_widget_route_id);
-  WebContentsImpl* created = owned_created.get();
+
   // The browser may have rejected the request to make a new window, or the
   // renderer could be sending an invalid route id. Ignore the request then.
-  if (!created)
+  if (!owned_created || !owned_created->contents)
     return;
 
+  WebContentsImpl* created = owned_created->contents.get();
+
   // This uses the delegate for the WebContents where the window was created
   // from, to control how to show the newly created window.
   WebContentsDelegate* delegate = GetDelegate();
@@ -3105,7 +3122,8 @@ void WebContentsImpl::ShowCreatedWindow(int process_id,
 
     base::WeakPtr<WebContentsImpl> weak_created =
         created->weak_factory_.GetWeakPtr();
-    delegate->AddNewContents(this, std::move(owned_created), disposition,
+    delegate->AddNewContents(this, std::move(owned_created->contents),
+                             std::move(owned_created->target_url), disposition,
                              initial_rect, user_gesture, nullptr);
     // The delegate may delete |created| during AddNewContents().
     if (!weak_created)
@@ -3194,7 +3212,7 @@ void WebContentsImpl::ShowCreatedWidget(int process_id,
   render_widget_host_impl->set_allow_privileged_mouse_lock(is_fullscreen);
 }
 
-std::unique_ptr<WebContentsImpl> WebContentsImpl::GetCreatedWindow(
+base::Optional<CreatedWindow> WebContentsImpl::GetCreatedWindow(
     int process_id,
     int main_frame_widget_route_id) {
   auto key = GlobalRoutingID(process_id, main_frame_widget_route_id);
@@ -3203,22 +3221,23 @@ std::unique_ptr<WebContentsImpl> WebContentsImpl::GetCreatedWindow(
   // Certain systems can block the creation of new windows. If we didn't succeed
   // in creating one, just return NULL.
   if (iter == pending_contents_.end())
-    return nullptr;
+    return base::nullopt;
 
-  std::unique_ptr<WebContentsImpl> new_contents = std::move(iter->second);
+  CreatedWindow result = std::move(iter->second);
+  WebContentsImpl* new_contents = result.contents.get();
   pending_contents_.erase(key);
-  RemoveDestructionObserver(new_contents.get());
+  RemoveDestructionObserver(new_contents);
 
   // Don't initialize the guest WebContents immediately.
-  if (BrowserPluginGuest::IsGuest(new_contents.get()))
-    return new_contents;
+  if (BrowserPluginGuest::IsGuest(new_contents))
+    return result;
 
   if (!new_contents->GetMainFrame()->GetProcess()->IsInitializedAndNotDead() ||
       !new_contents->GetMainFrame()->GetView()) {
-    return nullptr;
+    return base::nullopt;
   }
 
-  return new_contents;
+  return result;
 }
 
 RenderWidgetHostView* WebContentsImpl::GetCreatedWidget(int process_id,
@@ -3411,15 +3430,6 @@ void WebContentsImpl::SendScreenRects() {
     if (node->current_frame_host()->is_local_root())
       node->current_frame_host()->GetRenderWidgetHost()->SendScreenRects();
   }
-
-  // Interstitials have their own |frame_tree_|.
-  if (interstitial_page_) {
-    FrameTree* interstitial_frame_tree = interstitial_page_->GetFrameTree();
-    for (FrameTreeNode* node : interstitial_frame_tree->Nodes()) {
-      if (node->current_frame_host()->is_local_root())
-        node->current_frame_host()->GetRenderWidgetHost()->SendScreenRects();
-    }
-  }
 }
 
 TextInputManager* WebContentsImpl::GetTextInputManager() {
@@ -3447,17 +3457,13 @@ bool WebContentsImpl::IsWidgetForMainFrame(
 
 BrowserAccessibilityManager*
     WebContentsImpl::GetRootBrowserAccessibilityManager() {
-  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(
-      ShowingInterstitialPage() ? GetInterstitialPage()->GetMainFrame()
-                                : GetMainFrame());
+  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(GetMainFrame());
   return rfh ? rfh->browser_accessibility_manager() : nullptr;
 }
 
 BrowserAccessibilityManager*
     WebContentsImpl::GetOrCreateRootBrowserAccessibilityManager() {
-  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(
-      ShowingInterstitialPage() ? GetInterstitialPage()->GetMainFrame()
-                                : GetMainFrame());
+  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(GetMainFrame());
   return rfh ? rfh->GetOrCreateBrowserAccessibilityManager() : nullptr;
 }
 
@@ -3568,126 +3574,6 @@ WebContents* WebContentsImpl::OpenURL(const OpenURLParams& params) {
   return new_contents;
 }
 
-void WebContentsImpl::RenderFrameForInterstitialPageCreated(
-    RenderFrameHost* render_frame_host) {
-  for (auto& observer : observers_)
-    observer.RenderFrameForInterstitialPageCreated(render_frame_host);
-}
-
-void WebContentsImpl::AttachInterstitialPage(
-    InterstitialPageImpl* interstitial_page) {
-  DCHECK(!interstitial_page_ && interstitial_page);
-  interstitial_page_ = interstitial_page;
-
-  // Cancel any visible dialogs so that they don't interfere with the
-  // interstitial.
-  CancelActiveAndPendingDialogs();
-
-  for (auto& observer : observers_)
-    observer.DidAttachInterstitialPage();
-
-  // Stop the throbber if needed while the interstitial page is shown.
-  if (frame_tree_.IsLoading())
-    LoadingStateChanged(true, true, nullptr);
-
-  // Connect to outer WebContents if necessary.
-  if (node_.OuterContentsFrameTreeNode()) {
-    if (GetRenderManager()->GetProxyToOuterDelegate()) {
-      DCHECK(
-          static_cast<RenderWidgetHostViewBase*>(interstitial_page->GetView())
-              ->IsRenderWidgetHostViewChildFrame());
-      RenderWidgetHostViewChildFrame* view =
-          static_cast<RenderWidgetHostViewChildFrame*>(
-              interstitial_page->GetView());
-      GetRenderManager()->SetRWHViewForInnerContents(view);
-    }
-  }
-
-#if defined(OS_ANDROID)
-  // Update importance of the interstitial.
-  static_cast<RenderFrameHostImpl*>(interstitial_page_->GetMainFrame())
-      ->GetRenderWidgetHost()
-      ->SetImportance(GetMainFrame()->GetRenderWidgetHost()->importance());
-#endif
-
-  if (accessibility_mode_.has_mode(ui::AXMode::kNativeAPIs)) {
-    // Make sure that the main page's accessibility tree is hidden and the
-    // interstitial gets focus.
-    RenderFrameHostImpl* rfh =
-        static_cast<RenderFrameHostImpl*>(GetMainFrame());
-    if (rfh) {
-      BrowserAccessibilityManager* accessibility_manager =
-          rfh->browser_accessibility_manager();
-      if (accessibility_manager)
-        accessibility_manager->set_hidden_by_interstitial_page(true);
-    }
-    rfh = static_cast<RenderFrameHostImpl*>(
-        GetInterstitialPage()->GetMainFrame());
-    if (rfh) {
-      BrowserAccessibilityManager* accessibility_manager =
-          rfh->GetOrCreateBrowserAccessibilityManager();
-      if (accessibility_manager)
-        accessibility_manager->OnWindowFocused();
-    }
-  }
-}
-
-void WebContentsImpl::DidProceedOnInterstitial() {
-  // The interstitial page should no longer be pausing the throbber.
-  DCHECK(!(ShowingInterstitialPage() && interstitial_page_->pause_throbber()));
-
-  // Restart the throbber now that the interstitial page no longer pauses it.
-  if (ShowingInterstitialPage() && frame_tree_.IsLoading())
-    LoadingStateChanged(true, true, nullptr);
-}
-
-void WebContentsImpl::DetachInterstitialPage(bool has_focus) {
-  bool interstitial_pausing_throbber =
-      ShowingInterstitialPage() && interstitial_page_->pause_throbber();
-  if (ShowingInterstitialPage())
-    interstitial_page_ = nullptr;
-
-  // Make sure that the main page's accessibility tree is no longer
-  // suppressed.
-  RenderFrameHostImpl* rfh = GetMainFrame();
-  if (rfh) {
-    BrowserAccessibilityManager* accessibility_manager =
-        rfh->browser_accessibility_manager();
-    if (accessibility_manager)
-      accessibility_manager->set_hidden_by_interstitial_page(false);
-  }
-
-  // If the focus was on the interstitial, let's keep it to the page.
-  // (Note that in unit-tests the RVH may not have a view).
-  if (has_focus && GetRenderViewHost()->GetWidget()->GetView())
-    GetRenderViewHost()->GetWidget()->GetView()->Focus();
-
-  for (auto& observer : observers_)
-    observer.DidDetachInterstitialPage();
-
-  // Disconnect from outer WebContents if necessary. This must happen after the
-  // interstitial page is cleared above, since the call to
-  // SetRWHViewForInnerContents below may loop over all the
-  // RenderWidgetHostViews in the tree (otherwise, including the now-deleted
-  // view for the interstitial).
-  if (node_.OuterContentsFrameTreeNode()) {
-    if (GetRenderManager()->GetProxyToOuterDelegate()) {
-      DCHECK(static_cast<RenderWidgetHostViewBase*>(
-                 GetRenderManager()->current_frame_host()->GetView())
-                 ->IsRenderWidgetHostViewChildFrame());
-      RenderWidgetHostViewChildFrame* view =
-          static_cast<RenderWidgetHostViewChildFrame*>(
-              GetRenderManager()->current_frame_host()->GetView());
-      GetRenderManager()->SetRWHViewForInnerContents(view);
-    }
-  }
-
-  // Restart the throbber if needed now that the interstitial page is going
-  // away.
-  if (interstitial_pausing_throbber && frame_tree_.IsLoading())
-    LoadingStateChanged(true, true, nullptr);
-}
-
 void WebContentsImpl::SetHistoryOffsetAndLength(int history_offset,
                                                 int history_length) {
   SendPageMessage(new PageMsg_SetHistoryOffsetAndLength(
@@ -3901,11 +3787,7 @@ void WebContentsImpl::FocusThroughTabTraversal(bool reverse) {
 }
 
 bool WebContentsImpl::ShowingInterstitialPage() {
-  return interstitial_page_ != nullptr;
-}
-
-InterstitialPageImpl* WebContentsImpl::GetInterstitialPage() {
-  return interstitial_page_;
+  return false;
 }
 
 bool WebContentsImpl::IsSavable() {
@@ -4326,7 +4208,10 @@ bool WebContentsImpl::WasEverAudible() {
 }
 
 void WebContentsImpl::GetManifest(GetManifestCallback callback) {
-  manifest_manager_host_->GetManifest(std::move(callback));
+  // TODO(yuzus, 1061899): Move this function to RenderFrameHostImpl.
+  ManifestManagerHost* manifest_manager_host =
+      ManifestManagerHost::GetOrCreateForCurrentDocument(GetMainFrame());
+  manifest_manager_host->GetManifest(std::move(callback));
 }
 
 void WebContentsImpl::ExitFullscreen(bool will_cause_resize) {
@@ -4552,8 +4437,6 @@ void WebContentsImpl::DidFinishNavigation(NavigationHandle* navigation_handle) {
 
       if (!navigation_handle->IsSameDocument()) {
         was_ever_audible_ = false;
-        last_committed_source_id_ =
-            last_committed_source_id_including_same_document_;
       }
     }
 
@@ -4599,13 +4482,6 @@ void WebContentsImpl::NotifyChangedNavigationState(
   NotifyNavigationStateChanged(changed_flags);
 }
 
-void WebContentsImpl::DidStartNavigationToPendingEntry(const GURL& url,
-                                                       ReloadType reload_type) {
-  // Notify observers about navigation.
-  for (auto& observer : observers_)
-    observer.DidStartNavigationToPendingEntry(url, reload_type);
-}
-
 bool WebContentsImpl::ShouldTransferNavigation(bool is_main_frame_navigation) {
   if (!delegate_)
     return true;
@@ -4715,7 +4591,7 @@ void WebContentsImpl::OnThemeColorChanged(RenderViewHostImpl* source) {
   }
 }
 
-void WebContentsImpl::OnDidLoadResourceFromMemoryCache(
+void WebContentsImpl::DidLoadResourceFromMemoryCache(
     RenderFrameHostImpl* source,
     const GURL& url,
     const std::string& http_method,
@@ -4830,11 +4706,11 @@ void WebContentsImpl::ViewSource(RenderFrameHostImpl* frame) {
       title_for_view_source, ui::PAGE_TRANSITION_LINK,
       /* is_renderer_initiated = */ false,
       /* blob_url_loader_factory = */ nullptr);
-  navigation_entry->SetVirtualURL(GURL(content::kViewSourceScheme +
-                                       std::string(":") +
-                                       frame_entry->url().spec()));
-
-  navigation_entry->set_network_isolation_key(frame->GetNetworkIsolationKey());
+  const GURL url(content::kViewSourceScheme + std::string(":") +
+                 frame_entry->url().spec());
+  navigation_entry->SetVirtualURL(url);
+  navigation_entry->set_isolation_info(
+      frame->GetIsolationInfoForSubresources());
 
   // Do not restore scroller position.
   // TODO(creis, lukasza, arthursonzogni): Do not reuse the original PageState,
@@ -4861,7 +4737,7 @@ void WebContentsImpl::ViewSource(RenderFrameHostImpl* frame) {
   gfx::Rect initial_rect;
   constexpr bool kUserGesture = true;
   bool ignored_was_blocked;
-  delegate_->AddNewContents(this, std::move(view_source_contents),
+  delegate_->AddNewContents(this, std::move(view_source_contents), url,
                             WindowOpenDisposition::NEW_FOREGROUND_TAB,
                             initial_rect, kUserGesture, &ignored_was_blocked);
   // Note that the |delegate_| could have deleted |view_source_contents| during
@@ -4982,7 +4858,7 @@ void WebContentsImpl::OnGoToEntryAtOffset(RenderFrameHostImpl* source,
 
   // All frames are allowed to navigate the global history.
   if (!delegate_ || delegate_->OnGoToEntryOffset(offset)) {
-    if (source->IsSandboxed(blink::mojom::WebSandboxFlags::kTopNavigation)) {
+    if (source->IsSandboxed(network::mojom::WebSandboxFlags::kTopNavigation)) {
       // Keep track of whether this is a session history from a sandboxed iframe
       // with top level navigation disallowed.
       controller_.GoToOffsetInSandboxedFrame(offset,
@@ -5019,14 +4895,18 @@ void WebContentsImpl::OnPageScaleFactorChanged(RenderFrameHostImpl* source,
 }
 
 void WebContentsImpl::OnTextAutosizerPageInfoChanged(
-    RenderViewHostImpl* source,
-    const blink::WebTextAutosizerPageInfo& page_info) {
+    RenderFrameHostImpl* source,
+    blink::mojom::TextAutosizerPageInfoPtr page_info) {
   // Keep a copy of |page_info| in case we create a new RenderView before
   // the next update.
-  text_autosizer_page_info_ = page_info;
+  text_autosizer_page_info_.main_frame_width = page_info->main_frame_width;
+  text_autosizer_page_info_.main_frame_layout_width =
+      page_info->main_frame_layout_width;
+  text_autosizer_page_info_.device_scale_adjustment =
+      page_info->device_scale_adjustment;
   frame_tree_.root()->render_manager()->SendPageMessage(
       new PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames(
-          MSG_ROUTING_NONE, page_info),
+          MSG_ROUTING_NONE, text_autosizer_page_info_),
       source->GetSiteInstance());
 }
 
@@ -5084,16 +4964,6 @@ void WebContentsImpl::UnregisterProtocolHandler(RenderFrameHostImpl* source,
   delegate_->UnregisterProtocolHandler(this, protocol, url, user_gesture);
 }
 
-void WebContentsImpl::OnDomOperationResponse(RenderFrameHostImpl* source,
-                                             const std::string& json_string) {
-  // TODO(nick, lukasza): The notification below should probably be updated to
-  // include |source|.
-  std::string json = json_string;
-  NotificationService::current()->Notify(NOTIFICATION_DOM_OPERATION_RESPONSE,
-                                         Source<WebContents>(this),
-                                         Details<std::string>(&json));
-}
-
 void WebContentsImpl::OnAppCacheAccessed(const GURL& manifest_url,
                                          bool blocked_by_policy) {
   // TODO(nick): Should we consider |source| here? Should we call FilterURL on
@@ -5104,6 +4974,35 @@ void WebContentsImpl::OnAppCacheAccessed(const GURL& manifest_url,
     observer.AppCacheAccessed(manifest_url, blocked_by_policy);
 }
 
+void WebContentsImpl::DomOperationResponse(const std::string& json_string) {
+  // TODO(lukasza): The notification below should probably indicate which
+  // RenderFrameHostImpl the message is coming from. This can enable tests to
+  // talk to 2 frames at the same time, without being confused which frame a
+  // given response comes from.  See also a corresponding TODO in the
+  // ExecuteScriptHelper in //content/public/test/browser_test_utils.cc
+  NotificationService::current()->Notify(
+      NOTIFICATION_DOM_OPERATION_RESPONSE, Source<WebContents>(this),
+      Details<const std::string>(&json_string));
+}
+
+void WebContentsImpl::OnServiceWorkerAccessed(
+    RenderFrameHost* render_frame_host,
+    const GURL& scope,
+    AllowServiceWorkerResult allowed) {
+  for (auto& observer : observers_) {
+    observer.OnServiceWorkerAccessed(render_frame_host, scope, allowed);
+  }
+}
+
+void WebContentsImpl::OnServiceWorkerAccessed(
+    NavigationHandle* navigation,
+    const GURL& scope,
+    AllowServiceWorkerResult allowed) {
+  for (auto& observer : observers_) {
+    observer.OnServiceWorkerAccessed(navigation, scope, allowed);
+  }
+}
+
 void WebContentsImpl::OnColorChooserFactoryReceiver(
     mojo::PendingReceiver<blink::mojom::ColorChooserFactory> receiver) {
   color_chooser_factory_receivers_.Add(this, std::move(receiver));
@@ -5164,7 +5063,7 @@ void WebContentsImpl::OnPluginCrashed(RenderFrameHostImpl* source,
                                       const base::FilePath& plugin_path,
                                       base::ProcessId plugin_pid) {
   // TODO(nick): Eliminate the |plugin_pid| parameter, which can't be trusted,
-  // and is only used by BlinkTestController.
+  // and is only used by WebTestControlHost.
   for (auto& observer : observers_)
     observer.PluginCrashed(plugin_path, plugin_pid);
 }
@@ -5240,7 +5139,7 @@ void WebContentsImpl::DidFirstVisuallyNonEmptyPaint(
   }
 }
 
-bool WebContentsImpl::IsPortal() const {
+bool WebContentsImpl::IsPortal() {
   return portal();
 }
 
@@ -5312,12 +5211,6 @@ void WebContentsImpl::LoadingStateChanged(bool to_different_document,
                                           LoadNotificationDetails* details) {
   if (is_being_destroyed_)
     return;
-  // Do not send notifications about loading changes in the FrameTree while the
-  // interstitial page is pausing the throbber.
-  if (ShowingInterstitialPage() && interstitial_page_->pause_throbber() &&
-      !due_to_interstitial) {
-    return;
-  }
 
   bool is_loading = IsLoading();
 
@@ -5361,17 +5254,17 @@ void WebContentsImpl::LoadingStateChanged(bool to_different_document,
       type, Source<NavigationController>(&controller_), det);
 }
 
-void WebContentsImpl::NotifyViewSwapped(RenderViewHost* old_host,
-                                        RenderViewHost* new_host) {
-  DCHECK_NE(old_host, new_host);
+void WebContentsImpl::NotifyViewSwapped(RenderViewHost* old_view,
+                                        RenderViewHost* new_view) {
+  DCHECK_NE(old_view, new_view);
   // After sending out a swap notification, we need to send a disconnect
   // notification so that clients that pick up a pointer to |this| can NULL the
   // pointer.  See Bug 1230284.
   notify_disconnection_ = true;
   for (auto& observer : observers_)
-    observer.RenderViewHostChanged(old_host, new_host);
+    observer.RenderViewHostChanged(old_view, new_view);
 
-  view_->RenderViewHostChanged(old_host, new_host);
+  view_->RenderViewHostChanged(old_view, new_view);
 
   // If this is an inner WebContents that has swapped views, we need to reattach
   // it to its outer WebContents.
@@ -5384,21 +5277,21 @@ void WebContentsImpl::NotifyViewSwapped(RenderViewHost* old_host,
   RemoveBrowserPluginEmbedder();
 }
 
-void WebContentsImpl::NotifyFrameSwapped(RenderFrameHost* old_host,
-                                         RenderFrameHost* new_host,
+void WebContentsImpl::NotifyFrameSwapped(RenderFrameHost* old_frame,
+                                         RenderFrameHost* new_frame,
                                          bool is_main_frame) {
 #if defined(OS_ANDROID)
-  // Copy importance from |old_host| if |new_host| is a main frame.
-  if (old_host && !new_host->GetParent()) {
-    static_cast<RenderFrameHostImpl*>(new_host)
-        ->GetRenderWidgetHost()
-        ->SetImportance(static_cast<RenderFrameHostImpl*>(old_host)
-                            ->GetRenderWidgetHost()
-                            ->importance());
+  // Copy importance from |old_frame| if |new_frame| is a main frame.
+  if (old_frame && !new_frame->GetParent()) {
+    RenderWidgetHostImpl* old_widget =
+        static_cast<RenderFrameHostImpl*>(old_frame)->GetRenderWidgetHost();
+    RenderWidgetHostImpl* new_widget =
+        static_cast<RenderFrameHostImpl*>(new_frame)->GetRenderWidgetHost();
+    new_widget->SetImportance(old_widget->importance());
   }
 #endif
   for (auto& observer : observers_)
-    observer.RenderFrameHostChanged(old_host, new_host);
+    observer.RenderFrameHostChanged(old_frame, new_frame);
 }
 
 // TODO(avi): Remove this entire function because this notification is already
@@ -5493,8 +5386,7 @@ void WebContentsImpl::RenderFrameCreated(RenderFrameHost* render_frame_host) {
 void WebContentsImpl::RenderFrameDeleted(RenderFrameHost* render_frame_host) {
   if (IsBeingDestroyed() && !render_frame_host->GetParent() &&
       first_navigation_completed_ &&
-      !static_cast<RenderFrameHostImpl*>(render_frame_host)
-           ->is_in_back_forward_cache()) {
+      !render_frame_host->IsInBackForwardCache()) {
     // Main frame has been deleted because WebContents is being destroyed.
     // Note that we aren't recording this here when the main frame is in the
     // back-forward cache because that means we've actually already navigated
@@ -5815,7 +5707,7 @@ RenderFrameHostImpl* WebContentsImpl::GetOuterWebContentsFrame() {
       FrameTreeNode::GloballyFindByID(GetOuterDelegateFrameTreeNodeId());
   // The outer node should be in the outer WebContents.
   DCHECK_EQ(outer_node->frame_tree(), GetOuterWebContents()->GetFrameTree());
-  return outer_node->parent()->current_frame_host();
+  return outer_node->parent();
 }
 
 WebContentsImpl* WebContentsImpl::GetOuterWebContents() {
@@ -6054,17 +5946,12 @@ void WebContentsImpl::DidStopLoading() {
   // Use the last committed entry rather than the active one, in case a
   // pending entry has been created.
   NavigationEntry* entry = controller_.GetLastCommittedEntry();
-  Navigator* navigator = frame_tree_.root()->navigator();
 
   // An entry may not exist for a stop when loading an initial blank page or
   // if an iframe injected by script into a blank page finishes loading.
   if (entry) {
-    base::TimeDelta elapsed =
-        base::TimeTicks::Now() - navigator->GetCurrentLoadStart();
-
     details.reset(new LoadNotificationDetails(
         entry->GetVirtualURL(),
-        elapsed,
         &controller_,
         controller_.GetCurrentEntryIndex()));
   }
@@ -6135,6 +6022,23 @@ std::unique_ptr<NavigationUIData> WebContentsImpl::GetNavigationUIData(
   return GetContentClient()->browser()->GetNavigationUIData(navigation_handle);
 }
 
+void WebContentsImpl::RegisterExistingOriginToPreventOptInIsolation(
+    const url::Origin& origin,
+    NavigationRequest* navigation_request_to_exclude) {
+  // Note: This function can be made static if we ever need call it without
+  // a WebContentsImpl instance, in which case we can use a wrapper to
+  // implement the override from NavigatorDelegate.
+  for (WebContentsImpl* web_contents : GetAllWebContents()) {
+    web_contents->controller_.RegisterExistingOriginToPreventOptInIsolation(
+        origin);
+    // Walk the frame tree to pick up any frames without FrameNavigationEntries.
+    // * Some frames won't have FrameNavigationEntries (Issues 524208, 608402).
+    // * Some pending navigations won't have NavigationEntries.
+    web_contents->GetFrameTree()->RegisterExistingOriginToPreventOptInIsolation(
+        origin, navigation_request_to_exclude);
+  }
+}
+
 void WebContentsImpl::DidCancelLoading() {
   controller_.DiscardNonCommittedEntries();
 
@@ -6334,13 +6238,7 @@ void WebContentsImpl::SetAsFocusedWebContentsIfNecessary() {
   // focused which would return early without actually advancing focus.
   FocusOuterAttachmentFrameChain();
 
-  if (ShowingInterstitialPage()) {
-    static_cast<RenderFrameHostImpl*>(interstitial_page_->GetMainFrame())
-        ->GetRenderWidgetHost()
-        ->SetPageFocus(true);
-  } else {
-    GetMainFrame()->GetRenderWidgetHost()->SetPageFocus(true);
-  }
+  GetMainFrame()->GetRenderWidgetHost()->SetPageFocus(true);
 }
 
 void WebContentsImpl::SetFocusedFrame(FrameTreeNode* node,
@@ -6471,7 +6369,7 @@ void WebContentsImpl::DidReceiveInputEvent(
   if (!HasMatchingWidgetHost(&frame_tree_, render_widget_host))
     return;
 
-  if (type != blink::WebInputEvent::kGestureScrollBegin)
+  if (type != blink::WebInputEvent::Type::kGestureScrollBegin)
     last_interactive_input_event_time_ = ui::EventTimeForNow();
 
   for (auto& observer : observers_)
@@ -6535,6 +6433,9 @@ void WebContentsImpl::RendererUnresponsive(
 
 void WebContentsImpl::RendererResponsive(
     RenderWidgetHostImpl* render_widget_host) {
+  for (auto& observer : observers_)
+    observer.OnRendererResponsive(render_widget_host->GetProcess());
+
   if (delegate_)
     delegate_->RendererResponsive(this, render_widget_host);
 }
@@ -6578,17 +6479,6 @@ void WebContentsImpl::RenderProcessGoneFromRenderManager(
   RenderViewTerminated(render_view_host, crashed_status_, crashed_error_code_);
 }
 
-void WebContentsImpl::UpdateRenderViewSizeForRenderManager(bool is_main_frame) {
-  // TODO(brettw) this is a hack. See WebContentsView::SizeContents.
-  gfx::Size size = GetSizeForNewRenderView(is_main_frame);
-  // 0x0 isn't a valid window size (minimal window size is 1x1) but it may be
-  // here during container initialization and normal window size will be set
-  // later. In case of tab duplication this resizing to 0x0 prevents setting
-  // normal size later so just ignore it.
-  if (!size.IsEmpty())
-    view_->SizeContents(size);
-}
-
 void WebContentsImpl::CancelModalDialogsForRenderManager() {
   // We need to cancel modal dialogs when doing a process swap, since the load
   // deferrer would prevent us from swapping out. We also clear the state
@@ -6603,13 +6493,19 @@ void WebContentsImpl::CancelModalDialogsForRenderManager() {
   }
 }
 
-void WebContentsImpl::NotifySwappedFromRenderManager(RenderFrameHost* old_host,
-                                                     RenderFrameHost* new_host,
+void WebContentsImpl::NotifySwappedFromRenderManager(RenderFrameHost* old_frame,
+                                                     RenderFrameHost* new_frame,
                                                      bool is_main_frame) {
   if (is_main_frame) {
+    // The |new_frame| and its various compadres are already swapped into place
+    // for the WebContentsImpl when this method is called.
+    DCHECK(GetMainFrame() == new_frame);
+    DCHECK(GetRenderViewHost() == new_frame->GetRenderViewHost());
+    DCHECK(GetRenderWidgetHostView() == new_frame->GetView());
+
     RenderViewHost* old_rvh =
-        old_host ? old_host->GetRenderViewHost() : nullptr;
-    RenderViewHost* new_rvh = new_host->GetRenderViewHost();
+        old_frame ? old_frame->GetRenderViewHost() : nullptr;
+    RenderViewHost* new_rvh = new_frame->GetRenderViewHost();
     // |old_rvh| and |new_rvh| might be equal when navigating from a crashed
     // RenderFrameHost to a new same-site one. With RenderDocument, this will
     // happen for every same-site navigation.
@@ -6620,20 +6516,28 @@ void WebContentsImpl::NotifySwappedFromRenderManager(RenderFrameHost* old_host,
     if (delegate_)
       view_->SetOverscrollControllerEnabled(CanOverscrollContent());
 
-    RenderWidgetHostViewBase* rwhv =
-        static_cast<RenderWidgetHostViewBase*>(GetRenderWidgetHostView());
-    if (rwhv)
-      rwhv->SetMainFrameAXTreeID(GetMainFrame()->GetAXTreeID());
+    auto* rwhv = static_cast<RenderWidgetHostViewBase*>(new_frame->GetView());
+    if (rwhv) {
+      rwhv->SetMainFrameAXTreeID(new_frame->GetAXTreeID());
+
+      // The RenderWidgetHostView for the speculative RenderFrameHost is not
+      // resized with the current RenderFrameHost while a navigation is
+      // pending. So when we swap in the main frame, we need to update the
+      // RenderWidgetHostView's size.
+      //
+      // Historically, this was done to fix b/1079768 for interstitials.
+      rwhv->SetSize(GetSizeForMainFrame());
+    }
   }
 
-  NotifyFrameSwapped(old_host, new_host, is_main_frame);
+  NotifyFrameSwapped(old_frame, new_frame, is_main_frame);
 }
 
 void WebContentsImpl::NotifyMainFrameSwappedFromRenderManager(
-    RenderFrameHost* old_host,
-    RenderFrameHost* new_host) {
-  NotifyViewSwapped(old_host ? old_host->GetRenderViewHost() : nullptr,
-                    new_host->GetRenderViewHost());
+    RenderFrameHost* old_frame,
+    RenderFrameHost* new_frame) {
+  NotifyViewSwapped(old_frame ? old_frame->GetRenderViewHost() : nullptr,
+                    new_frame->GetRenderViewHost());
 }
 
 NavigationControllerImpl& WebContentsImpl::GetControllerForRenderManager() {
@@ -6645,21 +6549,18 @@ std::unique_ptr<WebUIImpl> WebContentsImpl::CreateWebUIForRenderFrameHost(
   return CreateWebUI(url);
 }
 
-InterstitialPageImpl* WebContentsImpl::GetInterstitialForRenderManager() {
-  return interstitial_page_;
-}
-
 void WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(
     RenderViewHost* render_view_host) {
   RenderWidgetHostViewBase* rwh_view =
       view_->CreateViewForWidget(render_view_host->GetWidget());
-  rwh_view->SetSize(GetSizeForNewRenderView(true));
+  rwh_view->SetSize(GetSizeForMainFrame());
 }
 
 bool WebContentsImpl::CreateRenderViewForRenderManager(
     RenderViewHost* render_view_host,
     int opener_frame_routing_id,
     int proxy_routing_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const FrameReplicationState& replicated_frame_state) {
   TRACE_EVENT0("browser,navigation",
@@ -6670,8 +6571,8 @@ bool WebContentsImpl::CreateRenderViewForRenderManager(
 
   if (!static_cast<RenderViewHostImpl*>(render_view_host)
            ->CreateRenderView(opener_frame_routing_id, proxy_routing_id,
-                              devtools_frame_token, replicated_frame_state,
-                              created_with_opener_)) {
+                              frame_token, devtools_frame_token,
+                              replicated_frame_state, created_with_opener_)) {
     return false;
   }
   // Set the TextAutosizer state from the main frame's renderer on the new view,
@@ -6755,13 +6656,6 @@ void WebContentsImpl::RequestFindMatchRects(int current_version) {
   GetOrCreateFindRequestManager()->RequestFindMatchRects(current_version);
 }
 
-bool WebContentsImpl::CreateRenderViewForInitialEmptyDocument() {
-  return CreateRenderViewForRenderManager(
-      GetRenderViewHost(), MSG_ROUTING_NONE, MSG_ROUTING_NONE,
-      frame_tree_.root()->devtools_frame_token(),
-      frame_tree_.root()->current_replication_state());
-}
-
 service_manager::InterfaceProvider* WebContentsImpl::GetJavaInterfaces() {
   if (!java_interfaces_) {
     mojo::PendingRemote<service_manager::mojom::InterfaceProvider> provider;
@@ -6862,10 +6756,6 @@ base::UnguessableToken WebContentsImpl::GetAudioGroupId() {
   return GetAudioStreamFactory()->group_id();
 }
 
-ukm::SourceId WebContentsImpl::GetLastCommittedSourceId() {
-  return last_committed_source_id_;
-}
-
 const std::vector<blink::mojom::FaviconURLPtr>&
 WebContentsImpl::GetFaviconURLs() {
   return favicon_urls_;
@@ -6881,15 +6771,19 @@ void WebContentsImpl::CreateBrowserPluginEmbedderIfNecessary() {
   browser_plugin_embedder_.reset(BrowserPluginEmbedder::Create(this));
 }
 
-gfx::Size WebContentsImpl::GetSizeForNewRenderView(bool is_main_frame) {
-  gfx::Size size;
-  if (is_main_frame)
-    size = device_emulation_size_;
-  if (size.IsEmpty() && delegate_)
-    size = delegate_->GetSizeForNewRenderView(this);
-  if (size.IsEmpty())
-    size = GetContainerBounds().size();
-  return size;
+gfx::Size WebContentsImpl::GetSizeForMainFrame() {
+  if (delegate_) {
+    // The delegate has a chance to specify a size independent of the UI.
+    gfx::Size delegate_size = delegate_->GetSizeForNewRenderView(this);
+    if (!delegate_size.IsEmpty())
+      return delegate_size;
+  }
+
+  // Device emulation, when enabled, can specify a size independent of the UI.
+  if (!device_emulation_size_.IsEmpty())
+    return device_emulation_size_;
+
+  return GetContainerBounds().size();
 }
 
 void WebContentsImpl::OnFrameRemoved(RenderFrameHost* render_frame_host) {
@@ -7372,6 +7266,27 @@ void WebContentsImpl::DidChangeScreenOrientation() {
   last_screen_orientation_change_time_ = ui::EventTimeForNow();
 }
 
+bool WebContentsImpl::ShowPopupMenu(
+    RenderFrameHostImpl* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+    const gfx::Rect& bounds,
+    int32_t item_height,
+    double font_size,
+    int32_t selected_item,
+    std::vector<blink::mojom::MenuItemPtr>* menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
+  for (auto& observer : observers_) {
+    if (observer.ShowPopupMenu(render_frame_host, popup_client, bounds,
+                               item_height, font_size, selected_item,
+                               menu_items, right_aligned,
+                               allow_multiple_selection)) {
+      return true;
+    }
+  }
+  return false;
+}
+
 void WebContentsImpl::UpdateWebContentsVisibility(Visibility visibility) {
   // Occlusion is disabled when |features::kWebContentsOcclusion| is disabled
   // (for power and speed impact assessment) or when
@@ -7528,4 +7443,8 @@ mojom::FrameInputHandler* WebContentsImpl::GetFocusedFrameInputHandler() {
   return focused_frame->GetFrameInputHandler();
 }
 
+ukm::SourceId WebContentsImpl::GetCurrentPageUkmSourceId() {
+  return GetMainFrame()->GetPageUkmSourceId();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_contents/web_contents_impl.h b/chromium/content/browser/web_contents/web_contents_impl.h
index 33ff2051307..29125641f89 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.h
+++ b/chromium/content/browser/web_contents/web_contents_impl.h
@@ -31,7 +31,6 @@
 #include "content/browser/frame_host/file_chooser_impl.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_controller_delegate.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigator_delegate.h"
@@ -46,6 +45,7 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/accessibility_tree_formatter.h"
 #include "content/public/browser/color_chooser.h"
+#include "content/public/browser/cookie_access_details.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/media_stream_request.h"
 #include "content/public/browser/mhtml_generation_result.h"
@@ -66,12 +66,14 @@
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/network/public/mojom/fetch_api.mojom-forward.h"
 #include "third_party/blink/public/mojom/choosers/color_chooser.mojom.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame.mojom-forward.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 #include "third_party/blink/public/mojom/page/display_cutout.mojom.h"
+#include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
-#include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -98,13 +100,11 @@ class BrowserPluginGuest;
 class ConversionHost;
 class DisplayCutoutHostImpl;
 class FindRequestManager;
-class InterstitialPageImpl;
 class JavaScriptDialogManager;
 class JavaScriptDialogNavigationDeferrer;
-class ManifestManagerHost;
 class MediaWebContentsObserver;
 class NFCHost;
-class PluginContentOriginWhitelist;
+class PluginContentOriginAllowlist;
 class Portal;
 class RenderFrameHost;
 class RenderViewHost;
@@ -112,6 +112,7 @@ class RenderViewHostDelegateView;
 class RenderWidgetHostImpl;
 class RenderWidgetHostInputEventRouter;
 class SavePackage;
+class ScreenChangeMonitor;
 class ScreenOrientationProvider;
 class SiteInstance;
 class BeforeUnloadBlockingDelegate;  // content_browser_test_utils_internal.h
@@ -143,6 +144,23 @@ class PepperPlaybackObserver;
 using AccessibilityEventCallback =
     base::RepeatingCallback<void(const std::string&)>;
 
+// CreatedWindow holds the WebContentsImpl and target url between IPC calls to
+// CreateNewWindow and ShowCreatedWindow.
+struct CONTENT_EXPORT CreatedWindow {
+  CreatedWindow();
+  CreatedWindow(std::unique_ptr<WebContentsImpl> contents, GURL target_url);
+  CreatedWindow(CreatedWindow&&);
+  CreatedWindow(const CreatedWindow&) = delete;
+  CreatedWindow& operator=(CreatedWindow&&);
+  CreatedWindow& operator=(const CreatedWindow&) = delete;
+  ~CreatedWindow();
+
+  std::unique_ptr<WebContentsImpl> contents;
+  GURL target_url;
+};
+
+using PageVisibilityState = blink::mojom::PageVisibilityState;
+
 // Factory function for the implementations that content knows about. Takes
 // ownership of |delegate|.
 WebContentsView* CreateWebContentsView(
@@ -188,15 +206,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Returns the SavePackage which manages the page saving job. May be NULL.
   SavePackage* save_package() const { return save_package_.get(); }
 
-#if defined(OS_ANDROID)
-  // In Android WebView, the RenderView needs created even there is no
-  // navigation entry, this allows Android WebViews to use
-  // javascript: URLs that load into the DOMWindow before the first page
-  // load. This is not safe to do in any context that a web page could get a
-  // reference to the DOMWindow before the first page load.
-  bool CreateRenderViewForInitialEmptyDocument();
-#endif
-
   // Expose the render manager for testing.
   // TODO(creis): Remove this now that we can get to it via FrameTreeNode.
   RenderFrameHostManager* GetRenderManagerForTesting();
@@ -250,6 +259,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
 
   WebContentsView* GetView() const;
 
+  void OnScreensChange();
   void OnScreenOrientationChange();
 
   ScreenOrientationProvider* GetScreenOrientationProviderForTesting() const {
@@ -301,10 +311,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
 
   void NotifyManifestUrlChanged(const base::Optional<GURL>& manifest_url);
 
-  ManifestManagerHost* GetManifestManagerHost() const {
-    return manifest_manager_host_.get();
-  }
-
 #if defined(OS_ANDROID)
   void SetMainFrameImportance(ChildProcessImportance importance);
 #endif
@@ -337,8 +343,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   WebUI* GetCommittedWebUI() override;
   void SetUserAgentOverride(const blink::UserAgentOverride& ua_override,
                             bool override_in_new_tabs) override;
+  void SetRendererInitiatedUserAgentOverrideOption(
+      NavigationController::UserAgentOverrideOption option) override;
   const blink::UserAgentOverride& GetUserAgentOverride() override;
-  bool ShouldOverrideUserAgentInNewTabs() override;
+  bool ShouldOverrideUserAgentForRendererInitiatedNavigation() override;
   void EnableWebContentsOnlyAccessibilityMode() override;
   bool IsWebContentsOnlyAccessibilityModeForTesting() override;
   bool IsFullAccessibilityModeForTesting() override;
@@ -393,6 +401,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                               RenderFrameHost* render_frame_host,
                               bool is_full_page) override;
   bool IsInnerWebContentsForGuest() override;
+  bool IsPortal() override;
   RenderFrameHostImpl* GetOuterWebContentsFrame() override;
   WebContentsImpl* GetOuterWebContents() override;
   WebContentsImpl* GetOutermostWebContents() override;
@@ -401,14 +410,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void DidChangeVisibleSecurityState() override;
   void NotifyPreferencesChanged() override;
   void SyncRendererPrefs() override;
-  void OnCookiesRead(const GURL& url,
-                     const GURL& first_party_url,
-                     const net::CookieList& cookie_list,
-                     bool blocked_by_policy) override;
-  void OnCookieChange(const GURL& url,
-                      const GURL& first_party_url,
-                      const net::CanonicalCookie& cookie,
-                      bool blocked_by_policy) override;
 
   void Stop() override;
   void SetPageFrozen(bool frozen) override;
@@ -445,7 +446,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void RestoreFocus() override;
   void FocusThroughTabTraversal(bool reverse) override;
   bool ShowingInterstitialPage() override;
-  InterstitialPageImpl* GetInterstitialPage() override;
   bool IsSavable() override;
   void OnSavePage() override;
   bool SavePage(const base::FilePath& main_file,
@@ -519,7 +519,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void SetShowingContextMenu(bool showing) override;
   base::UnguessableToken GetAudioGroupId() override;
   bool CompletedFirstVisuallyNonEmptyPaint() override;
-  ukm::SourceId GetLastCommittedSourceId() override;
   void UpdateFaviconURL(
       RenderFrameHost* source,
       std::vector<blink::mojom::FaviconURLPtr> candidates) override;
@@ -682,6 +681,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       RenderFrameHost* render_frame_host,
       const GlobalRequestID& request_id,
       blink::mojom::ResourceLoadInfoPtr resource_load_information) override;
+  void OnCookiesAccessed(RenderFrameHostImpl*,
+                         const CookieAccessDetails& details) override;
 
   // Called when WebAudio starts or stops playing audible audio in an
   // AudioContext.
@@ -713,6 +714,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       IsClipboardPasteAllowedCallback callback) override;
   void OnPageScaleFactorChanged(RenderFrameHostImpl* source,
                                 float page_scale_factor) override;
+  void OnTextAutosizerPageInfoChanged(
+      RenderFrameHostImpl* source,
+      blink::mojom::TextAutosizerPageInfoPtr page_info) override;
   bool HasSeenRecentScreenOrientationChange() override;
   void CreateNewWidget(int32_t render_process_id,
                        int32_t route_id,
@@ -729,6 +733,23 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
           blink_widget_host,
       mojo::PendingAssociatedRemote<blink::mojom::Widget> blink_widget)
       override;
+  bool ShowPopupMenu(
+      RenderFrameHostImpl* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+      const gfx::Rect& bounds,
+      int32_t item_height,
+      double font_size,
+      int32_t selected_item,
+      std::vector<blink::mojom::MenuItemPtr>* menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
+  void DidLoadResourceFromMemoryCache(
+      RenderFrameHostImpl* source,
+      const GURL& url,
+      const std::string& http_request,
+      const std::string& mime_type,
+      network::mojom::RequestDestination request_destination) override;
+  void DomOperationResponse(const std::string& json_string) override;
 
   // RenderViewHostDelegate ----------------------------------------------------
   RenderViewHostDelegateView* GetDelegateView() override;
@@ -784,7 +805,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   bool IsSpatialNavigationDisabled() const override;
   RenderFrameHostImpl* GetPendingMainFrame() override;
   void DidFirstVisuallyNonEmptyPaint(RenderViewHostImpl* source) override;
-  bool IsPortal() const override;
   void OnThemeColorChanged(RenderViewHostImpl* source) override;
 
   // NavigatorDelegate ---------------------------------------------------------
@@ -808,8 +828,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void SetMainFrameMimeType(const std::string& mime_type) override;
   bool CanOverscrollContent() const override;
   void NotifyChangedNavigationState(InvalidateTypes changed_flags) override;
-  void DidStartNavigationToPendingEntry(const GURL& url,
-                                        ReloadType reload_type) override;
   bool ShouldTransferNavigation(bool is_main_frame_navigation) override;
   void DidStartLoading(FrameTreeNode* frame_tree_node,
                        bool to_different_document) override;
@@ -819,10 +837,17 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       NavigationHandle* navigation_handle) override;
   std::unique_ptr<NavigationUIData> GetNavigationUIData(
       NavigationHandle* navigation_handle) override;
+  void OnServiceWorkerAccessed(NavigationHandle* navigation,
+                               const GURL& scope,
+                               AllowServiceWorkerResult allowed) override;
+  void OnCookiesAccessed(NavigationHandle*,
+                         const CookieAccessDetails& details) override;
+  void RegisterExistingOriginToPreventOptInIsolation(
+      const url::Origin& origin,
+      NavigationRequest* navigation_request_to_exclude) override;
 
   // RenderWidgetHostDelegate --------------------------------------------------
 
-  ukm::SourceId GetUkmSourceIdForLastCommittedSource() const override;
   ukm::SourceId GetUkmSourceIdForLastCommittedSourceIncludingSameDocument()
       const override;
   void SetTopControlsShownRatio(RenderWidgetHostImpl* render_widget_host,
@@ -888,8 +913,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   RenderWidgetHostImpl* GetKeyboardLockWidget() override;
   // The following function is already listed under WebContents overrides:
   // bool IsFullscreenForCurrentTab() const override;
-  blink::mojom::DisplayMode GetDisplayMode(
-      RenderWidgetHostImpl* render_widget_host) const override;
+  blink::mojom::DisplayMode GetDisplayMode() const override;
   void LostCapture(RenderWidgetHostImpl* render_widget_host) override;
   void LostMouseLock(RenderWidgetHostImpl* render_widget_host) override;
   bool HasMouseLock(RenderWidgetHostImpl* render_widget_host) override;
@@ -910,6 +934,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       RenderViewHost* render_view_host,
       int opener_frame_routing_id,
       int proxy_routing_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const FrameReplicationState& replicated_frame_state) override;
   void CreateRenderWidgetHostViewForRenderManager(
@@ -926,16 +951,14 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       bool* proceed_to_fire_unload) override;
   void RenderProcessGoneFromRenderManager(
       RenderViewHost* render_view_host) override;
-  void UpdateRenderViewSizeForRenderManager(bool is_main_frame) override;
   void CancelModalDialogsForRenderManager() override;
-  void NotifySwappedFromRenderManager(RenderFrameHost* old_host,
-                                      RenderFrameHost* new_host,
+  void NotifySwappedFromRenderManager(RenderFrameHost* old_frame,
+                                      RenderFrameHost* new_frame,
                                       bool is_main_frame) override;
   void NotifyMainFrameSwappedFromRenderManager(
-      RenderFrameHost* old_host,
-      RenderFrameHost* new_host) override;
+      RenderFrameHost* old_frame,
+      RenderFrameHost* new_frame) override;
   NavigationControllerImpl& GetControllerForRenderManager() override;
-  InterstitialPageImpl* GetInterstitialForRenderManager() override;
   bool FocusLocationBarByDefault() override;
   void SetFocusToLocationBar() override;
   bool IsHidden() override;
@@ -986,24 +1009,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void SetHistoryOffsetAndLength(int history_offset,
                                  int history_length) override;
 
-  // Called by InterstitialPageImpl when it creates a RenderFrameHost.
-  void RenderFrameForInterstitialPageCreated(
-      RenderFrameHost* render_frame_host) override;
-
-  // Sets the passed interstitial as the currently showing interstitial.
-  // No interstitial page should already be attached.
-  void AttachInterstitialPage(InterstitialPageImpl* interstitial_page) override;
-
   void MediaMutedStatusChanged(const MediaPlayerId& id, bool muted);
 
-  // Unsets the currently showing interstitial.
-  void DetachInterstitialPage(bool has_focus) override;
-
   void UpdateOverridingUserAgent() override;
 
-  // Unpause the throbber if it was paused.
-  void DidProceedOnInterstitial() override;
-
   // Forces overscroll to be disabled (used by touch emulation).
   void SetForceDisableOverscrollContent(bool force_disable);
 
@@ -1162,6 +1171,11 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void set_portal(Portal* portal) { portal_ = portal; }
   Portal* portal() const { return portal_; }
 
+  // Notifies observers that this WebContents was activated. This contents'
+  // former portal host, |predecessor_contents|, has become a portal pending
+  // adoption.
+  void DidActivatePortal(WebContents* predecessor_contents);
+
   // Sends a page message to notify every process in the frame tree if the
   // web contents is a portal web contents.
   void NotifyInsidePortal(bool inside_portal);
@@ -1170,6 +1184,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // call this directly.
   void OnAppCacheAccessed(const GURL& manifest_url, bool blocked_by_policy);
 
+  void OnServiceWorkerAccessed(RenderFrameHost* render_frame_host,
+                               const GURL& scope,
+                               AllowServiceWorkerResult allowed);
+
   JavaScriptDialogNavigationDeferrer* GetJavaScriptDialogNavigationDeferrer() {
     return javascript_dialog_navigation_deferrer_.get();
   }
@@ -1245,6 +1263,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   FRIEND_TEST_ALL_PREFIXES(DevToolsProtocolTest, PageDisableWithOpenedDialog);
   FRIEND_TEST_ALL_PREFIXES(DevToolsProtocolTest,
                            PageDisableWithNoDialogManager);
+  FRIEND_TEST_ALL_PREFIXES(PluginContentOriginAllowlistTest,
+                           ClearAllowlistOnNavigate);
+  FRIEND_TEST_ALL_PREFIXES(PluginContentOriginAllowlistTest,
+                           SubframeInheritsAllowlist);
   FRIEND_TEST_ALL_PREFIXES(PointerLockBrowserTest,
                            PointerLockInnerContentsCrashes);
   FRIEND_TEST_ALL_PREFIXES(PointerLockBrowserTest, PointerLockOopifCrashes);
@@ -1382,12 +1404,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                       const base::string16& user_input);
 
   // IPC message handlers.
-  void OnDidLoadResourceFromMemoryCache(
-      RenderFrameHostImpl* source,
-      const GURL& url,
-      const std::string& http_request,
-      const std::string& mime_type,
-      network::mojom::RequestDestination request_destination);
   void OnDidRunInsecureContent(RenderFrameHostImpl* source,
                                const GURL& security_origin,
                                const GURL& target_url);
@@ -1396,12 +1412,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void OnUpdateZoomLimits(RenderViewHostImpl* source,
                           int minimum_percent,
                           int maximum_percent);
-  void OnTextAutosizerPageInfoChanged(
-      RenderViewHostImpl* source,
-      const blink::WebTextAutosizerPageInfo& page_info);
-
-  void OnDomOperationResponse(RenderFrameHostImpl* source,
-                              const std::string& json_string);
 #if BUILDFLAG(ENABLE_PLUGINS)
   void OnPepperInstanceCreated(RenderFrameHostImpl* source,
                                int32_t pp_instance);
@@ -1503,10 +1513,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // called once as this call also removes it from the internal map.
   RenderWidgetHostView* GetCreatedWidget(int process_id, int route_id);
 
-  // Finds the new WebContentsImpl by |main_frame_widget_route_id|, initializes
+  // Finds the new CreatedWindow by |main_frame_widget_route_id|, initializes
   // it for renderer-initiated creation, and returns it. Note that this can only
   // be called once as this call also removes it from the internal map.
-  std::unique_ptr<WebContentsImpl> GetCreatedWindow(
+  base::Optional<CreatedWindow> GetCreatedWindow(
       int process_id,
       int main_frame_widget_route_id);
 
@@ -1541,9 +1551,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                                         int history_length);
 
   // Helper functions for sending notifications.
-  void NotifyViewSwapped(RenderViewHost* old_host, RenderViewHost* new_host);
-  void NotifyFrameSwapped(RenderFrameHost* old_host,
-                          RenderFrameHost* new_host,
+  void NotifyViewSwapped(RenderViewHost* old_view, RenderViewHost* new_view);
+  void NotifyFrameSwapped(RenderFrameHost* old_frame,
+                          RenderFrameHost* new_frame,
                           bool is_main_frame);
   void NotifyDisconnected();
 
@@ -1554,8 +1564,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Removes browser plugin embedder if there is one.
   void RemoveBrowserPluginEmbedder();
 
-  // Helper function to invoke WebContentsDelegate::GetSizeForNewRenderView().
-  gfx::Size GetSizeForNewRenderView(bool is_main_frame);
+  // Returns the size that the main frame should be sized to.
+  gfx::Size GetSizeForMainFrame();
 
   void OnFrameRemoved(RenderFrameHost* render_frame_host);
 
@@ -1618,6 +1628,13 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // changes.
   void UpdateVisibilityAndNotifyPageAndView(Visibility new_visibility);
 
+  // Returns UKM source id for the currently displayed page.
+  // Intentionally kept private, prefer using
+  // render_frame_host->GetPageUkmSourceId() if you already have a
+  // |render_frame_host| reference or GetMainFrame()->GetPageUkmSourceId()
+  // if you don't.
+  ukm::SourceId GetCurrentPageUkmSourceId() override;
+
   // Data for core operation ---------------------------------------------------
 
   // Delegate for notifying our owner about stuff. Not owned by us.
@@ -1634,9 +1651,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // provide this.
   RenderViewHostDelegateView* render_view_host_delegate_view_;
 
-  // Tracks created WebContentsImpl objects that have not been shown yet. They
-  // are identified by the process ID and routing ID passed to CreateNewWindow.
-  std::map<GlobalRoutingID, std::unique_ptr<WebContentsImpl>> pending_contents_;
+  // Tracks CreatedWindow objects that have not been shown yet. They are
+  // identified by the process ID and routing ID passed to CreateNewWindow.
+  std::map<GlobalRoutingID, CreatedWindow> pending_contents_;
 
   // This map holds widgets that were created on behalf of the renderer but
   // haven't been shown yet.
@@ -1707,12 +1724,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // See ResumeLoadingCreatedWebContents.
   bool is_resume_pending_;
 
-  // The interstitial page currently shown, if any. Not owned by this class: the
-  // InterstitialPage is self-owned and deletes itself asynchronously when
-  // hidden. Because it may outlive this WebContents, it enters a disabled state
-  // when hidden or preparing for destruction.
-  InterstitialPageImpl* interstitial_page_;
-
   // Data for current page -----------------------------------------------------
 
   // When a title cannot be taken from any entry, this title will be used.
@@ -1730,9 +1741,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // The last published theme color.
   base::Optional<SkColor> last_sent_theme_color_;
 
-  // SourceId for current page from the last committed cross-document
-  // navigation.
-  ukm::SourceId last_committed_source_id_ = ukm::kInvalidSourceId;
   // SourceId of the last committed navigation, either a cross-document or
   // same-document navigation.
   ukm::SourceId last_committed_source_id_including_same_document_ =
@@ -1833,9 +1841,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   std::unique_ptr<BrowserPluginGuest> browser_plugin_guest_;
 
 #if BUILDFLAG(ENABLE_PLUGINS)
-  // Manages the whitelist of plugin content origins exempt from power saving.
-  std::unique_ptr<PluginContentOriginWhitelist>
-      plugin_content_origin_whitelist_;
+  // Manages the allowlist of plugin content origins exempt from power saving.
+  std::unique_ptr<PluginContentOriginAllowlist>
+      plugin_content_origin_allowlist_;
 #endif
 
   // This must be at the end, or else we might get notifications and use other
@@ -1887,8 +1895,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
 
   std::unique_ptr<ScreenOrientationProvider> screen_orientation_provider_;
 
-  std::unique_ptr<ManifestManagerHost> manifest_manager_host_;
-
   // The accessibility mode for all frames. This is queried when each frame
   // is created, and broadcast to all frames when it changes.
   ui::AXMode accessibility_mode_;
@@ -1977,6 +1983,12 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Whether we should override user agent in new tabs.
   bool should_override_user_agent_in_new_tabs_ = false;
 
+  // Used to determine the value of is-user-agent-overriden for renderer
+  // initiated navigations.
+  NavigationController::UserAgentOverrideOption
+      renderer_initiated_user_agent_override_option_ =
+          NavigationController::UA_OVERRIDE_INHERIT;
+
   // Gets notified about changes in viewport fit events.
   std::unique_ptr<DisplayCutoutHostImpl> display_cutout_host_impl_;
 
@@ -2027,6 +2039,9 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Empty std::vector until the first update from the renderer.
   std::vector<blink::mojom::FaviconURLPtr> favicon_urls_;
 
+  // Monitors system screen info changes to notify the renderer.
+  std::unique_ptr<ScreenChangeMonitor> screen_change_monitor_;
+
   // This time is used to record the last time we saw a screen orientation
   // change.
   base::TimeTicks last_screen_orientation_change_time_;
diff --git a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
index 65464d49abe..da87aa9b97e 100644
--- a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
@@ -15,6 +15,7 @@
 #include "base/optional.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
+#include "base/stl_util.h"
 #include "base/strings/pattern.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
@@ -26,6 +27,7 @@
 #include "components/url_formatter/url_formatter.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -40,6 +42,7 @@
 #include "content/public/browser/javascript_dialog_manager.h"
 #include "content/public/browser/load_notification_details.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_types.h"
@@ -51,9 +54,11 @@
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -62,6 +67,9 @@
 #include "content/public/test/test_utils.h"
 #include "content/public/test/url_loader_interceptor.h"
 #include "content/shell/browser/shell.h"
+#include "content/shell/browser/shell_browser_context.h"
+#include "content/shell/browser/shell_content_browser_client.h"
+#include "content/shell/browser/web_test/mock_client_hints_controller_delegate.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "content/test/resource_load_observer.h"
 #include "content/test/test_content_browser_client.h"
@@ -71,7 +79,9 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "services/network/public/mojom/web_client_hints_types.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "url/gurl.h"
@@ -86,21 +96,13 @@ namespace content {
 
 void ResizeWebContentsView(Shell* shell, const gfx::Size& size,
                            bool set_start_page) {
-  // Shell::SizeTo is not implemented on Aura; WebContentsView::SizeContents
-  // works on Win and ChromeOS but not Linux - we need to resize the shell
-  // window on Linux because if we don't, the next layout of the unchanged shell
-  // window will resize WebContentsView back to the previous size.
-  // SizeContents is a hack and should not be relied on.
-#if defined(OS_MACOSX)
-  shell->SizeTo(size);
-  // If |set_start_page| is true, start with blank page to make sure resize
-  // takes effect.
+  // Resizing the web content directly, independent of the Shell window,
+  // requires the RenderWidgetHostView to exist. So we do a navigation
+  // first if |set_start_page| is true.
   if (set_start_page)
     EXPECT_TRUE(NavigateToURL(shell, GURL(url::kAboutBlankURL)));
-#else
-  static_cast<WebContentsImpl*>(shell->web_contents())->GetView()->
-      SizeContents(size);
-#endif  // defined(OS_MACOSX)
+
+  shell->ResizeWebContentForTests(size);
 }
 
 // Class to test that OverrideWebkitPrefs has been called for all relevant
@@ -1257,13 +1259,12 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   const GURL kViewSourceURL(kViewSourceScheme + std::string(":") + kUrl.spec());
   EXPECT_TRUE(NavigateToURL(shell(), kUrl));
 
-  auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-      shell()->web_contents(),
+  WebContentsConsoleObserver console_observer(shell()->web_contents());
+  console_observer.SetPattern(
       "Not allowed to load local resource: view-source:*");
-  shell()->web_contents()->SetDelegate(console_delegate.get());
   EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
                             "window.open('" + kViewSourceURL.spec() + "');"));
-  console_delegate->Wait();
+  console_observer.Wait();
   // Original page shouldn't navigate away, no new tab should be opened.
   EXPECT_EQ(kUrl, shell()->web_contents()->GetURL());
   EXPECT_EQ(1u, Shell::windows().size());
@@ -1277,16 +1278,14 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   const GURL kViewSourceURL(kViewSourceScheme + std::string(":") + kUrl.spec());
   EXPECT_TRUE(NavigateToURL(shell(), kUrl));
 
-  std::unique_ptr<ConsoleObserverDelegate> console_delegate(
-      new ConsoleObserverDelegate(
-          shell()->web_contents(),
-          "Not allowed to load local resource: view-source:*"));
-  shell()->web_contents()->SetDelegate(console_delegate.get());
+  WebContentsConsoleObserver console_observer(shell()->web_contents());
+  console_observer.SetPattern(
+      "Not allowed to load local resource: view-source:*");
 
   EXPECT_TRUE(
       ExecuteScript(shell()->web_contents(),
                     "window.location = '" + kViewSourceURL.spec() + "';"));
-  console_delegate->Wait();
+  console_observer.Wait();
   // Original page shouldn't navigate away.
   EXPECT_EQ(kUrl, shell()->web_contents()->GetURL());
   EXPECT_FALSE(shell()
@@ -1550,6 +1549,7 @@ class TestWCDelegateForDialogsAndFullscreen : public JavaScriptDialogManager,
 
   void AddNewContents(WebContents* source,
                       std::unique_ptr<WebContents> new_contents,
+                      const GURL& target_url,
                       WindowOpenDisposition disposition,
                       const gfx::Rect& initial_rect,
                       bool user_gesture,
@@ -2193,6 +2193,189 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, UserAgentOverride) {
   EXPECT_EQ(kUserAgentOverride, header_value);
 }
 
+// Changes the WebContents and active entry user agent override from
+// DidStartNavigation().
+// in WebContentsObserver::DidStartNavigation().
+class UserAgentInjector : public WebContentsObserver {
+ public:
+  UserAgentInjector(WebContents* web_contents, const std::string& user_agent)
+      : UserAgentInjector(web_contents,
+                          blink::UserAgentOverride::UserAgentOnly(user_agent),
+                          true) {}
+
+  UserAgentInjector(WebContents* web_contents,
+                    const blink::UserAgentOverride& ua_override,
+                    bool is_overriding_user_agent = true)
+      : WebContentsObserver(web_contents),
+        user_agent_override_(ua_override),
+        is_overriding_user_agent_(is_overriding_user_agent) {}
+
+  // WebContentsObserver:
+  void DidStartNavigation(NavigationHandle* navigation_handle) override {
+    web_contents()->SetUserAgentOverride(user_agent_override_, false);
+    navigation_handle->SetIsOverridingUserAgent(is_overriding_user_agent_);
+  }
+
+ private:
+  const blink::UserAgentOverride user_agent_override_;
+  const bool is_overriding_user_agent_ = true;
+};
+
+// Verifies the user-agent string may be changed in DidStartNavigation().
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       SetUserAgentOverrideFromDidStartNavigation) {
+  net::test_server::ControllableHttpResponse http_response(
+      embedded_test_server(), "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const std::string user_agent_override = "foo";
+  UserAgentInjector injector(shell()->web_contents(), user_agent_override);
+  shell()->web_contents()->GetController().LoadURLWithParams(
+      NavigationController::LoadURLParams(
+          embedded_test_server()->GetURL("/test.html")));
+  http_response.WaitForRequest();
+  http_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: text/html; charset=utf-8\r\n"
+      "\r\n"
+      "<html>");
+  http_response.Done();
+  EXPECT_EQ(user_agent_override, http_response.http_request()->headers.at(
+                                     net::HttpRequestHeaders::kUserAgent));
+  WaitForLoadStop(shell()->web_contents());
+  EXPECT_EQ(user_agent_override,
+            EvalJs(shell()->web_contents(), "navigator.userAgent;"));
+}
+
+// Used by SetIsOverridingUserAgent(), adding assertions unique to it.
+class NoEntryUserAgentInjector : public UserAgentInjector {
+ public:
+  NoEntryUserAgentInjector(WebContents* web_contents,
+                           const std::string& user_agent)
+      : UserAgentInjector(web_contents, user_agent) {}
+
+  // WebContentsObserver:
+  void DidStartNavigation(NavigationHandle* navigation_handle) override {
+    UserAgentInjector::DidStartNavigation(navigation_handle);
+    // DidStartNavigation() should only be called once for this test.
+    ASSERT_FALSE(was_did_start_navigation_called_);
+    was_did_start_navigation_called_ = true;
+
+    // This test expects to exercise the code where thee NavigationRequest is
+    // created before the NavigationEntry.
+    EXPECT_EQ(
+        0, static_cast<NavigationRequest*>(navigation_handle)->nav_entry_id());
+  }
+
+ private:
+  bool was_did_start_navigation_called_ = false;
+};
+
+// Verifies the user-agent string may be changed for a NavigationRequest whose
+// NavigationEntry is created after the NavigationRequest is.
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       SetIsOverridingUserAgentNoEntry) {
+  net::test_server::ControllableHttpResponse http_response1(
+      embedded_test_server(), "", true);
+  net::test_server::ControllableHttpResponse http_response2(
+      embedded_test_server(), "", true);
+  net::test_server::ControllableHttpResponse http_response3(
+      embedded_test_server(), "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  shell()->web_contents()->GetController().LoadURLWithParams(
+      NavigationController::LoadURLParams(
+          embedded_test_server()->GetURL("/test.html")));
+  http_response1.WaitForRequest();
+  http_response1.Send(net::HTTP_OK, "text/html", "<html>");
+  http_response1.Done();
+  WaitForLoadStop(shell()->web_contents());
+  shell()->web_contents()->GetController().LoadURLWithParams(
+      NavigationController::LoadURLParams(
+          embedded_test_server()->GetURL("/test2.html")));
+  http_response2.WaitForRequest();
+  http_response2.Send(net::HTTP_OK, "text/html", "<html>");
+  http_response2.Done();
+  WaitForLoadStop(shell()->web_contents());
+
+  // Register a WebContentsObserver that changes the user-agent.
+  const std::string user_agent_override = "foo";
+  NoEntryUserAgentInjector injector(shell()->web_contents(),
+                                    user_agent_override);
+
+  // This triggers creating a NavigationRequest without a NavigationEntry. More
+  // specifically back() triggers creating a pending entry, and because back()
+  // does not complete, the reload() call results in a NavigationRequest with no
+  // NavigationEntry.
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
+                            "history.back(); location.reload();"));
+
+  http_response3.WaitForRequest();
+  http_response3.Send(net::HTTP_OK, "text/html", "<html>");
+  http_response3.Done();
+  EXPECT_EQ(user_agent_override, http_response3.http_request()->headers.at(
+                                     net::HttpRequestHeaders::kUserAgent));
+  WaitForLoadStop(shell()->web_contents());
+  auto* controller = &(shell()->web_contents()->GetController());
+  EXPECT_EQ(1, controller->GetLastCommittedEntryIndex());
+  EXPECT_TRUE(shell()
+                  ->web_contents()
+                  ->GetController()
+                  .GetLastCommittedEntry()
+                  ->GetIsOverridingUserAgent());
+  EXPECT_EQ(user_agent_override,
+            EvalJs(shell()->web_contents(), "navigator.userAgent;"));
+}
+
+class WebContentsImplBrowserTestClientHintsEnabled
+    : public WebContentsImplBrowserTest {
+ public:
+  void SetUp() override {
+    scoped_feature_list_.InitAndEnableFeature(features::kUserAgentClientHint);
+    WebContentsImplBrowserTest::SetUp();
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
+// Verifies client hints are updated when the user-agent is changed in
+// DidStartNavigation().
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTestClientHintsEnabled,
+                       SetUserAgentOverrideFromDidStartNavigation) {
+  MockClientHintsControllerDelegate client_hints_controller_delegate;
+  ShellContentBrowserClient::Get()
+      ->browser_context()
+      ->set_client_hints_controller_delegate(&client_hints_controller_delegate);
+  net::test_server::ControllableHttpResponse http_response(
+      embedded_test_server(), "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+  blink::UserAgentOverride ua_override;
+  ua_override.ua_string_override = "x";
+  ua_override.ua_metadata_override.emplace();
+  ua_override.ua_metadata_override->brand_version_list.emplace_back("x", "y");
+  ua_override.ua_metadata_override->mobile = true;
+  UserAgentInjector injector(shell()->web_contents(), ua_override);
+  shell()->web_contents()->GetController().LoadURLWithParams(
+      NavigationController::LoadURLParams(
+          embedded_test_server()->GetURL("/test.html")));
+  http_response.WaitForRequest();
+  http_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Content-Type: text/html; charset=utf-8\r\n"
+      "\r\n"
+      "<html>");
+  http_response.Done();
+  const std::string mobile_id =
+      blink::kClientHintsHeaderMapping[static_cast<int>(
+          network::mojom::WebClientHintsType::kUAMobile)];
+  ASSERT_TRUE(base::Contains(http_response.http_request()->headers, mobile_id));
+  // "?!" corresponds to "mobile=true".
+  EXPECT_EQ("?1", http_response.http_request()->headers.at(mobile_id));
+  ShellContentBrowserClient::Get()
+      ->browser_context()
+      ->set_client_hints_controller_delegate(nullptr);
+}
+
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
                        DialogsFromJavaScriptEndFullscreen) {
   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell()->web_contents());
@@ -3332,7 +3515,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsNavigate) {
     TestNavigationObserver back_observer(web_contents);
     web_contents->GetRenderWidgetHostWithPageFocus()->ForwardMouseEvent(
         blink::WebMouseEvent(
-            blink::WebInputEvent::kMouseUp, gfx::PointF(51, 50),
+            blink::WebInputEvent::Type::kMouseUp, gfx::PointF(51, 50),
             gfx::PointF(51, 50), blink::WebPointerProperties::Button::kBack, 0,
             blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
     back_observer.Wait();
@@ -3343,7 +3526,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsNavigate) {
     TestNavigationObserver forward_observer(web_contents);
     web_contents->GetRenderWidgetHostWithPageFocus()->ForwardMouseEvent(
         blink::WebMouseEvent(
-            blink::WebInputEvent::kMouseUp, gfx::PointF(51, 50),
+            blink::WebInputEvent::Type::kMouseUp, gfx::PointF(51, 50),
             gfx::PointF(51, 50), blink::WebPointerProperties::Button::kForward,
             0, blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
     forward_observer.Wait();
@@ -3374,8 +3557,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsDontNavigate) {
   RenderWidgetHostImpl* render_widget_host =
       web_contents->GetRenderWidgetHostWithPageFocus();
   render_widget_host->ForwardMouseEvent(blink::WebMouseEvent(
-      blink::WebInputEvent::kMouseUp, gfx::PointF(51, 50), gfx::PointF(51, 50),
-      blink::WebPointerProperties::Button::kBack, 0,
+      blink::WebInputEvent::Type::kMouseUp, gfx::PointF(51, 50),
+      gfx::PointF(51, 50), blink::WebPointerProperties::Button::kBack, 0,
       blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
   RunUntilInputProcessed(render_widget_host);
 
@@ -3406,8 +3589,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsDontNavigate) {
 
   render_widget_host = web_contents->GetRenderWidgetHostWithPageFocus();
   render_widget_host->ForwardMouseEvent(blink::WebMouseEvent(
-      blink::WebInputEvent::kMouseUp, gfx::PointF(51, 50), gfx::PointF(51, 50),
-      blink::WebPointerProperties::Button::kForward, 0,
+      blink::WebInputEvent::Type::kMouseUp, gfx::PointF(51, 50),
+      gfx::PointF(51, 50), blink::WebPointerProperties::Button::kForward, 0,
       blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
   RunUntilInputProcessed(render_widget_host);
   // Wait an action timeout and assert the URL is correct.
@@ -3940,4 +4123,60 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
             web_contents_observer.last_value());
 }
 
+// Verifies assertions for SetRendererInitiatedUserAgentOverrideOption().
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       RendererInitiatedUserAgentOverride) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContents* web_contents = shell()->web_contents();
+
+  // This url triggers a renderer initiated navigation (redirect).
+  NavigationController::LoadURLParams load_params(
+      embedded_test_server()->GetURL("a.co", "/client_redirect.html"));
+  load_params.override_user_agent = NavigationController::UA_OVERRIDE_TRUE;
+
+  const GURL resulting_url =
+      embedded_test_server()->GetURL("a.co", "/title1.html");
+
+  // Assertions for the default SetRendererInitiatedUserAgentOverrideOption(),
+  // which is UA_OVERRIDE_INHERIT.
+  {
+    // The 2 is because the url redirects.
+    TestNavigationObserver observer(shell()->web_contents(), 2);
+    web_contents->GetController().LoadURLWithParams(load_params);
+    observer.Wait();
+
+    NavigationEntry* resulting_entry =
+        web_contents->GetController().GetLastCommittedEntry();
+    ASSERT_TRUE(resulting_entry);
+    EXPECT_EQ(resulting_url, resulting_entry->GetURL());
+    // The resulting entry should override the user-agent as the previous
+    // entry (as created by |load_params|) was configured to override the
+    // user-agent, and the WebContents was configured with
+    // SetRendererInitiatedUserAgentOverrideOption() of
+    // UA_OVERRIDE_INHERIT.
+    EXPECT_TRUE(resulting_entry->GetIsOverridingUserAgent());
+  }
+
+  // Repeat the above, but with UA_OVERRIDE_FALSE.
+  web_contents->SetRendererInitiatedUserAgentOverrideOption(
+      NavigationController::UA_OVERRIDE_FALSE);
+  {
+    // The 2 is because the url redirects.
+    TestNavigationObserver observer(shell()->web_contents(), 2);
+    web_contents->GetController().LoadURLWithParams(load_params);
+    observer.Wait();
+
+    EXPECT_EQ(2, web_contents->GetController().GetEntryCount());
+    NavigationEntry* resulting_entry =
+        web_contents->GetController().GetLastCommittedEntry();
+    ASSERT_TRUE(resulting_entry);
+    EXPECT_EQ(resulting_url, resulting_entry->GetURL());
+    // Even though |load_params| was configured to override the user-agent, the
+    // NavigationEntry for the redirect gets an override user-agent value of
+    // false because
+    // of SetRendererInitiatedUserAgentOverrideOption(UA_OVERRIDE_FALSE).
+    EXPECT_FALSE(resulting_entry->GetIsOverridingUserAgent());
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_contents/web_contents_impl_unittest.cc b/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
index cb2f1d19902..26cfcade0cc 100644
--- a/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
@@ -18,7 +18,6 @@
 #include "build/build_config.h"
 #include "components/download/public/common/download_url_parameters.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
@@ -38,7 +37,6 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/context_menu_params.h"
 #include "content/public/browser/global_request_id.h"
-#include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/javascript_dialog_manager.h"
 #include "content/public/browser/navigation_details.h"
 #include "content/public/browser/notification_details.h"
@@ -53,6 +51,7 @@
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/common/url_utils.h"
 #include "content/public/test/fake_local_frame.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/navigation_simulator.h"
@@ -66,181 +65,17 @@
 #include "content/test/test_web_contents.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/test_data_directory.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
+#include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "url/url_constants.h"
 
 namespace content {
 namespace {
-
-class TestInterstitialPage;
-
-class TestInterstitialPageDelegate : public InterstitialPageDelegate {
- public:
-  explicit TestInterstitialPageDelegate(TestInterstitialPage* interstitial_page)
-      : interstitial_page_(interstitial_page) {}
-  void CommandReceived(const std::string& command) override;
-  std::string GetHTMLContents() override { return std::string(); }
-  void OnDontProceed() override;
-  void OnProceed() override;
-
- private:
-  TestInterstitialPage* interstitial_page_;
-};
-
-class TestInterstitialPage : public InterstitialPageImpl {
- public:
-  enum InterstitialState {
-    INVALID = 0,    // Hasn't yet been initialized.
-    UNDECIDED,      // Initialized, but no decision taken yet.
-    OKED,           // Proceed was called.
-    CANCELED        // DontProceed was called.
-  };
-
-  class Delegate {
-   public:
-    virtual void TestInterstitialPageDeleted(
-        TestInterstitialPage* interstitial) = 0;
-
-   protected:
-    virtual ~Delegate() {}
-  };
-
-  // IMPORTANT NOTE: if you pass stack allocated values for |state| and
-  // |deleted| (like all interstitial related tests do at this point), make sure
-  // to create an instance of the TestInterstitialPageStateGuard class on the
-  // stack in your test.  This will ensure that the TestInterstitialPage states
-  // are cleared when the test finishes.
-  // Not doing so will cause stack trashing if your test does not hide the
-  // interstitial, as in such a case it will be destroyed in the test TearDown
-  // method and will dereference the |deleted| local variable which by then is
-  // out of scope.
-  TestInterstitialPage(WebContentsImpl* contents,
-                       bool new_navigation,
-                       const GURL& url,
-                       InterstitialState* state,
-                       bool* deleted)
-      : InterstitialPageImpl(
-            contents,
-            static_cast<RenderWidgetHostDelegate*>(contents),
-            new_navigation, url, new TestInterstitialPageDelegate(this)),
-        state_(state),
-        deleted_(deleted),
-        command_received_count_(0),
-        delegate_(nullptr) {
-    *state_ = UNDECIDED;
-    *deleted_ = false;
-  }
-
-  ~TestInterstitialPage() override {
-    if (deleted_)
-      *deleted_ = true;
-    if (delegate_)
-      delegate_->TestInterstitialPageDeleted(this);
-  }
-
-  void OnDontProceed() {
-    if (state_)
-      *state_ = CANCELED;
-  }
-  void OnProceed() {
-    if (state_)
-      *state_ = OKED;
-  }
-
-  int command_received_count() const {
-    return command_received_count_;
-  }
-
-  void TestDomOperationResponse(const std::string& json_string) {
-    if (enabled())
-      CommandReceived();
-  }
-
-  void TestDidNavigate(int nav_entry_id,
-                       bool did_create_new_entry,
-                       const GURL& url) {
-    FrameHostMsg_DidCommitProvisionalLoad_Params params;
-    InitNavigateParams(&params, nav_entry_id, did_create_new_entry,
-                       url, ui::PAGE_TRANSITION_TYPED);
-    DidNavigate(GetMainFrame()->GetRenderViewHost(), params);
-  }
-
-  void TestRenderViewTerminated(base::TerminationStatus status,
-                                int error_code) {
-    RenderViewTerminated(GetMainFrame()->GetRenderViewHost(), status,
-                         error_code);
-  }
-
-  bool is_showing() {
-    return static_cast<TestRenderWidgetHostView*>(
-               GetMainFrame()->GetRenderViewHost()->GetWidget()->GetView())
-        ->is_showing();
-  }
-
-  void ClearStates() {
-    state_ = nullptr;
-    deleted_ = nullptr;
-    delegate_ = nullptr;
-  }
-
-  void CommandReceived() {
-    command_received_count_++;
-  }
-
-  void set_delegate(Delegate* delegate) {
-    delegate_ = delegate;
-  }
-
- protected:
-  WebContentsView* CreateWebContentsView() override { return nullptr; }
-
- private:
-  InterstitialState* state_;
-  bool* deleted_;
-  int command_received_count_;
-  Delegate* delegate_;
-};
-
-void TestInterstitialPageDelegate::CommandReceived(const std::string& command) {
-  interstitial_page_->CommandReceived();
-}
-
-void TestInterstitialPageDelegate::OnDontProceed() {
-  interstitial_page_->OnDontProceed();
-}
-
-void TestInterstitialPageDelegate::OnProceed() {
-  interstitial_page_->OnProceed();
-}
-
-class TestInterstitialPageStateGuard : public TestInterstitialPage::Delegate {
- public:
-  explicit TestInterstitialPageStateGuard(
-      TestInterstitialPage* interstitial_page)
-      : interstitial_page_(interstitial_page) {
-    DCHECK(interstitial_page_);
-    interstitial_page_->set_delegate(this);
-  }
-  ~TestInterstitialPageStateGuard() override {
-    if (interstitial_page_)
-      interstitial_page_->ClearStates();
-  }
-
-  void TestInterstitialPageDeleted(
-      TestInterstitialPage* interstitial) override {
-    DCHECK(interstitial_page_ == interstitial);
-    interstitial_page_ = nullptr;
-  }
-
- private:
-  TestInterstitialPage* interstitial_page_;
-};
-
 class WebContentsImplTestBrowserClient : public TestContentBrowserClient {
  public:
   WebContentsImplTestBrowserClient()
@@ -581,6 +416,19 @@ TEST_F(WebContentsImplTest, NavigateToInvalidURL) {
   EXPECT_NE(nullptr, controller().GetPendingEntry());
 }
 
+// Test that we reject NavigateToEntry if the url is a renderer debug URL
+// inside a view-source: URL. This verifies that the navigation is not allowed
+// to proceed after the view-source: URL rewriting logic has run.
+TEST_F(WebContentsImplTest, NavigateToViewSourceRendererDebugURL) {
+  const GURL renderer_debug_url(kChromeUIKillURL);
+  const GURL view_source_debug_url("view-source:" + renderer_debug_url.spec());
+  EXPECT_TRUE(IsRendererDebugURL(renderer_debug_url));
+  EXPECT_FALSE(IsRendererDebugURL(view_source_debug_url));
+  controller().LoadURL(view_source_debug_url, Referrer(),
+                       ui::PAGE_TRANSITION_GENERATED, std::string());
+  EXPECT_EQ(nullptr, controller().GetPendingEntry());
+}
+
 // Test that navigating across a site boundary creates a new RenderViewHost
 // with a new SiteInstance.  Going back should do the same.
 TEST_F(WebContentsImplTest, CrossSiteBoundaries) {
@@ -1359,9 +1207,9 @@ TEST_F(WebContentsImplTest, CrossSiteNotPreemptedDuringBeforeUnload) {
   EXPECT_NE(orig_rfh, pending_rfh);
 
   // Suppose the first navigation tries to commit now, with a
-  // FrameMsg_Stop in flight.  This should not cancel the pending navigation,
-  // but it should act as if the beforeunload completion callback had been
-  // invoked.
+  // blink::mojom::LocalFrame::StopLoading() in flight. This should not cancel
+  // the pending navigation, but it should act as if the beforeunload completion
+  // callback had been invoked.
   same_site_navigation->Commit();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
   EXPECT_EQ(orig_rfh, main_test_rfh());
@@ -1589,1023 +1437,6 @@ TEST_F(WebContentsImplTest,
   contents()->SetDelegate(nullptr);
 }
 
-////////////////////////////////////////////////////////////////////////////////
-// Interstitial Tests
-////////////////////////////////////////////////////////////////////////////////
-
-// Test navigating to a page (with the navigation initiated from the browser,
-// as when a URL is typed in the location bar) that shows an interstitial and
-// creates a new navigation entry, then hiding it without proceeding.
-TEST_F(WebContentsImplTest,
-       ShowInterstitialFromBrowserWithNewNavigationDontProceed) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Initiate a browser navigation that will trigger the interstitial.
-  controller().LoadURL(GURL("http://www.evil.com"), Referrer(),
-                       ui::PAGE_TRANSITION_TYPED, std::string());
-  NavigationEntry* entry = controller().GetPendingEntry();
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url2);
-
-  // Now don't proceed.
-  interstitial->DontProceed();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page (with the navigation initiated from the renderer,
-// as when clicking on a link in the page) that shows an interstitial and
-// creates a new navigation entry, then hiding it without proceeding.
-TEST_F(WebContentsImplTest,
-       ShowInterstitialFromRendererWithNewNavigationDontProceed) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromDocument(url1, main_test_rfh());
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial (no pending entry, the interstitial would have been
-  // triggered by clicking on a link).
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url2);
-
-  // Now don't proceed.
-  interstitial->DontProceed();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial without creating a new
-// navigation entry (this happens when the interstitial is triggered by a
-// sub-resource in the page), then hiding it without proceeding.
-TEST_F(WebContentsImplTest, ShowInterstitialNoNewNavigationDontProceed) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromDocument(url1, main_test_rfh());
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), false, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(0, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  // The URL specified to the interstitial should have been ignored.
-  EXPECT_TRUE(entry->GetURL() == url1);
-
-  // Now don't proceed.
-  interstitial->DontProceed();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page (with the navigation initiated from the browser,
-// as when a URL is typed in the location bar) that shows an interstitial and
-// creates a new navigation entry, then proceeding.
-TEST_F(WebContentsImplTest,
-       ShowInterstitialFromBrowserNewNavigationProceed) {
-  // Navigate to a page.
-  GURL url1("http://www.thepage.com/one");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Initiate a browser navigation that will trigger the interstitial
-  GURL evil_url = GURL("http://www.evil.com");
-  auto navigation =
-      NavigationSimulator::CreateBrowserInitiated(evil_url, contents());
-  navigation->Start();
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url2);
-
-  // Then proceed.
-  interstitial->Proceed();
-  // The interstitial should show until the new navigation commits.
-  RunAllPendingInMessageLoop();
-  ASSERT_FALSE(deleted);
-  EXPECT_EQ(TestInterstitialPage::OKED, state);
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-
-  // Simulate the navigation to the page, that's when the interstitial gets
-  // hidden.
-  navigation->Commit();
-
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_EQ(evil_url, entry->GetURL());
-
-  EXPECT_EQ(2, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page (with the navigation initiated from the renderer,
-// as when clicking on a link in the page) that shows an interstitial and
-// creates a new navigation entry, then proceeding.
-TEST_F(WebContentsImplTest,
-       ShowInterstitialFromRendererNewNavigationProceed) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromDocument(url1, main_test_rfh());
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url2);
-
-  // Then proceed.
-  interstitial->Proceed();
-  // The interstitial should show until the new navigation commits.
-  RunAllPendingInMessageLoop();
-  ASSERT_FALSE(deleted);
-  EXPECT_EQ(TestInterstitialPage::OKED, state);
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-
-  // Simulate the navigation to the page, that's when the interstitial gets
-  // hidden.
-  GURL url3("http://www.thepage.com");
-  NavigationSimulator::NavigateAndCommitFromDocument(url3, main_test_rfh());
-
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url3);
-
-  EXPECT_EQ(2, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial without creating a new
-// navigation entry (this happens when the interstitial is triggered by a
-// sub-resource in the page), then proceeding.
-TEST_F(WebContentsImplTest, ShowInterstitialNoNewNavigationProceed) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromDocument(url1, main_test_rfh());
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), false, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  // Let's commit the interstitial navigation.
-  interstitial->TestDidNavigate(0, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_TRUE(contents()->ShowingInterstitialPage());
-  EXPECT_TRUE(contents()->GetInterstitialPage() == interstitial);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  // The URL specified to the interstitial should have been ignored.
-  EXPECT_TRUE(entry->GetURL() == url1);
-
-  // Then proceed.
-  interstitial->Proceed();
-  // Since this is not a new navigation, the previous page is dismissed right
-  // away and shows the original page.
-  EXPECT_EQ(TestInterstitialPage::OKED, state);
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == url1);
-
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial, then navigating away.
-TEST_F(WebContentsImplTest, ShowInterstitialThenNavigate) {
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url);
-
-  // While interstitial showing, navigate to a new URL.
-  const GURL url2("http://www.yahoo.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url2);
-
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial, then going back.
-TEST_F(WebContentsImplTest, ShowInterstitialThenGoBack) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL interstitial_url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true,
-                                interstitial_url);
-  EXPECT_EQ(2, controller().GetEntryCount());
-
-  // While the interstitial is showing, go back. This will dismiss the
-  // interstitial and not initiate a navigation, but just show the existing
-  // RenderFrameHost.
-  controller().GoBack();
-
-  // Make sure we are back to the original page and that the interstitial is
-  // gone.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_TRUE(entry);
-  EXPECT_EQ(url1.spec(), entry->GetURL().spec());
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial, has a renderer crash,
-// and then goes back.
-TEST_F(WebContentsImplTest, ShowInterstitialCrashRendererThenGoBack) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-  NavigationEntry* entry = controller().GetLastCommittedEntry();
-
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL interstitial_url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true,
-                                interstitial_url);
-
-  // Crash the renderer
-  main_test_rfh()->GetProcess()->SimulateCrash();
-
-  // While the interstitial is showing, go back. This will dismiss the
-  // interstitial and not initiate a navigation, but just show the existing
-  // RenderFrameHost.
-  controller().GoBack();
-
-  // Make sure we are back to the original page and that the interstitial is
-  // gone.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  entry = controller().GetVisibleEntry();
-  ASSERT_TRUE(entry);
-  EXPECT_EQ(url1.spec(), entry->GetURL().spec());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial, has the renderer crash,
-// and then navigates to the interstitial.
-TEST_F(WebContentsImplTest, ShowInterstitialCrashRendererThenNavigate) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL interstitial_url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-
-  // Crash the renderer
-  main_test_rfh()->GetProcess()->SimulateCrash();
-
-  interstitial->TestDidNavigate(interstitial_entry_id, true,
-                                interstitial_url);
-}
-
-// Test navigating to a page that shows an interstitial, then close the
-// contents.
-TEST_F(WebContentsImplTest, ShowInterstitialThenCloseTab) {
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url);
-
-  // Now close the contents.
-  DeleteContents();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test navigating to a page that shows an interstitial, then close the
-// contents.
-TEST_F(WebContentsImplTest, ShowInterstitialThenCloseAndShutdown) {
-  // Show interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url);
-  TestRenderFrameHost* rfh =
-      static_cast<TestRenderFrameHost*>(interstitial->GetMainFrame());
-
-  // Now close the contents.
-  DeleteContents();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-
-  // Before the interstitial has a chance to process its shutdown task,
-  // simulate quitting the browser.  This goes through all processes and
-  // tells them to destruct.
-  rfh->GetProcess()->SimulateCrash();
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test for https://crbug.com/730592, where deleting a WebContents while its
-// interstitial is navigating could lead to a crash.
-TEST_F(WebContentsImplTest, CreateInterstitialForClosingTab) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Initiate a browser navigation that will trigger an interstitial.
-  controller().LoadURL(GURL("http://www.evil.com"), Referrer(),
-                       ui::PAGE_TRANSITION_TYPED, std::string());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state = TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  TestRenderFrameHost* interstitial_rfh =
-      static_cast<TestRenderFrameHost*>(interstitial->GetMainFrame());
-
-  // Ensure the InterfaceProvider for the initial empty document is bound.
-  interstitial_rfh->InitializeRenderFrameIfNeeded();
-
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-
-  // Close the tab before the interstitial commits.
-  DeleteContents();
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-
-  // Simulate a commit in the interstitial page, which should not crash.
-  interstitial_rfh->SimulateNavigationCommit(url2);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test for https://crbug.com/703655, where navigating a tab and showing an
-// interstitial could race.
-TEST_F(WebContentsImplTest, TabNavigationDoesntRaceInterstitial) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Initiate a browser navigation that will trigger an interstitial.
-  GURL evil_url("http://www.evil.com");
-  controller().LoadURL(evil_url, Referrer(), ui::PAGE_TRANSITION_TYPED,
-                       std::string());
-  NavigationEntry* entry = contents()->GetController().GetPendingEntry();
-  ASSERT_TRUE(entry);
-  EXPECT_EQ(evil_url, entry->GetURL());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state = TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  // The interstitial should not show until its navigation has committed.
-  EXPECT_FALSE(interstitial->is_showing());
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-
-  // At this point, there is an interstitial that has been instructed to show
-  // but has not yet committed its own navigation. This is a window; navigate
-  // back one page within this window.
-  //
-  // Because the page with the interstitial did not commit, this invokes an
-  // early return in NavigationControllerImpl::NavigateToPendingEntry which just
-  // drops the pending entry, so no committing is required.
-  controller().GoBack();
-  entry = contents()->GetController().GetPendingEntry();
-  ASSERT_FALSE(entry);
-
-  // The interstitial should be gone.
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test that after Proceed is called and an interstitial is still shown, no more
-// commands get executed.
-TEST_F(WebContentsImplTest, ShowInterstitialProceedMultipleCommands) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-
-  // Run a command.
-  EXPECT_EQ(0, interstitial->command_received_count());
-  interstitial->TestDomOperationResponse("toto");
-  EXPECT_EQ(1, interstitial->command_received_count());
-
-  // Then proceed.
-  interstitial->Proceed();
-  RunAllPendingInMessageLoop();
-  ASSERT_FALSE(deleted);
-
-  // While the navigation to the new page is pending, send other commands, they
-  // should be ignored.
-  interstitial->TestDomOperationResponse("hello");
-  interstitial->TestDomOperationResponse("hi");
-  EXPECT_EQ(1, interstitial->command_received_count());
-}
-
-// Test showing an interstitial while another interstitial is already showing.
-TEST_F(WebContentsImplTest, ShowInterstitialOnInterstitial) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL start_url("http://www.thepage.com/one");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), start_url);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state1 =
-      TestInterstitialPage::INVALID;
-  bool deleted1 = false;
-  GURL url1("http://interstitial1");
-  TestInterstitialPage* interstitial1 =
-      new TestInterstitialPage(contents(), true, url1, &state1, &deleted1);
-  TestInterstitialPageStateGuard state_guard1(interstitial1);
-  interstitial1->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial1->TestDidNavigate(interstitial_entry_id, true, url1);
-
-  // Now show another interstitial.
-  TestInterstitialPage::InterstitialState state2 =
-      TestInterstitialPage::INVALID;
-  bool deleted2 = false;
-  GURL url2("http://interstitial2");
-  TestInterstitialPage* interstitial2 =
-      new TestInterstitialPage(contents(), true, url2, &state2, &deleted2);
-  TestInterstitialPageStateGuard state_guard2(interstitial2);
-  interstitial2->Show();
-  interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial2->TestDidNavigate(interstitial_entry_id, true, url2);
-
-  // Showing interstitial2 should have caused interstitial1 to go away.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state1);
-  EXPECT_EQ(TestInterstitialPage::UNDECIDED, state2);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted1);
-  ASSERT_FALSE(deleted2);
-
-  // Let's make sure interstitial2 is working as intended.
-  interstitial2->Proceed();
-  GURL landing_url("http://www.thepage.com/two");
-  NavigationSimulator::NavigateAndCommitFromDocument(landing_url,
-                                                     main_test_rfh());
-
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == landing_url);
-  EXPECT_EQ(2, controller().GetEntryCount());
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted2);
-}
-
-// Test showing an interstitial, proceeding and then navigating to another
-// interstitial.
-TEST_F(WebContentsImplTest, ShowInterstitialProceedShowInterstitial) {
-  // Navigate to a page so we have a navigation entry in the controller.
-  GURL start_url("http://www.thepage.com/one");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), start_url);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state1 =
-      TestInterstitialPage::INVALID;
-  bool deleted1 = false;
-  GURL url1("http://interstitial1");
-  TestInterstitialPage* interstitial1 =
-      new TestInterstitialPage(contents(), true, url1, &state1, &deleted1);
-  TestInterstitialPageStateGuard state_guard1(interstitial1);
-  interstitial1->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial1->TestDidNavigate(interstitial_entry_id, true, url1);
-
-  // Take action.  The interstitial won't be hidden until the navigation is
-  // committed.
-  interstitial1->Proceed();
-  EXPECT_EQ(TestInterstitialPage::OKED, state1);
-
-  // Now show another interstitial (simulating the navigation causing another
-  // interstitial).
-  TestInterstitialPage::InterstitialState state2 =
-      TestInterstitialPage::INVALID;
-  bool deleted2 = false;
-  GURL url2("http://interstitial2");
-  TestInterstitialPage* interstitial2 =
-      new TestInterstitialPage(contents(), true, url2, &state2, &deleted2);
-  TestInterstitialPageStateGuard state_guard2(interstitial2);
-  interstitial2->Show();
-  interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial2->TestDidNavigate(interstitial_entry_id, true, url2);
-
-  // Showing interstitial2 should have caused interstitial1 to go away.
-  EXPECT_EQ(TestInterstitialPage::UNDECIDED, state2);
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted1);
-  ASSERT_FALSE(deleted2);
-
-  // Let's make sure interstitial2 is working as intended.
-  interstitial2->Proceed();
-  GURL landing_url("http://www.thepage.com/two");
-  NavigationSimulator::NavigateAndCommitFromDocument(landing_url,
-                                                     main_test_rfh());
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted2);
-  EXPECT_FALSE(contents()->ShowingInterstitialPage());
-  EXPECT_EQ(nullptr, contents()->GetInterstitialPage());
-  NavigationEntry* entry = controller().GetVisibleEntry();
-  ASSERT_NE(nullptr, entry);
-  EXPECT_TRUE(entry->GetURL() == landing_url);
-  EXPECT_EQ(2, controller().GetEntryCount());
-}
-
-// Test that navigating away from an interstitial while it's loading cause it
-// not to show.
-TEST_F(WebContentsImplTest, NavigateBeforeInterstitialShows) {
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL interstitial_url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-
-  // Let's simulate a navigation initiated from the browser before the
-  // interstitial finishes loading.
-  const GURL url("http://www.google.com");
-  controller().LoadURL(
-      url, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
-  EXPECT_FALSE(interstitial->is_showing());
-  RunAllPendingInMessageLoop();
-  ASSERT_FALSE(deleted);
-
-  // Now let's make the interstitial navigation commit.
-  interstitial->TestDidNavigate(interstitial_entry_id, true,
-                                interstitial_url);
-
-  // After it loaded the interstitial should be gone.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Test that a new request to show an interstitial while an interstitial is
-// pending does not cause problems. htp://crbug/29655 and htp://crbug/9442.
-TEST_F(WebContentsImplTest, TwoQuickInterstitials) {
-  GURL interstitial_url("http://interstitial");
-
-  // Show a first interstitial.
-  TestInterstitialPage::InterstitialState state1 =
-      TestInterstitialPage::INVALID;
-  bool deleted1 = false;
-  TestInterstitialPage* interstitial1 =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state1, &deleted1);
-  TestInterstitialPageStateGuard state_guard1(interstitial1);
-  interstitial1->Show();
-
-  // Show another interstitial on that same contents before the first one had
-  // time to load.
-  TestInterstitialPage::InterstitialState state2 =
-      TestInterstitialPage::INVALID;
-  bool deleted2 = false;
-  TestInterstitialPage* interstitial2 =
-      new TestInterstitialPage(contents(), true, interstitial_url,
-                               &state2, &deleted2);
-  TestInterstitialPageStateGuard state_guard2(interstitial2);
-  interstitial2->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-
-  // The first interstitial should have been closed and deleted.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state1);
-  // The 2nd one should still be OK.
-  EXPECT_EQ(TestInterstitialPage::UNDECIDED, state2);
-
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted1);
-  ASSERT_FALSE(deleted2);
-
-  // Make the interstitial navigation commit it should be showing.
-  interstitial2->TestDidNavigate(interstitial_entry_id, true,
-                                 interstitial_url);
-  EXPECT_EQ(interstitial2, contents()->GetInterstitialPage());
-}
-
-// Test showing an interstitial and have its renderer crash.
-TEST_F(WebContentsImplTest, InterstitialCrasher) {
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  // Simulate a renderer crash before the interstitial is shown.
-  interstitial->TestRenderViewTerminated(
-      base::TERMINATION_STATUS_PROCESS_CRASHED, -1);
-  // The interstitial should have been dismissed.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-
-  // Now try again but this time crash the interstitial after it was shown.
-  interstitial =
-      new TestInterstitialPage(contents(), true, url, &state, &deleted);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url);
-  // Simulate a renderer crash.
-  interstitial->TestRenderViewTerminated(
-      base::TERMINATION_STATUS_PROCESS_CRASHED, -1);
-  // The interstitial should have been dismissed.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-}
-
-// Tests that showing an interstitial as a result of a browser initiated
-// navigation while an interstitial is showing does not remove the pending
-// entry (see http://crbug.com/9791).
-TEST_F(WebContentsImplTest, NewInterstitialDoesNotCancelPendingEntry) {
-  const char kUrl[] = "http://www.badguys.com/";
-  const GURL kGURL(kUrl);
-
-  // Start a navigation to a page
-  contents()->GetController().LoadURL(
-      kGURL, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
-
-  // Simulate that navigation triggering an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, kGURL, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, kGURL);
-
-  // Initiate a new navigation from the browser that also triggers an
-  // interstitial.
-  contents()->GetController().LoadURL(
-      kGURL, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
-  TestInterstitialPage::InterstitialState state2 =
-      TestInterstitialPage::INVALID;
-  bool deleted2 = false;
-  TestInterstitialPage* interstitial2 =
-      new TestInterstitialPage(contents(), true, kGURL, &state2, &deleted2);
-  TestInterstitialPageStateGuard state_guard2(interstitial2);
-  interstitial2->Show();
-  interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial2->TestDidNavigate(interstitial_entry_id, true, kGURL);
-
-  // Make sure we still have an entry.
-  NavigationEntry* entry = contents()->GetController().GetPendingEntry();
-  ASSERT_TRUE(entry);
-  EXPECT_EQ(kUrl, entry->GetURL().spec());
-
-  // And that the first interstitial is gone, but not the second.
-  EXPECT_EQ(TestInterstitialPage::CANCELED, state);
-  EXPECT_EQ(TestInterstitialPage::UNDECIDED, state2);
-  RunAllPendingInMessageLoop();
-  EXPECT_TRUE(deleted);
-  EXPECT_FALSE(deleted2);
-}
-
-// Tests that Javascript messages are not shown while an interstitial is
-// showing.
-TEST_F(WebContentsImplTest, NoJSMessageOnInterstitials) {
-  const char kUrl[] = "http://www.badguys.com/";
-  const GURL kGURL(kUrl);
-
-  // Start a navigation to a page
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), kGURL);
-
-  // Simulate showing an interstitial while the page is showing.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, kGURL, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, kGURL);
-
-  // While the interstitial is showing, let's simulate the hidden page
-  // attempting to show a JS message.
-  contents()->RunJavaScriptDialog(
-      main_test_rfh(), base::ASCIIToUTF16("This is an informative message"),
-      base::ASCIIToUTF16("OK"), JAVASCRIPT_DIALOG_TYPE_ALERT,
-      base::DoNothing());
-  EXPECT_TRUE(contents()->last_dialog_suppressed_);
-}
-
-// Makes sure that if the source passed to CopyStateFromAndPrune has an
-// interstitial it isn't copied over to the destination.
-TEST_F(WebContentsImplTest, CopyStateFromAndPruneSourceInterstitial) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url1);
-  EXPECT_EQ(1, controller().GetEntryCount());
-
-  // Initiate a browser navigation that will trigger the interstitial
-  controller().LoadURL(GURL("http://www.evil.com"), Referrer(),
-                        ui::PAGE_TRANSITION_TYPED, std::string());
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url2("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(contents(), true, url2, &state, &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id = controller().GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url2);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_EQ(2, controller().GetEntryCount());
-
-  // Create another NavigationController.
-  GURL url3("http://foo2");
-  std::unique_ptr<TestWebContents> other_contents(
-      static_cast<TestWebContents*>(CreateTestWebContents().release()));
-  NavigationControllerImpl& other_controller = other_contents->GetController();
-  other_contents->NavigateAndCommit(url3);
-  other_contents->ExpectSetHistoryOffsetAndLength(1, 2);
-  other_controller.CopyStateFromAndPrune(&controller(), false);
-
-  // The merged controller should only have two entries: url1 and url2.
-  ASSERT_EQ(2, other_controller.GetEntryCount());
-  EXPECT_EQ(1, other_controller.GetCurrentEntryIndex());
-  EXPECT_EQ(url1, other_controller.GetEntryAtIndex(0)->GetURL());
-  EXPECT_EQ(url3, other_controller.GetEntryAtIndex(1)->GetURL());
-
-  // And the merged controller shouldn't be showing an interstitial.
-  EXPECT_FALSE(other_contents->ShowingInterstitialPage());
-}
-
-// Makes sure that CopyStateFromAndPrune cannot be called if the target is
-// showing an interstitial.
-TEST_F(WebContentsImplTest, CopyStateFromAndPruneTargetInterstitial) {
-  // Navigate to a page.
-  GURL url1("http://www.google.com");
-  contents()->NavigateAndCommit(url1);
-
-  // Create another NavigationController.
-  std::unique_ptr<TestWebContents> other_contents(
-      static_cast<TestWebContents*>(CreateTestWebContents().release()));
-  NavigationControllerImpl& other_controller = other_contents->GetController();
-
-  // Navigate it to url2.
-  GURL url2("http://foo2");
-  other_contents->NavigateAndCommit(url2);
-
-  // Show an interstitial.
-  TestInterstitialPage::InterstitialState state =
-      TestInterstitialPage::INVALID;
-  bool deleted = false;
-  GURL url3("http://interstitial");
-  TestInterstitialPage* interstitial =
-      new TestInterstitialPage(other_contents.get(), true, url3, &state,
-                               &deleted);
-  TestInterstitialPageStateGuard state_guard(interstitial);
-  interstitial->Show();
-  int interstitial_entry_id =
-      other_controller.GetTransientEntry()->GetUniqueID();
-  interstitial->TestDidNavigate(interstitial_entry_id, true, url3);
-  EXPECT_TRUE(interstitial->is_showing());
-  EXPECT_EQ(2, other_controller.GetEntryCount());
-
-  // Ensure that we do not allow calling CopyStateFromAndPrune when an
-  // interstitial is showing in the target.
-  EXPECT_FALSE(other_controller.CanPruneAllButLastCommitted());
-}
-
 // Regression test for http://crbug.com/168611 - the URLs passed by the
 // DidFinishLoad and DidFailLoadWithError IPCs should get filtered.
 TEST_F(WebContentsImplTest, FilterURLs) {
@@ -2644,7 +1475,7 @@ TEST_F(WebContentsImplTest, PendingContentsDestroyed) {
   auto other_contents = base::WrapUnique(
       static_cast<TestWebContents*>(CreateTestWebContents().release()));
   content::TestWebContents* test_web_contents = other_contents.get();
-  contents()->AddPendingContents(std::move(other_contents));
+  contents()->AddPendingContents(std::move(other_contents), GURL());
   RenderWidgetHost* widget =
       test_web_contents->GetMainFrame()->GetRenderWidgetHost();
   int process_id = widget->GetProcess()->GetID();
@@ -2653,14 +1484,15 @@ TEST_F(WebContentsImplTest, PendingContentsDestroyed) {
   // TODO(erikchen): Fix ownership semantics of WebContents. Nothing should be
   // able to delete it beside from the owner. https://crbug.com/832879.
   delete test_web_contents;
-  EXPECT_EQ(nullptr, contents()->GetCreatedWindow(process_id, widget_id));
+  EXPECT_FALSE(contents()->GetCreatedWindow(process_id, widget_id).has_value());
 }
 
 TEST_F(WebContentsImplTest, PendingContentsShown) {
+  GURL url("http://example.com");
   auto other_contents = base::WrapUnique(
       static_cast<TestWebContents*>(CreateTestWebContents().release()));
   content::TestWebContents* test_web_contents = other_contents.get();
-  contents()->AddPendingContents(std::move(other_contents));
+  contents()->AddPendingContents(std::move(other_contents), url);
 
   RenderWidgetHost* widget =
       test_web_contents->GetMainFrame()->GetRenderWidgetHost();
@@ -2668,10 +1500,15 @@ TEST_F(WebContentsImplTest, PendingContentsShown) {
   int widget_id = widget->GetRoutingID();
 
   // The first call to GetCreatedWindow pops it off the pending list.
-  EXPECT_EQ(test_web_contents,
-            contents()->GetCreatedWindow(process_id, widget_id).get());
-  // A second call should return nullptr, verifying that it's been forgotten.
-  EXPECT_EQ(nullptr, contents()->GetCreatedWindow(process_id, widget_id));
+  base::Optional<CreatedWindow> created_window =
+      contents()->GetCreatedWindow(process_id, widget_id);
+  EXPECT_TRUE(created_window.has_value());
+  EXPECT_EQ(test_web_contents, created_window->contents.get());
+  // Validate target_url.
+  EXPECT_EQ(url, created_window->target_url);
+
+  // A second call should return nullopt, verifying that it's been forgotten.
+  EXPECT_FALSE(contents()->GetCreatedWindow(process_id, widget_id).has_value());
 }
 
 TEST_F(WebContentsImplTest, CapturerOverridesPreferredSize) {
@@ -2833,57 +1670,24 @@ TEST_F(WebContentsImplTest, OccludeWithCapturer) {
   HideOrOccludeWithCapturerTest(contents(), Visibility::OCCLUDED);
 }
 
-namespace {
-
-void CheckVisibilityMessage(const IPC::Message* message,
-                            PageVisibilityState expected_state) {
-  ASSERT_TRUE(message);
-  std::tuple<content::PageVisibilityState> params;
-  ASSERT_TRUE(PageMsg_VisibilityChanged::Read(message, &params));
-  EXPECT_EQ(expected_state, std::get<0>(params));
-}
-
-}  // namespace
-
 TEST_F(WebContentsImplTest, HiddenCapture) {
-  TestRenderViewHost* const rvh =
-      static_cast<TestRenderViewHost*>(contents()->GetRenderViewHost());
   TestRenderWidgetHostView* rwhv = static_cast<TestRenderWidgetHostView*>(
       contents()->GetRenderWidgetHostView());
-  MockRenderProcessHost* const rph = rvh->GetProcess();
-  IPC::TestSink* const sink = &rph->sink();
 
   contents()->UpdateWebContentsVisibility(Visibility::VISIBLE);
   contents()->UpdateWebContentsVisibility(Visibility::HIDDEN);
   EXPECT_EQ(Visibility::HIDDEN, contents()->GetVisibility());
 
-  sink->ClearMessages();
   contents()->IncrementCapturerCount(gfx::Size(), /* stay_hidden */ true);
-  const IPC::Message* visibility_message =
-      sink->GetUniqueMessageMatching(PageMsg_VisibilityChanged::ID);
-  CheckVisibilityMessage(visibility_message,
-                         PageVisibilityState::kHiddenButPainting);
   EXPECT_TRUE(rwhv->is_showing());
 
-  sink->ClearMessages();
   contents()->IncrementCapturerCount(gfx::Size(), /* stay_hidden */ false);
-  visibility_message =
-      sink->GetUniqueMessageMatching(PageMsg_VisibilityChanged::ID);
-  CheckVisibilityMessage(visibility_message, PageVisibilityState::kVisible);
   EXPECT_TRUE(rwhv->is_showing());
 
-  sink->ClearMessages();
   contents()->DecrementCapturerCount(/* stay_hidden */ true);
-  visibility_message =
-      sink->GetUniqueMessageMatching(PageMsg_VisibilityChanged::ID);
-  CheckVisibilityMessage(visibility_message, PageVisibilityState::kVisible);
   EXPECT_TRUE(rwhv->is_showing());
 
-  sink->ClearMessages();
   contents()->DecrementCapturerCount(/* stay_hidden */ false);
-  visibility_message =
-      sink->GetUniqueMessageMatching(PageMsg_VisibilityChanged::ID);
-  CheckVisibilityMessage(visibility_message, PageVisibilityState::kHidden);
   EXPECT_FALSE(rwhv->is_showing());
 }
 
@@ -3524,18 +2328,18 @@ TEST_F(WebContentsImplTest, ResetJavaScriptDialogOnUserNavigate) {
 
 TEST_F(WebContentsImplTest, StartingSandboxFlags) {
   WebContents::CreateParams params(browser_context());
-  const blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kPopups |
-      blink::mojom::WebSandboxFlags::kModals |
-      blink::mojom::WebSandboxFlags::kTopNavigation;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kPopups |
+      network::mojom::WebSandboxFlags::kModals |
+      network::mojom::WebSandboxFlags::kTopNavigation;
   params.starting_sandbox_flags = expected_flags;
   std::unique_ptr<WebContentsImpl> new_contents(
       WebContentsImpl::CreateWithOpener(params, nullptr));
   FrameTreeNode* root = new_contents->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags pending_flags =
+  network::mojom::WebSandboxFlags pending_flags =
       root->pending_frame_policy().sandbox_flags;
   EXPECT_EQ(pending_flags, expected_flags);
-  blink::mojom::WebSandboxFlags effective_flags =
+  network::mojom::WebSandboxFlags effective_flags =
       root->effective_frame_policy().sandbox_flags;
   EXPECT_EQ(effective_flags, expected_flags);
 }
diff --git a/chromium/content/browser/web_contents/web_contents_observer_browsertest.cc b/chromium/content/browser/web_contents/web_contents_observer_browsertest.cc
new file mode 100644
index 00000000000..44078c4b8f6
--- /dev/null
+++ b/chromium/content/browser/web_contents/web_contents_observer_browsertest.cc
@@ -0,0 +1,608 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/test/scoped_feature_list.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/service_worker/embedded_worker_instance.h"
+#include "content/browser/service_worker/embedded_worker_status.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/allow_service_worker_result.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/shell/browser/shell.h"
+#include "content/test/test_content_browser_client.h"
+#include "net/dns/mock_host_resolver.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using testing::_;
+using testing::NotNull;
+
+namespace content {
+
+class WebContentsObserverBrowserTest : public ContentBrowserTest {
+ public:
+  WebContentsObserverBrowserTest() = default;
+
+ protected:
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    SetupCrossSiteRedirector(embedded_test_server());
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
+  WebContentsImpl* web_contents() const {
+    return static_cast<WebContentsImpl*>(shell()->web_contents());
+  }
+
+  RenderFrameHostImpl* top_frame_host() {
+    return static_cast<RenderFrameHostImpl*>(web_contents()->GetMainFrame());
+  }
+
+  base::test::ScopedFeatureList feature_list_;
+};
+
+namespace {
+
+class ServiceWorkerAccessObserver : public WebContentsObserver {
+ public:
+  ServiceWorkerAccessObserver(WebContentsImpl* web_contents)
+      : WebContentsObserver(web_contents) {}
+
+  MOCK_METHOD3(OnServiceWorkerAccessed,
+               void(NavigationHandle*, const GURL&, AllowServiceWorkerResult));
+  MOCK_METHOD3(OnServiceWorkerAccessed,
+               void(RenderFrameHost*, const GURL&, AllowServiceWorkerResult));
+};
+
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       OnServiceWorkerAccessed) {
+  GURL service_worker_scope =
+      embedded_test_server()->GetURL("/service_worker/");
+  {
+    // 1) Navigate to a page and register a ServiceWorker. Expect a notification
+    // to be called when the service worker is accessed from a frame.
+    ServiceWorkerAccessObserver observer(web_contents());
+    base::RunLoop run_loop;
+    EXPECT_CALL(
+        observer,
+        OnServiceWorkerAccessed(
+            testing::Matcher<RenderFrameHost*>(NotNull()), service_worker_scope,
+            AllowServiceWorkerResult::FromPolicy(false, false)))
+        .WillOnce([&]() { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(
+        web_contents(), embedded_test_server()->GetURL(
+                            "/service_worker/create_service_worker.html")));
+    EXPECT_EQ("DONE",
+              EvalJs(top_frame_host(),
+                     "register('fetch_event.js', '/service_worker/');"));
+    run_loop.Run();
+  }
+
+  {
+    // 2) Navigate to a page in scope of the previously registered ServiceWorker
+    // and expect to get a notification about ServiceWorker being accessed for
+    // a navigation.
+    ServiceWorkerAccessObserver observer(web_contents());
+    base::RunLoop run_loop;
+    EXPECT_CALL(observer,
+                OnServiceWorkerAccessed(
+                    testing::Matcher<NavigationHandle*>(NotNull()),
+                    service_worker_scope,
+                    AllowServiceWorkerResult::FromPolicy(false, false)))
+        .WillOnce([&]() { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(
+        web_contents(),
+        embedded_test_server()->GetURL("/service_worker/empty.html")));
+    run_loop.Run();
+  }
+}
+
+namespace {
+
+class ServiceWorkerAccessContentBrowserClient
+    : public TestContentBrowserClient {
+ public:
+  ServiceWorkerAccessContentBrowserClient() = default;
+
+  void SetJavascriptAllowed(bool allowed) { javascript_allowed_ = allowed; }
+
+  void SetCookiesAllowed(bool allowed) { cookies_allowed_ = allowed; }
+
+  AllowServiceWorkerResult AllowServiceWorkerOnUI(
+      const GURL& scope,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
+      const GURL& script_url,
+      BrowserContext* context) override {
+    return AllowServiceWorkerResult::FromPolicy(!javascript_allowed_,
+                                                !cookies_allowed_);
+  }
+
+ private:
+  bool cookies_allowed_ = true;
+  bool javascript_allowed_ = true;
+};
+
+}  // namespace
+
+class WebContentsObserverWithSWonUIBrowserTest
+    : public WebContentsObserverBrowserTest {
+ public:
+  WebContentsObserverWithSWonUIBrowserTest() {
+    feature_list_.InitAndEnableFeature(features::kServiceWorkerOnUI);
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverWithSWonUIBrowserTest,
+                       OnServiceWorkerAccessed_ContentClientBlocked) {
+  GURL service_worker_scope =
+      embedded_test_server()->GetURL("/service_worker/");
+  {
+    // 1) Navigate to a page and register a ServiceWorker. Expect a notification
+    // to be called when the service worker is accessed from a frame.
+    ServiceWorkerAccessObserver observer(web_contents());
+    base::RunLoop run_loop;
+    EXPECT_CALL(
+        observer,
+        OnServiceWorkerAccessed(
+            testing::Matcher<RenderFrameHost*>(NotNull()), service_worker_scope,
+            AllowServiceWorkerResult::FromPolicy(false, false)))
+        .WillOnce([&]() { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(
+        web_contents(), embedded_test_server()->GetURL(
+                            "/service_worker/create_service_worker.html")));
+    EXPECT_EQ("DONE",
+              EvalJs(top_frame_host(),
+                     "register('fetch_event.js', '/service_worker/');"));
+    run_loop.Run();
+  }
+
+  // 2) Set content client and disallow javascript.
+  ServiceWorkerAccessContentBrowserClient content_browser_client;
+  ContentBrowserClient* old_client =
+      SetBrowserClientForTesting(&content_browser_client);
+  content_browser_client.SetJavascriptAllowed(false);
+
+  {
+    // 2) Navigate to a page in scope of the previously registered ServiceWorker
+    // and expect to get a notification about ServiceWorker being accessed for
+    // a navigation. Javascript should be blocked according to the policy.
+    ServiceWorkerAccessObserver observer(web_contents());
+    base::RunLoop run_loop;
+    EXPECT_CALL(observer, OnServiceWorkerAccessed(
+                              testing::Matcher<NavigationHandle*>(NotNull()),
+                              service_worker_scope,
+                              AllowServiceWorkerResult::FromPolicy(
+                                  /* javascript_blocked=*/true,
+                                  /* cookies_blocked=*/false)))
+        .WillOnce([&]() { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(
+        web_contents(),
+        embedded_test_server()->GetURL("/service_worker/empty.html")));
+    run_loop.Run();
+  }
+
+  content_browser_client.SetJavascriptAllowed(true);
+  content_browser_client.SetCookiesAllowed(false);
+
+  {
+    // 3) Navigate to a page in scope of the previously registered ServiceWorker
+    // and expect to get a notification about ServiceWorker being accessed for
+    // a navigation. Cookies should be blocked according to the policy.
+    ServiceWorkerAccessObserver observer(web_contents());
+    base::RunLoop run_loop;
+    EXPECT_CALL(observer, OnServiceWorkerAccessed(
+                              testing::Matcher<NavigationHandle*>(NotNull()),
+                              service_worker_scope,
+                              AllowServiceWorkerResult::FromPolicy(
+                                  /* javascript_blocked=*/false,
+                                  /* cookies_blocked=*/true)))
+        .WillOnce([&]() { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(
+        web_contents(),
+        embedded_test_server()->GetURL("/service_worker/empty.html")));
+    run_loop.Run();
+  }
+
+  SetBrowserClientForTesting(old_client);
+}
+
+namespace {
+
+enum class ContextType {
+  kNavigation,
+  kFrame,
+};
+
+class CookieTracker : public WebContentsObserver {
+ public:
+  explicit CookieTracker(WebContentsImpl* web_contents)
+      : WebContentsObserver(web_contents) {}
+
+  struct CookieAccessDescription {
+    CookieAccessDetails::Type type;
+
+    ContextType context_type;
+    GlobalRoutingID frame_id;
+    int navigation_id = -1;
+
+    GURL url;
+    GURL first_party_url;
+    std::string cookie_name;
+    std::string cookie_value;
+
+    friend std::ostream& operator<<(std::ostream& o,
+                                    const CookieAccessDescription& d) {
+      o << (d.type == CookieAccessDetails::Type::kRead ? "read" : "change");
+      o << " url=" << d.url;
+      o << " first_party_url=" << d.first_party_url;
+      o << " name=" << d.cookie_name;
+      o << " value=" << d.cookie_value;
+      switch (d.context_type) {
+        case ContextType::kNavigation:
+          o << " context=navigation(";
+          o << "id=" << d.navigation_id;
+          o << ")";
+          break;
+        case ContextType::kFrame:
+          o << " context=frame(";
+          o << "process_id=" << d.frame_id.child_id;
+          o << " frame_id=" << d.frame_id.route_id;
+          o << ")";
+          break;
+      }
+      return o;
+    }
+
+   private:
+    auto comparison_key() const {
+      return std::tie(type, url, first_party_url, cookie_name, cookie_value,
+                      frame_id, navigation_id);
+    }
+
+   public:
+    bool operator==(const CookieAccessDescription& other) const {
+      return comparison_key() == other.comparison_key();
+    }
+  };
+
+  void OnCookiesAccessed(NavigationHandle* navigation,
+                         const CookieAccessDetails& details) override {
+    for (const auto& cookie : details.cookie_list) {
+      cookie_accesses_.push_back({details.type,
+                                  ContextType::kNavigation,
+                                  {},
+                                  navigation->GetNavigationId(),
+                                  details.url,
+                                  details.first_party_url,
+                                  cookie.Name(),
+                                  cookie.Value()});
+    }
+
+    QuitIfReady();
+  }
+
+  void OnCookiesAccessed(RenderFrameHost* rfh,
+                         const CookieAccessDetails& details) override {
+    for (const auto& cookie : details.cookie_list) {
+      cookie_accesses_.push_back(
+          {details.type,
+           ContextType::kFrame,
+           {rfh->GetProcess()->GetID(), rfh->GetRoutingID()},
+           -1,
+           details.url,
+           details.first_party_url,
+           cookie.Name(),
+           cookie.Value()});
+    }
+
+    QuitIfReady();
+  }
+
+  void WaitForCookies(size_t count) {
+    waiting_for_cookies_count_ = count;
+
+    base::RunLoop run_loop;
+    quit_closure_ = run_loop.QuitClosure();
+    QuitIfReady();
+    run_loop.Run();
+  }
+
+  std::vector<CookieAccessDescription>& cookie_accesses() {
+    return cookie_accesses_;
+  }
+
+  GlobalRoutingID frame_id(size_t index) {
+    if (index < frame_ids_.size())
+      return frame_ids_[index];
+    // Return bogus values which will never be returned by the code we are
+    // testing. This ensures that if we return this value, the subsequent
+    // comparison will fail.
+    return {-42, -42};
+  }
+
+  int64_t navigation_id(size_t index) {
+    if (index < navigation_ids_.size())
+      return navigation_ids_[index];
+    // Return bogus values which will never be returned by the code we are
+    // testing. This ensures that if we return this value, the subsequent
+    // comparison will fail.
+    return -42;
+  }
+
+  void DidFinishNavigation(NavigationHandle* navigation) override {
+    navigation_ids_.push_back(navigation->GetNavigationId());
+  }
+
+  void RenderFrameCreated(RenderFrameHost* rfh) override {
+    frame_ids_.emplace_back(rfh->GetProcess()->GetID(), rfh->GetRoutingID());
+  }
+
+ private:
+  void QuitIfReady() {
+    if (quit_closure_.is_null())
+      return;
+    if (cookie_accesses_.size() < waiting_for_cookies_count_)
+      return;
+    std::move(quit_closure_).Run();
+  }
+
+  std::vector<CookieAccessDescription> cookie_accesses_;
+
+  // List of observed navigation and frame ids to be used in testing.
+  std::vector<GlobalRoutingID> frame_ids_;
+  std::vector<int64_t> navigation_ids_;
+
+  size_t waiting_for_cookies_count_ = 0;
+  base::OnceClosure quit_closure_;
+};
+
+using CookieAccess = CookieTracker::CookieAccessDescription;
+
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       CookieCallbacks_MainFrame) {
+  CookieTracker cookie_tracker(web_contents());
+
+  GURL first_party_url("http://a.com/");
+  GURL url1(
+      embedded_test_server()->GetURL("a.com", "/cookies/set_cookie.html"));
+  GURL url2(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // 1) Navigate to |url1|. This navigation should set a cookie, which we should
+  // be notified about.
+  EXPECT_TRUE(NavigateToURL(web_contents(), url1));
+  cookie_tracker.WaitForCookies(1);
+
+  EXPECT_THAT(
+      cookie_tracker.cookie_accesses(),
+      testing::ElementsAre(CookieAccess{CookieAccessDetails::Type::kChange,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(0),
+                                        url1,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+
+  // 2) Navigate to |url2| on the same site. Given that we have set a cookie
+  // before, this should sent a previously set cookie with the request and we
+  // should be notified about this.
+  EXPECT_TRUE(NavigateToURL(web_contents(), url2));
+  cookie_tracker.WaitForCookies(1);
+
+  EXPECT_THAT(
+      cookie_tracker.cookie_accesses(),
+      testing::ElementsAre(CookieAccess{CookieAccessDetails::Type::kRead,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(1),
+                                        url2,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       CookieCallbacks_MainFrameRedirect) {
+  CookieTracker cookie_tracker(web_contents());
+
+  GURL first_party_url("http://a.com/");
+  GURL url1(embedded_test_server()->GetURL(
+      "a.com", "/cookies/redirect_and_set_cookie.html"));
+  GURL url1_after_redirect(
+      embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url2(embedded_test_server()->GetURL("a.com", "/title2.html"));
+
+  // 1) Navigate to |url1|. The initial URL redirects and sets a cookie (we
+  // should be notified about this) and as the redirect points to the same site,
+  // cookie should be sent for the second request as well (we should be notified
+  // about this as well).
+  EXPECT_TRUE(NavigateToURL(web_contents(), url1, url1_after_redirect));
+
+  cookie_tracker.WaitForCookies(2);
+  EXPECT_THAT(cookie_tracker.cookie_accesses(),
+              testing::UnorderedElementsAre(
+                  CookieAccess{CookieAccessDetails::Type::kChange,
+                               ContextType::kNavigation,
+                               {},
+                               cookie_tracker.navigation_id(0),
+                               url1,
+                               first_party_url,
+                               "foo",
+                               "bar"},
+                  CookieAccess{CookieAccessDetails::Type::kRead,
+                               ContextType::kNavigation,
+                               {},
+                               cookie_tracker.navigation_id(0),
+                               url1_after_redirect,
+                               first_party_url,
+                               "foo",
+                               "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+
+  // 2) Navigate to another url on the same site and expect a notification about
+  // a read cookie.
+  EXPECT_TRUE(NavigateToURL(web_contents(), url2));
+
+  cookie_tracker.WaitForCookies(1);
+  EXPECT_THAT(
+      cookie_tracker.cookie_accesses(),
+      testing::ElementsAre(CookieAccess{CookieAccessDetails::Type::kRead,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(1),
+                                        url2,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       CookieCallbacks_Subframe) {
+  CookieTracker cookie_tracker(web_contents());
+
+  GURL first_party_url("http://a.com/");
+  GURL url1(embedded_test_server()->GetURL(
+      "a.com", "/cookies/set_cookie_from_subframe.html"));
+  GURL url1_subframe(
+      embedded_test_server()->GetURL("a.com", "/cookies/set_cookie.html"));
+  GURL url2(embedded_test_server()->GetURL("a.com",
+                                           "/cookies/page_with_subframe.html"));
+  GURL url2_subframe(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  // 1) Load a page with a subframe. The main resource of the the subframe
+  // triggers setting a cookie. We should get a cookie change for the
+  // subresource and no cookie read for the main resource.
+  EXPECT_TRUE(NavigateToURL(web_contents(), url1));
+
+  cookie_tracker.WaitForCookies(1);
+  // Navigations are: main frame (0), subframe (1).
+  EXPECT_THAT(
+      cookie_tracker.cookie_accesses(),
+      testing::ElementsAre(CookieAccess{CookieAccessDetails::Type::kChange,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(1),
+                                        url1_subframe,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+
+  EXPECT_TRUE(NavigateToURL(web_contents(), url2));
+
+  // 2) Load a page with a subframe. Both main frame and subframe should get a
+  // cookie read.
+  cookie_tracker.WaitForCookies(2);
+  // Navigations are: main frame (2), subframe (3).
+  EXPECT_THAT(
+      cookie_tracker.cookie_accesses(),
+      testing::ElementsAre(CookieAccess{CookieAccessDetails::Type::kRead,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(2),
+                                        url2,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"},
+                           CookieAccess{CookieAccessDetails::Type::kRead,
+                                        ContextType::kNavigation,
+                                        {},
+                                        cookie_tracker.navigation_id(3),
+                                        url2_subframe,
+                                        first_party_url,
+                                        "foo",
+                                        "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       CookieCallbacks_Subresource) {
+  CookieTracker cookie_tracker(web_contents());
+
+  GURL first_party_url("http://a.com/");
+  GURL url1(embedded_test_server()->GetURL(
+      "a.com", "/cookies/set_cookie_from_subresource.html"));
+  GURL url1_image(embedded_test_server()->GetURL(
+      "a.com", "/cookies/image_with_set_cookie.jpg"));
+  GURL url2(embedded_test_server()->GetURL(
+      "a.com", "/cookies/page_with_subresource.html"));
+  GURL url2_image(embedded_test_server()->GetURL(
+      "a.com", "/cookies/image_without_set_cookie.jpg"));
+
+  EXPECT_TRUE(NavigateToURL(web_contents(), url1));
+
+  // 1) Load a page with a subresource (image), which sets a cookie when
+  // fetched.
+  cookie_tracker.WaitForCookies(1);
+  EXPECT_THAT(cookie_tracker.cookie_accesses(),
+              testing::ElementsAre(
+                  CookieAccess{CookieAccessDetails::Type::kChange,
+                               ContextType::kFrame, cookie_tracker.frame_id(0),
+                               -1, url1_image, first_party_url, "foo", "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+
+  // 2) Load a page with subresource. Both the page and the resource should get
+  // a cookie.
+  EXPECT_TRUE(NavigateToURL(web_contents(), url2));
+
+  cookie_tracker.WaitForCookies(2);
+  EXPECT_THAT(cookie_tracker.cookie_accesses(),
+              testing::ElementsAre(
+                  CookieAccess{CookieAccessDetails::Type::kRead,
+                               ContextType::kNavigation,
+                               {},
+                               cookie_tracker.navigation_id(1),
+                               url2,
+                               first_party_url,
+                               "foo",
+                               "bar"},
+                  CookieAccess{CookieAccessDetails::Type::kRead,
+                               ContextType::kFrame, cookie_tracker.frame_id(0),
+                               -1, url2_image, first_party_url, "foo", "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsObserverBrowserTest,
+                       CookieCallbacks_DocumentCookie) {
+  CookieTracker cookie_tracker(web_contents());
+
+  GURL first_party_url("http://a.com/");
+  GURL url1(embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  EXPECT_TRUE(NavigateToURL(web_contents(), url1));
+  EXPECT_TRUE(ExecJs(web_contents(), "document.cookie='foo=bar'"));
+
+  cookie_tracker.WaitForCookies(1);
+  EXPECT_THAT(cookie_tracker.cookie_accesses(),
+              testing::ElementsAre(
+                  CookieAccess{CookieAccessDetails::Type::kChange,
+                               ContextType::kFrame, cookie_tracker.frame_id(0),
+                               -1, url1, first_party_url, "foo", "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+
+  EXPECT_EQ("foo=bar", EvalJs(web_contents(), "document.cookie"));
+
+  cookie_tracker.WaitForCookies(1);
+  EXPECT_THAT(cookie_tracker.cookie_accesses(),
+              testing::ElementsAre(
+                  CookieAccess{CookieAccessDetails::Type::kRead,
+                               ContextType::kFrame, cookie_tracker.frame_id(0),
+                               -1, url1, first_party_url, "foo", "bar"}));
+  cookie_tracker.cookie_accesses().clear();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/web_contents/web_contents_view.h b/chromium/content/browser/web_contents/web_contents_view.h
index c0cd1950697..2277fc44cf2 100644
--- a/chromium/content/browser/web_contents/web_contents_view.h
+++ b/chromium/content/browser/web_contents/web_contents_view.h
@@ -43,16 +43,6 @@ class WebContentsView {
   // the tab in the screen coordinate system.
   virtual void GetContainerBounds(gfx::Rect* out) const = 0;
 
-  // TODO(brettw) this is a hack. It's used in two places at the time of this
-  // writing: (1) when render view hosts switch, we need to size the replaced
-  // one to be correct, since it wouldn't have known about sizes that happened
-  // while it was hidden; (2) in constrained windows.
-  //
-  // (1) will be fixed once interstitials are cleaned up. (2) seems like it
-  // should be cleaned up or done some other way, since this works for normal
-  // WebContents without the special code.
-  virtual void SizeContents(const gfx::Size& size) = 0;
-
   // Sets focus to the native widget for this tab.
   virtual void Focus() = 0;
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_android.cc b/chromium/content/browser/web_contents/web_contents_view_android.cc
index e1b314c3f19..eb490b5c03c 100644
--- a/chromium/content/browser/web_contents/web_contents_view_android.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_android.cc
@@ -7,7 +7,8 @@
 #include "base/android/build_info.h"
 #include "base/android/jni_android.h"
 #include "base/android/jni_string.h"
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "cc/layers/layer.h"
 #include "content/browser/accessibility/browser_accessibility_manager_android.h"
 #include "content/browser/android/content_feature_list.h"
@@ -15,7 +16,6 @@
 #include "content/browser/android/gesture_listener_manager.h"
 #include "content/browser/android/select_popup.h"
 #include "content/browser/android/selection/selection_popup_controller.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/renderer_host/display_util.h"
 #include "content/browser/renderer_host/render_view_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
@@ -117,18 +117,6 @@ void WebContentsViewAndroid::SetOverscrollRefreshHandler(
     static_cast<RenderWidgetHostViewAndroid*>(rwhv)
         ->OnOverscrollRefreshHandlerAvailable();
   }
-
-  if (web_contents_->ShowingInterstitialPage()) {
-    rwhv = web_contents_->GetInterstitialPage()
-               ->GetMainFrame()
-               ->GetRenderViewHost()
-               ->GetWidget()
-               ->GetView();
-    if (rwhv) {
-      static_cast<RenderWidgetHostViewAndroid*>(rwhv)
-          ->OnOverscrollRefreshHandlerAvailable();
-    }
-  }
 }
 
 ui::OverscrollRefreshHandler*
@@ -153,13 +141,6 @@ RenderWidgetHostViewAndroid*
 WebContentsViewAndroid::GetRenderWidgetHostViewAndroid() {
   RenderWidgetHostView* rwhv = nullptr;
   rwhv = web_contents_->GetRenderWidgetHostView();
-  if (web_contents_->ShowingInterstitialPage()) {
-    rwhv = web_contents_->GetInterstitialPage()
-               ->GetMainFrame()
-               ->GetRenderViewHost()
-               ->GetWidget()
-               ->GetView();
-  }
   return static_cast<RenderWidgetHostViewAndroid*>(rwhv);
 }
 
@@ -175,21 +156,10 @@ void WebContentsViewAndroid::SetPageTitle(const base::string16& title) {
   // Do nothing.
 }
 
-void WebContentsViewAndroid::SizeContents(const gfx::Size& size) {
-  // TODO(klobag): Do we need to do anything else?
-  RenderWidgetHostView* rwhv = web_contents_->GetRenderWidgetHostView();
-  if (rwhv)
-    rwhv->SetSize(size);
-}
-
 void WebContentsViewAndroid::Focus() {
-  if (web_contents_->ShowingInterstitialPage()) {
-    web_contents_->GetInterstitialPage()->Focus();
-  } else {
-    auto* rwhv = web_contents_->GetRenderWidgetHostView();
-    if (rwhv)
-      static_cast<RenderWidgetHostViewAndroid*>(rwhv)->Focus();
-  }
+  auto* rwhv = web_contents_->GetRenderWidgetHostView();
+  if (rwhv)
+    static_cast<RenderWidgetHostViewAndroid*>(rwhv)->Focus();
 }
 
 void WebContentsViewAndroid::SetInitialFocus() {
@@ -208,10 +178,6 @@ void WebContentsViewAndroid::RestoreFocus() {
 }
 
 void WebContentsViewAndroid::FocusThroughTabTraversal(bool reverse) {
-  if (web_contents_->ShowingInterstitialPage()) {
-    web_contents_->GetInterstitialPage()->FocusThroughTabTraversal(reverse);
-    return;
-  }
   content::RenderWidgetHostView* fullscreen_view =
       web_contents_->GetFullscreenRenderWidgetHostView();
   if (fullscreen_view) {
@@ -247,8 +213,7 @@ RenderWidgetHostViewBase* WebContentsViewAndroid::CreateViewForWidget(
   // Note that while this instructs the render widget host to reference
   // |native_view_|, this has no effect without also instructing the
   // native view (i.e. ContentView) how to obtain a reference to this widget in
-  // order to paint it. See ContentView::GetRenderWidgetHostViewAndroid for an
-  // example of how this is achieved for InterstitialPages.
+  // order to paint it.
   RenderWidgetHostImpl* rwhi = RenderWidgetHostImpl::From(render_widget_host);
   auto* rwhv = new RenderWidgetHostViewAndroid(rwhi, &view_);
   rwhv->SetSynchronousCompositorClient(synchronous_compositor_client_);
@@ -324,21 +289,19 @@ SelectPopup* WebContentsViewAndroid::GetSelectPopup() {
 
 void WebContentsViewAndroid::ShowPopupMenu(
     RenderFrameHost* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
     const gfx::Rect& bounds,
     int item_height,
     double item_font_size,
     int selected_item,
-    const std::vector<MenuItem>& items,
+    std::vector<blink::mojom::MenuItemPtr> menu_items,
     bool right_aligned,
     bool allow_multiple_selection) {
-  GetSelectPopup()->ShowMenu(render_frame_host, bounds, items, selected_item,
+  GetSelectPopup()->ShowMenu(std::move(popup_client), bounds,
+                             std::move(menu_items), selected_item,
                              allow_multiple_selection, right_aligned);
 }
 
-void WebContentsViewAndroid::HidePopupMenu() {
-  GetSelectPopup()->HideMenu();
-}
-
 void WebContentsViewAndroid::StartDragging(
     const DropData& drop_data,
     blink::WebDragOperationsMask allowed_ops,
diff --git a/chromium/content/browser/web_contents/web_contents_view_android.h b/chromium/content/browser/web_contents/web_contents_view_android.h
index 1ac6eccf911..2a6dcf7ed06 100644
--- a/chromium/content/browser/web_contents/web_contents_view_android.h
+++ b/chromium/content/browser/web_contents/web_contents_view_android.h
@@ -12,6 +12,8 @@
 #include "content/browser/web_contents/web_contents_view.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/common/drop_data.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "ui/android/overscroll_refresh.h"
 #include "ui/android/view_android.h"
 #include "ui/android/view_android_observer.h"
@@ -59,7 +61,6 @@ class WebContentsViewAndroid : public WebContentsView,
   gfx::NativeView GetContentNativeView() const override;
   gfx::NativeWindow GetTopLevelNativeWindow() const override;
   void GetContainerBounds(gfx::Rect* out) const override;
-  void SizeContents(const gfx::Size& size) override;
   void Focus() override;
   void SetInitialFocus() override;
   void StoreFocus() override;
@@ -81,15 +82,16 @@ class WebContentsViewAndroid : public WebContentsView,
   // Backend implementation of RenderViewHostDelegateView.
   void ShowContextMenu(RenderFrameHost* render_frame_host,
                        const ContextMenuParams& params) override;
-  void ShowPopupMenu(RenderFrameHost* render_frame_host,
-                     const gfx::Rect& bounds,
-                     int item_height,
-                     double item_font_size,
-                     int selected_item,
-                     const std::vector<MenuItem>& items,
-                     bool right_aligned,
-                     bool allow_multiple_selection) override;
-  void HidePopupMenu() override;
+  void ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+      const gfx::Rect& bounds,
+      int item_height,
+      double item_font_size,
+      int selected_item,
+      std::vector<blink::mojom::MenuItemPtr> menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
   ui::OverscrollRefreshHandler* GetOverscrollRefreshHandler() const override;
   void StartDragging(const DropData& drop_data,
                      blink::WebDragOperationsMask allowed_ops,
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.cc b/chromium/content/browser/web_contents/web_contents_view_aura.cc
index 025f82ede5c..950dc1931b4 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.cc
@@ -24,7 +24,6 @@
 #include "components/viz/common/features.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/download/drag_download_util.h"
-#include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/renderer_host/dip_util.h"
 #include "content/browser/renderer_host/input/touch_selection_controller_client_aura.h"
@@ -156,7 +155,7 @@ class WebDragSourceAura : public NotificationObserver {
 // Fill out the OSExchangeData with a file contents, synthesizing a name if
 // necessary.
 void PrepareDragForFileContents(const DropData& drop_data,
-                                ui::OSExchangeData::Provider* provider) {
+                                ui::OSExchangeDataProvider* provider) {
   base::Optional<base::FilePath> filename =
       drop_data.GetSafeFilenameForImageFileContents();
   if (filename)
@@ -165,10 +164,9 @@ void PrepareDragForFileContents(const DropData& drop_data,
 #endif
 
 #if defined(OS_WIN)
-void PrepareDragForDownload(
-    const DropData& drop_data,
-    ui::OSExchangeData::Provider* provider,
-    WebContentsImpl* web_contents) {
+void PrepareDragForDownload(const DropData& drop_data,
+                            ui::OSExchangeDataProvider* provider,
+                            WebContentsImpl* web_contents) {
   const GURL& page_url = web_contents->GetLastCommittedURL();
   const std::string& page_encoding = web_contents->GetEncoding();
 
@@ -215,8 +213,8 @@ void PrepareDragForDownload(
       download_path, base::File(), download_url,
       Referrer(page_url, drop_data.referrer_policy), page_encoding,
       web_contents);
-  ui::OSExchangeData::DownloadFileInfo file_download(base::FilePath(),
-                                                     std::move(download_file));
+  ui::DownloadFileInfo file_download(base::FilePath(),
+                                     std::move(download_file));
   provider->SetDownloadFileInfo(&file_download);
 }
 #endif  // defined(OS_WIN)
@@ -230,7 +228,7 @@ const ui::ClipboardFormatType& GetFileSystemFileFormatType() {
 
 // Utility to fill a ui::OSExchangeDataProvider object from DropData.
 void PrepareDragData(const DropData& drop_data,
-                     ui::OSExchangeData::Provider* provider,
+                     ui::OSExchangeDataProvider* provider,
                      WebContentsImpl* web_contents) {
   provider->MarkOriginatedFromRenderer();
 #if defined(OS_WIN)
@@ -315,8 +313,7 @@ void PrepareDropData(DropData* drop_data, const ui::OSExchangeData& data) {
 
   GURL url;
   base::string16 url_title;
-  data.GetURLAndTitle(
-      ui::OSExchangeData::DO_NOT_CONVERT_FILENAMES, &url, &url_title);
+  data.GetURLAndTitle(ui::DO_NOT_CONVERT_FILENAMES, &url, &url_title);
   if (url.is_valid()) {
     drop_data->url = url;
     drop_data->url_title = url_title;
@@ -713,15 +710,6 @@ WebContentsViewAura::~WebContentsViewAura() {
   window_.reset();
 }
 
-void WebContentsViewAura::SizeChangedCommon(const gfx::Size& size) {
-  if (web_contents_->GetInterstitialPage())
-    web_contents_->GetInterstitialPage()->SetSize(size);
-  RenderWidgetHostView* rwhv =
-      web_contents_->GetRenderWidgetHostView();
-  if (rwhv)
-    rwhv->SetSize(size);
-}
-
 void WebContentsViewAura::EndDrag(
     base::WeakPtr<RenderWidgetHostImpl> source_rwh_weak_ptr,
     blink::WebDragOperationsMask ops) {
@@ -822,27 +810,10 @@ void WebContentsViewAura::GetContainerBounds(gfx::Rect* out) const {
   *out = GetNativeView()->GetBoundsInScreen();
 }
 
-void WebContentsViewAura::SizeContents(const gfx::Size& size) {
-  gfx::Rect bounds = window_->bounds();
-  if (bounds.size() != size) {
-    bounds.set_size(size);
-    window_->SetBounds(bounds);
-  } else {
-    // Our size matches what we want but the renderers size may not match.
-    // Pretend we were resized so that the renderers size is updated too.
-    SizeChangedCommon(size);
-  }
-}
-
 void WebContentsViewAura::Focus() {
   if (delegate_)
     delegate_->ResetStoredFocus();
 
-  if (web_contents_->GetInterstitialPage()) {
-    web_contents_->GetInterstitialPage()->Focus();
-    return;
-  }
-
   if (delegate_ && delegate_->Focus())
     return;
 
@@ -879,10 +850,6 @@ void WebContentsViewAura::FocusThroughTabTraversal(bool reverse) {
   if (delegate_)
     delegate_->ResetStoredFocus();
 
-  if (web_contents_->ShowingInterstitialPage()) {
-    web_contents_->GetInterstitialPage()->FocusThroughTabTraversal(reverse);
-    return;
-  }
   content::RenderWidgetHostView* fullscreen_view =
       web_contents_->GetFullscreenRenderWidgetHostView();
   if (fullscreen_view) {
@@ -1071,7 +1038,7 @@ void WebContentsViewAura::StartDragging(
   ui::TouchSelectionController* selection_controller = GetSelectionController();
   if (selection_controller)
     selection_controller->HideAndDisallowShowingAutomatically();
-  std::unique_ptr<ui::OSExchangeData::Provider> provider =
+  std::unique_ptr<ui::OSExchangeDataProvider> provider =
       ui::OSExchangeDataProviderFactory::CreateProvider();
   PrepareDragData(drop_data, provider.get(), web_contents_);
 
@@ -1151,7 +1118,9 @@ gfx::Size WebContentsViewAura::GetMaximumSize() const {
 
 void WebContentsViewAura::OnBoundsChanged(const gfx::Rect& old_bounds,
                                           const gfx::Rect& new_bounds) {
-  SizeChangedCommon(new_bounds.size());
+  RenderWidgetHostView* rwhv = web_contents_->GetRenderWidgetHostView();
+  if (rwhv)
+    rwhv->SetSize(new_bounds.size());
 
   // Constrained web dialogs, need to be kept centered over our content area.
   for (size_t i = 0; i < window_->children().size(); i++) {
@@ -1647,19 +1616,17 @@ bool WebContentsViewAura::DoBrowserControlsShrinkRendererSize() const {
 }
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void WebContentsViewAura::ShowPopupMenu(RenderFrameHost* render_frame_host,
-                                        const gfx::Rect& bounds,
-                                        int item_height,
-                                        double item_font_size,
-                                        int selected_item,
-                                        const std::vector<MenuItem>& items,
-                                        bool right_aligned,
-                                        bool allow_multiple_selection) {
-  NOTIMPLEMENTED() << " show " << items.size() << " menu items";
-}
-
-void WebContentsViewAura::HidePopupMenu() {
-  NOTIMPLEMENTED();
+void WebContentsViewAura::ShowPopupMenu(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+    const gfx::Rect& bounds,
+    int item_height,
+    double item_font_size,
+    int selected_item,
+    std::vector<blink::mojom::MenuItemPtr> menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
+  NOTIMPLEMENTED() << " show " << menu_items.size() << " menu items";
 }
 #endif
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.h b/chromium/content/browser/web_contents/web_contents_view_aura.h
index c1a7e57d7d2..3a3d0b9073f 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.h
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.h
@@ -24,6 +24,8 @@
 #include "content/public/browser/visibility.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/common/drop_data.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "ui/aura/client/drag_drop_delegate.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_delegate.h"
@@ -106,8 +108,6 @@ class CONTENT_EXPORT WebContentsViewAura
 
   ~WebContentsViewAura() override;
 
-  void SizeChangedCommon(const gfx::Size& size);
-
   void EndDrag(base::WeakPtr<RenderWidgetHostImpl> source_rwh_weak_ptr,
                blink::WebDragOperationsMask ops);
 
@@ -138,7 +138,6 @@ class CONTENT_EXPORT WebContentsViewAura
   gfx::NativeView GetContentNativeView() const override;
   gfx::NativeWindow GetTopLevelNativeWindow() const override;
   void GetContainerBounds(gfx::Rect* out) const override;
-  void SizeContents(const gfx::Size& size) override;
   void Focus() override;
   void SetInitialFocus() override;
   void StoreFocus() override;
@@ -174,16 +173,16 @@ class CONTENT_EXPORT WebContentsViewAura
   int GetBottomControlsHeight() const override;
   bool DoBrowserControlsShrinkRendererSize() const override;
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void ShowPopupMenu(RenderFrameHost* render_frame_host,
-                     const gfx::Rect& bounds,
-                     int item_height,
-                     double item_font_size,
-                     int selected_item,
-                     const std::vector<MenuItem>& items,
-                     bool right_aligned,
-                     bool allow_multiple_selection) override;
-
-  void HidePopupMenu() override;
+  void ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+      const gfx::Rect& bounds,
+      int item_height,
+      double item_font_size,
+      int selected_item,
+      std::vector<blink::mojom::MenuItemPtr> menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
 #endif
 
   // Overridden from aura::WindowDelegate:
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc b/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
index 26ad80b3e8c..66f1ce72a47 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
@@ -37,6 +37,7 @@
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/browser/web_drag_dest_delegate.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -347,7 +348,7 @@ class SpuriousMouseMoveEventObserver
   }
 
   void OnInputEvent(const blink::WebInputEvent& event) override {
-    EXPECT_NE(blink::WebInputEvent::kMouseMove, event.GetType())
+    EXPECT_NE(blink::WebInputEvent::Type::kMouseMove, event.GetType())
         << "Unexpected mouse move event.";
   }
 
@@ -392,7 +393,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
   SpuriousMouseMoveEventObserver mouse_observer(GetRenderWidgetHost());
 
   blink::WebGestureEvent gesture_scroll_begin(
-      blink::WebGestureEvent::kGestureScrollBegin,
+      blink::WebGestureEvent::Type::kGestureScrollBegin,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -403,7 +404,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
   GetRenderWidgetHost()->ForwardGestureEvent(gesture_scroll_begin);
 
   blink::WebGestureEvent gesture_scroll_update(
-      blink::WebGestureEvent::kGestureScrollUpdate,
+      blink::WebGestureEvent::Type::kGestureScrollUpdate,
       blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests(),
       blink::WebGestureDevice::kTouchscreen);
@@ -473,7 +474,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
   ui::TouchEvent press(
       ui::ET_TOUCH_PRESSED,
       gfx::Point(bounds.x() + bounds.width() / 2, bounds.y() + 5), timestamp,
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   ui::EventDispatchDetails details = sink->OnEventFromSource(&press);
   ASSERT_FALSE(details.dispatcher_destroyed);
   EXPECT_EQ(1, GetCurrentIndex());
@@ -481,8 +482,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
   timestamp += base::TimeDelta::FromMilliseconds(10);
   ui::TouchEvent move1(
       ui::ET_TOUCH_MOVED, gfx::Point(bounds.right() - 10, bounds.y() + 5),
-      timestamp,
-      ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+      timestamp, ui::PointerDetails(ui::EventPointerType::kTouch, 0));
   details = sink->OnEventFromSource(&move1);
   ASSERT_FALSE(details.dispatcher_destroyed);
   EXPECT_EQ(1, GetCurrentIndex());
@@ -492,9 +492,9 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
 
   for (int x = bounds.right() - 10; x >= bounds.x() + 10; x-= 10) {
     timestamp += base::TimeDelta::FromMilliseconds(10);
-    ui::TouchEvent inc(
-        ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5), timestamp,
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+    ui::TouchEvent inc(ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5),
+                       timestamp,
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
     details = sink->OnEventFromSource(&inc);
     ASSERT_FALSE(details.dispatcher_destroyed);
     EXPECT_EQ(1, GetCurrentIndex());
@@ -502,9 +502,9 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
 
   for (int x = bounds.x() + 10; x <= bounds.width() - 10; x+= 10) {
     timestamp += base::TimeDelta::FromMilliseconds(10);
-    ui::TouchEvent inc(
-        ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5), timestamp,
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+    ui::TouchEvent inc(ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5),
+                       timestamp,
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
     details = sink->OnEventFromSource(&inc);
     ASSERT_FALSE(details.dispatcher_destroyed);
     EXPECT_EQ(1, GetCurrentIndex());
@@ -512,9 +512,9 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
 
   for (int x = bounds.width() - 10; x >= bounds.x() + 10; x-= 10) {
     timestamp += base::TimeDelta::FromMilliseconds(10);
-    ui::TouchEvent inc(
-        ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5), timestamp,
-        ui::PointerDetails(ui::EventPointerType::POINTER_TYPE_TOUCH, 0));
+    ui::TouchEvent inc(ui::ET_TOUCH_MOVED, gfx::Point(x, bounds.y() + 5),
+                       timestamp,
+                       ui::PointerDetails(ui::EventPointerType::kTouch, 0));
     details = sink->OnEventFromSource(&inc);
     ASSERT_FALSE(details.dispatcher_destroyed);
     EXPECT_EQ(1, GetCurrentIndex());
@@ -874,11 +874,11 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
     }
     InputEventAckWaiter touch_start_waiter(
         GetRenderWidgetHost(),
-        base::BindRepeating([](content::InputEventAckSource,
-                               content::InputEventAckState state,
+        base::BindRepeating([](blink::mojom::InputEventResultSource,
+                               blink::mojom::InputEventResultState state,
                                const blink::WebInputEvent& event) {
-          return event.GetType() == blink::WebGestureEvent::kTouchStart &&
-                 state == content::INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+          return event.GetType() == blink::WebGestureEvent::Type::kTouchStart &&
+                 state == blink::mojom::InputEventResultState::kNotConsumed;
         }));
     // Send touch press.
     SyntheticWebTouchEvent touch;
@@ -892,11 +892,11 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
     touch.MovePoint(0, bounds.x() + 20 + 1 * dx, bounds.y() + 100);
     InputEventAckWaiter touch_move_waiter(
         GetRenderWidgetHost(),
-        base::BindRepeating([](content::InputEventAckSource,
-                               content::InputEventAckState state,
+        base::BindRepeating([](blink::mojom::InputEventResultSource,
+                               blink::mojom::InputEventResultState state,
                                const blink::WebInputEvent& event) {
-          return event.GetType() == blink::WebGestureEvent::kTouchMove &&
-                 state == content::INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
+          return event.GetType() == blink::WebGestureEvent::Type::kTouchMove &&
+                 state == blink::mojom::InputEventResultState::kNotConsumed;
         }));
     GetRenderWidgetHost()->ForwardTouchEventWithLatencyInfo(touch,
                                                             ui::LatencyInfo());
@@ -933,9 +933,9 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest,
                                                             ui::LatencyInfo());
     WaitAFrame();
 
-    blink::WebGestureEvent scroll_end(blink::WebInputEvent::kGestureScrollEnd,
-                                      blink::WebInputEvent::kNoModifiers,
-                                      ui::EventTimeForNow());
+    blink::WebGestureEvent scroll_end(
+        blink::WebInputEvent::Type::kGestureScrollEnd,
+        blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     GetRenderWidgetHost()->ForwardGestureEventWithLatencyInfo(
         scroll_end, ui::LatencyInfo());
     WaitAFrame();
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura_unittest.cc b/chromium/content/browser/web_contents/web_contents_view_aura_unittest.cc
index 3c0bf2a1eaa..ca77acc3ef5 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura_unittest.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura_unittest.cc
@@ -39,7 +39,10 @@ namespace content {
 namespace {
 constexpr gfx::Rect kBounds = gfx::Rect(0, 0, 20, 20);
 constexpr gfx::PointF kClientPt = {5, 10};
+
+#if !defined(USE_OZONE) || defined(OS_WIN) || defined(USE_X11)
 constexpr gfx::PointF kScreenPt = {17, 3};
+#endif
 
 // Runs a specified callback when a ui::MouseEvent is received.
 class RunCallbackOnActivation : public WebContentsDelegate {
@@ -198,6 +201,20 @@ TEST_F(WebContentsViewAuraTest, OccludeView) {
   EXPECT_EQ(web_contents()->GetVisibility(), Visibility::VISIBLE);
 }
 
+#if !defined(USE_OZONE) && !defined(OS_CHROMEOS)
+// TODO(crbug.com/1070483): Enable this test on Ozone.
+//
+// The expectations for the X11 implementation differ from other ones because
+// the GetString() method of the X11 data provider returns an empty string
+// if file data is also present, which is not the same for other
+// implementations.  (See the code under USE_X11 in the body of the test.)
+//
+// Ozone spawns the platform at run time, which would require this test to query
+// Ozone about the current platform, which would pull the Ozone platform as the
+// dependency here.
+//
+// Another solution could be fixing the X11 platform implementation so it
+// would behave the same way as other Ozone platforms do.
 TEST_F(WebContentsViewAuraTest, DragDropFiles) {
   WebContentsViewAura* view = GetView();
   auto data = std::make_unique<ui::OSExchangeData>();
@@ -234,7 +251,7 @@ TEST_F(WebContentsViewAuraTest, DragDropFiles) {
   ASSERT_NE(nullptr, view->current_drop_data_);
 
 #if defined(USE_X11)
-  // By design, OSExchangeDataProviderAuraX11::GetString returns an empty string
+  // By design, OSExchangeDataProviderX11::GetString returns an empty string
   // if file data is also present.
   EXPECT_TRUE(view->current_drop_data_->text.string().empty());
 #else
@@ -264,7 +281,7 @@ TEST_F(WebContentsViewAuraTest, DragDropFiles) {
   CheckDropData(view);
 
 #if defined(USE_X11)
-  // By design, OSExchangeDataProviderAuraX11::GetString returns an empty string
+  // By design, OSExchangeDataProviderX11::GetString returns an empty string
   // if file data is also present.
   EXPECT_TRUE(drop_complete_data_->drop_data.text.string().empty());
 #else
@@ -280,6 +297,8 @@ TEST_F(WebContentsViewAuraTest, DragDropFiles) {
   }
 }
 
+#endif  // !defined(USE_OZONE) && !defined(OS_CHROMEOS)
+
 #if defined(OS_WIN) || defined(USE_X11)
 TEST_F(WebContentsViewAuraTest, DragDropFilesOriginateFromRenderer) {
   WebContentsViewAura* view = GetView();
@@ -321,7 +340,7 @@ TEST_F(WebContentsViewAuraTest, DragDropFilesOriginateFromRenderer) {
   ASSERT_NE(nullptr, view->current_drop_data_);
 
 #if defined(USE_X11)
-  // By design, OSExchangeDataProviderAuraX11::GetString returns an empty string
+  // By design, OSExchangeDataProviderX11::GetString returns an empty string
   // if file data is also present.
   EXPECT_TRUE(view->current_drop_data_->text.string().empty());
 #else
@@ -344,7 +363,7 @@ TEST_F(WebContentsViewAuraTest, DragDropFilesOriginateFromRenderer) {
   CheckDropData(view);
 
 #if defined(USE_X11)
-  // By design, OSExchangeDataProviderAuraX11::GetString returns an empty string
+  // By design, OSExchangeDataProviderX11::GetString returns an empty string
   // if file data is also present.
   EXPECT_TRUE(drop_complete_data_->drop_data.text.string().empty());
 #else
diff --git a/chromium/content/browser/web_contents/web_contents_view_child_frame.cc b/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
index a3715d66e32..cbbc29fa522 100644
--- a/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
@@ -65,10 +65,6 @@ void WebContentsViewChildFrame::GetContainerBounds(gfx::Rect* out) const {
     *out = gfx::Rect();
 }
 
-void WebContentsViewChildFrame::SizeContents(const gfx::Size& size) {
-  // The RenderWidgetHostViewChildFrame is responsible for sizing the contents.
-}
-
 void WebContentsViewChildFrame::SetInitialFocus() {
   NOTREACHED();
 }
@@ -150,8 +146,7 @@ void WebContentsViewChildFrame::TakeFocus(bool reverse) {
                                   ->GetProxyToOuterDelegate();
   FrameTreeNode* outer_node = FrameTreeNode::GloballyFindByID(
       web_contents_->GetOuterDelegateFrameTreeNodeId());
-  RenderFrameHostImpl* rfhi =
-      outer_node->parent()->render_manager()->current_frame_host();
+  RenderFrameHostImpl* rfhi = outer_node->parent();
 
   rfhi->AdvanceFocus(reverse ? blink::mojom::FocusType::kBackward
                              : blink::mojom::FocusType::kForward,
diff --git a/chromium/content/browser/web_contents/web_contents_view_child_frame.h b/chromium/content/browser/web_contents/web_contents_view_child_frame.h
index 15b516b3c67..c387257e579 100644
--- a/chromium/content/browser/web_contents/web_contents_view_child_frame.h
+++ b/chromium/content/browser/web_contents/web_contents_view_child_frame.h
@@ -28,7 +28,6 @@ class WebContentsViewChildFrame : public WebContentsView,
   gfx::NativeView GetContentNativeView() const override;
   gfx::NativeWindow GetTopLevelNativeWindow() const override;
   void GetContainerBounds(gfx::Rect* out) const override;
-  void SizeContents(const gfx::Size& size) override;
   void Focus() override;
   void SetInitialFocus() override;
   void StoreFocus() override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_mac.h b/chromium/content/browser/web_contents/web_contents_view_mac.h
index b461319c2c7..a1f76e3f293 100644
--- a/chromium/content/browser/web_contents/web_contents_view_mac.h
+++ b/chromium/content/browser/web_contents/web_contents_view_mac.h
@@ -23,6 +23,7 @@
 #include "content/public/browser/visibility.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #import "ui/base/cocoa/views_hostable.h"
 #include "ui/gfx/geometry/size.h"
 
@@ -66,7 +67,6 @@ class WebContentsViewMac : public WebContentsView,
   gfx::NativeView GetContentNativeView() const override;
   gfx::NativeWindow GetTopLevelNativeWindow() const override;
   void GetContainerBounds(gfx::Rect* out) const override;
-  void SizeContents(const gfx::Size& size) override;
   void Focus() override;
   void SetInitialFocus() override;
   void StoreFocus() override;
@@ -99,15 +99,16 @@ class WebContentsViewMac : public WebContentsView,
   void TakeFocus(bool reverse) override;
   void ShowContextMenu(RenderFrameHost* render_frame_host,
                        const ContextMenuParams& params) override;
-  void ShowPopupMenu(RenderFrameHost* render_frame_host,
-                     const gfx::Rect& bounds,
-                     int item_height,
-                     double item_font_size,
-                     int selected_item,
-                     const std::vector<MenuItem>& items,
-                     bool right_aligned,
-                     bool allow_multiple_selection) override;
-  void HidePopupMenu() override;
+  void ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
+      const gfx::Rect& bounds,
+      int item_height,
+      double item_font_size,
+      int selected_item,
+      std::vector<blink::mojom::MenuItemPtr> menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection) override;
 
   // PopupMenuHelper::Delegate:
   void OnMenuClosed() override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_mac.mm b/chromium/content/browser/web_contents/web_contents_view_mac.mm
index bd346925053..8d4a118ee82 100644
--- a/chromium/content/browser/web_contents/web_contents_view_mac.mm
+++ b/chromium/content/browser/web_contents/web_contents_view_mac.mm
@@ -28,7 +28,6 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #import "content/browser/web_contents/web_drag_dest_mac.h"
 #include "content/common/web_contents_ns_view_bridge.mojom-shared.h"
-#include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
@@ -168,13 +167,6 @@ void WebContentsViewMac::StartDragging(
   }
 }
 
-void WebContentsViewMac::SizeContents(const gfx::Size& size) {
-  // TODO(brettw | japhet) This is a hack and should be removed.
-  // See web_contents_view.h.
-  // Note(erikchen): This method has /never/ worked correctly. I've removed the
-  // previous implementation.
-}
-
 void WebContentsViewMac::Focus() {
   if (delegate())
     delegate()->ResetStoredFocus();
@@ -223,10 +215,6 @@ void WebContentsViewMac::FocusThroughTabTraversal(bool reverse) {
   if (delegate())
     delegate()->ResetStoredFocus();
 
-  if (web_contents_->ShowingInterstitialPage()) {
-    web_contents_->GetInterstitialPage()->FocusThroughTabTraversal(reverse);
-    return;
-  }
   content::RenderWidgetHostView* fullscreen_view =
       web_contents_->GetFullscreenRenderWidgetHostView();
   if (fullscreen_view) {
@@ -283,25 +271,22 @@ void WebContentsViewMac::ShowContextMenu(
 
 void WebContentsViewMac::ShowPopupMenu(
     RenderFrameHost* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient> popup_client,
     const gfx::Rect& bounds,
     int item_height,
     double item_font_size,
     int selected_item,
-    const std::vector<MenuItem>& items,
+    std::vector<blink::mojom::MenuItemPtr> menu_items,
     bool right_aligned,
     bool allow_multiple_selection) {
-  popup_menu_helper_.reset(new PopupMenuHelper(this, render_frame_host));
+  popup_menu_helper_.reset(
+      new PopupMenuHelper(this, render_frame_host, std::move(popup_client)));
   popup_menu_helper_->ShowPopupMenu(bounds, item_height, item_font_size,
-                                    selected_item, items, right_aligned,
-                                    allow_multiple_selection);
+                                    selected_item, std::move(menu_items),
+                                    right_aligned, allow_multiple_selection);
   // Note: |this| may be deleted here.
 }
 
-void WebContentsViewMac::HidePopupMenu() {
-  if (popup_menu_helper_)
-    popup_menu_helper_->Hide();
-}
-
 void WebContentsViewMac::OnMenuClosed() {
   popup_menu_helper_.reset();
 }
@@ -385,6 +370,16 @@ RenderWidgetHostViewBase* WebContentsViewMac::CreateViewForChildWidget(
     RenderWidgetHost* render_widget_host) {
   RenderWidgetHostViewMac* view =
       new RenderWidgetHostViewMac(render_widget_host);
+
+  // If the parent RenderWidgetHostViewMac is hosted in another process, ensure
+  // that the popup window will be created created in the same process.
+  // https://crbug.com/1091179
+  if (views_host_) {
+    auto* remote_cocoa_application = views_host_->GetRemoteCocoaApplication();
+    view->MigrateNSViewBridge(remote_cocoa_application,
+                              remote_cocoa::kInvalidNSViewId);
+  }
+
   if (delegate()) {
     base::scoped_nsobject<NSObject<RenderWidgetHostViewMacDelegate>>
         rw_delegate(delegate()->CreateRenderWidgetHostViewDelegate(
diff --git a/chromium/content/browser/web_contents/web_drag_utils_win.cc b/chromium/content/browser/web_contents/web_drag_utils_win.cc
index 4627bbd9675..06e3a3c0ef6 100644
--- a/chromium/content/browser/web_contents/web_drag_utils_win.cc
+++ b/chromium/content/browser/web_contents/web_drag_utils_win.cc
@@ -5,7 +5,7 @@
 #include "content/browser/web_contents/web_drag_utils_win.h"
 
 #include <oleidl.h>
-#include "base/logging.h"
+#include "base/check.h"
 
 using blink::WebDragOperation;
 using blink::WebDragOperationsMask;
diff --git a/chromium/content/browser/web_contents_receiver_set_browsertest.cc b/chromium/content/browser/web_contents_receiver_set_browsertest.cc
index fbdf9d801f1..456a9700789 100644
--- a/chromium/content/browser/web_contents_receiver_set_browsertest.cc
+++ b/chromium/content/browser/web_contents_receiver_set_browsertest.cc
@@ -7,6 +7,7 @@
 #include "base/run_loop.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents_receiver_set.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/web_package/mock_signed_exchange_handler.cc b/chromium/content/browser/web_package/mock_signed_exchange_handler.cc
index fbf2899fe47..2808e2a0eac 100644
--- a/chromium/content/browser/web_package/mock_signed_exchange_handler.cc
+++ b/chromium/content/browser/web_package/mock_signed_exchange_handler.cc
@@ -20,7 +20,7 @@ MockSignedExchangeHandlerParams::MockSignedExchangeHandlerParams(
     net::Error error,
     const GURL& inner_url,
     const std::string& mime_type,
-    std::vector<std::string> response_headers,
+    std::vector<std::pair<std::string, std::string>> response_headers,
     base::Optional<net::SHA256HashValue> header_integrity,
     const base::Time& signature_expire_time)
     : outer_url(outer_url),
@@ -50,10 +50,9 @@ MockSignedExchangeHandler::MockSignedExchangeHandler(
     head->headers =
         base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.1 200 OK");
     head->mime_type = params.mime_type;
-    head->headers->AddHeader(
-        base::StringPrintf("Content-type: %s", params.mime_type.c_str()));
+    head->headers->SetHeader("Content-type", params.mime_type);
     for (const auto& header : params.response_headers)
-      head->headers->AddHeader(header);
+      head->headers->AddHeader(header.first, header.second);
     head->is_signed_exchange_inner_response = true;
     head->content_length = head->headers->GetContentLength();
   }
diff --git a/chromium/content/browser/web_package/mock_signed_exchange_handler.h b/chromium/content/browser/web_package/mock_signed_exchange_handler.h
index ab71024f93e..9fab6750fd0 100644
--- a/chromium/content/browser/web_package/mock_signed_exchange_handler.h
+++ b/chromium/content/browser/web_package/mock_signed_exchange_handler.h
@@ -27,7 +27,7 @@ class MockSignedExchangeHandlerParams {
       net::Error error,
       const GURL& inner_url,
       const std::string& mime_type,
-      std::vector<std::string> response_headers,
+      std::vector<std::pair<std::string, std::string>> response_headers,
       base::Optional<net::SHA256HashValue> header_integrity,
       const base::Time& signature_expire_time = base::Time());
   MockSignedExchangeHandlerParams(const MockSignedExchangeHandlerParams& other);
@@ -37,7 +37,7 @@ class MockSignedExchangeHandlerParams {
   const net::Error error;
   const GURL inner_url;
   const std::string mime_type;
-  const std::vector<std::string> response_headers;
+  const std::vector<std::pair<std::string, std::string>> response_headers;
   const base::Optional<net::SHA256HashValue> header_integrity;
   const base::Time signature_expire_time;
 };
diff --git a/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc b/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
index d86ba3c19a2..0d3ae7b6004 100644
--- a/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
+++ b/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
@@ -102,9 +102,11 @@ class RedirectResponseURLLoader : public network::mojom::URLLoader {
 
  private:
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {
     NOTREACHED();
   }
   void SetPriority(net::RequestPriority priority,
@@ -238,9 +240,11 @@ class InnerResponseURLLoader : public network::mojom::URLLoader {
   }
 
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {
     NOTREACHED();
   }
   void SetPriority(net::RequestPriority priority,
diff --git a/chromium/content/browser/web_package/save_page_as_web_bundle_browsertest.cc b/chromium/content/browser/web_package/save_page_as_web_bundle_browsertest.cc
index 67095f19b5b..c2e9c5d74a2 100644
--- a/chromium/content/browser/web_package/save_page_as_web_bundle_browsertest.cc
+++ b/chromium/content/browser/web_package/save_page_as_web_bundle_browsertest.cc
@@ -14,6 +14,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher.cc b/chromium/content/browser/web_package/signed_exchange_cert_fetcher.cc
index cc547a558ba..46e19085064 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher.cc
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher.cc
@@ -82,14 +82,14 @@ SignedExchangeCertFetcher::CreateAndStart(
     SignedExchangeDevToolsProxy* devtools_proxy,
     SignedExchangeReporter* reporter,
     const base::Optional<base::UnguessableToken>& throttling_profile_id,
-    base::Optional<net::NetworkIsolationKey> network_isolation_key) {
+    net::IsolationInfo isolation_info) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("loading"),
                "SignedExchangeCertFetcher::CreateAndStart");
   std::unique_ptr<SignedExchangeCertFetcher> cert_fetcher(
       new SignedExchangeCertFetcher(
           std::move(shared_url_loader_factory), std::move(throttles), cert_url,
           force_fetch, std::move(callback), devtools_proxy, reporter,
-          throttling_profile_id, std::move(network_isolation_key)));
+          throttling_profile_id, std::move(isolation_info)));
   cert_fetcher->Start();
   return cert_fetcher;
 }
@@ -104,7 +104,7 @@ SignedExchangeCertFetcher::SignedExchangeCertFetcher(
     SignedExchangeDevToolsProxy* devtools_proxy,
     SignedExchangeReporter* reporter,
     const base::Optional<base::UnguessableToken>& throttling_profile_id,
-    base::Optional<net::NetworkIsolationKey> network_isolation_key)
+    net::IsolationInfo isolation_info)
     : shared_url_loader_factory_(std::move(shared_url_loader_factory)),
       throttles_(std::move(throttles)),
       resource_request_(std::make_unique<network::ResourceRequest>()),
@@ -133,11 +133,10 @@ SignedExchangeCertFetcher::SignedExchangeCertFetcher(
     resource_request_->enable_load_timing = true;
   }
   resource_request_->throttling_profile_id = throttling_profile_id;
-  if (network_isolation_key) {
+  if (!isolation_info.IsEmpty()) {
     resource_request_->trusted_params =
         network::ResourceRequest::TrustedParams();
-    resource_request_->trusted_params->network_isolation_key =
-        *network_isolation_key;
+    resource_request_->trusted_params->isolation_info = isolation_info;
   }
 }
 
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher.h b/chromium/content/browser/web_package/signed_exchange_cert_fetcher.h
index 54918f9181b..485d9b7d5b0 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher.h
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher.h
@@ -18,7 +18,7 @@
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "net/base/network_isolation_key.h"
+#include "net/base/isolation_info.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 
 namespace network {
@@ -66,7 +66,7 @@ class CONTENT_EXPORT SignedExchangeCertFetcher
       SignedExchangeDevToolsProxy* devtools_proxy,
       SignedExchangeReporter* reporter,
       const base::Optional<base::UnguessableToken>& throttling_profile_id,
-      base::Optional<net::NetworkIsolationKey> network_isolation_key);
+      net::IsolationInfo isolation_info);
 
   ~SignedExchangeCertFetcher() override;
 
@@ -89,7 +89,7 @@ class CONTENT_EXPORT SignedExchangeCertFetcher
       SignedExchangeDevToolsProxy* devtools_proxy,
       SignedExchangeReporter* reporter,
       const base::Optional<base::UnguessableToken>& throttling_profile_id,
-      base::Optional<net::NetworkIsolationKey> network_isolation_key);
+      net::IsolationInfo isolation_info);
   void Start();
   void Abort();
   void OnHandleReady(MojoResult result);
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.cc b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.cc
index 499ad63cdd7..80442579238 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.cc
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/unguessable_token.h"
+#include "net/base/isolation_info.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "url/origin.h"
@@ -22,11 +23,11 @@ class SignedExchangeCertFetcherFactoryImpl
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
       URLLoaderThrottlesGetter url_loader_throttles_getter,
       const base::Optional<base::UnguessableToken>& throttling_profile_id,
-      base::Optional<net::NetworkIsolationKey> network_isolation_key)
+      net::IsolationInfo isolation_info)
       : url_loader_factory_(std::move(url_loader_factory)),
         url_loader_throttles_getter_(std::move(url_loader_throttles_getter)),
         throttling_profile_id_(throttling_profile_id),
-        network_isolation_key_(std::move(network_isolation_key)) {}
+        isolation_info_(std::move(isolation_info)) {}
 
   std::unique_ptr<SignedExchangeCertFetcher> CreateFetcherAndStart(
       const GURL& cert_url,
@@ -39,7 +40,7 @@ class SignedExchangeCertFetcherFactoryImpl
   scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
   URLLoaderThrottlesGetter url_loader_throttles_getter_;
   const base::Optional<base::UnguessableToken> throttling_profile_id_;
-  const base::Optional<net::NetworkIsolationKey> network_isolation_key_;
+  const net::IsolationInfo isolation_info_;
 };
 
 std::unique_ptr<SignedExchangeCertFetcher>
@@ -56,7 +57,7 @@ SignedExchangeCertFetcherFactoryImpl::CreateFetcherAndStart(
   return SignedExchangeCertFetcher::CreateAndStart(
       std::move(url_loader_factory_), std::move(throttles), cert_url,
       force_fetch, std::move(callback), devtools_proxy, reporter,
-      throttling_profile_id_, network_isolation_key_);
+      throttling_profile_id_, isolation_info_);
 }
 
 // static
@@ -65,10 +66,10 @@ SignedExchangeCertFetcherFactory::Create(
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
     URLLoaderThrottlesGetter url_loader_throttles_getter,
     const base::Optional<base::UnguessableToken>& throttling_profile_id,
-    base::Optional<net::NetworkIsolationKey> network_isolation_key) {
+    net::IsolationInfo isolation_info) {
   return std::make_unique<SignedExchangeCertFetcherFactoryImpl>(
       std::move(url_loader_factory), std::move(url_loader_throttles_getter),
-      throttling_profile_id, std::move(network_isolation_key));
+      throttling_profile_id, std::move(isolation_info));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.h b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.h
index e3f8adb0a58..0272b3a3455 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.h
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_factory.h
@@ -9,11 +9,10 @@
 #include <vector>
 
 #include "base/callback_forward.h"
-#include "base/optional.h"
 #include "base/unguessable_token.h"
 #include "content/browser/web_package/signed_exchange_cert_fetcher.h"
 #include "content/common/content_export.h"
-#include "net/base/network_isolation_key.h"
+#include "net/base/isolation_info.h"
 
 namespace network {
 class SharedURLLoaderFactory;
@@ -48,7 +47,7 @@ class CONTENT_EXPORT SignedExchangeCertFetcherFactory {
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
       URLLoaderThrottlesGetter url_loader_throttles_getter,
       const base::Optional<base::UnguessableToken>& throttling_profile_id,
-      base::Optional<net::NetworkIsolationKey> network_isolation_key);
+      net::IsolationInfo isolation_info);
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
index f5606d3a2f0..589f9a37dd4 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
@@ -16,6 +16,7 @@
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
+#include "net/base/isolation_info.h"
 #include "net/base/load_flags.h"
 #include "net/cert/x509_util.h"
 #include "net/test/cert_test_util.h"
@@ -49,7 +50,8 @@ class DeferringURLLoaderThrottle final : public blink::URLLoaderThrottle {
       const network::mojom::URLResponseHead& /* response_head */,
       bool* defer,
       std::vector<std::string>* /* to_be_removed_headers */,
-      net::HttpRequestHeaders* /* modified_headers */) override {
+      net::HttpRequestHeaders* /* modified_headers */,
+      net::HttpRequestHeaders* /* modified_cors_exempt_headers */) override {
     will_redirect_request_called_ = true;
     *defer = true;
   }
@@ -86,9 +88,10 @@ class MockURLLoader final : public network::mojom::URLLoader {
       : receiver_(this, std::move(url_loader_receiver)) {}
   ~MockURLLoader() override = default;
 
-  MOCK_METHOD3(FollowRedirect,
+  MOCK_METHOD4(FollowRedirect,
                void(const std::vector<std::string>&,
                     const net::HttpRequestHeaders&,
+                    const net::HttpRequestHeaders&,
                     const base::Optional<GURL>&));
   MOCK_METHOD2(SetPriority,
                void(net::RequestPriority priority,
@@ -223,16 +226,15 @@ class SignedExchangeCertFetcherTest : public testing::Test {
             &mock_loader_factory_),
         std::move(throttles_), url, force_fetch, std::move(callback),
         nullptr /* devtools_proxy */, nullptr /* reporter */,
-        base::nullopt /* throttling_profile_id */,
-        base::nullopt /* network_isolation_key */);
+        base::nullopt /* throttling_profile_id */, net::IsolationInfo());
   }
 
   void CallOnReceiveResponse() {
     auto response_head = network::mojom::URLResponseHead::New();
     response_head->headers =
         base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.1 200 OK");
-    response_head->headers->AddHeader(
-        "Content-Type: application/cert-chain+cbor");
+    response_head->headers->SetHeader("Content-Type",
+                                      "application/cert-chain+cbor");
     response_head->mime_type = "application/cert-chain+cbor";
     mock_loader_factory_.client_remote()->OnReceiveResponse(
         std::move(response_head));
@@ -482,7 +484,7 @@ TEST_F(SignedExchangeCertFetcherTest, WrongMimeType) {
   auto response_head = network::mojom::URLResponseHead::New();
   response_head->headers =
       base::MakeRefCounted<net::HttpResponseHeaders>("HTTP/1.1 200 OK");
-  response_head->headers->AddHeader("Content-Type: application/octet-stream");
+  response_head->headers->SetHeader("Content-Type", "application/octet-stream");
   response_head->mime_type = "application/octet-stream";
   mock_loader_factory_.client_remote()->OnReceiveResponse(
       std::move(response_head));
diff --git a/chromium/content/browser/web_package/signed_exchange_error.cc b/chromium/content/browser/web_package/signed_exchange_error.cc
index 098cdd9bcdf..69fafe298c6 100644
--- a/chromium/content/browser/web_package/signed_exchange_error.cc
+++ b/chromium/content/browser/web_package/signed_exchange_error.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/web_package/signed_exchange_error.h"
 
+#include "base/notreached.h"
+
 namespace content {
 
 // static
diff --git a/chromium/content/browser/web_package/signed_exchange_handler.cc b/chromium/content/browser/web_package/signed_exchange_handler.cc
index a8db39acf1d..9f63b8fcec7 100644
--- a/chromium/content/browser/web_package/signed_exchange_handler.cc
+++ b/chromium/content/browser/web_package/signed_exchange_handler.cc
@@ -252,10 +252,10 @@ void SignedExchangeHandler::DoHeaderLoop() {
   DCHECK(state_ == State::kReadingPrologueBeforeFallbackUrl ||
          state_ == State::kReadingPrologueFallbackUrlAndAfter ||
          state_ == State::kReadingHeaders);
-  int rv = source_->Read(
-      header_read_buf_.get(), header_read_buf_->BytesRemaining(),
-      base::BindRepeating(&SignedExchangeHandler::DidReadHeader,
-                          base::Unretained(this), false /* sync */));
+  int rv =
+      source_->Read(header_read_buf_.get(), header_read_buf_->BytesRemaining(),
+                    base::BindOnce(&SignedExchangeHandler::DidReadHeader,
+                                   base::Unretained(this), false /* sync */));
   if (rv != net::ERR_IO_PENDING)
     DidReadHeader(true /* sync */, rv);
 }
diff --git a/chromium/content/browser/web_package/signed_exchange_loader.cc b/chromium/content/browser/web_package/signed_exchange_loader.cc
index e48be37090f..02aab85898d 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader.cc
+++ b/chromium/content/browser/web_package/signed_exchange_loader.cc
@@ -140,10 +140,15 @@ void SignedExchangeLoader::OnStartLoadingResponseBody(
   auto cert_fetcher_factory = SignedExchangeCertFetcherFactory::Create(
       url_loader_factory_, url_loader_throttles_getter_,
       outer_request_.throttling_profile_id,
-      outer_request_.trusted_params
-          ? base::make_optional(
-                outer_request_.trusted_params->network_isolation_key)
-          : base::nullopt);
+      (outer_request_.trusted_params &&
+       !outer_request_.trusted_params->isolation_info.IsEmpty())
+          ? net::IsolationInfo::Create(
+                net::IsolationInfo::RedirectMode::kUpdateNothing,
+                *outer_request_.trusted_params->isolation_info
+                     .top_frame_origin(),
+                *outer_request_.trusted_params->isolation_info.frame_origin(),
+                net::SiteForCookies())
+          : net::IsolationInfo());
 
   if (g_signed_exchange_factory_for_testing_) {
     signed_exchange_handler_ = g_signed_exchange_factory_for_testing_->Create(
@@ -182,6 +187,7 @@ void SignedExchangeLoader::OnComplete(
 void SignedExchangeLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   NOTREACHED();
 }
diff --git a/chromium/content/browser/web_package/signed_exchange_loader.h b/chromium/content/browser/web_package/signed_exchange_loader.h
index f81a37a07b6..cf5cf12a897 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader.h
+++ b/chromium/content/browser/web_package/signed_exchange_loader.h
@@ -98,9 +98,11 @@ class CONTENT_EXPORT SignedExchangeLoader final
   void OnComplete(const network::URLLoaderCompletionStatus& status) override;
 
   // network::mojom::URLLoader implementation
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc b/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
index 1b72f45f9e5..8d4a823ef08 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
@@ -85,9 +85,10 @@ class SignedExchangeLoaderTest : public testing::TestWithParam<bool> {
     ~MockURLLoader() override = default;
 
     // network::mojom::URLLoader overrides:
-    MOCK_METHOD3(FollowRedirect,
+    MOCK_METHOD4(FollowRedirect,
                  void(const std::vector<std::string>&,
                       const net::HttpRequestHeaders&,
+                      const net::HttpRequestHeaders&,
                       const base::Optional<GURL>&));
     MOCK_METHOD2(SetPriority,
                  void(net::RequestPriority priority,
diff --git a/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc b/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
index ca006a2907f..455222105c5 100644
--- a/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
@@ -15,7 +15,6 @@
 #include "base/test/scoped_feature_list.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
-#include "build/build_config.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
@@ -40,6 +39,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/page_type.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/content_cert_verifier_browser_test.h"
@@ -48,6 +48,7 @@
 #include "content/public/test/url_loader_interceptor.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_download_manager_delegate.h"
+#include "media/media_buildflags.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/mock_cert_verifier.h"
 #include "net/dns/mock_host_resolver.h"
@@ -226,23 +227,12 @@ class SignedExchangeRequestHandlerBrowserTestBase
     inactive_rfh_deletion_observer_ =
         std::make_unique<InactiveRenderFrameHostDeletionObserver>(
             shell()->web_contents());
-#if defined(OS_ANDROID)
-    // TODO(crbug.com/864403): It seems that we call unsupported Android APIs on
-    // KitKat when we set a ContentBrowserClient. Don't call such APIs and make
-    // this test available on KitKat.
-    int32_t major_version = 0, minor_version = 0, bugfix_version = 0;
-    base::SysInfo::OperatingSystemVersionNumbers(&major_version, &minor_version,
-                                                 &bugfix_version);
-    if (major_version < 5)
-      return;
-#endif
     original_client_ = SetBrowserClientForTesting(&client_);
   }
 
   void TearDownOnMainThread() override {
     sxg_test_helper_.TearDownOnMainThread();
-    if (original_client_)
-      SetBrowserClientForTesting(original_client_);
+    SetBrowserClientForTesting(original_client_);
   }
 
  protected:
@@ -258,18 +248,12 @@ class SignedExchangeRequestHandlerBrowserTestBase
     sxg_test_helper_.InstallMockCertChainInterceptor();
   }
 
-  // Returns false if we cannot override accept languages. It happens only on
-  // Android Kitkat or older systems.
-  bool SetAcceptLangs(const std::string langs) {
-    if (!original_client_)
-      return false;
-
+  void SetAcceptLangs(const std::string langs) {
     client_.SetAcceptLangs(langs);
     StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
         BrowserContext::GetDefaultStoragePartition(
             shell()->web_contents()->GetBrowserContext()));
     partition->GetPrefetchURLLoaderService()->SetAcceptLanguages(langs);
-    return true;
   }
 
   std::unique_ptr<InactiveRenderFrameHostDeletionObserver>
@@ -448,8 +432,7 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, Simple) {
 }
 
 IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, VariantMatch) {
-  if (!SetAcceptLangs("en-US,fr"))
-    return;
+  SetAcceptLangs("en-US,fr");
   InstallUrlInterceptor(
       GURL("https://cert.example.org/cert.msg"),
       "content/test/data/sxg/test.example.org.public.pem.cbor");
@@ -490,8 +473,7 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, VariantMatch) {
 
 IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
                        VariantMismatch) {
-  if (!SetAcceptLangs("en-US,ja"))
-    return;
+  SetAcceptLangs("en-US,ja");
   InstallUrlInterceptor(
       GURL("https://cert.example.org/cert.msg"),
       "content/test/data/sxg/test.example.org.public.pem.cbor");
@@ -1099,15 +1081,23 @@ class SignedExchangeAcceptHeaderBrowserTest
                          bool is_fallback) {
     const auto accept_header = GetInterceptedAcceptHeader(url);
     ASSERT_TRUE(accept_header);
+    const char* frame_accept_c_str = network::kFrameAcceptHeaderValue;
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+    if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+      frame_accept_c_str =
+          "text/html,application/xhtml+xml,application/xml;q=0.9,"
+          "image/avif,image/webp,image/apng,*/*;q=0.8";
+    }
+#endif
     EXPECT_EQ(
         *accept_header,
         IsSignedExchangeEnabled() && !is_fallback
             ? (is_navigation
-                   ? std::string(network::kFrameAcceptHeaderValue) +
+                   ? std::string(frame_accept_c_str) +
                          std::string(kAcceptHeaderSignedExchangeSuffix)
                    : std::string(kExpectedSXGEnabledAcceptHeaderForPrefetch))
             : (is_navigation
-                   ? std::string(network::kFrameAcceptHeaderValue)
+                   ? std::string(frame_accept_c_str)
                    : std::string(network::kDefaultAcceptHeaderValue)));
   }
 
@@ -1294,8 +1284,15 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeAcceptHeaderBrowserTest, ServiceWorker) {
   NavigateAndWaitForTitle(https_server_.GetURL("/sxg/service-worker.html"),
                           "Done");
 
-  const std::string frame_accept =
-      std::string(network::kFrameAcceptHeaderValue);
+  const char* frame_accept_c_str = network::kFrameAcceptHeaderValue;
+#if BUILDFLAG(ENABLE_AV1_DECODER)
+  if (base::FeatureList::IsEnabled(blink::features::kAVIF)) {
+    frame_accept_c_str =
+        "text/html,application/xhtml+xml,application/xml;q=0.9,"
+        "image/avif,image/webp,image/apng,*/*;q=0.8";
+  }
+#endif
+  const std::string frame_accept = std::string(frame_accept_c_str);
   const std::string frame_accept_with_sxg =
       frame_accept + std::string(kAcceptHeaderSignedExchangeSuffix);
   const std::vector<std::string> scopes = {"/sxg/sw-scope-generated/",
diff --git a/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc b/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
index a4b148fb152..892a8733a4b 100644
--- a/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
@@ -36,6 +36,8 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/browsing_data_remover_test_util.h"
 #include "content/public/test/content_browser_test.h"
@@ -365,7 +367,8 @@ class SignedExchangePrefetchBrowserTest
       const net::SHA256HashValue& header_integrity,
       const std::string& content,
       const std::vector<std::pair<std::string, std::string>>& sxg_outer_headers,
-      const std::vector<std::string>& sxg_inner_headers = {},
+      const std::vector<std::pair<std::string, std::string>>&
+          sxg_inner_headers = {},
       const base::Time& signature_expire_time = base::Time()) {
     auto sxg_request_counter =
         RequestCounter::CreateAndMonitor(embedded_test_server(), sxg_path);
@@ -490,8 +493,9 @@ IN_PROC_BROWSER_TEST_P(
       "/target.html" /* inner_url_path */,
       net::SHA256HashValue({{0x01}}) /* header_integrity */, content,
       {} /* sxg_outer_headers */,
-      {base::StringPrintf("content-length: %" PRIuS,
-                          content.size())} /* sxg_inner_headers */);
+      {{"content-length",
+        base::StringPrintf("%" PRIuS,
+                           content.size())}} /* sxg_inner_headers */);
   const auto cached_exchanges = GetCachedExchanges(shell());
   // The content of prefetched SXG is larger than the Blob storage limit.
   // So the SXG should not be stored to the cache.
@@ -789,7 +793,6 @@ IN_PROC_BROWSER_TEST_P(SignedExchangePrefetchBrowserTest,
   const std::string outer_link_header =
       CreateAlternateLinkHeader(sxg_script_url, inner_url_script_url);
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString(
           {CreateAllowedAltSxgLinkHeader(inner_url_script_url,
                                          script_header_integrity),
@@ -815,7 +818,7 @@ IN_PROC_BROWSER_TEST_P(SignedExchangePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory(
       {MockSignedExchangeHandlerParams(
            sxg_page_url, SignedExchangeLoadResult::kSuccess, net::OK,
-           inner_url_page_url, "text/html", {inner_link_headers},
+           inner_url_page_url, "text/html", {{"Link", inner_link_headers}},
            page_header_integrity),
        MockSignedExchangeHandlerParams(
            sxg_script_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1003,8 +1006,8 @@ class SignedExchangeSubresourcePrefetchBrowserTest
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     PrefetchBrowserTestBase::SetUpCommandLine(command_line);
-    // Needed to call internals.scheduleBlinkGC().
-    command_line->AppendSwitch(switches::kExposeInternalsForTesting);
+    // For window.gc().
+    command_line->AppendSwitchASCII(switches::kJavaScriptFlags, "--expose-gc");
   }
 
   void SetUp() override {
@@ -1077,7 +1080,6 @@ class SignedExchangeSubresourcePrefetchBrowserTest
     const std::string outer_link_header =
         CreateAlternateLinkHeader(sxg_script_url, inner_url_script_url);
     const std::string inner_link_headers =
-        std::string("Link: ") +
         base::JoinString(
             {CreateAllowedAltSxgLinkHeader(inner_url_script_url,
                                            script_header_integrity),
@@ -1108,7 +1110,7 @@ class SignedExchangeSubresourcePrefetchBrowserTest
     MockSignedExchangeHandlerFactory factory(
         {MockSignedExchangeHandlerParams(
              sxg_page_url, SignedExchangeLoadResult::kSuccess, net::OK,
-             inner_url_page_url, "text/html", {inner_link_headers},
+             inner_url_page_url, "text/html", {{"Link", inner_link_headers}},
              page_header_integrity),
          MockSignedExchangeHandlerParams(
              sxg_script_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1215,7 +1217,6 @@ class SignedExchangeSubresourcePrefetchBrowserTest
     const std::string outer_link_header =
         CreateAlternateLinkHeader(script_sxg_url, script_url);
     const std::string inner_link_headers =
-        std::string("Link: ") +
         base::JoinString(
             {CreateAllowedAltSxgLinkHeader(script_url, script_header_integrity),
              CreatePreloadLinkHeader(script_url, "script")},
@@ -1236,15 +1237,16 @@ class SignedExchangeSubresourcePrefetchBrowserTest
                          {{"link", outer_link_header}}));
     RegisterResponse(script_sxg_path,
                      CreateSignedExchangeResponseEntry(content));
-    std::vector<std::string> script_inner_response_headers;
+    std::vector<std::pair<std::string, std::string>>
+        script_inner_response_headers;
     if (has_nosniff) {
-      script_inner_response_headers.emplace_back(
-          "x-content-type-options: nosniff");
+      script_inner_response_headers.emplace_back(std::make_pair(
+          std::string("x-content-type-options"), std::string("nosniff")));
     }
     MockSignedExchangeHandlerFactory factory(
         {MockSignedExchangeHandlerParams(
              target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
-             target_url, "text/html", {inner_link_headers},
+             target_url, "text/html", {{"Link", inner_link_headers}},
              target_header_integrity),
          MockSignedExchangeHandlerParams(
              script_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1560,7 +1562,6 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
                         CreateAlternateLinkHeader(image2_sxg_url, image2_url)},
                        ",");
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString(
           {CreateAllowedAltSxgLinkHeader(image1_url, image1_header_integrity),
            CreateAllowedAltSxgLinkHeader(image2_url, image2_header_integrity),
@@ -1595,7 +1596,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory(
       {MockSignedExchangeHandlerParams(
            target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
-           target_url, "text/html", {inner_link_headers},
+           target_url, "text/html", {{"Link", inner_link_headers}},
            target_header_integrity),
        MockSignedExchangeHandlerParams(
            image1_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1676,7 +1677,6 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
        CreateAlternateLinkHeader(script2_sxg_url, script2_url)},
       ",");
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString(
           {CreateAllowedAltSxgLinkHeader(script1_url, script1_header_integrity),
            CreateAllowedAltSxgLinkHeader(script2_url, script2_header_integrity),
@@ -1705,7 +1705,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory({
       MockSignedExchangeHandlerParams(
           target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
-          target_url, "text/html", {inner_link_headers},
+          target_url, "text/html", {{"Link", inner_link_headers}},
           target_header_integrity),
       MockSignedExchangeHandlerParams(
           script1_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1791,7 +1791,6 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   // Use the wrong header integrity value for "allowed-alt-sxg" link header to
   // trigger the integrity mismatch fallback logic.
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString({CreateAllowedAltSxgLinkHeader(
                             script_url, wrong_script_header_integrity),
                         CreatePreloadLinkHeader(script_url, "script")},
@@ -1813,7 +1812,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory(
       {MockSignedExchangeHandlerParams(
            target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
-           target_url, "text/html", {inner_link_headers},
+           target_url, "text/html", {{"Link", inner_link_headers}},
            target_header_integrity),
        MockSignedExchangeHandlerParams(
            script_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -1879,7 +1878,6 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   // Use the wrong header integrity value for "allowed-alt-sxg" link header for
   // script2 to trigger the integrity mismatch fallback logic.
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString(
           {CreateAllowedAltSxgLinkHeader(script1_url, script1_header_integrity),
            CreateAllowedAltSxgLinkHeader(script2_url,
@@ -1910,7 +1908,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory({
       MockSignedExchangeHandlerParams(
           target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
-          target_url, "text/html", {inner_link_headers},
+          target_url, "text/html", {{"Link", inner_link_headers}},
           target_header_integrity),
       MockSignedExchangeHandlerParams(
           script1_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
@@ -2054,7 +2052,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest, CORS) {
   const net::SHA256HashValue target_header_integrity = {{0x01}};
 
   std::string target_sxg_outer_link_header;
-  std::string target_sxg_inner_link_header("Link: ");
+  std::string target_sxg_inner_link_header;
   std::string requests_list_string;
 
   std::vector<MockSignedExchangeHandlerParams> mock_params;
@@ -2090,27 +2088,27 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest, CORS) {
             "server", "text/plain",
             {{"Access-Control-Allow-Origin", test_server_origin.c_str()},
              {"Access-Control-Allow-Credentials", "true"}}));
-    std::vector<std::string> data_sxg_inner_headers;
+    std::vector<std::pair<std::string, std::string>> data_sxg_inner_headers;
     if (kTestCases[i].access_control_allow_origin_header) {
-      data_sxg_inner_headers.emplace_back(
-          base::StringPrintf("Access-Control-Allow-Origin: %s",
-                             kTestCases[i].access_control_allow_origin_header));
+      data_sxg_inner_headers.emplace_back(std::make_pair(
+          std::string("Access-Control-Allow-Origin"),
+          std::string(kTestCases[i].access_control_allow_origin_header)));
     }
     if (kTestCases[i].has_access_control_allow_credentials_true_header) {
       data_sxg_inner_headers.emplace_back(
-          "Access-Control-Allow-Credentials: true");
+          std::make_pair(std::string("Access-Control-Allow-Credentials"),
+                         std::string("true")));
     }
     mock_params.emplace_back(
         data_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK, data_url,
         "text/plain", std::move(data_sxg_inner_headers), data_header_integrity);
   }
 
-  std::vector<std::string> target_sxg_inner_headers = {
-      std::move(target_sxg_inner_link_header)};
+  std::vector<std::pair<std::string, std::string>> target_sxg_inner_headers = {
+      {"Link", target_sxg_inner_link_header}};
   mock_params.emplace_back(target_sxg_url, SignedExchangeLoadResult::kSuccess,
                            net::OK, target_url, "text/html",
-                           std::move(target_sxg_inner_headers),
-                           target_header_integrity);
+                           target_sxg_inner_headers, target_header_integrity);
   MockSignedExchangeHandlerFactory factory(std::move(mock_params));
 
   RegisterResponse(
@@ -2222,7 +2220,6 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   const std::string outer_link_header =
       CreateAlternateLinkHeader(sxg_script_url, inner_url_script_url);
   const std::string inner_link_headers =
-      std::string("Link: ") +
       base::JoinString(
           {CreateAllowedAltSxgLinkHeader(inner_url_script_url,
                                          script_header_integrity),
@@ -2244,14 +2241,15 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   MockSignedExchangeHandlerFactory factory(
       {MockSignedExchangeHandlerParams(
            sxg_page_url, SignedExchangeLoadResult::kSuccess, net::OK,
-           inner_url_page_url, "text/html", {inner_link_headers},
+           inner_url_page_url, "text/html", {{"Link", inner_link_headers}},
            page_header_integrity),
        MockSignedExchangeHandlerParams(
            sxg_script_url, SignedExchangeLoadResult::kSuccess, net::OK,
            inner_url_script_url, "text/javascript",
            // Set "cache-control: public" to keep the script in the memory
            // cache.
-           {"cache-control: public, max-age=600"}, script_header_integrity)});
+           {{"cache-control", "public, max-age=600"}},
+           script_header_integrity)});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
   EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
@@ -2283,8 +2281,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
           "<head><title>Next page</title>"
           "<script src=\"./script.js\" async defer></script></head>"));
   // Triggers GC.
-  EXPECT_TRUE(
-      ExecuteScript(shell()->web_contents(), "internals.scheduleBlinkGC();"));
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(), "window.gc();"));
   // The script which was served via SXG must be kept in memory cache and must
   // be reused.
   NavigateToURLAndWaitTitle(next_page_url, "done");
diff --git a/chromium/content/browser/web_package/web_bundle_browsertest.cc b/chromium/content/browser/web_package/web_bundle_browsertest.cc
index 5929d66882f..ce0f8b43f4b 100644
--- a/chromium/content/browser/web_package/web_bundle_browsertest.cc
+++ b/chromium/content/browser/web_package/web_bundle_browsertest.cc
@@ -24,6 +24,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
@@ -56,6 +57,14 @@ constexpr char kDefaultHeaders[] =
     "Content-Type: application/webbundle\n"
     "X-Content-Type-Options: nosniff\n";
 
+constexpr char kHeadersForHtml[] =
+    "HTTP/1.1 200 OK\n"
+    "Content-Type: text/html\n";
+
+constexpr char kHeadersForJavaScript[] =
+    "HTTP/1.1 200 OK\n"
+    "Content-Type: application/javascript\n";
+
 base::FilePath GetTestDataPath(base::StringPiece file) {
   base::FilePath test_data_dir;
   CHECK(base::PathService::Get(base::DIR_SOURCE_ROOT, &test_data_dir));
@@ -65,20 +74,25 @@ base::FilePath GetTestDataPath(base::StringPiece file) {
 }
 
 #if defined(OS_ANDROID)
-GURL CopyFileAndGetContentUri(const base::FilePath& file) {
+void CopyFileAndGetContentUri(const base::FilePath& file,
+                              GURL* content_uri,
+                              base::FilePath* new_file_path) {
+  DCHECK(content_uri);
   base::ScopedAllowBlockingForTesting allow_blocking;
   base::FilePath tmp_dir;
-  CHECK(base::GetTempDir(&tmp_dir));
+  ASSERT_TRUE(base::GetTempDir(&tmp_dir));
   // The directory name "web_bundle" must be kept in sync with
   // content/shell/android/browsertests_apk/res/xml/file_paths.xml
   base::FilePath tmp_wbn_dir = tmp_dir.AppendASCII("web_bundle");
-  CHECK(base::CreateDirectoryAndGetError(tmp_wbn_dir, nullptr));
+  ASSERT_TRUE(base::CreateDirectoryAndGetError(tmp_wbn_dir, nullptr));
   base::FilePath tmp_dir_in_tmp_wbn_dir;
-  CHECK(
+  ASSERT_TRUE(
       base::CreateTemporaryDirInDir(tmp_wbn_dir, "", &tmp_dir_in_tmp_wbn_dir));
   base::FilePath temp_file = tmp_dir_in_tmp_wbn_dir.Append(file.BaseName());
-  CHECK(base::CopyFile(file, temp_file));
-  return GURL(base::GetContentUriFromFilePath(temp_file).value());
+  ASSERT_TRUE(base::CopyFile(file, temp_file));
+  if (new_file_path)
+    *new_file_path = temp_file;
+  *content_uri = GURL(base::GetContentUriFromFilePath(temp_file).value());
 }
 #endif  // OS_ANDROID
 
@@ -288,21 +302,6 @@ class TestBrowserClient : public ContentBrowserClient {
   DISALLOW_COPY_AND_ASSIGN(TestBrowserClient);
 };
 
-ContentBrowserClient* MaybeSetBrowserClientForTesting(
-    ContentBrowserClient* browser_client) {
-#if defined(OS_ANDROID)
-  // TODO(crbug.com/864403): It seems that we call unsupported Android APIs on
-  // KitKat when we set a ContentBrowserClient. Don't call such APIs and make
-  // this test available on KitKat.
-  int32_t major_version = 0, minor_version = 0, bugfix_version = 0;
-  base::SysInfo::OperatingSystemVersionNumbers(&major_version, &minor_version,
-                                               &bugfix_version);
-  if (major_version < 5)
-    return nullptr;
-#endif  // defined(OS_ANDROID)
-  return SetBrowserClientForTesting(browser_client);
-}
-
 class WebBundleBrowserTestBase : public ContentBrowserTest {
  protected:
   WebBundleBrowserTestBase() = default;
@@ -310,23 +309,16 @@ class WebBundleBrowserTestBase : public ContentBrowserTest {
 
   void SetUpOnMainThread() override {
     ContentBrowserTest::SetUpOnMainThread();
-    original_client_ = MaybeSetBrowserClientForTesting(&browser_client_);
+    original_client_ = SetBrowserClientForTesting(&browser_client_);
   }
 
   void TearDownOnMainThread() override {
     ContentBrowserTest::TearDownOnMainThread();
-    if (original_client_)
-      SetBrowserClientForTesting(original_client_);
+    SetBrowserClientForTesting(original_client_);
   }
 
-  // Returns false if we cannot override accept languages. It happens only on
-  // Android Kitkat or older systems.
-  bool SetAcceptLangs(const std::string langs) {
-    if (!original_client_)
-      return false;
-
+  void SetAcceptLangs(const std::string langs) {
     browser_client_.SetAcceptLangs(langs);
-    return true;
   }
 
   void NavigateAndWaitForTitle(const GURL& test_data_url,
@@ -366,10 +358,25 @@ class WebBundleBrowserTestBase : public ContentBrowserTest {
         base::StringPrintf("location.href = '%s';", url.spec().c_str()), title);
   }
 
-  ContentBrowserClient* original_client_ = nullptr;
+  void CreateTemporaryWebBundleFile(const std::string& content,
+                                    base::FilePath* file_path) {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    if (!temp_dir_.IsValid()) {
+      ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
+    }
+    base::FilePath tmp_file_path;
+    ASSERT_TRUE(
+        base::CreateTemporaryFileInDir(temp_dir_.GetPath(), &tmp_file_path));
+    if (!content.empty())
+      ASSERT_TRUE(base::WriteFile(tmp_file_path, content));
+    *file_path = tmp_file_path.AddExtension(FILE_PATH_LITERAL(".wbn"));
+    ASSERT_TRUE(base::Move(tmp_file_path, *file_path));
+  }
 
  private:
+  ContentBrowserClient* original_client_ = nullptr;
   TestBrowserClient browser_client_;
+  base::ScopedTempDir temp_dir_;
 
   DISALLOW_COPY_AND_ASSIGN(WebBundleBrowserTestBase);
 };
@@ -429,36 +436,238 @@ std::string CreateSimpleWebBundle(const GURL& primary_url) {
   return std::string(bundle.begin(), bundle.end());
 }
 
-std::string CreatePathTestWebBundle(
-    const net::test_server::EmbeddedTestServer* server) {
-  const GURL primary_url = server->GetURL("/web_bundle/path_test/in_scope/");
-  data_decoder::test::WebBundleBuilder builder(primary_url.spec(), "");
-  builder.AddExchange(primary_url.spec(),
-                      {{":status", "200"}, {"content-type", "text/html"}},
-                      "<title>Ready</title>");
-  builder.AddExchange(
-      server->GetURL("/web_bundle/path_test/in_scope/page.html").spec(),
-      {{":status", "200"}, {"content-type", "text/html"}},
+void AddHtmlFile(data_decoder::test::WebBundleBuilder* builder,
+                 const GURL& base_url,
+                 const std::string& path,
+                 const std::string& content) {
+  builder->AddExchange(base_url.Resolve(path).spec(),
+                       {{":status", "200"}, {"content-type", "text/html"}},
+                       content);
+}
+
+void AddScriptFile(data_decoder::test::WebBundleBuilder* builder,
+                   const GURL& base_url,
+                   const std::string& path,
+                   const std::string& content) {
+  builder->AddExchange(
+      base_url.Resolve(path).spec(),
+      {{":status", "200"}, {"content-type", "application/javascript"}},
+      content);
+}
+
+std::string CreatePathTestWebBundle(const GURL& base_url) {
+  const std::string primary_url_path = "/web_bundle/path_test/in_scope/";
+  data_decoder::test::WebBundleBuilder builder(
+      base_url.Resolve(primary_url_path).spec(), "");
+  AddHtmlFile(&builder, base_url, primary_url_path, "<title>Ready</title>");
+  AddHtmlFile(
+      &builder, base_url, "/web_bundle/path_test/in_scope/page.html",
       "<script>const page_info = 'In scope page in Web Bundle';</script>"
       "<script src=\"page.js\"></script>");
-  builder.AddExchange(
-      server->GetURL("/web_bundle/path_test/in_scope/page.js").spec(),
-      {{":status", "200"}, {"content-type", "application/javascript"}},
+  AddScriptFile(
+      &builder, base_url, "/web_bundle/path_test/in_scope/page.js",
       "document.title = page_info + ' / in scope script in Web Bundle';");
-  builder.AddExchange(
-      server->GetURL("/web_bundle/path_test/out_scope/page.html").spec(),
-      {{":status", "200"}, {"content-type", "text/html"}},
+  AddHtmlFile(
+      &builder, base_url, "/web_bundle/path_test/out_scope/page.html",
       "<script>const page_info = 'Out scope page in Web Bundle';</script>"
       "<script src=\"page.js\"></script>");
-  builder.AddExchange(
-      server->GetURL("/web_bundle/path_test/out_scope/page.js").spec(),
-      {{":status", "200"}, {"content-type", "application/javascript"}},
+  AddScriptFile(
+      &builder, base_url, "/web_bundle/path_test/out_scope/page.js",
       "document.title = page_info + ' / out scope script in Web Bundle';");
-
   std::vector<uint8_t> bundle = builder.CreateBundle();
   return std::string(bundle.begin(), bundle.end());
 }
 
+std::string CreateSubPageHtml(const std::string& page_info) {
+  return base::StringPrintf(R"(
+    <body><script>
+      const page_info = '%s';
+      let script  = document.createElement('script');
+      script.src = location.hash.substr(1);
+      document.body.appendChild(script);
+    </script></body>)",
+                            page_info.c_str());
+}
+
+std::string CreateScriptForSubPageTest(const std::string& script_info) {
+  return base::StringPrintf(
+      R"(
+        if (window.opener) {
+          window.opener.postMessage(page_info + ' %s', '*');
+        } else {
+          window.parent.window.postMessage(page_info + ' %s', '*');
+        }
+        )",
+      script_info.c_str(), script_info.c_str());
+}
+
+void RegisterRequestHandlerForSubPageTest(net::EmbeddedTestServer* server,
+                                          const std::string& prefix) {
+  server->RegisterRequestHandler(base::BindRepeating(
+      [](const std::string& prefix,
+         const net::test_server::HttpRequest& request)
+          -> std::unique_ptr<net::test_server::HttpResponse> {
+        if (base::EndsWith(request.relative_url, "subpage",
+                           base::CompareCase::SENSITIVE)) {
+          return std::make_unique<net::test_server::RawHttpResponse>(
+              kHeadersForHtml, CreateSubPageHtml(prefix + "server-page"));
+        }
+        if (base::EndsWith(request.relative_url, "script",
+                           base::CompareCase::SENSITIVE)) {
+          return std::make_unique<net::test_server::RawHttpResponse>(
+              kHeadersForJavaScript,
+              CreateScriptForSubPageTest(prefix + "server-script"));
+        }
+        return nullptr;
+      },
+      prefix));
+}
+
+// Sets up |primary_server| and |third_party_server| to return server generated
+// sub page HTML files and JavaScript files:
+//  - |primary_server| will return a sub page file created by
+//    CreateSubPageHtml("") for all URL which ends with "subpage", and returns a
+//    script file created by CreateScriptForSubPageTest("") for all URL which
+//    ends with "script".
+//  - |third_party_server| will return a sub page file created by
+//    CreateSubPageHtml("third-party:") for all URL which ends with "subpage",
+//    and returns a script file created by
+//    CreateScriptForSubPageTest("third-party:") for all URL which ends with
+//    "script".
+// And generates a web bundle file which contains the following files:
+//  - in |primary_server|'s origin:
+//    - /top : web bundle file's primary URL.
+//    - /subpage : returns CreateSubPageHtml("wbn-page").
+//    - /script : returns CreateScriptForSubPageTest("wbn-script").
+//  - in |third_party_server|'s origin:
+//    - /subpage : returns CreateSubPageHtml("third-party:wbn-page").
+//    - /script : returns CreateScriptForSubPageTest("third-party:wbn-script").
+// When the sub page is loaded using iframe or window.open(), a script of the
+// URL hash of the sub page is loaded. And domAutomationController.send() will
+// be called via postMessage(). So we can know whether the sub page and the
+// script are loaded from the web bundle file or the server.
+void SetUpSubPageTest(net::EmbeddedTestServer* primary_server,
+                      net::EmbeddedTestServer* third_party_server,
+                      GURL* primary_url_origin,
+                      GURL* third_party_origin,
+                      std::string* web_bundle_content) {
+  RegisterRequestHandlerForSubPageTest(primary_server, "");
+  RegisterRequestHandlerForSubPageTest(third_party_server, "third-party:");
+
+  ASSERT_TRUE(primary_server->Start());
+  ASSERT_TRUE(third_party_server->Start());
+  *primary_url_origin = primary_server->GetURL("/");
+  *third_party_origin = third_party_server->GetURL("/");
+
+  data_decoder::test::WebBundleBuilder builder(
+      primary_url_origin->Resolve("/top").spec(), "");
+  AddHtmlFile(&builder, *primary_url_origin, "/top", R"(
+    <script>
+    window.addEventListener('message',
+                            event => domAutomationController.send(event.data),
+                            false);
+    document.title = 'Ready';
+    </script>
+    )");
+  AddHtmlFile(&builder, *primary_url_origin, "/subpage",
+              CreateSubPageHtml("wbn-page"));
+  AddScriptFile(&builder, *primary_url_origin, "/script",
+                CreateScriptForSubPageTest("wbn-script"));
+
+  AddHtmlFile(&builder, *third_party_origin, "/subpage",
+              CreateSubPageHtml("third-party:wbn-page"));
+  AddScriptFile(&builder, *third_party_origin, "/script",
+                CreateScriptForSubPageTest("third-party:wbn-script"));
+
+  std::vector<uint8_t> bundle = builder.CreateBundle();
+  *web_bundle_content = std::string(bundle.begin(), bundle.end());
+}
+
+std::string AddIframeAndWaitForMessage(const ToRenderFrameHost& adapter,
+                                       const GURL& url) {
+  std::string result;
+  EXPECT_TRUE(content::ExecuteScriptAndExtractString(adapter,
+                                                     base::StringPrintf(
+                                                         R"(
+  (function(){
+    const iframe = document.createElement('iframe');
+    iframe.src = '%s';
+    document.body.appendChild(iframe);
+  })();
+  )",
+                                                         url.spec().c_str()),
+                                                     &result));
+  return result;
+}
+
+std::string WindowOpenAndWaitForMessage(const ToRenderFrameHost& adapter,
+                                        const GURL& url) {
+  std::string result;
+  EXPECT_TRUE(content::ExecuteScriptAndExtractString(
+      adapter,
+      base::StringPrintf(R"(
+        if (document.last_win) {
+          // Close the latest window to avoid OOM-killer on Android.
+          document.last_win.close();
+        }
+        document.last_win = window.open('%s', '_blank');
+      )",
+                         url.spec().c_str()),
+      &result));
+  return result;
+}
+
+// Runs tests for subpages  (iframe / window.open()). This function calls
+// |test_func| to create an iframe (AddIframeAndWaitForMessage) or to open a new
+// window (WindowOpenAndWaitForMessage).
+// |support_third_party_wbn_page| must be true when third party pages should be
+// served from servers even if they are in the web bundle.
+void RunSubPageTest(const ToRenderFrameHost& adapter,
+                    const GURL& primary_url_origin,
+                    const GURL& third_party_origin,
+                    std::string (*test_func)(const content::ToRenderFrameHost&,
+                                             const GURL&),
+                    bool support_third_party_wbn_page) {
+  EXPECT_EQ(
+      "wbn-page wbn-script",
+      (*test_func)(adapter,
+                   primary_url_origin.Resolve("/subpage").Resolve("#/script")));
+  EXPECT_EQ("wbn-page server-script",
+            (*test_func)(adapter, primary_url_origin.Resolve("/subpage")
+                                      .Resolve("#/not-in-wbn-script")));
+
+  EXPECT_EQ(
+      support_third_party_wbn_page ? "wbn-page third-party:wbn-script"
+                                   : "wbn-page third-party:server-script",
+      (*test_func)(adapter,
+                   primary_url_origin.Resolve("/subpage")
+                       .Resolve(std::string("#") +
+                                third_party_origin.Resolve("/script").spec())));
+  EXPECT_EQ(
+      "wbn-page third-party:server-script",
+      (*test_func)(
+          adapter,
+          primary_url_origin.Resolve("/subpage")
+              .Resolve(
+                  std::string("#") +
+                  third_party_origin.Resolve("/not-in-wbn-script").spec())));
+
+  EXPECT_EQ(
+      "server-page server-script",
+      (*test_func)(adapter, primary_url_origin.Resolve("/not-in-wbn-subpage")
+                                .Resolve("#/script")));
+  EXPECT_EQ(
+      support_third_party_wbn_page
+          ? "third-party:wbn-page third-party:wbn-script"
+          : "third-party:server-page third-party:server-script",
+      (*test_func)(adapter,
+                   third_party_origin.Resolve("/subpage").Resolve("#script")));
+  EXPECT_EQ(
+      "third-party:server-page third-party:server-script",
+      (*test_func)(adapter, third_party_origin.Resolve("/not-in-wbn-subpage")
+                                .Resolve("#script")));
+}
+
 }  // namespace
 
 class InvalidTrustableWebBundleFileUrlBrowserTest : public ContentBrowserTest {
@@ -468,13 +677,12 @@ class InvalidTrustableWebBundleFileUrlBrowserTest : public ContentBrowserTest {
 
   void SetUpOnMainThread() override {
     ContentBrowserTest::SetUpOnMainThread();
-    original_client_ = MaybeSetBrowserClientForTesting(&browser_client_);
+    original_client_ = SetBrowserClientForTesting(&browser_client_);
   }
 
   void TearDownOnMainThread() override {
     ContentBrowserTest::TearDownOnMainThread();
-    if (original_client_)
-      SetBrowserClientForTesting(original_client_);
+    SetBrowserClientForTesting(original_client_);
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
@@ -482,9 +690,8 @@ class InvalidTrustableWebBundleFileUrlBrowserTest : public ContentBrowserTest {
                                     kInvalidFileUrl);
   }
 
-  ContentBrowserClient* original_client_ = nullptr;
-
  private:
+  ContentBrowserClient* original_client_ = nullptr;
   TestBrowserClient browser_client_;
 
   DISALLOW_COPY_AND_ASSIGN(InvalidTrustableWebBundleFileUrlBrowserTest);
@@ -492,10 +699,6 @@ class InvalidTrustableWebBundleFileUrlBrowserTest : public ContentBrowserTest {
 
 IN_PROC_BROWSER_TEST_F(InvalidTrustableWebBundleFileUrlBrowserTest,
                        NoCrashOnNavigation) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
   base::RunLoop run_loop;
   FinishNavigationObserver finish_navigation_observer(shell()->web_contents(),
                                                       run_loop.QuitClosure());
@@ -505,94 +708,118 @@ IN_PROC_BROWSER_TEST_F(InvalidTrustableWebBundleFileUrlBrowserTest,
   EXPECT_EQ(net::ERR_INVALID_URL, *finish_navigation_observer.error_code());
 }
 
-class WebBundleTrustableFileBrowserTestBase : public WebBundleBrowserTestBase {
+enum class TestFilePathMode {
+  kNormalFilePath,
+#if defined(OS_ANDROID)
+  kContentURI,
+#endif  // OS_ANDROID
+};
+
+#if defined(OS_ANDROID)
+#define TEST_FILE_PATH_MODE_PARAMS                   \
+  testing::Values(TestFilePathMode::kNormalFilePath, \
+                  TestFilePathMode::kContentURI)
+#else
+#define TEST_FILE_PATH_MODE_PARAMS \
+  testing::Values(TestFilePathMode::kNormalFilePath)
+#endif  // OS_ANDROID
+
+class WebBundleTrustableFileBrowserTest
+    : public testing::WithParamInterface<TestFilePathMode>,
+      public WebBundleBrowserTestBase {
  protected:
-  WebBundleTrustableFileBrowserTestBase() = default;
-  ~WebBundleTrustableFileBrowserTestBase() override = default;
+  WebBundleTrustableFileBrowserTest() = default;
+  ~WebBundleTrustableFileBrowserTest() override = default;
 
-  void SetUp() override { WebBundleBrowserTestBase::SetUp(); }
+  void SetUp() override {
+    InitializeTestDataUrl();
+    SetEmptyPageUrl();
+    WebBundleBrowserTestBase::SetUp();
+  }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitchASCII(switches::kTrustableWebBundleFileUrl,
                                     test_data_url().spec());
   }
 
+  void WriteWebBundleFile(const std::string& contents) {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    ASSERT_FALSE(contents.empty());
+    ASSERT_TRUE(base::WriteFile(test_data_file_path_, contents.data(),
+                                contents.size()) > 0);
+  }
+
+  void WriteCommonWebBundleFile() {
+    std::string contents;
+    {
+      base::ScopedAllowBlockingForTesting allow_blocking;
+      ASSERT_TRUE(base::ReadFileToString(
+          GetTestDataPath("web_bundle_browsertest.wbn"), &contents));
+    }
+    WriteWebBundleFile(contents);
+  }
+
   const GURL& test_data_url() const { return test_data_url_; }
   const GURL& empty_page_url() const { return empty_page_url_; }
 
-  GURL test_data_url_;
-  GURL empty_page_url_;
+  std::string ExecuteAndGetString(const std::string& script) {
+    std::string result;
+    EXPECT_TRUE(content::ExecuteScriptAndExtractString(
+        shell()->web_contents(), "domAutomationController.send(" + script + ")",
+        &result));
+    return result;
+  }
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(WebBundleTrustableFileBrowserTestBase);
-};
-
-enum class TestFilePathMode {
-  kNormalFilePath,
+  void InitializeTestDataUrl() {
+    base::FilePath file_path;
+    CreateTemporaryWebBundleFile("", &file_path);
+    if (GetParam() == TestFilePathMode::kNormalFilePath) {
+      test_data_file_path_ = file_path;
+      test_data_url_ = net::FilePathToFileURL(file_path);
+      return;
+    }
 #if defined(OS_ANDROID)
-  kContentURI,
+    DCHECK_EQ(TestFilePathMode::kContentURI, GetParam());
+    CopyFileAndGetContentUri(file_path, &test_data_url_, &test_data_file_path_);
 #endif  // OS_ANDROID
-};
+  }
 
-class WebBundleTrustableFileBrowserTest
-    : public testing::WithParamInterface<TestFilePathMode>,
-      public WebBundleTrustableFileBrowserTestBase {
- protected:
-  WebBundleTrustableFileBrowserTest() {
+  void SetEmptyPageUrl() {
     if (GetParam() == TestFilePathMode::kNormalFilePath) {
-      test_data_url_ =
-          net::FilePathToFileURL(GetTestDataPath("web_bundle_browsertest.wbn"));
       empty_page_url_ =
           net::FilePathToFileURL(GetTestDataPath("empty_page.html"));
       return;
     }
 #if defined(OS_ANDROID)
     DCHECK_EQ(TestFilePathMode::kContentURI, GetParam());
-    test_data_url_ =
-        CopyFileAndGetContentUri(GetTestDataPath("web_bundle_browsertest.wbn"));
-    empty_page_url_ =
-        CopyFileAndGetContentUri(GetTestDataPath("empty_page.html"));
+    CopyFileAndGetContentUri(GetTestDataPath("empty_page.html"),
+                             &empty_page_url_, nullptr /* new_file_path */);
 #endif  // OS_ANDROID
   }
-  ~WebBundleTrustableFileBrowserTest() override = default;
 
-  std::string ExecuteAndGetString(const std::string& script) {
-    std::string result;
-    EXPECT_TRUE(content::ExecuteScriptAndExtractString(
-        shell()->web_contents(), "domAutomationController.send(" + script + ")",
-        &result));
-    return result;
-  }
+  GURL test_data_url_;
+  base::FilePath test_data_file_path_;
+
+  GURL empty_page_url_;
 
- private:
   DISALLOW_COPY_AND_ASSIGN(WebBundleTrustableFileBrowserTest);
 };
 
 IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest,
                        TrustableWebBundleFile) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
+  WriteCommonWebBundleFile();
   NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
 }
 
 IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, RangeRequest) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
-
+  WriteCommonWebBundleFile();
   NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
   RunTestScript("test-range-request.js");
 }
 
 IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, Navigations) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
-
+  WriteCommonWebBundleFile();
   NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
   // Move to page 1.
   NavigateToURLAndWaitForTitle(GURL(kTestPage1Url), "Page 1");
@@ -637,10 +864,7 @@ IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, Navigations) {
 }
 
 IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, NavigationWithHash) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
+  WriteCommonWebBundleFile();
   NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
   NavigateToURLAndWaitForTitle(GURL(kTestPageForHashUrl), "#hello");
 
@@ -653,10 +877,7 @@ IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, NavigationWithHash) {
 }
 
 IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, BaseURI) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
+  WriteCommonWebBundleFile();
   NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
   EXPECT_EQ(ExecuteAndGetString("(new Request('./foo/bar')).url"),
             "https://test.example.org/foo/bar");
@@ -673,33 +894,67 @@ IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, BaseURI) {
             "https://example.org/piyo/foo/bar");
 }
 
-INSTANTIATE_TEST_SUITE_P(WebBundleTrustableFileBrowserTests,
+IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, Iframe) {
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+  WriteWebBundleFile(web_bundle_content);
+
+  NavigateToBundleAndWaitForReady(test_data_url(),
+                                  primary_url_origin.Resolve("/top"));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &AddIframeAndWaitForMessage,
+                 true /* support_third_party_wbn_page */);
+}
+
+IN_PROC_BROWSER_TEST_P(WebBundleTrustableFileBrowserTest, WindowOpen) {
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+  WriteWebBundleFile(web_bundle_content);
+
+  NavigateToBundleAndWaitForReady(test_data_url(),
+                                  primary_url_origin.Resolve("/top"));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &WindowOpenAndWaitForMessage,
+                 true /* support_third_party_wbn_page */);
+}
+
+INSTANTIATE_TEST_SUITE_P(WebBundleTrustableFileBrowserTest,
                          WebBundleTrustableFileBrowserTest,
-                         testing::Values(TestFilePathMode::kNormalFilePath
-#if defined(OS_ANDROID)
-                                         ,
-                                         TestFilePathMode::kContentURI
-#endif  // OS_ANDROID
-                                         ));
+                         TEST_FILE_PATH_MODE_PARAMS);
 
 class WebBundleTrustableFileNotFoundBrowserTest
-    : public WebBundleTrustableFileBrowserTestBase {
+    : public WebBundleBrowserTestBase {
  protected:
-  WebBundleTrustableFileNotFoundBrowserTest() {
-    base::FilePath test_data_dir;
-    CHECK(base::PathService::Get(base::DIR_SOURCE_ROOT, &test_data_dir));
-    test_data_url_ =
-        net::FilePathToFileURL(test_data_dir.AppendASCII("not_found"));
-  }
+  WebBundleTrustableFileNotFoundBrowserTest() = default;
   ~WebBundleTrustableFileNotFoundBrowserTest() override = default;
+  void SetUp() override {
+    test_data_url_ = net::FilePathToFileURL(GetTestDataPath("not_found"));
+    WebBundleBrowserTestBase::SetUp();
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitchASCII(switches::kTrustableWebBundleFileUrl,
+                                    test_data_url().spec());
+  }
+  const GURL& test_data_url() const { return test_data_url_; }
+
+ private:
+  GURL test_data_url_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebBundleTrustableFileNotFoundBrowserTest);
 };
 
 IN_PROC_BROWSER_TEST_F(WebBundleTrustableFileNotFoundBrowserTest, NotFound) {
-  // Don't run the test if we couldn't override BrowserClient. It happens only
-  // on Android Kitkat or older systems.
-  if (!original_client_)
-    return;
-
   std::string console_message = ExpectNavigationFailureAndReturnConsoleMessage(
       shell()->web_contents(), test_data_url());
 
@@ -720,14 +975,17 @@ class WebBundleFileBrowserTest
   }
 
   GURL GetTestUrlForFile(base::FilePath file_path) const {
-    switch (GetParam()) {
-      case TestFilePathMode::kNormalFilePath:
-        return net::FilePathToFileURL(file_path);
+    GURL content_uri;
+    if (GetParam() == TestFilePathMode::kNormalFilePath) {
+      content_uri = net::FilePathToFileURL(file_path);
+    } else {
 #if defined(OS_ANDROID)
-      case TestFilePathMode::kContentURI:
-        return CopyFileAndGetContentUri(file_path);
+      DCHECK_EQ(TestFilePathMode::kContentURI, GetParam());
+      CopyFileAndGetContentUri(file_path, &content_uri,
+                               nullptr /* new_file_path */);
 #endif  // OS_ANDROID
     }
+    return content_uri;
   }
 
  private:
@@ -953,15 +1211,14 @@ IN_PROC_BROWSER_TEST_P(WebBundleFileBrowserTest, ParseResponseCrash) {
 }
 
 IN_PROC_BROWSER_TEST_P(WebBundleFileBrowserTest, Variants) {
-  if (!SetAcceptLangs("ja,en"))
-    return;
+  SetAcceptLangs("ja,en");
   const GURL test_data_url =
       GetTestUrlForFile(GetTestDataPath("variants_test.wbn"));
   NavigateAndWaitForTitle(test_data_url,
                           web_bundle_utils::GetSynthesizedUrlForWebBundle(
                               test_data_url, GURL(kTestPageUrl)),
                           "lang=ja");
-  ASSERT_TRUE(SetAcceptLangs("en,ja"));
+  SetAcceptLangs("en,ja");
   NavigateAndWaitForTitle(test_data_url,
                           web_bundle_utils::GetSynthesizedUrlForWebBundle(
                               test_data_url, GURL(kTestPageUrl)),
@@ -1051,14 +1308,49 @@ IN_PROC_BROWSER_TEST_P(WebBundleFileBrowserTest, IframeNavigationNoCrash) {
                                "Iframe loaded again");
 }
 
+IN_PROC_BROWSER_TEST_P(WebBundleFileBrowserTest, Iframe) {
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+
+  base::FilePath file_path;
+  CreateTemporaryWebBundleFile(web_bundle_content, &file_path);
+  const GURL test_data_url = GetTestUrlForFile(file_path);
+  NavigateToBundleAndWaitForReady(
+      test_data_url, web_bundle_utils::GetSynthesizedUrlForWebBundle(
+                         test_data_url, primary_url_origin.Resolve("/top")));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &AddIframeAndWaitForMessage,
+                 true /* support_third_party_wbn_page */);
+}
+
+IN_PROC_BROWSER_TEST_P(WebBundleFileBrowserTest, WindowOpen) {
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+
+  base::FilePath file_path;
+  CreateTemporaryWebBundleFile(web_bundle_content, &file_path);
+  const GURL test_data_url = GetTestUrlForFile(file_path);
+  NavigateToBundleAndWaitForReady(
+      test_data_url, web_bundle_utils::GetSynthesizedUrlForWebBundle(
+                         test_data_url, primary_url_origin.Resolve("/top")));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &WindowOpenAndWaitForMessage,
+                 true /* support_third_party_wbn_page */);
+}
+
 INSTANTIATE_TEST_SUITE_P(WebBundleFileBrowserTest,
                          WebBundleFileBrowserTest,
-                         testing::Values(TestFilePathMode::kNormalFilePath
-#if defined(OS_ANDROID)
-                                         ,
-                                         TestFilePathMode::kContentURI
-#endif  // OS_ANDROID
-                                         ));
+                         TEST_FILE_PATH_MODE_PARAMS);
 
 class WebBundleNetworkBrowserTest : public WebBundleBrowserTestBase {
  protected:
@@ -1069,6 +1361,7 @@ class WebBundleNetworkBrowserTest : public WebBundleBrowserTestBase {
     WebBundleBrowserTestBase::SetUpOnMainThread();
     host_resolver()->AddRule("*", "127.0.0.1");
   }
+
   void TearDownOnMainThread() override {
     // Shutdown the server to avoid the data race of |headers_| and |contents_|
     // caused by page reload on error.
@@ -1380,7 +1673,7 @@ IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest, Navigations) {
   const std::string wbn_path = "/web_bundle/path_test/in_scope/path_test.wbn";
   RegisterRequestHandler(wbn_path);
   ASSERT_TRUE(embedded_test_server()->Start());
-  SetContents(CreatePathTestWebBundle(embedded_test_server()));
+  SetContents(CreatePathTestWebBundle(embedded_test_server()->base_url()));
 
   const GURL wbn_url = embedded_test_server()->GetURL(wbn_path);
   const GURL primary_url =
@@ -1405,7 +1698,7 @@ IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest, HistoryNavigations) {
   const std::string wbn_path = "/web_bundle/path_test/in_scope/path_test.wbn";
   RegisterRequestHandler(wbn_path);
   ASSERT_TRUE(embedded_test_server()->Start());
-  SetContents(CreatePathTestWebBundle(embedded_test_server()));
+  SetContents(CreatePathTestWebBundle(embedded_test_server()->base_url()));
 
   const GURL wbn_url = embedded_test_server()->GetURL(wbn_path);
   const GURL primary_url =
@@ -1575,4 +1868,97 @@ IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest,
       "The expected URL resource is not found in the web bundle.");
 }
 
+IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest, Iframe) {
+  const std::string wbn_path = "/test.wbn";
+  RegisterRequestHandler(wbn_path);
+
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+  SetContents(web_bundle_content);
+  NavigateToBundleAndWaitForReady(primary_url_origin.Resolve(wbn_path),
+                                  primary_url_origin.Resolve("/top"));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &AddIframeAndWaitForMessage,
+                 false /* support_third_party_wbn_page */);
+}
+
+IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest, WindowOpen) {
+  const std::string wbn_path = "/test.wbn";
+  RegisterRequestHandler(wbn_path);
+
+  net::EmbeddedTestServer third_party_server;
+  GURL primary_url_origin;
+  GURL third_party_origin;
+  std::string web_bundle_content;
+  SetUpSubPageTest(embedded_test_server(), &third_party_server,
+                   &primary_url_origin, &third_party_origin,
+                   &web_bundle_content);
+  SetContents(web_bundle_content);
+  NavigateToBundleAndWaitForReady(primary_url_origin.Resolve(wbn_path),
+                                  primary_url_origin.Resolve("/top"));
+  RunSubPageTest(shell()->web_contents(), primary_url_origin,
+                 third_party_origin, &WindowOpenAndWaitForMessage,
+                 false /* support_third_party_wbn_page */);
+}
+
+IN_PROC_BROWSER_TEST_F(WebBundleNetworkBrowserTest, OutScopeSubPage) {
+  const std::string wbn_path = "/in_scope/test.wbn";
+  const std::string primary_url_path = "/in_scope/test.html";
+
+  RegisterRequestHandler(wbn_path);
+  RegisterRequestHandlerForSubPageTest(embedded_test_server(), "");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL origin = embedded_test_server()->GetURL("/");
+  data_decoder::test::WebBundleBuilder builder(
+      origin.Resolve(primary_url_path).spec(), "");
+  AddHtmlFile(&builder, origin, primary_url_path, R"(
+    <script>
+    window.addEventListener('message',
+                            event => domAutomationController.send(event.data),
+                            false);
+    document.title = 'Ready';
+    </script>
+    )");
+  AddHtmlFile(&builder, origin, "/in_scope/subpage",
+              CreateSubPageHtml("in-scope-wbn-page"));
+  AddScriptFile(&builder, origin, "/in_scope/script",
+                CreateScriptForSubPageTest("in-scope-wbn-script"));
+  AddHtmlFile(&builder, origin, "/out_scope/subpage",
+              CreateSubPageHtml("out-scope-wbn-page"));
+  AddScriptFile(&builder, origin, "/out_scope/script",
+                CreateScriptForSubPageTest("out-scope-wbn-script"));
+  std::vector<uint8_t> bundle = builder.CreateBundle();
+  SetContents(std::string(bundle.begin(), bundle.end()));
+  NavigateToBundleAndWaitForReady(origin.Resolve(wbn_path),
+                                  origin.Resolve(primary_url_path));
+  const auto funcs = {&AddIframeAndWaitForMessage,
+                      &WindowOpenAndWaitForMessage};
+  for (const auto func : funcs) {
+    EXPECT_EQ(
+        "in-scope-wbn-page in-scope-wbn-script",
+        (*func)(
+            shell()->web_contents(),
+            origin.Resolve("/in_scope/subpage").Resolve("#/in_scope/script")));
+    EXPECT_EQ(
+        "in-scope-wbn-page server-script",
+        (*func)(
+            shell()->web_contents(),
+            origin.Resolve("/in_scope/subpage").Resolve("#/out_scope/script")));
+    EXPECT_EQ(
+        "server-page server-script",
+        (*func)(
+            shell()->web_contents(),
+            origin.Resolve("/out_scope/subpage").Resolve("#/in_scope/script")));
+    EXPECT_EQ(
+        "server-page server-script",
+        (*func)(shell()->web_contents(), origin.Resolve("/out_scope/subpage")
+                                             .Resolve("#/out_scope/script")));
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_handle.cc b/chromium/content/browser/web_package/web_bundle_handle.cc
index adec318b057..24863bc32ea 100644
--- a/chromium/content/browser/web_package/web_bundle_handle.cc
+++ b/chromium/content/browser/web_package/web_bundle_handle.cc
@@ -4,1161 +4,31 @@
 
 #include "content/browser/web_package/web_bundle_handle.h"
 
-#include <string>
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "base/feature_list.h"
-#include "base/memory/ptr_util.h"
-#include "base/sequence_checker.h"
-#include "base/strings/stringprintf.h"
-#include "base/task/post_task.h"
-#include "content/browser/loader/navigation_loader_interceptor.h"
-#include "content/browser/loader/single_request_url_loader_factory.h"
-#include "content/browser/web_package/signed_exchange_utils.h"
 #include "content/browser/web_package/web_bundle_handle_tracker.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_file.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_network.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_trustable_file.h"
 #include "content/browser/web_package/web_bundle_navigation_info.h"
 #include "content/browser/web_package/web_bundle_reader.h"
 #include "content/browser/web_package/web_bundle_source.h"
-#include "content/browser/web_package/web_bundle_url_loader_factory.h"
 #include "content/browser/web_package/web_bundle_utils.h"
-#include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/download_utils.h"
 #include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/self_owned_receiver.h"
-#include "net/http/http_util.h"
-#include "net/traffic_annotation/network_traffic_annotation.h"
-#include "services/data_decoder/public/mojom/web_bundle_parser.mojom.h"
-#include "services/network/public/mojom/url_loader.mojom.h"
-#include "third_party/blink/public/common/loader/throttling_url_loader.h"
 
 namespace content {
-
-namespace {
-
-using DoneCallback = base::OnceCallback<void(
-    const GURL& target_inner_url,
-    std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory)>;
-
-constexpr char kNoSniffErrorMessage[] =
-    "Web Bundle response must have \"X-Content-Type-Options: nosniff\" header.";
-
-const net::NetworkTrafficAnnotationTag kTrafficAnnotation =
-    net::DefineNetworkTrafficAnnotation("web_bundle_start_url_loader",
-                                        R"(
-  semantics {
-    sender: "Web Bundle primary_url Loader"
-    description:
-      "Navigation request for the primary_url provided by a Web Bundle "
-      "that is requested by the user. This does not trigger any network "
-      "transaction directly, but access to an entry in a local file, or in a "
-      "previously fetched resource over network."
-    trigger: "The user navigates to a Web Bundle."
-    data: "Nothing."
-    destination: LOCAL
-  }
-  policy {
-    cookies_allowed: NO
-    setting: "These requests cannot be disabled in settings."
-    policy_exception_justification:
-      "Not implemented. This request does not make any network transaction."
-  }
-  comments:
-    "Usually the request accesses an entry in a local file that contains "
-    "multiple archived entries. But once the feature is exposed to the public "
-    "web API, the archive file can be streamed over network. In such case, the "
-    "streaming should be provided by another URLLoader request that is issued "
-    "by Blink, but based on a user initiated navigation."
-  )");
-
-std::string GetMetadataParseErrorMessage(
-    const data_decoder::mojom::BundleMetadataParseErrorPtr& metadata_error) {
-  return std::string("Failed to read metadata of Web Bundle file: ") +
-         metadata_error->message;
-}
-
-void CompleteWithInvalidWebBundleError(
-    mojo::Remote<network::mojom::URLLoaderClient> client,
-    int frame_tree_node_id,
-    const std::string& error_message) {
-  WebContents* web_contents =
-      WebContents::FromFrameTreeNodeId(frame_tree_node_id);
-  if (web_contents) {
-    web_contents->GetMainFrame()->AddMessageToConsole(
-        blink::mojom::ConsoleMessageLevel::kError, error_message);
-  }
-  std::move(client)->OnComplete(
-      network::URLLoaderCompletionStatus(net::ERR_INVALID_WEB_BUNDLE));
-}
-
-// A class to provide a network::mojom::URLLoader interface to redirect a
-// request to the Web Bundle to the main resource url.
-class RedirectURLLoader final : public network::mojom::URLLoader {
- public:
-  RedirectURLLoader(mojo::PendingRemote<network::mojom::URLLoaderClient> client)
-      : client_(std::move(client)) {}
-
-  void OnReadyToRedirect(const network::ResourceRequest& resource_request,
-                         const GURL& url) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(client_.is_connected());
-    auto response_head = network::mojom::URLResponseHead::New();
-    response_head->encoded_data_length = 0;
-    response_head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
-        net::HttpUtil::AssembleRawHeaders(
-            base::StringPrintf("HTTP/1.1 %d %s\r\n", 303, "See Other")));
-
-    net::RedirectInfo redirect_info = net::RedirectInfo::ComputeRedirectInfo(
-        "GET", resource_request.url, resource_request.site_for_cookies,
-        resource_request.update_first_party_url_on_redirect
-            ? net::URLRequest::FirstPartyURLPolicy::
-                  UPDATE_FIRST_PARTY_URL_ON_REDIRECT
-            : net::URLRequest::FirstPartyURLPolicy::
-                  NEVER_CHANGE_FIRST_PARTY_URL,
-        resource_request.referrer_policy, resource_request.referrer.spec(), 303,
-        url, /*referrer_policy_header=*/base::nullopt,
-        /*insecure_scheme_was_upgraded=*/false, /*copy_fragment=*/true,
-        /*is_signed_exchange_fallback_redirect=*/false);
-    client_->OnReceiveRedirect(redirect_info, std::move(response_head));
-  }
-
- private:
-  // mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
-  void SetPriority(net::RequestPriority priority,
-                   int intra_priority_value) override {}
-  void PauseReadingBodyFromNet() override {}
-  void ResumeReadingBodyFromNet() override {}
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  mojo::Remote<network::mojom::URLLoaderClient> client_;
-
-  DISALLOW_COPY_AND_ASSIGN(RedirectURLLoader);
-};
-
-// A class to inherit NavigationLoaderInterceptor for a navigation to an
-// untrustable Web Bundle file (eg: "file:///tmp/a.wbn").
-// The overridden methods of NavigationLoaderInterceptor are called in the
-// following sequence:
-// [1] MaybeCreateLoader() is called for all navigation requests. It calls the
-//     |callback| with a null RequestHandler.
-// [2] MaybeCreateLoaderForResponse() is called for all navigation responses.
-//     If the response mime type is not "application/webbundle", returns false.
-//     Otherwise starts reading the metadata and returns true. Once the metadata
-//     is read, OnMetadataReady() is called, and a redirect loader is
-//     created to redirect the navigation request to the Bundle's synthesized
-//     primary URL ("file:///tmp/a.wbn?https://example.com/a.html").
-// [3] MaybeCreateLoader() is called again for the redirect. It continues on
-//     StartResponse() to create the loader for the main resource.
-class InterceptorForFile final : public NavigationLoaderInterceptor {
- public:
-  explicit InterceptorForFile(DoneCallback done_callback,
-                              int frame_tree_node_id)
-      : done_callback_(std::move(done_callback)),
-        frame_tree_node_id_(frame_tree_node_id) {}
-  ~InterceptorForFile() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(
-      const network::ResourceRequest& tentative_resource_request,
-      BrowserContext* browser_context,
-      LoaderCallback callback,
-      FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    // InterceptorForFile::MaybeCreateLoader() creates a loader only after
-    // recognising that the response is a Web Bundle file at
-    // MaybeCreateLoaderForResponse() and successfully created
-    // |url_loader_factory_|.
-    if (!url_loader_factory_) {
-      std::move(callback).Run({});
-      return;
-    }
-    std::move(callback).Run(
-        base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForFile::StartResponse, weak_factory_.GetWeakPtr())));
-  }
-
-  bool MaybeCreateLoaderForResponse(
-      const network::ResourceRequest& request,
-      network::mojom::URLResponseHeadPtr* response_head,
-      mojo::ScopedDataPipeConsumerHandle* response_body,
-      mojo::PendingRemote<network::mojom::URLLoader>* loader,
-      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
-      blink::ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors,
-      bool* will_return_unsafe_redirect) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(web_bundle_utils::IsSupportedFileScheme(request.url));
-    if ((*response_head)->mime_type !=
-        web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
-      return false;
-    }
-    std::unique_ptr<WebBundleSource> source =
-        WebBundleSource::MaybeCreateFromFileUrl(request.url);
-    if (!source)
-      return false;
-    reader_ = base::MakeRefCounted<WebBundleReader>(std::move(source));
-    reader_->ReadMetadata(base::BindOnce(&InterceptorForFile::OnMetadataReady,
-                                         weak_factory_.GetWeakPtr(), request));
-    *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
-    *will_return_unsafe_redirect = true;
-    return true;
-  }
-
-  void OnMetadataReady(
-      network::ResourceRequest request,
-      data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if (metadata_error) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          GetMetadataParseErrorMessage(metadata_error));
-      return;
-    }
-    DCHECK(reader_);
-    primary_url_ = reader_->GetPrimaryURL();
-    url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
-        std::move(reader_), frame_tree_node_id_);
-
-    const GURL new_url = web_bundle_utils::GetSynthesizedUrlForWebBundle(
-        request.url, primary_url_);
-    auto redirect_loader =
-        std::make_unique<RedirectURLLoader>(forwarding_client_.Unbind());
-    redirect_loader->OnReadyToRedirect(request, new_url);
-  }
-
-  void StartResponse(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    network::ResourceRequest new_resource_request = resource_request;
-    new_resource_request.url = primary_url_;
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(receiver), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
-        new_resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    std::move(done_callback_).Run(primary_url_, std::move(url_loader_factory_));
-  }
-
-  DoneCallback done_callback_;
-  const int frame_tree_node_id_;
-  scoped_refptr<WebBundleReader> reader_;
-  GURL primary_url_;
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-
-  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<InterceptorForFile> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForFile);
-};
-
-// A class to inherit NavigationLoaderInterceptor for a navigation to a
-// trustable Web Bundle file (eg: "file:///tmp/a.wbn").
-// The overridden methods of NavigationLoaderInterceptor are called in the
-// following sequence:
-// [1] MaybeCreateLoader() is called for the navigation request to the trustable
-//     Web Bundle file. It continues on CreateURLLoader() to create the loader
-//     for the main resource.
-//     - If OnMetadataReady() has not been called yet:
-//         Wait for OnMetadataReady() to be called.
-//     - If OnMetadataReady() was called with an error:
-//         Completes the request with ERR_INVALID_WEB_BUNDLE.
-//     - If OnMetadataReady() was called whthout errors:
-//         A redirect loader is created to redirect the navigation request to
-//         the Bundle's primary URL ("https://example.com/a.html").
-// [2] MaybeCreateLoader() is called again for the redirect. It continues on
-//     CreateURLLoader() to create the loader for the main resource.
-class InterceptorForTrustableFile final : public NavigationLoaderInterceptor {
- public:
-  InterceptorForTrustableFile(std::unique_ptr<WebBundleSource> source,
-                              DoneCallback done_callback,
-                              int frame_tree_node_id)
-      : source_(std::move(source)),
-        reader_(base::MakeRefCounted<WebBundleReader>(source_->Clone())),
-        done_callback_(std::move(done_callback)),
-        frame_tree_node_id_(frame_tree_node_id) {
-    reader_->ReadMetadata(
-        base::BindOnce(&InterceptorForTrustableFile::OnMetadataReady,
-                       weak_factory_.GetWeakPtr()));
-  }
-  ~InterceptorForTrustableFile() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
-                         BrowserContext* browser_context,
-                         LoaderCallback callback,
-                         FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    std::move(callback).Run(base::MakeRefCounted<SingleRequestURLLoaderFactory>(
-        base::BindOnce(&InterceptorForTrustableFile::CreateURLLoader,
-                       weak_factory_.GetWeakPtr())));
-  }
-
-  void CreateURLLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if (metadata_error_) {
-      CompleteWithInvalidWebBundleError(
-          mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
-          frame_tree_node_id_, GetMetadataParseErrorMessage(metadata_error_));
-      return;
-    }
-
-    if (!url_loader_factory_) {
-      // This must be the first request to the Web Bundle file.
-      DCHECK_EQ(source_->url(), resource_request.url);
-      pending_resource_request_ = resource_request;
-      pending_receiver_ = std::move(receiver);
-      pending_client_ = std::move(client);
-      return;
-    }
-
-    // Currently |source_| must be a local file. And the bundle's primary URL
-    // can't be a local file URL. So while handling redirected request to the
-    // primary URL, |resource_request.url| must not be same as the |source_|'s
-    // URL.
-    if (source_->url() != resource_request.url) {
-      url_loader_factory_->CreateLoaderAndStart(
-          std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
-          /*options=*/0, resource_request, std::move(client),
-          net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-      std::move(done_callback_)
-          .Run(resource_request.url, std::move(url_loader_factory_));
-      return;
-    }
-
-    auto redirect_loader =
-        std::make_unique<RedirectURLLoader>(std::move(client));
-    redirect_loader->OnReadyToRedirect(resource_request, primary_url_);
-    mojo::MakeSelfOwnedReceiver(
-        std::move(redirect_loader),
-        mojo::PendingReceiver<network::mojom::URLLoader>(std::move(receiver)));
-  }
-
-  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(!url_loader_factory_);
-
-    if (error) {
-      metadata_error_ = std::move(error);
-    } else {
-      primary_url_ = reader_->GetPrimaryURL();
-      url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
-          std::move(reader_), frame_tree_node_id_);
-    }
-
-    if (pending_receiver_) {
-      DCHECK(pending_client_);
-      CreateURLLoader(pending_resource_request_, std::move(pending_receiver_),
-                      std::move(pending_client_));
-    }
-  }
-
-  std::unique_ptr<WebBundleSource> source_;
-  scoped_refptr<WebBundleReader> reader_;
-  DoneCallback done_callback_;
-  const int frame_tree_node_id_;
-
-  network::ResourceRequest pending_resource_request_;
-  mojo::PendingReceiver<network::mojom::URLLoader> pending_receiver_;
-  mojo::PendingRemote<network::mojom::URLLoaderClient> pending_client_;
-
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-
-  GURL primary_url_;
-  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<InterceptorForTrustableFile> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForTrustableFile);
-};
-
-// A class to inherit NavigationLoaderInterceptor for a navigation to a
-// Web Bundle file on HTTPS server (eg: "https://example.com/a.wbn").
-// The overridden methods of NavigationLoaderInterceptor are called in the
-// following sequence:
-// [1] MaybeCreateLoader() is called for all navigation requests. It calls the
-//     |callback| with a null RequestHandler.
-// [2] MaybeCreateLoaderForResponse() is called for all navigation responses.
-//     - If the response mime type is not "application/webbundle", or attachment
-//       Content-Disposition header is set, returns false.
-//     - If the URL isn't HTTPS nor localhost HTTP, or the Content-Length header
-//       is not a positive value, completes the requests with
-//       ERR_INVALID_WEB_BUNDLE and returns true.
-//     - Otherwise starts reading the metadata and returns true. Once the
-//       metadata is read, OnMetadataReady() is called, and a redirect loader is
-//       created to redirect the navigation request to the Bundle's primary URL
-//       ("https://example.com/a.html").
-// [3] MaybeCreateLoader() is called again for the redirect. It continues on
-//     StartResponse() to create the loader for the main resource.
-class InterceptorForNetwork final : public NavigationLoaderInterceptor {
- public:
-  InterceptorForNetwork(DoneCallback done_callback,
-                        BrowserContext* browser_context,
-                        int frame_tree_node_id)
-      : done_callback_(std::move(done_callback)),
-        browser_context_(browser_context),
-        frame_tree_node_id_(frame_tree_node_id) {
-    DCHECK(browser_context_);
-  }
-  ~InterceptorForNetwork() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(
-      const network::ResourceRequest& tentative_resource_request,
-      BrowserContext* browser_context,
-      LoaderCallback callback,
-      FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if (!reader_) {
-      std::move(callback).Run({});
-      return;
-    }
-    std::move(callback).Run(base::MakeRefCounted<SingleRequestURLLoaderFactory>(
-        base::BindOnce(&InterceptorForNetwork::StartResponse,
-                       weak_factory_.GetWeakPtr())));
-  }
-
-  bool MaybeCreateLoaderForResponse(
-      const network::ResourceRequest& request,
-      network::mojom::URLResponseHeadPtr* response_head,
-      mojo::ScopedDataPipeConsumerHandle* response_body,
-      mojo::PendingRemote<network::mojom::URLLoader>* loader,
-      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
-      blink::ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors,
-      bool* will_return_and_handle_unsafe_redirect) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if ((*response_head)->mime_type !=
-        web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
-      return false;
-    }
-    if (download_utils::MustDownload(request.url,
-                                     (*response_head)->headers.get(),
-                                     (*response_head)->mime_type)) {
-      return false;
-    }
-    *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
-
-    if (!signed_exchange_utils::HasNoSniffHeader(**response_head)) {
-      CompleteWithInvalidWebBundleError(std::move(forwarding_client_),
-                                        frame_tree_node_id_,
-                                        kNoSniffErrorMessage);
-      return true;
-    }
-    auto source = WebBundleSource::MaybeCreateFromNetworkUrl(request.url);
-    if (!source) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          "Web Bundle response must be served from HTTPS or localhost HTTP.");
-      return true;
-    }
-
-    uint64_t length_hint =
-        (*response_head)->content_length > 0
-            ? static_cast<uint64_t>((*response_head)->content_length)
-            : 0;
-
-    // TODO(crbug.com/1018640): Check the special HTTP response header if we
-    // decided to require one for WBN navigation.
-
-    reader_ = base::MakeRefCounted<WebBundleReader>(
-        std::move(source), length_hint, std::move(*response_body),
-        url_loader->Unbind(),
-        BrowserContext::GetBlobStorageContext(browser_context_));
-    reader_->ReadMetadata(
-        base::BindOnce(&InterceptorForNetwork::OnMetadataReady,
-                       weak_factory_.GetWeakPtr(), request));
-    return true;
-  }
-
-  void OnMetadataReady(network::ResourceRequest request,
-                       data_decoder::mojom::BundleMetadataParseErrorPtr error) {
-    if (error) {
-      CompleteWithInvalidWebBundleError(std::move(forwarding_client_),
-                                        frame_tree_node_id_,
-                                        GetMetadataParseErrorMessage(error));
-      return;
-    }
-    primary_url_ = reader_->GetPrimaryURL();
-    if (!reader_->HasEntry(primary_url_)) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          "The primary URL resource is not found in the web bundle.");
-      return;
-    }
-    if (primary_url_.GetOrigin() != reader_->source().url().GetOrigin()) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          "The origin of primary URL doesn't match with the origin of the web "
-          "bundle.");
-      return;
-    }
-    if (!reader_->source().IsNavigationPathRestrictionSatisfied(primary_url_)) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          base::StringPrintf("Path restriction mismatch: Can't navigate to %s "
-                             "in the web bundle served from %s.",
-                             primary_url_.spec().c_str(),
-                             reader_->source().url().spec().c_str()));
-      return;
-    }
-    url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
-        reader_, frame_tree_node_id_);
-    auto redirect_loader =
-        std::make_unique<RedirectURLLoader>(forwarding_client_.Unbind());
-    redirect_loader->OnReadyToRedirect(request, primary_url_);
-  }
-
-  void StartResponse(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    network::ResourceRequest new_resource_request = resource_request;
-    new_resource_request.url = primary_url_;
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(receiver), 0, 0, 0, new_resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    std::move(done_callback_).Run(primary_url_, std::move(url_loader_factory_));
-  }
-
-  DoneCallback done_callback_;
-  BrowserContext* browser_context_;
-  const int frame_tree_node_id_;
-  scoped_refptr<WebBundleReader> reader_;
-  GURL primary_url_;
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-
-  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<InterceptorForNetwork> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForNetwork);
-};
-
-// A class to inherit NavigationLoaderInterceptor for a navigation within a
-// trustable Web Bundle file or within a Web Bundle from network.
-// For example:
-//   A user opened a trustable Web Bundle file "file:///tmp/a.wbn", and
-//   InterceptorForTrustableFile redirected to "https://example.com/a.html" and
-//   "a.html" in "a.wbn" was loaded. Or, a user opened a Web Bundle
-//   "https://example.com/a.wbn", and InterceptorForNetwork redirected to
-//   "https://example.com/a.html" and "a.html" in "a.wbn" was loaded. And the
-//   user clicked a link to "https://example.com/b.html" from "a.html".
-//
-// In this case, this interceptor intecepts the navigation request to "b.html",
-// and creates a URLLoader using the WebBundleURLLoaderFactory to load
-// the response of "b.html" in "a.wbn".
-class InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork final
-    : public NavigationLoaderInterceptor {
- public:
-  InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork(
-      scoped_refptr<WebBundleReader> reader,
-      DoneCallback done_callback,
-      int frame_tree_node_id)
-      : url_loader_factory_(
-            std::make_unique<WebBundleURLLoaderFactory>(std::move(reader),
-                                                        frame_tree_node_id)),
-        done_callback_(std::move(done_callback)) {
-    DCHECK((base::CommandLine::ForCurrentProcess()->HasSwitch(
-                switches::kTrustableWebBundleFileUrl) &&
-            url_loader_factory_->reader()->source().is_trusted_file()) ||
-           (base::FeatureList::IsEnabled(features::kWebBundlesFromNetwork) &&
-            url_loader_factory_->reader()->source().is_network()));
-  }
-  ~InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
-                         BrowserContext* browser_context,
-                         LoaderCallback callback,
-                         FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
-    DCHECK(url_loader_factory_->reader()->source().is_trusted_file() ||
-           (url_loader_factory_->reader()->source().is_network() &&
-            url_loader_factory_->reader()
-                ->source()
-                .IsNavigationPathRestrictionSatisfied(resource_request.url)));
-    std::move(callback).Run(
-        base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
-                CreateURLLoader,
-            weak_factory_.GetWeakPtr())));
-  }
-
-  void CreateURLLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
-        /*options=*/0, resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    std::move(done_callback_)
-        .Run(resource_request.url, std::move(url_loader_factory_));
-  }
-
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-  DoneCallback done_callback_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<
-      InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork>
-      weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(
-      InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork);
-};
-
-// A class to inherit NavigationLoaderInterceptor for a navigation within a
-// Web Bundle file.
-// For example:
-//   A user opened "file:///tmp/a.wbn", and InterceptorForFile redirected to
-//   "file:///tmp/a.wbn?https://example.com/a.html" and "a.html" in "a.wbn" was
-//   loaded. And the user clicked a link to "https://example.com/b.html" from
-//   "a.html".
-// In this case, this interceptor intecepts the navigation request to "b.html",
-// and redirect the navigation request to
-// "file:///tmp/a.wbn?https://example.com/b.html" and creates a URLLoader using
-// the WebBundleURLLoaderFactory to load the response of "b.html" in
-// "a.wbn".
-class InterceptorForTrackedNavigationFromFile final
-    : public NavigationLoaderInterceptor {
- public:
-  InterceptorForTrackedNavigationFromFile(scoped_refptr<WebBundleReader> reader,
-                                          DoneCallback done_callback,
-                                          int frame_tree_node_id)
-      : url_loader_factory_(
-            std::make_unique<WebBundleURLLoaderFactory>(std::move(reader),
-                                                        frame_tree_node_id)),
-        done_callback_(std::move(done_callback)) {}
-  ~InterceptorForTrackedNavigationFromFile() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
-                         BrowserContext* browser_context,
-                         LoaderCallback callback,
-                         FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    std::move(callback).Run(
-        base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForTrackedNavigationFromFile::CreateURLLoader,
-            weak_factory_.GetWeakPtr())));
-  }
-
-  bool ShouldBypassRedirectChecks() override { return true; }
-
-  void CreateURLLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if (!is_redirected_) {
-      DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
-      is_redirected_ = true;
-      original_request_url_ = resource_request.url;
-
-      GURL web_bundle_url = url_loader_factory_->reader()->source().url();
-      const GURL new_url = web_bundle_utils::GetSynthesizedUrlForWebBundle(
-          web_bundle_url, original_request_url_);
-      auto redirect_loader =
-          std::make_unique<RedirectURLLoader>(std::move(client));
-      redirect_loader->OnReadyToRedirect(resource_request, new_url);
-      mojo::MakeSelfOwnedReceiver(
-          std::move(redirect_loader),
-          mojo::PendingReceiver<network::mojom::URLLoader>(
-              std::move(receiver)));
-      return;
-    }
-    network::ResourceRequest new_resource_request = resource_request;
-    new_resource_request.url = original_request_url_;
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(receiver), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
-        new_resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    std::move(done_callback_)
-        .Run(original_request_url_, std::move(url_loader_factory_));
-  }
-
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-  DoneCallback done_callback_;
-
-  bool is_redirected_ = false;
-  GURL original_request_url_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  base::WeakPtrFactory<InterceptorForTrackedNavigationFromFile> weak_factory_{
-      this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForTrackedNavigationFromFile);
-};
-
-// A base class of the following NavigationLoaderInterceptor classes. They are
-// used to intercept history navigation to a Web Bundle.
-//   - InterceptorForHistoryNavigationWithExistingReader:
-//       This class is used when the WebBundleReader for the Web Bundle is still
-//       alive.
-//   - InterceptorForHistoryNavigationFromFileOrFromTrustableFile:
-//       This class is used when the WebBundleReader was already deleted, and
-//       the Web Bundle is a file or a trustable file.
-//   - InterceptorForHistoryNavigationFromNetwork:
-//       This class is used when the WebBundleReader was already deleted, and
-//       the Web Bundle was from network.
-class InterceptorForHistoryNavigation : public NavigationLoaderInterceptor {
- protected:
-  InterceptorForHistoryNavigation(const GURL& target_inner_url,
-                                  DoneCallback done_callback,
-                                  int frame_tree_node_id)
-      : target_inner_url_(target_inner_url),
-        frame_tree_node_id_(frame_tree_node_id),
-        done_callback_(std::move(done_callback)) {}
-  ~InterceptorForHistoryNavigation() override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  }
-
-  void CreateWebBundleURLLoaderFactory(scoped_refptr<WebBundleReader> reader) {
-    DCHECK(reader->HasEntry(target_inner_url_));
-    url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
-        std::move(reader), frame_tree_node_id_);
-  }
-  void CreateLoaderAndStartAndDone(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    network::ResourceRequest new_resource_request = resource_request;
-    new_resource_request.url = target_inner_url_;
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
-        /*options=*/0, new_resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    std::move(done_callback_)
-        .Run(target_inner_url_, std::move(url_loader_factory_));
-  }
-
-  const GURL target_inner_url_;
-  const int frame_tree_node_id_;
-  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
-  SEQUENCE_CHECKER(sequence_checker_);
-
- private:
-  DoneCallback done_callback_;
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForHistoryNavigation);
-};
-
-// A class to inherit NavigationLoaderInterceptor for the history navigation to
-// a Web Bundle when the previous WebBundleReader is still alive.
-// - MaybeCreateLoader() is called for the history navigation request. It
-//   continues on CreateURLLoader() to create the loader for the main resource.
-class InterceptorForHistoryNavigationWithExistingReader final
-    : public InterceptorForHistoryNavigation {
- public:
-  InterceptorForHistoryNavigationWithExistingReader(
-      scoped_refptr<WebBundleReader> reader,
-      const GURL& target_inner_url,
-      DoneCallback done_callback,
-      int frame_tree_node_id)
-      : InterceptorForHistoryNavigation(target_inner_url,
-                                        std::move(done_callback),
-                                        frame_tree_node_id) {
-    CreateWebBundleURLLoaderFactory(std::move(reader));
-  }
-  ~InterceptorForHistoryNavigationWithExistingReader() override {}
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
-                         BrowserContext* browser_context,
-                         LoaderCallback callback,
-                         FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(resource_request.url,
-              url_loader_factory_->reader()->source().is_file()
-                  ? web_bundle_utils::GetSynthesizedUrlForWebBundle(
-                        url_loader_factory_->reader()->source().url(),
-                        target_inner_url_)
-                  : target_inner_url_);
-    std::move(callback).Run(
-        base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForHistoryNavigationWithExistingReader::CreateURLLoader,
-            weak_factory_.GetWeakPtr())));
-  }
-
-  void CreateURLLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(resource_request.url,
-              url_loader_factory_->reader()->source().is_file()
-                  ? web_bundle_utils::GetSynthesizedUrlForWebBundle(
-                        url_loader_factory_->reader()->source().url(),
-                        target_inner_url_)
-                  : target_inner_url_);
-    CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
-                                std::move(client));
-  }
-
-  base::WeakPtrFactory<InterceptorForHistoryNavigationWithExistingReader>
-      weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForHistoryNavigationWithExistingReader);
-};
-
-// A class to inherit NavigationLoaderInterceptor for the history navigation to
-// a Web Bundle file or a trustable Web Bundle file when the previous
-// WebBundleReader was deleted.
-// - MaybeCreateLoader() is called for the history navigation request. It
-//   continues on CreateURLLoader() to create the loader for the main resource.
-//   - If OnMetadataReady() has not been called yet:
-//       Wait for OnMetadataReady() to be called.
-//   - If OnMetadataReady() was called with an error:
-//       Completes the request with ERR_INVALID_WEB_BUNDLE.
-//   - If OnMetadataReady() was called whthout errors:
-//       Creates the loader for the main resource.
-class InterceptorForHistoryNavigationFromFileOrFromTrustableFile final
-    : public InterceptorForHistoryNavigation {
- public:
-  InterceptorForHistoryNavigationFromFileOrFromTrustableFile(
-      std::unique_ptr<WebBundleSource> source,
-      const GURL& target_inner_url,
-      DoneCallback done_callback,
-      int frame_tree_node_id)
-      : InterceptorForHistoryNavigation(target_inner_url,
-                                        std::move(done_callback),
-                                        frame_tree_node_id),
-        reader_(base::MakeRefCounted<WebBundleReader>(std::move(source))) {
-    reader_->ReadMetadata(base::BindOnce(
-        &InterceptorForHistoryNavigationFromFileOrFromTrustableFile::
-            OnMetadataReady,
-        weak_factory_.GetWeakPtr()));
-  }
-  ~InterceptorForHistoryNavigationFromFileOrFromTrustableFile() override {}
-
- private:
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
-                         BrowserContext* browser_context,
-                         LoaderCallback callback,
-                         FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    std::move(callback).Run(
-        base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForHistoryNavigationFromFileOrFromTrustableFile::
-                CreateURLLoader,
-            weak_factory_.GetWeakPtr())));
-  }
-
-  void CreateURLLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    if (metadata_error_) {
-      CompleteWithInvalidWebBundleError(
-          mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
-          frame_tree_node_id_, GetMetadataParseErrorMessage(metadata_error_));
-      return;
-    }
-
-    if (!url_loader_factory_) {
-      pending_resource_request_ = resource_request;
-      pending_receiver_ = std::move(receiver);
-      pending_client_ = std::move(client);
-      return;
-    }
-    CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
-                                std::move(client));
-  }
-
-  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(!url_loader_factory_);
-
-    if (error) {
-      metadata_error_ = std::move(error);
-    } else {
-      CreateWebBundleURLLoaderFactory(std::move(reader_));
-    }
-
-    if (pending_receiver_) {
-      DCHECK(pending_client_);
-      CreateURLLoader(pending_resource_request_, std::move(pending_receiver_),
-                      std::move(pending_client_));
-    }
-  }
-
-  scoped_refptr<WebBundleReader> reader_;
-
-  network::ResourceRequest pending_resource_request_;
-  mojo::PendingReceiver<network::mojom::URLLoader> pending_receiver_;
-  mojo::PendingRemote<network::mojom::URLLoaderClient> pending_client_;
-
-  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
-
-  base::WeakPtrFactory<
-      InterceptorForHistoryNavigationFromFileOrFromTrustableFile>
-      weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(
-      InterceptorForHistoryNavigationFromFileOrFromTrustableFile);
-};
-
-// A class to inherit NavigationLoaderInterceptor for the history navigation to
-// a Web Bundle from network when the previous WebBundleReader was deleted.
-// The overridden methods of NavigationLoaderInterceptor are called in the
-// following sequence:
-// [1] MaybeCreateLoader() is called for the history navigation request. It
-//     continues on StartRedirectResponse() to redirect to the Web Bundle URL.
-// [2] MaybeCreateLoader() is called again for the Web Bundle request. It calls
-//     the |callback| with a null RequestHandler.
-//     If server returned a redirect response instead of the Web Bundle,
-//     MaybeCreateLoader() is called again for the redirected new URL, in such
-//     it continues on StartErrorResponseForUnexpectedRedirect() and returns an
-//     error.
-//     Note that the Web Bundle URL should be loaded as cache-preferring load,
-//     but it may still go to the server if the Bundle is served with
-//     "no-store".
-// [3] MaybeCreateLoaderForResponse() is called for all navigation responses.
-//     - If the response mime type is not "application/webbundle", this means
-//       the server response is not a Web Bundle. So handles as an error.
-//     - If the Content-Length header is not a positive value, handles as an
-//       error.
-//     - Otherwise starts reading the metadata and returns true. Once the
-//       metadata is read, OnMetadataReady() is called, and a redirect loader is
-//       created to redirect the navigation request to the target inner URL.
-// [4] MaybeCreateLoader() is called again for target inner URL. It continues
-//     on StartResponse() to create the loader for the main resource.
-class InterceptorForHistoryNavigationFromNetwork final
-    : public InterceptorForHistoryNavigation {
- public:
-  InterceptorForHistoryNavigationFromNetwork(
-      std::unique_ptr<WebBundleSource> source,
-      const GURL& target_inner_url,
-      DoneCallback done_callback,
-      int frame_tree_node_id)
-      : InterceptorForHistoryNavigation(target_inner_url,
-                                        std::move(done_callback),
-                                        frame_tree_node_id),
-        source_(std::move(source)) {
-    DCHECK(source_->IsNavigationPathRestrictionSatisfied(target_inner_url_));
-  }
-  ~InterceptorForHistoryNavigationFromNetwork() override {}
-
- private:
-  enum class State {
-    kInitial,
-    kRedirectedToWebBundle,
-    kWebBundleRecieved,
-    kMetadataReady,
-  };
-
-  // NavigationLoaderInterceptor implementation
-  void MaybeCreateLoader(
-      const network::ResourceRequest& tentative_resource_request,
-      BrowserContext* browser_context,
-      LoaderCallback callback,
-      FallbackCallback fallback_callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    switch (state_) {
-      case State::kInitial:
-        DCHECK_EQ(tentative_resource_request.url, target_inner_url_);
-        std::move(callback).Run(base::MakeRefCounted<
-                                SingleRequestURLLoaderFactory>(base::BindOnce(
-            &InterceptorForHistoryNavigationFromNetwork::StartRedirectResponse,
-            weak_factory_.GetWeakPtr())));
-        return;
-      case State::kRedirectedToWebBundle:
-        DCHECK(!reader_);
-        if (tentative_resource_request.url != source_->url()) {
-          std::move(callback).Run(
-              base::MakeRefCounted<SingleRequestURLLoaderFactory>(
-                  base::BindOnce(&InterceptorForHistoryNavigationFromNetwork::
-                                     StartErrorResponseForUnexpectedRedirect,
-                                 weak_factory_.GetWeakPtr())));
-        } else {
-          std::move(callback).Run({});
-        }
-        return;
-      case State::kWebBundleRecieved:
-        NOTREACHED();
-        return;
-      case State::kMetadataReady:
-        std::move(callback).Run(
-            base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
-                &InterceptorForHistoryNavigationFromNetwork::StartResponse,
-                weak_factory_.GetWeakPtr())));
-    }
-  }
-
-  bool MaybeCreateLoaderForResponse(
-      const network::ResourceRequest& request,
-      network::mojom::URLResponseHeadPtr* response_head,
-      mojo::ScopedDataPipeConsumerHandle* response_body,
-      mojo::PendingRemote<network::mojom::URLLoader>* loader,
-      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
-      blink::ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors,
-      bool* will_return_and_handle_unsafe_redirect) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(State::kRedirectedToWebBundle, state_);
-    DCHECK_EQ(source_->url(), request.url);
-    state_ = State::kWebBundleRecieved;
-    *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
-    if ((*response_head)->mime_type !=
-        web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
-      CompleteWithInvalidWebBundleError(std::move(forwarding_client_),
-                                        frame_tree_node_id_,
-                                        "Unexpected content type.");
-      return true;
-    }
-    if (!signed_exchange_utils::HasNoSniffHeader(**response_head)) {
-      CompleteWithInvalidWebBundleError(std::move(forwarding_client_),
-                                        frame_tree_node_id_,
-                                        kNoSniffErrorMessage);
-      return true;
-    }
-    uint64_t length_hint =
-        (*response_head)->content_length > 0
-            ? static_cast<uint64_t>((*response_head)->content_length)
-            : 0;
-
-    // TODO(crbug.com/1018640): Check the special HTTP response header if we
-    // decided to require one for WBN navigation.
-
-    WebContents* web_contents =
-        WebContents::FromFrameTreeNodeId(frame_tree_node_id_);
-    DCHECK(web_contents);
-    BrowserContext* browser_context = web_contents->GetBrowserContext();
-    DCHECK(browser_context);
-    reader_ = base::MakeRefCounted<WebBundleReader>(
-        std::move(source_), length_hint, std::move(*response_body),
-        url_loader->Unbind(),
-        BrowserContext::GetBlobStorageContext(browser_context));
-    reader_->ReadMetadata(base::BindOnce(
-        &InterceptorForHistoryNavigationFromNetwork::OnMetadataReady,
-        weak_factory_.GetWeakPtr(), request));
-    return true;
-  }
-
-  void OnMetadataReady(network::ResourceRequest request,
-                       data_decoder::mojom::BundleMetadataParseErrorPtr error) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(State::kWebBundleRecieved, state_);
-    state_ = State::kMetadataReady;
-    if (error) {
-      CompleteWithInvalidWebBundleError(std::move(forwarding_client_),
-                                        frame_tree_node_id_,
-                                        GetMetadataParseErrorMessage(error));
-      return;
-    }
-    if (!reader_->HasEntry(target_inner_url_)) {
-      CompleteWithInvalidWebBundleError(
-          std::move(forwarding_client_), frame_tree_node_id_,
-          "The expected URL resource is not found in the web bundle.");
-      return;
-    }
-    CreateWebBundleURLLoaderFactory(reader_);
-    auto redirect_loader =
-        std::make_unique<RedirectURLLoader>(forwarding_client_.Unbind());
-    redirect_loader->OnReadyToRedirect(request, target_inner_url_);
-  }
-
-  void StartRedirectResponse(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(State::kInitial, state_);
-    state_ = State::kRedirectedToWebBundle;
-    auto redirect_loader =
-        std::make_unique<RedirectURLLoader>(std::move(client));
-    redirect_loader->OnReadyToRedirect(resource_request, source_->url());
-    mojo::MakeSelfOwnedReceiver(
-        std::move(redirect_loader),
-        mojo::PendingReceiver<network::mojom::URLLoader>(std::move(receiver)));
-  }
-
-  void StartErrorResponseForUnexpectedRedirect(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(State::kRedirectedToWebBundle, state_);
-    DCHECK_NE(source_->url(), resource_request.url);
-    CompleteWithInvalidWebBundleError(
-        mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
-        frame_tree_node_id_, "Unexpected redirect.");
-  }
-
-  void StartResponse(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK_EQ(State::kMetadataReady, state_);
-    CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
-                                std::move(client));
-  }
-
-  State state_ = State::kInitial;
-  std::unique_ptr<WebBundleSource> source_;
-  scoped_refptr<WebBundleReader> reader_;
-
-  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
-
-  base::WeakPtrFactory<InterceptorForHistoryNavigationFromNetwork>
-      weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(InterceptorForHistoryNavigationFromNetwork);
-};
-
-}  // namespace
-
 // static
 std::unique_ptr<WebBundleHandle> WebBundleHandle::CreateForFile(
     int frame_tree_node_id) {
   auto handle = base::WrapUnique(new WebBundleHandle());
-  handle->SetInterceptor(std::make_unique<InterceptorForFile>(
+  handle->SetInterceptor(std::make_unique<WebBundleInterceptorForFile>(
       base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
                      handle->weak_factory_.GetWeakPtr()),
       frame_tree_node_id));
@@ -1171,7 +41,7 @@ std::unique_ptr<WebBundleHandle> WebBundleHandle::CreateForTrustableFile(
     int frame_tree_node_id) {
   DCHECK(source->is_trusted_file());
   auto handle = base::WrapUnique(new WebBundleHandle());
-  handle->SetInterceptor(std::make_unique<InterceptorForTrustableFile>(
+  handle->SetInterceptor(std::make_unique<WebBundleInterceptorForTrustableFile>(
       std::move(source),
       base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
                      handle->weak_factory_.GetWeakPtr()),
@@ -1185,7 +55,7 @@ std::unique_ptr<WebBundleHandle> WebBundleHandle::CreateForNetwork(
     int frame_tree_node_id) {
   DCHECK(base::FeatureList::IsEnabled(features::kWebBundlesFromNetwork));
   auto handle = base::WrapUnique(new WebBundleHandle());
-  handle->SetInterceptor(std::make_unique<InterceptorForNetwork>(
+  handle->SetInterceptor(std::make_unique<WebBundleInterceptorForNetwork>(
       base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
                      handle->weak_factory_.GetWeakPtr()),
       browser_context, frame_tree_node_id));
@@ -1202,19 +72,21 @@ std::unique_ptr<WebBundleHandle> WebBundleHandle::CreateForTrackedNavigation(
     case WebBundleSource::Type::kNetwork:
       handle->SetInterceptor(
           std::make_unique<
-              InterceptorForTrackedNavigationFromTrustableFileOrFromNetwork>(
+
+              WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork>(
               std::move(reader),
               base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
                              handle->weak_factory_.GetWeakPtr()),
               frame_tree_node_id));
       break;
     case WebBundleSource::Type::kFile:
-      handle->SetInterceptor(
-          std::make_unique<InterceptorForTrackedNavigationFromFile>(
-              std::move(reader),
-              base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
-                             handle->weak_factory_.GetWeakPtr()),
-              frame_tree_node_id));
+      handle->SetInterceptor(std::make_unique<
+
+                             WebBundleInterceptorForTrackedNavigationFromFile>(
+          std::move(reader),
+          base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
+                         handle->weak_factory_.GetWeakPtr()),
+          frame_tree_node_id));
       break;
   }
   return handle;
@@ -1228,25 +100,28 @@ std::unique_ptr<WebBundleHandle> WebBundleHandle::MaybeCreateForNavigationInfo(
   if (navigation_info->GetReader()) {
     scoped_refptr<WebBundleReader> reader = navigation_info->GetReader().get();
     handle->SetInterceptor(
-        std::make_unique<InterceptorForHistoryNavigationWithExistingReader>(
+        std::make_unique<
+
+            WebBundleInterceptorForHistoryNavigationWithExistingReader>(
             std::move(reader), navigation_info->target_inner_url(),
             base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
                            handle->weak_factory_.GetWeakPtr()),
             frame_tree_node_id));
   } else if (navigation_info->source().is_network()) {
-    handle->SetInterceptor(
-        std::make_unique<InterceptorForHistoryNavigationFromNetwork>(
-            navigation_info->source().Clone(),
-            navigation_info->target_inner_url(),
-            base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
-                           handle->weak_factory_.GetWeakPtr()),
-            frame_tree_node_id));
+    handle->SetInterceptor(std::make_unique<
+
+                           WebBundleInterceptorForHistoryNavigationFromNetwork>(
+        navigation_info->source().Clone(), navigation_info->target_inner_url(),
+        base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
+                       handle->weak_factory_.GetWeakPtr()),
+        frame_tree_node_id));
   } else {
     DCHECK(navigation_info->source().is_trusted_file() ||
            navigation_info->source().is_file());
     handle->SetInterceptor(
         std::make_unique<
-            InterceptorForHistoryNavigationFromFileOrFromTrustableFile>(
+
+            WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile>(
             navigation_info->source().Clone(),
             navigation_info->target_inner_url(),
             base::BindOnce(&WebBundleHandle::OnWebBundleFileLoaded,
@@ -1303,5 +178,4 @@ void WebBundleHandle::OnWebBundleFileLoaded(
       url_loader_factory->reader()->GetWeakPtr());
   url_loader_factory_ = std::move(url_loader_factory);
 }
-
 }  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_handle_tracker.cc b/chromium/content/browser/web_package/web_bundle_handle_tracker.cc
index 4436bec0733..9b6d87d8ce4 100644
--- a/chromium/content/browser/web_package/web_bundle_handle_tracker.cc
+++ b/chromium/content/browser/web_package/web_bundle_handle_tracker.cc
@@ -49,7 +49,7 @@ WebBundleHandleTracker::MaybeCreateWebBundleHandle(const GURL& url,
       break;
     case WebBundleSource::Type::kNetwork:
       if (reader_->HasEntry(url) &&
-          reader_->source().IsNavigationPathRestrictionSatisfied(url)) {
+          reader_->source().IsPathRestrictionSatisfied(url)) {
         return WebBundleHandle::CreateForTrackedNavigation(reader_,
                                                            frame_tree_node_id);
       }
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_file.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_file.cc
new file mode 100644
index 00000000000..f8c4191074a
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_file.cc
@@ -0,0 +1,111 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_file.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "third_party/blink/public/common/loader/throttling_url_loader.h"
+
+namespace content {
+WebBundleInterceptorForFile::WebBundleInterceptorForFile(
+    WebBundleDoneCallback done_callback,
+    int frame_tree_node_id)
+    : done_callback_(std::move(done_callback)),
+      frame_tree_node_id_(frame_tree_node_id) {}
+
+WebBundleInterceptorForFile::~WebBundleInterceptorForFile() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+void WebBundleInterceptorForFile::MaybeCreateLoader(
+    const network::ResourceRequest& tentative_resource_request,
+    BrowserContext* browser_context,
+    LoaderCallback callback,
+    FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  // WebBundleInterceptorForFile::MaybeCreateLoader() creates a loader only
+  // after recognising that the response is a Web Bundle file at
+  // MaybeCreateLoaderForResponse() and successfully created
+  // |url_loader_factory_|.
+  if (!url_loader_factory_) {
+    std::move(callback).Run({});
+    return;
+  }
+  std::move(callback).Run(base::MakeRefCounted<SingleRequestURLLoaderFactory>(
+      base::BindOnce(&WebBundleInterceptorForFile::StartResponse,
+                     weak_factory_.GetWeakPtr())));
+}
+
+bool WebBundleInterceptorForFile::MaybeCreateLoaderForResponse(
+    const network::ResourceRequest& request,
+    network::mojom::URLResponseHeadPtr* response_head,
+    mojo::ScopedDataPipeConsumerHandle* response_body,
+    mojo::PendingRemote<network::mojom::URLLoader>* loader,
+    mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+    blink::ThrottlingURLLoader* url_loader,
+    bool* skip_other_interceptors,
+    bool* will_return_unsafe_redirect) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(web_bundle_utils::IsSupportedFileScheme(request.url));
+  if ((*response_head)->mime_type !=
+      web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
+    return false;
+  }
+  std::unique_ptr<WebBundleSource> source =
+      WebBundleSource::MaybeCreateFromFileUrl(request.url);
+  if (!source)
+    return false;
+  reader_ = base::MakeRefCounted<WebBundleReader>(std::move(source));
+  reader_->ReadMetadata(
+      base::BindOnce(&WebBundleInterceptorForFile::OnMetadataReady,
+                     weak_factory_.GetWeakPtr(), request));
+  *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
+  *will_return_unsafe_redirect = true;
+  return true;
+}
+
+void WebBundleInterceptorForFile::OnMetadataReady(
+    const network::ResourceRequest& request,
+    data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if (metadata_error) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        web_bundle_utils::GetMetadataParseErrorMessage(metadata_error));
+    return;
+  }
+  DCHECK(reader_);
+  primary_url_ = reader_->GetPrimaryURL();
+  url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
+      std::move(reader_), frame_tree_node_id_);
+
+  const GURL new_url = web_bundle_utils::GetSynthesizedUrlForWebBundle(
+      request.url, primary_url_);
+  auto redirect_loader =
+      std::make_unique<WebBundleRedirectURLLoader>(forwarding_client_.Unbind());
+  redirect_loader->OnReadyToRedirect(request, new_url);
+}
+
+void WebBundleInterceptorForFile::StartResponse(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  network::ResourceRequest new_resource_request = resource_request;
+  new_resource_request.url = primary_url_;
+  url_loader_factory_->CreateLoaderAndStart(
+      std::move(receiver), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+      new_resource_request, std::move(client),
+      net::MutableNetworkTrafficAnnotationTag(
+          web_bundle_utils::kTrafficAnnotation));
+  std::move(done_callback_).Run(primary_url_, std::move(url_loader_factory_));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_file.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_file.h
new file mode 100644
index 00000000000..b08b86eae9d
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_file.h
@@ -0,0 +1,94 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_FILE_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_FILE_H_
+
+#include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/data_decoder/public/mojom/web_bundle_parser.mojom.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "url/gurl.h"
+
+namespace blink {
+class ThrottlingURLLoader;
+}  // namespace blink
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleURLLoaderFactory;
+
+// A class to inherit NavigationLoaderInterceptor for a navigation to an
+// untrustable Web Bundle file (eg: "file:///tmp/a.wbn").
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for all navigation requests. It calls the
+//     |callback| with a null RequestHandler.
+// [2] MaybeCreateLoaderForResponse() is called for all navigation responses.
+//     If the response mime type is not "application/webbundle", returns false.
+//     Otherwise starts reading the metadata and returns true. Once the metadata
+//     is read, OnMetadataReady() is called, and a redirect loader is
+//     created to redirect the navigation request to the Bundle's synthesized
+//     primary URL ("file:///tmp/a.wbn?https://example.com/a.html").
+// [3] MaybeCreateLoader() is called again for the redirect. It continues on
+//     StartResponse() to create the loader for the main resource.
+class WebBundleInterceptorForFile final : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForFile(WebBundleDoneCallback done_callback,
+                              int frame_tree_node_id);
+  WebBundleInterceptorForFile(const WebBundleInterceptorForFile&) = delete;
+  WebBundleInterceptorForFile& operator=(const WebBundleInterceptorForFile&) =
+      delete;
+
+  ~WebBundleInterceptorForFile() override;
+
+ private:
+  void MaybeCreateLoader(
+      const network::ResourceRequest& tentative_resource_request,
+      BrowserContext* browser_context,
+      LoaderCallback callback,
+      FallbackCallback fallback_callback) override;
+
+  bool MaybeCreateLoaderForResponse(
+      const network::ResourceRequest& request,
+      network::mojom::URLResponseHeadPtr* response_head,
+      mojo::ScopedDataPipeConsumerHandle* response_body,
+      mojo::PendingRemote<network::mojom::URLLoader>* loader,
+      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+      blink::ThrottlingURLLoader* url_loader,
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect) override;
+
+  void OnMetadataReady(
+      const network::ResourceRequest& request,
+      data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error);
+
+  void StartResponse(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  WebBundleDoneCallback done_callback_;
+  const int frame_tree_node_id_;
+  scoped_refptr<WebBundleReader> reader_;
+  GURL primary_url_;
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+
+  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<WebBundleInterceptorForFile> weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_FILE_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.cc
new file mode 100644
index 00000000000..0be143a513a
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.cc
@@ -0,0 +1,49 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation.h"
+
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/cpp/resource_request.h"
+
+namespace content {
+
+WebBundleInterceptorForHistoryNavigation::
+    WebBundleInterceptorForHistoryNavigation(
+        const GURL& target_inner_url,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : target_inner_url_(target_inner_url),
+      frame_tree_node_id_(frame_tree_node_id),
+      done_callback_(std::move(done_callback)) {}
+
+WebBundleInterceptorForHistoryNavigation::
+    ~WebBundleInterceptorForHistoryNavigation() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+void WebBundleInterceptorForHistoryNavigation::CreateWebBundleURLLoaderFactory(
+    scoped_refptr<WebBundleReader> reader) {
+  DCHECK(reader->HasEntry(target_inner_url_));
+  url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
+      std::move(reader), frame_tree_node_id_);
+}
+
+void WebBundleInterceptorForHistoryNavigation::CreateLoaderAndStartAndDone(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  network::ResourceRequest new_resource_request = resource_request;
+  new_resource_request.url = target_inner_url_;
+  url_loader_factory_->CreateLoaderAndStart(
+      std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
+      /*options=*/0, new_resource_request, std::move(client),
+      net::MutableNetworkTrafficAnnotationTag(
+          web_bundle_utils::kTrafficAnnotation));
+  std::move(done_callback_)
+      .Run(target_inner_url_, std::move(url_loader_factory_));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.h
new file mode 100644
index 00000000000..17013e86c8c
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation.h
@@ -0,0 +1,68 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_H_
+
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "url/gurl.h"
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleURLLoaderFactory;
+
+// A base class of the following NavigationLoaderInterceptor classes. They are
+// used to intercept history navigation to a Web Bundle.
+//   - WebBundleInterceptorForHistoryNavigationWithExistingReader:
+//       This class is used when the WebBundleReader for the Web Bundle is still
+//       alive.
+//   - WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile:
+//       This class is used when the WebBundleReader was already deleted, and
+//       the Web Bundle is a file or a trustable file.
+//   - WebBundleInterceptorForHistoryNavigationFromNetwork:
+//       This class is used when the WebBundleReader was already deleted, and
+//       the Web Bundle was from network.
+class WebBundleInterceptorForHistoryNavigation
+    : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForHistoryNavigation(
+      const WebBundleInterceptorForHistoryNavigation&) = delete;
+  WebBundleInterceptorForHistoryNavigation& operator=(
+      const WebBundleInterceptorForHistoryNavigation&) = delete;
+
+ protected:
+  WebBundleInterceptorForHistoryNavigation(const GURL& target_inner_url,
+                                           WebBundleDoneCallback done_callback,
+                                           int frame_tree_node_id);
+
+  ~WebBundleInterceptorForHistoryNavigation() override;
+
+  void CreateWebBundleURLLoaderFactory(scoped_refptr<WebBundleReader> reader);
+
+  void CreateLoaderAndStartAndDone(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  const GURL target_inner_url_;
+  const int frame_tree_node_id_;
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+  SEQUENCE_CHECKER(sequence_checker_);
+
+ private:
+  WebBundleDoneCallback done_callback_;
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.cc
new file mode 100644
index 00000000000..8cb9a03d5b8
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.cc
@@ -0,0 +1,91 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/signed_exchange_utils.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "url/gurl.h"
+
+namespace content {
+
+WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+    WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile(
+        std::unique_ptr<WebBundleSource> source,
+        const GURL& target_inner_url,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : WebBundleInterceptorForHistoryNavigation(target_inner_url,
+                                               std::move(done_callback),
+                                               frame_tree_node_id),
+      reader_(base::MakeRefCounted<WebBundleReader>(std::move(source))) {
+  reader_->ReadMetadata(base::BindOnce(
+      &WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+          OnMetadataReady,
+      weak_factory_.GetWeakPtr()));
+}
+
+WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+    ~WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile() =
+        default;
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+    MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                      BrowserContext* browser_context,
+                      LoaderCallback callback,
+                      FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  std::move(callback).Run(
+      base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
+          &WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+              CreateURLLoader,
+          weak_factory_.GetWeakPtr())));
+}
+
+void WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+    CreateURLLoader(
+        const network::ResourceRequest& resource_request,
+        mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+        mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if (metadata_error_) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
+        frame_tree_node_id_,
+        web_bundle_utils::GetMetadataParseErrorMessage(metadata_error_));
+    return;
+  }
+
+  if (!url_loader_factory_) {
+    pending_resource_request_ = resource_request;
+    pending_receiver_ = std::move(receiver);
+    pending_client_ = std::move(client);
+    return;
+  }
+  CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
+                              std::move(client));
+}
+
+void WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile::
+    OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(!url_loader_factory_);
+
+  if (error) {
+    metadata_error_ = std::move(error);
+  } else {
+    CreateWebBundleURLLoaderFactory(std::move(reader_));
+  }
+
+  if (pending_receiver_) {
+    DCHECK(pending_client_);
+    CreateURLLoader(pending_resource_request_, std::move(pending_receiver_),
+                    std::move(pending_client_));
+  }
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h
new file mode 100644
index 00000000000..eaae4580d63
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_file_or_from_trustable_file.h
@@ -0,0 +1,81 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_FILE_OR_FROM_TRUSTABLE_FILE_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_FILE_OR_FROM_TRUSTABLE_FILE_H_
+
+#include "base/memory/weak_ptr.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/data_decoder/public/mojom/web_bundle_parser.mojom.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+class GURL;
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleSource;
+
+// A class to inherit NavigationLoaderInterceptor for the history navigation to
+// a Web Bundle file or a trustable Web Bundle file when the previous
+// WebBundleReader was deleted.
+// - MaybeCreateLoader() is called for the history navigation request. It
+//   continues on CreateURLLoader() to create the loader for the main resource.
+//   - If OnMetadataReady() has not been called yet:
+//       Wait for OnMetadataReady() to be called.
+//   - If OnMetadataReady() was called with an error:
+//       Completes the request with ERR_INVALID_WEB_BUNDLE.
+//   - If OnMetadataReady() was called whthout errors:
+//       Creates the loader for the main resource.
+class WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile final
+    : public WebBundleInterceptorForHistoryNavigation {
+ public:
+  WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile(
+      std::unique_ptr<WebBundleSource> source,
+      const GURL& target_inner_url,
+      WebBundleDoneCallback done_callback,
+      int frame_tree_node_id);
+  WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile(
+      const WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile&) =
+      delete;
+  WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile&
+  operator=(
+      const WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile&) =
+      delete;
+
+  ~WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile()
+      override;
+
+ private:
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override;
+
+  void CreateURLLoader(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error);
+
+  scoped_refptr<WebBundleReader> reader_;
+
+  network::ResourceRequest pending_resource_request_;
+  mojo::PendingReceiver<network::mojom::URLLoader> pending_receiver_;
+  mojo::PendingRemote<network::mojom::URLLoaderClient> pending_client_;
+
+  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
+
+  base::WeakPtrFactory<
+      WebBundleInterceptorForHistoryNavigationFromFileOrFromTrustableFile>
+      weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_FILE_OR_FROM_TRUSTABLE_FILE_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.cc
new file mode 100644
index 00000000000..9dfb5af15d6
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.cc
@@ -0,0 +1,189 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/signed_exchange_utils.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "content/public/browser/web_contents.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "third_party/blink/public/common/loader/throttling_url_loader.h"
+#include "url/gurl.h"
+
+namespace content {
+
+WebBundleInterceptorForHistoryNavigationFromNetwork::
+    WebBundleInterceptorForHistoryNavigationFromNetwork(
+        std::unique_ptr<WebBundleSource> source,
+        const GURL& target_inner_url,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : WebBundleInterceptorForHistoryNavigation(target_inner_url,
+                                               std::move(done_callback),
+                                               frame_tree_node_id),
+      source_(std::move(source)) {
+  DCHECK(source_->IsPathRestrictionSatisfied(target_inner_url_));
+}
+
+WebBundleInterceptorForHistoryNavigationFromNetwork::
+    ~WebBundleInterceptorForHistoryNavigationFromNetwork() = default;
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForHistoryNavigationFromNetwork::MaybeCreateLoader(
+    const network::ResourceRequest& tentative_resource_request,
+    BrowserContext* browser_context,
+    LoaderCallback callback,
+    FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  switch (state_) {
+    case State::kInitial:
+      DCHECK_EQ(tentative_resource_request.url, target_inner_url_);
+      std::move(callback).Run(
+          base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
+              &WebBundleInterceptorForHistoryNavigationFromNetwork::
+                  StartRedirectResponse,
+              weak_factory_.GetWeakPtr())));
+      return;
+    case State::kRedirectedToWebBundle:
+      DCHECK(!reader_);
+      if (tentative_resource_request.url != source_->url()) {
+        std::move(callback).Run(
+            base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
+                &WebBundleInterceptorForHistoryNavigationFromNetwork::
+                    StartErrorResponseForUnexpectedRedirect,
+                weak_factory_.GetWeakPtr())));
+      } else {
+        std::move(callback).Run({});
+      }
+      return;
+    case State::kWebBundleRecieved:
+      NOTREACHED();
+      return;
+    case State::kMetadataReady:
+      std::move(callback).Run(base::MakeRefCounted<
+                              SingleRequestURLLoaderFactory>(base::BindOnce(
+          &WebBundleInterceptorForHistoryNavigationFromNetwork::StartResponse,
+          weak_factory_.GetWeakPtr())));
+  }
+}
+
+bool WebBundleInterceptorForHistoryNavigationFromNetwork::
+    MaybeCreateLoaderForResponse(
+        const network::ResourceRequest& request,
+        network::mojom::URLResponseHeadPtr* response_head,
+        mojo::ScopedDataPipeConsumerHandle* response_body,
+        mojo::PendingRemote<network::mojom::URLLoader>* loader,
+        mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+        blink::ThrottlingURLLoader* url_loader,
+        bool* skip_other_interceptors,
+        bool* will_return_and_handle_unsafe_redirect) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(State::kRedirectedToWebBundle, state_);
+  DCHECK_EQ(source_->url(), request.url);
+  state_ = State::kWebBundleRecieved;
+  *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
+  if ((*response_head)->mime_type !=
+      web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        "Unexpected content type.");
+    return true;
+  }
+  if (!signed_exchange_utils::HasNoSniffHeader(**response_head)) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        web_bundle_utils::kNoSniffErrorMessage);
+    return true;
+  }
+  uint64_t length_hint =
+      (*response_head)->content_length > 0
+          ? static_cast<uint64_t>((*response_head)->content_length)
+          : 0;
+
+  // TODO(crbug.com/1018640): Check the special HTTP response header if we
+  // decided to require one for WBN navigation.
+
+  WebContents* web_contents =
+      WebContents::FromFrameTreeNodeId(frame_tree_node_id_);
+  DCHECK(web_contents);
+  BrowserContext* browser_context = web_contents->GetBrowserContext();
+  DCHECK(browser_context);
+  reader_ = base::MakeRefCounted<WebBundleReader>(
+      std::move(source_), length_hint, std::move(*response_body),
+      url_loader->Unbind(),
+      BrowserContext::GetBlobStorageContext(browser_context));
+  reader_->ReadMetadata(base::BindOnce(
+      &WebBundleInterceptorForHistoryNavigationFromNetwork::OnMetadataReady,
+      weak_factory_.GetWeakPtr(), request));
+  return true;
+}
+
+void WebBundleInterceptorForHistoryNavigationFromNetwork::OnMetadataReady(
+    network::ResourceRequest request,
+    data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(State::kWebBundleRecieved, state_);
+  state_ = State::kMetadataReady;
+  if (error) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        web_bundle_utils::GetMetadataParseErrorMessage(error));
+    return;
+  }
+  if (!reader_->HasEntry(target_inner_url_)) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        "The expected URL resource is not found in the web bundle.");
+    return;
+  }
+  CreateWebBundleURLLoaderFactory(reader_);
+  auto redirect_loader =
+      std::make_unique<WebBundleRedirectURLLoader>(forwarding_client_.Unbind());
+  redirect_loader->OnReadyToRedirect(request, target_inner_url_);
+}
+
+void WebBundleInterceptorForHistoryNavigationFromNetwork::StartRedirectResponse(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(State::kInitial, state_);
+  state_ = State::kRedirectedToWebBundle;
+  auto redirect_loader =
+      std::make_unique<WebBundleRedirectURLLoader>(std::move(client));
+  redirect_loader->OnReadyToRedirect(resource_request, source_->url());
+  mojo::MakeSelfOwnedReceiver(
+      std::move(redirect_loader),
+      mojo::PendingReceiver<network::mojom::URLLoader>(std::move(receiver)));
+}
+
+void WebBundleInterceptorForHistoryNavigationFromNetwork::
+    StartErrorResponseForUnexpectedRedirect(
+        const network::ResourceRequest& resource_request,
+        mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+        mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(State::kRedirectedToWebBundle, state_);
+  DCHECK_NE(source_->url(), resource_request.url);
+  web_bundle_utils::CompleteWithInvalidWebBundleError(
+      mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
+      frame_tree_node_id_, "Unexpected redirect.");
+}
+
+void WebBundleInterceptorForHistoryNavigationFromNetwork::StartResponse(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(State::kMetadataReady, state_);
+  CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
+                              std::move(client));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.h
new file mode 100644
index 00000000000..9dfcb1cfcc1
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_from_network.h
@@ -0,0 +1,122 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_NETWORK_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_NETWORK_H_
+
+#include "base/memory/weak_ptr.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/data_decoder/public/mojom/web_bundle_parser.mojom.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+class GURL;
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleSource;
+
+// A class to inherit NavigationLoaderInterceptor for the history navigation to
+// a Web Bundle from network when the previous WebBundleReader was deleted.
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for the history navigation request. It
+//     continues on StartRedirectResponse() to redirect to the Web Bundle URL.
+// [2] MaybeCreateLoader() is called again for the Web Bundle request. It calls
+//     the |callback| with a null RequestHandler.
+//     If server returned a redirect response instead of the Web Bundle,
+//     MaybeCreateLoader() is called again for the redirected new URL, in such
+//     it continues on StartErrorResponseForUnexpectedRedirect() and returns an
+//     error.
+//     Note that the Web Bundle URL should be loaded as cache-preferring load,
+//     but it may still go to the server if the Bundle is served with
+//     "no-store".
+// [3] MaybeCreateLoaderForResponse() is called for all navigation responses.
+//     - If the response mime type is not "application/webbundle", this means
+//       the server response is not a Web Bundle. So handles as an error.
+//     - If the Content-Length header is not a positive value, handles as an
+//       error.
+//     - Otherwise starts reading the metadata and returns true. Once the
+//       metadata is read, OnMetadataReady() is called, and a redirect loader is
+//       created to redirect the navigation request to the target inner URL.
+// [4] MaybeCreateLoader() is called again for target inner URL. It continues
+//     on StartResponse() to create the loader for the main resource.
+class WebBundleInterceptorForHistoryNavigationFromNetwork final
+    : public WebBundleInterceptorForHistoryNavigation {
+ public:
+  WebBundleInterceptorForHistoryNavigationFromNetwork(
+      std::unique_ptr<WebBundleSource> source,
+      const GURL& target_inner_url,
+      WebBundleDoneCallback done_callback,
+      int frame_tree_node_id);
+  WebBundleInterceptorForHistoryNavigationFromNetwork(
+      const WebBundleInterceptorForHistoryNavigationFromNetwork&) = delete;
+  WebBundleInterceptorForHistoryNavigationFromNetwork& operator=(
+      const WebBundleInterceptorForHistoryNavigationFromNetwork&) = delete;
+
+  ~WebBundleInterceptorForHistoryNavigationFromNetwork() override;
+
+ private:
+  enum class State {
+    kInitial,
+    kRedirectedToWebBundle,
+    kWebBundleRecieved,
+    kMetadataReady,
+  };
+
+  // NavigationLoaderInterceptor implementation
+  void MaybeCreateLoader(
+      const network::ResourceRequest& tentative_resource_request,
+      BrowserContext* browser_context,
+      LoaderCallback callback,
+      FallbackCallback fallback_callback) override;
+
+  bool MaybeCreateLoaderForResponse(
+      const network::ResourceRequest& request,
+      network::mojom::URLResponseHeadPtr* response_head,
+      mojo::ScopedDataPipeConsumerHandle* response_body,
+      mojo::PendingRemote<network::mojom::URLLoader>* loader,
+      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+      blink::ThrottlingURLLoader* url_loader,
+      bool* skip_other_interceptors,
+      bool* will_return_and_handle_unsafe_redirect) override;
+
+  void OnMetadataReady(network::ResourceRequest request,
+                       data_decoder::mojom::BundleMetadataParseErrorPtr error);
+
+  void StartRedirectResponse(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  void StartErrorResponseForUnexpectedRedirect(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  void StartResponse(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  State state_ = State::kInitial;
+  std::unique_ptr<WebBundleSource> source_;
+  scoped_refptr<WebBundleReader> reader_;
+
+  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
+
+  base::WeakPtrFactory<WebBundleInterceptorForHistoryNavigationFromNetwork>
+      weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_FROM_NETWORK_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.cc
new file mode 100644
index 00000000000..cb9d37dd19f
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.cc
@@ -0,0 +1,66 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "url/gurl.h"
+
+namespace content {
+
+WebBundleInterceptorForHistoryNavigationWithExistingReader::
+    WebBundleInterceptorForHistoryNavigationWithExistingReader(
+        scoped_refptr<WebBundleReader> reader,
+        const GURL& target_inner_url,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : WebBundleInterceptorForHistoryNavigation(target_inner_url,
+                                               std::move(done_callback),
+                                               frame_tree_node_id) {
+  CreateWebBundleURLLoaderFactory(std::move(reader));
+}
+
+WebBundleInterceptorForHistoryNavigationWithExistingReader::
+    ~WebBundleInterceptorForHistoryNavigationWithExistingReader() = default;
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForHistoryNavigationWithExistingReader::
+    MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                      BrowserContext* browser_context,
+                      LoaderCallback callback,
+                      FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(resource_request.url,
+            url_loader_factory_->reader()->source().is_file()
+                ? web_bundle_utils::GetSynthesizedUrlForWebBundle(
+                      url_loader_factory_->reader()->source().url(),
+                      target_inner_url_)
+                : target_inner_url_);
+  std::move(callback).Run(
+      base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
+          &WebBundleInterceptorForHistoryNavigationWithExistingReader::
+              CreateURLLoader,
+          weak_factory_.GetWeakPtr())));
+}
+
+void WebBundleInterceptorForHistoryNavigationWithExistingReader::
+    CreateURLLoader(
+        const network::ResourceRequest& resource_request,
+        mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+        mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK_EQ(resource_request.url,
+            url_loader_factory_->reader()->source().is_file()
+                ? web_bundle_utils::GetSynthesizedUrlForWebBundle(
+                      url_loader_factory_->reader()->source().url(),
+                      target_inner_url_)
+                : target_inner_url_);
+  CreateLoaderAndStartAndDone(resource_request, std::move(receiver),
+                              std::move(client));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h
new file mode 100644
index 00000000000..3799d64d6c6
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_history_navigation_with_existing_reader.h
@@ -0,0 +1,64 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_WITH_EXISTING_READER_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_WITH_EXISTING_READER_H_
+
+#include "base/memory/weak_ptr.h"
+#include "content/browser/web_package/web_bundle_interceptor_for_history_navigation.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+class GURL;
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+class WebBundleReader;
+
+// A class to inherit NavigationLoaderInterceptor for the history navigation to
+// a Web Bundle when the previous WebBundleReader is still alive.
+// - MaybeCreateLoader() is called for the history navigation request. It
+//   continues on CreateURLLoader() to create the loader for the main resource.
+class WebBundleInterceptorForHistoryNavigationWithExistingReader final
+    : public WebBundleInterceptorForHistoryNavigation {
+ public:
+  WebBundleInterceptorForHistoryNavigationWithExistingReader(
+      scoped_refptr<WebBundleReader> reader,
+      const GURL& target_inner_url,
+      WebBundleDoneCallback done_callback,
+      int frame_tree_node_id);
+  WebBundleInterceptorForHistoryNavigationWithExistingReader(
+      const WebBundleInterceptorForHistoryNavigationWithExistingReader&) =
+      delete;
+  WebBundleInterceptorForHistoryNavigationWithExistingReader& operator=(
+      const WebBundleInterceptorForHistoryNavigationWithExistingReader&) =
+      delete;
+
+  ~WebBundleInterceptorForHistoryNavigationWithExistingReader() override;
+
+ private:
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override;
+
+  void CreateURLLoader(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  base::WeakPtrFactory<
+      WebBundleInterceptorForHistoryNavigationWithExistingReader>
+      weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_HISTORY_NAVIGATION_WITH_EXISTING_READER_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_network.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_network.cc
new file mode 100644
index 00000000000..9db14a3d4f5
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_network.cc
@@ -0,0 +1,154 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_network.h"
+
+#include "base/strings/stringprintf.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/signed_exchange_utils.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "content/public/browser/download_utils.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+
+namespace content {
+
+WebBundleInterceptorForNetwork::WebBundleInterceptorForNetwork(
+    WebBundleDoneCallback done_callback,
+    BrowserContext* browser_context,
+    int frame_tree_node_id)
+    : done_callback_(std::move(done_callback)),
+      browser_context_(browser_context),
+      frame_tree_node_id_(frame_tree_node_id) {
+  DCHECK(browser_context_);
+}
+
+WebBundleInterceptorForNetwork::~WebBundleInterceptorForNetwork() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForNetwork::MaybeCreateLoader(
+    const network::ResourceRequest& tentative_resource_request,
+    BrowserContext* browser_context,
+    LoaderCallback callback,
+    FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if (!reader_) {
+    std::move(callback).Run({});
+    return;
+  }
+  std::move(callback).Run(base::MakeRefCounted<SingleRequestURLLoaderFactory>(
+      base::BindOnce(&WebBundleInterceptorForNetwork::StartResponse,
+                     weak_factory_.GetWeakPtr())));
+}
+
+bool WebBundleInterceptorForNetwork::MaybeCreateLoaderForResponse(
+    const network::ResourceRequest& request,
+    network::mojom::URLResponseHeadPtr* response_head,
+    mojo::ScopedDataPipeConsumerHandle* response_body,
+    mojo::PendingRemote<network::mojom::URLLoader>* loader,
+    mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+    blink::ThrottlingURLLoader* url_loader,
+    bool* skip_other_interceptors,
+    bool* will_return_and_handle_unsafe_redirect) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if ((*response_head)->mime_type !=
+      web_bundle_utils::kWebBundleFileMimeTypeWithoutParameters) {
+    return false;
+  }
+  if (download_utils::MustDownload(request.url, (*response_head)->headers.get(),
+                                   (*response_head)->mime_type)) {
+    return false;
+  }
+  *client_receiver = forwarding_client_.BindNewPipeAndPassReceiver();
+
+  if (!signed_exchange_utils::HasNoSniffHeader(**response_head)) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        web_bundle_utils::kNoSniffErrorMessage);
+    return true;
+  }
+  auto source = WebBundleSource::MaybeCreateFromNetworkUrl(request.url);
+  if (!source) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        "Web Bundle response must be served from HTTPS or localhost HTTP.");
+    return true;
+  }
+
+  uint64_t length_hint =
+      (*response_head)->content_length > 0
+          ? static_cast<uint64_t>((*response_head)->content_length)
+          : 0;
+
+  // TODO(crbug.com/1018640): Check the special HTTP response header if we
+  // decided to require one for WBN navigation.
+
+  reader_ = base::MakeRefCounted<WebBundleReader>(
+      std::move(source), length_hint, std::move(*response_body),
+      url_loader->Unbind(),
+      BrowserContext::GetBlobStorageContext(browser_context_));
+  reader_->ReadMetadata(
+      base::BindOnce(&WebBundleInterceptorForNetwork::OnMetadataReady,
+                     weak_factory_.GetWeakPtr(), request));
+  return true;
+}
+
+void WebBundleInterceptorForNetwork::OnMetadataReady(
+    network::ResourceRequest request,
+    data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+  if (error) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        web_bundle_utils::GetMetadataParseErrorMessage(error));
+    return;
+  }
+  primary_url_ = reader_->GetPrimaryURL();
+  if (!reader_->HasEntry(primary_url_)) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        "The primary URL resource is not found in the web bundle.");
+    return;
+  }
+  if (primary_url_.GetOrigin() != reader_->source().url().GetOrigin()) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        "The origin of primary URL doesn't match with the origin of the web "
+        "bundle.");
+    return;
+  }
+  if (!reader_->source().IsPathRestrictionSatisfied(primary_url_)) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        std::move(forwarding_client_), frame_tree_node_id_,
+        base::StringPrintf("Path restriction mismatch: Can't navigate to %s "
+                           "in the web bundle served from %s.",
+                           primary_url_.spec().c_str(),
+                           reader_->source().url().spec().c_str()));
+    return;
+  }
+  url_loader_factory_ =
+      std::make_unique<WebBundleURLLoaderFactory>(reader_, frame_tree_node_id_);
+  auto redirect_loader =
+      std::make_unique<WebBundleRedirectURLLoader>(forwarding_client_.Unbind());
+  redirect_loader->OnReadyToRedirect(request, primary_url_);
+}
+
+void WebBundleInterceptorForNetwork::StartResponse(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  network::ResourceRequest new_resource_request = resource_request;
+  new_resource_request.url = primary_url_;
+  url_loader_factory_->CreateLoaderAndStart(
+      std::move(receiver), 0, 0, 0, new_resource_request, std::move(client),
+      net::MutableNetworkTrafficAnnotationTag(
+          web_bundle_utils::kTrafficAnnotation));
+  std::move(done_callback_).Run(primary_url_, std::move(url_loader_factory_));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_network.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_network.h
new file mode 100644
index 00000000000..fd4ead0c545
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_network.h
@@ -0,0 +1,93 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_NETWORK_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_NETWORK_H_
+
+#include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "third_party/blink/public/common/loader/throttling_url_loader.h"
+#include "url/gurl.h"
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleURLLoaderFactory;
+
+// A class to inherit NavigationLoaderInterceptor for a navigation to a
+// Web Bundle file on HTTPS server (eg: "https://example.com/a.wbn").
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for all navigation requests. It calls the
+//     |callback| with a null RequestHandler.
+// [2] MaybeCreateLoaderForResponse() is called for all navigation responses.
+//     - If the response mime type is not "application/webbundle", or attachment
+//       Content-Disposition header is set, returns false.
+//     - If the URL isn't HTTPS nor localhost HTTP, or the Content-Length header
+//       is not a positive value, completes the requests with
+//       ERR_INVALID_WEB_BUNDLE and returns true.
+//     - Otherwise starts reading the metadata and returns true. Once the
+//       metadata is read, OnMetadataReady() is called, and a redirect loader is
+//       created to redirect the navigation request to the Bundle's primary URL
+//       ("https://example.com/a.html").
+// [3] MaybeCreateLoader() is called again for the redirect. It continues on
+//     StartResponse() to create the loader for the main resource.
+class WebBundleInterceptorForNetwork final
+    : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForNetwork(WebBundleDoneCallback done_callback,
+                                 BrowserContext* browser_context,
+                                 int frame_tree_node_id);
+  WebBundleInterceptorForNetwork(const WebBundleInterceptorForNetwork&) =
+      delete;
+  WebBundleInterceptorForNetwork& operator=(
+      const WebBundleInterceptorForNetwork&) = delete;
+
+  ~WebBundleInterceptorForNetwork() override;
+
+ private:
+  void MaybeCreateLoader(
+      const network::ResourceRequest& tentative_resource_request,
+      BrowserContext* browser_context,
+      LoaderCallback callback,
+      FallbackCallback fallback_callback) override;
+
+  bool MaybeCreateLoaderForResponse(
+      const network::ResourceRequest& request,
+      network::mojom::URLResponseHeadPtr* response_head,
+      mojo::ScopedDataPipeConsumerHandle* response_body,
+      mojo::PendingRemote<network::mojom::URLLoader>* loader,
+      mojo::PendingReceiver<network::mojom::URLLoaderClient>* client_receiver,
+      blink::ThrottlingURLLoader* url_loader,
+      bool* skip_other_interceptors,
+      bool* will_return_and_handle_unsafe_redirect) override;
+
+  void OnMetadataReady(network::ResourceRequest request,
+                       data_decoder::mojom::BundleMetadataParseErrorPtr error);
+
+  void StartResponse(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  WebBundleDoneCallback done_callback_;
+  BrowserContext* browser_context_;
+  const int frame_tree_node_id_;
+  scoped_refptr<WebBundleReader> reader_;
+  GURL primary_url_;
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+
+  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<WebBundleInterceptorForNetwork> weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_NETWORK_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.cc
new file mode 100644
index 00000000000..8ca4292a3fb
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.cc
@@ -0,0 +1,93 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+
+namespace content {
+
+// A class to inherit NavigationLoaderInterceptor for a navigation within a
+// Web Bundle file.
+// For example:
+//   A user opened "file:///tmp/a.wbn", and InterceptorForFile redirected to
+//   "file:///tmp/a.wbn?https://example.com/a.html" and "a.html" in "a.wbn" was
+//   loaded. And the user clicked a link to "https://example.com/b.html" from
+//   "a.html".
+// In this case, this interceptor intecepts the navigation request to "b.html",
+// and redirect the navigation request to
+// "file:///tmp/a.wbn?https://example.com/b.html" and creates a URLLoader using
+// the WebBundleURLLoaderFactory to load the response of "b.html" in
+// "a.wbn".
+WebBundleInterceptorForTrackedNavigationFromFile::
+    WebBundleInterceptorForTrackedNavigationFromFile(
+        scoped_refptr<WebBundleReader> reader,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : url_loader_factory_(
+          std::make_unique<WebBundleURLLoaderFactory>(std::move(reader),
+                                                      frame_tree_node_id)),
+      done_callback_(std::move(done_callback)) {}
+WebBundleInterceptorForTrackedNavigationFromFile::
+    ~WebBundleInterceptorForTrackedNavigationFromFile() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForTrackedNavigationFromFile::MaybeCreateLoader(
+    const network::ResourceRequest& resource_request,
+    BrowserContext* browser_context,
+    LoaderCallback callback,
+    FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  std::move(callback).Run(
+      base::MakeRefCounted<SingleRequestURLLoaderFactory>(base::BindOnce(
+          &WebBundleInterceptorForTrackedNavigationFromFile::CreateURLLoader,
+          weak_factory_.GetWeakPtr())));
+}
+
+bool WebBundleInterceptorForTrackedNavigationFromFile::
+    ShouldBypassRedirectChecks() {
+  return true;
+}
+
+void WebBundleInterceptorForTrackedNavigationFromFile::CreateURLLoader(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if (!is_redirected_) {
+    DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
+    is_redirected_ = true;
+    original_request_url_ = resource_request.url;
+
+    GURL web_bundle_url = url_loader_factory_->reader()->source().url();
+    const GURL new_url = web_bundle_utils::GetSynthesizedUrlForWebBundle(
+        web_bundle_url, original_request_url_);
+    auto redirect_loader =
+        std::make_unique<WebBundleRedirectURLLoader>(std::move(client));
+    redirect_loader->OnReadyToRedirect(resource_request, new_url);
+    mojo::MakeSelfOwnedReceiver(
+        std::move(redirect_loader),
+        mojo::PendingReceiver<network::mojom::URLLoader>(std::move(receiver)));
+    return;
+  }
+  network::ResourceRequest new_resource_request = resource_request;
+  new_resource_request.url = original_request_url_;
+  url_loader_factory_->CreateLoaderAndStart(
+      std::move(receiver), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+      new_resource_request, std::move(client),
+      net::MutableNetworkTrafficAnnotationTag(
+          web_bundle_utils::kTrafficAnnotation));
+  std::move(done_callback_)
+      .Run(original_request_url_, std::move(url_loader_factory_));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h
new file mode 100644
index 00000000000..de5c876cb65
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_file.h
@@ -0,0 +1,73 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_FILE_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_FILE_H_
+
+#include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleURLLoaderFactory;
+
+// A class to inherit NavigationLoaderInterceptor for a navigation within a
+// Web Bundle file.
+// For example:
+//   A user opened "file:///tmp/a.wbn", and InterceptorForFile redirected to
+//   "file:///tmp/a.wbn?https://example.com/a.html" and "a.html" in "a.wbn" was
+//   loaded. And the user clicked a link to "https://example.com/b.html" from
+//   "a.html".
+// In this case, this interceptor intecepts the navigation request to "b.html",
+// and redirect the navigation request to
+// "file:///tmp/a.wbn?https://example.com/b.html" and creates a URLLoader using
+// the WebBundleURLLoaderFactory to load the response of "b.html" in
+// "a.wbn".
+class WebBundleInterceptorForTrackedNavigationFromFile final
+    : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForTrackedNavigationFromFile(
+      scoped_refptr<WebBundleReader> reader,
+      WebBundleDoneCallback done_callback,
+      int frame_tree_node_id);
+  WebBundleInterceptorForTrackedNavigationFromFile(
+      const WebBundleInterceptorForTrackedNavigationFromFile&) = delete;
+  WebBundleInterceptorForTrackedNavigationFromFile& operator=(
+      const WebBundleInterceptorForTrackedNavigationFromFile&) = delete;
+
+  ~WebBundleInterceptorForTrackedNavigationFromFile() override;
+
+ private:
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override;
+
+  bool ShouldBypassRedirectChecks() override;
+
+  void CreateURLLoader(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+  WebBundleDoneCallback done_callback_;
+
+  bool is_redirected_ = false;
+  GURL original_request_url_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<WebBundleInterceptorForTrackedNavigationFromFile>
+      weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_FILE_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.cc
new file mode 100644
index 00000000000..afe657191eb
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.cc
@@ -0,0 +1,74 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h"
+
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace content {
+
+WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
+    WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork(
+        scoped_refptr<WebBundleReader> reader,
+        WebBundleDoneCallback done_callback,
+        int frame_tree_node_id)
+    : url_loader_factory_(
+          std::make_unique<WebBundleURLLoaderFactory>(std::move(reader),
+                                                      frame_tree_node_id)),
+      done_callback_(std::move(done_callback)) {
+  DCHECK((base::CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kTrustableWebBundleFileUrl) &&
+          url_loader_factory_->reader()->source().is_trusted_file()) ||
+         (base::FeatureList::IsEnabled(features::kWebBundlesFromNetwork) &&
+          url_loader_factory_->reader()->source().is_network()));
+}
+
+WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
+    ~WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
+    MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                      BrowserContext* browser_context,
+                      LoaderCallback callback,
+                      FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
+  DCHECK(url_loader_factory_->reader()->source().is_trusted_file() ||
+         (url_loader_factory_->reader()->source().is_network() &&
+          url_loader_factory_->reader()->source().IsPathRestrictionSatisfied(
+              resource_request.url)));
+  std::move(callback).Run(base::MakeRefCounted<
+                          SingleRequestURLLoaderFactory>(base::BindOnce(
+      &WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
+          CreateURLLoader,
+      weak_factory_.GetWeakPtr())));
+}
+
+void WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork::
+    CreateURLLoader(
+        const network::ResourceRequest& resource_request,
+        mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+        mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  url_loader_factory_->CreateLoaderAndStart(
+      std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
+      /*options=*/0, resource_request, std::move(client),
+      net::MutableNetworkTrafficAnnotationTag(
+          web_bundle_utils::kTrafficAnnotation));
+  std::move(done_callback_)
+      .Run(resource_request.url, std::move(url_loader_factory_));
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h
new file mode 100644
index 00000000000..433fadb8ad2
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_tracked_navigation_from_trustable_file_or_from_network.h
@@ -0,0 +1,74 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_TRUSTABLE_FILE_OR_FROM_NETWORK_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_TRUSTABLE_FILE_OR_FROM_NETWORK_H_
+
+#include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace content {
+
+class WebBundleReader;
+
+// A class to inherit NavigationLoaderInterceptor for a navigation within a
+// trustable Web Bundle file or within a Web Bundle from network.
+// For example:
+//   A user opened a trustable Web Bundle file "file:///tmp/a.wbn", and
+//   InterceptorForTrustableFile redirected to "https://example.com/a.html" and
+//   "a.html" in "a.wbn" was loaded. Or, a user opened a Web Bundle
+//   "https://example.com/a.wbn", and InterceptorForNetwork redirected to
+//   "https://example.com/a.html" and "a.html" in "a.wbn" was loaded. And the
+//   user clicked a link to "https://example.com/b.html" from "a.html".
+//
+// In this case, this interceptor intecepts the navigation request to "b.html",
+// and creates a URLLoader using the WebBundleURLLoaderFactory to load
+// the response of "b.html" in "a.wbn".
+class WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork
+    final : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork(
+      scoped_refptr<WebBundleReader> reader,
+      WebBundleDoneCallback done_callback,
+      int frame_tree_node_id);
+  WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork(
+      const WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork&) =
+      delete;
+  WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork&
+  operator=(
+      const WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork&) =
+      delete;
+
+  ~WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork()
+      override;
+
+ private:
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override;
+
+  void CreateURLLoader(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+  WebBundleDoneCallback done_callback_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<
+      WebBundleInterceptorForTrackedNavigationFromTrustableFileOrFromNetwork>
+      weak_factory_{this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRACKED_NAVIGATION_FROM_TRUSTABLE_FILE_OR_FROM_NETWORK_H_
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.cc b/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.cc
new file mode 100644
index 00000000000..8ae33003ed2
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.cc
@@ -0,0 +1,109 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_interceptor_for_trustable_file.h"
+
+#include "base/bind.h"
+#include "content/browser/loader/single_request_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+#include "content/browser/web_package/web_bundle_source.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+
+namespace content {
+
+WebBundleInterceptorForTrustableFile::WebBundleInterceptorForTrustableFile(
+    std::unique_ptr<WebBundleSource> source,
+    WebBundleDoneCallback done_callback,
+    int frame_tree_node_id)
+    : source_(std::move(source)),
+      reader_(base::MakeRefCounted<WebBundleReader>(source_->Clone())),
+      done_callback_(std::move(done_callback)),
+      frame_tree_node_id_(frame_tree_node_id) {
+  reader_->ReadMetadata(
+      base::BindOnce(&WebBundleInterceptorForTrustableFile::OnMetadataReady,
+                     weak_factory_.GetWeakPtr()));
+}
+WebBundleInterceptorForTrustableFile::~WebBundleInterceptorForTrustableFile() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+// NavigationLoaderInterceptor implementation
+void WebBundleInterceptorForTrustableFile::MaybeCreateLoader(
+    const network::ResourceRequest& resource_request,
+    BrowserContext* browser_context,
+    LoaderCallback callback,
+    FallbackCallback fallback_callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  std::move(callback).Run(base::MakeRefCounted<SingleRequestURLLoaderFactory>(
+      base::BindOnce(&WebBundleInterceptorForTrustableFile::CreateURLLoader,
+                     weak_factory_.GetWeakPtr())));
+}
+
+void WebBundleInterceptorForTrustableFile::CreateURLLoader(
+    const network::ResourceRequest& resource_request,
+    mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  if (metadata_error_) {
+    web_bundle_utils::CompleteWithInvalidWebBundleError(
+        mojo::Remote<network::mojom::URLLoaderClient>(std::move(client)),
+        frame_tree_node_id_,
+        web_bundle_utils::GetMetadataParseErrorMessage(metadata_error_));
+    return;
+  }
+
+  if (!url_loader_factory_) {
+    // This must be the first request to the Web Bundle file.
+    DCHECK_EQ(source_->url(), resource_request.url);
+    pending_resource_request_ = resource_request;
+    pending_receiver_ = std::move(receiver);
+    pending_client_ = std::move(client);
+    return;
+  }
+
+  // Currently |source_| must be a local file. And the bundle's primary URL
+  // can't be a local file URL. So while handling redirected request to the
+  // primary URL, |resource_request.url| must not be same as the |source_|'s
+  // URL.
+  if (source_->url() != resource_request.url) {
+    url_loader_factory_->CreateLoaderAndStart(
+        std::move(receiver), /*routing_id=*/0, /*request_id=*/0,
+        /*options=*/0, resource_request, std::move(client),
+        net::MutableNetworkTrafficAnnotationTag(
+            web_bundle_utils::kTrafficAnnotation));
+    std::move(done_callback_)
+        .Run(resource_request.url, std::move(url_loader_factory_));
+    return;
+  }
+
+  auto redirect_loader =
+      std::make_unique<WebBundleRedirectURLLoader>(std::move(client));
+  redirect_loader->OnReadyToRedirect(resource_request, primary_url_);
+  mojo::MakeSelfOwnedReceiver(
+      std::move(redirect_loader),
+      mojo::PendingReceiver<network::mojom::URLLoader>(std::move(receiver)));
+}
+
+void WebBundleInterceptorForTrustableFile::OnMetadataReady(
+    data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(!url_loader_factory_);
+
+  if (error) {
+    metadata_error_ = std::move(error);
+  } else {
+    primary_url_ = reader_->GetPrimaryURL();
+    url_loader_factory_ = std::make_unique<WebBundleURLLoaderFactory>(
+        std::move(reader_), frame_tree_node_id_);
+  }
+
+  if (pending_receiver_) {
+    DCHECK(pending_client_);
+    CreateURLLoader(pending_resource_request_, std::move(pending_receiver_),
+                    std::move(pending_client_));
+  }
+}
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.h b/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.h
new file mode 100644
index 00000000000..01116b01f2f
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_interceptor_for_trustable_file.h
@@ -0,0 +1,86 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRUSTABLE_FILE_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRUSTABLE_FILE_H_
+
+#include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
+#include "content/browser/web_package/web_bundle_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace content {
+
+class WebBundleReader;
+class WebBundleSource;
+
+// A class to inherit NavigationLoaderInterceptor for a navigation to a
+// trustable Web Bundle file (eg: "file:///tmp/a.wbn").
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for the navigation request to the trustable
+//     Web Bundle file. It continues on CreateURLLoader() to create the loader
+//     for the main resource.
+//     - If OnMetadataReady() has not been called yet:
+//         Wait for OnMetadataReady() to be called.
+//     - If OnMetadataReady() was called with an error:
+//         Completes the request with ERR_INVALID_WEB_BUNDLE.
+//     - If OnMetadataReady() was called whthout errors:
+//         A redirect loader is created to redirect the navigation request to
+//         the Bundle's primary URL ("https://example.com/a.html").
+// [2] MaybeCreateLoader() is called again for the redirect. It continues on
+//     CreateURLLoader() to create the loader for the main resource.
+class WebBundleInterceptorForTrustableFile final
+    : public NavigationLoaderInterceptor {
+ public:
+  WebBundleInterceptorForTrustableFile(std::unique_ptr<WebBundleSource> source,
+                                       WebBundleDoneCallback done_callback,
+                                       int frame_tree_node_id);
+  WebBundleInterceptorForTrustableFile(
+      const WebBundleInterceptorForTrustableFile&) = delete;
+  WebBundleInterceptorForTrustableFile& operator=(
+      const WebBundleInterceptorForTrustableFile&) = delete;
+
+  ~WebBundleInterceptorForTrustableFile() override;
+
+ private:
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override;
+
+  void CreateURLLoader(
+      const network::ResourceRequest& resource_request,
+      mojo::PendingReceiver<network::mojom::URLLoader> receiver,
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+
+  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error);
+
+  std::unique_ptr<WebBundleSource> source_;
+  scoped_refptr<WebBundleReader> reader_;
+  WebBundleDoneCallback done_callback_;
+  const int frame_tree_node_id_;
+
+  network::ResourceRequest pending_resource_request_;
+  mojo::PendingReceiver<network::mojom::URLLoader> pending_receiver_;
+  mojo::PendingRemote<network::mojom::URLLoaderClient> pending_client_;
+
+  std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory_;
+
+  GURL primary_url_;
+  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<WebBundleInterceptorForTrustableFile> weak_factory_{
+      this};
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_INTERCEPTOR_FOR_TRUSTABLE_FILE_H_
diff --git a/chromium/content/browser/web_package/web_bundle_reader.cc b/chromium/content/browser/web_package/web_bundle_reader.cc
index 4f6f5826b4d..869195a08d2 100644
--- a/chromium/content/browser/web_package/web_bundle_reader.cc
+++ b/chromium/content/browser/web_package/web_bundle_reader.cc
@@ -6,7 +6,7 @@
 
 #include <limits>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/numerics/safe_math.h"
 #include "base/task/post_task.h"
 #include "base/task/task_traits.h"
diff --git a/chromium/content/browser/web_package/web_bundle_reader_unittest.cc b/chromium/content/browser/web_package/web_bundle_reader_unittest.cc
index 476bcce4998..d3018300d1b 100644
--- a/chromium/content/browser/web_package/web_bundle_reader_unittest.cc
+++ b/chromium/content/browser/web_package/web_bundle_reader_unittest.cc
@@ -8,7 +8,6 @@
 #include "base/callback.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/optional.h"
diff --git a/chromium/content/browser/web_package/web_bundle_redirect_url_loader.cc b/chromium/content/browser/web_package/web_bundle_redirect_url_loader.cc
new file mode 100644
index 00000000000..871850572a9
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_redirect_url_loader.cc
@@ -0,0 +1,46 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/web_bundle_redirect_url_loader.h"
+
+#include "base/strings/stringprintf.h"
+#include "content/public/browser/web_contents.h"
+#include "net/http/http_util.h"
+#include "services/network/public/cpp/resource_request.h"
+
+namespace content {
+
+WebBundleRedirectURLLoader::WebBundleRedirectURLLoader(
+    mojo::PendingRemote<network::mojom::URLLoaderClient> client)
+    : client_(std::move(client)) {}
+
+WebBundleRedirectURLLoader::~WebBundleRedirectURLLoader() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+}
+
+void WebBundleRedirectURLLoader::OnReadyToRedirect(
+    const network::ResourceRequest& resource_request,
+    const GURL& url) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(client_.is_connected());
+  auto response_head = network::mojom::URLResponseHead::New();
+  response_head->encoded_data_length = 0;
+  response_head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+      net::HttpUtil::AssembleRawHeaders(
+          base::StringPrintf("HTTP/1.1 %d %s\r\n", 303, "See Other")));
+
+  net::RedirectInfo redirect_info = net::RedirectInfo::ComputeRedirectInfo(
+      "GET", resource_request.url, resource_request.site_for_cookies,
+      resource_request.update_first_party_url_on_redirect
+          ? net::URLRequest::FirstPartyURLPolicy::
+                UPDATE_FIRST_PARTY_URL_ON_REDIRECT
+          : net::URLRequest::FirstPartyURLPolicy::NEVER_CHANGE_FIRST_PARTY_URL,
+      resource_request.referrer_policy, resource_request.referrer.spec(), 303,
+      url, /*referrer_policy_header=*/base::nullopt,
+      /*insecure_scheme_was_upgraded=*/false, /*copy_fragment=*/true,
+      /*is_signed_exchange_fallback_redirect=*/false);
+  client_->OnReceiveRedirect(redirect_info, std::move(response_head));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_redirect_url_loader.h b/chromium/content/browser/web_package/web_bundle_redirect_url_loader.h
new file mode 100644
index 00000000000..77fb33c8b70
--- /dev/null
+++ b/chromium/content/browser/web_package/web_bundle_redirect_url_loader.h
@@ -0,0 +1,56 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_REDIRECT_URL_LOADER_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_REDIRECT_URL_LOADER_H_
+
+#include <string>
+#include <vector>
+
+#include "base/sequence_checker.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "url/gurl.h"
+
+namespace network {
+struct ResourceRequest;
+}  // namespace network
+
+namespace content {
+
+// A class to provide a network::mojom::URLLoader interface to redirect a
+// request to the Web Bundle to the main resource url.
+class WebBundleRedirectURLLoader final : public network::mojom::URLLoader {
+ public:
+  explicit WebBundleRedirectURLLoader(
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client);
+  WebBundleRedirectURLLoader(const WebBundleRedirectURLLoader&) = delete;
+  WebBundleRedirectURLLoader& operator=(const WebBundleRedirectURLLoader&) =
+      delete;
+
+  ~WebBundleRedirectURLLoader() override;
+
+  void OnReadyToRedirect(const network::ResourceRequest& resource_request,
+                         const GURL& url);
+
+ private:
+  // mojom::URLLoader overrides:
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {}
+  void SetPriority(net::RequestPriority priority,
+                   int intra_priority_value) override {}
+  void PauseReadingBodyFromNet() override {}
+  void ResumeReadingBodyFromNet() override {}
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  mojo::Remote<network::mojom::URLLoaderClient> client_;
+};
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_WEB_BUNDLE_REDIRECT_URL_LOADER_H_
diff --git a/chromium/content/browser/web_package/web_bundle_source.cc b/chromium/content/browser/web_package/web_bundle_source.cc
index a22e2d23d15..10a52579c26 100644
--- a/chromium/content/browser/web_package/web_bundle_source.cc
+++ b/chromium/content/browser/web_package/web_bundle_source.cc
@@ -6,6 +6,7 @@
 
 #include "base/files/file.h"
 #include "base/memory/ptr_util.h"
+#include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "net/base/filename_util.h"
 #include "net/base/url_util.h"
@@ -80,8 +81,7 @@ std::unique_ptr<base::File> WebBundleSource::OpenFile() const {
       file_path_, base::File::FLAG_OPEN | base::File::FLAG_READ);
 }
 
-bool WebBundleSource::IsNavigationPathRestrictionSatisfied(
-    const GURL& url) const {
+bool WebBundleSource::IsPathRestrictionSatisfied(const GURL& url) const {
   DCHECK(is_network());
   return base::StartsWith(url.spec(), url_.GetWithoutFilename().spec(),
                           base::CompareCase::SENSITIVE);
diff --git a/chromium/content/browser/web_package/web_bundle_source.h b/chromium/content/browser/web_package/web_bundle_source.h
index 1d00e4795c0..bd4e2bfb6bc 100644
--- a/chromium/content/browser/web_package/web_bundle_source.h
+++ b/chromium/content/browser/web_package/web_bundle_source.h
@@ -56,7 +56,7 @@ class CONTENT_EXPORT WebBundleSource {
 
   const GURL& url() const { return url_; }
 
-  bool IsNavigationPathRestrictionSatisfied(const GURL& url) const;
+  bool IsPathRestrictionSatisfied(const GURL& url) const;
 
  private:
   WebBundleSource(Type type, const base::FilePath& file_path, const GURL& url);
diff --git a/chromium/content/browser/web_package/web_bundle_url_loader_factory.cc b/chromium/content/browser/web_package/web_bundle_url_loader_factory.cc
index 3f8529db4e7..2785564e8fb 100644
--- a/chromium/content/browser/web_package/web_bundle_url_loader_factory.cc
+++ b/chromium/content/browser/web_package/web_bundle_url_loader_factory.cc
@@ -12,6 +12,7 @@
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "content/browser/web_package/web_bundle_reader.h"
+#include "content/browser/web_package/web_bundle_source.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
@@ -110,9 +111,11 @@ class WebBundleURLLoaderFactory::EntryLoader final
 
  private:
   // network::mojom::URLLoader implementation
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override {}
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override {}
   void PauseReadingBodyFromNet() override {}
@@ -226,9 +229,7 @@ void WebBundleURLLoaderFactory::CreateLoaderAndStart(
     const network::ResourceRequest& resource_request,
     mojo::PendingRemote<network::mojom::URLLoaderClient> loader_client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
-  if (base::EqualsCaseInsensitiveASCII(resource_request.method,
-                                       net::HttpRequestHeaders::kGetMethod) &&
-      reader_->HasEntry(resource_request.url)) {
+  if (CanHandleRequest(resource_request)) {
     auto loader = std::make_unique<EntryLoader>(
         weak_factory_.GetWeakPtr(), std::move(loader_client), resource_request,
         frame_tree_node_id_);
@@ -251,4 +252,22 @@ void WebBundleURLLoaderFactory::Clone(
   receivers_.Add(this, std::move(receiver));
 }
 
+bool WebBundleURLLoaderFactory::CanHandleRequest(
+    const network::ResourceRequest& resource_request) const {
+  if (!base::EqualsCaseInsensitiveASCII(resource_request.method,
+                                        net::HttpRequestHeaders::kGetMethod)) {
+    return false;
+  }
+  if (reader_->source().is_network() &&
+      !reader_->source().IsPathRestrictionSatisfied(resource_request.url)) {
+    // For network served bundle, subresources are loaded from the bundle only
+    // when their URLs are inside the bundle's scope.
+    // https://github.com/WICG/webpackage/blob/master/explainers/navigation-to-unsigned-bundles.md#loading-an-authoritative-unsigned-bundle
+    // 'Subsequent subresource requests will also only be served from the bundle
+    // if they're inside its scope.'
+    return false;
+  }
+  return reader_->HasEntry(resource_request.url);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_url_loader_factory.h b/chromium/content/browser/web_package/web_bundle_url_loader_factory.h
index 92b1d615be9..d41e183a121 100644
--- a/chromium/content/browser/web_package/web_bundle_url_loader_factory.h
+++ b/chromium/content/browser/web_package/web_bundle_url_loader_factory.h
@@ -50,7 +50,8 @@ class CONTENT_EXPORT WebBundleURLLoaderFactory final
 
  private:
   class EntryLoader;
-  friend class EntryLoader;
+
+  bool CanHandleRequest(const network::ResourceRequest& resource_request) const;
 
   mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
   scoped_refptr<WebBundleReader> reader_;
diff --git a/chromium/content/browser/web_package/web_bundle_utils.cc b/chromium/content/browser/web_package/web_bundle_utils.cc
index 1404513ba81..42c75b865a5 100644
--- a/chromium/content/browser/web_package/web_bundle_utils.cc
+++ b/chromium/content/browser/web_package/web_bundle_utils.cc
@@ -7,7 +7,10 @@
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "build/build_config.h"
+#include "content/browser/web_package/web_bundle_url_loader_factory.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -26,6 +29,35 @@ const base::FilePath::CharType kWebBundleFileExtension[] =
 
 }  // namespace
 
+const net::NetworkTrafficAnnotationTag kTrafficAnnotation =
+    net::DefineNetworkTrafficAnnotation("web_bundle_loader",
+                                        R"(
+  semantics {
+    sender: "Web Bundle Loader"
+    description:
+      "Navigation request and subresource request inside a Web Bundle. "
+      "This does not trigger any network transaction directly, but "
+      "access to an entry in a local file, or in a previously fetched "
+      "resource over network."
+    trigger: "The user navigates to a Web Bundle."
+    data: "Nothing."
+    destination: LOCAL
+  }
+  policy {
+    cookies_allowed: NO
+    setting: "These requests cannot be disabled in settings."
+    policy_exception_justification:
+      "Not implemented. This request does not make any network transaction."
+  }
+  comments:
+    "Usually the request accesses an entry in a local file or a previously "
+    "fetched resource over network that contains multiple archived entries. "
+    "But once the feature is exposed to the public web API, the archive file "
+    "can be streamed over network. In such case, the streaming should be "
+    "provided by another URLLoader request that is issued by Blink, but based "
+    "on a user initiated navigation."
+  )");
+
 bool IsSupportedFileScheme(const GURL& url) {
   if (url.SchemeIsFile())
     return true;
@@ -96,5 +128,25 @@ GURL GetSynthesizedUrlForWebBundle(const GURL& web_bundle_file_url,
   return web_bundle_file_url.ReplaceComponents(replacements);
 }
 
+void CompleteWithInvalidWebBundleError(
+    mojo::Remote<network::mojom::URLLoaderClient> client,
+    int frame_tree_node_id,
+    const std::string& error_message) {
+  WebContents* web_contents =
+      WebContents::FromFrameTreeNodeId(frame_tree_node_id);
+  if (web_contents) {
+    web_contents->GetMainFrame()->AddMessageToConsole(
+        blink::mojom::ConsoleMessageLevel::kError, error_message);
+  }
+  std::move(client)->OnComplete(
+      network::URLLoaderCompletionStatus(net::ERR_INVALID_WEB_BUNDLE));
+}
+
+std::string GetMetadataParseErrorMessage(
+    const data_decoder::mojom::BundleMetadataParseErrorPtr& metadata_error) {
+  return std::string("Failed to read metadata of Web Bundle file: ") +
+         metadata_error->message;
+}
+
 }  // namespace web_bundle_utils
 }  // namespace content
diff --git a/chromium/content/browser/web_package/web_bundle_utils.h b/chromium/content/browser/web_package/web_bundle_utils.h
index 548470bba97..e43bb5ff39e 100644
--- a/chromium/content/browser/web_package/web_bundle_utils.h
+++ b/chromium/content/browser/web_package/web_bundle_utils.h
@@ -9,10 +9,20 @@
 
 #include "base/files/file_path.h"
 #include "content/common/content_export.h"
-
-class GURL;
+#include "mojo/public/cpp/bindings/remote.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/data_decoder/public/mojom/web_bundle_parser.mojom.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "url/gurl.h"
 
 namespace content {
+
+class WebBundleURLLoaderFactory;
+
+using WebBundleDoneCallback = base::OnceCallback<void(
+    const GURL& target_inner_url,
+    std::unique_ptr<WebBundleURLLoaderFactory> url_loader_factory)>;
+
 namespace web_bundle_utils {
 
 // The "application/webbundle" MIME type must have a "v" parameter whose value
@@ -33,6 +43,20 @@ namespace web_bundle_utils {
 constexpr char kWebBundleFileMimeTypeWithoutParameters[] =
     "application/webbundle";
 
+constexpr char kNoSniffErrorMessage[] =
+    "Web Bundle response must have \"X-Content-Type-Options: nosniff\" header.";
+
+extern const net::NetworkTrafficAnnotationTag kTrafficAnnotation;
+
+// Adds |error_message| to the console and calls OnComplete() of |client|.
+void CompleteWithInvalidWebBundleError(
+    mojo::Remote<network::mojom::URLLoaderClient> client,
+    int frame_tree_node_id,
+    const std::string& error_message);
+
+std::string GetMetadataParseErrorMessage(
+    const data_decoder::mojom::BundleMetadataParseErrorPtr& metadata_error);
+
 // On Android, returns true if the url scheme is file or content. On other
 // platforms, returns true if the url scheme is file.
 bool IsSupportedFileScheme(const GURL& url);
diff --git a/chromium/content/browser/webauth/authenticator_common.cc b/chromium/content/browser/webauth/authenticator_common.cc
index 1bb5ffb78ab..6a5570ccd99 100644
--- a/chromium/content/browser/webauth/authenticator_common.cc
+++ b/chromium/content/browser/webauth/authenticator_common.cc
@@ -10,9 +10,10 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/rand_util.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/utf_string_conversion_utils.h"
@@ -487,7 +488,7 @@ base::flat_set<device::FidoTransportProtocol> GetAvailableTransports(
 
   // FIXME(martinkr): Check whether this can be moved in front of the BLE
   // adapter enumeration logic in FidoRequestHandlerBase.
-  if (!device::BluetoothAdapterFactory::Get().IsLowEnergySupported()) {
+  if (!device::BluetoothAdapterFactory::Get()->IsLowEnergySupported()) {
     return transports;
   }
 
@@ -561,12 +562,14 @@ void AuthenticatorCommon::StartMakeCredentialRequest(
     }
   }
 
+  make_credential_options_->allow_skipping_pin_touch = allow_skipping_pin_touch;
+
   request_ = std::make_unique<device::MakeCredentialRequestHandler>(
       discovery_factory,
       GetAvailableTransports(render_frame_host_, request_delegate_.get(),
                              caller_origin_),
       *ctap_make_credential_request_, *authenticator_selection_criteria_,
-      allow_skipping_pin_touch,
+      *make_credential_options_,
       base::BindOnce(&AuthenticatorCommon::OnRegisterResponse,
                      weak_factory_.GetWeakPtr()));
 
@@ -582,10 +585,7 @@ void AuthenticatorCommon::StartMakeCredentialRequest(
           request_->GetWeakPtr()) /* request_callback */,
       base::BindRepeating(
           &device::FidoRequestHandlerBase::PowerOnBluetoothAdapter,
-          request_->GetWeakPtr()) /* bluetooth_adapter_power_on_callback */,
-      base::BindRepeating(
-          &device::FidoRequestHandlerBase::InitiatePairingWithDevice,
-          request_->GetWeakPtr()) /* ble_pairing_callback */);
+          request_->GetWeakPtr()) /* bluetooth_adapter_power_on_callback */);
   if (authenticator_selection_criteria_->require_resident_key()) {
     request_delegate_->SetMightCreateResidentCredential(true);
   }
@@ -647,10 +647,7 @@ void AuthenticatorCommon::StartGetAssertionRequest(
           request_->GetWeakPtr()) /* request_callback */,
       base::BindRepeating(
           &device::FidoRequestHandlerBase::PowerOnBluetoothAdapter,
-          request_->GetWeakPtr()) /* bluetooth_adapter_power_on_callback */,
-      base::BindRepeating(
-          &device::FidoRequestHandlerBase::InitiatePairingWithDevice,
-          request_->GetWeakPtr()) /* ble_pairing_callback*/);
+          request_->GetWeakPtr()) /* bluetooth_adapter_power_on_callback */);
 
   request_->set_observer(request_delegate_.get());
 }
@@ -684,8 +681,10 @@ void AuthenticatorCommon::MakeCredential(
 
   bool is_cross_origin;
   blink::mojom::AuthenticatorStatus status =
-      security_checker_->ValidateAncestorOrigins(caller_origin,
-                                                 &is_cross_origin);
+      security_checker_->ValidateAncestorOrigins(
+          caller_origin,
+          WebAuthRequestSecurityChecker::RequestType::kMakeCredential,
+          &is_cross_origin);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     InvokeCallbackAndCleanup(std::move(callback), status);
     return;
@@ -795,12 +794,31 @@ void AuthenticatorCommon::MakeCredential(
     return;
   }
 
-  if (options->protection_policy ==
-          blink::mojom::ProtectionPolicy::UNSPECIFIED &&
-      resident_key) {
-    // If not specified, UV_OR_CRED_ID_REQUIRED is made the default.
-    options->protection_policy =
-        blink::mojom::ProtectionPolicy::UV_OR_CRED_ID_REQUIRED;
+  base::Optional<device::CredProtectRequest> cred_protect_request;
+  switch (options->protection_policy) {
+    case blink::mojom::ProtectionPolicy::UNSPECIFIED:
+      if (resident_key) {
+        // If not specified, kUVOrCredIDRequired is made the default unless the
+        // authenticator defaults to something better.
+        cred_protect_request =
+            device::CredProtectRequest::kUVOrCredIDRequiredOrBetter;
+      }
+      break;
+    case blink::mojom::ProtectionPolicy::NONE:
+      cred_protect_request = device::CredProtectRequest::kUVOptional;
+      break;
+    case blink::mojom::ProtectionPolicy::UV_OR_CRED_ID_REQUIRED:
+      cred_protect_request = device::CredProtectRequest::kUVOrCredIDRequired;
+      break;
+    case blink::mojom::ProtectionPolicy::UV_REQUIRED:
+      cred_protect_request = device::CredProtectRequest::kUVRequired;
+      break;
+  }
+
+  make_credential_options_.emplace();
+  if (cred_protect_request) {
+    make_credential_options_->cred_protect_request.emplace(
+        *cred_protect_request, options->enforce_protection_policy);
   }
 
   DCHECK(make_credential_response_callback_.is_null());
@@ -853,7 +871,7 @@ void AuthenticatorCommon::MakeCredential(
     // NOTE: Because Android has no way of building a clientDataJSON for
     // cross-origin requests, we don't create the extension for those. This
     // problem will go away once we add clientDataHash inputs to Android.
-    ctap_make_credential_request_->android_client_data_ext.emplace(
+    make_credential_options_->android_client_data_ext.emplace(
         client_data::kCreateType, caller_origin_, options->challenge);
   }
 
@@ -869,21 +887,6 @@ void AuthenticatorCommon::MakeCredential(
   attestation_requested_ =
       attestation != ::device::AttestationConveyancePreference::kNone;
 
-  switch (options->protection_policy) {
-    case blink::mojom::ProtectionPolicy::UNSPECIFIED:
-    case blink::mojom::ProtectionPolicy::NONE:
-      break;
-    case blink::mojom::ProtectionPolicy::UV_OR_CRED_ID_REQUIRED:
-      ctap_make_credential_request_->cred_protect =
-          std::make_pair(device::CredProtect::kUVOrCredIDRequired,
-                         options->enforce_protection_policy);
-      break;
-    case blink::mojom::ProtectionPolicy::UV_REQUIRED:
-      ctap_make_credential_request_->cred_protect = std::make_pair(
-          device::CredProtect::kUVRequired, options->enforce_protection_policy);
-      break;
-  }
-
   StartMakeCredentialRequest(/*allow_skipping_pin_touch=*/true);
 }
 
@@ -911,8 +914,10 @@ void AuthenticatorCommon::GetAssertion(
 
   bool is_cross_origin;
   blink::mojom::AuthenticatorStatus status =
-      security_checker_->ValidateAncestorOrigins(caller_origin,
-                                                 &is_cross_origin);
+      security_checker_->ValidateAncestorOrigins(
+          caller_origin,
+          WebAuthRequestSecurityChecker::RequestType::kGetAssertion,
+          &is_cross_origin);
   if (status != blink::mojom::AuthenticatorStatus::SUCCESS) {
     InvokeCallbackAndCleanup(std::move(callback), status);
     return;
@@ -1480,6 +1485,8 @@ void AuthenticatorCommon::Cleanup() {
 
   timer_->Stop();
   request_.reset();
+  ctap_make_credential_request_.reset();
+  make_credential_options_.reset();
   request_delegate_.reset();
   make_credential_response_callback_.Reset();
   get_assertion_response_callback_.Reset();
diff --git a/chromium/content/browser/webauth/authenticator_common.h b/chromium/content/browser/webauth/authenticator_common.h
index 2935a574b89..a15c113669c 100644
--- a/chromium/content/browser/webauth/authenticator_common.h
+++ b/chromium/content/browser/webauth/authenticator_common.h
@@ -27,6 +27,7 @@
 #include "device/fido/ctap_make_credential_request.h"
 #include "device/fido/fido_constants.h"
 #include "device/fido/fido_transport_protocol.h"
+#include "device/fido/make_credential_request_handler.h"
 #include "third_party/blink/public/mojom/webauthn/authenticator.mojom.h"
 #include "url/origin.h"
 
@@ -188,6 +189,8 @@ class CONTENT_EXPORT AuthenticatorCommon {
   base::Optional<std::string> app_id_;
   base::Optional<device::CtapMakeCredentialRequest>
       ctap_make_credential_request_;
+  base::Optional<device::MakeCredentialRequestHandler::Options>
+      make_credential_options_;
   base::Optional<device::CtapGetAssertionRequest> ctap_get_assertion_request_;
   // awaiting_attestation_response_ is true if the embedder has been queried
   // about an attestsation decision and the response is still pending.
diff --git a/chromium/content/browser/webauth/authenticator_environment_impl.cc b/chromium/content/browser/webauth/authenticator_environment_impl.cc
index 31097df4c40..24a093b735e 100644
--- a/chromium/content/browser/webauth/authenticator_environment_impl.cc
+++ b/chromium/content/browser/webauth/authenticator_environment_impl.cc
@@ -64,7 +64,7 @@ VirtualFidoDiscoveryFactory* AuthenticatorEnvironmentImpl::GetVirtualFactoryFor(
     if (base::Contains(virtual_discovery_factories_, node)) {
       return virtual_discovery_factories_[node].get();
     }
-  } while ((node = node->parent()));
+  } while ((node = FrameTreeNode::From(node->parent())));
   return nullptr;
 }
 
diff --git a/chromium/content/browser/webauth/authenticator_impl_unittest.cc b/chromium/content/browser/webauth/authenticator_impl_unittest.cc
index 80520d63f8f..ed897583fce 100644
--- a/chromium/content/browser/webauth/authenticator_impl_unittest.cc
+++ b/chromium/content/browser/webauth/authenticator_impl_unittest.cc
@@ -52,6 +52,7 @@
 #include "device/fido/fido_test_data.h"
 #include "device/fido/hid/fake_hid_impl_for_testing.h"
 #include "device/fido/mock_fido_device.h"
+#include "device/fido/public_key.h"
 #include "device/fido/test_callback_receiver.h"
 #include "device/fido/virtual_fido_device_factory.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
@@ -534,7 +535,7 @@ class AuthenticatorImplTest : public AuthenticatorTestBase {
   base::Optional<base::test::ScopedFeatureList> scoped_feature_list_;
   std::unique_ptr<device::BluetoothAdapterFactory::GlobalValuesForTesting>
       bluetooth_global_values_ =
-          device::BluetoothAdapterFactory::Get().InitGlobalValuesForTesting();
+          device::BluetoothAdapterFactory::Get()->InitGlobalValuesForTesting();
   scoped_refptr<::testing::NiceMock<device::MockBluetoothAdapter>>
       mock_adapter_ = base::MakeRefCounted<
           ::testing::NiceMock<device::MockBluetoothAdapter>>();
@@ -915,6 +916,39 @@ TEST_F(AuthenticatorImplTest, TestMakeCredentialTimeout) {
   EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR, callback_receiver.status());
 }
 
+TEST_F(AuthenticatorImplTest, TestMakeCredentialRSA) {
+  virtual_device_factory_->SetSupportedProtocol(
+      device::ProtocolVersion::kCtap2);
+  SimulateNavigation(GURL(kTestOrigin1));
+
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+  PublicKeyCredentialCreationOptionsPtr options =
+      GetTestPublicKeyCredentialCreationOptions();
+  options->public_key_parameters = GetTestPublicKeyCredentialParameters(
+      static_cast<int32_t>(device::CoseAlgorithmIdentifier::kCoseRs256));
+  TestMakeCredentialCallback callback;
+  authenticator->MakeCredential(std::move(options), callback.callback());
+  base::RunLoop().RunUntilIdle();
+  callback.WaitForCallback();
+
+  ASSERT_EQ(callback.status(), AuthenticatorStatus::SUCCESS);
+
+  base::Optional<Value> attestation_value =
+      Reader::Read(callback.value()->attestation_object);
+  ASSERT_TRUE(attestation_value);
+  ASSERT_TRUE(attestation_value->is_map());
+  const auto& attestation = attestation_value->GetMap();
+
+  const auto auth_data_it = attestation.find(Value("authData"));
+  ASSERT_TRUE(auth_data_it != attestation.end());
+  ASSERT_TRUE(auth_data_it->second.is_bytestring());
+  auto auth_data = device::AuthenticatorData::DecodeAuthenticatorData(
+      auth_data_it->second.GetBytestring());
+  EXPECT_EQ(static_cast<int32_t>(device::CoseAlgorithmIdentifier::kCoseRs256),
+            auth_data->attested_data()->public_key()->algorithm());
+}
+
 // Verify behavior for various combinations of origins and RP IDs.
 TEST_F(AuthenticatorImplTest, GetAssertionOriginAndRpIds) {
   // These instances should return security errors (for circumstances
@@ -1894,9 +1928,7 @@ class TestAuthenticatorRequestDelegate
       base::OnceClosure cancel_callback,
       base::RepeatingClosure start_over_callback,
       device::FidoRequestHandlerBase::RequestCallback request_callback,
-      base::RepeatingClosure bluetooth_adapter_power_on_callback,
-      device::FidoRequestHandlerBase::BlePairingCallback ble_pairing_callback)
-      override {
+      base::RepeatingClosure bluetooth_adapter_power_on_callback) override {
     ASSERT_TRUE(action_callbacks_registered_callback_)
         << "RegisterActionCallbacks called twice.";
     cancel_callback_.emplace(std::move(cancel_callback));
@@ -2876,7 +2908,7 @@ TEST_F(AuthenticatorImplRequestDelegateTest,
 
   auto discovery_factory =
       std::make_unique<device::test::FakeFidoDiscoveryFactory>();
-  auto* fake_ble_discovery = discovery_factory->ForgeNextBleDiscovery();
+  auto* fake_hid_discovery = discovery_factory->ForgeNextHidDiscovery();
   AuthenticatorEnvironmentImpl::GetInstance()
       ->ReplaceDefaultDiscoveryFactoryForTesting(std::move(discovery_factory));
 
@@ -2893,33 +2925,33 @@ TEST_F(AuthenticatorImplRequestDelegateTest,
   auto authenticator = ConstructFakeAuthenticatorWithTimer(
       std::move(mock_delegate), task_runner);
 
-  auto mock_ble_device = device::MockFidoDevice::MakeCtap();
-  mock_ble_device->StubGetId();
-  mock_ble_device->SetDeviceTransport(
-      device::FidoTransportProtocol::kBluetoothLowEnergy);
-  const auto device_id = mock_ble_device->GetId();
+  auto mock_usb_device = device::MockFidoDevice::MakeCtap();
+  mock_usb_device->StubGetId();
+  mock_usb_device->SetDeviceTransport(
+      device::FidoTransportProtocol::kUsbHumanInterfaceDevice);
+  const auto device_id = mock_usb_device->GetId();
 
   EXPECT_CALL(*mock_delegate_ptr, OnTransportAvailabilityEnumerated(_));
   EXPECT_CALL(*mock_delegate_ptr, EmbedderControlsAuthenticatorDispatch(_))
       .WillOnce(testing::Return(true));
 
-  base::RunLoop ble_device_found_done;
+  base::RunLoop usb_device_found_done;
   EXPECT_CALL(*mock_delegate_ptr, FidoAuthenticatorAdded(_))
       .WillOnce(testing::InvokeWithoutArgs(
-          [&ble_device_found_done]() { ble_device_found_done.Quit(); }));
+          [&usb_device_found_done]() { usb_device_found_done.Quit(); }));
 
-  base::RunLoop ble_device_lost_done;
+  base::RunLoop usb_device_lost_done;
   EXPECT_CALL(*mock_delegate_ptr, FidoAuthenticatorRemoved(_))
       .WillOnce(testing::InvokeWithoutArgs(
-          [&ble_device_lost_done]() { ble_device_lost_done.Quit(); }));
+          [&usb_device_lost_done]() { usb_device_lost_done.Quit(); }));
 
   authenticator->GetAssertion(std::move(options), callback_receiver.callback());
-  fake_ble_discovery->WaitForCallToStartAndSimulateSuccess();
-  fake_ble_discovery->AddDevice(std::move(mock_ble_device));
-  ble_device_found_done.Run();
+  fake_hid_discovery->WaitForCallToStartAndSimulateSuccess();
+  fake_hid_discovery->AddDevice(std::move(mock_usb_device));
+  usb_device_found_done.Run();
 
-  fake_ble_discovery->RemoveDevice(device_id);
-  ble_device_lost_done.Run();
+  fake_hid_discovery->RemoveDevice(device_id);
+  usb_device_lost_done.Run();
   base::RunLoop().RunUntilIdle();
 }
 
@@ -3295,6 +3327,100 @@ TEST_F(AuthenticatorImplTest, NoUnexpectedAuthenticatorExtensions) {
             AuthenticatorStatus::NOT_ALLOWED_ERROR);
 }
 
+TEST_F(AuthenticatorImplTest, NoUnexpectedClientExtensions) {
+  NavigateAndCommit(GURL(kTestOrigin1));
+
+  device::VirtualCtap2Device::Config config;
+  config.reject_all_extensions = true;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  // Check that no unexpected client extensions are sent to the authenticator.
+  TestMakeCredentialCallback create_callback;
+  authenticator->MakeCredential(GetTestPublicKeyCredentialCreationOptions(),
+                                create_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  create_callback.WaitForCallback();
+  EXPECT_EQ(create_callback.status(), AuthenticatorStatus::SUCCESS);
+
+  // No extensions should be sent when getting an assertion either.
+  PublicKeyCredentialRequestOptionsPtr assertion_options =
+      GetTestPublicKeyCredentialRequestOptions();
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      assertion_options->allow_credentials.back().id(), kTestRelyingPartyId));
+  TestGetAssertionCallback assertion_callback;
+  authenticator->GetAssertion(std::move(assertion_options),
+                              assertion_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  assertion_callback.WaitForCallback();
+  EXPECT_EQ(assertion_callback.status(), AuthenticatorStatus::SUCCESS);
+}
+
+TEST_F(AuthenticatorImplTest, AndroidClientDataExtension) {
+  EnableFeature(device::kWebAuthPhoneSupport);
+  NavigateAndCommit(GURL(kTestOrigin1));
+
+  device::VirtualCtap2Device::Config config;
+  config.support_android_client_data_extension = true;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  TestMakeCredentialCallback create_callback;
+  authenticator->MakeCredential(GetTestPublicKeyCredentialCreationOptions(),
+                                create_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  create_callback.WaitForCallback();
+  EXPECT_EQ(create_callback.status(), AuthenticatorStatus::SUCCESS);
+
+  PublicKeyCredentialRequestOptionsPtr assertion_options =
+      GetTestPublicKeyCredentialRequestOptions();
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      assertion_options->allow_credentials.back().id(), kTestRelyingPartyId));
+  TestGetAssertionCallback assertion_callback;
+  authenticator->GetAssertion(std::move(assertion_options),
+                              assertion_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  assertion_callback.WaitForCallback();
+  EXPECT_EQ(assertion_callback.status(), AuthenticatorStatus::SUCCESS);
+}
+
+TEST_F(AuthenticatorImplTest, UnsolicitedAndroidClientDataExtensionReponse) {
+  EnableFeature(device::kWebAuthPhoneSupport);
+  NavigateAndCommit(GURL(kTestOrigin1));
+
+  device::VirtualCtap2Device::Config config;
+  config.send_unsolicited_android_client_data_extension = true;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  // An unsolicited androidClientData extension response results in an error.
+  TestMakeCredentialCallback create_callback;
+  authenticator->MakeCredential(GetTestPublicKeyCredentialCreationOptions(),
+                                create_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  create_callback.WaitForCallback();
+  EXPECT_EQ(create_callback.status(), AuthenticatorStatus::NOT_ALLOWED_ERROR);
+
+  // The same goes for getAssertion.
+  PublicKeyCredentialRequestOptionsPtr assertion_options =
+      GetTestPublicKeyCredentialRequestOptions();
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      assertion_options->allow_credentials.back().id(), kTestRelyingPartyId));
+  TestGetAssertionCallback assertion_callback;
+  authenticator->GetAssertion(std::move(assertion_options),
+                              assertion_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  assertion_callback.WaitForCallback();
+  EXPECT_EQ(assertion_callback.status(),
+            AuthenticatorStatus::NOT_ALLOWED_ERROR);
+}
+
 // Tests that on an authenticator that supports batching, exclude lists that fit
 // into a single batch are sent without probing.
 TEST_F(AuthenticatorImplTest, ExcludeListBatching) {
@@ -3347,9 +3473,14 @@ static constexpr char kTestPIN[] = "1234";
 class UVTestAuthenticatorClientDelegate
     : public AuthenticatorRequestClientDelegate {
  public:
-  explicit UVTestAuthenticatorClientDelegate(bool* collected_pin)
-      : collected_pin_(collected_pin) {
+  explicit UVTestAuthenticatorClientDelegate(bool* collected_pin,
+                                             bool* did_bio_enrollment,
+                                             bool cancel_bio_enrollment)
+      : collected_pin_(collected_pin),
+        did_bio_enrollment_(did_bio_enrollment),
+        cancel_bio_enrollment_(cancel_bio_enrollment) {
     *collected_pin_ = false;
+    *did_bio_enrollment_ = false;
   }
 
   bool SupportsPIN() const override { return true; }
@@ -3362,10 +3493,30 @@ class UVTestAuthenticatorClientDelegate
         FROM_HERE, base::BindOnce(std::move(provide_pin_cb), kTestPIN));
   }
 
+  void StartBioEnrollment(base::OnceClosure next_callback) override {
+    *did_bio_enrollment_ = true;
+    if (cancel_bio_enrollment_) {
+      base::SequencedTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, std::move(next_callback));
+      return;
+    }
+    bio_callback_ = std::move(next_callback);
+  }
+
+  void OnSampleCollected(int remaining_samples) override {
+    if (remaining_samples <= 0) {
+      base::SequencedTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, std::move(bio_callback_));
+    }
+  }
+
   void FinishCollectToken() override {}
 
  private:
   bool* collected_pin_;
+  base::OnceClosure bio_callback_;
+  bool* did_bio_enrollment_;
+  bool cancel_bio_enrollment_;
 };
 
 class UVTestAuthenticatorContentBrowserClient : public ContentBrowserClient {
@@ -3373,13 +3524,22 @@ class UVTestAuthenticatorContentBrowserClient : public ContentBrowserClient {
   std::unique_ptr<AuthenticatorRequestClientDelegate>
   GetWebAuthenticationRequestDelegate(
       RenderFrameHost* render_frame_host) override {
-    return std::make_unique<UVTestAuthenticatorClientDelegate>(&collected_pin_);
+    return std::make_unique<UVTestAuthenticatorClientDelegate>(
+        &collected_pin_, &did_bio_enrollment_, cancel_bio_enrollment_);
   }
 
   bool collected_pin() { return collected_pin_; }
 
+  bool did_bio_enrollment() { return did_bio_enrollment_; }
+
+  void set_cancel_bio_enrollment(bool cancel_bio_enrollment) {
+    cancel_bio_enrollment_ = cancel_bio_enrollment;
+  }
+
  private:
   bool collected_pin_;
+  bool did_bio_enrollment_;
+  bool cancel_bio_enrollment_ = false;
 };
 
 class UVAuthenticatorImplTest : public AuthenticatorImplTest {
@@ -4013,6 +4173,71 @@ TEST_F(InternalUVAuthenticatorImplTest, MakeCredentialCryptotoken) {
   }
 }
 
+// Test making a credential on an authenticator that supports biometric
+// enrollment but has no fingerprints enrolled.
+TEST_F(InternalUVAuthenticatorImplTest, MakeCredentialInlineBioEnrollment) {
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  device::VirtualCtap2Device::Config config;
+  config.internal_uv_support = true;
+  config.pin_support = true;
+  config.user_verification_succeeds = true;
+  config.bio_enrollment_support = true;
+  virtual_device_factory_->mutable_state()->pin = kTestPIN;
+  virtual_device_factory_->mutable_state()->pin_retries =
+      device::kMaxPinRetries;
+  virtual_device_factory_->mutable_state()->fingerprints_enrolled = false;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  auto options =
+      make_credential_options(device::UserVerificationRequirement::kRequired);
+
+  TestMakeCredentialCallback callback_receiver;
+  authenticator->MakeCredential(std::move(options),
+                                callback_receiver.callback());
+  callback_receiver.WaitForCallback();
+
+  EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
+  EXPECT_TRUE(HasUV(callback_receiver));
+  EXPECT_TRUE(test_client_.collected_pin());
+  EXPECT_TRUE(test_client_.did_bio_enrollment());
+  EXPECT_TRUE(virtual_device_factory_->mutable_state()->fingerprints_enrolled);
+}
+
+// Test making a credential skipping biometric enrollment during credential
+// creation.
+TEST_F(InternalUVAuthenticatorImplTest, MakeCredentialSkipInlineBioEnrollment) {
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+  test_client_.set_cancel_bio_enrollment(true);
+
+  device::VirtualCtap2Device::Config config;
+  config.internal_uv_support = true;
+  config.pin_support = true;
+  config.user_verification_succeeds = true;
+  config.bio_enrollment_support = true;
+  virtual_device_factory_->mutable_state()->pin = kTestPIN;
+  virtual_device_factory_->mutable_state()->pin_retries =
+      device::kMaxPinRetries;
+  virtual_device_factory_->mutable_state()->fingerprints_enrolled = false;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  auto options =
+      make_credential_options(device::UserVerificationRequirement::kRequired);
+
+  TestMakeCredentialCallback callback_receiver;
+  authenticator->MakeCredential(std::move(options),
+                                callback_receiver.callback());
+  callback_receiver.WaitForCallback();
+
+  EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
+  EXPECT_TRUE(HasUV(callback_receiver));
+  EXPECT_TRUE(test_client_.collected_pin());
+  EXPECT_TRUE(test_client_.did_bio_enrollment());
+  EXPECT_FALSE(virtual_device_factory_->mutable_state()->fingerprints_enrolled);
+}
+
 TEST_F(InternalUVAuthenticatorImplTest, GetAssertion) {
   mojo::Remote<blink::mojom::Authenticator> authenticator =
       ConnectToAuthenticator();
@@ -4238,6 +4463,35 @@ TEST_F(UVTokenAuthenticatorImplTest, GetAssertionFallBackToPin) {
   EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
 }
 
+// Tests that a device supporting UV token with UV blocked at the start of a get
+// assertion request gets a touch and then falls back to PIN.
+TEST_F(UVTokenAuthenticatorImplTest, GetAssertionUvBlockedFallBackToPin) {
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+  device::VirtualCtap2Device::Config config;
+  config.internal_uv_support = true;
+  config.uv_token_support = true;
+  config.user_verification_succeeds = false;
+  config.pin_support = true;
+
+  virtual_device_factory_->SetCtap2Config(config);
+  virtual_device_factory_->mutable_state()->uv_retries = 0;
+  virtual_device_factory_->mutable_state()->fingerprints_enrolled = true;
+  virtual_device_factory_->mutable_state()->pin = kTestPIN;
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      get_credential_options()->allow_credentials[0].id(),
+      kTestRelyingPartyId));
+
+  auto options = get_credential_options();
+  TestGetAssertionCallback callback_receiver;
+  authenticator->GetAssertion(std::move(options), callback_receiver.callback());
+  callback_receiver.WaitForCallback();
+
+  EXPECT_TRUE(test_client_.collected_pin());
+  EXPECT_EQ(5, virtual_device_factory_->mutable_state()->uv_retries);
+  EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
+}
+
 TEST_F(UVTokenAuthenticatorImplTest, MakeCredentialUVToken) {
   mojo::Remote<blink::mojom::Authenticator> authenticator =
       ConnectToAuthenticator();
@@ -4351,6 +4605,36 @@ TEST_F(UVTokenAuthenticatorImplTest, MakeCredentialFallBackToPin) {
   EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
 }
 
+// Tests that a device supporting UV token with UV blocked at the start of a get
+// assertion request gets a touch and then falls back to PIN.
+TEST_F(UVTokenAuthenticatorImplTest, MakeCredentialUvBlockedFallBackToPin) {
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+  device::VirtualCtap2Device::Config config;
+  config.internal_uv_support = true;
+  config.uv_token_support = true;
+  config.user_verification_succeeds = false;
+  config.pin_support = true;
+
+  virtual_device_factory_->SetCtap2Config(config);
+  virtual_device_factory_->mutable_state()->uv_retries = 0;
+  virtual_device_factory_->mutable_state()->fingerprints_enrolled = true;
+  virtual_device_factory_->mutable_state()->pin = kTestPIN;
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      get_credential_options()->allow_credentials[0].id(),
+      kTestRelyingPartyId));
+
+  auto options = make_credential_options();
+  TestMakeCredentialCallback callback_receiver;
+  authenticator->MakeCredential(std::move(options),
+                                callback_receiver.callback());
+  callback_receiver.WaitForCallback();
+
+  EXPECT_TRUE(test_client_.collected_pin());
+  EXPECT_EQ(5, virtual_device_factory_->mutable_state()->uv_retries);
+  EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
+}
+
 // ResidentKeyTestAuthenticatorRequestDelegate is a delegate that:
 //   a) always returns |kTestPIN| when asked for a PIN.
 //   b) sorts potential resident-key accounts by user ID, maps them to a string
@@ -4665,6 +4949,17 @@ static const char* ProtectionPolicyDescription(
   }
 }
 
+static const char* CredProtectDescription(device::CredProtect cred_protect) {
+  switch (cred_protect) {
+    case device::CredProtect::kUVOptional:
+      return "UV optional";
+    case device::CredProtect::kUVOrCredIDRequired:
+      return "UV or cred ID required";
+    case device::CredProtect::kUVRequired:
+      return "UV required";
+  }
+}
+
 TEST_F(ResidentKeyAuthenticatorImplTest, CredProtectRegistration) {
   mojo::Remote<blink::mojom::Authenticator> authenticator =
       ConnectToAuthenticator();
@@ -4767,7 +5062,7 @@ TEST_F(ResidentKeyAuthenticatorImplTest, CredProtectRegistration) {
         EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
         ASSERT_EQ(
             1u, virtual_device_factory_->mutable_state()->registrations.size());
-        const base::Optional<device::CredProtect> result =
+        const device::CredProtect result =
             virtual_device_factory_->mutable_state()
                 ->registrations.begin()
                 ->second.protection;
@@ -4777,15 +5072,13 @@ TEST_F(ResidentKeyAuthenticatorImplTest, CredProtectRegistration) {
             NOTREACHED();
             break;
           case NONE:
-            EXPECT_FALSE(result);
+            EXPECT_EQ(device::CredProtect::kUVOptional, result);
             break;
           case UV_OR_CRED:
-            ASSERT_TRUE(result);
-            EXPECT_EQ(device::CredProtect::kUVOrCredIDRequired, *result);
+            EXPECT_EQ(device::CredProtect::kUVOrCredIDRequired, result);
             break;
           case UV_REQ:
-            ASSERT_TRUE(result);
-            EXPECT_EQ(device::CredProtect::kUVRequired, *result);
+            EXPECT_EQ(device::CredProtect::kUVRequired, result);
             break;
         }
         break;
@@ -4817,7 +5110,7 @@ TEST_F(ResidentKeyAuthenticatorImplTest, AuthenticatorSetsCredProtect) {
       blink::mojom::ProtectionPolicy::UV_REQUIRED,
   };
   constexpr device::CredProtect kDeviceLevels[] = {
-      device::CredProtect::kUVOrCredIDRequired,  // dummy entry.
+      device::CredProtect::kUVOptional,
       device::CredProtect::kUVOrCredIDRequired,
       device::CredProtect::kUVRequired,
   };
@@ -4863,6 +5156,95 @@ TEST_F(ResidentKeyAuthenticatorImplTest, AuthenticatorSetsCredProtect) {
   }
 }
 
+TEST_F(ResidentKeyAuthenticatorImplTest, AuthenticatorDefaultCredProtect) {
+  // Some authenticators may have a default credProtect level that isn't
+  // kUVOptional. This has complex interactions that are tested here.
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  constexpr struct {
+    blink::mojom::ProtectionPolicy requested_level;
+    device::CredProtect authenticator_default;
+    device::CredProtect result;
+  } kExpectations[] = {
+      // Standard case: normal authenticator and nothing specified. Chrome sets
+      // a default of kUVOrCredIDRequired for discoverable credentials.
+      {
+          blink::mojom::ProtectionPolicy::UNSPECIFIED,
+          device::CredProtect::kUVOptional,
+          device::CredProtect::kUVOrCredIDRequired,
+      },
+      // Chrome's default of |kUVOrCredIDRequired| should not prevent a site
+      // from requesting |kUVRequired| from a normal authenticator.
+      {
+          blink::mojom::ProtectionPolicy::UV_REQUIRED,
+          device::CredProtect::kUVOptional,
+          device::CredProtect::kUVRequired,
+      },
+      // Authenticator has a non-standard default, which should work fine.
+      {
+          blink::mojom::ProtectionPolicy::UNSPECIFIED,
+          device::CredProtect::kUVOrCredIDRequired,
+          device::CredProtect::kUVOrCredIDRequired,
+      },
+      // Authenticators can have a default of kUVRequired, but Chrome has a
+      // default of kUVOrCredIDRequired for discoverable credentials. We should
+      // not get a lesser protection level because of that.
+      {
+          blink::mojom::ProtectionPolicy::UNSPECIFIED,
+          device::CredProtect::kUVRequired,
+          device::CredProtect::kUVRequired,
+      },
+      // Site should be able to explicitly set credProtect kUVOptional despite
+      // an authenticator default.
+      {
+          blink::mojom::ProtectionPolicy::NONE,
+          device::CredProtect::kUVOrCredIDRequired,
+          device::CredProtect::kUVOptional,
+      },
+  };
+
+  device::VirtualCtap2Device::Config config;
+  config.pin_support = true;
+  config.resident_key_support = true;
+  config.cred_protect_support = true;
+
+  for (const auto& test : kExpectations) {
+    config.default_cred_protect = test.authenticator_default;
+    virtual_device_factory_->SetCtap2Config(config);
+    virtual_device_factory_->mutable_state()->registrations.clear();
+
+    SCOPED_TRACE(::testing::Message()
+                 << "result=" << CredProtectDescription(test.result));
+    SCOPED_TRACE(::testing::Message()
+                 << "default="
+                 << CredProtectDescription(test.authenticator_default));
+    SCOPED_TRACE(::testing::Message()
+                 << "request="
+                 << ProtectionPolicyDescription(test.requested_level));
+
+    PublicKeyCredentialCreationOptionsPtr options = make_credential_options();
+    options->authenticator_selection->SetRequireResidentKeyForTesting(true);
+    options->protection_policy = test.requested_level;
+    options->authenticator_selection->SetUserVerificationRequirementForTesting(
+        device::UserVerificationRequirement::kRequired);
+
+    TestMakeCredentialCallback callback_receiver;
+    authenticator->MakeCredential(std::move(options),
+                                  callback_receiver.callback());
+    callback_receiver.WaitForCallback();
+
+    EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
+    ASSERT_EQ(1u,
+              virtual_device_factory_->mutable_state()->registrations.size());
+    const device::CredProtect result = virtual_device_factory_->mutable_state()
+                                           ->registrations.begin()
+                                           ->second.protection;
+
+    EXPECT_EQ(result, test.result) << CredProtectDescription(result);
+  }
+}
+
 TEST_F(ResidentKeyAuthenticatorImplTest, ProtectedNonResidentCreds) {
   // Until we have UVToken, there's a danger that we'll preflight UV-required
   // credential IDs such that the authenticator denies knowledge of all of them
diff --git a/chromium/content/browser/webauth/virtual_authenticator.cc b/chromium/content/browser/webauth/virtual_authenticator.cc
index 167d8270ce0..97fc8b3f5d0 100644
--- a/chromium/content/browser/webauth/virtual_authenticator.cc
+++ b/chromium/content/browser/webauth/virtual_authenticator.cc
@@ -48,16 +48,17 @@ bool VirtualAuthenticator::AddRegistration(
     const std::string& rp_id,
     const std::vector<uint8_t>& private_key,
     int32_t counter) {
-  auto ec_private_key =
-      crypto::ECPrivateKey::CreateFromPrivateKeyInfo(private_key);
-  if (!ec_private_key)
+  base::Optional<std::unique_ptr<device::VirtualFidoDevice::PrivateKey>>
+      fido_private_key =
+          device::VirtualFidoDevice::PrivateKey::FromPKCS8(private_key);
+  if (!fido_private_key)
     return false;
 
   return state_->registrations
       .emplace(
           std::move(key_handle),
           ::device::VirtualFidoDevice::RegistrationData(
-              std::move(ec_private_key),
+              std::move(*fido_private_key),
               ::device::fido_parsing_utils::CreateSHA256Hash(rp_id), counter))
       .second;
 }
@@ -68,16 +69,17 @@ bool VirtualAuthenticator::AddResidentRegistration(
     const std::vector<uint8_t>& private_key,
     int32_t counter,
     std::vector<uint8_t> user_handle) {
-  auto ec_private_key =
-      crypto::ECPrivateKey::CreateFromPrivateKeyInfo(private_key);
-  if (!ec_private_key)
+  base::Optional<std::unique_ptr<device::VirtualFidoDevice::PrivateKey>>
+      fido_private_key =
+          device::VirtualFidoDevice::PrivateKey::FromPKCS8(private_key);
+  if (!fido_private_key)
     return false;
 
   return state_->InjectResidentKey(
       std::move(key_handle),
       device::PublicKeyCredentialRpEntity(std::move(rp_id)),
       device::PublicKeyCredentialUserEntity(std::move(user_handle)), counter,
-      std::move(ec_private_key));
+      std::move(*fido_private_key));
 }
 
 void VirtualAuthenticator::ClearRegistrations() {
@@ -129,8 +131,8 @@ void VirtualAuthenticator::GetRegistrations(GetRegistrationsCallback callback) {
     mojo_registered_key->counter = registration.second.counter;
     mojo_registered_key->rp_id =
         registration.second.rp ? registration.second.rp->id : "";
-    registration.second.private_key->ExportPrivateKey(
-        &mojo_registered_key->private_key);
+    mojo_registered_key->private_key =
+        registration.second.private_key->GetPKCS8PrivateKey();
     mojo_registered_keys.push_back(std::move(mojo_registered_key));
   }
   std::move(callback).Run(std::move(mojo_registered_keys));
diff --git a/chromium/content/browser/webauth/virtual_discovery.cc b/chromium/content/browser/webauth/virtual_discovery.cc
index c0642aba546..788607c2606 100644
--- a/chromium/content/browser/webauth/virtual_discovery.cc
+++ b/chromium/content/browser/webauth/virtual_discovery.cc
@@ -8,8 +8,8 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/webauth/authenticator_environment_impl.h"
 #include "device/fido/fido_device.h"
diff --git a/chromium/content/browser/webauth/webauth_browsertest.cc b/chromium/content/browser/webauth/webauth_browsertest.cc
index eb889394a39..e75e4ec190c 100644
--- a/chromium/content/browser/webauth/webauth_browsertest.cc
+++ b/chromium/content/browser/webauth/webauth_browsertest.cc
@@ -28,8 +28,8 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/back_forward_cache_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -83,7 +83,8 @@ constexpr char kPublicKeyErrorMessage[] =
 
 constexpr char kNotAllowedErrorMessage[] =
     "webauth: NotAllowedError: The operation either timed out or was not "
-    "allowed. See: https://w3c.github.io/webauthn/#sec-assertion-privacy.";
+    "allowed. See: "
+    "https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.";
 
 #if defined(OS_WIN)
 constexpr char kInvalidStateErrorMessage[] =
@@ -109,11 +110,17 @@ constexpr char kRelyingPartyRpIconUrlSecurityErrorMessage[] =
 constexpr char kAbortErrorMessage[] =
     "webauth: AbortError: Request has been aborted.";
 
-constexpr char kFeatureMissingMessage[] =
-    "webauth: NotAllowedError: The 'publickey-credentials' feature is not "
-    "enabled in this document. Feature Policy may be used to delegate Web "
+constexpr char kGetFeaturePolicyMissingMessage[] =
+    "webauth: NotAllowedError: The 'publickey-credentials-get' feature is "
+    "not enabled in this document. Feature Policy may be used to delegate Web "
     "Authentication capabilities to cross-origin child frames.";
 
+constexpr char kCrossOriginAncestorMessage[] =
+    "webauth: NotAllowedError: The following credential operations can only "
+    "occur in a document which is same-origin with all of its ancestors: "
+    "storage/retrieval of 'PasswordCredential' and 'FederatedCredential', "
+    "storage of 'PublicKeyCredential'.";
+
 // Templates to be used with base::ReplaceStringPlaceholders. Can be
 // modified to include up to 9 replacements. The default values for
 // any additional replacements added should also be added to the
@@ -789,7 +796,7 @@ class WebAuthJavascriptClientBrowserTest : public WebAuthBrowserTestBase {
 
  protected:
   std::vector<base::Feature> GetFeaturesToEnable() override {
-    return {device::kWebAuthFeaturePolicy};
+    return {device::kWebAuthGetAssertionFeaturePolicy};
   }
 
  private:
@@ -1170,7 +1177,7 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
       // XO |Create|Get  | Allow
       {false, true, true, ""},
       {true, false, false, ""},
-      {true, true, true, "publickey-credentials"},
+      {true, false, true, "publickey-credentials-get"},
   };
 
   for (const auto& test : kTestCases) {
@@ -1210,7 +1217,7 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
     if (test.create_should_work) {
       EXPECT_EQ(std::string(kOkMessage), result);
     } else {
-      EXPECT_EQ(kFeatureMissingMessage, result);
+      EXPECT_EQ(kCrossOriginAncestorMessage, result);
     }
 
     const int credential_id =
@@ -1228,7 +1235,7 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
     if (test.get_should_work) {
       EXPECT_EQ(std::string(kOkMessage), result);
     } else {
-      EXPECT_EQ(kFeatureMissingMessage, result);
+      EXPECT_EQ(kGetFeaturePolicyMissingMessage, result);
     }
   }
 }
@@ -1412,7 +1419,10 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
   }
 }
 
-IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinGetAssertion) {
+// TODO(crbug/1081450): FakeWinWebAuthnApi needs to support injecting
+// credentials in order for assertion responses to pass response validation.
+IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
+                       DISABLED_WinGetAssertion) {
   EXPECT_TRUE(
       NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
 
diff --git a/chromium/content/browser/webauth/webauth_request_security_checker.cc b/chromium/content/browser/webauth/webauth_request_security_checker.cc
index 9f29f0f1e2b..e1e63be4b49 100644
--- a/chromium/content/browser/webauth/webauth_request_security_checker.cc
+++ b/chromium/content/browser/webauth/webauth_request_security_checker.cc
@@ -139,12 +139,15 @@ bool WebAuthRequestSecurityChecker::IsSameOriginWithAncestors(
 blink::mojom::AuthenticatorStatus
 WebAuthRequestSecurityChecker::ValidateAncestorOrigins(
     const url::Origin& origin,
+    RequestType type,
     bool* is_cross_origin) {
   *is_cross_origin = !IsSameOriginWithAncestors(origin);
-  if ((!base::FeatureList::IsEnabled(device::kWebAuthFeaturePolicy) ||
+  if ((type == RequestType::kMakeCredential ||
+       !base::FeatureList::IsEnabled(
+           device::kWebAuthGetAssertionFeaturePolicy) ||
        !static_cast<RenderFrameHostImpl*>(render_frame_host_)
-            ->IsFeatureEnabled(
-                blink::mojom::FeaturePolicyFeature::kPublicKeyCredentials)) &&
+            ->IsFeatureEnabled(blink::mojom::FeaturePolicyFeature::
+                                   kPublicKeyCredentialsGet)) &&
       *is_cross_origin) {
     ReportSecurityCheckFailure(
         RelyingPartySecurityCheckFailure::kCrossOriginMismatch);
diff --git a/chromium/content/browser/webauth/webauth_request_security_checker.h b/chromium/content/browser/webauth/webauth_request_security_checker.h
index 73663fa9966..642b70e9a66 100644
--- a/chromium/content/browser/webauth/webauth_request_security_checker.h
+++ b/chromium/content/browser/webauth/webauth_request_security_checker.h
@@ -41,6 +41,8 @@ enum class RelyingPartySecurityCheckFailure {
 class CONTENT_EXPORT WebAuthRequestSecurityChecker
     : public base::RefCounted<WebAuthRequestSecurityChecker> {
  public:
+  enum class RequestType { kMakeCredential, kGetAssertion };
+
   explicit WebAuthRequestSecurityChecker(RenderFrameHost* host);
   WebAuthRequestSecurityChecker(const WebAuthRequestSecurityChecker&) = delete;
 
@@ -53,12 +55,14 @@ class CONTENT_EXPORT WebAuthRequestSecurityChecker
 
   // Returns blink::mojom::AuthenticatorStatus::SUCCESS if |origin| is
   // same-origin with all ancestors in the frame tree, or else if
-  // requests from cross-origin embeddings are allowed by policy.
+  // requests from cross-origin embeddings are allowed by policy and the
+  // RequestType is |kGetAssertion|.
   // Returns blink::mojom::AuthenticatorStatus::NOT_ALLOWED_ERROR otherwise.
   // |is_cross_origin| is an output parameter that is set to true if there is
   // a cross-origin embedding, regardless of policy, and false otherwise.
   blink::mojom::AuthenticatorStatus ValidateAncestorOrigins(
       const url::Origin& origin,
+      RequestType type,
       bool* is_cross_origin);
 
   // Returns AuthenticatorStatus::SUCCESS if the origin domain is valid under
diff --git a/chromium/content/browser/webkit_browsertest.cc b/chromium/content/browser/webkit_browsertest.cc
index b83003fdde9..92a986b2947 100644
--- a/chromium/content/browser/webkit_browsertest.cc
+++ b/chromium/content/browser/webkit_browsertest.cc
@@ -5,6 +5,7 @@
 #include "base/bind.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/url_loader_interceptor.h"
diff --git a/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc b/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
index e06959b0870..31692059d24 100644
--- a/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_audio_debug_recordings_browsertest.cc b/chromium/content/browser/webrtc/webrtc_audio_debug_recordings_browsertest.cc
index 8937113119f..3eb76a005d7 100644
--- a/chromium/content/browser/webrtc/webrtc_audio_debug_recordings_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_audio_debug_recordings_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/browser/webrtc/webrtc_internals.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/webrtc/webrtc_browsertest.cc b/chromium/content/browser/webrtc/webrtc_browsertest.cc
index a66910e1c03..0799ad37635 100644
--- a/chromium/content/browser/webrtc/webrtc_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_capture_from_element_browsertest.cc b/chromium/content/browser/webrtc/webrtc_capture_from_element_browsertest.cc
index b3238701850..ee6e1cf531e 100644
--- a/chromium/content/browser/webrtc/webrtc_capture_from_element_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_capture_from_element_browsertest.cc
@@ -7,6 +7,7 @@
 #include "build/build_config.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/shell/common/shell_switches.h"
 #include "media/base/media_switches.h"
diff --git a/chromium/content/browser/webrtc/webrtc_constraints_browsertest.cc b/chromium/content/browser/webrtc/webrtc_constraints_browsertest.cc
index 1fb7773c68b..798446120f1 100644
--- a/chromium/content/browser/webrtc/webrtc_constraints_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_constraints_browsertest.cc
@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_data_browsertest.cc b/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
index 7d40178f97e..74f48645e04 100644
--- a/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_datachannel_browsertest.cc b/chromium/content/browser/webrtc/webrtc_datachannel_browsertest.cc
index 53ec1982d46..9e3710f1516 100644
--- a/chromium/content/browser/webrtc/webrtc_datachannel_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_datachannel_browsertest.cc
@@ -6,6 +6,7 @@
 #include "base/macros.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 
 namespace {
 
diff --git a/chromium/content/browser/webrtc/webrtc_depth_capture_browsertest.cc b/chromium/content/browser/webrtc/webrtc_depth_capture_browsertest.cc
index 3f171c9e8c6..35f056fb9ed 100644
--- a/chromium/content/browser/webrtc/webrtc_depth_capture_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_depth_capture_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "media/base/media_switches.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
diff --git a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
index 34c7223de8e..490e3e4a7d1 100644
--- a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/browser/audio_service.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
@@ -29,7 +30,6 @@
 #include "media/base/media_switches.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "services/audio/public/mojom/testing_api.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
@@ -132,18 +132,15 @@ class WebRtcGetUserMediaBrowserTest : public WebRtcContentBrowserTestBase {
         "getSources()");
     EXPECT_FALSE(devices_as_json.empty());
 
-    int error_code;
-    std::string error_message;
-    std::unique_ptr<base::Value> value =
-        base::JSONReader::ReadAndReturnErrorDeprecated(
-            devices_as_json, base::JSON_ALLOW_TRAILING_COMMAS, &error_code,
-            &error_message);
+    base::JSONReader::ValueWithError parsed_json =
+        base::JSONReader::ReadAndReturnValueWithError(
+            devices_as_json, base::JSON_ALLOW_TRAILING_COMMAS);
 
-    ASSERT_TRUE(value.get() != nullptr) << error_message;
-    EXPECT_EQ(value->type(), base::Value::Type::LIST);
+    ASSERT_TRUE(parsed_json.value) << parsed_json.error_message;
+    EXPECT_EQ(parsed_json.value->type(), base::Value::Type::LIST);
 
     base::ListValue* values;
-    ASSERT_TRUE(value->GetAsList(&values));
+    ASSERT_TRUE(parsed_json.value->GetAsList(&values));
 
     for (auto it = values->begin(); it != values->end(); ++it) {
       const base::DictionaryValue* dict;
diff --git a/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc b/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
index 4e1b2f0a53d..206efde3e3a 100644
--- a/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/webrtc/webrtc_webcam_browsertest.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_internals_browsertest.cc b/chromium/content/browser/webrtc/webrtc_internals_browsertest.cc
index aec0c29b649..a9c3b6eaea2 100644
--- a/chromium/content/browser/webrtc/webrtc_internals_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_internals_browsertest.cc
@@ -12,6 +12,7 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc b/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
index 6def6d8447c..6876eb8dcdc 100644
--- a/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_media_recorder_browsertest.cc b/chromium/content/browser/webrtc/webrtc_media_recorder_browsertest.cc
index 6460653eac2..5c2b60e5a34 100644
--- a/chromium/content/browser/webrtc/webrtc_media_recorder_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_media_recorder_browsertest.cc
@@ -8,6 +8,7 @@
 #include "build/build_config.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "media/base/media_switches.h"
diff --git a/chromium/content/browser/webrtc/webrtc_stress_image_capture_browsertest.cc b/chromium/content/browser/webrtc/webrtc_stress_image_capture_browsertest.cc
index 526f30ff53d..66721e98c60 100644
--- a/chromium/content/browser/webrtc/webrtc_stress_image_capture_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_stress_image_capture_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/browser/webrtc/webrtc_webcam_browsertest.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_stress_pause_browsertest.cc b/chromium/content/browser/webrtc/webrtc_stress_pause_browsertest.cc
index c7248a879cb..94319356981 100644
--- a/chromium/content/browser/webrtc/webrtc_stress_pause_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_stress_pause_browsertest.cc
@@ -9,6 +9,7 @@
 #include "build/build_config.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_stress_resolution_switch_browsertest.cc b/chromium/content/browser/webrtc/webrtc_stress_resolution_switch_browsertest.cc
index 2af0209bf70..55343842c24 100644
--- a/chromium/content/browser/webrtc/webrtc_stress_resolution_switch_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_stress_resolution_switch_browsertest.cc
@@ -9,6 +9,7 @@
 #include "build/build_config.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_stress_source_switch_browsertest.cc b/chromium/content/browser/webrtc/webrtc_stress_source_switch_browsertest.cc
index 86f3aa1e3b5..a1cec9dab93 100644
--- a/chromium/content/browser/webrtc/webrtc_stress_source_switch_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_stress_source_switch_browsertest.cc
@@ -9,6 +9,7 @@
 #include "build/build_config.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_video_capture_browsertest.cc b/chromium/content/browser/webrtc/webrtc_video_capture_browsertest.cc
index 970c716a4ce..6b96eb0efb1 100644
--- a/chromium/content/browser/webrtc/webrtc_video_capture_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_video_capture_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
diff --git a/chromium/content/browser/webrtc/webrtc_video_capture_service_browsertest.cc b/chromium/content/browser/webrtc/webrtc_video_capture_service_browsertest.cc
index 7870f588001..c13ef7cf5a9 100644
--- a/chromium/content/browser/webrtc/webrtc_video_capture_service_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_video_capture_service_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/browser/video_capture_service.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_video_capture_service_enumeration_browsertest.cc b/chromium/content/browser/webrtc/webrtc_video_capture_service_enumeration_browsertest.cc
index ee8c3bd7a57..e3d89eaef86 100644
--- a/chromium/content/browser/webrtc/webrtc_video_capture_service_enumeration_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_video_capture_service_enumeration_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/video_capture_service.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc b/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
index f4ff82c4562..0579bf5b96c 100644
--- a/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/browser/video_capture_service.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/webrtc/webrtc_webcam_browsertest.cc b/chromium/content/browser/webrtc/webrtc_webcam_browsertest.cc
index f9c31b6cca4..4c93df2ab4e 100644
--- a/chromium/content/browser/webrtc/webrtc_webcam_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_webcam_browsertest.cc
@@ -10,6 +10,7 @@
 #include "build/build_config.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/browser/websockets/websocket_connector_impl.cc b/chromium/content/browser/websockets/websocket_connector_impl.cc
index ba5bd3234af..c774a88060a 100644
--- a/chromium/content/browser/websockets/websocket_connector_impl.cc
+++ b/chromium/content/browser/websockets/websocket_connector_impl.cc
@@ -18,11 +18,11 @@ WebSocketConnectorImpl::WebSocketConnectorImpl(
     int process_id,
     int frame_id,
     const url::Origin& origin,
-    const net::NetworkIsolationKey& network_isolation_key)
+    const net::IsolationInfo& isolation_info)
     : process_id_(process_id),
       frame_id_(frame_id),
       origin_(origin),
-      network_isolation_key_(network_isolation_key) {}
+      isolation_info_(isolation_info) {}
 
 WebSocketConnectorImpl::~WebSocketConnectorImpl() = default;
 
@@ -47,7 +47,7 @@ void WebSocketConnectorImpl::Connect(
     GetContentClient()->browser()->CreateWebSocket(
         frame,
         base::BindOnce(ConnectCalledByContentBrowserClient, requested_protocols,
-                       site_for_cookies, network_isolation_key_, process_id_,
+                       site_for_cookies, isolation_info_, process_id_,
                        frame_id_, origin_, options),
         url, site_for_cookies, user_agent, std::move(handshake_client));
     return;
@@ -58,7 +58,7 @@ void WebSocketConnectorImpl::Connect(
         net::HttpRequestHeaders::kUserAgent, *user_agent));
   }
   process->GetStoragePartition()->GetNetworkContext()->CreateWebSocket(
-      url, requested_protocols, site_for_cookies, network_isolation_key_,
+      url, requested_protocols, site_for_cookies, isolation_info_,
       std::move(headers), process_id_, frame_id_, origin_, options,
       std::move(handshake_client), mojo::NullRemote(), mojo::NullRemote());
 }
@@ -66,7 +66,7 @@ void WebSocketConnectorImpl::Connect(
 void WebSocketConnectorImpl::ConnectCalledByContentBrowserClient(
     const std::vector<std::string>& requested_protocols,
     const net::SiteForCookies& site_for_cookies,
-    const net::NetworkIsolationKey& network_isolation_key,
+    const net::IsolationInfo& isolation_info,
     int process_id,
     int frame_id,
     const url::Origin& origin,
@@ -84,7 +84,7 @@ void WebSocketConnectorImpl::ConnectCalledByContentBrowserClient(
     return;
   }
   process->GetStoragePartition()->GetNetworkContext()->CreateWebSocket(
-      url, requested_protocols, site_for_cookies, network_isolation_key,
+      url, requested_protocols, site_for_cookies, isolation_info,
       std::move(additional_headers), process_id, frame_id, origin, options,
       std::move(handshake_client), std::move(auth_handler),
       std::move(trusted_header_client));
diff --git a/chromium/content/browser/websockets/websocket_connector_impl.h b/chromium/content/browser/websockets/websocket_connector_impl.h
index c4afd0ec7da..18dde8edc52 100644
--- a/chromium/content/browser/websockets/websocket_connector_impl.h
+++ b/chromium/content/browser/websockets/websocket_connector_impl.h
@@ -9,6 +9,7 @@
 #include <vector>
 #include "base/optional.h"
 #include "content/public/browser/content_browser_client.h"
+#include "net/base/isolation_info.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/websocket.mojom.h"
 #include "third_party/blink/public/mojom/websockets/websocket_connector.mojom.h"
@@ -31,7 +32,7 @@ class WebSocketConnectorImpl final : public blink::mojom::WebSocketConnector {
   WebSocketConnectorImpl(int process_id,
                          int frame_id,
                          const url::Origin& origin,
-                         const net::NetworkIsolationKey& network_isolation_key);
+                         const net::IsolationInfo& isolation_info);
   ~WebSocketConnectorImpl() override;
 
   // WebSocketConnector implementation
@@ -46,7 +47,7 @@ class WebSocketConnectorImpl final : public blink::mojom::WebSocketConnector {
   static void ConnectCalledByContentBrowserClient(
       const std::vector<std::string>& requested_protocols,
       const net::SiteForCookies& site_for_cookies,
-      const net::NetworkIsolationKey& network_isolation_key,
+      const net::IsolationInfo& isolation_info,
       int process_id,
       int frame_id,
       const url::Origin& origin,
@@ -62,7 +63,7 @@ class WebSocketConnectorImpl final : public blink::mojom::WebSocketConnector {
   const int process_id_;
   const int frame_id_;
   const url::Origin origin_;
-  const net::NetworkIsolationKey network_isolation_key_;
+  const net::IsolationInfo isolation_info_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/webtransport/quic_transport_connector_impl.cc b/chromium/content/browser/webtransport/quic_transport_connector_impl.cc
index 0acddc55b19..98871672d00 100644
--- a/chromium/content/browser/webtransport/quic_transport_connector_impl.cc
+++ b/chromium/content/browser/webtransport/quic_transport_connector_impl.cc
@@ -3,19 +3,94 @@
 // found in the LICENSE file.
 
 #include "content/browser/webtransport/quic_transport_connector_impl.h"
+#include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/quic/quic_transport_client.h"
+
+namespace mojo {
+// We cannot use type mapping due to a build error in iOS (see
+// https://crrev.com/c/2189716/10 and
+// https://cr-buildbucket.appspot.com/build/8880349779729215008).
+// TODO(yhirano): Fix the build error and use type mapping.
+template <>
+struct TypeConverter<base::Optional<net::QuicTransportError>,
+                     network::mojom::QuicTransportErrorPtr> {
+  static base::Optional<net::QuicTransportError> Convert(
+      const network::mojom::QuicTransportErrorPtr& in) {
+    if (!in) {
+      return base::nullopt;
+    }
+    if (in->net_error > 0 || in->quic_error < 0 ||
+        in->quic_error >= quic::QUIC_LAST_ERROR) {
+      return base::nullopt;
+    }
+    auto out = base::make_optional<net::QuicTransportError>();
+    out->net_error = in->net_error;
+    out->quic_error = static_cast<quic::QuicErrorCode>(in->quic_error);
+    out->details = in->details;
+    out->safe_to_report_details = in->safe_to_report_details;
+    return out;
+  }
+};
+
+}  // namespace mojo
 
 namespace content {
 
+namespace {
+
+using network::mojom::QuicTransportHandshakeClient;
+
+class InterceptingHandshakeClient final : public QuicTransportHandshakeClient {
+ public:
+  InterceptingHandshakeClient(
+      base::WeakPtr<RenderFrameHostImpl> frame,
+      const GURL& url,
+      mojo::PendingRemote<QuicTransportHandshakeClient> remote)
+      : frame_(std::move(frame)), url_(url), remote_(std::move(remote)) {}
+  ~InterceptingHandshakeClient() override = default;
+
+  // QuicTransportHandshakeClient implementation:
+  void OnConnectionEstablished(
+      mojo::PendingRemote<network::mojom::QuicTransport> transport,
+      mojo::PendingReceiver<network::mojom::QuicTransportClient> client)
+      override {
+    remote_->OnConnectionEstablished(std::move(transport), std::move(client));
+  }
+  void OnHandshakeFailed(network::mojom::QuicTransportErrorPtr error) override {
+    // Here we pass null because it is dangerous to pass the error details
+    // to the initiator renderer.
+    remote_->OnHandshakeFailed(nullptr);
+
+    if (RenderFrameHostImpl* frame = frame_.get()) {
+      devtools_instrumentation::OnQuicTransportHandshakeFailed(
+          frame, url_,
+          mojo::ConvertTo<base::Optional<net::QuicTransportError>>(error));
+    }
+  }
+
+ private:
+  const base::WeakPtr<RenderFrameHostImpl> frame_;
+  const GURL url_;
+  mojo::Remote<QuicTransportHandshakeClient> remote_;
+};
+
+}  // namespace
+
 QuicTransportConnectorImpl::QuicTransportConnectorImpl(
     int process_id,
+    base::WeakPtr<RenderFrameHostImpl> frame,
     const url::Origin& origin,
     const net::NetworkIsolationKey& network_isolation_key)
     : process_id_(process_id),
+      frame_(std::move(frame)),
       origin_(origin),
       network_isolation_key_(network_isolation_key) {}
 
+QuicTransportConnectorImpl::~QuicTransportConnectorImpl() = default;
+
 void QuicTransportConnectorImpl::Connect(
     const GURL& url,
     mojo::PendingRemote<network::mojom::QuicTransportHandshakeClient>
@@ -24,8 +99,19 @@ void QuicTransportConnectorImpl::Connect(
   if (!process) {
     return;
   }
+
+  mojo::PendingRemote<QuicTransportHandshakeClient> handshake_client_to_pass;
+  // TODO(yhirano): Stop using MakeSelfOwnedReceiver here, because the
+  // QuicTransport implementation in the network service won't notice that
+  // the QuicTransportHandshakeClient is going away.
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<InterceptingHandshakeClient>(
+          frame_, url, std::move(handshake_client)),
+      handshake_client_to_pass.InitWithNewPipeAndPassReceiver());
+
   process->GetStoragePartition()->GetNetworkContext()->CreateQuicTransport(
-      url, origin_, network_isolation_key_, std::move(handshake_client));
+      url, origin_, network_isolation_key_,
+      std::move(handshake_client_to_pass));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/webtransport/quic_transport_connector_impl.h b/chromium/content/browser/webtransport/quic_transport_connector_impl.h
index b732612856c..cd5a8c0e820 100644
--- a/chromium/content/browser/webtransport/quic_transport_connector_impl.h
+++ b/chromium/content/browser/webtransport/quic_transport_connector_impl.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_WEBTRANSPORT_QUIC_TRANSPORT_CONNECTOR_IMPL_H_
 #define CONTENT_BROWSER_WEBTRANSPORT_QUIC_TRANSPORT_CONNECTOR_IMPL_H_
 
+#include "base/memory/weak_ptr.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/network_isolation_key.h"
 #include "services/network/public/mojom/network_context.mojom.h"
@@ -14,13 +15,20 @@
 
 namespace content {
 
+class RenderFrameHostImpl;
+
 class QuicTransportConnectorImpl final
     : public blink::mojom::QuicTransportConnector {
  public:
+  // |frame| is needed for devtools - sometimes (e.g., the connector is for
+  // workers) there is not appropriate frame to associate, and in that case
+  // nullptr is provided.
   QuicTransportConnectorImpl(
       int process_id,
+      base::WeakPtr<RenderFrameHostImpl> frame,
       const url::Origin& origin,
       const net::NetworkIsolationKey& network_isolation_key);
+  ~QuicTransportConnectorImpl() override;
 
   void Connect(const GURL& url,
                mojo::PendingRemote<network::mojom::QuicTransportHandshakeClient>
@@ -28,6 +36,7 @@ class QuicTransportConnectorImpl final
 
  private:
   const int process_id_;
+  const base::WeakPtr<RenderFrameHostImpl> frame_;
   const url::Origin origin_;
   const net::NetworkIsolationKey network_isolation_key_;
 };
diff --git a/chromium/content/browser/webui/content_web_ui_controller_factory.cc b/chromium/content/browser/webui/content_web_ui_controller_factory.cc
index b59ad1cb39d..d0a353e6193 100644
--- a/chromium/content/browser/webui/content_web_ui_controller_factory.cc
+++ b/chromium/content/browser/webui/content_web_ui_controller_factory.cc
@@ -6,6 +6,7 @@
 
 #include "build/build_config.h"
 #include "content/browser/appcache/appcache_internals_ui.h"
+#include "content/browser/conversions/conversion_internals_ui.h"
 #include "content/browser/gpu/gpu_internals_ui.h"
 #include "content/browser/histograms_internals_ui.h"
 #include "content/browser/indexed_db/indexed_db_internals_ui.h"
@@ -40,7 +41,8 @@ WebUI::TypeID ContentWebUIControllerFactory::GetWebUIType(
       url.host_piece() == kChromeUIServiceWorkerInternalsHost ||
       url.host_piece() == kChromeUIAppCacheInternalsHost ||
       url.host_piece() == kChromeUINetworkErrorsListingHost ||
-      url.host_piece() == kChromeUIProcessInternalsHost) {
+      url.host_piece() == kChromeUIProcessInternalsHost ||
+      url.host_piece() == kChromeUIConversionInternalsHost) {
     return const_cast<ContentWebUIControllerFactory*>(this);
   }
   return WebUI::kNoWebUI;
@@ -86,7 +88,8 @@ ContentWebUIControllerFactory::CreateWebUIControllerForURL(WebUI* web_ui,
     return std::make_unique<WebRTCInternalsUI>(web_ui);
   if (url.host_piece() == kChromeUIProcessInternalsHost)
     return std::make_unique<ProcessInternalsUI>(web_ui);
-
+  if (url.host_piece() == kChromeUIConversionInternalsHost)
+    return std::make_unique<ConversionInternalsUI>(web_ui);
   return nullptr;
 }
 
diff --git a/chromium/content/browser/webui/shared_resources_data_source.cc b/chromium/content/browser/webui/shared_resources_data_source.cc
index 69fe841b020..91ce33a80d0 100644
--- a/chromium/content/browser/webui/shared_resources_data_source.cc
+++ b/chromium/content/browser/webui/shared_resources_data_source.cc
@@ -7,10 +7,11 @@
 #include <stddef.h>
 #include <string>
 
+#include "base/check_op.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/memory/ref_counted_memory.h"
+#include "base/notreached.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
@@ -80,14 +81,12 @@ const std::map<std::string, std::string> CreatePathPrefixAliasesMap() {
   };
 
 #if defined(OS_CHROMEOS)
-  // Add lottie library for Chrome OS.
-  aliases["../../../third_party/lottie/"] = "lottie/";
-
   if (UsingMultiplePolymerVersions())
     return aliases;
 #endif  // defined(OS_CHROMEOS)
 
 #if !defined(OS_ANDROID)
+  aliases["../../../third_party/lottie/"] = "lottie/";
   aliases["../../../third_party/polymer/v1_0/components-chromium/polymer2/"] =
       "polymer/v1_0/polymer/";
 #endif  // !defined(OS_ANDROID)
@@ -131,12 +130,14 @@ const std::map<int, std::string> CreateMojoResourceIdToAliasMap() {
          "mojo/mojo/public/mojom/base/text_direction.mojom.html"},
         {IDR_MOJO_TEXT_DIRECTION_MOJOM_LITE_JS,
          "mojo/mojo/public/mojom/base/text_direction.mojom-lite.js"},
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
+#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX) || \
+    defined(OS_ANDROID)
         {IDR_MOJO_TIME_MOJOM_HTML,
          "mojo/mojo/public/mojom/base/time.mojom.html"},
         {IDR_MOJO_TIME_MOJOM_LITE_JS,
          "mojo/mojo/public/mojom/base/time.mojom-lite.js"},
-#endif  // defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
+#endif  // defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX) ||
+        //  defined(OS_ANDROID)
   };
 }
 
@@ -173,6 +174,12 @@ const std::map<int, std::string> CreateChromeosMojoResourceIdToAliasMap() {
       {IDR_NETWORK_CONFIG_MOJOM_LITE_JS,
        "mojo/chromeos/services/network_config/public/mojom/"
        "cros_network_config.mojom-lite.js"},
+      {IDR_NETWORK_CONFIG_TYPES_MOJOM_HTML,
+       "mojo/chromeos/services/network_config/public/mojom/"
+       "network_types.mojom.html"},
+      {IDR_NETWORK_CONFIG_TYPES_MOJOM_LITE_JS,
+       "mojo/chromeos/services/network_config/public/mojom/"
+       "network_types.mojom-lite.js"},
       {IDR_IP_ADDRESS_MOJOM_HTML,
        "mojo/services/network/public/mojom/"
        "ip_address.mojom.html"},
@@ -377,28 +384,6 @@ bool SharedResourcesDataSource::ShouldServeMimeTypeAsContentTypeHeader() {
   return true;
 }
 
-scoped_refptr<base::SingleThreadTaskRunner>
-SharedResourcesDataSource::TaskRunnerForRequestPath(const std::string& path) {
-  // Since WebContentsGetter can only be run on the UI thread, always return
-  // a task runner if we need to choose between Polymer resources based on the
-  // WebContents that is requesting the resource.
-  // TODO (rbpotter): Remove this once the OOBE Polymer 2 migration is complete.
-#if defined(OS_CHROMEOS)
-  if (UsingMultiplePolymerVersions())
-    return base::CreateSingleThreadTaskRunner({BrowserThread::UI});
-#endif  // defined(OS_CHROMEOS)
-
-  int idr = GetIdrForPath(path);
-  if (idr == IDR_WEBUI_CSS_TEXT_DEFAULTS ||
-      idr == IDR_WEBUI_CSS_TEXT_DEFAULTS_MD) {
-    // Use UI thread to load CSS since its construction touches non-thread-safe
-    // gfx::Font names in ui::ResourceBundle.
-    return base::CreateSingleThreadTaskRunner({BrowserThread::UI});
-  }
-
-  return nullptr;
-}
-
 std::string SharedResourcesDataSource::GetAccessControlAllowOriginForOrigin(
     const std::string& origin) {
   // For now we give access only for "chrome://*" origins.
@@ -414,6 +399,10 @@ std::string SharedResourcesDataSource::GetAccessControlAllowOriginForOrigin(
   return origin;
 }
 
+std::string SharedResourcesDataSource::GetContentSecurityPolicyWorkerSrc() {
+  return "worker-src blob: 'self';";
+}
+
 #if defined(OS_CHROMEOS)
 void SharedResourcesDataSource::DisablePolymer2ForHost(
     const std::string& host) {
@@ -421,10 +410,6 @@ void SharedResourcesDataSource::DisablePolymer2ForHost(
   disabled_polymer2_host_ = host;
 }
 
-std::string SharedResourcesDataSource::GetContentSecurityPolicyWorkerSrc() {
-  return "worker-src blob: 'self';";
-}
-
 // Returns true if the WebContents making the request has disabled Polymer 2.
 bool SharedResourcesDataSource::IsPolymer2DisabledForPage(
     const WebContents::Getter& wc_getter) {
diff --git a/chromium/content/browser/webui/shared_resources_data_source.h b/chromium/content/browser/webui/shared_resources_data_source.h
index 8473cf73489..4500bb40c17 100644
--- a/chromium/content/browser/webui/shared_resources_data_source.h
+++ b/chromium/content/browser/webui/shared_resources_data_source.h
@@ -27,13 +27,11 @@ class SharedResourcesDataSource : public URLDataSource {
   bool AllowCaching() override;
   std::string GetMimeType(const std::string& path) override;
   bool ShouldServeMimeTypeAsContentTypeHeader() override;
-  scoped_refptr<base::SingleThreadTaskRunner> TaskRunnerForRequestPath(
-      const std::string& path) override;
   std::string GetAccessControlAllowOriginForOrigin(
       const std::string& origin) override;
+  std::string GetContentSecurityPolicyWorkerSrc() override;
 #if defined(OS_CHROMEOS)
   void DisablePolymer2ForHost(const std::string& host) override;
-  std::string GetContentSecurityPolicyWorkerSrc() override;
 #endif  // defined (OS_CHROMEOS)
 
  private:
diff --git a/chromium/content/browser/webui/url_data_manager.cc b/chromium/content/browser/webui/url_data_manager.cc
index 7c4b225f8d9..401b38a0088 100644
--- a/chromium/content/browser/webui/url_data_manager.cc
+++ b/chromium/content/browser/webui/url_data_manager.cc
@@ -43,23 +43,6 @@ URLDataManager* GetFromBrowserContext(BrowserContext* context) {
       context->GetUserData(kURLDataManagerKeyName));
 }
 
-// Invoked on the IO thread to do the actual adding of the DataSource.
-static void AddDataSourceOnIOThread(
-    ResourceContext* resource_context,
-    scoped_refptr<URLDataSourceImpl> data_source) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  GetURLDataManagerForResourceContext(resource_context)->AddDataSource(
-      data_source.get());
-}
-
-static void UpdateWebUIDataSourceOnIOThread(
-    ResourceContext* resource_context,
-    std::string source_name,
-    const base::DictionaryValue* update) {
-  GetURLDataManagerForResourceContext(resource_context)
-      ->UpdateWebUIDataSource(source_name, *update);
-}
-
 }  // namespace
 
 // static
@@ -75,20 +58,16 @@ URLDataManager::~URLDataManager() {
 
 void URLDataManager::AddDataSource(URLDataSourceImpl* source) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&AddDataSourceOnIOThread,
-                                browser_context_->GetResourceContext(),
-                                base::WrapRefCounted(source)));
+  URLDataManagerBackend::GetForBrowserContext(browser_context_)
+      ->AddDataSource(source);
 }
 
 void URLDataManager::UpdateWebUIDataSource(
     const std::string& source_name,
     std::unique_ptr<base::DictionaryValue> update) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&UpdateWebUIDataSourceOnIOThread,
-                                browser_context_->GetResourceContext(),
-                                source_name, base::Owned(update.release())));
+  URLDataManagerBackend::GetForBrowserContext(browser_context_)
+      ->UpdateWebUIDataSource(source_name, *update);
 }
 
 // static
@@ -135,8 +114,9 @@ void URLDataManager::DeleteDataSource(const URLDataSourceImpl* data_source) {
 void URLDataManager::AddDataSource(BrowserContext* browser_context,
                                    std::unique_ptr<URLDataSource> source) {
   std::string name = source->GetSource();
-  GetFromBrowserContext(browser_context)
-      ->AddDataSource(new URLDataSourceImpl(name, std::move(source)));
+  auto source_impl =
+      base::MakeRefCounted<URLDataSourceImpl>(name, std::move(source));
+  GetFromBrowserContext(browser_context)->AddDataSource(source_impl.get());
 }
 
 // static
diff --git a/chromium/content/browser/webui/url_data_manager_backend.cc b/chromium/content/browser/webui/url_data_manager_backend.cc
index ce56d9f34a7..2e4c8136128 100644
--- a/chromium/content/browser/webui/url_data_manager_backend.cc
+++ b/chromium/content/browser/webui/url_data_manager_backend.cc
@@ -22,7 +22,6 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
-#include "content/browser/resource_context_impl.h"
 #include "content/browser/webui/shared_resources_data_source.h"
 #include "content/browser/webui/url_data_source_impl.h"
 #include "content/browser/webui/web_ui_data_source_impl.h"
@@ -32,6 +31,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
@@ -51,11 +51,17 @@ namespace content {
 
 namespace {
 
-const char kChromeURLContentSecurityPolicyHeaderBase[] =
-    "Content-Security-Policy: ";
+const char kChromeURLContentSecurityPolicyHeaderName[] =
+    "Content-Security-Policy";
+const char kChromeURLContentSecurityPolicyReportOnlyHeaderName[] =
+    "Content-Security-Policy-Report-Only";
+const char kChromeURLContentSecurityPolicyReportOnlyHeaderValue[] =
+    "require-trusted-types-for 'script'";
 
-const char kChromeURLXFrameOptionsHeader[] = "X-Frame-Options: DENY";
+const char kChromeURLXFrameOptionsHeaderName[] = "X-Frame-Options";
+const char kChromeURLXFrameOptionsHeaderValue[] = "DENY";
 const char kNetworkErrorKey[] = "netError";
+const char kURLDataManagerBackendKeyName[] = "url_data_manager_backend";
 
 bool SchemeIsInSchemes(const std::string& scheme,
                        const std::vector<std::string>& schemes) {
@@ -72,9 +78,19 @@ URLDataManagerBackend::URLDataManagerBackend() : next_request_id_(0) {
 
 URLDataManagerBackend::~URLDataManagerBackend() = default;
 
-void URLDataManagerBackend::AddDataSource(
-    URLDataSourceImpl* source) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+URLDataManagerBackend* URLDataManagerBackend::GetForBrowserContext(
+    BrowserContext* context) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!context->GetUserData(kURLDataManagerBackendKeyName)) {
+    context->SetUserData(kURLDataManagerBackendKeyName,
+                         std::make_unique<URLDataManagerBackend>());
+  }
+  return static_cast<URLDataManagerBackend*>(
+      context->GetUserData(kURLDataManagerBackendKeyName));
+}
+
+void URLDataManagerBackend::AddDataSource(URLDataSourceImpl* source) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (!source->source()->ShouldReplaceExistingSource()) {
     auto i = data_sources_.find(source->source_name());
     if (i != data_sources_.end())
@@ -139,42 +155,46 @@ scoped_refptr<net::HttpResponseHeaders> URLDataManagerBackend::GetHeaders(
   // that is compatible with a given WebUI URL, and append it to the existing
   // response headers.
   if (source->ShouldAddContentSecurityPolicy()) {
-    std::string base = kChromeURLContentSecurityPolicyHeaderBase;
-    base.append(source->GetContentSecurityPolicyScriptSrc());
-    base.append(source->GetContentSecurityPolicyObjectSrc());
-    base.append(source->GetContentSecurityPolicyChildSrc());
-    base.append(source->GetContentSecurityPolicyStyleSrc());
-    base.append(source->GetContentSecurityPolicyImgSrc());
-    base.append(source->GetContentSecurityPolicyWorkerSrc());
+    std::string csp_header;
+    csp_header.append(source->GetContentSecurityPolicyChildSrc());
+    csp_header.append(source->GetContentSecurityPolicyDefaultSrc());
+    csp_header.append(source->GetContentSecurityPolicyImgSrc());
+    csp_header.append(source->GetContentSecurityPolicyObjectSrc());
+    csp_header.append(source->GetContentSecurityPolicyScriptSrc());
+    csp_header.append(source->GetContentSecurityPolicyStyleSrc());
+    csp_header.append(source->GetContentSecurityPolicyWorkerSrc());
     // TODO(crbug.com/1051745): Both CSP frame ancestors and XFO headers may be
     // added to the response but frame ancestors would take precedence. In the
     // future, XFO will be removed so when that happens remove the check and
     // always add frame ancestors.
     if (source->ShouldDenyXFrameOptions())
-      base.append(source->GetContentSecurityPolicyFrameAncestors());
-    headers->AddHeader(base);
+      csp_header.append(source->GetContentSecurityPolicyFrameAncestors());
+    headers->SetHeader(kChromeURLContentSecurityPolicyHeaderName, csp_header);
   }
 
-  if (source->ShouldDenyXFrameOptions())
-    headers->AddHeader(kChromeURLXFrameOptionsHeader);
+  if (source->ShouldDenyXFrameOptions()) {
+    headers->SetHeader(kChromeURLXFrameOptionsHeaderName,
+                       kChromeURLXFrameOptionsHeaderValue);
+  }
+
+  if (base::FeatureList::IsEnabled(features::kWebUIReportOnlyTrustedTypes))
+    headers->SetHeader(kChromeURLContentSecurityPolicyReportOnlyHeaderName,
+                       kChromeURLContentSecurityPolicyReportOnlyHeaderValue);
 
   if (!source->AllowCaching())
-    headers->AddHeader("Cache-Control: no-cache");
+    headers->SetHeader("Cache-Control", "no-cache");
 
   std::string mime_type = source->GetMimeType(path);
-  if (source->ShouldServeMimeTypeAsContentTypeHeader() && !mime_type.empty()) {
-    std::string content_type = base::StringPrintf(
-        "%s:%s", net::HttpRequestHeaders::kContentType, mime_type.c_str());
-    headers->AddHeader(content_type);
-  }
+  if (source->ShouldServeMimeTypeAsContentTypeHeader() && !mime_type.empty())
+    headers->SetHeader(net::HttpRequestHeaders::kContentType, mime_type);
 
   if (!origin.empty()) {
     std::string header = source->GetAccessControlAllowOriginForOrigin(origin);
     DCHECK(header.empty() || header == origin || header == "*" ||
            header == "null");
     if (!header.empty()) {
-      headers->AddHeader("Access-Control-Allow-Origin: " + header);
-      headers->AddHeader("Vary: Origin");
+      headers->SetHeader("Access-Control-Allow-Origin", header);
+      headers->SetHeader("Vary", "Origin");
     }
   }
 
diff --git a/chromium/content/browser/webui/url_data_manager_backend.h b/chromium/content/browser/webui/url_data_manager_backend.h
index 72c92d39260..08698368e42 100644
--- a/chromium/content/browser/webui/url_data_manager_backend.h
+++ b/chromium/content/browser/webui/url_data_manager_backend.h
@@ -28,13 +28,13 @@ class RefCountedMemory;
 
 namespace content {
 
-class ResourceContext;
+class BrowserContext;
 class URLDataManagerBackend;
 class URLDataSourceImpl;
 
-// URLDataManagerBackend is used internally by ChromeURLDataManager on the IO
+// URLDataManagerBackend is used internally by ChromeURLDataManager on the UI
 // thread. In most cases you can use the API in ChromeURLDataManager and ignore
-// this class. URLDataManagerBackend is owned by ResourceContext.
+// this class. URLDataManagerBackend is owned by BrowserContext.
 class URLDataManagerBackend : public base::SupportsUserData::Data {
  public:
   typedef int RequestID;
@@ -42,6 +42,8 @@ class URLDataManagerBackend : public base::SupportsUserData::Data {
   URLDataManagerBackend();
   ~URLDataManagerBackend() override;
 
+  static URLDataManagerBackend* GetForBrowserContext(BrowserContext* context);
+
   // Adds a DataSource to the collection of data sources.
   void AddDataSource(URLDataSourceImpl* source);
 
@@ -73,8 +75,7 @@ class URLDataManagerBackend : public base::SupportsUserData::Data {
   static std::vector<std::string> GetWebUISchemes();
 
  private:
-  typedef std::map<std::string,
-      scoped_refptr<URLDataSourceImpl> > DataSourceMap;
+  typedef std::map<std::string, scoped_refptr<URLDataSourceImpl>> DataSourceMap;
 
   // Custom sources of data, keyed by source path (e.g. "favicon").
   DataSourceMap data_sources_;
diff --git a/chromium/content/browser/webui/web_ui_browsertest.cc b/chromium/content/browser/webui/web_ui_browsertest.cc
index 9cd02c2a56e..f83f09f8a43 100644
--- a/chromium/content/browser/webui/web_ui_browsertest.cc
+++ b/chromium/content/browser/webui/web_ui_browsertest.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/web_ui_message_handler.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_utils.h"
@@ -288,11 +289,14 @@ IN_PROC_BROWSER_TEST_F(WebUIRequiringGestureBrowserTest,
                        MessageRequiringGestureIgnoresNonInteractiveEvents) {
   // Mouse enter / mouse move / mouse leave should not be considered input
   // events that interact with the page.
-  content::SimulateMouseEvent(web_contents(), blink::WebInputEvent::kMouseEnter,
+  content::SimulateMouseEvent(web_contents(),
+                              blink::WebInputEvent::Type::kMouseEnter,
                               gfx::Point(50, 50));
-  content::SimulateMouseEvent(web_contents(), blink::WebInputEvent::kMouseMove,
+  content::SimulateMouseEvent(web_contents(),
+                              blink::WebInputEvent::Type::kMouseMove,
                               gfx::Point(50, 50));
-  content::SimulateMouseEvent(web_contents(), blink::WebInputEvent::kMouseLeave,
+  content::SimulateMouseEvent(web_contents(),
+                              blink::WebInputEvent::Type::kMouseLeave,
                               gfx::Point(50, 50));
   // Nor should mouse wheel.
   content::SimulateMouseWheelEvent(web_contents(), gfx::Point(50, 50),
diff --git a/chromium/content/browser/webui/web_ui_data_source_impl.cc b/chromium/content/browser/webui/web_ui_data_source_impl.cc
index a64d2247331..6df18f9c6e2 100644
--- a/chromium/content/browser/webui/web_ui_data_source_impl.cc
+++ b/chromium/content/browser/webui/web_ui_data_source_impl.cc
@@ -12,7 +12,7 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/strings/string_util.h"
@@ -53,6 +53,8 @@ std::string CleanUpPath(const std::string& path) {
   return path.substr(0, path.find_first_of('?'));
 }
 
+const int kNonExistentResource = -1;
+
 }  // namespace
 
 // Internal class to hide the fact that WebUIDataSourceImpl implements
@@ -78,28 +80,36 @@ class WebUIDataSourceImpl::InternalDataSource : public URLDataSource {
   }
   bool AllowCaching() override { return false; }
   bool ShouldAddContentSecurityPolicy() override { return parent_->add_csp_; }
-  std::string GetContentSecurityPolicyScriptSrc() override {
-    if (parent_->script_src_set_)
-      return parent_->script_src_;
-    return URLDataSource::GetContentSecurityPolicyScriptSrc();
+  std::string GetContentSecurityPolicyChildSrc() override {
+    return parent_->child_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyChildSrc());
+  }
+  std::string GetContentSecurityPolicyDefaultSrc() override {
+    return parent_->default_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyDefaultSrc());
+  }
+  std::string GetContentSecurityPolicyImgSrc() override {
+    return parent_->img_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyImgSrc());
   }
   std::string GetContentSecurityPolicyObjectSrc() override {
-    if (parent_->object_src_set_)
-      return parent_->object_src_;
-    return URLDataSource::GetContentSecurityPolicyObjectSrc();
+    return parent_->object_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyObjectSrc());
   }
-  std::string GetContentSecurityPolicyChildSrc() override {
-    if (parent_->frame_src_set_)
-      return parent_->frame_src_;
-    return URLDataSource::GetContentSecurityPolicyChildSrc();
+  std::string GetContentSecurityPolicyScriptSrc() override {
+    return parent_->script_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyScriptSrc());
+  }
+  std::string GetContentSecurityPolicyStyleSrc() override {
+    return parent_->style_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyStyleSrc());
   }
   std::string GetContentSecurityPolicyWorkerSrc() override {
-    if (parent_->worker_src_set_)
-      return parent_->worker_src_;
-    return URLDataSource::GetContentSecurityPolicyWorkerSrc();
+    return parent_->worker_src_.value_or(
+        URLDataSource::GetContentSecurityPolicyWorkerSrc());
   }
   std::string GetContentSecurityPolicyFrameAncestors() override {
-    std::string frame_ancestors = "";
+    std::string frame_ancestors;
     if (parent_->frame_ancestors_.size() == 0)
       frame_ancestors += " 'none'";
     for (const GURL& frame_ancestor : parent_->frame_ancestors_) {
@@ -126,10 +136,9 @@ WebUIDataSourceImpl::WebUIDataSourceImpl(const std::string& source_name)
     : URLDataSourceImpl(source_name,
                         std::make_unique<InternalDataSource>(this)),
       source_name_(source_name),
-      default_resource_(-1) {}
+      default_resource_(kNonExistentResource) {}
 
-WebUIDataSourceImpl::~WebUIDataSourceImpl() {
-}
+WebUIDataSourceImpl::~WebUIDataSourceImpl() = default;
 
 void WebUIDataSourceImpl::AddString(base::StringPiece name,
                                     const base::string16& value) {
@@ -205,27 +214,38 @@ void WebUIDataSourceImpl::DisableContentSecurityPolicy() {
   add_csp_ = false;
 }
 
-void WebUIDataSourceImpl::OverrideContentSecurityPolicyScriptSrc(
+void WebUIDataSourceImpl::OverrideContentSecurityPolicyChildSrc(
     const std::string& data) {
-  script_src_set_ = true;
-  script_src_ = data;
+  child_src_ = data;
+}
+
+void WebUIDataSourceImpl::OverrideContentSecurityPolicyDefaultSrc(
+    const std::string& data) {
+  default_src_ = data;
+}
+
+void WebUIDataSourceImpl::OverrideContentSecurityPolicyImgSrc(
+    const std::string& data) {
+  img_src_ = data;
 }
 
 void WebUIDataSourceImpl::OverrideContentSecurityPolicyObjectSrc(
     const std::string& data) {
-  object_src_set_ = true;
   object_src_ = data;
 }
 
-void WebUIDataSourceImpl::OverrideContentSecurityPolicyChildSrc(
+void WebUIDataSourceImpl::OverrideContentSecurityPolicyScriptSrc(
     const std::string& data) {
-  frame_src_set_ = true;
-  frame_src_ = data;
+  script_src_ = data;
+}
+
+void WebUIDataSourceImpl::OverrideContentSecurityPolicyStyleSrc(
+    const std::string& data) {
+  style_src_ = data;
 }
 
 void WebUIDataSourceImpl::OverrideContentSecurityPolicyWorkerSrc(
     const std::string& data) {
-  worker_src_set_ = true;
   worker_src_ = data;
 }
 
@@ -313,10 +333,13 @@ void WebUIDataSourceImpl::StartDataRequest(
   }
 
   int resource_id = PathToIdrOrDefault(CleanUpPath(path));
-  DCHECK_NE(resource_id, -1) << " for " << path;
-  scoped_refptr<base::RefCountedMemory> response(
-      GetContentClient()->GetDataResourceBytes(resource_id));
-  std::move(callback).Run(response.get());
+  if (resource_id == kNonExistentResource) {
+    std::move(callback).Run(nullptr);
+  } else {
+    scoped_refptr<base::RefCountedMemory> response(
+        GetContentClient()->GetDataResourceBytes(resource_id));
+    std::move(callback).Run(response.get());
+  }
 }
 
 void WebUIDataSourceImpl::SendLocalizedStringsAsJSON(
@@ -337,7 +360,24 @@ bool WebUIDataSourceImpl::ShouldReplaceI18nInJS() const {
 
 int WebUIDataSourceImpl::PathToIdrOrDefault(const std::string& path) const {
   auto it = path_to_idr_map_.find(path);
-  return it == path_to_idr_map_.end() ? default_resource_ : it->second;
+  if (it != path_to_idr_map_.end())
+    return it->second;
+
+  if (default_resource_ != kNonExistentResource)
+    return default_resource_;
+
+  // Use GetMimeType() to check for most file requests. It returns text/html by
+  // default regardless of the extension if it does not match a different file
+  // type, so check for HTML file requests separately.
+  if (GetMimeType(path) != "text/html" ||
+      base::EndsWith(path, ".html", base::CompareCase::INSENSITIVE_ASCII)) {
+    return kNonExistentResource;
+  }
+
+  // If not a file request, try to get the resource for the empty key.
+  auto it_empty = path_to_idr_map_.find("");
+  return (it_empty != path_to_idr_map_.end()) ? it_empty->second
+                                              : kNonExistentResource;
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/webui/web_ui_data_source_impl.h b/chromium/content/browser/webui/web_ui_data_source_impl.h
index 2de2fd86ba2..7d8c45420c7 100644
--- a/chromium/content/browser/webui/web_ui_data_source_impl.h
+++ b/chromium/content/browser/webui/web_ui_data_source_impl.h
@@ -45,9 +45,13 @@ class CONTENT_EXPORT WebUIDataSourceImpl : public URLDataSourceImpl,
                             handle_request_callback) override;
   void DisableReplaceExistingSource() override;
   void DisableContentSecurityPolicy() override;
-  void OverrideContentSecurityPolicyScriptSrc(const std::string& data) override;
-  void OverrideContentSecurityPolicyObjectSrc(const std::string& data) override;
   void OverrideContentSecurityPolicyChildSrc(const std::string& data) override;
+  void OverrideContentSecurityPolicyDefaultSrc(
+      const std::string& data) override;
+  void OverrideContentSecurityPolicyImgSrc(const std::string& data) override;
+  void OverrideContentSecurityPolicyObjectSrc(const std::string& data) override;
+  void OverrideContentSecurityPolicyScriptSrc(const std::string& data) override;
+  void OverrideContentSecurityPolicyStyleSrc(const std::string& data) override;
   void OverrideContentSecurityPolicyWorkerSrc(const std::string& data) override;
   void DisableDenyXFrameOptions() override;
   void EnableReplaceI18nInJS() override;
@@ -111,14 +115,14 @@ class CONTENT_EXPORT WebUIDataSourceImpl : public URLDataSourceImpl,
   WebUIDataSource::ShouldHandleRequestCallback should_handle_request_callback_;
 
   bool add_csp_ = true;
-  bool script_src_set_ = false;
-  std::string script_src_;
-  bool object_src_set_ = false;
-  std::string object_src_;
-  bool frame_src_set_ = false;
-  std::string frame_src_;
-  bool worker_src_set_ = false;
-  std::string worker_src_;
+
+  base::Optional<std::string> child_src_;
+  base::Optional<std::string> default_src_;
+  base::Optional<std::string> img_src_;
+  base::Optional<std::string> object_src_;
+  base::Optional<std::string> script_src_;
+  base::Optional<std::string> style_src_;
+  base::Optional<std::string> worker_src_;
   bool deny_xframe_options_ = true;
   bool add_load_time_data_defaults_ = true;
   bool replace_existing_source_ = true;
diff --git a/chromium/content/browser/webui/web_ui_data_source_unittest.cc b/chromium/content/browser/webui/web_ui_data_source_unittest.cc
index 795c73dfcd1..36d70553e12 100644
--- a/chromium/content/browser/webui/web_ui_data_source_unittest.cc
+++ b/chromium/content/browser/webui/web_ui_data_source_unittest.cc
@@ -17,10 +17,12 @@ namespace {
 const int kDummyStringId = 123;
 const int kDummyDefaultResourceId = 456;
 const int kDummyResourceId = 789;
+const int kDummyJSResourceId = 790;
 
 const char kDummyString[] = "foo";
 const char kDummyDefaultResource[] = "<html>foo</html>";
 const char kDummyResource[] = "<html>blah</html>";
+const char kDummyJSResource[] = "export const bar = 5;";
 
 class TestClient : public TestContentClient {
  public:
@@ -40,6 +42,9 @@ class TestClient : public TestContentClient {
     } else if (resource_id == kDummyResourceId) {
       bytes = new base::RefCountedStaticMemory(kDummyResource,
                                                base::size(kDummyResource));
+    } else if (resource_id == kDummyJSResourceId) {
+      bytes = new base::RefCountedStaticMemory(kDummyJSResource,
+                                               base::size(kDummyJSResource));
     }
     return bytes;
   }
@@ -79,8 +84,8 @@ class WebUIDataSourceTest : public testing::Test {
   void SetUp() override {
     SetContentClient(&client_);
     WebUIDataSource* source = WebUIDataSourceImpl::Create("host");
-    WebUIDataSourceImpl* source_impl = static_cast<WebUIDataSourceImpl*>(
-        source);
+    WebUIDataSourceImpl* source_impl =
+        static_cast<WebUIDataSourceImpl*>(source);
     source_impl->disable_load_time_data_defaults_for_testing();
     source_ = base::WrapRefCounted(source_impl);
   }
@@ -228,4 +233,82 @@ TEST_F(WebUIDataSourceTest, ShouldServeMimeTypeAsContentTypeHeader) {
   EXPECT_TRUE(source()->source()->ShouldServeMimeTypeAsContentTypeHeader());
 }
 
+void InvalidResourceCallback(scoped_refptr<base::RefCountedMemory> data) {
+  EXPECT_EQ(nullptr, data);
+}
+
+void NamedResourceBarJSCallback(scoped_refptr<base::RefCountedMemory> data) {
+  std::string result(data->front_as<char>(), data->size());
+  EXPECT_NE(result.find(kDummyJSResource), std::string::npos);
+}
+
+TEST_F(WebUIDataSourceTest, NoSetDefaultResource) {
+  // Set an empty path resource instead of a default.
+  source()->AddResourcePath("", kDummyDefaultResourceId);
+  source()->AddResourcePath("foobar.html", kDummyResourceId);
+  source()->AddResourcePath("bar.js", kDummyJSResourceId);
+
+  // Empty paths return the resource for the empty path.
+  StartDataRequest("", base::BindOnce(&DefaultResourceFoobarCallback));
+  StartDataRequest("/", base::BindOnce(&DefaultResourceFoobarCallback));
+  // Un-mapped path that does not look like a file request also returns the
+  // resource associated with the empty path.
+  StartDataRequest("subpage", base::BindOnce(&DefaultResourceFoobarCallback));
+  // Paths that are valid filenames succeed and return the file contents.
+  StartDataRequest("foobar.html", base::BindOnce(&NamedResourceFoobarCallback));
+  StartDataRequest("bar.js", base::BindOnce(&NamedResourceBarJSCallback));
+  // Invalid file requests fail
+  StartDataRequest("does_not_exist.html",
+                   base::BindOnce(&InvalidResourceCallback));
+  StartDataRequest("does_not_exist.js",
+                   base::BindOnce(&InvalidResourceCallback));
+
+  // strings.m.js fails until UseStringsJs is called.
+  StartDataRequest("strings.m.js", base::BindOnce(&InvalidResourceCallback));
+  source()->UseStringsJs();
+  StartDataRequest("strings.m.js", base::BindOnce(&EmptyStringsCallback, true));
+}
+
+TEST_F(WebUIDataSourceTest, SetCspValues) {
+  URLDataSource* url_data_source = source()->source();
+
+  // Default values.
+  EXPECT_EQ("child-src 'none';",
+            url_data_source->GetContentSecurityPolicyChildSrc());
+  EXPECT_EQ("", url_data_source->GetContentSecurityPolicyDefaultSrc());
+  EXPECT_EQ("", url_data_source->GetContentSecurityPolicyImgSrc());
+  EXPECT_EQ("object-src 'none';",
+            url_data_source->GetContentSecurityPolicyObjectSrc());
+  EXPECT_EQ("script-src chrome://resources 'self';",
+            url_data_source->GetContentSecurityPolicyScriptSrc());
+  EXPECT_EQ("", url_data_source->GetContentSecurityPolicyStyleSrc());
+
+  // Override each directive and test it updates the underlying URLDataSource.
+  source()->OverrideContentSecurityPolicyChildSrc("child-src 'self';");
+  EXPECT_EQ("child-src 'self';",
+            url_data_source->GetContentSecurityPolicyChildSrc());
+
+  source()->OverrideContentSecurityPolicyDefaultSrc("default-src 'self';");
+  EXPECT_EQ("default-src 'self';",
+            url_data_source->GetContentSecurityPolicyDefaultSrc());
+
+  source()->OverrideContentSecurityPolicyImgSrc("img-src 'self' blob:;");
+  EXPECT_EQ("img-src 'self' blob:;",
+            url_data_source->GetContentSecurityPolicyImgSrc());
+
+  source()->OverrideContentSecurityPolicyObjectSrc("object-src 'self' data:;");
+  EXPECT_EQ("object-src 'self' data:;",
+            url_data_source->GetContentSecurityPolicyObjectSrc());
+
+  source()->OverrideContentSecurityPolicyScriptSrc(
+      "script-src chrome://resources 'self' 'unsafe-inline';");
+  EXPECT_EQ("script-src chrome://resources 'self' 'unsafe-inline';",
+            url_data_source->GetContentSecurityPolicyScriptSrc());
+
+  source()->OverrideContentSecurityPolicyStyleSrc(
+      "style-src 'self' 'unsafe-inline';");
+  EXPECT_EQ("style-src 'self' 'unsafe-inline';",
+            url_data_source->GetContentSecurityPolicyStyleSrc());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/webui/web_ui_message_handler.cc b/chromium/content/browser/webui/web_ui_message_handler.cc
index 8c88995877d..fc0ef4e8ae2 100644
--- a/chromium/content/browser/webui/web_ui_message_handler.cc
+++ b/chromium/content/browser/webui/web_ui_message_handler.cc
@@ -4,7 +4,8 @@
 
 #include "content/public/browser/web_ui_message_handler.h"
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
diff --git a/chromium/content/browser/webui/web_ui_mojo_browsertest.cc b/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
index f2ded300cce..821e91edc31 100644
--- a/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
@@ -32,15 +32,16 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
+#include "mojo/public/cpp/bindings/binder_map.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver.h"
-#include "services/service_manager/public/cpp/binder_map.h"
 
 namespace content {
 namespace {
@@ -247,8 +248,7 @@ class TestWebUIContentBrowserClient : public ContentBrowserClient {
 
   void RegisterBrowserInterfaceBindersForFrame(
       RenderFrameHost* render_frame_host,
-      service_manager::BinderMapWithContext<content::RenderFrameHost*>* map)
-      override {
+      mojo::BinderMapWithContext<content::RenderFrameHost*>* map) override {
     map->Add<mojom::BrowserTarget>(
         base::BindRepeating(&TestWebUIContentBrowserClient::BindBrowserTarget,
                             base::Unretained(this)));
diff --git a/chromium/content/browser/webui/web_ui_navigation_browsertest.cc b/chromium/content/browser/webui/web_ui_navigation_browsertest.cc
index 6321098de1e..6d0542244bf 100644
--- a/chromium/content/browser/webui/web_ui_navigation_browsertest.cc
+++ b/chromium/content/browser/webui/web_ui_navigation_browsertest.cc
@@ -4,6 +4,7 @@
 
 #include "base/command_line.h"
 #include "base/macros.h"
+#include "build/build_config.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -11,6 +12,7 @@
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -50,23 +52,29 @@ class WebUINavigationBrowserTest : public ContentBrowserTest {
     ASSERT_TRUE(embedded_test_server()->Start());
   }
 
-  // Verify that no web content can be loaded in a process that has WebUI
-  // bindings, regardless of what scheme the content was loaded from.
-  void TestWebFrameInWebUIProcessDisallowed(int bindings) {
+  // Verify that a document running in a process that has WebUI bindings,
+  // regardless of scheme, can navigate an iframe to web content and the
+  // resulting document is properly site isolated.
+  // Note: The goal of test is to verify that isolation works correctly even
+  // if somehow non-WebUI scheme gets granted WebUI bindings. See also
+  // WebFrameInChromeSchemeIsAllowed, which tests the more typical case of a
+  // WebUI scheme embedding a web iframe.
+  void TestWebFrameInProcessWithWebUIBindings(int bindings) {
     FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                               ->GetFrameTree()
                               ->root();
-    GURL data_url("data:text/html,a data url document");
-    EXPECT_TRUE(NavigateToURL(shell(), data_url));
-    EXPECT_EQ(data_url, root->current_frame_host()->GetLastCommittedURL());
+    // Start navigating to foo.com in the main frame.
+    GURL foo_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell(), foo_url));
+    EXPECT_EQ(foo_url, root->current_frame_host()->GetLastCommittedURL());
     EXPECT_FALSE(
         ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
             root->current_frame_host()->GetProcess()->GetID()));
 
     // Grant WebUI bindings to the process. This will ensure that if there is
     // a mistake in the navigation logic and a process gets somehow WebUI
-    // bindings, it cannot include web content regardless of the scheme of the
-    // document.
+    // bindings, the web content is correctly isolated regardless of the scheme
+    // of the parent document.
     ChildProcessSecurityPolicyImpl::GetInstance()->GrantWebUIBindings(
         root->current_frame_host()->GetProcess()->GetID(), bindings);
     EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
@@ -84,7 +92,13 @@ class WebUINavigationBrowserTest : public ContentBrowserTest {
       navigation_observer.Wait();
 
       EXPECT_EQ(1U, root->child_count());
-      EXPECT_FALSE(navigation_observer.last_navigation_succeeded());
+      EXPECT_TRUE(navigation_observer.last_navigation_succeeded());
+      EXPECT_EQ(web_url, navigation_observer.last_navigation_url());
+      EXPECT_NE(root->current_frame_host()->GetSiteInstance(),
+                root->child_at(0)->current_frame_host()->GetSiteInstance());
+      EXPECT_FALSE(
+          ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+              root->child_at(0)->current_frame_host()->GetProcess()->GetID()));
     }
   }
 
@@ -167,10 +181,11 @@ class WebUINavigationBrowserTest : public ContentBrowserTest {
   DISALLOW_COPY_AND_ASSIGN(WebUINavigationBrowserTest);
 };
 
-// Verify that a chrome: scheme document cannot add iframes with web content.
-// See https://crbug.com/683418.
+// Verify that a chrome: scheme document can add iframes with web content, as
+// long as X-Frame-Options and the default Content-Security-Policy are
+// overridden to allow the frame to be embedded.
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
-                       WebFrameInChromeSchemeDisallowed) {
+                       WebFrameInChromeSchemeIsAllowed) {
   // Serve a WebUI with no iframe restrictions.
   GURL main_frame_url(GetWebUIURL("web-ui/title1.html?noxfo=true&childsrc="));
   EXPECT_TRUE(NavigateToURL(shell(), main_frame_url));
@@ -180,44 +195,28 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
                             ->root();
   EXPECT_EQ(BINDINGS_POLICY_WEB_UI,
             root->current_frame_host()->GetEnabledBindings());
+  EXPECT_EQ(0UL, root->child_count());
 
-  // Navigate to a Web URL and verify that the navigation was blocked.
+  // Navigate to a Web URL and verify that the navigation is allowed.
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL web_url(embedded_test_server()->GetURL("/title2.html"));
     EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, web_url),
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
     observer.Wait();
-    EXPECT_FALSE(observer.last_navigation_succeeded());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(1UL, root->child_count());
   }
 
-  // Navigate to a data URL and verify that the navigation was blocked.
+  // Navigate to a data URL and verify that the navigation is allowed.
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL data_url("data:text/html,foo");
     EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, data_url),
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
     observer.Wait();
-    EXPECT_FALSE(observer.last_navigation_succeeded());
-  }
-
-  // Navigate to a chrome-untrusted URL and verify that the navigation was
-  // blocked. This tests the Frame::BeginNavigation path.
-  {
-    TestNavigationObserver observer(shell()->web_contents());
-    TestUntrustedDataSourceCSP csp;
-    csp.no_xfo = true;
-    // Add a DataSource for chrome-untrusted:// that can be iframe'd.
-    AddUntrustedDataSource(shell()->web_contents()->GetBrowserContext(),
-                           "test-host", csp);
-    GURL untrusted_url(GetChromeUntrustedUIURL("test-host/title1.html"));
-
-    EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, untrusted_url),
-                       EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    observer.Wait();
-
-    RenderFrameHost* child = root->child_at(2)->current_frame_host();
-    EXPECT_EQ(kBlockedURL, child->GetLastCommittedURL());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(2UL, root->child_count());
   }
 
   // Verify that an iframe with "about:blank" URL is actually allowed. Not
@@ -231,6 +230,7 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
     observer.Wait();
     EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(3UL, root->child_count());
   }
 }
 
@@ -477,14 +477,13 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
         embedded_test_server()->GetURL("/title1.html?childsrc="));
     ASSERT_TRUE(NavigateToURL(web_contents, main_frame_url));
 
-    auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-        web_contents,
-        "Not allowed to load local resource: " + iframe_url.spec());
-    web_contents->SetDelegate(console_delegate.get());
+    WebContentsConsoleObserver console_observer(web_contents);
+    console_observer.SetPattern("Not allowed to load local resource: " +
+                                iframe_url.spec());
 
     EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, iframe_url),
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    console_delegate->Wait();
+    console_observer.Wait();
 
     FrameTreeNode* root =
         static_cast<WebContentsImpl*>(web_contents)->GetFrameTree()->root();
@@ -529,14 +528,13 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
         embedded_test_server()->GetURL("/title1.html?childsrc="));
     EXPECT_TRUE(NavigateToURL(shell(), main_frame_url));
 
-    auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-        web_contents,
-        "Not allowed to load local resource: " + iframe_url.spec());
-    web_contents->SetDelegate(console_delegate.get());
+    WebContentsConsoleObserver console_observer(web_contents);
+    console_observer.SetPattern("Not allowed to load local resource: " +
+                                iframe_url.spec());
 
     EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, iframe_url),
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    console_delegate->Wait();
+    console_observer.Wait();
 
     FrameTreeNode* root =
         static_cast<WebContentsImpl*>(web_contents)->GetFrameTree()->root();
@@ -578,14 +576,13 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
     GURL main_frame_url(
         embedded_test_server()->GetURL("/title1.html?childsrc="));
     ASSERT_TRUE(NavigateToURL(web_contents, main_frame_url));
-    auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-        web_contents,
-        "Not allowed to load local resource: " + iframe_url.spec());
-    web_contents->SetDelegate(console_delegate.get());
+    WebContentsConsoleObserver console_observer(web_contents);
+    console_observer.SetPattern("Not allowed to load local resource: " +
+                                iframe_url.spec());
 
     EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, iframe_url),
                        EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    console_delegate->Wait();
+    console_observer.Wait();
 
     FrameTreeNode* root =
         static_cast<WebContentsImpl*>(web_contents)->GetFrameTree()->root();
@@ -595,10 +592,47 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
   }
 }
 
+// Verify that default WebUI cannot embed chrome-untrusted: iframes. To allow
+// embedding, WebUI needs to call AddRequestableScheme to explicitly allow it.
+IN_PROC_BROWSER_TEST_F(
+    WebUINavigationBrowserTest,
+    ChromeUntrustedFrameInChromeSchemeDisallowedInDefaultWebUI) {
+  // Serve a WebUI with no iframe restrictions.
+  GURL main_frame_url(GetWebUIURL("web-ui/title1.html?noxfo=true&childsrc="));
+  EXPECT_TRUE(NavigateToURL(shell(), main_frame_url));
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  EXPECT_EQ(BINDINGS_POLICY_WEB_UI,
+            root->current_frame_host()->GetEnabledBindings());
+  EXPECT_EQ(0UL, root->child_count());
+
+  // Add a DataSource for chrome-untrusted:// that can be iframe'd.
+  TestUntrustedDataSourceCSP csp;
+  csp.no_xfo = true;
+  AddUntrustedDataSource(shell()->web_contents()->GetBrowserContext(),
+                         "test-host", csp);
+  GURL untrusted_url(GetChromeUntrustedUIURL("test-host/title1.html"));
+
+  // Navigate an iframe to a chrome-untrusted URL and verify that the navigation
+  // was blocked. This tests the Frame::BeginNavigation path.
+  TestNavigationObserver observer(shell()->web_contents());
+  EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, untrusted_url),
+                     EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
+  observer.Wait();
+  EXPECT_EQ(1UL, root->child_count());
+
+  RenderFrameHost* child = root->child_at(0)->current_frame_host();
+  EXPECT_EQ(kBlockedURL, child->GetLastCommittedURL());
+}
+
 // Verify that a chrome-untrusted:// scheme iframe can be embedded in chrome://
-// frame.
+// frame. The test needs to specify requestableschemes parameter to the main
+// frame WebUI URL, which will result in a call to AddRequestableScheme and
+// permit the embedding to work.
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
-                       ChromeUntrustedWebFrameInChromeSchemeAllowed) {
+                       ChromeUntrustedFrameInChromeSchemeAllowed) {
   // Serve a WebUI with no iframe restrictions.
   GURL main_frame_url(
       GetWebUIURL("web-ui/"
@@ -648,16 +682,15 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_frame_url));
 
   GURL webui_url(GetWebUIURL("web-ui/title1.html?noxfo=true"));
-  auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-      shell()->web_contents(),
-      "Not allowed to load local resource: " + webui_url.spec());
-  shell()->web_contents()->SetDelegate(console_delegate.get());
+  WebContentsConsoleObserver console_observer(shell()->web_contents());
+  console_observer.SetPattern("Not allowed to load local resource: " +
+                              webui_url.spec());
 
   // Add iframe and navigate it to a chrome:// URL and verify that the
   // navigation was blocked.
   EXPECT_TRUE(ExecJs(shell(), JsReplace(kAddIframeScript, webui_url),
                      EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-  console_delegate->Wait();
+  console_observer.Wait();
 
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                             ->GetFrameTree()
@@ -834,21 +867,25 @@ IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest, WebUIMainFrameToWebAllowed) {
             webui_site_instance->GetSiteURL());
 }
 
+#if !defined(OS_ANDROID)
+// The following tests rely on full site isolation behavior, which is not
+// present on Android.
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
-                       WebFrameInWebUIProcessDisallowed) {
-  TestWebFrameInWebUIProcessDisallowed(BINDINGS_POLICY_WEB_UI);
+                       WebFrameInWebUIProcessAllowed) {
+  TestWebFrameInProcessWithWebUIBindings(BINDINGS_POLICY_WEB_UI);
 }
 
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
-                       WebFrameInMojoWebUIProcessDisallowed) {
-  TestWebFrameInWebUIProcessDisallowed(BINDINGS_POLICY_MOJO_WEB_UI);
+                       WebFrameInMojoWebUIProcessAllowed) {
+  TestWebFrameInProcessWithWebUIBindings(BINDINGS_POLICY_MOJO_WEB_UI);
 }
 
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
-                       WebFrameInHybridWebUIProcessDisallowed) {
-  TestWebFrameInWebUIProcessDisallowed(BINDINGS_POLICY_MOJO_WEB_UI |
-                                       BINDINGS_POLICY_WEB_UI);
+                       WebFrameInHybridWebUIProcessAllowed) {
+  TestWebFrameInProcessWithWebUIBindings(BINDINGS_POLICY_MOJO_WEB_UI |
+                                         BINDINGS_POLICY_WEB_UI);
 }
+#endif
 
 IN_PROC_BROWSER_TEST_F(WebUINavigationBrowserTest,
                        WebUISubframeNewWindowToWebAllowed) {
diff --git a/chromium/content/browser/webui/web_ui_security_browsertest.cc b/chromium/content/browser/webui/web_ui_security_browsertest.cc
index bf7b889c12f..8e53304c2ab 100644
--- a/chromium/content/browser/webui/web_ui_security_browsertest.cc
+++ b/chromium/content/browser/webui/web_ui_security_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/memory/ref_counted_memory.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/threading/thread_restrictions.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/frame_tree_node.h"
@@ -18,7 +19,9 @@
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/browser/web_ui_data_source.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -448,16 +451,15 @@ IN_PROC_BROWSER_TEST_F(WebUISecurityTest,
       "})();";
   {
     GURL untrusted_url(GetChromeUntrustedUIURL("test-host/script.js"));
-    auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-        shell()->web_contents(),
+    WebContentsConsoleObserver console_observer(shell()->web_contents());
+    console_observer.SetPattern(
         "Fetch API cannot load " + untrusted_url.spec() +
-            ". URL scheme must be \"http\" or \"https\" for CORS request.");
-    shell()->web_contents()->SetDelegate(console_delegate.get());
+        ". URL scheme must be \"http\" or \"https\" for CORS request.");
 
     EXPECT_EQ("Failed to fetch",
               EvalJs(shell(), JsReplace(kFetchRequestScript, untrusted_url),
                      EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    console_delegate->Wait();
+    console_observer.Wait();
   }
 }
 
@@ -487,18 +489,17 @@ IN_PROC_BROWSER_TEST_F(WebUISecurityTest, DisallowXHRRequestToChromeUntrusted) {
     GURL untrusted_url(GetChromeUntrustedUIURL("test-host/script.js"));
     const std::string host = web_url.GetOrigin().spec();
 
-    auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
-        shell()->web_contents(),
+    WebContentsConsoleObserver console_observer(shell()->web_contents());
+    console_observer.SetPattern(
         "Access to XMLHttpRequest at '" + untrusted_url.spec() +
-            "' from origin '" + host.substr(0, host.length() - 1) +
-            "' has been blocked by CORS policy: Cross origin requests are only "
-            "supported for protocol schemes: http, data, chrome, https.");
+        "' from origin '" + host.substr(0, host.length() - 1) +
+        "' has been blocked by CORS policy: Cross origin requests are only "
+        "supported for protocol schemes: http, data, chrome, https.");
 
-    shell()->web_contents()->SetDelegate(console_delegate.get());
     EXPECT_EQ("Request failed",
               EvalJs(shell(), JsReplace(kXHRRequest, untrusted_url),
                      EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
-    console_delegate->Wait();
+    console_observer.Wait();
   }
 }
 
@@ -536,4 +537,45 @@ IN_PROC_BROWSER_TEST_F(WebUISecurityTest,
   }
 }
 
+class WebUISecurityTestWithWebUIReportOnlyTrustedTypesEnabled
+    : public WebUISecurityTest {
+ public:
+  WebUISecurityTestWithWebUIReportOnlyTrustedTypesEnabled() {
+    feature_list_.InitAndEnableFeature(features::kWebUIReportOnlyTrustedTypes);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Verify Report-Only Trusted Types won't block assignment to a dangerous sink,
+// but logs warning
+IN_PROC_BROWSER_TEST_F(WebUISecurityTestWithWebUIReportOnlyTrustedTypesEnabled,
+                       DoNotBlockSinkAssignmentOnReportOnlyTrustedTypes) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL test_url(GetWebUIURL("web-ui/title1.html"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  const char kDangerousSinkUse[] =
+      "(() => {"
+      "  try {"
+      "    document.body.innerHTML = 1;"
+      "    return 'Assignment succeeded';"
+      "  } catch(e) {"
+      "    throw 'Assignment should have succeeded';"
+      "  }"
+      "})();";
+  {
+    WebContentsConsoleObserver console_observer(shell()->web_contents());
+    console_observer.SetPattern(
+        "[Report Only] This document requires 'TrustedHTML' assignment.");
+
+    EXPECT_EQ("Assignment succeeded",
+              EvalJs(shell(), kDangerousSinkUse, EXECUTE_SCRIPT_DEFAULT_OPTIONS,
+                     1 /* world_id */));
+    console_observer.Wait();
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/webui/web_ui_url_loader_factory.cc b/chromium/content/browser/webui/web_ui_url_loader_factory.cc
index 42cb1212746..1814672916a 100644
--- a/chromium/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/chromium/content/browser/webui/web_ui_url_loader_factory.cc
@@ -36,7 +36,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/network/public/cpp/content_security_policy/content_security_policy.h"
+#include "services/network/public/cpp/parsed_headers.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "ui/base/template_expressions.h"
 
@@ -151,7 +151,7 @@ void StartURLLoader(
     const network::ResourceRequest& request,
     int frame_tree_node_id,
     mojo::PendingRemote<network::mojom::URLLoaderClient> client_remote,
-    ResourceContext* resource_context) {
+    BrowserContext* browser_context) {
   // NOTE: this duplicates code in URLDataManagerBackend::StartRequest.
   if (!URLDataManagerBackend::CheckURLIsValid(request.url)) {
     CallOnError(std::move(client_remote), net::ERR_INVALID_URL);
@@ -159,14 +159,14 @@ void StartURLLoader(
   }
 
   URLDataSourceImpl* source =
-      GetURLDataManagerForResourceContext(resource_context)
+      URLDataManagerBackend::GetForBrowserContext(browser_context)
           ->GetDataSourceFromURL(request.url);
   if (!source) {
     CallOnError(std::move(client_remote), net::ERR_INVALID_URL);
     return;
   }
 
-  if (!source->source()->ShouldServiceRequest(request.url, resource_context,
+  if (!source->source()->ShouldServiceRequest(request.url, browser_context,
                                               -1)) {
     CallOnError(std::move(client_remote), net::ERR_INVALID_URL);
     return;
@@ -180,10 +180,12 @@ void StartURLLoader(
       URLDataManagerBackend::GetHeaders(source, path, origin_header);
 
   auto resource_response = network::mojom::URLResponseHead::New();
-  network::AddContentSecurityPolicyFromHeaders(
-      *headers, request.url, &(resource_response->content_security_policy));
 
   resource_response->headers = headers;
+  // Headers from WebUI are trusted, so parsing can happen from a non-sandboxed
+  // process.
+  resource_response->parsed_headers =
+      network::PopulateParsedHeaders(resource_response->headers, request.url);
   resource_response->mime_type = source->source()->GetMimeType(path);
   // TODO: fill all the time related field i.e. request_time response_time
   // request_start response_start
@@ -206,24 +208,8 @@ void StartURLLoader(
       DataAvailable, std::move(resource_response), replacements, replace_in_js,
       base::RetainedRef(source), std::move(client_remote));
 
-  // TODO(jam): once we only have this code path for WebUI, and not the
-  // URLLRequestJob one, then we should switch data sources to run on the UI
-  // thread by default.
-  scoped_refptr<base::SingleThreadTaskRunner> target_runner =
-      source->source()->TaskRunnerForRequestPath(path);
-  if (!target_runner) {
-    source->source()->StartDataRequest(request.url, std::move(wc_getter),
-                                       std::move(data_available_callback));
-    return;
-  }
-
-  // The DataSource wants StartDataRequest to be called on a specific
-  // thread, usually the UI thread, for this path.
-  target_runner->PostTask(
-      FROM_HERE,
-      base::BindOnce(&URLDataSource::StartDataRequest,
-                     base::Unretained(source->source()), request.url,
-                     std::move(wc_getter), std::move(data_available_callback)));
+  source->source()->StartDataRequest(request.url, std::move(wc_getter),
+                                     std::move(data_available_callback));
 }
 
 class WebUIURLLoaderFactory : public network::mojom::URLLoaderFactory,
@@ -305,12 +291,8 @@ class WebUIURLLoaderFactory : public network::mojom::URLLoaderFactory,
     // from frames can happen while the RFH is changed for a cross-process
     // navigation. The URLDataSources just need the WebContents; the specific
     // frame doesn't matter.
-    base::PostTask(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(
-            &StartURLLoader, request, render_frame_host_->GetFrameTreeNodeId(),
-            std::move(client),
-            GetStoragePartition()->browser_context()->GetResourceContext()));
+    StartURLLoader(request, render_frame_host_->GetFrameTreeNodeId(),
+                   std::move(client), GetStoragePartition()->browser_context());
   }
 
   void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.cc b/chromium/content/browser/worker_host/dedicated_worker_host.cc
index e037c3e3baa..e253fb829ec 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.cc
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.cc
@@ -23,6 +23,7 @@
 #include "content/browser/worker_host/dedicated_worker_service_impl.h"
 #include "content/browser/worker_host/worker_script_fetch_initiator.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/idle_manager.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/service_worker_context.h"
@@ -31,7 +32,7 @@
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
-#include "net/base/network_isolation_key.h"
+#include "net/base/isolation_info.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/loader/fetch_client_settings_object.mojom.h"
 #include "third_party/blink/public/mojom/usb/web_usb_service.mojom.h"
@@ -143,9 +144,6 @@ void DedicatedWorkerHost::StartScriptLoad(
     return;
   }
 
-  network_isolation_key_ =
-      nearest_ancestor_render_frame_host->GetNetworkIsolationKey();
-
   // Get a storage domain.
   SiteInstance* site_instance =
       nearest_ancestor_render_frame_host->GetSiteInstance();
@@ -204,13 +202,15 @@ void DedicatedWorkerHost::StartScriptLoad(
   file_url_support_ = creator_origin_.scheme() == url::kFileScheme;
 
   service_worker_handle_ = std::make_unique<ServiceWorkerMainResourceHandle>(
-      storage_partition_impl->GetServiceWorkerContext());
+      storage_partition_impl->GetServiceWorkerContext(), base::DoNothing());
 
   WorkerScriptFetchInitiator::Start(
-      worker_process_host_->GetID(), script_url, creator_render_frame_host,
+      worker_process_host_->GetID(), id_, SharedWorkerId(), script_url,
+      creator_render_frame_host,
       nearest_ancestor_render_frame_host->ComputeSiteForCookies(),
-      creator_origin_, network_isolation_key_, credentials_mode,
-      std::move(outside_fetch_client_settings_object),
+      creator_origin_,
+      nearest_ancestor_render_frame_host->GetIsolationInfoForSubresources(),
+      credentials_mode, std::move(outside_fetch_client_settings_object),
       blink::mojom::ResourceType::kWorker,
       storage_partition_impl->GetServiceWorkerContext(),
       service_worker_handle_.get(),
@@ -371,7 +371,7 @@ void DedicatedWorkerHost::CreateWebSocketConnector(
       std::make_unique<WebSocketConnectorImpl>(
           ancestor_render_frame_host_id_.child_id,
           ancestor_render_frame_host_id_.frame_routing_id, worker_origin_,
-          network_isolation_key_),
+          ancestor_render_frame_host->GetIsolationInfoForSubresources()),
       std::move(receiver));
 }
 
@@ -385,10 +385,12 @@ void DedicatedWorkerHost::CreateQuicTransportConnector(
     // will soon be terminated too, so abort the connection.
     return;
   }
-  mojo::MakeSelfOwnedReceiver(std::make_unique<QuicTransportConnectorImpl>(
-                                  worker_process_host_->GetID(), worker_origin_,
-                                  network_isolation_key_),
-                              std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<QuicTransportConnectorImpl>(
+          worker_process_host_->GetID(), /*frame=*/nullptr, worker_origin_,
+          ancestor_render_frame_host->GetIsolationInfoForSubresources()
+              .network_isolation_key()),
+      std::move(receiver));
 }
 
 void DedicatedWorkerHost::CreateWakeLockService(
@@ -445,7 +447,9 @@ void DedicatedWorkerHost::CreateIdleManager(
   static_cast<StoragePartitionImpl*>(
       ancestor_render_frame_host->GetProcess()->GetStoragePartition())
       ->GetIdleManager()
-      ->CreateService(std::move(receiver));
+      ->CreateService(
+          std::move(receiver),
+          ancestor_render_frame_host->GetMainFrame()->GetLastCommittedOrigin());
 }
 
 void DedicatedWorkerHost::BindSmsReceiverReceiver(
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.h b/chromium/content/browser/worker_host/dedicated_worker_host.h
index 5261966fe7b..2e9e168b0b1 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.h
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.h
@@ -11,7 +11,7 @@
 #include "base/scoped_observer.h"
 #include "build/build_config.h"
 #include "content/browser/browser_interface_broker_impl.h"
-#include "content/public/browser/dedicated_worker_service.h"
+#include "content/public/browser/dedicated_worker_id.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_process_host_observer.h"
@@ -206,10 +206,6 @@ class DedicatedWorkerHost final : public blink::mojom::DedicatedWorkerHost,
   // https://html.spec.whatwg.org/C/#concept-settings-object-origin
   const url::Origin worker_origin_;
 
-  // The network isolation key to be used for both the worker script and the
-  // worker's subresources.
-  net::NetworkIsolationKey network_isolation_key_;
-
   // The DedicatedWorker's Cross-Origin-Embedder-Policy(COEP). It is equals to
   // the nearest ancestor frame host's COEP:
   // https://mikewest.github.io/corpp/#initialize-embedder-policy-for-global
diff --git a/chromium/content/browser/worker_host/mock_shared_worker.cc b/chromium/content/browser/worker_host/mock_shared_worker.cc
index 3c6220be29e..7425cb6cafb 100644
--- a/chromium/content/browser/worker_host/mock_shared_worker.cc
+++ b/chromium/content/browser/worker_host/mock_shared_worker.cc
@@ -53,7 +53,7 @@ bool MockSharedWorker::CheckReceivedTerminate() {
 }
 
 void MockSharedWorker::Connect(int connection_request_id,
-                               mojo::ScopedMessagePipeHandle port) {
+                               blink::MessagePortDescriptor port) {
   connect_received_.emplace(connection_request_id,
                             blink::MessagePortChannel(std::move(port)));
 }
diff --git a/chromium/content/browser/worker_host/mock_shared_worker.h b/chromium/content/browser/worker_host/mock_shared_worker.h
index 15e89f17969..318611b50d7 100644
--- a/chromium/content/browser/worker_host/mock_shared_worker.h
+++ b/chromium/content/browser/worker_host/mock_shared_worker.h
@@ -48,7 +48,7 @@ class MockSharedWorker : public blink::mojom::SharedWorker {
  private:
   // blink::mojom::SharedWorker methods:
   void Connect(int connection_request_id,
-               mojo::ScopedMessagePipeHandle port) override;
+               blink::MessagePortDescriptor port) override;
   void Terminate() override;
 
   mojo::Receiver<blink::mojom::SharedWorker> receiver_;
diff --git a/chromium/content/browser/worker_host/shared_worker_connector_impl.cc b/chromium/content/browser/worker_host/shared_worker_connector_impl.cc
index 8d3d211ae47..acd7f2c0f2b 100644
--- a/chromium/content/browser/worker_host/shared_worker_connector_impl.cc
+++ b/chromium/content/browser/worker_host/shared_worker_connector_impl.cc
@@ -36,7 +36,7 @@ void SharedWorkerConnectorImpl::Connect(
     blink::mojom::SharedWorkerInfoPtr info,
     mojo::PendingRemote<blink::mojom::SharedWorkerClient> client,
     blink::mojom::SharedWorkerCreationContextType creation_context_type,
-    mojo::ScopedMessagePipeHandle message_port,
+    blink::MessagePortDescriptor message_port,
     mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) {
   RenderProcessHost* host =
       RenderProcessHost::FromID(client_render_frame_host_id_.child_id);
diff --git a/chromium/content/browser/worker_host/shared_worker_connector_impl.h b/chromium/content/browser/worker_host/shared_worker_connector_impl.h
index f2e7e1c7fb4..de148d8582e 100644
--- a/chromium/content/browser/worker_host/shared_worker_connector_impl.h
+++ b/chromium/content/browser/worker_host/shared_worker_connector_impl.h
@@ -9,6 +9,7 @@
 #include "content/public/browser/global_routing_id.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
 #include "third_party/blink/public/mojom/worker/shared_worker_connector.mojom.h"
 
 namespace content {
@@ -31,7 +32,7 @@ class CONTENT_EXPORT SharedWorkerConnectorImpl
       blink::mojom::SharedWorkerInfoPtr info,
       mojo::PendingRemote<blink::mojom::SharedWorkerClient> client,
       blink::mojom::SharedWorkerCreationContextType creation_context_type,
-      mojo::ScopedMessagePipeHandle message_port,
+      blink::MessagePortDescriptor message_port,
       mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) override;
 
   const GlobalFrameRoutingId client_render_frame_host_id_;
diff --git a/chromium/content/browser/worker_host/shared_worker_host.cc b/chromium/content/browser/worker_host/shared_worker_host.cc
index 80b7e236313..5350ebb2cbc 100644
--- a/chromium/content/browser/worker_host/shared_worker_host.cc
+++ b/chromium/content/browser/worker_host/shared_worker_host.cc
@@ -30,7 +30,8 @@
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/common/content_client.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
-#include "net/base/network_isolation_key.h"
+#include "net/base/isolation_info.h"
+#include "net/cookies/site_for_cookies.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
@@ -100,7 +101,7 @@ SharedWorkerHost::SharedWorkerHost(SharedWorkerServiceImpl* service,
       scoped_process_host_observer_(this),
       next_connection_request_id_(1) {
   DCHECK(worker_process_host_);
-  DCHECK(!IsShuttingDown(worker_process_host_));
+  DCHECK(worker_process_host_->IsInitializedAndNotDead());
 
   // Set up the worker pending receiver. This is needed first in either
   // AddClient() or Start(). AddClient() can sometimes be called before Start()
@@ -263,13 +264,16 @@ SharedWorkerHost::CreateNetworkFactoryForSubresources(
       default_factory_receiver =
           pending_default_factory.InitWithNewPipeAndPassReceiver();
 
-  const url::Origin& origin = instance_.constructor_origin();
+  url::Origin origin = url::Origin::Create(instance_.url());
+
   // TODO(https://crbug.com/1060832): Implement COEP reporter for shared
   // workers.
   network::mojom::URLLoaderFactoryParamsPtr factory_params =
       URLLoaderFactoryParamsHelper::CreateForWorker(
-          worker_process_host_, origin,
-          net::NetworkIsolationKey(origin, origin),
+          worker_process_host_, instance_.constructor_origin(),
+          net::IsolationInfo::Create(
+              net::IsolationInfo::RedirectMode::kUpdateNothing, origin, origin,
+              net::SiteForCookies::FromOrigin(origin)),
           /*coep_reporter=*/mojo::NullRemote());
   GetContentClient()->browser()->WillCreateURLLoaderFactory(
       worker_process_host_->GetBrowserContext(),
@@ -335,10 +339,11 @@ void SharedWorkerHost::CreateQuicTransportConnector(
     mojo::PendingReceiver<blink::mojom::QuicTransportConnector> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   const url::Origin origin = url::Origin::Create(instance().url());
-  mojo::MakeSelfOwnedReceiver(std::make_unique<QuicTransportConnectorImpl>(
-                                  worker_process_host_->GetID(), origin,
-                                  net::NetworkIsolationKey(origin, origin)),
-                              std::move(receiver));
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<QuicTransportConnectorImpl>(
+          worker_process_host_->GetID(), /*frame=*/nullptr, origin,
+          net::NetworkIsolationKey(origin, origin)),
+      std::move(receiver));
 }
 
 void SharedWorkerHost::BindCacheStorage(
diff --git a/chromium/content/browser/worker_host/shared_worker_host.h b/chromium/content/browser/worker_host/shared_worker_host.h
index 3a7bddea8df..c39e2dec358 100644
--- a/chromium/content/browser/worker_host/shared_worker_host.h
+++ b/chromium/content/browser/worker_host/shared_worker_host.h
@@ -21,8 +21,8 @@
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_process_host_observer.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "content/public/browser/shared_worker_instance.h"
-#include "content/public/browser/shared_worker_service.h"
 #include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
diff --git a/chromium/content/browser/worker_host/shared_worker_host_unittest.cc b/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
index ec9395e49af..ed7d5a06377 100644
--- a/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
+++ b/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
@@ -31,6 +31,7 @@
 #include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
 #include "url/origin.h"
 
 using blink::MessagePortChannel;
@@ -41,6 +42,7 @@ class SharedWorkerHostTest : public testing::Test {
  public:
   void SetUp() override {
     helper_.reset(new EmbeddedWorkerTestHelper(base::FilePath()));
+    ASSERT_TRUE(mock_render_process_host_.Init());
   }
 
   SharedWorkerHostTest()
@@ -95,7 +97,7 @@ class SharedWorkerHostTest : public testing::Test {
     // Set up for service worker.
     auto service_worker_handle =
         std::make_unique<ServiceWorkerMainResourceHandle>(
-            helper_->context_wrapper());
+            helper_->context_wrapper(), base::DoNothing());
     mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
         client_remote;
     mojo::PendingAssociatedReceiver<blink::mojom::ServiceWorkerContainerHost>
@@ -106,11 +108,12 @@ class SharedWorkerHostTest : public testing::Test {
         client_remote.InitWithNewEndpointAndPassReceiver();
     host_receiver =
         provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
-    base::WeakPtr<ServiceWorkerContainerHost> service_worker_container_host =
-        ServiceWorkerContainerHost::CreateForWebWorker(
-            helper_->context()->AsWeakPtr(), mock_render_process_host_.GetID(),
-            blink::mojom::ServiceWorkerContainerType::kForSharedWorker,
-            std::move(host_receiver), std::move(client_remote));
+
+    helper_->context()->CreateContainerHostForWorker(
+        std::move(host_receiver), mock_render_process_host_.GetID(),
+        std::move(client_remote),
+        blink::mojom::ServiceWorkerClientType::kSharedWorker,
+        DedicatedWorkerId(), host->id());
     service_worker_handle->OnCreatedProviderHost(std::move(provider_info));
     host->SetServiceWorkerHandle(std::move(service_worker_handle));
 
@@ -130,9 +133,9 @@ class SharedWorkerHostTest : public testing::Test {
     GlobalFrameRoutingId dummy_render_frame_host_id(
         mock_render_process_host_.GetID(), 22);
 
-    mojo::MessagePipe message_pipe;
-    MessagePortChannel local_port(std::move(message_pipe.handle0));
-    MessagePortChannel remote_port(std::move(message_pipe.handle1));
+    blink::MessagePortDescriptorPair port_pair;
+    MessagePortChannel local_port(port_pair.TakePort0());
+    MessagePortChannel remote_port(port_pair.TakePort1());
     host->AddClient(std::move(client), dummy_render_frame_host_id,
                     std::move(remote_port));
     return local_port;
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl.cc b/chromium/content/browser/worker_host/shared_worker_service_impl.cc
index 31abecd2702..2aaae6f415a 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl.cc
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl.cc
@@ -12,8 +12,8 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
@@ -35,6 +35,8 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "net/base/isolation_info.h"
+#include "net/cookies/site_for_cookies.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
@@ -46,11 +48,6 @@
 
 namespace content {
 
-bool IsShuttingDown(RenderProcessHost* host) {
-  return !host || host->FastShutdownStarted() ||
-         host->IsKeepAliveRefCountDisabled();
-}
-
 SharedWorkerServiceImpl::SharedWorkerServiceImpl(
     StoragePartitionImpl* storage_partition,
     scoped_refptr<ServiceWorkerContextWrapper> service_worker_context,
@@ -282,7 +279,8 @@ SharedWorkerHost* SharedWorkerServiceImpl::CreateWorker(
   // Allocate the worker in the same process as the creator.
   auto* worker_process_host =
       RenderProcessHost::FromID(creator_render_frame_host_id.child_id);
-  DCHECK(!IsShuttingDown(worker_process_host));
+  DCHECK(worker_process_host);
+  DCHECK(worker_process_host->IsInitializedAndNotDead());
 
   // Create the host. We need to do this even before starting the worker,
   // because we are about to bounce to the IO thread. If another ConnectToWorker
@@ -304,7 +302,7 @@ SharedWorkerHost* SharedWorkerServiceImpl::CreateWorker(
 
   auto service_worker_handle =
       std::make_unique<ServiceWorkerMainResourceHandle>(
-          storage_partition_->GetServiceWorkerContext());
+          storage_partition_->GetServiceWorkerContext(), base::DoNothing());
   auto* service_worker_handle_raw = service_worker_handle.get();
   host->SetServiceWorkerHandle(std::move(service_worker_handle));
 
@@ -330,11 +328,14 @@ SharedWorkerHost* SharedWorkerServiceImpl::CreateWorker(
   // data across NetworkIsolationKeys and allow same-site cookies to be sent in
   // cross-site contexts. Fix this.
   WorkerScriptFetchInitiator::Start(
-      worker_process_host->GetID(), host->instance().url(),
-      creator_render_frame_host, net::SiteForCookies::FromOrigin(worker_origin),
+      worker_process_host->GetID(), DedicatedWorkerId(), host->id(),
+      host->instance().url(), creator_render_frame_host,
+      net::SiteForCookies::FromOrigin(worker_origin),
       host->instance().constructor_origin(),
-      net::NetworkIsolationKey(worker_origin, worker_origin), credentials_mode,
-      std::move(outside_fetch_client_settings_object),
+      net::IsolationInfo::Create(
+          net::IsolationInfo::RedirectMode::kUpdateNothing, worker_origin,
+          worker_origin, net::SiteForCookies::FromOrigin(worker_origin)),
+      credentials_mode, std::move(outside_fetch_client_settings_object),
       blink::mojom::ResourceType::kSharedWorker, service_worker_context_,
       service_worker_handle_raw, std::move(appcache_host),
       std::move(blob_url_loader_factory), url_loader_factory_override_,
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl.h b/chromium/content/browser/worker_host/shared_worker_service_impl.h
index 68828b1e9b1..b263dcc827e 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl.h
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl.h
@@ -37,9 +37,6 @@ class SharedWorkerInstance;
 class SharedWorkerHost;
 class StoragePartitionImpl;
 
-// Shared helper function
-bool IsShuttingDown(RenderProcessHost* host);
-
 // Created per StoragePartition.
 class CONTENT_EXPORT SharedWorkerServiceImpl : public SharedWorkerService {
  public:
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc b/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
index 6446dc01846..219b88b2ba9 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
@@ -59,15 +59,15 @@ void ConnectToSharedWorker(
           network::mojom::ReferrerPolicy::kDefault, GURL(),
           blink::mojom::InsecureRequestsPolicy::kDoNotUpgrade)));
 
-  mojo::MessagePipe message_pipe;
-  *local_port = MessagePortChannel(std::move(message_pipe.handle0));
+  blink::MessagePortDescriptorPair pipe;
+  *local_port = MessagePortChannel(pipe.TakePort0());
 
   mojo::PendingRemote<blink::mojom::SharedWorkerClient> client_proxy;
   client->Bind(client_proxy.InitWithNewPipeAndPassReceiver());
 
   connector->Connect(std::move(info), std::move(client_proxy),
                      blink::mojom::SharedWorkerCreationContextType::kSecure,
-                     std::move(message_pipe.handle1), mojo::NullRemote());
+                     pipe.TakePort1(), mojo::NullRemote());
 }
 
 // Helper to delete the given WebContents and shut down its process. This is
@@ -263,11 +263,11 @@ TEST_F(SharedWorkerServiceImplTest, BasicTest) {
 
   // Verify that |port| corresponds to |connector->local_port()|.
   std::string expected_message("test1");
-  EXPECT_TRUE(mojo::test::WriteTextMessage(local_port.GetHandle().get(),
-                                           expected_message));
+  EXPECT_TRUE(mojo::test::WriteTextMessage(
+      local_port.GetHandle().handle().get(), expected_message));
   std::string received_message;
-  EXPECT_TRUE(
-      mojo::test::ReadTextMessage(port.GetHandle().get(), &received_message));
+  EXPECT_TRUE(mojo::test::ReadTextMessage(port.GetHandle().handle().get(),
+                                          &received_message));
   EXPECT_EQ(expected_message, received_message);
 
   // Send feature from shared worker to host.
@@ -389,11 +389,11 @@ TEST_F(SharedWorkerServiceImplTest, TwoRendererTest) {
 
   // Verify that |port0| corresponds to |connector0->local_port()|.
   std::string expected_message0("test1");
-  EXPECT_TRUE(mojo::test::WriteTextMessage(local_port0.GetHandle().get(),
-                                           expected_message0));
+  EXPECT_TRUE(mojo::test::WriteTextMessage(
+      local_port0.GetHandle().handle().get(), expected_message0));
   std::string received_message0;
-  EXPECT_TRUE(
-      mojo::test::ReadTextMessage(port0.GetHandle().get(), &received_message0));
+  EXPECT_TRUE(mojo::test::ReadTextMessage(port0.GetHandle().handle().get(),
+                                          &received_message0));
   EXPECT_EQ(expected_message0, received_message0);
 
   auto feature1 = static_cast<blink::mojom::WebFeature>(124);
@@ -448,11 +448,11 @@ TEST_F(SharedWorkerServiceImplTest, TwoRendererTest) {
 
   // Verify that |worker_msg_port2| corresponds to |connector1->local_port()|.
   std::string expected_message1("test2");
-  EXPECT_TRUE(mojo::test::WriteTextMessage(local_port1.GetHandle().get(),
-                                           expected_message1));
+  EXPECT_TRUE(mojo::test::WriteTextMessage(
+      local_port1.GetHandle().handle().get(), expected_message1));
   std::string received_message1;
-  EXPECT_TRUE(
-      mojo::test::ReadTextMessage(port1.GetHandle().get(), &received_message1));
+  EXPECT_TRUE(mojo::test::ReadTextMessage(port1.GetHandle().handle().get(),
+                                          &received_message1));
   EXPECT_EQ(expected_message1, received_message1);
 
   worker_host->OnFeatureUsed(feature1);
diff --git a/chromium/content/browser/worker_host/worker_browsertest.cc b/chromium/content/browser/worker_host/worker_browsertest.cc
index eb9c1232d56..45ca330b100 100644
--- a/chromium/content/browser/worker_host/worker_browsertest.cc
+++ b/chromium/content/browser/worker_host/worker_browsertest.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -25,6 +25,8 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -158,13 +160,13 @@ class WorkerTest : public ContentBrowserTest,
         net::CookieOptions::SameSiteCookieContext(
             net::CookieOptions::SameSiteCookieContext::ContextType::
                 SAME_SITE_LAX));
+    GURL cookie_url = ssl_server_.GetURL(host, "/");
     std::unique_ptr<net::CanonicalCookie> cookie = net::CanonicalCookie::Create(
-        ssl_server_.GetURL(host, "/"),
-        std::string(kSameSiteCookie) + "; SameSite=Lax; Secure",
+        cookie_url, std::string(kSameSiteCookie) + "; SameSite=Lax; Secure",
         base::Time::Now(), base::nullopt /* server_time */);
     base::RunLoop run_loop;
     cookie_manager->SetCanonicalCookie(
-        *cookie, "https" /* source_scheme */, options,
+        *cookie, cookie_url, options,
         base::BindLambdaForTesting(
             [&](net::CanonicalCookie::CookieInclusionStatus set_cookie_result) {
               EXPECT_TRUE(set_cookie_result.IsInclude());
@@ -174,11 +176,24 @@ class WorkerTest : public ContentBrowserTest,
   }
 
   // Returns the cookie received with the request for the specified path. If the
-  // path was requested but no cookie was received, return kNoCookie.
+  // path was requested but no cookie was received, return kNoCookie. Waits for
+  // the path to be requested if it hasn't been requested already.
   std::string GetReceivedCookie(const std::string& path) {
+    {
+      base::AutoLock auto_lock(path_cookie_map_lock_);
+      DCHECK(path_to_wait_for_.empty());
+      DCHECK(!path_wait_loop_);
+      if (path_cookie_map_.find(path) != path_cookie_map_.end())
+        return path_cookie_map_[path];
+      path_to_wait_for_ = path;
+      path_wait_loop_ = std::make_unique<base::RunLoop>();
+    }
+
+    path_wait_loop_->Run();
+
     base::AutoLock auto_lock(path_cookie_map_lock_);
-    if (path_cookie_map_.find(path) == path_cookie_map_.end())
-      return "path not requested";
+    path_to_wait_for_.clear();
+    path_wait_loop_.reset();
     return path_cookie_map_[path];
   }
 
@@ -213,9 +228,12 @@ class WorkerTest : public ContentBrowserTest,
     auto cookie_header = request.headers.find("Cookie");
     if (cookie_header == request.headers.end()) {
       path_cookie_map_[request.relative_url] = kNoCookie;
-      return nullptr;
+    } else {
+      path_cookie_map_[request.relative_url] = cookie_header->second;
+    }
+    if (path_to_wait_for_ == request.relative_url) {
+      path_wait_loop_->Quit();
     }
-    path_cookie_map_[request.relative_url] = cookie_header->second;
     return nullptr;
   }
 
@@ -223,6 +241,14 @@ class WorkerTest : public ContentBrowserTest,
   // with. Paths may only be requested once without clearing the map.
   std::map<std::string, std::string> path_cookie_map_
       GUARDED_BY(path_cookie_map_lock_);
+  // If non-empty, path to wait for the test server to see a request for on the
+  // "a.test" server.
+  std::string path_to_wait_for_ GUARDED_BY(path_cookie_map_lock_);
+  // If non-null, quit when a request for |path_to_wait_for_| is observed. May
+  // only be created or dereferenced off of the UI thread while holding
+  // |path_cookie_map_lock_|, its run method must be called while not holding
+  // the lock.
+  std::unique_ptr<base::RunLoop> path_wait_loop_;
   // Lock that must be held while modifying |path_cookie_map_|, as it's used on
   // both the test server's thread and the UI thread.
   base::Lock path_cookie_map_lock_;
@@ -245,6 +271,23 @@ IN_PROC_BROWSER_TEST_P(WorkerTest, SingleWorker) {
 }
 
 IN_PROC_BROWSER_TEST_P(WorkerTest, SingleWorkerFromFile) {
+  RunTest(GetTestFileURL("single_worker.html"), true /* expect_failure */);
+}
+
+class WorkerTestWithAllowFileAccessFromFiles : public WorkerTest {
+ public:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    WorkerTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch(switches::kAllowFileAccessFromFiles);
+  }
+};
+
+INSTANTIATE_TEST_SUITE_P(All,
+                         WorkerTestWithAllowFileAccessFromFiles,
+                         testing::ValuesIn({false, true}));
+
+IN_PROC_BROWSER_TEST_P(WorkerTestWithAllowFileAccessFromFiles,
+                       SingleWorkerFromFile) {
   RunTest(GetTestFileURL("single_worker.html"));
 }
 
@@ -396,17 +439,18 @@ IN_PROC_BROWSER_TEST_P(WorkerTest,
 }
 
 // Tests the value of |request_initiator| for shared worker resources.
-IN_PROC_BROWSER_TEST_P(WorkerTest, VerifyInitiatorSharedWorker) {
+IN_PROC_BROWSER_TEST_P(WorkerTest,
+                       VerifyInitiatorAndSameSiteCookiesSharedWorker) {
   if (!SupportsSharedWorker())
     return;
 
-  const GURL start_url(ssl_server()->GetURL("a.test", "/frame_tree/top.html"));
+  const GURL start_url(ssl_server()->GetURL("b.test", "/frame_tree/top.html"));
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
   // To make things tricky about |top_frame_origin|, this test navigates to
   // a page on |ssl_server()| which has a cross-origin iframe that registers the
   // worker.
-  std::string cross_site_domain("b.test");
+  std::string cross_site_domain("a.test");
   const GURL test_url(ssl_server()->GetURL(
       cross_site_domain, "/workers/simple_shared_worker.html"));
 
@@ -421,6 +465,9 @@ IN_PROC_BROWSER_TEST_P(WorkerTest, VerifyInitiatorSharedWorker) {
   const GURL resource_url(
       ssl_server()->GetURL(cross_site_domain, "/workers/empty.html"));
 
+  // Set a cookie for verfifying which requests send SameSite cookies.
+  SetSameSiteCookie(cross_site_domain);
+
   std::set<GURL> expected_request_urls = {worker_url, script_url, resource_url};
   const url::Origin expected_origin =
       url::Origin::Create(worker_url.GetOrigin());
@@ -445,6 +492,14 @@ IN_PROC_BROWSER_TEST_P(WorkerTest, VerifyInitiatorSharedWorker) {
                             ->root();
   NavigateFrameToURL(root->child_at(0), test_url);
   waiter.Run();
+
+  // Check cookies sent with each request to "a.test". Frame request should not
+  // have SameSite cookies, but SharedWorker could (though eventually this will
+  // need to be changed, to protect against cross-site user tracking).
+  EXPECT_EQ(kNoCookie, GetReceivedCookie(test_url.path()));
+  EXPECT_EQ(kSameSiteCookie, GetReceivedCookie(worker_url.path()));
+  EXPECT_EQ(kSameSiteCookie, GetReceivedCookie(script_url.path()));
+  EXPECT_EQ(kSameSiteCookie, GetReceivedCookie(resource_url.path()));
 }
 
 // Test that an "a.test" worker sends "a.test" SameSite cookies, both when
diff --git a/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc b/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
index 6534c66a482..09ae3d82c04 100644
--- a/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
+++ b/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
@@ -8,10 +8,11 @@
 
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/metrics/field_trial_params.h"
+#include "base/notreached.h"
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
 #include "content/browser/data_url_loader_factory.h"
@@ -42,8 +43,8 @@
 #include "content/public/common/referrer.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/base/isolation_info.h"
 #include "net/base/load_flags.h"
-#include "net/base/network_isolation_key.h"
 #include "net/http/http_request_headers.h"
 #include "services/network/public/cpp/constants.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -63,11 +64,13 @@ namespace {
 // static
 void WorkerScriptFetchInitiator::Start(
     int worker_process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
     const GURL& initial_request_url,
     RenderFrameHost* creator_render_frame_host,
     const net::SiteForCookies& site_for_cookies,
     const url::Origin& request_initiator,
-    const net::NetworkIsolationKey& trusted_network_isolation_key,
+    const net::IsolationInfo& trusted_isolation_info,
     network::mojom::CredentialsMode credentials_mode,
     blink::mojom::FetchClientSettingsObjectPtr
         outside_fetch_client_settings_object,
@@ -153,14 +156,10 @@ void WorkerScriptFetchInitiator::Start(
 
   switch (resource_type) {
     case blink::mojom::ResourceType::kWorker:
-      resource_request->fetch_request_context_type =
-          static_cast<int>(blink::mojom::RequestContextType::WORKER);
       resource_request->destination =
           network::mojom::RequestDestination::kWorker;
       break;
     case blink::mojom::ResourceType::kSharedWorker:
-      resource_request->fetch_request_context_type =
-          static_cast<int>(blink::mojom::RequestContextType::SHARED_WORKER);
       resource_request->destination =
           network::mojom::RequestDestination::kSharedWorker;
       break;
@@ -178,9 +177,9 @@ void WorkerScriptFetchInitiator::Start(
   AddAdditionalRequestHeaders(resource_request.get(), browser_context);
 
   CreateScriptLoader(
-      worker_process_id, initial_request_url, creator_render_frame_host,
-      trusted_network_isolation_key, std::move(resource_request),
-      std::move(factory_bundle_for_browser),
+      worker_process_id, dedicated_worker_id, shared_worker_id,
+      initial_request_url, creator_render_frame_host, trusted_isolation_info,
+      std::move(resource_request), std::move(factory_bundle_for_browser),
       std::move(subresource_loader_factories),
       std::move(service_worker_context), service_worker_handle,
       std::move(appcache_host), std::move(blob_url_loader_factory),
@@ -282,9 +281,11 @@ void WorkerScriptFetchInitiator::AddAdditionalRequestHeaders(
 
 void WorkerScriptFetchInitiator::CreateScriptLoader(
     int worker_process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
     const GURL& initial_request_url,
     RenderFrameHost* creator_render_frame_host,
-    const net::NetworkIsolationKey& trusted_network_isolation_key,
+    const net::IsolationInfo& trusted_isolation_info,
     std::unique_ptr<network::ResourceRequest> resource_request,
     std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
         factory_bundle_for_browser_info,
@@ -324,7 +325,7 @@ void WorkerScriptFetchInitiator::CreateScriptLoader(
     // to the COEP reporter in DedicatedWorkerHost.
     network::mojom::URLLoaderFactoryParamsPtr factory_params =
         URLLoaderFactoryParamsHelper::CreateForWorker(
-            factory_process, request_initiator, trusted_network_isolation_key,
+            factory_process, request_initiator, trusted_isolation_info,
             /*coep_reporter=*/mojo::NullRemote());
 
     mojo::PendingReceiver<network::mojom::URLLoaderFactory>
@@ -374,7 +375,8 @@ void WorkerScriptFetchInitiator::CreateScriptLoader(
 
   WorkerScriptFetcher::CreateAndStart(
       std::make_unique<WorkerScriptLoaderFactory>(
-          worker_process_id, service_worker_handle, std::move(appcache_host),
+          worker_process_id, dedicated_worker_id, shared_worker_id,
+          service_worker_handle, std::move(appcache_host),
           browser_context_getter, std::move(url_loader_factory)),
       std::move(throttles), std::move(resource_request),
       base::BindOnce(WorkerScriptFetchInitiator::DidCreateScriptLoader,
diff --git a/chromium/content/browser/worker_host/worker_script_fetch_initiator.h b/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
index 900e754c2bb..6765a0e28a4 100644
--- a/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
+++ b/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
@@ -14,6 +14,8 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
@@ -66,11 +68,13 @@ class CONTENT_EXPORT WorkerScriptFetchInitiator {
   // thread. |callback| will be called with the result on the UI thread.
   static void Start(
       int worker_process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id,
       const GURL& initial_request_url,
       RenderFrameHost* creator_render_frame_host,
       const net::SiteForCookies& site_for_cookies,
       const url::Origin& request_initiator,
-      const net::NetworkIsolationKey& trusted_network_isolation_key,
+      const net::IsolationInfo& trusted_isolation_info,
       network::mojom::CredentialsMode credentials_mode,
       blink::mojom::FetchClientSettingsObjectPtr
           outside_fetch_client_settings_object,
@@ -109,9 +113,11 @@ class CONTENT_EXPORT WorkerScriptFetchInitiator {
 
   static void CreateScriptLoader(
       int worker_process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id,
       const GURL& initial_request_url,
       RenderFrameHost* creator_render_frame_host,
-      const net::NetworkIsolationKey& trusted_network_isolation_key,
+      const net::IsolationInfo& trusted_isolation_info,
       std::unique_ptr<network::ResourceRequest> resource_request,
       std::unique_ptr<blink::PendingURLLoaderFactoryBundle>
           factory_bundle_for_browser_info,
diff --git a/chromium/content/browser/worker_host/worker_script_fetcher.cc b/chromium/content/browser/worker_host/worker_script_fetcher.cc
index 19624666826..9a369dbdc12 100644
--- a/chromium/content/browser/worker_host/worker_script_fetcher.cc
+++ b/chromium/content/browser/worker_host/worker_script_fetcher.cc
@@ -174,7 +174,8 @@ void WorkerScriptFetcher::OnReceiveRedirect(
   redirect_infos_.push_back(redirect_info);
   redirect_response_heads_.push_back(std::move(response_head));
   url_loader_->FollowRedirect({}, /* removed_headers */
-                              {} /* modified_headers */);
+                              {}, /* modified_headers */
+                              {} /* modified_cors_exempt_headers */);
 }
 
 void WorkerScriptFetcher::OnUploadProgress(int64_t current_position,
diff --git a/chromium/content/browser/worker_host/worker_script_loader.cc b/chromium/content/browser/worker_host/worker_script_loader.cc
index 998c0d67966..f07152c1314 100644
--- a/chromium/content/browser/worker_host/worker_script_loader.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader.cc
@@ -10,7 +10,7 @@
 #include "content/browser/loader/navigation_loader_interceptor.h"
 #include "content/browser/service_worker/service_worker_main_resource_handle.h"
 #include "content/browser/service_worker/service_worker_main_resource_handle_core.h"
-#include "content/browser/service_worker/service_worker_request_handler.h"
+#include "content/browser/service_worker/service_worker_navigation_loader_interceptor.h"
 #include "content/browser/worker_host/worker_script_fetch_initiator.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -21,6 +21,8 @@ namespace content {
 
 WorkerScriptLoader::WorkerScriptLoader(
     int process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
@@ -42,14 +44,15 @@ WorkerScriptLoader::WorkerScriptLoader(
       traffic_annotation_(traffic_annotation) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  std::unique_ptr<NavigationLoaderInterceptor> service_worker_interceptor;
   if (!service_worker_handle_) {
     // The DedicatedWorkerHost or SharedWorkerHost is already destroyed.
     Abort();
     return;
   }
-  service_worker_interceptor = ServiceWorkerRequestHandler::CreateForWorker(
-      resource_request_, process_id, service_worker_handle_);
+  auto service_worker_interceptor =
+      ServiceWorkerNavigationLoaderInterceptor::CreateForWorker(
+          resource_request_, process_id, dedicated_worker_id, shared_worker_id,
+          service_worker_handle_);
 
   if (service_worker_interceptor)
     interceptors_.push_back(std::move(service_worker_interceptor));
@@ -168,6 +171,7 @@ void WorkerScriptLoader::LoadFromNetwork(bool reset_subresource_loader_params) {
 void WorkerScriptLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!new_url.has_value()) << "Redirect with modified URL was not "
@@ -181,6 +185,9 @@ void WorkerScriptLoader::FollowRedirect(
       resource_request_.url, resource_request_.method, *redirect_info_,
       removed_headers, modified_headers, &resource_request_.headers,
       &should_clear_upload);
+  resource_request_.cors_exempt_headers.MergeFrom(modified_cors_exempt_headers);
+  for (const std::string& name : removed_headers)
+    resource_request_.cors_exempt_headers.RemoveHeader(name);
 
   resource_request_.url = redirect_info_->new_url;
   resource_request_.method = redirect_info_->new_method;
diff --git a/chromium/content/browser/worker_host/worker_script_loader.h b/chromium/content/browser/worker_host/worker_script_loader.h
index b2ceded4527..77a940e9649 100644
--- a/chromium/content/browser/worker_host/worker_script_loader.h
+++ b/chromium/content/browser/worker_host/worker_script_loader.h
@@ -14,6 +14,8 @@
 #include "base/optional.h"
 #include "content/browser/loader/single_request_url_loader_factory.h"
 #include "content/browser/navigation_subresource_loader_params.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
@@ -67,6 +69,8 @@ class WorkerScriptLoader : public network::mojom::URLLoader,
   // chrome-extension:// URL.
   WorkerScriptLoader(
       int process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id,
       int32_t routing_id,
       int32_t request_id,
       uint32_t options,
@@ -80,9 +84,11 @@ class WorkerScriptLoader : public network::mojom::URLLoader,
   ~WorkerScriptLoader() override;
 
   // network::mojom::URLLoader:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int32_t intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory.cc b/chromium/content/browser/worker_host/worker_script_loader_factory.cc
index eddf188f8e0..fe4fe754fe6 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory.cc
@@ -22,11 +22,15 @@ namespace content {
 
 WorkerScriptLoaderFactory::WorkerScriptLoaderFactory(
     int process_id,
+    DedicatedWorkerId dedicated_worker_id,
+    SharedWorkerId shared_worker_id,
     ServiceWorkerMainResourceHandle* service_worker_handle,
     base::WeakPtr<AppCacheHost> appcache_host,
     const BrowserContextGetter& browser_context_getter,
     scoped_refptr<network::SharedURLLoaderFactory> loader_factory)
     : process_id_(process_id),
+      dedicated_worker_id_(dedicated_worker_id),
+      shared_worker_id_(shared_worker_id),
       appcache_host_(std::move(appcache_host)),
       browser_context_getter_(browser_context_getter),
       loader_factory_(std::move(loader_factory)) {
@@ -59,9 +63,10 @@ void WorkerScriptLoaderFactory::CreateLoaderAndStart(
 
   // Create a WorkerScriptLoader to load the script.
   auto script_loader = std::make_unique<WorkerScriptLoader>(
-      process_id_, routing_id, request_id, options, resource_request,
-      std::move(client), service_worker_handle_, appcache_host_,
-      browser_context_getter_, loader_factory_, traffic_annotation);
+      process_id_, dedicated_worker_id_, shared_worker_id_, routing_id,
+      request_id, options, resource_request, std::move(client),
+      service_worker_handle_, appcache_host_, browser_context_getter_,
+      loader_factory_, traffic_annotation);
   script_loader_ = script_loader->GetWeakPtr();
   mojo::MakeSelfOwnedReceiver(std::move(script_loader), std::move(receiver));
 }
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory.h b/chromium/content/browser/worker_host/worker_script_loader_factory.h
index 89ab86b77f2..274f5622b17 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory.h
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory.h
@@ -8,6 +8,8 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/navigation_subresource_loader_params.h"
+#include "content/public/browser/dedicated_worker_id.h"
+#include "content/public/browser/shared_worker_id.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
@@ -48,6 +50,8 @@ class CONTENT_EXPORT WorkerScriptLoaderFactory
   // factories used for non-http(s) URLs, e.g., a chrome-extension:// URL.
   WorkerScriptLoaderFactory(
       int process_id,
+      DedicatedWorkerId dedicated_worker_id,
+      SharedWorkerId shared_worker_id,
       ServiceWorkerMainResourceHandle* service_worker_handle,
       base::WeakPtr<AppCacheHost> appcache_host,
       const BrowserContextGetter& browser_context_getter,
@@ -71,6 +75,8 @@ class CONTENT_EXPORT WorkerScriptLoaderFactory
 
  private:
   const int process_id_;
+  const DedicatedWorkerId dedicated_worker_id_;
+  const SharedWorkerId shared_worker_id_;
   base::WeakPtr<ServiceWorkerMainResourceHandle> service_worker_handle_;
   base::WeakPtr<AppCacheHost> appcache_host_;
   BrowserContextGetter browser_context_getter_;
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc b/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
index e7cdbfdabd6..be1b1620e88 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
@@ -14,7 +14,7 @@
 #include "content/browser/service_worker/service_worker_main_resource_handle_core.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/test/fake_network_url_loader_factory.h"
-#include "net/base/network_isolation_key.h"
+#include "net/base/isolation_info.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_client.h"
@@ -57,7 +57,7 @@ class WorkerScriptLoaderFactoryTest : public testing::Test {
 
     // Set up a service worker host for the shared worker.
     service_worker_handle_ = std::make_unique<ServiceWorkerMainResourceHandle>(
-        helper_->context_wrapper());
+        helper_->context_wrapper(), base::DoNothing());
   }
 
  protected:
@@ -69,9 +69,11 @@ class WorkerScriptLoaderFactoryTest : public testing::Test {
     network::ResourceRequest resource_request;
     resource_request.url = url;
     resource_request.trusted_params = network::ResourceRequest::TrustedParams();
-    resource_request.trusted_params->network_isolation_key =
-        net::NetworkIsolationKey(url::Origin::Create(url),
-                                 url::Origin::Create(url));
+    resource_request.trusted_params->isolation_info =
+        net::IsolationInfo::Create(
+            net::IsolationInfo::RedirectMode::kUpdateNothing,
+            url::Origin::Create(url), url::Origin::Create(url),
+            net::SiteForCookies());
     resource_request.resource_type =
         static_cast<int>(blink::mojom::ResourceType::kSharedWorker);
     factory->CreateLoaderAndStart(
@@ -94,9 +96,9 @@ class WorkerScriptLoaderFactoryTest : public testing::Test {
 TEST_F(WorkerScriptLoaderFactoryTest, ServiceWorkerProviderHost) {
   // Make the factory.
   auto factory = std::make_unique<WorkerScriptLoaderFactory>(
-      kProcessId, service_worker_handle_.get(),
-      /*appcache_host=*/nullptr, browser_context_getter_,
-      network_loader_factory_);
+      kProcessId, DedicatedWorkerId(), SharedWorkerId(),
+      service_worker_handle_.get(), /*appcache_host=*/nullptr,
+      browser_context_getter_, network_loader_factory_);
 
   // Load the script.
   GURL url("https://www.example.com/worker.js");
@@ -119,7 +121,8 @@ TEST_F(WorkerScriptLoaderFactoryTest, ServiceWorkerProviderHost) {
 TEST_F(WorkerScriptLoaderFactoryTest, NullServiceWorkerHandle) {
   // Make the factory.
   auto factory = std::make_unique<WorkerScriptLoaderFactory>(
-      kProcessId, service_worker_handle_.get(), nullptr /* appcache_host */,
+      kProcessId, DedicatedWorkerId(), SharedWorkerId(),
+      service_worker_handle_.get(), nullptr /* appcache_host */,
       browser_context_getter_, network_loader_factory_);
 
   // Destroy the handle.
@@ -142,7 +145,8 @@ TEST_F(WorkerScriptLoaderFactoryTest, NullServiceWorkerHandle) {
 TEST_F(WorkerScriptLoaderFactoryTest, NullBrowserContext) {
   // Make the factory.
   auto factory = std::make_unique<WorkerScriptLoaderFactory>(
-      kProcessId, service_worker_handle_.get(), nullptr /* appcache_host */,
+      kProcessId, DedicatedWorkerId(), SharedWorkerId(),
+      service_worker_handle_.get(), nullptr /* appcache_host */,
       browser_context_getter_, network_loader_factory_);
 
   // Set a null browser context.
diff --git a/chromium/content/browser/worker_network_isolation_key_browsertest.cc b/chromium/content/browser/worker_network_isolation_key_browsertest.cc
index e5dd49d585b..e56dbb31217 100644
--- a/chromium/content/browser/worker_network_isolation_key_browsertest.cc
+++ b/chromium/content/browser/worker_network_isolation_key_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
diff --git a/chromium/content/browser/xr/DEPS b/chromium/content/browser/xr/DEPS
new file mode 100644
index 00000000000..974b375c20a
--- /dev/null
+++ b/chromium/content/browser/xr/DEPS
@@ -0,0 +1,4 @@
+include_rules = [
+  "+device/base",
+  "+device/vr",
+]
diff --git a/chromium/content/browser/xr/OWNERS b/chromium/content/browser/xr/OWNERS
new file mode 100644
index 00000000000..7a5f229511b
--- /dev/null
+++ b/chromium/content/browser/xr/OWNERS
@@ -0,0 +1,8 @@
+alcooper@chromium.org
+klausw@chromium.org
+
+# Browser Test-related.
+bsheedy@chromium.org
+
+# TEAM: xr-dev@chromium.org
+# COMPONENT: Internals>XR
diff --git a/chromium/content/browser/xr/metrics/session_metrics_helper.cc b/chromium/content/browser/xr/metrics/session_metrics_helper.cc
new file mode 100644
index 00000000000..7eb0a221511
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_metrics_helper.cc
@@ -0,0 +1,274 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/metrics/session_metrics_helper.h"
+
+#include "base/logging.h"
+#include "base/metrics/histogram_macros.h"
+#include "content/browser/xr/metrics/session_timer.h"
+#include "content/browser/xr/metrics/webxr_session_tracker.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/web_contents.h"
+#include "device/vr/public/cpp/session_mode.h"
+
+namespace content {
+
+namespace {
+
+const void* const kSessionMetricsHelperDataKey = &kSessionMetricsHelperDataKey;
+
+// minimum duration: 7 seconds for video, no minimum for headset/vr modes
+// maximum gap: 7 seconds between videos.  no gap for headset/vr-modes
+constexpr base::TimeDelta kMinimumVideoSessionDuration(
+    base::TimeDelta::FromSecondsD(7));
+constexpr base::TimeDelta kMaximumVideoSessionGap(
+    base::TimeDelta::FromSecondsD(7));
+
+constexpr base::TimeDelta kMinimumHeadsetSessionDuration(
+    base::TimeDelta::FromSecondsD(0));
+constexpr base::TimeDelta kMaximumHeadsetSessionGap(
+    base::TimeDelta::FromSecondsD(0));
+
+// Handles the lifetime of the helper which is attached to a WebContents.
+class SessionMetricsHelperData : public base::SupportsUserData::Data {
+ public:
+  explicit SessionMetricsHelperData(
+      SessionMetricsHelper* session_metrics_helper)
+      : session_metrics_helper_(session_metrics_helper) {}
+
+  ~SessionMetricsHelperData() override { delete session_metrics_helper_; }
+
+  SessionMetricsHelper* get() const { return session_metrics_helper_; }
+
+ private:
+  SessionMetricsHelper* session_metrics_helper_;
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(SessionMetricsHelperData);
+};
+
+// Helper method to log out both the mode and the initially requested features
+// for a WebXRSessionTracker.  WebXRSessionTracker is an unowned pointer.
+void ReportInitialSessionData(
+    WebXRSessionTracker* webxr_session_tracker,
+    const device::mojom::XRSessionOptions& session_options,
+    const std::set<device::mojom::XRSessionFeature>& enabled_features) {
+  DCHECK(webxr_session_tracker);
+
+  webxr_session_tracker->ukm_entry()->SetMode(
+      static_cast<int64_t>(session_options.mode));
+  webxr_session_tracker->ReportRequestedFeatures(session_options,
+                                                 enabled_features);
+}
+
+}  // namespace
+
+// static
+SessionMetricsHelper* SessionMetricsHelper::FromWebContents(
+    content::WebContents* web_contents) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  if (!web_contents)
+    return nullptr;
+  SessionMetricsHelperData* data = static_cast<SessionMetricsHelperData*>(
+      web_contents->GetUserData(kSessionMetricsHelperDataKey));
+  return data ? data->get() : nullptr;
+}
+
+// static
+SessionMetricsHelper* SessionMetricsHelper::CreateForWebContents(
+    content::WebContents* contents) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  // This is not leaked as the SessionMetricsHelperData will clean it up.
+  return new SessionMetricsHelper(contents);
+}
+
+SessionMetricsHelper::SessionMetricsHelper(content::WebContents* contents) {
+  DVLOG(2) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK(contents);
+
+  num_videos_playing_ = contents->GetCurrentlyPlayingVideoCount();
+
+  Observe(contents);
+  contents->SetUserData(kSessionMetricsHelperDataKey,
+                        std::make_unique<SessionMetricsHelperData>(this));
+}
+
+SessionMetricsHelper::~SessionMetricsHelper() {
+  DVLOG(2) << __func__;
+}
+
+mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+SessionMetricsHelper::StartInlineSession(
+    const device::mojom::XRSessionOptions& session_options,
+    const std::set<device::mojom::XRSessionFeature>& enabled_features,
+    size_t session_id) {
+  DVLOG(1) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  DCHECK(webxr_inline_session_trackers_.find(session_id) ==
+         webxr_inline_session_trackers_.end());
+
+  // TODO(crbug.com/1061899): The code here assumes that it's called on
+  // behalf of the active frame, which is not always true.
+  // Plumb explicit RenderFrameHost reference from VRSessionImpl.
+  auto result = webxr_inline_session_trackers_.emplace(
+      session_id,
+      std::make_unique<WebXRSessionTracker>(
+          std::make_unique<ukm::builders::XR_WebXR_Session>(
+              web_contents()->GetMainFrame()->GetPageUkmSourceId())));
+  auto* tracker = result.first->second.get();
+
+  ReportInitialSessionData(tracker, session_options, enabled_features);
+
+  return tracker->BindMetricsRecorderPipe();
+}
+
+void SessionMetricsHelper::StopAndRecordInlineSession(size_t session_id) {
+  DVLOG(1) << __func__;
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  auto it = webxr_inline_session_trackers_.find(session_id);
+
+  if (it == webxr_inline_session_trackers_.end())
+    return;
+
+  it->second->SetSessionEnd(base::Time::Now());
+  it->second->ukm_entry()->SetDuration(
+      it->second->GetRoundedDurationInSeconds());
+  it->second->RecordEntry();
+
+  webxr_inline_session_trackers_.erase(it);
+}
+
+mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+SessionMetricsHelper::StartImmersiveSession(
+    const device::mojom::XRSessionOptions& session_options,
+    const std::set<device::mojom::XRSessionFeature>& enabled_features) {
+  DVLOG(1) << __func__;
+  DCHECK(!webxr_immersive_session_tracker_);
+  base::Time start_time = base::Time::Now();
+
+  // TODO(crbug.com/1061899): The code here assumes that it's called on
+  // behalf of the active frame, which is not always true.
+  // Plumb explicit RenderFrameHost reference from VRSessionImpl.
+  webxr_immersive_session_tracker_ = std::make_unique<WebXRSessionTracker>(
+      std::make_unique<ukm::builders::XR_WebXR_Session>(
+          web_contents()->GetMainFrame()->GetPageUkmSourceId()));
+
+  // TODO(https://crbug.com/1056930): Consider renaming the timers to something
+  // that indicates both that these also record AR, and that these are no longer
+  // "suffixed" histograms.
+  session_timer_ = std::make_unique<SessionTimer>(
+      "VRSessionTime.WebVR", kMaximumHeadsetSessionGap,
+      kMinimumHeadsetSessionDuration);
+  session_timer_->StartSession(start_time);
+
+  session_video_timer_ = std::make_unique<SessionTimer>(
+      "VRSessionVideoTime.WebVR", kMaximumVideoSessionGap,
+      kMinimumVideoSessionDuration);
+
+  num_session_video_playback_ = num_videos_playing_;
+
+  if (num_videos_playing_ > 0) {
+    session_video_timer_->StartSession(start_time);
+  }
+
+  ReportInitialSessionData(webxr_immersive_session_tracker_.get(),
+                           session_options, enabled_features);
+
+  return webxr_immersive_session_tracker_->BindMetricsRecorderPipe();
+}
+
+void SessionMetricsHelper::StopAndRecordImmersiveSession() {
+  DVLOG(1) << __func__;
+  // A session cannot outlive a navigation, so we terminate it here. However,
+  // depending on how the session is torn down, we may be notified in any order
+  // of the navigation and then shutdown. If we don't have an active session,
+  // assume it's been stopped already and just return early.
+  if (!webxr_immersive_session_tracker_) {
+    return;
+  }
+
+  webxr_immersive_session_tracker_->SetSessionEnd(base::Time::Now());
+  webxr_immersive_session_tracker_->ukm_entry()->SetDuration(
+      webxr_immersive_session_tracker_->GetRoundedDurationInSeconds());
+  webxr_immersive_session_tracker_->RecordEntry();
+  webxr_immersive_session_tracker_ = nullptr;
+
+  // Destroyig the timers will both stop the session and force them to log their
+  // metrics.
+  session_timer_ = nullptr;
+  session_video_timer_ = nullptr;
+
+  UMA_HISTOGRAM_COUNTS_100("VRSessionVideoCount", num_session_video_playback_);
+}
+
+void SessionMetricsHelper::MediaStartedPlaying(
+    const MediaPlayerInfo& media_info,
+    const content::MediaPlayerId&) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  if (!media_info.has_video)
+    return;
+
+  if (num_videos_playing_ == 0) {
+    // started playing video - start sessions
+    base::Time start_time = base::Time::Now();
+
+    if (session_video_timer_) {
+      session_video_timer_->StartSession(start_time);
+    }
+  }
+
+  num_videos_playing_++;
+  num_session_video_playback_++;
+}
+
+void SessionMetricsHelper::MediaStoppedPlaying(
+    const MediaPlayerInfo& media_info,
+    const content::MediaPlayerId&,
+    WebContentsObserver::MediaStoppedReason reason) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  if (!media_info.has_video)
+    return;
+
+  num_videos_playing_--;
+
+  if (num_videos_playing_ == 0) {
+    // stopped playing video - update existing video sessions
+    base::Time stop_time = base::Time::Now();
+
+    if (session_video_timer_) {
+      session_video_timer_->StopSession(true, stop_time);
+    }
+  }
+}
+
+void SessionMetricsHelper::DidStartNavigation(
+    content::NavigationHandle* handle) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+
+  if (handle && handle->IsInMainFrame() && !handle->IsSameDocument()) {
+    // All sessions are terminated on navigations, so to ensure that we log
+    // everything that we have, cleanup any outstanding session trackers now.
+    if (webxr_immersive_session_tracker_) {
+      StopAndRecordImmersiveSession();
+    }
+
+    for (auto& inline_session_tracker : webxr_inline_session_trackers_) {
+      inline_session_tracker.second->SetSessionEnd(base::Time::Now());
+      inline_session_tracker.second->ukm_entry()->SetDuration(
+          inline_session_tracker.second->GetRoundedDurationInSeconds());
+      inline_session_tracker.second->RecordEntry();
+    }
+
+    webxr_inline_session_trackers_.clear();
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/metrics/session_metrics_helper.h b/chromium/content/browser/xr/metrics/session_metrics_helper.h
new file mode 100644
index 00000000000..d88dcaf2681
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_metrics_helper.h
@@ -0,0 +1,89 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_METRICS_SESSION_METRICS_HELPER_H_
+#define CONTENT_BROWSER_XR_METRICS_SESSION_METRICS_HELPER_H_
+
+#include <memory>
+#include <set>
+#include <unordered_map>
+
+#include "base/time/time.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "device/vr/public/mojom/vr_service.mojom-forward.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
+
+namespace content {
+class SessionTimer;
+class WebXRSessionTracker;
+
+// This class is not thread-safe and must only be used from the main thread.
+// This class tracks metrics for various kinds of sessions, including VR
+// browsing sessions, WebXR presentation sessions, and others. It mainly tracks
+// metrics that require state monitoring, such as durations, but also tracks
+// data we want attached to that, such as number of videos watched and how the
+// session was started.
+class SessionMetricsHelper : public content::WebContentsObserver {
+ public:
+  // Returns the SessionMetricsHelper singleton if it has been created for the
+  // WebContents.
+  static SessionMetricsHelper* FromWebContents(content::WebContents* contents);
+  static SessionMetricsHelper* CreateForWebContents(
+      content::WebContents* contents);
+
+  ~SessionMetricsHelper() override;
+
+  // Records that an inline session was started and returns the |PendingRemote|
+  // for the created session recorder.
+  mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+  StartInlineSession(
+      const device::mojom::XRSessionOptions& session_options,
+      const std::set<device::mojom::XRSessionFeature>& enabled_features,
+      size_t session_id);
+
+  // Records that inline session was stopped. Will record an UKM entry.
+  void StopAndRecordInlineSession(size_t session_id);
+
+  // Records that an immersive session was started and returns the
+  // |PendingRemote| for the created session recorder. Two immersive sessions
+  // may not exist simultaneously.
+  mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+  StartImmersiveSession(
+      const device::mojom::XRSessionOptions& session_options,
+      const std::set<device::mojom::XRSessionFeature>& enabled_features);
+
+  // Records that an immersive session was stopped. Will record a UKM entry.
+  void StopAndRecordImmersiveSession();
+
+ private:
+  explicit SessionMetricsHelper(content::WebContents* contents);
+
+  // WebContentsObserver
+  void MediaStartedPlaying(const MediaPlayerInfo& media_info,
+                           const content::MediaPlayerId&) override;
+  void MediaStoppedPlaying(
+      const MediaPlayerInfo& media_info,
+      const content::MediaPlayerId&,
+      WebContentsObserver::MediaStoppedReason reason) override;
+  void DidStartNavigation(content::NavigationHandle* handle) override;
+
+  std::unique_ptr<SessionTimer> session_video_timer_;
+  std::unique_ptr<SessionTimer> session_timer_;
+
+  std::unique_ptr<WebXRSessionTracker> webxr_immersive_session_tracker_;
+
+  // Map associating active inline session Ids to their trackers. The contents
+  // of the map are managed by |StartInlineSession| and
+  // |StopAndRecordInlineSession|.
+  std::unordered_map<size_t, std::unique_ptr<WebXRSessionTracker>>
+      webxr_inline_session_trackers_;
+
+  int num_videos_playing_ = 0;
+  int num_session_video_playback_ = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_METRICS_SESSION_METRICS_HELPER_H_
diff --git a/chromium/content/browser/xr/metrics/session_timer.cc b/chromium/content/browser/xr/metrics/session_timer.cc
new file mode 100644
index 00000000000..1ab24750a3d
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_timer.cc
@@ -0,0 +1,69 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/metrics/session_timer.h"
+
+#include "base/metrics/histogram_functions.h"
+
+namespace content {
+
+SessionTimer::SessionTimer(char const* histogram_name,
+                           base::TimeDelta gap_time,
+                           base::TimeDelta minimum_duration)
+    : histogram_name_(histogram_name),
+      maximum_session_gap_time_(gap_time),
+      minimum_duration_(minimum_duration) {}
+
+SessionTimer::~SessionTimer() {
+  StopSession(false, base::Time::Now());
+}
+
+void SessionTimer::StartSession(base::Time start_time) {
+  // If the new start time is within the minimum session gap time from the
+  // last stop, continue the previous session. Otherwise, start a new session,
+  // sending the event for the last session.
+  if (!stop_time_.is_null() &&
+      start_time - stop_time_ <= maximum_session_gap_time_) {
+    // Mark the previous segment as non-continuable, sending data and clearing
+    // state.
+    StopSession(false, stop_time_);
+  }
+
+  start_time_ = start_time;
+}
+
+void SessionTimer::StopSession(bool continuable, base::Time stop_time) {
+  // first accumulate time from this segment of the session
+  base::TimeDelta segment_duration =
+      (start_time_.is_null() ? base::TimeDelta() : stop_time - start_time_);
+  if (!segment_duration.is_zero() && segment_duration > minimum_duration_) {
+    accumulated_time_ = accumulated_time_ + segment_duration;
+  }
+
+  if (continuable) {
+    // if we are continuable, accumulate the current segment to the session,
+    // and set stop_time_ so we may continue later
+    accumulated_time_ = stop_time - start_time_ + accumulated_time_;
+    stop_time_ = stop_time;
+    start_time_ = base::Time();
+  } else {
+    // send the histogram now if we aren't continuable, clearing segment state
+    SendAccumulatedSessionTime();
+
+    // clear out start/stop/accumulated time
+    start_time_ = base::Time();
+    stop_time_ = base::Time();
+    accumulated_time_ = base::TimeDelta();
+  }
+}
+
+void SessionTimer::SendAccumulatedSessionTime() {
+  if (!accumulated_time_.is_zero()) {
+    base::UmaHistogramCustomTimes(histogram_name_, accumulated_time_,
+                                  base::TimeDelta(),
+                                  base::TimeDelta::FromHours(5), 100);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/metrics/session_timer.h b/chromium/content/browser/xr/metrics/session_timer.h
new file mode 100644
index 00000000000..6c1eee183d4
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_timer.h
@@ -0,0 +1,54 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_METRICS_SESSION_TIMER_H_
+#define CONTENT_BROWSER_XR_METRICS_SESSION_TIMER_H_
+
+#include "base/time/time.h"
+
+namespace content {
+
+// SessionTimer will monitor the time between calls to StartSession and
+// StopSession.  It will combine multiple segments into a single session if they
+// are sufficiently close in time.  It will also only include segments if they
+// are sufficiently long.
+// Because the session may be extended, the accumulated time is only sent when
+// a StopSession call indicates that the session is no longer continuable, or
+// on destruction.
+class SessionTimer {
+ public:
+  SessionTimer(char const* histogram_name,
+               base::TimeDelta gap_time,
+               base::TimeDelta minimum_duration);
+
+  virtual ~SessionTimer();
+
+  SessionTimer(const SessionTimer&) = delete;
+  SessionTimer& operator=(const SessionTimer&) = delete;
+
+  void StartSession(base::Time start_time);
+  void StopSession(bool continuable, base::Time stop_time);
+
+ private:
+  void SendAccumulatedSessionTime();
+
+  char const* histogram_name_;
+
+  base::Time start_time_;
+  base::Time stop_time_;
+  base::TimeDelta accumulated_time_;
+
+  // Config members.
+  // Maximum time gap allowed between a StopSession and a StartSession before it
+  // will be logged as a separate session.
+  base::TimeDelta maximum_session_gap_time_;
+
+  // Minimum time between a StartSession and StopSession required before it is
+  // added to the duration.
+  base::TimeDelta minimum_duration_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_METRICS_SESSION_TIMER_H_
diff --git a/chromium/content/browser/xr/metrics/session_tracker.h b/chromium/content/browser/xr/metrics/session_tracker.h
new file mode 100644
index 00000000000..38ee234cdf0
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_tracker.h
@@ -0,0 +1,69 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_METRICS_SESSION_TRACKER_H_
+#define CONTENT_BROWSER_XR_METRICS_SESSION_TRACKER_H_
+
+#include <memory>
+#include <utility>
+
+#include "base/logging.h"
+#include "base/time/time.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
+
+namespace content {
+
+// SessionTracker tracks UKM data for sessions and sends the data upon request.
+template <class T>
+class SessionTracker {
+ public:
+  explicit SessionTracker(std::unique_ptr<T> entry)
+      : ukm_entry_(std::move(entry)),
+        start_time_(base::Time::Now()),
+        stop_time_(base::Time::Now()) {}
+  virtual ~SessionTracker() {}
+  T* ukm_entry() { return ukm_entry_.get(); }
+  void SetSessionEnd(base::Time stop_time) { stop_time_ = stop_time; }
+
+  int GetRoundedDurationInSeconds() {
+    if (start_time_ > stop_time_) {
+      // Return negative one to indicate an invalid value was recorded.
+      return -1;
+    }
+
+    base::TimeDelta duration = stop_time_ - start_time_;
+    DVLOG(1) << __func__ << ": " << duration.InSeconds();
+
+    if (duration.InHours() > 1) {
+      return duration.InHours() * 3600;
+    } else if (duration.InMinutes() > 10) {
+      return (duration.InMinutes() / 10) * 10 * 60;
+    } else if (duration.InSeconds() > 60) {
+      return duration.InMinutes() * 60;
+    } else {
+      return duration.InSeconds();
+    }
+  }
+
+  void RecordEntry() {
+    DVLOG(1) << __func__;
+    ukm::UkmRecorder* ukm_recorder = ukm::UkmRecorder::Get();
+    DCHECK(ukm_recorder);
+
+    ukm_entry_->Record(ukm_recorder);
+  }
+
+  SessionTracker(const SessionTracker&) = delete;
+  SessionTracker& operator=(const SessionTracker&) = delete;
+
+ protected:
+  std::unique_ptr<T> ukm_entry_;
+
+  base::Time start_time_;
+  base::Time stop_time_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_METRICS_SESSION_TRACKER_H_
diff --git a/chromium/content/browser/xr/metrics/session_tracker_unittest.cc b/chromium/content/browser/xr/metrics/session_tracker_unittest.cc
new file mode 100644
index 00000000000..8c9088d25cf
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/session_tracker_unittest.cc
@@ -0,0 +1,40 @@
+// Copyright (c) 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/metrics/session_tracker.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+class FakeUkmEvent {
+  void Record(ukm::UkmRecorder* recorder) {}
+};
+
+class SessionTrackerTest : public testing::Test {
+ public:
+  SessionTrackerTest() {}
+  DISALLOW_COPY_AND_ASSIGN(SessionTrackerTest);
+};
+
+TEST_F(SessionTrackerTest, SessionTrackerGetRoundedDurationInSeconds) {
+  SessionTracker<FakeUkmEvent> tracker(std::make_unique<FakeUkmEvent>());
+  base::Time now = base::Time::Now();
+
+  tracker.SetSessionEnd(now + base::TimeDelta::FromSeconds(8));
+  EXPECT_EQ(tracker.GetRoundedDurationInSeconds(), 8);
+
+  // 3 min and 7 seconds, round down to nearest minute
+  tracker.SetSessionEnd(now + base::TimeDelta::FromSeconds(187));
+  EXPECT_EQ(tracker.GetRoundedDurationInSeconds(), 180);
+
+  // 22 minutes 34 seconds, rounds down to nearest 10 minutes
+  tracker.SetSessionEnd(now + base::TimeDelta::FromSeconds(1254));
+  EXPECT_EQ(tracker.GetRoundedDurationInSeconds(), 1200);
+
+  // 2 hours, 10 minutes, 22 seconds, rounds down nearest hour
+  tracker.SetSessionEnd(now + base::TimeDelta::FromSeconds(7822));
+  EXPECT_EQ(tracker.GetRoundedDurationInSeconds(), 7200);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/metrics/webxr_session_tracker.cc b/chromium/content/browser/xr/metrics/webxr_session_tracker.cc
new file mode 100644
index 00000000000..1914e7e1289
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/webxr_session_tracker.cc
@@ -0,0 +1,119 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/metrics/webxr_session_tracker.h"
+
+#include <utility>
+
+namespace content {
+
+WebXRSessionTracker::WebXRSessionTracker(
+    std::unique_ptr<ukm::builders::XR_WebXR_Session> entry)
+    : SessionTracker<ukm::builders::XR_WebXR_Session>(std::move(entry)),
+      receiver_(this) {}
+
+WebXRSessionTracker::~WebXRSessionTracker() = default;
+
+void WebXRSessionTracker::ReportRequestedFeatures(
+    const device::mojom::XRSessionOptions& session_options,
+    const std::set<device::mojom::XRSessionFeature>& enabled_features) {
+  using device::mojom::XRSessionFeature;
+  using device::mojom::XRSessionFeatureRequestStatus;
+
+  // Set all features as 'not requested', to begin
+  SetFeatureRequest(XRSessionFeature::REF_SPACE_VIEWER,
+                    XRSessionFeatureRequestStatus::kNotRequested);
+  SetFeatureRequest(XRSessionFeature::REF_SPACE_LOCAL,
+                    XRSessionFeatureRequestStatus::kNotRequested);
+  SetFeatureRequest(XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+                    XRSessionFeatureRequestStatus::kNotRequested);
+  SetFeatureRequest(XRSessionFeature::REF_SPACE_BOUNDED_FLOOR,
+                    XRSessionFeatureRequestStatus::kNotRequested);
+  SetFeatureRequest(XRSessionFeature::REF_SPACE_UNBOUNDED,
+                    XRSessionFeatureRequestStatus::kNotRequested);
+  // Not currently recording metrics for XRSessionFeature::DOM_OVERLAY
+
+  // Record required feature requests
+  for (auto feature : session_options.required_features) {
+    DCHECK(enabled_features.find(feature) != enabled_features.end());
+    SetFeatureRequest(feature, XRSessionFeatureRequestStatus::kRequired);
+  }
+
+  // Record optional feature requests
+  for (auto feature : session_options.optional_features) {
+    bool enabled = enabled_features.find(feature) != enabled_features.end();
+    SetFeatureRequest(
+        feature, enabled ? XRSessionFeatureRequestStatus::kOptionalAccepted
+                         : XRSessionFeatureRequestStatus::kOptionalRejected);
+  }
+}
+
+void WebXRSessionTracker::ReportFeatureUsed(
+    device::mojom::XRSessionFeature feature) {
+  using device::mojom::XRSessionFeature;
+
+  switch (feature) {
+    case XRSessionFeature::REF_SPACE_VIEWER:
+      ukm_entry_->SetFeatureUse_Viewer(true);
+      break;
+    case XRSessionFeature::REF_SPACE_LOCAL:
+      ukm_entry_->SetFeatureUse_Local(true);
+      break;
+    case XRSessionFeature::REF_SPACE_LOCAL_FLOOR:
+      ukm_entry_->SetFeatureUse_LocalFloor(true);
+      break;
+    case XRSessionFeature::REF_SPACE_BOUNDED_FLOOR:
+      ukm_entry_->SetFeatureUse_BoundedFloor(true);
+      break;
+    case XRSessionFeature::REF_SPACE_UNBOUNDED:
+      ukm_entry_->SetFeatureUse_Unbounded(true);
+      break;
+    case XRSessionFeature::DOM_OVERLAY:
+    case XRSessionFeature::HIT_TEST:
+    case XRSessionFeature::LIGHT_ESTIMATION:
+    case XRSessionFeature::ANCHORS:
+      // Not recording metrics for these features currently.
+      // TODO(https://crbug.com/965729): Add metrics for the AR-related features
+      // that are enabled by default.
+      break;
+  }
+}
+
+mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+WebXRSessionTracker::BindMetricsRecorderPipe() {
+  return receiver_.BindNewPipeAndPassRemote();
+}
+
+void WebXRSessionTracker::SetFeatureRequest(
+    device::mojom::XRSessionFeature feature,
+    device::mojom::XRSessionFeatureRequestStatus status) {
+  using device::mojom::XRSessionFeature;
+
+  switch (feature) {
+    case XRSessionFeature::REF_SPACE_VIEWER:
+      ukm_entry_->SetFeatureRequest_Viewer(static_cast<int64_t>(status));
+      break;
+    case XRSessionFeature::REF_SPACE_LOCAL:
+      ukm_entry_->SetFeatureRequest_Local(static_cast<int64_t>(status));
+      break;
+    case XRSessionFeature::REF_SPACE_LOCAL_FLOOR:
+      ukm_entry_->SetFeatureRequest_Local(static_cast<int64_t>(status));
+      break;
+    case XRSessionFeature::REF_SPACE_BOUNDED_FLOOR:
+      ukm_entry_->SetFeatureRequest_Local(static_cast<int64_t>(status));
+      break;
+    case XRSessionFeature::REF_SPACE_UNBOUNDED:
+      ukm_entry_->SetFeatureRequest_Local(static_cast<int64_t>(status));
+      break;
+    case XRSessionFeature::DOM_OVERLAY:
+    case XRSessionFeature::HIT_TEST:
+    case XRSessionFeature::LIGHT_ESTIMATION:
+    case XRSessionFeature::ANCHORS:
+      // Not recording metrics for these features currently.
+      // TODO(https://crbug.com/965729): Add metrics for the AR-related features
+      // that are enabled by default.
+      break;
+  }
+}
+}  // namespace content
diff --git a/chromium/content/browser/xr/metrics/webxr_session_tracker.h b/chromium/content/browser/xr/metrics/webxr_session_tracker.h
new file mode 100644
index 00000000000..148762b5d80
--- /dev/null
+++ b/chromium/content/browser/xr/metrics/webxr_session_tracker.h
@@ -0,0 +1,51 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_METRICS_WEBXR_SESSION_TRACKER_H_
+#define CONTENT_BROWSER_XR_METRICS_WEBXR_SESSION_TRACKER_H_
+
+#include <memory>
+#include <set>
+
+#include "content/browser/xr/metrics/session_tracker.h"
+#include "device/vr/public/mojom/isolated_xr_service.mojom.h"
+#include "device/vr/public/mojom/vr_service.mojom.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
+
+namespace content {
+
+class WebXRSessionTracker
+    : public SessionTracker<ukm::builders::XR_WebXR_Session>,
+      device::mojom::XRSessionMetricsRecorder {
+ public:
+  explicit WebXRSessionTracker(
+      std::unique_ptr<ukm::builders::XR_WebXR_Session> entry);
+  ~WebXRSessionTracker() override;
+
+  // Records which features for the session have been requested as required or
+  // optional, which were accepted/rejeceted, and which weren't requested at
+  // all. This assumes that the session as a whole was accepted.
+  void ReportRequestedFeatures(
+      const device::mojom::XRSessionOptions& session_options,
+      const std::set<device::mojom::XRSessionFeature>& enabled_features);
+
+  // |XRSessionMetricsRecorder| implementation
+  void ReportFeatureUsed(device::mojom::XRSessionFeature feature) override;
+
+  // Binds this tracker's |XRSessionMetricsRecorder| receiver to a new pipe, and
+  // returns the |PendingRemote|.
+  mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+  BindMetricsRecorderPipe();
+
+ private:
+  void SetFeatureRequest(device::mojom::XRSessionFeature feature,
+                         device::mojom::XRSessionFeatureRequestStatus status);
+
+  mojo::Receiver<device::mojom::XRSessionMetricsRecorder> receiver_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_METRICS_WEBXR_SESSION_TRACKER_H_
diff --git a/chromium/content/browser/xr/service/browser_xr_runtime_impl.cc b/chromium/content/browser/xr/service/browser_xr_runtime_impl.cc
new file mode 100644
index 00000000000..59394d2d92d
--- /dev/null
+++ b/chromium/content/browser/xr/service/browser_xr_runtime_impl.cc
@@ -0,0 +1,577 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/service/browser_xr_runtime_impl.h"
+
+#include <algorithm>
+#include <memory>
+#include <utility>
+
+#include "base/bind_helpers.h"
+#include "base/numerics/ranges.h"
+#include "build/build_config.h"
+#include "content/browser/xr/service/vr_service_impl.h"
+#include "content/browser/xr/xr_utils.h"
+#include "content/public/browser/xr_install_helper.h"
+#include "content/public/browser/xr_integration_client.h"
+#include "content/public/common/content_features.h"
+#include "device/vr/buildflags/buildflags.h"
+#include "device/vr/public/cpp/session_mode.h"
+#include "ui/gfx/transform.h"
+#include "ui/gfx/transform_util.h"
+
+namespace content {
+namespace {
+bool IsValidTransform(const gfx::Transform& transform,
+                      float max_translate_meters) {
+  if (!transform.IsInvertible() || transform.HasPerspective())
+    return false;
+
+  gfx::DecomposedTransform decomp;
+  if (!DecomposeTransform(&decomp, transform))
+    return false;
+
+  float kEpsilon = 0.1f;
+  if (abs(decomp.perspective[3] - 1) > kEpsilon) {
+    // If testing with unexpectedly high values, catch on debug builds rather
+    // than silently change data.  On release builds its better to be safe and
+    // validate.
+    DCHECK(false);
+    return false;
+  }
+  for (int i = 0; i < 3; ++i) {
+    if (abs(decomp.scale[i] - 1) > kEpsilon)
+      return false;
+    if (abs(decomp.skew[i]) > kEpsilon)
+      return false;
+    if (abs(decomp.perspective[i]) > kEpsilon)
+      return false;
+    if (abs(decomp.translate[i]) > max_translate_meters)
+      return false;
+  }
+
+  // Only rotate and translate.
+  return true;
+}
+
+device::mojom::VREyeParametersPtr ValidateEyeParameters(
+    const device::mojom::VREyeParameters* eye) {
+  if (!eye)
+    return nullptr;
+  device::mojom::VREyeParametersPtr ret = device::mojom::VREyeParameters::New();
+  // FOV
+  float kDefaultFOV = 45;
+  ret->field_of_view = device::mojom::VRFieldOfView::New();
+  if (eye->field_of_view->up_degrees < 90 &&
+      eye->field_of_view->up_degrees > -90 &&
+      eye->field_of_view->up_degrees > -eye->field_of_view->down_degrees &&
+      eye->field_of_view->down_degrees < 90 &&
+      eye->field_of_view->down_degrees > -90 &&
+      eye->field_of_view->down_degrees > -eye->field_of_view->up_degrees &&
+      eye->field_of_view->left_degrees < 90 &&
+      eye->field_of_view->left_degrees > -90 &&
+      eye->field_of_view->left_degrees > -eye->field_of_view->right_degrees &&
+      eye->field_of_view->right_degrees < 90 &&
+      eye->field_of_view->right_degrees > -90 &&
+      eye->field_of_view->right_degrees > -eye->field_of_view->left_degrees) {
+    ret->field_of_view->up_degrees = eye->field_of_view->up_degrees;
+    ret->field_of_view->down_degrees = eye->field_of_view->down_degrees;
+    ret->field_of_view->left_degrees = eye->field_of_view->left_degrees;
+    ret->field_of_view->right_degrees = eye->field_of_view->right_degrees;
+  } else {
+    ret->field_of_view->up_degrees = kDefaultFOV;
+    ret->field_of_view->down_degrees = kDefaultFOV;
+    ret->field_of_view->left_degrees = kDefaultFOV;
+    ret->field_of_view->right_degrees = kDefaultFOV;
+  }
+
+  // Head-from-Eye Transform
+  // Maximum 10m translation.
+  if (IsValidTransform(eye->head_from_eye, 10)) {
+    ret->head_from_eye = eye->head_from_eye;
+  }
+  // else, ret->head_from_eye remains the identity transform
+
+  // Renderwidth/height
+  uint32_t kMaxSize = 16384;
+  uint32_t kMinSize = 2;
+  // DCHECK on debug builds to catch legitimate large sizes, but clamp on
+  // release builds to ensure valid state.
+  DCHECK(eye->render_width < kMaxSize);
+  DCHECK(eye->render_height < kMaxSize);
+  ret->render_width = base::ClampToRange(eye->render_width, kMinSize, kMaxSize);
+  ret->render_height =
+      base::ClampToRange(eye->render_height, kMinSize, kMaxSize);
+  return ret;
+}
+
+device::mojom::VRDisplayInfoPtr ValidateVRDisplayInfo(
+    const device::mojom::VRDisplayInfo* info,
+    device::mojom::XRDeviceId id) {
+  if (!info)
+    return nullptr;
+
+  device::mojom::VRDisplayInfoPtr ret = device::mojom::VRDisplayInfo::New();
+
+  // Rather than just cloning everything, we copy over each field and validate
+  // individually.  This ensures new fields don't bypass validation.
+  ret->id = id;
+
+  // Maximum 1000km translation.
+  if (info->stage_parameters &&
+      IsValidTransform(info->stage_parameters->standing_transform, 1000000)) {
+    ret->stage_parameters = device::mojom::VRStageParameters::New(
+        info->stage_parameters->standing_transform,
+        info->stage_parameters->bounds);
+  }
+
+  ret->left_eye = ValidateEyeParameters(info->left_eye.get());
+  ret->right_eye = ValidateEyeParameters(info->right_eye.get());
+
+  float kMinFramebufferScale = 0.1f;
+  float kMaxFramebufferScale = 1.0f;
+
+  if (info->webxr_default_framebuffer_scale <= kMaxFramebufferScale &&
+      info->webxr_default_framebuffer_scale >= kMinFramebufferScale) {
+    ret->webxr_default_framebuffer_scale =
+        info->webxr_default_framebuffer_scale;
+  } else {
+    ret->webxr_default_framebuffer_scale = 1;
+  }
+  return ret;
+}
+
+// TODO(crbug.com/995377): Report these from the device runtime instead.
+constexpr device::mojom::XRSessionFeature kOrientationDeviceFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+};
+
+constexpr device::mojom::XRSessionFeature kGVRDeviceFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+};
+
+constexpr device::mojom::XRSessionFeature kARCoreDeviceFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_UNBOUNDED,
+    device::mojom::XRSessionFeature::DOM_OVERLAY,
+    device::mojom::XRSessionFeature::LIGHT_ESTIMATION,
+    device::mojom::XRSessionFeature::ANCHORS,
+};
+
+#if BUILDFLAG(ENABLE_OPENVR)
+constexpr device::mojom::XRSessionFeature kOpenVRFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_BOUNDED_FLOOR,
+};
+#endif
+
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+constexpr device::mojom::XRSessionFeature kWindowsMixedRealityFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_BOUNDED_FLOOR,
+};
+#endif
+
+#if BUILDFLAG(ENABLE_OPENXR)
+constexpr device::mojom::XRSessionFeature kOpenXRFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_BOUNDED_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_UNBOUNDED,
+};
+#endif
+
+#if BUILDFLAG(ENABLE_OCULUS_VR)
+constexpr device::mojom::XRSessionFeature kOculusFeatures[] = {
+    device::mojom::XRSessionFeature::REF_SPACE_VIEWER,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL,
+    device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR,
+    device::mojom::XRSessionFeature::REF_SPACE_BOUNDED_FLOOR,
+};
+#endif
+
+bool ContainsFeature(
+    base::span<const device::mojom::XRSessionFeature> feature_list,
+    device::mojom::XRSessionFeature feature) {
+  return std::find(feature_list.begin(), feature_list.end(), feature) !=
+         feature_list.end();
+}
+}  // anonymous namespace
+
+BrowserXRRuntimeImpl::BrowserXRRuntimeImpl(
+    device::mojom::XRDeviceId id,
+    mojo::PendingRemote<device::mojom::XRRuntime> runtime,
+    device::mojom::VRDisplayInfoPtr display_info)
+    : id_(id),
+      runtime_(std::move(runtime)),
+      display_info_(ValidateVRDisplayInfo(display_info.get(), id)) {
+  DVLOG(2) << __func__ << ": id=" << id;
+  // Unretained is safe because we are calling through an InterfacePtr we own,
+  // so we won't be called after runtime_ is destroyed.
+  runtime_->ListenToDeviceChanges(
+      receiver_.BindNewEndpointAndPassRemote(),
+      base::BindOnce(&BrowserXRRuntimeImpl::OnDisplayInfoChanged,
+                     base::Unretained(this)));
+
+  // TODO(crbug.com/1031622): Convert this to a query for the client off of
+  // ContentBrowserClient once BrowserXRRuntimeImpl moves to content.
+  auto* integration_client = GetXrIntegrationClient();
+
+  if (integration_client) {
+    install_helper_ = integration_client->GetInstallHelper(id_);
+    consent_helper_ = integration_client->GetConsentHelper(id_);
+  }
+}
+
+BrowserXRRuntimeImpl::~BrowserXRRuntimeImpl() {
+  DVLOG(2) << __func__ << ": id=" << id_;
+
+  if (install_finished_callback_) {
+    std::move(install_finished_callback_).Run(false);
+  }
+}
+
+void BrowserXRRuntimeImpl::ExitActiveImmersiveSession() {
+  DVLOG(2) << __func__;
+  auto* service = GetServiceWithActiveImmersiveSession();
+  if (service) {
+    service->ExitPresent(base::DoNothing());
+  }
+}
+
+bool BrowserXRRuntimeImpl::SupportsFeature(
+    device::mojom::XRSessionFeature feature) const {
+  switch (id_) {
+    // Test/fake devices support all features.
+    case device::mojom::XRDeviceId::WEB_TEST_DEVICE_ID:
+    case device::mojom::XRDeviceId::FAKE_DEVICE_ID:
+      return true;
+    case device::mojom::XRDeviceId::ARCORE_DEVICE_ID:
+      // Only support hit test if the feature flag is enabled.
+      if (feature == device::mojom::XRSessionFeature::HIT_TEST) {
+        return base::FeatureList::IsEnabled(features::kWebXrHitTest);
+      }
+
+      return ContainsFeature(kARCoreDeviceFeatures, feature);
+    case device::mojom::XRDeviceId::ORIENTATION_DEVICE_ID:
+      return ContainsFeature(kOrientationDeviceFeatures, feature);
+    case device::mojom::XRDeviceId::GVR_DEVICE_ID:
+      return ContainsFeature(kGVRDeviceFeatures, feature);
+
+#if BUILDFLAG(ENABLE_OPENVR)
+    case device::mojom::XRDeviceId::OPENVR_DEVICE_ID:
+      return ContainsFeature(kOpenVRFeatures, feature);
+#endif
+
+#if BUILDFLAG(ENABLE_OCULUS_VR)
+    case device::mojom::XRDeviceId::OCULUS_DEVICE_ID:
+      return ContainsFeature(kOculusFeatures, feature);
+#endif
+
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+    case device::mojom::XRDeviceId::WINDOWS_MIXED_REALITY_ID:
+      return ContainsFeature(kWindowsMixedRealityFeatures, feature);
+#endif
+
+#if BUILDFLAG(ENABLE_OPENXR)
+    case device::mojom::XRDeviceId::OPENXR_DEVICE_ID:
+      return ContainsFeature(kOpenXRFeatures, feature);
+#endif
+  }
+
+  NOTREACHED();
+}
+
+bool BrowserXRRuntimeImpl::SupportsAllFeatures(
+    const std::vector<device::mojom::XRSessionFeature>& features) const {
+  for (const auto& feature : features) {
+    if (!SupportsFeature(feature))
+      return false;
+  }
+
+  return true;
+}
+
+bool BrowserXRRuntimeImpl::SupportsCustomIPD() const {
+  switch (id_) {
+    case device::mojom::XRDeviceId::ARCORE_DEVICE_ID:
+    case device::mojom::XRDeviceId::WEB_TEST_DEVICE_ID:
+    case device::mojom::XRDeviceId::FAKE_DEVICE_ID:
+    case device::mojom::XRDeviceId::ORIENTATION_DEVICE_ID:
+    case device::mojom::XRDeviceId::GVR_DEVICE_ID:
+      return false;
+#if BUILDFLAG(ENABLE_OPENVR)
+    case device::mojom::XRDeviceId::OPENVR_DEVICE_ID:
+      return true;
+#endif
+#if BUILDFLAG(ENABLE_OCULUS_VR)
+    case device::mojom::XRDeviceId::OCULUS_DEVICE_ID:
+      return true;
+#endif
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+    case device::mojom::XRDeviceId::WINDOWS_MIXED_REALITY_ID:
+      return true;
+#endif
+#if BUILDFLAG(ENABLE_OPENXR)
+    case device::mojom::XRDeviceId::OPENXR_DEVICE_ID:
+      return true;
+#endif
+  }
+
+  NOTREACHED();
+}
+
+bool BrowserXRRuntimeImpl::SupportsNonEmulatedHeight() const {
+  switch (id_) {
+    case device::mojom::XRDeviceId::ARCORE_DEVICE_ID:
+    case device::mojom::XRDeviceId::WEB_TEST_DEVICE_ID:
+    case device::mojom::XRDeviceId::FAKE_DEVICE_ID:
+    case device::mojom::XRDeviceId::ORIENTATION_DEVICE_ID:
+      return false;
+    case device::mojom::XRDeviceId::GVR_DEVICE_ID:
+#if BUILDFLAG(ENABLE_OPENVR)
+    case device::mojom::XRDeviceId::OPENVR_DEVICE_ID:
+#endif
+#if BUILDFLAG(ENABLE_OCULUS_VR)
+    case device::mojom::XRDeviceId::OCULUS_DEVICE_ID:
+#endif
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+    case device::mojom::XRDeviceId::WINDOWS_MIXED_REALITY_ID:
+#endif
+#if BUILDFLAG(ENABLE_OPENXR)
+    case device::mojom::XRDeviceId::OPENXR_DEVICE_ID:
+#endif
+      return true;
+  }
+
+  NOTREACHED();
+}
+
+void BrowserXRRuntimeImpl::OnDisplayInfoChanged(
+    device::mojom::VRDisplayInfoPtr vr_device_info) {
+  bool had_display_info = !!display_info_;
+  display_info_ = ValidateVRDisplayInfo(vr_device_info.get(), id_);
+  if (had_display_info) {
+    for (VRServiceImpl* service : services_) {
+      service->OnDisplayInfoChanged();
+    }
+  }
+
+  // Notify observers of the new display info.
+  for (Observer& observer : observers_) {
+    observer.SetVRDisplayInfo(display_info_.Clone());
+  }
+}
+
+void BrowserXRRuntimeImpl::StopImmersiveSession(
+    VRServiceImpl::ExitPresentCallback on_exited) {
+  DVLOG(2) << __func__;
+  if (immersive_session_controller_) {
+    immersive_session_controller_.reset();
+    if (presenting_service_) {
+      presenting_service_->OnExitPresent();
+      presenting_service_ = nullptr;
+    }
+
+    for (Observer& observer : observers_) {
+      observer.SetWebXRWebContents(nullptr);
+    }
+  }
+  std::move(on_exited).Run();
+}
+
+void BrowserXRRuntimeImpl::OnExitPresent() {
+  DVLOG(2) << __func__;
+  if (presenting_service_) {
+    presenting_service_->OnExitPresent();
+    presenting_service_ = nullptr;
+  }
+}
+
+void BrowserXRRuntimeImpl::OnVisibilityStateChanged(
+    device::mojom::XRVisibilityState visibility_state) {
+  for (VRServiceImpl* service : services_) {
+    service->OnVisibilityStateChanged(visibility_state);
+  }
+}
+
+void BrowserXRRuntimeImpl::OnServiceAdded(VRServiceImpl* service) {
+  DVLOG(2) << __func__ << ": id=" << id_;
+  services_.insert(service);
+}
+
+void BrowserXRRuntimeImpl::OnServiceRemoved(VRServiceImpl* service) {
+  DVLOG(2) << __func__ << ": id=" << id_;
+  DCHECK(service);
+  services_.erase(service);
+  if (service == presenting_service_) {
+    ExitPresent(service, base::DoNothing());
+  }
+}
+
+void BrowserXRRuntimeImpl::ExitPresent(
+    VRServiceImpl* service,
+    VRServiceImpl::ExitPresentCallback on_exited) {
+  DVLOG(2) << __func__ << ": id=" << id_ << " service=" << service
+           << " presenting_service_=" << presenting_service_;
+  if (service == presenting_service_) {
+    runtime_->ShutdownSession(
+        base::BindOnce(&BrowserXRRuntimeImpl::StopImmersiveSession,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(on_exited)));
+  }
+}
+
+void BrowserXRRuntimeImpl::SetFramesThrottled(const VRServiceImpl* service,
+                                              bool throttled) {
+  if (service == presenting_service_) {
+    for (Observer& observer : observers_) {
+      observer.SetFramesThrottled(throttled);
+    }
+  }
+}
+
+void BrowserXRRuntimeImpl::RequestSession(
+    VRServiceImpl* service,
+    const device::mojom::XRRuntimeSessionOptionsPtr& options,
+    RequestSessionCallback callback) {
+  DVLOG(2) << __func__ << ": id=" << id_;
+  // base::Unretained is safe because we won't be called back after runtime_ is
+  // destroyed.
+  runtime_->RequestSession(
+      options->Clone(),
+      base::BindOnce(&BrowserXRRuntimeImpl::OnRequestSessionResult,
+                     base::Unretained(this), service->GetWeakPtr(),
+                     options->Clone(), std::move(callback)));
+}
+
+void BrowserXRRuntimeImpl::OnRequestSessionResult(
+    base::WeakPtr<VRServiceImpl> service,
+    device::mojom::XRRuntimeSessionOptionsPtr options,
+    RequestSessionCallback callback,
+    device::mojom::XRSessionPtr session,
+    mojo::PendingRemote<device::mojom::XRSessionController>
+        immersive_session_controller) {
+  if (session && service) {
+    DVLOG(2) << __func__ << ": id=" << id_;
+    if (device::XRSessionModeUtils::IsImmersive(options->mode)) {
+      presenting_service_ = service.get();
+      immersive_session_controller_.Bind(
+          std::move(immersive_session_controller));
+      immersive_session_controller_.set_disconnect_handler(
+          base::BindOnce(&BrowserXRRuntimeImpl::OnImmersiveSessionError,
+                         base::Unretained(this)));
+
+      // Notify observers that we have started presentation.
+      content::WebContents* web_contents = service->GetWebContents();
+      for (Observer& observer : observers_) {
+        observer.SetWebXRWebContents(web_contents);
+      }
+    }
+
+    std::move(callback).Run(std::move(session));
+  } else {
+    std::move(callback).Run(nullptr);
+    if (session) {
+      // The service has been removed, but we still got a session, so make
+      // sure to clean up this weird state.
+      immersive_session_controller_.Bind(
+          std::move(immersive_session_controller));
+      StopImmersiveSession(base::DoNothing());
+    }
+  }
+}
+
+void BrowserXRRuntimeImpl::ShowConsentPrompt(
+    int render_process_id,
+    int render_frame_id,
+    content::XrConsentPromptLevel consent_level,
+    content::OnXrUserConsentCallback consent_callback) {
+  // It is the responsibility of the consent prompt to ensure that the callback
+  // is run in the event that we get removed (and it gets destroyed).
+  if (consent_helper_) {
+    consent_helper_->ShowConsentPrompt(render_process_id, render_frame_id,
+                                       consent_level,
+                                       std::move(consent_callback));
+  } else {
+    std::move(consent_callback).Run(consent_level, false);
+  }
+}
+
+void BrowserXRRuntimeImpl::EnsureInstalled(
+    int render_process_id,
+    int render_frame_id,
+    base::OnceCallback<void(bool)> install_callback) {
+  // If there's no install helper, then we can assume no install is needed.
+  if (!install_helper_) {
+    std::move(install_callback).Run(true);
+    return;
+  }
+
+  // Only the most recent caller will be notified of a successful install.
+  bool had_outstanding_callback = false;
+  if (install_finished_callback_) {
+    had_outstanding_callback = true;
+    std::move(install_finished_callback_).Run(false);
+  }
+
+  install_finished_callback_ = std::move(install_callback);
+
+  // If we already had a cached install callback, then we don't need to query
+  // for installation again.
+  if (had_outstanding_callback)
+    return;
+
+  install_helper_->EnsureInstalled(
+      render_process_id, render_frame_id,
+      base::BindOnce(&BrowserXRRuntimeImpl::OnInstallFinished,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
+
+void BrowserXRRuntimeImpl::OnInstallFinished(bool succeeded) {
+  DCHECK(install_finished_callback_);
+
+  std::move(install_finished_callback_).Run(succeeded);
+}
+
+void BrowserXRRuntimeImpl::OnImmersiveSessionError() {
+  DVLOG(2) << __func__ << ": id=" << id_;
+  StopImmersiveSession(base::DoNothing());
+}
+
+void BrowserXRRuntimeImpl::AddObserver(Observer* observer) {
+  observers_.AddObserver(observer);
+  observer->SetVRDisplayInfo(display_info_.Clone());
+}
+
+void BrowserXRRuntimeImpl::RemoveObserver(Observer* observer) {
+  observers_.RemoveObserver(observer);
+}
+
+void BrowserXRRuntimeImpl::SetInlinePosesEnabled(bool enabled) {
+  runtime_->SetInlinePosesEnabled(enabled);
+}
+
+void BrowserXRRuntimeImpl::BeforeRuntimeRemoved() {
+  DVLOG(1) << __func__ << ": id=" << id_;
+
+  // If the device process crashes or otherwise gets removed, it's a race as to
+  // whether or not our mojo interface to the device gets reset before we're
+  // deleted as the result of the device provider being destroyed.
+  // Since this no-ops if we don't have an active immersive session, try to end
+  // any immersive session we may be currently responsible for.
+  StopImmersiveSession(base::DoNothing());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/service/browser_xr_runtime_impl.h b/chromium/content/browser/xr/service/browser_xr_runtime_impl.h
new file mode 100644
index 00000000000..8f96a0d04a1
--- /dev/null
+++ b/chromium/content/browser/xr/service/browser_xr_runtime_impl.h
@@ -0,0 +1,130 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_SERVICE_BROWSER_XR_RUNTIME_IMPL_H_
+#define CONTENT_BROWSER_XR_SERVICE_BROWSER_XR_RUNTIME_IMPL_H_
+
+#include <set>
+#include <vector>
+
+#include "base/observer_list.h"
+#include "base/observer_list_types.h"
+#include "content/browser/xr/service/vr_service_impl.h"
+#include "content/public/browser/browser_xr_runtime.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/xr_consent_helper.h"
+#include "device/vr/public/mojom/isolated_xr_service.mojom.h"
+#include "device/vr/public/mojom/vr_service.mojom-forward.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
+
+namespace content {
+class XrInstallHelper;
+}  // namespace content
+
+namespace content {
+// This class wraps a physical device's interfaces, and registers for events.
+// There is one BrowserXRRuntimeImpl per physical device runtime.  It manages
+// browser-side handling of state, like which VRServiceImpl is listening for
+// device activation.
+class BrowserXRRuntimeImpl : public content::BrowserXRRuntime,
+                             public device::mojom::XRRuntimeEventListener {
+ public:
+  using RequestSessionCallback =
+      base::OnceCallback<void(device::mojom::XRSessionPtr)>;
+  explicit BrowserXRRuntimeImpl(
+      device::mojom::XRDeviceId id,
+      mojo::PendingRemote<device::mojom::XRRuntime> runtime,
+      device::mojom::VRDisplayInfoPtr info);
+  ~BrowserXRRuntimeImpl() override;
+
+  void ExitActiveImmersiveSession();
+  bool SupportsFeature(device::mojom::XRSessionFeature feature) const;
+  bool SupportsAllFeatures(
+      const std::vector<device::mojom::XRSessionFeature>& features) const;
+
+  bool SupportsCustomIPD() const;
+  bool SupportsNonEmulatedHeight() const;
+
+  device::mojom::XRRuntime* GetRuntime() { return runtime_.get(); }
+
+  // Methods called by VRServiceImpl to interact with the runtime's device.
+  void OnServiceAdded(VRServiceImpl* service);
+  void OnServiceRemoved(VRServiceImpl* service);
+  void ExitPresent(VRServiceImpl* service,
+                   VRServiceImpl::ExitPresentCallback on_exited);
+  void SetFramesThrottled(const VRServiceImpl* service, bool throttled);
+  void RequestSession(VRServiceImpl* service,
+                      const device::mojom::XRRuntimeSessionOptionsPtr& options,
+                      RequestSessionCallback callback);
+  void ShowConsentPrompt(int render_process_id,
+                         int render_frame_id,
+                         content::XrConsentPromptLevel consent_level,
+                         content::OnXrUserConsentCallback consent_callback);
+  void EnsureInstalled(int render_process_id,
+                       int render_frame_id,
+                       base::OnceCallback<void(bool)> install_callback);
+  VRServiceImpl* GetServiceWithActiveImmersiveSession() {
+    return presenting_service_;
+  }
+
+  device::mojom::VRDisplayInfoPtr GetVRDisplayInfo() {
+    return display_info_.Clone();
+  }
+
+  device::mojom::XRDeviceId GetId() const { return id_; }
+
+  // BrowserXRRuntime
+  void AddObserver(Observer* observer) override;
+  void RemoveObserver(Observer* observer) override;
+  void SetInlinePosesEnabled(bool enabled) override;
+
+  // Called to allow the runtime to conduct any cleanup it needs to do before it
+  // is removed.
+  void BeforeRuntimeRemoved();
+
+ private:
+  // device::XRRuntimeEventListener
+  void OnDisplayInfoChanged(
+      device::mojom::VRDisplayInfoPtr vr_device_info) override;
+  void OnExitPresent() override;
+  void OnVisibilityStateChanged(
+      device::mojom::XRVisibilityState visibility_state) override;
+
+  void StopImmersiveSession(VRServiceImpl::ExitPresentCallback on_exited);
+  void OnRequestSessionResult(
+      base::WeakPtr<VRServiceImpl> service,
+      device::mojom::XRRuntimeSessionOptionsPtr options,
+      RequestSessionCallback callback,
+      device::mojom::XRSessionPtr session,
+      mojo::PendingRemote<device::mojom::XRSessionController>
+          immersive_session_controller);
+  void OnImmersiveSessionError();
+  void OnInstallFinished(bool succeeded);
+
+  device::mojom::XRDeviceId id_;
+  mojo::Remote<device::mojom::XRRuntime> runtime_;
+  mojo::Remote<device::mojom::XRSessionController>
+      immersive_session_controller_;
+
+  std::set<VRServiceImpl*> services_;
+  device::mojom::VRDisplayInfoPtr display_info_;
+
+  VRServiceImpl* presenting_service_ = nullptr;
+
+  mojo::AssociatedReceiver<device::mojom::XRRuntimeEventListener> receiver_{
+      this};
+
+  base::ObserverList<Observer> observers_;
+  std::unique_ptr<content::XrConsentHelper> consent_helper_;
+  std::unique_ptr<content::XrInstallHelper> install_helper_;
+  base::OnceCallback<void(bool)> install_finished_callback_;
+
+  base::WeakPtrFactory<BrowserXRRuntimeImpl> weak_ptr_factory_{this};
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_SERVICE_BROWSER_XR_RUNTIME_IMPL_H_
diff --git a/chromium/content/browser/xr/service/isolated_device_provider.cc b/chromium/content/browser/xr/service/isolated_device_provider.cc
new file mode 100644
index 00000000000..aae1ae6c654
--- /dev/null
+++ b/chromium/content/browser/xr/service/isolated_device_provider.cc
@@ -0,0 +1,111 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/service/isolated_device_provider.h"
+
+#include "base/bind.h"
+#include "content/browser/xr/service/xr_device_service.h"
+#include "content/browser/xr/xr_utils.h"
+#include "content/public/browser/xr_integration_client.h"
+
+namespace {
+constexpr int kMaxRetries = 3;
+}
+
+namespace content {
+
+void IsolatedVRDeviceProvider::Initialize(
+    base::RepeatingCallback<void(device::mojom::XRDeviceId,
+                                 device::mojom::VRDisplayInfoPtr,
+                                 mojo::PendingRemote<device::mojom::XRRuntime>)>
+        add_device_callback,
+    base::RepeatingCallback<void(device::mojom::XRDeviceId)>
+        remove_device_callback,
+    base::OnceClosure initialization_complete) {
+  add_device_callback_ = std::move(add_device_callback);
+  remove_device_callback_ = std::move(remove_device_callback);
+  initialization_complete_ = std::move(initialization_complete);
+
+  SetupDeviceProvider();
+}
+
+bool IsolatedVRDeviceProvider::Initialized() {
+  return initialized_;
+}
+
+void IsolatedVRDeviceProvider::OnDeviceAdded(
+    mojo::PendingRemote<device::mojom::XRRuntime> device,
+    mojo::PendingRemote<device::mojom::XRCompositorHost> compositor_host,
+    device::mojom::XRDeviceId device_id) {
+  add_device_callback_.Run(device_id, nullptr, std::move(device));
+
+  auto* integration_client = GetXrIntegrationClient();
+  if (!integration_client)
+    return;
+
+  // It's perfectly valid to insert nullptr, and doing so avoids the extra move
+  // if we were to do an assignment/check to avoid inserting it.
+  ui_host_map_.insert(
+      std::make_pair(device_id, integration_client->CreateVrUiHost(
+                                    device_id, std::move(compositor_host))));
+}
+
+void IsolatedVRDeviceProvider::OnDeviceRemoved(device::mojom::XRDeviceId id) {
+  remove_device_callback_.Run(id);
+  ui_host_map_.erase(id);
+}
+
+void IsolatedVRDeviceProvider::OnServerError() {
+  // An error occurred - any devices we have added are now disconnected and
+  // should be removed.
+  for (auto& entry : ui_host_map_) {
+    auto id = entry.first;
+    remove_device_callback_.Run(id);
+  }
+  ui_host_map_.clear();
+
+  // At this point, XRRuntimeManagerImpl may be blocked waiting for us to return
+  // that we've enumerated all runtimes/devices.  If we lost the connection to
+  // the service, we'll try again.  If we've already tried too many times,
+  // then just assume we won't ever get devices, so report we are done now.
+  // This will unblock WebXR/WebVR promises so they can reject indicating we
+  // never found devices.
+  if (!initialized_ && retry_count_ >= kMaxRetries) {
+    OnDevicesEnumerated();
+  } else {
+    device_provider_.reset();
+    receiver_.reset();
+    retry_count_++;
+    SetupDeviceProvider();
+  }
+}
+
+void IsolatedVRDeviceProvider::OnDevicesEnumerated() {
+  if (!initialized_) {
+    initialized_ = true;
+    std::move(initialization_complete_).Run();
+  }
+
+  // Either we've hit the max retries and given up (in which case we don't have
+  // a device provider which could error out and cause us to retry) or we've
+  // successfully gotten the device provider again after a retry, and we should
+  // reset our count in case it gets disconnected.
+  retry_count_ = 0;
+}
+
+void IsolatedVRDeviceProvider::SetupDeviceProvider() {
+  GetXRDeviceService()->BindRuntimeProvider(
+      device_provider_.BindNewPipeAndPassReceiver());
+  device_provider_.set_disconnect_handler(base::BindOnce(
+      &IsolatedVRDeviceProvider::OnServerError, base::Unretained(this)));
+
+  device_provider_->RequestDevices(receiver_.BindNewPipeAndPassRemote());
+}
+
+IsolatedVRDeviceProvider::IsolatedVRDeviceProvider() = default;
+
+// Default destructor handles renderer_host_map_ cleanup.
+IsolatedVRDeviceProvider::~IsolatedVRDeviceProvider() = default;
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/service/isolated_device_provider.h b/chromium/content/browser/xr/service/isolated_device_provider.h
new file mode 100644
index 00000000000..e362f18f59c
--- /dev/null
+++ b/chromium/content/browser/xr/service/isolated_device_provider.h
@@ -0,0 +1,73 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_SERVICE_ISOLATED_DEVICE_PROVIDER_H_
+#define CONTENT_BROWSER_XR_SERVICE_ISOLATED_DEVICE_PROVIDER_H_
+
+#include "base/containers/flat_map.h"
+#include "device/vr/public/cpp/vr_device_provider.h"
+#include "device/vr/public/mojom/isolated_xr_service.mojom-forward.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
+
+namespace content {
+class VrUiHost;
+}
+
+namespace content {
+
+class IsolatedVRDeviceProvider
+    : public device::VRDeviceProvider,
+      public device::mojom::IsolatedXRRuntimeProviderClient {
+ public:
+  IsolatedVRDeviceProvider();
+  ~IsolatedVRDeviceProvider() override;
+
+  // If the VR API requires initialization that should happen here.
+  void Initialize(
+      base::RepeatingCallback<void(
+          device::mojom::XRDeviceId,
+          device::mojom::VRDisplayInfoPtr,
+          mojo::PendingRemote<device::mojom::XRRuntime>)> add_device_callback,
+      base::RepeatingCallback<void(device::mojom::XRDeviceId)>
+          remove_device_callback,
+      base::OnceClosure initialization_complete) override;
+
+  // Returns true if initialization is complete.
+  bool Initialized() override;
+
+ private:
+  // IsolatedXRRuntimeProviderClient
+  void OnDeviceAdded(
+      mojo::PendingRemote<device::mojom::XRRuntime> device,
+      mojo::PendingRemote<device::mojom::XRCompositorHost> compositor_host,
+      device::mojom::XRDeviceId device_id) override;
+  void OnDeviceRemoved(device::mojom::XRDeviceId id) override;
+  void OnDevicesEnumerated() override;
+  void OnServerError();
+  void SetupDeviceProvider();
+
+  bool initialized_ = false;
+  int retry_count_ = 0;
+  mojo::Remote<device::mojom::IsolatedXRRuntimeProvider> device_provider_;
+
+  base::RepeatingCallback<void(device::mojom::XRDeviceId,
+                               device::mojom::VRDisplayInfoPtr,
+                               mojo::PendingRemote<device::mojom::XRRuntime>)>
+      add_device_callback_;
+  base::RepeatingCallback<void(device::mojom::XRDeviceId)>
+      remove_device_callback_;
+  base::OnceClosure initialization_complete_;
+  mojo::Receiver<device::mojom::IsolatedXRRuntimeProviderClient> receiver_{
+      this};
+
+  using UiHostMap = base::flat_map<device::mojom::XRDeviceId,
+                                   std::unique_ptr<content::VrUiHost>>;
+  UiHostMap ui_host_map_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_SERVICE_ISOLATED_DEVICE_PROVIDER_H_
diff --git a/chromium/content/browser/xr/service/vr_service_impl.cc b/chromium/content/browser/xr/service/vr_service_impl.cc
new file mode 100644
index 00000000000..e01fc6f8494
--- /dev/null
+++ b/chromium/content/browser/xr/service/vr_service_impl.cc
@@ -0,0 +1,651 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/service/vr_service_impl.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/feature_list.h"
+#include "base/metrics/histogram_macros.h"
+#include "base/stl_util.h"
+#include "base/trace_event/common/trace_event_common.h"
+#include "content/browser/permissions/permission_controller_impl.h"
+#include "content/browser/xr/metrics/session_metrics_helper.h"
+#include "content/browser/xr/service/browser_xr_runtime_impl.h"
+#include "content/browser/xr/service/xr_runtime_manager_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/permission_type.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/render_widget_host.h"
+#include "content/public/browser/render_widget_host_view.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/common/origin_util.h"
+#include "device/vr/buildflags/buildflags.h"
+#include "device/vr/public/cpp/session_mode.h"
+
+namespace {
+
+device::mojom::XRRuntimeSessionOptionsPtr GetRuntimeOptions(
+    device::mojom::XRSessionOptions* options) {
+  device::mojom::XRRuntimeSessionOptionsPtr runtime_options =
+      device::mojom::XRRuntimeSessionOptions::New();
+  runtime_options->mode = options->mode;
+  return runtime_options;
+}
+
+content::XrConsentPromptLevel GetRequiredConsentLevel(
+    device::mojom::XRSessionMode mode,
+    const content::BrowserXRRuntimeImpl* runtime,
+    const std::set<device::mojom::XRSessionFeature>& requested_features) {
+  if (base::Contains(
+          requested_features,
+          device::mojom::XRSessionFeature::REF_SPACE_BOUNDED_FLOOR)) {
+    return content::XrConsentPromptLevel::kVRFloorPlan;
+  }
+
+  // If the device supports a custom IPD and it will be exposed (via immersive),
+  // we need to warn about physical features Being exposed.
+  if (runtime->SupportsCustomIPD() &&
+      device::XRSessionModeUtils::IsImmersive(mode)) {
+    return content::XrConsentPromptLevel::kVRFeatures;
+  }
+
+  // If local-floor is requested and the device supports a user inputted or real
+  // height, we need to warn about physical features being exposed.
+  // Note that while this is also the case for bounded-floor, that is covered
+  // by the stricter kVRFloorPlan Prompt set above.
+  if (base::Contains(requested_features,
+                     device::mojom::XRSessionFeature::REF_SPACE_LOCAL_FLOOR) &&
+      runtime->SupportsNonEmulatedHeight()) {
+    return content::XrConsentPromptLevel::kVRFeatures;
+  }
+
+  // In the absence of other items that need to be consented, inline does not
+  // require consent.
+  if (mode == device::mojom::XRSessionMode::kInline) {
+    return content::XrConsentPromptLevel::kNone;
+  }
+
+  return content::XrConsentPromptLevel::kDefault;
+}
+
+content::PermissionType GetRequiredPermission(
+    device::mojom::XRSessionMode mode) {
+  switch (mode) {
+    case device::mojom::XRSessionMode::kInline:
+      return content::PermissionType::SENSORS;
+    case device::mojom::XRSessionMode::kImmersiveVr:
+      return content::PermissionType::VR;
+    case device::mojom::XRSessionMode::kImmersiveAr:
+      return content::PermissionType::AR;
+  }
+}
+
+}  // namespace
+
+namespace content {
+
+VRServiceImpl::SessionRequestData::SessionRequestData(
+    device::mojom::XRSessionOptionsPtr options,
+    device::mojom::VRService::RequestSessionCallback callback,
+    std::set<device::mojom::XRSessionFeature> enabled_features,
+    device::mojom::XRDeviceId runtime_id)
+    : options(std::move(options)),
+      callback(std::move(callback)),
+      enabled_features(std::move(enabled_features)),
+      runtime_id(runtime_id) {}
+
+VRServiceImpl::SessionRequestData::~SessionRequestData() {
+  // In some cases, we may get dropped before the VRService pipe is closed. In
+  // these cases we need to try to ensure that the callback is run or else we
+  // hit DCHECKs for dropping the callback without closing the pipe.
+  // This most often occurs when the Permissions prompt is dismissed.
+  if (callback) {
+    std::move(callback).Run(
+        device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::UNKNOWN_FAILURE));
+  }
+}
+
+VRServiceImpl::SessionRequestData::SessionRequestData(SessionRequestData&&) =
+    default;
+
+VRServiceImpl::VRServiceImpl(content::RenderFrameHost* render_frame_host)
+    : WebContentsObserver(
+          content::WebContents::FromRenderFrameHost(render_frame_host)),
+      render_frame_host_(render_frame_host),
+      in_focused_frame_(render_frame_host->GetView()->HasFocus()) {
+  DCHECK(render_frame_host_);
+  DVLOG(2) << __func__;
+
+  runtime_manager_ = XRRuntimeManagerImpl::GetOrCreateInstance();
+  runtime_manager_->AddService(this);
+
+  magic_window_controllers_.set_disconnect_handler(base::BindRepeating(
+      &VRServiceImpl::OnInlineSessionDisconnected,
+      base::Unretained(this)));  // Unretained is OK since the collection is
+                                 // owned by VRServiceImpl.
+}
+
+// Constructor for testing.
+VRServiceImpl::VRServiceImpl(util::PassKey<XRRuntimeManagerTest>)
+    : render_frame_host_(nullptr) {
+  DVLOG(2) << __func__;
+  runtime_manager_ = XRRuntimeManagerImpl::GetOrCreateInstance();
+  runtime_manager_->AddService(this);
+}
+
+VRServiceImpl::~VRServiceImpl() {
+  DVLOG(2) << __func__;
+  // Ensure that any active magic window sessions are disconnected to avoid
+  // collisions when a new session starts. See https://crbug.com/1017959, the
+  // disconnect handler doesn't get called automatically on page navigation.
+  for (auto it = magic_window_controllers_.begin();
+       it != magic_window_controllers_.end(); ++it) {
+    OnInlineSessionDisconnected(it.id());
+  }
+  runtime_manager_->RemoveService(this);
+}
+
+void VRServiceImpl::Create(
+    content::RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<device::mojom::VRService> receiver) {
+  DVLOG(2) << __func__;
+  std::unique_ptr<VRServiceImpl> vr_service_impl =
+      std::make_unique<VRServiceImpl>(render_frame_host);
+
+  VRServiceImpl* impl = vr_service_impl.get();
+  impl->receiver_ = mojo::MakeSelfOwnedReceiver(std::move(vr_service_impl),
+                                                std::move(receiver));
+}
+
+void VRServiceImpl::InitializationComplete() {
+  // After initialization has completed, we can correctly answer
+  // supportsSession, and can provide correct display capabilities.
+  DVLOG(2) << __func__;
+  initialization_complete_ = true;
+
+  ResolvePendingRequests();
+}
+
+void VRServiceImpl::SetClient(
+    mojo::PendingRemote<device::mojom::VRServiceClient> service_client) {
+  if (service_client_) {
+    mojo::ReportBadMessage("ServiceClient should only be set once.");
+    return;
+  }
+
+  DVLOG(2) << __func__;
+  service_client_.Bind(std::move(service_client));
+}
+
+void VRServiceImpl::ResolvePendingRequests() {
+  DVLOG(2) << __func__
+           << ": pending_requests_.size()=" << pending_requests_.size();
+  for (auto& callback : pending_requests_) {
+    std::move(callback).Run();
+  }
+  pending_requests_.clear();
+}
+
+void VRServiceImpl::OnDisplayInfoChanged() {
+  device::mojom::VRDisplayInfoPtr display_info =
+      runtime_manager_->GetCurrentVRDisplayInfo(this);
+  if (display_info) {
+    for (auto& client : session_clients_)
+      client->OnChanged(display_info.Clone());
+  }
+}
+
+void VRServiceImpl::RuntimesChanged() {
+  DVLOG(2) << __func__;
+  OnDisplayInfoChanged();
+
+  if (service_client_) {
+    service_client_->OnDeviceChanged();
+  }
+}
+
+void VRServiceImpl::OnWebContentsFocused(content::RenderWidgetHost* host) {
+  OnWebContentsFocusChanged(host, true);
+}
+
+void VRServiceImpl::OnWebContentsLostFocus(content::RenderWidgetHost* host) {
+  OnWebContentsFocusChanged(host, false);
+}
+
+void VRServiceImpl::RenderFrameDeleted(content::RenderFrameHost* host) {
+  DVLOG(2) << __func__;
+  if (host != render_frame_host_)
+    return;
+
+  // Receiver should always be live here, as this is a SelfOwnedReceiver.
+  // Close the receiver (and delete this VrServiceImpl) when the RenderFrameHost
+  // is deleted.
+  DCHECK(receiver_.get());
+  receiver_->Close();
+}
+
+void VRServiceImpl::OnWebContentsFocusChanged(content::RenderWidgetHost* host,
+                                              bool focused) {
+  if (!render_frame_host_->GetView() ||
+      render_frame_host_->GetView()->GetRenderWidgetHost() != host) {
+    return;
+  }
+
+  in_focused_frame_ = focused;
+
+  for (const auto& controller : magic_window_controllers_)
+    controller->SetFrameDataRestricted(!focused);
+}
+
+void VRServiceImpl::OnInlineSessionCreated(
+    SessionRequestData request,
+    device::mojom::XRSessionPtr session,
+    mojo::PendingRemote<device::mojom::XRSessionController>
+        pending_controller) {
+  if (!session) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::UNKNOWN_RUNTIME_ERROR));
+    return;
+  }
+
+  mojo::Remote<device::mojom::XRSessionController> controller(
+      std::move(pending_controller));
+  // Start giving out magic window data if we are focused.
+  controller->SetFrameDataRestricted(!in_focused_frame_);
+
+  auto id = magic_window_controllers_.Add(std::move(controller));
+  DVLOG(2) << __func__ << ": session_id=" << id.GetUnsafeValue()
+           << " runtime_id=" << request.runtime_id;
+
+  mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+      session_metrics_recorder = GetSessionMetricsHelper()->StartInlineSession(
+          *(request.options), request.enabled_features, id.GetUnsafeValue());
+
+  OnSessionCreated(std::move(request), std::move(session),
+                   std::move(session_metrics_recorder));
+}
+
+void VRServiceImpl::OnImmersiveSessionCreated(
+    SessionRequestData request,
+    device::mojom::XRSessionPtr session) {
+  DCHECK(request.options);
+  if (!session) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::UNKNOWN_RUNTIME_ERROR));
+    return;
+  }
+
+  // Get the metrics tracker for the new immersive session
+  mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+      session_metrics_recorder =
+          GetSessionMetricsHelper()->StartImmersiveSession(
+              *(request.options), request.enabled_features);
+
+  OnSessionCreated(std::move(request), std::move(session),
+                   std::move(session_metrics_recorder));
+}
+
+void VRServiceImpl::OnInlineSessionDisconnected(
+    mojo::RemoteSetElementId session_id) {
+  DVLOG(2) << __func__ << ": session_id=" << session_id.GetUnsafeValue();
+  // Notify metrics helper that inline session was stopped.
+  auto* metrics_helper = GetSessionMetricsHelper();
+  metrics_helper->StopAndRecordInlineSession(session_id.GetUnsafeValue());
+}
+
+SessionMetricsHelper* VRServiceImpl::GetSessionMetricsHelper() {
+  content::WebContents* web_contents =
+      content::WebContents::FromRenderFrameHost(render_frame_host_);
+  SessionMetricsHelper* metrics_helper =
+      SessionMetricsHelper::FromWebContents(web_contents);
+  if (!metrics_helper) {
+    // This will only happen if we are not already in VR; set start params
+    // accordingly.
+    metrics_helper = SessionMetricsHelper::CreateForWebContents(web_contents);
+  }
+
+  return metrics_helper;
+}
+
+void VRServiceImpl::OnSessionCreated(
+    SessionRequestData request,
+    device::mojom::XRSessionPtr session,
+    mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+        session_metrics_recorder) {
+  DVLOG(2) << __func__ << ": session_runtime_id=" << request.runtime_id;
+
+  // Not checking for validity of |session|, since that's done by
+  // |OnInlineSessionCreated| and |OnImmersiveSessionCreated|.
+
+  UMA_HISTOGRAM_ENUMERATION("XR.RuntimeUsed", request.runtime_id);
+
+  mojo::Remote<device::mojom::XRSessionClient> client;
+  session->client_receiver = client.BindNewPipeAndPassReceiver();
+
+  session->enabled_features.clear();
+  for (const auto& feature : request.enabled_features) {
+    session->enabled_features.push_back(feature);
+  }
+
+  client->OnVisibilityStateChanged(visibility_state_);
+  session_clients_.Add(std::move(client));
+
+  auto success = device::mojom::RequestSessionSuccess::New();
+  success->session = std::move(session);
+  success->metrics_recorder = std::move(session_metrics_recorder);
+
+  std::move(request.callback)
+      .Run(device::mojom::RequestSessionResult::NewSuccess(std::move(success)));
+}
+
+void VRServiceImpl::RequestSession(
+    device::mojom::XRSessionOptionsPtr options,
+    device::mojom::VRService::RequestSessionCallback callback) {
+  DVLOG(2) << __func__;
+  DCHECK(options);
+
+  // Queue the request to get to when initialization has completed.
+  if (!initialization_complete_) {
+    DVLOG(2) << __func__ << ": initialization not yet complete, defer request";
+    pending_requests_.push_back(
+        base::BindOnce(&VRServiceImpl::RequestSession, base::Unretained(this),
+                       std::move(options), std::move(callback)));
+    return;
+  }
+
+  if (runtime_manager_->IsOtherClientPresenting(this)) {
+    DVLOG(2) << __func__
+             << ": can't create sessions while an immersive session exists";
+    // Can't create sessions while an immersive session exists.
+    std::move(callback).Run(
+        device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::EXISTING_IMMERSIVE_SESSION));
+    return;
+  }
+
+  auto* runtime = runtime_manager_->GetRuntimeForOptions(options.get());
+  if (!runtime) {
+    std::move(callback).Run(
+        device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::NO_RUNTIME_FOUND));
+    return;
+  }
+
+  // GetRuntimeForOptions should only return a device that supports all required
+  // features.
+  std::set<device::mojom::XRSessionFeature> requested_features;
+  for (const auto& feature : options->required_features) {
+    requested_features.insert(feature);
+  }
+
+  // The consent flow cannot differentiate between optional and required
+  // features, but we don't need to block creation if an optional feature is
+  // not supported. Add all requested features to the set of supported features.
+  for (const auto& feature : options->optional_features) {
+    if (runtime->SupportsFeature(feature)) {
+      requested_features.insert(feature);
+    }
+  }
+
+  SessionRequestData request(std::move(options), std::move(callback),
+                             std::move(requested_features), runtime->GetId());
+
+  ShowConsentPrompt(std::move(request), runtime);
+}
+
+void VRServiceImpl::ShowConsentPrompt(SessionRequestData request,
+                                      BrowserXRRuntimeImpl* runtime) {
+  DVLOG(2) << __func__;
+  DCHECK(request.options);
+  DCHECK(runtime);
+  DCHECK_EQ(runtime->GetId(), request.runtime_id);
+
+#if defined(OS_WIN)
+  DCHECK_NE(request.options->mode, device::mojom::XRSessionMode::kImmersiveAr);
+#endif
+
+  bool consent_granted = false;
+  content::XrConsentPromptLevel consent_level = GetRequiredConsentLevel(
+      request.options->mode, runtime, request.enabled_features);
+  if (!base::FeatureList::IsEnabled(features::kWebXrPermissionsApi)) {
+    consent_granted =
+        ((consent_level == content::XrConsentPromptLevel::kNone) ||
+         IsConsentGrantedForDevice(request.runtime_id, consent_level));
+  }
+
+  // Skip the consent prompt if the user has already consented for this device,
+  // or if consent is not needed.
+  if (consent_granted) {
+    EnsureRuntimeInstalled(std::move(request), runtime);
+    return;
+  }
+
+  if (base::FeatureList::IsEnabled(features::kWebXrPermissionsApi)) {
+    PermissionControllerImpl* permission_controller =
+        PermissionControllerImpl::FromBrowserContext(
+            GetWebContents()->GetBrowserContext());
+    DCHECK(permission_controller);
+
+    // Need to calculate the permission before the call below, as otherwise
+    // std::move nulls options out before GetRequiredPermission runs.
+    PermissionType permission = GetRequiredPermission(request.options->mode);
+    permission_controller->RequestPermission(
+        permission, render_frame_host_,
+        render_frame_host_->GetLastCommittedURL(), true,
+        base::BindOnce(&VRServiceImpl::OnPermissionResult,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(request),
+                       consent_level));
+    return;
+  }
+
+  runtime->ShowConsentPrompt(
+      render_frame_host_->GetProcess()->GetID(),
+      render_frame_host_->GetRoutingID(), consent_level,
+      base::BindOnce(&VRServiceImpl::OnConsentResult,
+                     weak_ptr_factory_.GetWeakPtr(), std::move(request)));
+}
+
+// TODO(alcooper): Once the ConsentFlow can be removed expected_runtime_id and
+// consent_level shouldn't be needed.
+void VRServiceImpl::OnPermissionResult(
+    SessionRequestData request,
+    content::XrConsentPromptLevel consent_level,
+    blink::mojom::PermissionStatus permission_status) {
+  OnConsentResult(std::move(request), consent_level,
+                  permission_status == blink::mojom::PermissionStatus::GRANTED);
+}
+
+void VRServiceImpl::OnConsentResult(SessionRequestData request,
+                                    content::XrConsentPromptLevel consent_level,
+                                    bool is_consent_granted) {
+  DVLOG(2) << __func__;
+  if (!is_consent_granted) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::USER_DENIED_CONSENT));
+    return;
+  }
+
+  AddConsentGrantedDevice(request.runtime_id, consent_level);
+
+  // Re-check for another client instance after a potential user consent.
+  if (runtime_manager_->IsOtherClientPresenting(this)) {
+    // Can't create sessions while an immersive session exists.
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::EXISTING_IMMERSIVE_SESSION));
+    return;
+  }
+
+  EnsureRuntimeInstalled(std::move(request), nullptr);
+}
+
+void VRServiceImpl::EnsureRuntimeInstalled(SessionRequestData request,
+                                           BrowserXRRuntimeImpl* runtime) {
+  DVLOG(2) << __func__;
+
+  // If we were not provided the runtime, try to get it again.
+  if (!runtime)
+    runtime = runtime_manager_->GetRuntimeForOptions(request.options.get());
+
+  // Ensure that it's the same runtime as the one we expect.
+  if (!runtime || runtime->GetId() != request.runtime_id) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::RUNTIMES_CHANGED));
+    return;
+  }
+
+  runtime->EnsureInstalled(
+      render_frame_host_->GetProcess()->GetID(),
+      render_frame_host_->GetRoutingID(),
+      base::BindOnce(&VRServiceImpl::OnInstallResult,
+                     weak_ptr_factory_.GetWeakPtr(), std::move(request)));
+}
+
+void VRServiceImpl::OnInstallResult(SessionRequestData request,
+                                    bool install_succeeded) {
+  if (!install_succeeded) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::RUNTIME_INSTALL_FAILURE));
+    return;
+  }
+
+  DoRequestSession(std::move(request));
+}
+
+void VRServiceImpl::DoRequestSession(SessionRequestData request) {
+  DVLOG(2) << __func__;
+  // Get the runtime again, since we're running in an async context
+  // and the pointer returned from `GetRuntimeForOptions` is non-owning.
+  auto* runtime = runtime_manager_->GetRuntimeForOptions(request.options.get());
+
+  // Ensure that it's the same runtime as the one we expect.
+  if (!runtime || runtime->GetId() != request.runtime_id) {
+    std::move(request.callback)
+        .Run(device::mojom::RequestSessionResult::NewFailureReason(
+            device::mojom::RequestSessionError::UNKNOWN_RUNTIME_ERROR));
+    return;
+  }
+
+  TRACE_EVENT_INSTANT1("xr", "GetRuntimeForOptions", TRACE_EVENT_SCOPE_THREAD,
+                       "id", request.runtime_id);
+
+  auto runtime_options = GetRuntimeOptions(request.options.get());
+
+#if defined(OS_ANDROID) && BUILDFLAG(ENABLE_ARCORE)
+  if (request.runtime_id == device::mojom::XRDeviceId::ARCORE_DEVICE_ID) {
+    runtime_options->render_process_id =
+        render_frame_host_->GetProcess()->GetID();
+    runtime_options->render_frame_id = render_frame_host_->GetRoutingID();
+  }
+#endif
+  // Make the resolved enabled features available to the runtime.
+  runtime_options->enabled_features.reserve(request.enabled_features.size());
+  for (const auto& feature : request.enabled_features) {
+    runtime_options->enabled_features.push_back(feature);
+  }
+
+  if (device::XRSessionModeUtils::IsImmersive(runtime_options->mode)) {
+    base::OnceCallback<void(device::mojom::XRSessionPtr)> immersive_callback =
+        base::BindOnce(&VRServiceImpl::OnImmersiveSessionCreated,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(request));
+    runtime->RequestSession(this, std::move(runtime_options),
+                            std::move(immersive_callback));
+  } else {
+    base::OnceCallback<void(
+        device::mojom::XRSessionPtr,
+        mojo::PendingRemote<device::mojom::XRSessionController>)>
+        non_immersive_callback =
+            base::BindOnce(&VRServiceImpl::OnInlineSessionCreated,
+                           weak_ptr_factory_.GetWeakPtr(), std::move(request));
+    runtime->GetRuntime()->RequestSession(std::move(runtime_options),
+                                          std::move(non_immersive_callback));
+  }
+}
+
+void VRServiceImpl::SupportsSession(
+    device::mojom::XRSessionOptionsPtr options,
+    device::mojom::VRService::SupportsSessionCallback callback) {
+  if (!initialization_complete_) {
+    pending_requests_.push_back(
+        base::BindOnce(&VRServiceImpl::SupportsSession, base::Unretained(this),
+                       std::move(options), std::move(callback)));
+    return;
+  }
+  runtime_manager_->SupportsSession(std::move(options), std::move(callback));
+}
+
+void VRServiceImpl::ExitPresent(ExitPresentCallback on_exited) {
+  BrowserXRRuntimeImpl* immersive_runtime =
+      runtime_manager_->GetCurrentlyPresentingImmersiveRuntime();
+  DVLOG(2) << __func__ << ": !!immersive_runtime=" << !!immersive_runtime;
+  if (immersive_runtime) {
+    immersive_runtime->ExitPresent(this, std::move(on_exited));
+  } else {
+    std::move(on_exited).Run();
+  }
+}
+
+void VRServiceImpl::SetFramesThrottled(bool throttled) {
+  if (throttled != frames_throttled_) {
+    frames_throttled_ = throttled;
+    BrowserXRRuntimeImpl* immersive_runtime =
+        runtime_manager_->GetCurrentlyPresentingImmersiveRuntime();
+    if (immersive_runtime) {
+      immersive_runtime->SetFramesThrottled(this, frames_throttled_);
+    }
+  }
+}
+
+void VRServiceImpl::OnExitPresent() {
+  DVLOG(2) << __func__;
+
+  GetSessionMetricsHelper()->StopAndRecordImmersiveSession();
+
+  for (auto& client : session_clients_)
+    client->OnExitPresent();
+
+  // Ensure that the client list is erased to avoid "Cannot issue Interface
+  // method calls on an unbound Remote" errors: https://crbug.com/991747
+  session_clients_.Clear();
+}
+
+void VRServiceImpl::OnVisibilityStateChanged(
+    device::mojom::XRVisibilityState visiblity_state) {
+  visibility_state_ = visiblity_state;
+  for (auto& client : session_clients_)
+    client->OnVisibilityStateChanged(visiblity_state);
+}
+
+content::WebContents* VRServiceImpl::GetWebContents() {
+  return content::WebContents::FromRenderFrameHost(render_frame_host_);
+}
+
+bool VRServiceImpl::IsConsentGrantedForDevice(
+    device::mojom::XRDeviceId device_id,
+    content::XrConsentPromptLevel consent_level) {
+  auto it = consent_granted_devices_.find(device_id);
+  return it != consent_granted_devices_.end() && it->second >= consent_level;
+}
+
+void VRServiceImpl::AddConsentGrantedDevice(
+    device::mojom::XRDeviceId device_id,
+    content::XrConsentPromptLevel consent_level) {
+  auto it = consent_granted_devices_.find(device_id);
+  if (it == consent_granted_devices_.end() || it->second < consent_level) {
+    consent_granted_devices_[device_id] = consent_level;
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/service/vr_service_impl.h b/chromium/content/browser/xr/service/vr_service_impl.h
new file mode 100644
index 00000000000..70251655801
--- /dev/null
+++ b/chromium/content/browser/xr/service/vr_service_impl.h
@@ -0,0 +1,190 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_SERVICE_VR_SERVICE_IMPL_H_
+#define CONTENT_BROWSER_XR_SERVICE_VR_SERVICE_IMPL_H_
+
+#include <map>
+#include <memory>
+#include <set>
+#include <vector>
+
+#include "base/macros.h"
+#include "base/util/type_safety/pass_key.h"
+#include "build/build_config.h"
+#include "content/browser/xr/metrics/session_metrics_helper.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/browser/xr_consent_helper.h"
+#include "content/public/browser/xr_consent_prompt_level.h"
+#include "device/vr/public/mojom/isolated_xr_service.mojom-forward.h"
+#include "device/vr/public/mojom/vr_service.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/remote_set.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "third_party/blink/public/mojom/permissions/permission_status.mojom-forward.h"
+
+namespace content {
+class RenderFrameHost;
+class WebContents;
+}  // namespace content
+
+namespace content {
+
+class XRRuntimeManagerImpl;
+class XRRuntimeManagerTest;
+class BrowserXRRuntimeImpl;
+
+// Browser process implementation of the VRService mojo interface. Instantiated
+// through Mojo once the user loads a page containing WebXR.
+class CONTENT_EXPORT VRServiceImpl : public device::mojom::VRService,
+                                     content::WebContentsObserver {
+ public:
+  explicit VRServiceImpl(content::RenderFrameHost* render_frame_host);
+
+  // Constructor for tests.
+  explicit VRServiceImpl(util::PassKey<XRRuntimeManagerTest>);
+
+  ~VRServiceImpl() override;
+
+  static void Create(content::RenderFrameHost* render_frame_host,
+                     mojo::PendingReceiver<device::mojom::VRService> receiver);
+
+  // device::mojom::VRService implementation
+  void SetClient(mojo::PendingRemote<device::mojom::VRServiceClient>
+                     service_client) override;
+  void RequestSession(
+      device::mojom::XRSessionOptionsPtr options,
+      device::mojom::VRService::RequestSessionCallback callback) override;
+  void SupportsSession(
+      device::mojom::XRSessionOptionsPtr options,
+      device::mojom::VRService::SupportsSessionCallback callback) override;
+  void ExitPresent(ExitPresentCallback on_exited) override;
+  void SetFramesThrottled(bool throttled) override;
+
+  void InitializationComplete();
+
+  // Called when inline session gets disconnected. |session_id| is the value
+  // returned by |magic_window_controllers_| when adding session controller to
+  // it.
+  void OnInlineSessionDisconnected(mojo::RemoteSetElementId session_id);
+
+  // Notifications/calls from BrowserXRRuntimeImpl:
+  void OnExitPresent();
+  void OnVisibilityStateChanged(
+      device::mojom::XRVisibilityState visibility_state);
+  void OnDisplayInfoChanged();
+  void RuntimesChanged();
+
+  base::WeakPtr<VRServiceImpl> GetWeakPtr() {
+    return weak_ptr_factory_.GetWeakPtr();
+  }
+
+  content::WebContents* GetWebContents();
+
+ private:
+  struct SessionRequestData {
+    device::mojom::XRSessionOptionsPtr options;
+    device::mojom::VRService::RequestSessionCallback callback;
+    std::set<device::mojom::XRSessionFeature> enabled_features;
+    device::mojom::XRDeviceId runtime_id;
+
+    SessionRequestData(
+        device::mojom::XRSessionOptionsPtr options,
+        device::mojom::VRService::RequestSessionCallback callback,
+        std::set<device::mojom::XRSessionFeature> enabled_features,
+        device::mojom::XRDeviceId runtime_id);
+    ~SessionRequestData();
+    SessionRequestData(SessionRequestData&&);
+
+   private:
+    SessionRequestData(const SessionRequestData&) = delete;
+    SessionRequestData& operator=(const SessionRequestData&) = delete;
+  };
+
+  // content::WebContentsObserver implementation
+  void OnWebContentsFocused(content::RenderWidgetHost* host) override;
+  void OnWebContentsLostFocus(content::RenderWidgetHost* host) override;
+  void RenderFrameDeleted(content::RenderFrameHost* host) override;
+
+  void OnWebContentsFocusChanged(content::RenderWidgetHost* host, bool focused);
+
+  void ResolvePendingRequests();
+
+  // Returns currently active instance of SessionMetricsHelper from WebContents.
+  // If the instance is not present on WebContents, it will be created with the
+  // assumption that we are not already in VR.
+  SessionMetricsHelper* GetSessionMetricsHelper();
+
+  bool InternalSupportsSession(device::mojom::XRSessionOptions* options);
+
+  bool IsConsentGrantedForDevice(device::mojom::XRDeviceId device_id,
+                                 content::XrConsentPromptLevel consent_level);
+  void AddConsentGrantedDevice(device::mojom::XRDeviceId device_id,
+                               content::XrConsentPromptLevel consent_level);
+
+  // The following steps are ordered in the general flow for "RequestSession"
+  // If the WebXrPermissionsAPI is enabled ShowConsentPrompt will result in a
+  // call to OnPermissionResult which feeds into OnConsentResult.
+  // If ShowConsentPrompt determines that no consent/permission is needed (or
+  // has already been granted), then it will directly call
+  // EnsureRuntimeInstalled. DoRequestSession will continue with OnInline or
+  // OnImmersive SessionCreated depending on the type of session created.
+  void ShowConsentPrompt(SessionRequestData request,
+                         BrowserXRRuntimeImpl* runtime);
+
+  void OnConsentResult(SessionRequestData request,
+                       content::XrConsentPromptLevel consent_level,
+                       bool is_consent_granted);
+  void OnPermissionResult(SessionRequestData request,
+                          content::XrConsentPromptLevel consent_level,
+                          blink::mojom::PermissionStatus permission_status);
+
+  void EnsureRuntimeInstalled(SessionRequestData request,
+                              BrowserXRRuntimeImpl* runtime);
+  void OnInstallResult(SessionRequestData request_data, bool install_succeeded);
+
+  void DoRequestSession(SessionRequestData request);
+
+  void OnInlineSessionCreated(
+      SessionRequestData request,
+      device::mojom::XRSessionPtr session,
+      mojo::PendingRemote<device::mojom::XRSessionController> controller);
+  void OnImmersiveSessionCreated(SessionRequestData request,
+                                 device::mojom::XRSessionPtr session);
+  void OnSessionCreated(
+      SessionRequestData request,
+      device::mojom::XRSessionPtr session,
+      mojo::PendingRemote<device::mojom::XRSessionMetricsRecorder>
+          session_metrics_recorder);
+
+  scoped_refptr<XRRuntimeManagerImpl> runtime_manager_;
+  mojo::RemoteSet<device::mojom::XRSessionClient> session_clients_;
+  mojo::Remote<device::mojom::VRServiceClient> service_client_;
+  content::RenderFrameHost* render_frame_host_;
+  mojo::SelfOwnedReceiverRef<device::mojom::VRService> receiver_;
+  mojo::RemoteSet<device::mojom::XRSessionController> magic_window_controllers_;
+  device::mojom::XRVisibilityState visibility_state_ =
+      device::mojom::XRVisibilityState::VISIBLE;
+
+  // List of callbacks to run when initialization is completed.
+  std::vector<base::OnceCallback<void()>> pending_requests_;
+
+  bool initialization_complete_ = false;
+  bool in_focused_frame_ = false;
+  bool frames_throttled_ = false;
+
+  std::map<device::mojom::XRDeviceId, content::XrConsentPromptLevel>
+      consent_granted_devices_;
+
+  base::WeakPtrFactory<VRServiceImpl> weak_ptr_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(VRServiceImpl);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_SERVICE_VR_SERVICE_IMPL_H_
diff --git a/chromium/content/browser/xr/service/xr_device_service.cc b/chromium/content/browser/xr/service/xr_device_service.cc
new file mode 100644
index 00000000000..0b8b1c55fed
--- /dev/null
+++ b/chromium/content/browser/xr/service/xr_device_service.cc
@@ -0,0 +1,54 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/service/xr_device_service.h"
+
+#include "base/no_destructor.h"
+#include "build/build_config.h"
+#include "content/browser/service_sandbox_type.h"
+#include "content/public/browser/service_process_host.h"
+
+namespace content {
+
+namespace {
+
+base::RepeatingClosure& GetStartupCallback() {
+  static base::NoDestructor<base::RepeatingClosure> callback;
+  return *callback;
+}
+
+}  // namespace
+
+const mojo::Remote<device::mojom::XRDeviceService>& GetXRDeviceService() {
+  static base::NoDestructor<mojo::Remote<device::mojom::XRDeviceService>>
+      remote;
+  if (!*remote) {
+    content::ServiceProcessHost::Launch(
+        remote->BindNewPipeAndPassReceiver(),
+        content::ServiceProcessHost::Options()
+            .WithDisplayName("Isolated XR Device Service")
+            .Pass());
+
+    // Ensure that if the interface is ever disconnected (e.g. the service
+    // process crashes) or goes idle for a short period of time -- meaning there
+    // are no in-flight messages and no other interfaces bound through this
+    // one -- then we will reset |remote|, causing the service process to be
+    // terminated if it isn't already.
+    remote->reset_on_disconnect();
+    remote->reset_on_idle_timeout(base::TimeDelta::FromSeconds(5));
+
+    auto& startup_callback = GetStartupCallback();
+    if (startup_callback)
+      startup_callback.Run();
+  }
+
+  return *remote;
+}
+
+void SetXRDeviceServiceStartupCallbackForTestingInternal(
+    base::RepeatingClosure callback) {
+  GetStartupCallback() = std::move(callback);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/service/xr_device_service.h b/chromium/content/browser/xr/service/xr_device_service.h
new file mode 100644
index 00000000000..405503ebfcb
--- /dev/null
+++ b/chromium/content/browser/xr/service/xr_device_service.h
@@ -0,0 +1,24 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_SERVICE_XR_DEVICE_SERVICE_H_
+#define CONTENT_BROWSER_XR_SERVICE_XR_DEVICE_SERVICE_H_
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+#include "device/vr/public/mojom/isolated_xr_service.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
+
+namespace content {
+
+// Acquires a remote handle to the sandboxed isolated XR Device Service
+// instance, launching a process to host the service if necessary.
+const CONTENT_EXPORT mojo::Remote<device::mojom::XRDeviceService>&
+GetXRDeviceService();
+
+void CONTENT_EXPORT SetXRDeviceServiceStartupCallbackForTestingInternal(
+    base::RepeatingClosure callback);
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_SERVICE_XR_DEVICE_SERVICE_H_
diff --git a/chromium/content/browser/xr/service/xr_runtime_manager_impl.cc b/chromium/content/browser/xr/service/xr_runtime_manager_impl.cc
new file mode 100644
index 00000000000..bb096ac8a53
--- /dev/null
+++ b/chromium/content/browser/xr/service/xr_runtime_manager_impl.cc
@@ -0,0 +1,434 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/service/xr_runtime_manager_impl.h"
+#include "content/public/browser/xr_runtime_manager.h"
+
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/feature_list.h"
+#include "base/lazy_instance.h"
+#include "base/memory/singleton.h"
+#include "base/trace_event/common/trace_event_common.h"
+#include "build/build_config.h"
+#include "content/browser/xr/xr_utils.h"
+#include "content/public/browser/device_service.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "device/base/features.h"
+#include "device/vr/buildflags/buildflags.h"
+#include "device/vr/orientation/orientation_device_provider.h"
+#include "device/vr/public/cpp/vr_device_provider.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/device/public/mojom/sensor_provider.mojom.h"
+
+#if !defined(OS_ANDROID)
+#include "content/browser/xr/service/isolated_device_provider.h"
+#endif  // !defined(OS_ANDROID)
+
+namespace content {
+
+namespace {
+XRRuntimeManagerImpl* g_xr_runtime_manager = nullptr;
+
+base::LazyInstance<base::ObserverList<XRRuntimeManager::Observer>>::Leaky
+    g_xr_runtime_manager_observers;
+
+#if !defined(OS_ANDROID)
+bool IsEnabled(const base::CommandLine* command_line,
+               const base::Feature& feature,
+               const std::string& name) {
+  if (!command_line->HasSwitch(switches::kWebXrForceRuntime))
+    return base::FeatureList::IsEnabled(feature);
+
+  return (base::CompareCaseInsensitiveASCII(
+              command_line->GetSwitchValueASCII(switches::kWebXrForceRuntime),
+              name) == 0);
+}
+#endif
+
+}  // namespace
+
+// XRRuntimeManager statics
+XRRuntimeManager* XRRuntimeManager::GetInstanceIfCreated() {
+  return g_xr_runtime_manager;
+}
+
+void XRRuntimeManager::AddObserver(XRRuntimeManager::Observer* observer) {
+  g_xr_runtime_manager_observers.Get().AddObserver(observer);
+}
+
+void XRRuntimeManager::RemoveObserver(XRRuntimeManager::Observer* observer) {
+  g_xr_runtime_manager_observers.Get().RemoveObserver(observer);
+}
+
+void XRRuntimeManager::ExitImmersivePresentation() {
+  if (!g_xr_runtime_manager) {
+    return;
+  }
+
+  auto* browser_xr_runtime =
+      g_xr_runtime_manager->GetCurrentlyPresentingImmersiveRuntime();
+  if (!browser_xr_runtime) {
+    return;
+  }
+
+  browser_xr_runtime->ExitActiveImmersiveSession();
+}
+
+// Static
+scoped_refptr<XRRuntimeManagerImpl>
+XRRuntimeManagerImpl::GetOrCreateInstance() {
+  if (g_xr_runtime_manager) {
+    return base::WrapRefCounted(g_xr_runtime_manager);
+  }
+
+  // Start by getting any providers specified by the XrIntegrationClient
+  XRProviderList providers;
+  auto* integration_client = GetXrIntegrationClient();
+
+  if (integration_client) {
+    auto additional_providers = integration_client->GetAdditionalProviders();
+    providers.insert(providers.end(),
+                     make_move_iterator(additional_providers.begin()),
+                     make_move_iterator(additional_providers.end()));
+  }
+
+  // Then add any other "built-in" providers
+#if !defined(OS_ANDROID)
+  providers.push_back(std::make_unique<IsolatedVRDeviceProvider>());
+#endif  // !defined(OS_ANDROID)
+
+  bool orientation_provider_enabled = true;
+
+#if !defined(OS_ANDROID)
+  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
+  orientation_provider_enabled =
+      IsEnabled(cmd_line, device::kWebXrOrientationSensorDevice,
+                ::switches::kWebXrRuntimeOrientationSensors);
+#endif
+
+  if (orientation_provider_enabled) {
+    mojo::PendingRemote<device::mojom::SensorProvider> sensor_provider;
+    GetDeviceService().BindSensorProvider(
+        sensor_provider.InitWithNewPipeAndPassReceiver());
+    providers.emplace_back(
+        std::make_unique<device::VROrientationDeviceProvider>(
+            std::move(sensor_provider)));
+  }
+  return CreateInstance(std::move(providers));
+}
+
+void XRRuntimeManagerImpl::AddService(VRServiceImpl* service) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DVLOG(2) << __func__;
+
+  // Loop through any currently active runtimes and send Connected messages to
+  // the service. Future runtimes that come online will send a Connected message
+  // when they are created.
+  InitializeProviders();
+
+  if (AreAllProvidersInitialized())
+    service->InitializationComplete();
+
+  services_.insert(service);
+}
+
+void XRRuntimeManagerImpl::RemoveService(VRServiceImpl* service) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DVLOG(2) << __func__;
+  services_.erase(service);
+
+  for (const auto& runtime : runtimes_) {
+    runtime.second->OnServiceRemoved(service);
+  }
+}
+
+BrowserXRRuntimeImpl* XRRuntimeManagerImpl::GetRuntime(
+    device::mojom::XRDeviceId id) {
+  auto it = runtimes_.find(id);
+  if (it == runtimes_.end())
+    return nullptr;
+
+  return it->second.get();
+}
+
+BrowserXRRuntimeImpl* XRRuntimeManagerImpl::GetRuntimeForOptions(
+    device::mojom::XRSessionOptions* options) {
+  BrowserXRRuntimeImpl* runtime = nullptr;
+  switch (options->mode) {
+    case device::mojom::XRSessionMode::kImmersiveAr:
+      runtime = GetRuntime(device::mojom::XRDeviceId::ARCORE_DEVICE_ID);
+      break;
+    case device::mojom::XRSessionMode::kImmersiveVr:
+      runtime = GetImmersiveVrRuntime();
+      break;
+    case device::mojom::XRSessionMode::kInline:
+      // Try the orientation provider if it exists.
+      // If we don't have an orientation provider, then we don't have an
+      // explicit runtime to back a non-immersive session.
+      runtime = GetRuntime(device::mojom::XRDeviceId::ORIENTATION_DEVICE_ID);
+  }
+
+  // Return the runtime from above if we got one and it supports all required
+  // features.
+  return runtime && runtime->SupportsAllFeatures(options->required_features)
+             ? runtime
+             : nullptr;
+}
+
+BrowserXRRuntimeImpl* XRRuntimeManagerImpl::GetImmersiveVrRuntime() {
+#if defined(OS_ANDROID)
+  auto* gvr = GetRuntime(device::mojom::XRDeviceId::GVR_DEVICE_ID);
+  if (gvr)
+    return gvr;
+#endif
+
+#if BUILDFLAG(ENABLE_OPENXR)
+  auto* openxr = GetRuntime(device::mojom::XRDeviceId::OPENXR_DEVICE_ID);
+  if (openxr)
+    return openxr;
+#endif
+
+#if BUILDFLAG(ENABLE_OPENVR)
+  auto* openvr = GetRuntime(device::mojom::XRDeviceId::OPENVR_DEVICE_ID);
+  if (openvr)
+    return openvr;
+#endif
+
+#if BUILDFLAG(ENABLE_OCULUS_VR)
+  auto* oculus = GetRuntime(device::mojom::XRDeviceId::OCULUS_DEVICE_ID);
+  if (oculus)
+    return oculus;
+#endif
+
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+  auto* wmr = GetRuntime(device::mojom::XRDeviceId::WINDOWS_MIXED_REALITY_ID);
+  if (wmr)
+    return wmr;
+#endif
+
+  return nullptr;
+}
+
+BrowserXRRuntimeImpl* XRRuntimeManagerImpl::GetImmersiveArRuntime() {
+  device::mojom::XRSessionOptions options = {};
+  options.mode = device::mojom::XRSessionMode::kImmersiveAr;
+  return GetRuntimeForOptions(&options);
+}
+
+device::mojom::VRDisplayInfoPtr XRRuntimeManagerImpl::GetCurrentVRDisplayInfo(
+    VRServiceImpl* service) {
+  // This seems to be occurring every frame on Windows
+  DVLOG(3) << __func__;
+  // Get an immersive VR runtime if there is one.
+  auto* immersive_runtime = GetImmersiveVrRuntime();
+  if (immersive_runtime) {
+    // Listen to changes for this runtime.
+    immersive_runtime->OnServiceAdded(service);
+
+    // If we don't have display info for the immersive runtime, get display info
+    // from a different runtime.
+    if (!immersive_runtime->GetVRDisplayInfo()) {
+      immersive_runtime = nullptr;
+    }
+  }
+
+  // Get an AR runtime if there is one.
+  auto* ar_runtime = GetImmersiveArRuntime();
+  if (ar_runtime) {
+    // Listen to  changes for this runtime.
+    ar_runtime->OnServiceAdded(service);
+  }
+
+  // If there is neither, use the generic non-immersive runtime.
+  if (!ar_runtime && !immersive_runtime) {
+    device::mojom::XRSessionOptions options = {};
+    options.mode = device::mojom::XRSessionMode::kInline;
+    auto* non_immersive_runtime = GetRuntimeForOptions(&options);
+    if (non_immersive_runtime) {
+      // Listen to changes for this runtime.
+      non_immersive_runtime->OnServiceAdded(service);
+    }
+
+    // If we don't have an AR or immersive runtime, return the generic non-
+    // immersive runtime's DisplayInfo if we have it.
+    return non_immersive_runtime ? non_immersive_runtime->GetVRDisplayInfo()
+                                 : nullptr;
+  }
+
+  // Use the immersive or AR runtime.
+  device::mojom::VRDisplayInfoPtr device_info =
+      immersive_runtime ? immersive_runtime->GetVRDisplayInfo()
+                        : ar_runtime->GetVRDisplayInfo();
+
+  return device_info;
+}
+
+BrowserXRRuntimeImpl*
+XRRuntimeManagerImpl::GetCurrentlyPresentingImmersiveRuntime() {
+  auto* vr_runtime = GetImmersiveVrRuntime();
+  if (vr_runtime && vr_runtime->GetServiceWithActiveImmersiveSession()) {
+    return vr_runtime;
+  }
+
+  auto* ar_runtime = GetImmersiveArRuntime();
+  if (ar_runtime && ar_runtime->GetServiceWithActiveImmersiveSession()) {
+    return ar_runtime;
+  }
+
+  return nullptr;
+}
+
+bool XRRuntimeManagerImpl::IsOtherClientPresenting(VRServiceImpl* service) {
+  DCHECK(service);
+
+  auto* runtime = GetCurrentlyPresentingImmersiveRuntime();
+  if (!runtime)
+    return false;  // No immersive runtime to be presenting.
+
+  auto* presenting_service = runtime->GetServiceWithActiveImmersiveSession();
+
+  // True if some other VRServiceImpl is presenting.
+  return (presenting_service != service);
+}
+
+void XRRuntimeManagerImpl::SupportsSession(
+    device::mojom::XRSessionOptionsPtr options,
+    device::mojom::VRService::SupportsSessionCallback callback) {
+  auto* runtime = GetRuntimeForOptions(options.get());
+
+  if (!runtime) {
+    std::move(callback).Run(false);
+    return;
+  }
+
+  // TODO(http://crbug.com/842025): Pass supports session on to the runtimes.
+  std::move(callback).Run(true);
+}
+
+XRRuntimeManagerImpl::XRRuntimeManagerImpl(XRProviderList providers)
+    : providers_(std::move(providers)) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  CHECK(!g_xr_runtime_manager);
+  g_xr_runtime_manager = this;
+}
+
+XRRuntimeManagerImpl::~XRRuntimeManagerImpl() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  CHECK_EQ(g_xr_runtime_manager, this);
+  g_xr_runtime_manager = nullptr;
+}
+
+scoped_refptr<XRRuntimeManagerImpl> XRRuntimeManagerImpl::CreateInstance(
+    XRProviderList providers) {
+  auto* ptr = new XRRuntimeManagerImpl(std::move(providers));
+  CHECK_EQ(ptr, g_xr_runtime_manager);
+  return base::AdoptRef(ptr);
+}
+
+device::mojom::XRRuntime* XRRuntimeManagerImpl::GetRuntimeForTest(
+    device::mojom::XRDeviceId id) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DeviceRuntimeMap::iterator iter =
+      runtimes_.find(static_cast<device::mojom::XRDeviceId>(id));
+  if (iter == runtimes_.end())
+    return nullptr;
+
+  return iter->second->GetRuntime();
+}
+
+size_t XRRuntimeManagerImpl::NumberOfConnectedServices() {
+  return services_.size();
+}
+
+void XRRuntimeManagerImpl::InitializeProviders() {
+  if (providers_initialized_)
+    return;
+
+  for (const auto& provider : providers_) {
+    if (!provider) {
+      // TODO(crbug.com/1050470): Remove this logging after investigation.
+      LOG(ERROR) << __func__ << " got null XR provider";
+      continue;
+    }
+
+    provider->Initialize(
+        base::BindRepeating(&XRRuntimeManagerImpl::AddRuntime,
+                            base::Unretained(this)),
+        base::BindRepeating(&XRRuntimeManagerImpl::RemoveRuntime,
+                            base::Unretained(this)),
+        base::BindOnce(&XRRuntimeManagerImpl::OnProviderInitialized,
+                       base::Unretained(this)));
+  }
+
+  providers_initialized_ = true;
+}
+
+void XRRuntimeManagerImpl::OnProviderInitialized() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  ++num_initialized_providers_;
+  if (AreAllProvidersInitialized()) {
+    for (VRServiceImpl* service : services_)
+      service->InitializationComplete();
+  }
+}
+
+bool XRRuntimeManagerImpl::AreAllProvidersInitialized() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  return num_initialized_providers_ == providers_.size();
+}
+
+void XRRuntimeManagerImpl::AddRuntime(
+    device::mojom::XRDeviceId id,
+    device::mojom::VRDisplayInfoPtr info,
+    mojo::PendingRemote<device::mojom::XRRuntime> runtime) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(runtimes_.find(id) == runtimes_.end());
+
+  TRACE_EVENT_INSTANT1("xr", "AddRuntime", TRACE_EVENT_SCOPE_THREAD, "id", id);
+
+  runtimes_[id] = std::make_unique<BrowserXRRuntimeImpl>(id, std::move(runtime),
+                                                         std::move(info));
+
+  for (Observer& obs : g_xr_runtime_manager_observers.Get())
+    obs.OnRuntimeAdded(runtimes_[id].get());
+
+  for (VRServiceImpl* service : services_)
+    // TODO(sumankancherla): Consider combining with XRRuntimeManager::Observer.
+    service->RuntimesChanged();
+}
+
+void XRRuntimeManagerImpl::RemoveRuntime(device::mojom::XRDeviceId id) {
+  DVLOG(1) << __func__ << " id: " << id;
+  TRACE_EVENT_INSTANT1("xr", "RemoveRuntime", TRACE_EVENT_SCOPE_THREAD, "id",
+                       id);
+
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  auto it = runtimes_.find(id);
+  DCHECK(it != runtimes_.end());
+
+  // Give the runtime a chance to clean itself up before notifying services
+  // that it was removed.
+  it->second->BeforeRuntimeRemoved();
+
+  // Remove the runtime from runtimes_ before notifying services that it was
+  // removed, since they will query for runtimes in RuntimesChanged.
+  std::unique_ptr<BrowserXRRuntimeImpl> removed_runtime = std::move(it->second);
+  runtimes_.erase(it);
+
+  for (VRServiceImpl* service : services_)
+    service->RuntimesChanged();
+}
+
+void XRRuntimeManagerImpl::ForEachRuntime(
+    base::RepeatingCallback<void(BrowserXRRuntime*)> fn) {
+  for (auto& runtime : runtimes_) {
+    fn.Run(runtime.second.get());
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/service/xr_runtime_manager_impl.h b/chromium/content/browser/xr/service/xr_runtime_manager_impl.h
new file mode 100644
index 00000000000..57e5494a3d9
--- /dev/null
+++ b/chromium/content/browser/xr/service/xr_runtime_manager_impl.h
@@ -0,0 +1,130 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_SERVICE_XR_RUNTIME_MANAGER_IMPL_H_
+#define CONTENT_BROWSER_XR_SERVICE_XR_RUNTIME_MANAGER_IMPL_H_
+
+#include <stdint.h>
+
+#include <map>
+#include <memory>
+#include <set>
+#include <vector>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/optional.h"
+#include "base/threading/thread_checker.h"
+#include "base/timer/timer.h"
+#include "content/browser/xr/service/browser_xr_runtime_impl.h"
+#include "content/browser/xr/service/vr_service_impl.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/xr_integration_client.h"
+#include "content/public/browser/xr_runtime_manager.h"
+#include "device/vr/public/mojom/vr_service.mojom-forward.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+
+namespace content {
+class XRRuntimeManagerTest;
+
+// Singleton used to provide the platform's XR Runtimes to VRServiceImpl
+// instances.
+class CONTENT_EXPORT XRRuntimeManagerImpl
+    : public XRRuntimeManager,
+      public base::RefCounted<XRRuntimeManagerImpl> {
+ public:
+  friend base::RefCounted<XRRuntimeManagerImpl>;
+  static constexpr auto kRefCountPreference =
+      base::subtle::kStartRefCountFromOneTag;
+
+  friend XRRuntimeManagerTest;
+  XRRuntimeManagerImpl(const XRRuntimeManagerImpl&) = delete;
+  XRRuntimeManagerImpl& operator=(const XRRuntimeManagerImpl&) = delete;
+
+  // Returns a pointer to the XRRuntimeManagerImpl singleton.
+  // If The singleton is not currently instantiated, this instantiates it with
+  // the built-in set of providers.
+  // The singleton will persist until all pointers have been dropped.
+  static scoped_refptr<XRRuntimeManagerImpl> GetOrCreateInstance();
+
+  // Adds a listener for runtime manager events. XRRuntimeManagerImpl does not
+  // own this object.
+  void AddService(VRServiceImpl* service);
+  void RemoveService(VRServiceImpl* service);
+
+  BrowserXRRuntimeImpl* GetRuntimeForOptions(
+      device::mojom::XRSessionOptions* options);
+
+  // Gets the runtime matching a currently-active immersive session, if any.
+  // This is either the VR or AR runtime, or null if there's no matching
+  // runtime or if there's no active immersive session.
+  BrowserXRRuntimeImpl* GetCurrentlyPresentingImmersiveRuntime();
+
+  device::mojom::VRDisplayInfoPtr GetCurrentVRDisplayInfo(
+      VRServiceImpl* service);
+
+  // Returns true if another service is presenting. Returns false if this
+  // service is presenting, or if nobody is presenting.
+  bool IsOtherClientPresenting(VRServiceImpl* service);
+
+  void SupportsSession(
+      device::mojom::XRSessionOptionsPtr options,
+      device::mojom::VRService::SupportsSessionCallback callback);
+
+  // XRRuntimeManager implementation
+  BrowserXRRuntimeImpl* GetRuntime(device::mojom::XRDeviceId id) override;
+  void ForEachRuntime(
+      base::RepeatingCallback<void(BrowserXRRuntime*)> fn) override;
+
+ private:
+  // Constructor also used by tests to supply an arbitrary list of providers
+  static scoped_refptr<XRRuntimeManagerImpl> CreateInstance(
+      XRProviderList providers);
+
+  // Used by tests to check on runtime state.
+  device::mojom::XRRuntime* GetRuntimeForTest(device::mojom::XRDeviceId id);
+
+  // Used by tests
+  size_t NumberOfConnectedServices();
+
+  explicit XRRuntimeManagerImpl(XRProviderList providers);
+
+  ~XRRuntimeManagerImpl() override;
+
+  void InitializeProviders();
+  void OnProviderInitialized();
+  bool AreAllProvidersInitialized();
+
+  void AddRuntime(device::mojom::XRDeviceId id,
+                  device::mojom::VRDisplayInfoPtr info,
+                  mojo::PendingRemote<device::mojom::XRRuntime> runtime);
+  void RemoveRuntime(device::mojom::XRDeviceId id);
+
+  // Gets the system default immersive-vr runtime if available.
+  BrowserXRRuntimeImpl* GetImmersiveVrRuntime();
+
+  // Gets the system default immersive-ar runtime if available.
+  BrowserXRRuntimeImpl* GetImmersiveArRuntime();
+
+  XRProviderList providers_;
+
+  // XRRuntimes are owned by their providers, each correspond to a
+  // BrowserXRRuntimeImpl that is owned by XRRuntimeManagerImpl.
+  using DeviceRuntimeMap =
+      base::small_map<std::map<device::mojom::XRDeviceId,
+                               std::unique_ptr<BrowserXRRuntimeImpl>>>;
+  DeviceRuntimeMap runtimes_;
+
+  bool providers_initialized_ = false;
+  size_t num_initialized_providers_ = 0;
+
+  std::set<VRServiceImpl*> services_;
+
+  THREAD_CHECKER(thread_checker_);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_SERVICE_XR_RUNTIME_MANAGER_IMPL_H_
diff --git a/chromium/content/browser/xr/service/xr_runtime_manager_unittest.cc b/chromium/content/browser/xr/service/xr_runtime_manager_unittest.cc
new file mode 100644
index 00000000000..3183935777f
--- /dev/null
+++ b/chromium/content/browser/xr/service/xr_runtime_manager_unittest.cc
@@ -0,0 +1,151 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+#include <utility>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
+#include "base/test/task_environment.h"
+#include "content/browser/xr/service/vr_service_impl.h"
+#include "content/browser/xr/service/xr_runtime_manager_impl.h"
+#include "content/public/browser/xr_runtime_manager.h"
+#include "device/vr/public/cpp/vr_device_provider.h"
+#include "device/vr/public/mojom/vr_service.mojom.h"
+#include "device/vr/test/fake_vr_device.h"
+#include "device/vr/test/fake_vr_device_provider.h"
+#include "device/vr/test/fake_vr_service_client.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+class XRRuntimeManagerTest : public testing::Test {
+ protected:
+  XRRuntimeManagerTest() = default;
+  ~XRRuntimeManagerTest() override = default;
+
+  void SetUp() override {
+    std::vector<std::unique_ptr<device::VRDeviceProvider>> providers;
+    provider_ = new device::FakeVRDeviceProvider();
+    providers.emplace_back(base::WrapUnique(provider_));
+    xr_runtime_manager_ =
+        XRRuntimeManagerImpl::CreateInstance(std::move(providers));
+  }
+
+  void TearDown() override {
+    DropRuntimeManagerRef();
+    EXPECT_EQ(XRRuntimeManager::GetInstanceIfCreated(), nullptr);
+  }
+
+  std::unique_ptr<VRServiceImpl> BindService() {
+    // The mojom bindings that get run as part of adding a device need to run on
+    // a single thread.
+    base::test::SingleThreadTaskEnvironment task_environment;
+    mojo::PendingRemote<device::mojom::VRServiceClient> proxy;
+    device::FakeVRServiceClient client(proxy.InitWithNewPipeAndPassReceiver());
+    auto service =
+        std::make_unique<VRServiceImpl>(util::PassKey<XRRuntimeManagerTest>());
+    service->SetClient(std::move(proxy));
+    base::RunLoop run_loop;
+    run_loop.RunUntilIdle();
+    return service;
+  }
+
+  scoped_refptr<XRRuntimeManagerImpl> GetRuntimeManager() {
+    EXPECT_NE(XRRuntimeManager::GetInstanceIfCreated(), nullptr);
+    return XRRuntimeManagerImpl::GetOrCreateInstance();
+  }
+
+  device::mojom::XRRuntime* GetRuntimeForTest(
+      device::mojom::XRDeviceId device_id) {
+    return GetRuntimeManager()->GetRuntimeForTest(device_id);
+  }
+
+  size_t ServiceCount() {
+    return GetRuntimeManager()->NumberOfConnectedServices();
+  }
+
+  device::FakeVRDeviceProvider* Provider() {
+    EXPECT_NE(XRRuntimeManager::GetInstanceIfCreated(), nullptr);
+    return provider_;
+  }
+
+  // Drops the internal XRRuntimeManagerImplRef. This is useful for testing the
+  // reference counting behavior of the XRRuntimeManagerImpl singleton.
+  void DropRuntimeManagerRef() { xr_runtime_manager_ = nullptr; }
+
+ private:
+  device::FakeVRDeviceProvider* provider_ = nullptr;
+  scoped_refptr<XRRuntimeManagerImpl> xr_runtime_manager_;
+
+  DISALLOW_COPY_AND_ASSIGN(XRRuntimeManagerTest);
+};
+
+TEST_F(XRRuntimeManagerTest, InitializationTest) {
+  EXPECT_FALSE(Provider()->Initialized());
+
+  // Calling GetDevices should initialize the service if it hasn't been
+  // initialized yet or the providesr have been released.
+  // The mojom::VRService should initialize each of it's providers upon it's own
+  // initialization. And SetClient method in VRService class will invoke
+  // GetVRDevices too.
+  auto service = BindService();
+  EXPECT_TRUE(Provider()->Initialized());
+}
+
+TEST_F(XRRuntimeManagerTest, GetNoDevicesTest) {
+  auto service = BindService();
+  // Calling GetVRDevices should initialize the providers.
+  EXPECT_TRUE(Provider()->Initialized());
+
+  // GetDeviceByIndex should return nullptr if an invalid index in queried.
+  device::mojom::XRRuntime* queried_device =
+      GetRuntimeForTest(device::mojom::XRDeviceId::GVR_DEVICE_ID);
+  EXPECT_EQ(nullptr, queried_device);
+}
+
+// Ensure that services are registered with the device manager as they are
+// created and removed from the device manager as their connections are closed.
+TEST_F(XRRuntimeManagerTest, DeviceManagerRegistration) {
+  EXPECT_EQ(0u, ServiceCount());
+  auto service_1 = BindService();
+  EXPECT_EQ(1u, ServiceCount());
+  auto service_2 = BindService();
+  EXPECT_EQ(2u, ServiceCount());
+  service_1.reset();
+  EXPECT_EQ(1u, ServiceCount());
+  service_2.reset();
+
+  DropRuntimeManagerRef();
+  EXPECT_EQ(XRRuntimeManager::GetInstanceIfCreated(), nullptr);
+}
+
+// Ensure that devices added and removed are reflected in calls to request
+// sessions.
+TEST_F(XRRuntimeManagerTest, AddRemoveDevices) {
+  auto service = BindService();
+  EXPECT_EQ(1u, ServiceCount());
+  EXPECT_TRUE(Provider()->Initialized());
+
+  // The mojom bindings that get run as part of adding a device need to run on
+  // a single thread.
+  base::test::SingleThreadTaskEnvironment task_environment;
+  base::RunLoop run_loop;
+  device::FakeVRDevice* device = new device::FakeVRDevice(
+      device::mojom::XRDeviceId::ORIENTATION_DEVICE_ID);
+  Provider()->AddDevice(base::WrapUnique(device));
+  run_loop.RunUntilIdle();
+
+  device::mojom::XRSessionOptions options = {};
+  options.mode = device::mojom::XRSessionMode::kInline;
+  EXPECT_TRUE(GetRuntimeManager()->GetRuntimeForOptions(&options));
+  Provider()->RemoveDevice(device->GetId());
+  EXPECT_TRUE(!GetRuntimeManager()->GetRuntimeForOptions(&options));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/xr/xr_utils.cc b/chromium/content/browser/xr/xr_utils.cc
new file mode 100644
index 00000000000..72d153458e7
--- /dev/null
+++ b/chromium/content/browser/xr/xr_utils.cc
@@ -0,0 +1,22 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/xr/xr_utils.h"
+
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
+
+namespace content {
+XrIntegrationClient* GetXrIntegrationClient() {
+  auto* client = GetContentClient();
+  if (!client)
+    return nullptr;
+
+  auto* browser = client->browser();
+  if (!browser)
+    return nullptr;
+
+  return browser->GetXrIntegrationClient();
+}
+}  // namespace content
diff --git a/chromium/content/browser/xr/xr_utils.h b/chromium/content/browser/xr/xr_utils.h
new file mode 100644
index 00000000000..ecc5f72c7b2
--- /dev/null
+++ b/chromium/content/browser/xr/xr_utils.h
@@ -0,0 +1,16 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_XR_XR_UTILS_H_
+#define CONTENT_BROWSER_XR_XR_UTILS_H_
+
+namespace content {
+class XrIntegrationClient;
+
+// Simplifies the querying of ContentClient->ContentBrowserClient->
+// XrIntegrationClient. May return nullptr.
+XrIntegrationClient* GetXrIntegrationClient();
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_XR_XR_UTILS_H_
diff --git a/chromium/content/browser/zoom_browsertest.cc b/chromium/content/browser/zoom_browsertest.cc
index 7983ca39df4..c4831650ff3 100644
--- a/chromium/content/browser/zoom_browsertest.cc
+++ b/chromium/content/browser/zoom_browsertest.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/child/child_process_sandbox_support_impl_mac.cc b/chromium/content/child/child_process_sandbox_support_impl_mac.cc
index c66975565de..4b1d573f5ea 100644
--- a/chromium/content/child/child_process_sandbox_support_impl_mac.cc
+++ b/chromium/content/child/child_process_sandbox_support_impl_mac.cc
@@ -15,7 +15,6 @@
 #include "content/public/child/child_thread.h"
 #include "content/public/common/service_names.mojom.h"
 #include "mojo/public/cpp/system/buffer.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
 
diff --git a/chromium/content/child/child_thread_impl.cc b/chromium/content/child/child_thread_impl.cc
index 36574e68cb0..9d3b69def68 100644
--- a/chromium/content/child/child_thread_impl.cc
+++ b/chromium/content/child/child_thread_impl.cc
@@ -364,7 +364,7 @@ class ChildThreadImpl::IOThreadState
       return;
     }
 
-    if (interface_binders_.Bind(&receiver))
+    if (interface_binders_.TryBind(&receiver))
       return;
 
     main_thread_task_runner_->PostTask(
@@ -570,8 +570,16 @@ void ChildThreadImpl::Init(const Options& options) {
   // IPC mode.
   mojo::ScopedMessagePipeHandle child_process_pipe;
   if (!IsInBrowserProcess()) {
+    scoped_refptr<base::SingleThreadTaskRunner> mojo_ipc_task_runner =
+        GetIOTaskRunner();
+    if (base::FeatureList::IsEnabled(features::kMojoDedicatedThread)) {
+      mojo_ipc_thread_.StartWithOptions(
+          base::Thread::Options(base::MessagePumpType::IO, 0));
+      mojo_ipc_task_runner = mojo_ipc_thread_.task_runner();
+    }
     mojo_ipc_support_.reset(new mojo::core::ScopedIPCSupport(
-        GetIOTaskRunner(), mojo::core::ScopedIPCSupport::ShutdownPolicy::FAST));
+        mojo_ipc_task_runner,
+        mojo::core::ScopedIPCSupport::ShutdownPolicy::FAST));
     mojo::IncomingInvitation invitation = InitializeMojoIPCChannel();
     child_process_pipe = invitation.ExtractMessagePipe(0);
   } else {
diff --git a/chromium/content/child/child_thread_impl.h b/chromium/content/child/child_thread_impl.h
index 36f058fa426..090be911261 100644
--- a/chromium/content/child/child_thread_impl.h
+++ b/chromium/content/child/child_thread_impl.h
@@ -16,6 +16,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/field_trial.h"
 #include "base/single_thread_task_runner.h"
+#include "base/threading/thread.h"
 #include "build/build_config.h"
 #include "components/variations/child_process_field_trial_syncer.h"
 #include "content/common/associated_interfaces.mojom.h"
@@ -211,6 +212,7 @@ class CONTENT_EXPORT ChildThreadImpl
   const mojo::Remote<mojom::FontCacheWin>& GetFontCacheWin();
 #endif
 
+  base::Thread mojo_ipc_thread_{"Mojo IPC"};
   std::unique_ptr<mojo::core::ScopedIPCSupport> mojo_ipc_support_;
 
   mojo::AssociatedReceiver<mojom::RouteProvider> route_provider_receiver_{this};
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
index f569898705d..23330b6374b 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
@@ -10,9 +10,9 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/debug/crash_logging.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_localized_strings_win.cc b/chromium/content/child/dwrite_font_proxy/dwrite_localized_strings_win.cc
index 1084c968783..987c2c2c596 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_localized_strings_win.cc
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_localized_strings_win.cc
@@ -6,7 +6,6 @@
 
 #include <stddef.h>
 
-#include "base/logging.h"
 
 namespace content {
 
diff --git a/chromium/content/child/runtime_features.cc b/chromium/content/child/runtime_features.cc
index ad5f1f1d5bd..a8f08ddedfe 100644
--- a/chromium/content/child/runtime_features.cc
+++ b/chromium/content/child/runtime_features.cc
@@ -12,6 +12,7 @@
 #include "base/metrics/field_trial_params.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
+#include "cc/base/features.h"
 #include "content/common/content_navigation_policy.h"
 #include "content/common/content_switches_internal.h"
 #include "content/public/common/content_features.h"
@@ -110,9 +111,6 @@ void SetRuntimeFeatureDefaultsForPlatform(
       base::FeatureList::IsEnabled(features::kWebAuth));
 #endif
 
-  WebRuntimeFeatures::EnableWebAuthenticationFeaturePolicy(
-      base::FeatureList::IsEnabled(device::kWebAuthFeaturePolicy));
-
 #if defined(OS_ANDROID)
   WebRuntimeFeatures::EnablePictureInPictureAPI(
       base::FeatureList::IsEnabled(media::kPictureInPictureAPI));
@@ -212,14 +210,12 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
     {wf::EnableWebXRARModule, features::kWebXrArModule, kUseFeatureState},
     {wf::EnableWebXRHitTest, features::kWebXrHitTest, kUseFeatureState},
     {wf::EnableWebXRIncubations, features::kWebXrIncubations, kEnableOnly},
+    {wf::EnableWebXRAnchors, features::kWebXrIncubations, kEnableOnly},
+    {wf::EnableWebXRLightEstimation, features::kWebXrIncubations, kEnableOnly},
     {wf::EnableUserActivationPostMessageTransfer,
      features::kUserActivationPostMessageTransfer, kUseFeatureState},
     {wf::EnableUserActivationSameOriginVisibility,
      features::kUserActivationSameOriginVisibility, kUseFeatureState},
-    {wf::EnablePassiveDocumentEventListeners,
-     features::kPassiveDocumentEventListeners, kUseFeatureState},
-    {wf::EnablePassiveDocumentWheelEventListeners,
-     features::kPassiveDocumentWheelEventListeners, kUseFeatureState},
     {wf::EnableExpensiveBackgroundTimerThrottling,
      features::kExpensiveBackgroundTimerThrottling, kUseFeatureState},
     {wf::EnableTimerThrottlingForHiddenFrames,
@@ -230,8 +226,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
     {wf::EnablePaymentHandlerMinimalUI, features::kWebPaymentsMinimalUI,
      kEnableOnly},
     {wf::EnablePaymentApp, features::kServiceWorkerPaymentApps, kEnableOnly},
-    {wf::EnableCompositorTouchAction, features::kCompositorTouchAction,
-     kEnableOnly},
     {wf::EnableGenericSensorExtraClasses, features::kGenericSensorExtraClasses,
      kEnableOnly},
     {wf::EnableMediaCastOverlayButton, media::kMediaCastOverlayButton,
@@ -244,8 +238,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
      media::kOverflowIconsForMediaControls, kUseFeatureState},
     {wf::EnableAllowActivationDelegationAttr,
      features::kAllowActivationDelegationAttr, kUseFeatureState},
-    {wf::EnableScriptStreamingOnPreload, features::kScriptStreamingOnPreload,
-     kUseFeatureState},
     {wf::EnableLazyFrameLoading, features::kLazyFrameLoading, kUseFeatureState},
     {wf::EnableLazyFrameVisibleLoadTimeMetrics,
      features::kLazyFrameVisibleLoadTimeMetrics, kUseFeatureState},
@@ -283,14 +275,12 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
      kUseFeatureState},
     {wf::EnableGetDisplayMedia, blink::features::kRTCGetDisplayMedia,
      kUseFeatureState},
-    {wf::EnableFallbackCursorMode, features::kFallbackCursorMode,
-     kUseFeatureState},
     {wf::EnableSignedExchangePrefetchCacheForNavigations,
      features::kSignedExchangePrefetchCacheForNavigations, kUseFeatureState},
     {wf::EnableSignedExchangeSubresourcePrefetch,
      features::kSignedExchangeSubresourcePrefetch, kUseFeatureState},
     {wf::EnableIdleDetection, features::kIdleDetection, kDisableOnly},
-    {wf::EnableSkipTouchEventFilter, features::kSkipTouchEventFilter,
+    {wf::EnableSkipTouchEventFilter, blink::features::kSkipTouchEventFilter,
      kUseFeatureState},
     {wf::EnableSmsReceiver, features::kSmsReceiver, kDisableOnly},
     {wf::EnableConsolidatedMovementXY, features::kConsolidatedMovementXY,
@@ -307,6 +297,8 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
      net::features::kCookiesWithoutSameSiteMustBeSecure, kEnableOnly},
     {wf::EnablePointerLockOptions, features::kPointerLockOptions, kEnableOnly},
     {wf::EnableDocumentPolicy, features::kDocumentPolicy, kUseFeatureState},
+    {wf::EnableScrollUnification, features::kScrollUnification,
+     kUseFeatureState},
     {wf::EnableNeverSlowMode, features::kNeverSlowMode, kUseFeatureState},
     {wf::EnableShadowDOMV0, blink::features::kWebComponentsV0Enabled,
      kEnableOnly},
@@ -325,8 +317,11 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
 #if defined(OS_ANDROID)
     {wf::EnableWebNfc, features::kWebNfc, kDisableOnly},
 #endif
-    {wf::EnableTrustTokens, network::features::kTrustTokens, kEnableOnly},
     {wf::EnableInstalledApp, features::kInstalledApp, kDisableOnly},
+    {wf::EnableWebAuthenticationGetAssertionFeaturePolicy,
+     device::kWebAuthGetAssertionFeaturePolicy, kUseFeatureState},
+    {wf::EnableVideoWakeLockOptimisationHiddenMuted,
+     media::kWakeLockOptimisationHiddenMuted, kUseFeatureState},
   };
   for (const auto& mapping : blinkFeatureToBaseFeatureMapping) {
     SetRuntimeFeatureFromChromiumFeature(
@@ -342,7 +337,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {"AllowContentInitiatedDataUrlNavigations",
            features::kAllowContentInitiatedDataUrlNavigations,
            kUseFeatureState},
-          {"AppCache", blink::features::kAppCache, kDisableOnly},
           {"AudioWorkletRealtimeThread",
            blink::features::kAudioWorkletRealtimeThread, kEnableOnly},
           {"BlockCredentialedSubresources",
@@ -358,7 +352,7 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
            kEnableOnly},
           {"FeaturePolicyForClientHints",
            features::kFeaturePolicyForClientHints, kUseFeatureState},
-          {"FlexNG", blink::features::kFlexNG, kEnableOnly},
+          {"FlexGaps", blink::features::kFlexGaps, kEnableOnly},
           {"FontAccess", blink::features::kFontAccess, kUseFeatureState},
           {"FontSrcLocalMatching", features::kFontSrcLocalMatching,
            kUseFeatureState},
@@ -368,14 +362,19 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
            blink::features::kIgnoreCrossOriginWindowWhenNamedAccessOnWindow,
            kEnableOnly},
           {"LayoutNG", blink::features::kLayoutNG, kUseFeatureState},
+          {"LayoutNGFlexBox", blink::features::kFlexNG, kEnableOnly},
           {"LegacyWindowsDWriteFontFallback",
            features::kLegacyWindowsDWriteFontFallback, kUseFeatureState},
           {"OriginPolicy", features::kOriginPolicy, kUseFeatureState},
+          {"OriginIsolationHeader", features::kOriginIsolationHeader,
+           kUseFeatureState},
+          {"RawClipboard", blink::features::kRawClipboard, kEnableOnly},
           {"ShadowDOMV0", blink::features::kWebComponentsV0Enabled,
            kEnableOnly},
           {"StorageAccessAPI", blink::features::kStorageAccessAPI, kEnableOnly},
           {"TrustedDOMTypes", features::kTrustedDOMTypes, kEnableOnly},
-          {"UserAgentClientHint", features::kUserAgentClientHint, kEnableOnly},
+          {"UserAgentClientHint", features::kUserAgentClientHint,
+           kUseFeatureState},
 
       };
   for (const auto& mapping : runtimeFeatureNameToChromiumFeatureMapping) {
@@ -490,10 +489,6 @@ void SetRuntimeFeaturesFromFieldTrialParams() {
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyImageLoading,
           "restrict-lazy-load-images-to-data-saver-only", true));
-  WebRuntimeFeatures::EnableLazyImageLoadingMetadataFetch(
-      base::GetFieldTrialParamByFeatureAsBool(
-          features::kLazyImageLoading, "enable-lazy-load-images-metadata-fetch",
-          false));
 }
 
 // Sets blink runtime features that depend on a combination
@@ -565,6 +560,50 @@ void SetCustomizedRuntimeFeaturesFromCombinedArgs(
   WebRuntimeFeatures::EnableReducedReferrerGranularity(
       base::FeatureList::IsEnabled(features::kReducedReferrerGranularity) &&
       !content::Referrer::ShouldForceLegacyDefaultReferrerPolicy());
+
+  if (base::FeatureList::IsEnabled(
+          blink::features::kAppCacheRequireOriginTrial)) {
+    // The kAppCacheRequireOriginTrial is a flag that controls whether or not
+    // the renderer AppCache api and backend is gated by an origin trial.  If
+    // on, then AppCache is disabled but can be re-enabled by the origin trial.
+    // The origin trial will not turn on the feature if the base::Feature
+    // AppCache is disabled.
+    WebRuntimeFeatures::EnableFeatureFromString("AppCache", false);
+  } else {
+    // If the origin trial is not required, then the kAppCache feature /
+    // about:flag is a disable-only kill switch to allow developers to test
+    // their application with AppCache fully disabled.
+    if (!base::FeatureList::IsEnabled(blink::features::kAppCache))
+      WebRuntimeFeatures::EnableFeatureFromString("AppCache", false);
+  }
+
+  if (base::FeatureList::IsEnabled(network::features::kTrustTokens)) {
+    // See https://bit.ly/configuring-trust-tokens.
+    using network::features::TrustTokenOriginTrialSpec;
+    switch (
+        network::features::kTrustTokenOperationsRequiringOriginTrial.Get()) {
+      case TrustTokenOriginTrialSpec::kOriginTrialNotRequired:
+        // Setting TrustTokens=true enables the Trust Tokens interface;
+        // TrustTokensAlwaysAllowIssuance disables a runtime check during
+        // issuance that the origin trial is active (see
+        // blink/.../trust_token_issuance_authorization.h).
+        WebRuntimeFeatures::EnableTrustTokens(true);
+        WebRuntimeFeatures::EnableTrustTokensAlwaysAllowIssuance(true);
+        break;
+      case TrustTokenOriginTrialSpec::kAllOperationsRequireOriginTrial:
+        // The origin trial itself will be responsible for enabling the
+        // TrustTokens RuntimeEnabledFeature.
+        WebRuntimeFeatures::EnableTrustTokens(false);
+        WebRuntimeFeatures::EnableTrustTokensAlwaysAllowIssuance(false);
+        break;
+      case TrustTokenOriginTrialSpec::kOnlyIssuanceRequiresOriginTrial:
+        // At issuance, a runtime check will be responsible for checking that
+        // the origin trial is present.
+        WebRuntimeFeatures::EnableTrustTokens(true);
+        WebRuntimeFeatures::EnableTrustTokensAlwaysAllowIssuance(false);
+        break;
+    }
+  }
 }
 
 }  // namespace
diff --git a/chromium/content/child/webthemeengine_impl_android.cc b/chromium/content/child/webthemeengine_impl_android.cc
index db48cdcd72a..a879ed2cfa4 100644
--- a/chromium/content/child/webthemeengine_impl_android.cc
+++ b/chromium/content/child/webthemeengine_impl_android.cc
@@ -4,7 +4,7 @@
 
 #include "content/child/webthemeengine_impl_android.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/system/sys_info.h"
 #include "content/child/webthemeengine_impl_conversions.h"
 #include "skia/ext/platform_canvas.h"
diff --git a/chromium/content/child/webthemeengine_impl_default_browsertest.cc b/chromium/content/child/webthemeengine_impl_default_browsertest.cc
index 36d1e8865f2..11f79219be3 100644
--- a/chromium/content/child/webthemeengine_impl_default_browsertest.cc
+++ b/chromium/content/child/webthemeengine_impl_default_browsertest.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "build/build_config.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 
diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index f22f6c8410d..cdce63391b1 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -55,6 +55,8 @@ source_set("common") {
     "appcache_interfaces.h",
     "ax_content_node_data.cc",
     "ax_content_node_data.h",
+    "ax_serialization_utils.cc",
+    "ax_serialization_utils.h",
     "background_fetch/background_fetch_types.cc",
     "background_fetch/background_fetch_types.h",
     "browser_plugin/browser_plugin_constants.cc",
@@ -92,7 +94,6 @@ source_set("common") {
     "drag_event_source_info.h",
     "drag_messages.h",
     "drag_traits.h",
-    "edit_command.h",
     "fetch/fetch_api_request_proto.cc",
     "fetch/fetch_api_request_proto.h",
     "fetch/fetch_request_type_converters.cc",
@@ -123,16 +124,12 @@ source_set("common") {
     "input/ime_text_span_conversions.h",
     "input/input_event.cc",
     "input/input_event.h",
-    "input/input_event_ack.cc",
-    "input/input_event_ack.h",
     "input/input_event_ack_state.cc",
     "input/input_event_dispatch_type.h",
     "input/input_event_mojom_traits.cc",
     "input/input_event_mojom_traits.h",
     "input/input_event_stream_validator.cc",
     "input/input_event_stream_validator.h",
-    "input/sync_compositor_messages.cc",
-    "input/sync_compositor_messages.h",
     "input/synthetic_gesture_params.cc",
     "input/synthetic_gesture_params.h",
     "input/synthetic_pinch_gesture_params.cc",
@@ -149,8 +146,6 @@ source_set("common") {
     "input/synthetic_tap_gesture_params.h",
     "input/synthetic_web_input_event_builders.cc",
     "input/synthetic_web_input_event_builders.h",
-    "input/touch_action_optional_mojom_traits.cc",
-    "input/touch_action_optional_mojom_traits.h",
     "input/touch_event_stream_validator.cc",
     "input/touch_event_stream_validator.h",
     "input/web_mouse_wheel_event_traits.cc",
@@ -234,8 +229,9 @@ source_set("common") {
     "//third_party/blink/public:blink_headers",
     "//third_party/blink/public/common",
     "//ui/accessibility",
+    "//ui/accessibility/mojom",
     "//ui/base/cursor",
-    "//ui/base/mojom:cursor_type",
+    "//ui/base/cursor/mojom:cursor_type",
     "//ui/events/ipc",
   ]
   deps = [
@@ -363,6 +359,8 @@ source_set("common") {
 
   if (!use_aura || !use_x11) {
     sources -= [ "cursors/webcursor_aurax11.cc" ]
+  } else {
+    deps += [ "//ui/gfx/x" ]
   }
 
   if (is_linux) {
@@ -411,10 +409,7 @@ source_set("common") {
   }
 
   if (use_clang_profiling_inside_sandbox) {
-    sources += [
-      "profiling_utils.cc",
-      "profiling_utils.h",
-    ]
+    sources += [ "profiling_utils.cc" ]
   }
 }
 
@@ -444,6 +439,7 @@ mojom("mojo_bindings") {
     "ax_content_tree_update.mojom",
     "child_process.mojom",
     "document_scoped_interface_bundle.mojom",
+    "dom_automation_controller.mojom",
     "download/mhtml_file_writer.mojom",
     "field_trial_recorder.mojom",
     "frame.mojom",
@@ -549,85 +545,23 @@ mojom("mojo_bindings") {
     {
       types = [
         {
-          mojom = "content.mojom.SyncCompositorDemandDrawHwParams"
-          cpp = "::content::SyncCompositorDemandDrawHwParams"
-        },
-        {
-          mojom = "content.mojom.SyncCompositorSetSharedMemoryParams"
-          cpp = "::content::SyncCompositorSetSharedMemoryParams"
-        },
-        {
-          mojom = "content.mojom.SyncCompositorDemandDrawSwParams"
-          cpp = "::content::SyncCompositorDemandDrawSwParams"
-        },
-        {
-          mojom = "content.mojom.SyncCompositorCommonRendererParams"
-          cpp = "::content::SyncCompositorCommonRendererParams"
-        },
-      ]
-      traits_headers = [ "//content/common/input/sync_compositor_messages.h" ]
-      traits_public_deps = [ "//ui/gfx/ipc" ]
-    },
-    {
-      types = [
-        {
-          mojom = "content.mojom.Button"
-          cpp = "::blink::WebPointerProperties::Button"
-        },
-        {
-          mojom = "content.mojom.Cancelability"
-          cpp = "::blink::WebInputEvent::DispatchType"
-        },
-        {
           mojom = "content.mojom.ContentSecurityPolicy"
           cpp = "::content::ContentSecurityPolicy"
         },
         {
-          mojom = "content.mojom.DidOverscrollParams"
-          cpp = "::ui::DidOverscrollParams"
-        },
-        {
-          mojom = "content.mojom.EditCommand"
-          cpp = "::content::EditCommand"
-        },
-        {
           mojom = "content.mojom.Event"
           cpp = "::std::unique_ptr<::content::InputEvent>"
           move_only = true
         },
         {
-          mojom = "content.mojom.EventType"
-          cpp = "::blink::WebInputEvent::Type"
-        },
-        {
           mojom = "content.mojom.FrameReplicationState"
           cpp = "::content::FrameReplicationState"
         },
         {
-          mojom = "content.mojom.GestureDevice"
-          cpp = "::blink::WebGestureDevice"
-        },
-        {
-          mojom = "content.mojom.InertialPhaseState"
-          cpp = "::blink::WebGestureEvent::InertialPhaseState"
-        },
-        {
-          mojom = "content.mojom.InputEventAckSource"
-          cpp = "::content::InputEventAckSource"
-        },
-        {
-          mojom = "content.mojom.InputEventAckState"
-          cpp = "::content::InputEventAckState"
-        },
-        {
           mojom = "content.mojom.NetworkConnectionType"
           cpp = "::net::NetworkChangeNotifier::ConnectionType"
         },
         {
-          mojom = "content.mojom.PointerType"
-          cpp = "::blink::WebPointerProperties::PointerType"
-        },
-        {
           mojom = "content.mojom.ScrollGranularity"
           cpp = "::ui::ScrollGranularity"
         },
@@ -656,14 +590,6 @@ mojom("mojo_bindings") {
           cpp = "::ui::NativeTheme::SystemThemeColor"
         },
         {
-          mojom = "content.mojom.TouchActionOptional"
-          cpp = "::cc::TouchAction"
-        },
-        {
-          mojom = "content.mojom.TouchState"
-          cpp = "::blink::WebTouchPoint::State"
-        },
-        {
           mojom = "content.mojom.VisualProperties"
           cpp = "::content::VisualProperties"
         },
@@ -680,7 +606,6 @@ mojom("mojo_bindings") {
       traits_headers = [
         "//cc/input/touch_action.h",
         "//content/common/cursors/webcursor.h",
-        "//content/common/edit_command.h",
         "//content/common/frame_replication_state.h",
         "//content/common/input/input_event.h",
         "//content/common/input/synthetic_pinch_gesture_params.h",
@@ -689,12 +614,8 @@ mojom("mojo_bindings") {
         "//content/common/input/synthetic_smooth_scroll_gesture_params.h",
         "//content/common/input/synthetic_tap_gesture_params.h",
         "//content/common/visual_properties.h",
-        "//content/public/common/input_event_ack_source.h",
-        "//content/public/common/input_event_ack_state.h",
         "//content/public/common/web_preferences.h",
         "//net/base/network_change_notifier.h",
-        "//third_party/blink/public/common/input/web_gesture_device.h",
-        "//third_party/blink/public/common/input/web_gesture_event.h",
         "//third_party/blink/public/common/input/web_input_event.h",
         "//third_party/blink/public/common/input/web_mouse_wheel_event.h",
         "//third_party/blink/public/common/input/web_pointer_properties.h",
@@ -708,7 +629,6 @@ mojom("mojo_bindings") {
       traits_private_headers = [
         "//content/common/frame_messages.h",
         "//content/common/input/input_event_mojom_traits.h",
-        "//content/common/input/touch_action_optional_mojom_traits.h",
         "//content/common/input_messages.h",
         "//content/common/view_messages.h",
         "//content/common/widget_messages.h",
@@ -731,6 +651,7 @@ mojom("mojo_bindings") {
         "//services/network/public/cpp",
         "//third_party/blink/public/common",
         "//ui/accessibility",
+        "//ui/base/cursor",
         "//ui/base/ime:text_input_types",
         "//ui/events/blink",
         "//ui/gfx/ipc",
@@ -743,6 +664,10 @@ mojom("mojo_bindings") {
     {
       types = [
         {
+          mojom = "content.mojom.Impression"
+          cpp = "::content::Impression"
+        },
+        {
           mojom = "content.mojom.MixedContentContextType"
           cpp = "::blink::WebMixedContentContextType"
         },
@@ -766,6 +691,7 @@ mojom("mojo_bindings") {
       traits_headers = [
         "//content/common/content_param_traits.h",
         "//content/common/navigation_params.h",
+        "//content/public/common/impression.h",
         "//content/public/common/navigation_policy.h",
         "//content/public/common/page_state.h",
         "//third_party/blink/public/platform/web_mixed_content_context_type.h",
@@ -812,6 +738,7 @@ mojom("mojo_bindings") {
     "//skia/public/mojom",
     "//third_party/blink/public/mojom:mojom_core",
     "//third_party/blink/public/mojom:web_feature_mojo_bindings",
+    "//ui/accessibility:ax_enums_mojo",
     "//ui/accessibility/mojom",
     "//ui/base/ime/mojom",
     "//ui/base/mojom",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index e156af2acdf..2c808941169 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -25,10 +25,10 @@ include_rules = [
   "+third_party/blink/public/platform/web_content_security_policy.h",
   "+third_party/blink/public/platform/web_drag_operation.h",
   "+third_party/blink/public/platform/web_float_rect.h",
+  "+third_party/blink/public/platform/web_float_size.h",
   "+third_party/blink/public/platform/web_fullscreen_video_status.h",
   "+third_party/blink/public/platform/web_http_body.h",
   "+third_party/blink/public/platform/web_history_scroll_restoration_type.h",
-  "+third_party/blink/public/platform/web_intrinsic_sizing_info.h",
   "+third_party/blink/public/platform/web_mixed_content_context_type.h",
   "+third_party/blink/public/platform/web_screen_info.h",
   "+third_party/blink/public/platform/web_storage_area.h",
@@ -43,7 +43,6 @@ include_rules = [
   "+third_party/blink/public/web/web_drag_status.h",
   "+third_party/blink/public/web/web_frame_owner_properties.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
-  "+third_party/blink/public/web/web_tree_scope_type.h",
   "+third_party/blink/public/web/win/web_font_rendering.h",
 ]
 specific_include_rules = {
diff --git a/chromium/content/common/android/gin_java_bridge_errors.cc b/chromium/content/common/android/gin_java_bridge_errors.cc
index b2458cd0354..5d0989ec877 100644
--- a/chromium/content/common/android/gin_java_bridge_errors.cc
+++ b/chromium/content/common/android/gin_java_bridge_errors.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/android/gin_java_bridge_errors.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 
 namespace content {
 
diff --git a/chromium/content/common/ax_serialization_utils.cc b/chromium/content/common/ax_serialization_utils.cc
new file mode 100644
index 00000000000..0cefb2aebbe
--- /dev/null
+++ b/chromium/content/common/ax_serialization_utils.cc
@@ -0,0 +1,19 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/ax_serialization_utils.h"
+
+#include "build/build_config.h"
+
+namespace content {
+
+bool AXShouldIncludePageScaleFactorInRoot() {
+#if !defined(OS_ANDROID) && !defined(OS_MACOSX)
+  return true;
+#else
+  return false;
+#endif
+}
+
+}  // namespace content
diff --git a/chromium/content/common/ax_serialization_utils.h b/chromium/content/common/ax_serialization_utils.h
new file mode 100644
index 00000000000..3bbebac810a
--- /dev/null
+++ b/chromium/content/common/ax_serialization_utils.h
@@ -0,0 +1,19 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Utilities to ensure that accessibility tree serialization and deserialization
+// logic is in sync.
+
+#ifndef CONTENT_COMMON_AX_SERIALIZATION_UTILS_H_
+#define CONTENT_COMMON_AX_SERIALIZATION_UTILS_H_
+
+namespace content {
+
+// Returns true if page scale factor should be included in the transform on the
+// root node of the AX tree.
+bool AXShouldIncludePageScaleFactorInRoot();
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_AX_SERIALIZATION_UTILS_H_
diff --git a/chromium/content/common/background_fetch/background_fetch_types.cc b/chromium/content/common/background_fetch/background_fetch_types.cc
index 9222c878d32..baa486878af 100644
--- a/chromium/content/common/background_fetch/background_fetch_types.cc
+++ b/chromium/content/common/background_fetch/background_fetch_types.cc
@@ -37,7 +37,7 @@ blink::mojom::FetchAPIResponsePtr BackgroundFetchSettledFetch::CloneResponse(
       response->cors_exposed_header_names,
       CloneSerializedBlob(response->side_data_blob),
       CloneSerializedBlob(response->side_data_blob_for_cache_put),
-      mojo::Clone(response->content_security_policy),
+      mojo::Clone(response->parsed_headers),
       response->loaded_with_credentials);
 }
 
@@ -47,9 +47,8 @@ blink::mojom::FetchAPIRequestPtr BackgroundFetchSettledFetch::CloneRequest(
   if (request.is_null())
     return nullptr;
   return blink::mojom::FetchAPIRequest::New(
-      request->mode, request->is_main_resource_load,
-      request->request_context_type, request->destination, request->frame_type,
-      request->url, request->method, request->headers,
+      request->mode, request->is_main_resource_load, request->destination,
+      request->frame_type, request->url, request->method, request->headers,
       CloneSerializedBlob(request->blob), request->body,
       request->referrer.Clone(), request->credentials_mode, request->cache_mode,
       request->redirect_mode, request->integrity, request->priority,
diff --git a/chromium/content/common/child_process_host_impl.cc b/chromium/content/common/child_process_host_impl.cc
index 06f21f0a752..adc7c1e4393 100644
--- a/chromium/content/common/child_process_host_impl.cc
+++ b/chromium/content/common/child_process_host_impl.cc
@@ -32,6 +32,7 @@
 #include "ipc/ipc_logging.h"
 #include "ipc/message_filter.h"
 #include "mojo/public/cpp/bindings/lib/message_quota_checker.h"
+#include "ppapi/buildflags/buildflags.h"
 #include "services/resource_coordinator/public/mojom/memory_instrumentation/constants.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
@@ -43,7 +44,7 @@
 #endif  // OS_LINUX
 
 #if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-#include "content/common/profiling_utils.h"
+#include "content/public/common/profiling_utils.h"
 #endif
 
 namespace {
@@ -95,8 +96,10 @@ base::FilePath ChildProcessHost::GetChildPath(int flags) {
       child_base_name += kMacHelperSuffix_renderer;
     } else if (flags == CHILD_GPU) {
       child_base_name += kMacHelperSuffix_gpu;
+#if BUILDFLAG(ENABLE_PLUGINS)
     } else if (flags == CHILD_PLUGIN) {
       child_base_name += kMacHelperSuffix_plugin;
+#endif
     } else {
       NOTREACHED();
     }
diff --git a/chromium/content/common/common_param_traits_unittest.cc b/chromium/content/common/common_param_traits_unittest.cc
index 0d234b4db12..2b2279f1b80 100644
--- a/chromium/content/common/common_param_traits_unittest.cc
+++ b/chromium/content/common/common_param_traits_unittest.cc
@@ -28,7 +28,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/ipc/gfx_param_traits.h"
 #include "ui/gfx/ipc/skia/gfx_skia_param_traits.h"
diff --git a/chromium/content/common/content_message_generator.h b/chromium/content/common/content_message_generator.h
index 11ed2e9df9b..50181ee0e82 100644
--- a/chromium/content/common/content_message_generator.h
+++ b/chromium/content/common/content_message_generator.h
@@ -63,12 +63,6 @@
 #endif
 #include "media/media_buildflags.h"
 
-#undef CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-#include "content/common/input/sync_compositor_messages.h"
-#ifndef CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-#error "Failed to include content/common/input/sync_compositor_messages.h"
-#endif
-
 #if defined(OS_ANDROID)
 #undef CONTENT_COMMON_GIN_JAVA_BRIDGE_MESSAGES_H_
 #include "content/common/gin_java_bridge_messages.h"
diff --git a/chromium/content/common/content_param_traits.cc b/chromium/content/common/content_param_traits.cc
index b0d80ab5640..5bdbdccf393 100644
--- a/chromium/content/common/content_param_traits.cc
+++ b/chromium/content/common/content_param_traits.cc
@@ -21,12 +21,13 @@
 #include "services/network/public/cpp/net_ipc_param_traits.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
 #include "third_party/blink/public/mojom/feature_policy/policy_value.mojom.h"
 #include "third_party/blink/public/mojom/messaging/transferable_message.mojom.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/ipc/skia/gfx_skia_param_traits.h"
 
 namespace IPC {
@@ -73,16 +74,16 @@ void ParamTraits<content::WebCursor>::Log(const param_type& p, std::string* l) {
 
 void ParamTraits<blink::MessagePortChannel>::Write(base::Pickle* m,
                                                    const param_type& p) {
-  ParamTraits<mojo::MessagePipeHandle>::Write(m, p.ReleaseHandle().release());
+  ParamTraits<blink::MessagePortDescriptor>::Write(m, p.ReleaseHandle());
 }
 
 bool ParamTraits<blink::MessagePortChannel>::Read(const base::Pickle* m,
                                                   base::PickleIterator* iter,
                                                   param_type* r) {
-  mojo::MessagePipeHandle handle;
-  if (!ParamTraits<mojo::MessagePipeHandle>::Read(m, iter, &handle))
+  blink::MessagePortDescriptor port;
+  if (!ParamTraits<blink::MessagePortDescriptor>::Read(m, iter, &port))
     return false;
-  *r = blink::MessagePortChannel(mojo::ScopedMessagePipeHandle(handle));
+  *r = blink::MessagePortChannel(std::move(port));
   return true;
 }
 
@@ -105,6 +106,37 @@ void ParamTraits<blink::PolicyValue>::Write(base::Pickle* m,
   }
 }
 
+void ParamTraits<blink::MessagePortDescriptor>::Write(
+    base::Pickle* m,
+    const param_type& pconst) {
+  // Serializing this object is a move of the object contents, thus we need a
+  // mutable reference to it.
+  param_type& p = const_cast<param_type&>(pconst);
+  ParamTraits<mojo::MessagePipeHandle>::Write(
+      m, p.TakeHandleForSerialization().release());
+  ParamTraits<base::UnguessableToken>::Write(m, p.TakeIdForSerialization());
+  ParamTraits<uint64_t>::Write(m, p.TakeSequenceNumberForSerialization());
+}
+
+bool ParamTraits<blink::MessagePortDescriptor>::Read(const base::Pickle* m,
+                                                     base::PickleIterator* iter,
+                                                     param_type* r) {
+  mojo::MessagePipeHandle port;
+  base::UnguessableToken id;
+  uint64_t sequence_number = 0;
+  if (!ParamTraits<mojo::MessagePipeHandle>::Read(m, iter, &port) ||
+      !ParamTraits<base::UnguessableToken>::Read(m, iter, &id) ||
+      !ParamTraits<uint64_t>::Read(m, iter, &sequence_number)) {
+    return false;
+  }
+  r->InitializeFromSerializedValues(mojo::ScopedMessagePipeHandle(port), id,
+                                    sequence_number);
+  return true;
+}
+
+void ParamTraits<blink::MessagePortDescriptor>::Log(const param_type& p,
+                                                    std::string* l) {}
+
 bool ParamTraits<blink::PolicyValue>::Read(const base::Pickle* m,
                                            base::PickleIterator* iter,
                                            param_type* r) {
diff --git a/chromium/content/common/content_param_traits.h b/chromium/content/common/content_param_traits.h
index 2e3586210a0..d034ad813e8 100644
--- a/chromium/content/common/content_param_traits.h
+++ b/chromium/content/common/content_param_traits.h
@@ -25,6 +25,7 @@
 namespace blink {
 class PolicyValue;
 class MessagePortChannel;
+class MessagePortDescriptor;
 struct TransferableMessage;
 }
 
@@ -63,6 +64,16 @@ struct CONTENT_EXPORT ParamTraits<blink::MessagePortChannel> {
 };
 
 template <>
+struct CONTENT_EXPORT ParamTraits<blink::MessagePortDescriptor> {
+  typedef blink::MessagePortDescriptor param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
+template <>
 struct CONTENT_EXPORT ParamTraits<blink::PolicyValue> {
   typedef blink::PolicyValue param_type;
   static void Write(base::Pickle* m, const param_type& p);
diff --git a/chromium/content/common/content_param_traits_macros.h b/chromium/content/common/content_param_traits_macros.h
index 0e38351c800..f65cd7dd823 100644
--- a/chromium/content/common/content_param_traits_macros.h
+++ b/chromium/content/common/content_param_traits_macros.h
@@ -11,7 +11,6 @@
 #include "components/viz/common/quads/selection.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/common/page_visibility_state.h"
 #include "ipc/ipc_message_macros.h"
 #include "services/network/public/mojom/content_security_policy.mojom.h"
@@ -20,7 +19,7 @@
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom.h"
 #include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gfx/ipc/geometry/gfx_param_traits.h"
 #include "ui/gfx/ipc/gfx_param_traits.h"
@@ -28,8 +27,6 @@
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
-IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventAckState,
-                          content::INPUT_EVENT_ACK_STATE_MAX)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::RequestContextType,
                           blink::mojom::RequestContextType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ResourceType,
@@ -42,9 +39,6 @@ IPC_ENUM_TRAITS_MAX_VALUE(network::mojom::ContentSecurityPolicyType,
 IPC_ENUM_TRAITS_MIN_MAX_VALUE(ui::mojom::CursorType,
                               ui::mojom::CursorType::kNull,
                               ui::mojom::CursorType::kMaxValue)
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebInputEvent::Type,
-                              blink::WebInputEvent::kTypeFirst,
-                              blink::WebInputEvent::kTypeLast)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebImeTextSpan::Type,
                           blink::WebImeTextSpan::Type::kMisspellingSuggestion)
 IPC_ENUM_TRAITS_MAX_VALUE(ui::mojom::ImeTextSpanThickness,
diff --git a/chromium/content/common/cursors/webcursor.cc b/chromium/content/common/cursors/webcursor.cc
index ada5f75c205..f1ae85d145f 100644
--- a/chromium/content/common/cursors/webcursor.cc
+++ b/chromium/content/common/cursors/webcursor.cc
@@ -6,9 +6,8 @@
 
 #include <algorithm>
 
-#include "base/logging.h"
 #include "build/build_config.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 
 namespace content {
 
diff --git a/chromium/content/common/cursors/webcursor_android.cc b/chromium/content/common/cursors/webcursor_android.cc
index 95c2faaef6d..9cf5a2a8e6d 100644
--- a/chromium/content/common/cursors/webcursor_android.cc
+++ b/chromium/content/common/cursors/webcursor_android.cc
@@ -4,7 +4,6 @@
 
 #include "content/common/cursors/webcursor.h"
 
-#include "base/logging.h"
 
 namespace content {
 
diff --git a/chromium/content/common/cursors/webcursor_aura.cc b/chromium/content/common/cursors/webcursor_aura.cc
index f979945d775..4d4e02010d8 100644
--- a/chromium/content/common/cursors/webcursor_aura.cc
+++ b/chromium/content/common/cursors/webcursor_aura.cc
@@ -4,10 +4,10 @@
 
 #include "content/common/cursors/webcursor.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "ui/base/cursor/cursor.h"
 #include "ui/base/cursor/cursor_util.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 
 namespace content {
 
diff --git a/chromium/content/common/cursors/webcursor_aurawin.cc b/chromium/content/common/cursors/webcursor_aurawin.cc
index f70096edaa4..03a751fdcb8 100644
--- a/chromium/content/common/cursors/webcursor_aurawin.cc
+++ b/chromium/content/common/cursors/webcursor_aurawin.cc
@@ -7,7 +7,7 @@
 #include <windows.h>
 
 #include "ui/base/cursor/cursor_lookup.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/icon_util.h"
 
 namespace content {
diff --git a/chromium/content/common/cursors/webcursor_aurax11.cc b/chromium/content/common/cursors/webcursor_aurax11.cc
index a52625ce1df..2fdcd9f9610 100644
--- a/chromium/content/common/cursors/webcursor_aurax11.cc
+++ b/chromium/content/common/cursors/webcursor_aurax11.cc
@@ -5,7 +5,6 @@
 #include "content/common/cursors/webcursor.h"
 
 
-#include "base/logging.h"
 #include "ui/base/cursor/cursor.h"
 #include "ui/base/cursor/cursor_loader_x11.h"
 #include "ui/base/cursor/cursor_lookup.h"
@@ -21,7 +20,7 @@ ui::PlatformCursor WebCursor::GetPlatformCursor(const ui::Cursor& cursor) {
   SkBitmap bitmap = GetCursorBitmap(cursor);
 
   XcursorImage* image =
-      ui::SkBitmapToXcursorImage(&bitmap, GetCursorHotspot(cursor));
+      ui::SkBitmapToXcursorImage(bitmap, GetCursorHotspot(cursor));
   platform_cursor_ = ui::CreateReffedCustomXCursor(image);
   return platform_cursor_;
 }
diff --git a/chromium/content/common/cursors/webcursor_mac.mm b/chromium/content/common/cursors/webcursor_mac.mm
index 792cde4224c..06c74d0c4ab 100644
--- a/chromium/content/common/cursors/webcursor_mac.mm
+++ b/chromium/content/common/cursors/webcursor_mac.mm
@@ -7,14 +7,15 @@
 #import <AppKit/AppKit.h>
 #include <stddef.h>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/mac/scoped_cftyperef.h"
+#include "base/notreached.h"
 #include "content/app/resources/grit/content_resources.h"
 #include "content/public/common/content_client.h"
 #include "skia/ext/skia_utils_mac.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/gfx/geometry/size_conversions.h"
 #include "ui/gfx/image/image.h"
diff --git a/chromium/content/common/cursors/webcursor_unittest.cc b/chromium/content/common/cursors/webcursor_unittest.cc
index 2cbd51dcf0f..7ccdbcc6ae6 100644
--- a/chromium/content/common/cursors/webcursor_unittest.cc
+++ b/chromium/content/common/cursors/webcursor_unittest.cc
@@ -10,7 +10,7 @@
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/cursor/cursor.h"
 #include "ui/base/cursor/cursor_lookup.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
diff --git a/chromium/content/common/dom_automation_controller.mojom b/chromium/content/common/dom_automation_controller.mojom
new file mode 100644
index 00000000000..525fd5aaecc
--- /dev/null
+++ b/chromium/content/common/dom_automation_controller.mojom
@@ -0,0 +1,19 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+// Interface for receiving messages sent from the renderer to the browser via
+// the DOM Automation Controller (i.e., window.domAutomationController).
+// This interface is only used and made available in browser tests and is
+// controlled by switches::kDomAutomationController.
+interface DomAutomationControllerHost {
+  // Used to communicate a value received from JavaScript. An instance of the
+  // browser that has an automation host listening to it can have JavaScript
+  // send a native value (string, number, boolean) to the listener in
+  // C++ (DomAutomationController). For example,
+  // `window.domAutomationController.send(foo())` sends the result of foo()
+  // here.
+  DomOperationResponse(string json_string);
+};
\ No newline at end of file
diff --git a/chromium/content/common/edit_command.h b/chromium/content/common/edit_command.h
deleted file mode 100644
index d7c3032380b..00000000000
--- a/chromium/content/common/edit_command.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_EDIT_COMMAND_H_
-#define CONTENT_COMMON_EDIT_COMMAND_H_
-
-#include <string>
-#include <vector>
-
-namespace content {
-
-// Types related to sending edit commands to the renderer.
-struct EditCommand {
-  EditCommand() { }
-  EditCommand(const std::string& n, const std::string& v)
-      : name(n), value(v) {
-  }
-
-  std::string name;
-  std::string value;
-};
-
-typedef std::vector<EditCommand> EditCommands;
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_EDIT_COMMAND_H_
diff --git a/chromium/content/common/fetch/fetch_api_request.proto b/chromium/content/common/fetch/fetch_api_request.proto
index 4d41127e95d..051f8c8e8f6 100644
--- a/chromium/content/common/fetch/fetch_api_request.proto
+++ b/chromium/content/common/fetch/fetch_api_request.proto
@@ -31,7 +31,7 @@ message FetchAPIRequest {
   // Other params.
   optional int32 mode = 6;  // network::mojom::FetchRequestMode.
   optional bool is_main_resource_load = 7;
-  optional int32 request_context_type = 8;  // content::RequestContextType.
+  reserved 8;  // Obsolete: used to be request_context_type.
   optional int32 credentials_mode = 9;  // network::mojom::FetchCredentialsMode.
   optional int32 cache_mode = 10;       // blink::mojom::FetchCacheMode.
   optional int32 redirect_mode = 11;    // network::mojom::FetchRedirectMode.
diff --git a/chromium/content/common/fetch/fetch_api_request_proto.cc b/chromium/content/common/fetch/fetch_api_request_proto.cc
index 669d8dd02de..2e542816ad9 100644
--- a/chromium/content/common/fetch/fetch_api_request_proto.cc
+++ b/chromium/content/common/fetch/fetch_api_request_proto.cc
@@ -23,8 +23,6 @@ std::string SerializeFetchRequestToString(
   request_proto.set_is_reload(request.is_reload);
   request_proto.set_mode(static_cast<int>(request.mode));
   request_proto.set_is_main_resource_load(request.is_main_resource_load);
-  request_proto.set_request_context_type(
-      static_cast<int>(request.request_context_type));
   request_proto.set_credentials_mode(
       static_cast<int>(request.credentials_mode));
   request_proto.set_cache_mode(static_cast<int>(request.cache_mode));
@@ -47,9 +45,6 @@ blink::mojom::FetchAPIRequestPtr DeserializeFetchRequestFromString(
   request_ptr->mode =
       static_cast<network::mojom::RequestMode>(request_proto.mode());
   request_ptr->is_main_resource_load = request_proto.is_main_resource_load();
-  request_ptr->request_context_type =
-      static_cast<blink::mojom::RequestContextType>(
-          request_proto.request_context_type());
   request_ptr->frame_type = blink::mojom::RequestContextFrameType::kNone;
   request_ptr->url = GURL(request_proto.url());
   request_ptr->method = request_proto.method();
diff --git a/chromium/content/common/fetch/fetch_api_request_proto_unittest.cc b/chromium/content/common/fetch/fetch_api_request_proto_unittest.cc
index df8f0c77969..46ee34f736b 100644
--- a/chromium/content/common/fetch/fetch_api_request_proto_unittest.cc
+++ b/chromium/content/common/fetch/fetch_api_request_proto_unittest.cc
@@ -12,7 +12,6 @@ TEST(FetchAPIRequestProtoTest, SerialiazeDeserializeRoundTrip) {
   auto request = blink::mojom::FetchAPIRequest::New();
   request->mode = network::mojom::RequestMode::kSameOrigin;
   request->is_main_resource_load = true;
-  request->request_context_type = blink::mojom::RequestContextType::IFRAME;
   request->url = GURL("foo.com");
   request->method = "GET";
   request->headers = {{"User-Agent", "Chrome"}};
diff --git a/chromium/content/common/fetch/fetch_request_type_converters.cc b/chromium/content/common/fetch/fetch_request_type_converters.cc
index e71b8afb7e3..9923dd396ac 100644
--- a/chromium/content/common/fetch/fetch_request_type_converters.cc
+++ b/chromium/content/common/fetch/fetch_request_type_converters.cc
@@ -38,8 +38,6 @@ blink::mojom::FetchAPIRequestPtr TypeConverter<
   output->cache_mode =
       content::ServiceWorkerUtils::GetCacheModeFromLoadFlags(input.load_flags);
   output->redirect_mode = input.redirect_mode;
-  output->request_context_type = static_cast<blink::mojom::RequestContextType>(
-      input.fetch_request_context_type);
   output->destination =
       static_cast<network::mojom::RequestDestination>(input.destination);
   output->is_reload = ui::PageTransitionCoreTypeIs(
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index edf716bca26..5dfb74713e4 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -18,6 +18,7 @@ import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "mojo/public/mojom/base/values.mojom";
 import "services/network/public/mojom/content_security_policy.mojom";
+import "services/network/public/mojom/web_sandbox_flags.mojom";
 import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/network/public/mojom/url_response_head.mojom";
@@ -179,7 +180,10 @@ interface FrameNavigationControl {
   // Request for the renderer to execute JavaScript in the frame's context.
   //
   // |javascript| is the string containing the JavaScript to be executed in the
-  // target frame's context.
+  // target frame's context. Note that this uses BigString16 rather than
+  // String16 as this is used in contexts, like DevTools, where the contents of
+  // the JavaScript script is user-provided, and therefore we can't guarantee
+  // the size of the script.
   //
   // |wants_result| is true if the result of this execution is required by the
   // caller. If it is false, a reply is still required by Mojo, but a null value
@@ -189,14 +193,14 @@ interface FrameNavigationControl {
   // order with other navigation-related messages. Fix this and move this to a
   // non-navigate-related interface if possible.
   JavaScriptExecuteRequest(
-      mojo_base.mojom.String16 javascript,
+      mojo_base.mojom.BigString16 javascript,
       bool wants_result) => (mojo_base.mojom.Value result);
 
   // ONLY FOR TESTS: Same as above but this can optionally trigger a fake user
   // activation notification to test functionalities that are gated by user
   // activation.
   JavaScriptExecuteRequestForTests(
-      mojo_base.mojom.String16 javascript,
+      mojo_base.mojom.BigString16 javascript,
       bool wants_result,
       bool has_user_gesture,
       int32 world_id)
@@ -205,25 +209,10 @@ interface FrameNavigationControl {
   // Same as JavaScriptExecuteRequest above except the script is run in the
   // isolated world specified by the fourth parameter.
   JavaScriptExecuteRequestInIsolatedWorld(
-      mojo_base.mojom.String16 javascript,
+      mojo_base.mojom.BigString16 javascript,
       bool wants_result,
       int32 world_id) => (mojo_base.mojom.Value result);
 
-  // Posts a message from a frame in another process to the current renderer.
-  // |source_routing_id| is the routing ID of the source frame in the source
-  // process when sent to the browser. The browser replaces it with the routing
-  // ID of the equivalent frame proxy in the destination process.
-  // |source_origin| is the origin of the source frame when the message was
-  // sent, and |target_origin| specifies what the origin of the target frame
-  // must be for the message to be dispatched. An empty string allows the
-  // message to be dispatched to any origin.
-  // |message| is the encoded data, and any extra properties such as
-  // transferred ports or blobs.
-  PostMessageEvent(int32 source_routing_id,
-                   mojo_base.mojom.String16 source_origin,
-                   mojo_base.mojom.String16 target_origin,
-                   blink.mojom.TransferableMessage message);
-
   // Forwards a message from a portal's host to the main frame in the portal's
   // guest contents.
   ForwardMessageFromHost(blink.mojom.TransferableMessage message,
@@ -243,6 +232,15 @@ interface FrameNavigationControl {
       pending_associated_receiver<blink.mojom.PortalClient> portal_client,
       blink.mojom.TransferableMessage data)
       => (blink.mojom.PortalActivateResult result);
+
+  // Requests that a provisional RenderFrame swap itself into the frame tree,
+  // replacing the RenderFrameProxy that it is associated with. This is used
+  // with remote-to-local frame navigations when the RenderFrameProxy
+  // corresponds to a non-live (crashed) frame. In that case, the browser
+  // process will send this message as part of an early commit to stop showing
+  // the sad iframe without waiting for the provisional RenderFrame's navigation
+  // to commit.
+  SwapIn();
 };
 
 // Implemented by the frame (e.g. renderer processes).
@@ -325,6 +323,9 @@ struct CreateNewWindowReply {
   // The ID of the main frame hosted in the view.
   int32 main_frame_route_id;
 
+  // The unique identifier of the RenderFrameHost
+  mojo_base.mojom.UnguessableToken main_frame_frame_token;
+
   // The ID of the widget for the main frame.
   int32 main_frame_widget_route_id;
 
@@ -370,26 +371,36 @@ interface FrameHost {
 
   // Sent by the renderer process to request the creation of a new portal.
   // |portal| is the pipe to be used for the Portal object, |client| is the pipe
-  // used to communicate back with the caller. Returns |proxy_routing_id|, which
-  // is the routing id of the RenderFrameProxy, |initial_replicated_state|, the
-  // replicated state associated with that RenderFrameProxy, and |portal_token|,
-  // which is the unique identifier for the portal.
+  // used to communicate back with the caller. Returns:
+  // |proxy_routing_id| - the routing id of the RenderFrameProxy
+  // |initial_replicated_state| - the replicated state associated with that
+  //                              RenderFrameProxy
+  // |portal_token| - the unique identifier for the portal
+  // |frame_token| - the unique identifier of the RenderFrameProxy
+  // |devtools_frame_token| - the unique identifier of the frame node in the
+  //                          frame tree
   [Sync] CreatePortal(
       pending_associated_receiver<blink.mojom.Portal> portal,
       pending_associated_remote<blink.mojom.PortalClient> client)
       => (int32 proxy_routing_id,
           FrameReplicationState initial_replicated_state,
           mojo_base.mojom.UnguessableToken portal_token,
+          mojo_base.mojom.UnguessableToken frame_token,
           mojo_base.mojom.UnguessableToken devtools_frame_token);
 
   // Requests that this frame adopts the portal identified by |portal_token|.
-  // Returns |proxy_routing_id|, which is the routing id of the portal's
-  // RenderFrameProxy, |replicated_state|, the replicated state associated with
-  // that RFP, and the |devtools_frame_token|.
+  // Returns:
+  // |proxy_routing_id| - the routing id of the portal's RenderFrameProxy
+  // |replicated_state| - the replicated state associated with that
+  //                      RenderFrameProxy
+  // |frame_token| - the unique identifier of the RenderFrameProxy
+  // |devtools_frame_token| - the unique identifier of the frame node in the
+  //                          frame tree
   [Sync] AdoptPortal(mojo_base.mojom.UnguessableToken portal_token)
       => (int32 proxy_routing_id,
           viz.mojom.FrameSinkId frame_sink_id,
           FrameReplicationState replicated_state,
+          mojo_base.mojom.UnguessableToken frame_token,
           mojo_base.mojom.UnguessableToken devtools_frame_token);
 
 
@@ -473,7 +484,7 @@ interface FrameHost {
   // |feature_policy_header| is a list of an origin whitelist for each feature
   // in the policy.
   DidSetFramePolicyHeaders(
-      blink.mojom.WebSandboxFlags sandbox_flags,
+      network.mojom.WebSandboxFlags sandbox_flags,
       array<blink.mojom.ParsedFeaturePolicyDeclaration> feature_policy_header,
       map<blink.mojom.DocumentPolicyFeature, blink.mojom.PolicyValue>
         document_policy_header);
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index 118765f9323..bec2919abc9 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -31,6 +31,7 @@
 #include "content/common/savable_subframe.h"
 #include "content/public/common/common_param_traits.h"
 #include "content/public/common/frame_navigate_params.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/navigation_policy.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/previews_state.h"
@@ -47,7 +48,6 @@
 #include "services/network/public/mojom/content_security_policy.mojom.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
@@ -56,11 +56,14 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/feature_policy/document_policy_feature.mojom.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-shared.h"
 #include "third_party/blink/public/mojom/feature_policy/policy_disposition.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
@@ -68,9 +71,8 @@
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
-#include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
+#include "third_party/blink/public/platform/web_float_size.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/rect_f.h"
 #include "ui/gfx/ipc/gfx_param_traits.h"
@@ -100,8 +102,8 @@ using FrameMsg_GetSerializedHtmlWithLocalLinks_FrameRoutingIdMap =
 #define IPC_MESSAGE_START FrameMsgStart
 IPC_ENUM_TRAITS_MAX_VALUE(content::FrameDeleteIntention,
                           content::FrameDeleteIntention::kMaxValue)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::FrameOwnerElementType,
-                          blink::FrameOwnerElementType::kMaxValue)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::FrameOwnerElementType,
+                          blink::mojom::FrameOwnerElementType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::AdFrameType,
                           blink::mojom::AdFrameType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::ContextMenuDataMediaType,
@@ -114,9 +116,9 @@ IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::ScrollbarMode,
                           blink::mojom::ScrollbarMode::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(content::StopFindAction,
                           content::STOP_FIND_ACTION_LAST)
-IPC_ENUM_TRAITS(blink::mojom::WebSandboxFlags)  // Bitmask
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTreeScopeType,
-                          blink::WebTreeScopeType::kMaxValue)
+IPC_ENUM_TRAITS(network::mojom::WebSandboxFlags)  // Bitmask.
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::TreeScopeType,
+                          blink::mojom::TreeScopeType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(ui::MenuSourceType, ui::MENU_SOURCE_TYPE_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(network::mojom::CSPDirectiveName,
                           network::mojom::CSPDirectiveName::kMaxValue)
@@ -148,18 +150,18 @@ IPC_STRUCT_TRAITS_BEGIN(content::NavigationDownloadPolicy)
   IPC_STRUCT_TRAITS_MEMBER(blocking_downloads_in_sandbox_enabled)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::Impression)
+  IPC_STRUCT_TRAITS_MEMBER(conversion_destination)
+  IPC_STRUCT_TRAITS_MEMBER(reporting_origin)
+  IPC_STRUCT_TRAITS_MEMBER(impression_data)
+  IPC_STRUCT_TRAITS_MEMBER(expiry)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(blink::WebFloatSize)
   IPC_STRUCT_TRAITS_MEMBER(width)
   IPC_STRUCT_TRAITS_MEMBER(height)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebIntrinsicSizingInfo)
-  IPC_STRUCT_TRAITS_MEMBER(size)
-  IPC_STRUCT_TRAITS_MEMBER(aspect_ratio)
-  IPC_STRUCT_TRAITS_MEMBER(has_width)
-  IPC_STRUCT_TRAITS_MEMBER(has_height)
-IPC_STRUCT_TRAITS_END()
-
 IPC_STRUCT_TRAITS_BEGIN(content::UntrustworthyContextMenuParams)
   IPC_STRUCT_TRAITS_MEMBER(media_type)
   IPC_STRUCT_TRAITS_MEMBER(x)
@@ -373,7 +375,7 @@ IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::ParsedFeaturePolicyDeclaration)
   IPC_STRUCT_TRAITS_MEMBER(feature)
-  IPC_STRUCT_TRAITS_MEMBER(values)
+  IPC_STRUCT_TRAITS_MEMBER(allowed_origins)
   IPC_STRUCT_TRAITS_MEMBER(fallback_value)
   IPC_STRUCT_TRAITS_MEMBER(opaque_value)
 IPC_STRUCT_TRAITS_END()
@@ -403,6 +405,7 @@ IPC_STRUCT_TRAITS_END()
 IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(GURL, url)
   IPC_STRUCT_MEMBER(url::Origin, initiator_origin)
+  IPC_STRUCT_MEMBER(int32_t, initiator_routing_id)
   IPC_STRUCT_MEMBER(scoped_refptr<network::ResourceRequestBody>, post_body)
   IPC_STRUCT_MEMBER(std::string, extra_headers)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
@@ -412,6 +415,7 @@ IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(blink::TriggeringEventInfo, triggering_event_info)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
   IPC_STRUCT_MEMBER(std::string, href_translate)
+  IPC_STRUCT_MEMBER(base::Optional<content::Impression>, impression)
   IPC_STRUCT_MEMBER(content::NavigationDownloadPolicy, download_policy)
 IPC_STRUCT_END()
 
@@ -422,19 +426,21 @@ IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_CreateChildFrame_Params)
   IPC_STRUCT_MEMBER(int32_t, parent_routing_id)
-  IPC_STRUCT_MEMBER(blink::WebTreeScopeType, scope)
+  IPC_STRUCT_MEMBER(blink::mojom::TreeScopeType, scope)
   IPC_STRUCT_MEMBER(std::string, frame_name)
   IPC_STRUCT_MEMBER(std::string, frame_unique_name)
   IPC_STRUCT_MEMBER(bool, is_created_by_script)
   IPC_STRUCT_MEMBER(blink::FramePolicy, frame_policy)
   IPC_STRUCT_MEMBER(blink::mojom::FrameOwnerProperties, frame_owner_properties)
-  IPC_STRUCT_MEMBER(blink::FrameOwnerElementType, frame_owner_element_type)
+  IPC_STRUCT_MEMBER(blink::mojom::FrameOwnerElementType,
+                    frame_owner_element_type)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_CreateChildFrame_Params_Reply)
   IPC_STRUCT_MEMBER(int32_t, child_routing_id)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, new_interface_provider)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, browser_interface_broker_handle)
+  IPC_STRUCT_MEMBER(base::UnguessableToken, frame_token)
   IPC_STRUCT_MEMBER(base::UnguessableToken, devtools_frame_token)
 IPC_STRUCT_END()
 
@@ -454,33 +460,6 @@ IPC_STRUCT_BEGIN(FrameMsg_MixedContentFound_Params)
   IPC_STRUCT_MEMBER(network::mojom::SourceLocation, source_location)
 IPC_STRUCT_END()
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-// This message is used for supporting popup menus on Mac OS X and Android using
-// native controls. See the FrameHostMsg_ShowPopup message.
-IPC_STRUCT_BEGIN(FrameHostMsg_ShowPopup_Params)
-  // Position on the screen.
-  IPC_STRUCT_MEMBER(gfx::Rect, bounds)
-
-  // The height of each item in the menu.
-  IPC_STRUCT_MEMBER(int, item_height)
-
-  // The size of the font to use for those items.
-  IPC_STRUCT_MEMBER(double, item_font_size)
-
-  // The currently selected (displayed) item in the menu.
-  IPC_STRUCT_MEMBER(int, selected_item)
-
-  // The entire list of items in the popup menu.
-  IPC_STRUCT_MEMBER(std::vector<content::MenuItem>, popup_items)
-
-  // Whether items should be right-aligned.
-  IPC_STRUCT_MEMBER(bool, right_aligned)
-
-  // Whether this is a multi-select popup.
-  IPC_STRUCT_MEMBER(bool, allow_multiple_selection)
-IPC_STRUCT_END()
-#endif
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 IPC_STRUCT_TRAITS_BEGIN(content::PepperRendererInstanceData)
   IPC_STRUCT_TRAITS_MEMBER(render_process_id)
@@ -513,17 +492,6 @@ IPC_MESSAGE_ROUTED1(FrameMsg_UpdateOpener, int /* opener_routing_id */)
 // commit, activation and frame swap of the current DOM tree in blink.
 IPC_MESSAGE_ROUTED1(FrameMsg_VisualStateRequest, uint64_t /* id */)
 
-// Requests that a provisional RenderFrame swap itself into the frame tree,
-// replacing the RenderFrameProxy that it is associated with.  This is used
-// with remote-to-local frame navigations when the RenderFrameProxy corresponds
-// to a non-live (crashed) frame.  In that case, the browser process will send
-// this message as part of an early commit to stop showing the sad iframe
-// without waiting for the provisional RenderFrame's navigation to commit.
-IPC_MESSAGE_ROUTED0(FrameMsg_SwapIn)
-
-// Instructs the frame to stop the load in progress, if any.
-IPC_MESSAGE_ROUTED0(FrameMsg_Stop)
-
 // TODO(https://crbug.com/995428): Deprecated.
 // Tells the renderer to reload the frame.
 IPC_MESSAGE_ROUTED0(FrameMsg_Reload)
@@ -534,17 +502,6 @@ IPC_MESSAGE_ROUTED2(FrameMsg_DidUpdateName,
                     std::string /* name */,
                     std::string /* unique_name */)
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-IPC_MESSAGE_ROUTED1(FrameMsg_SelectPopupMenuItem,
-                    int /* selected index, -1 means no selection */)
-#else
-IPC_MESSAGE_ROUTED2(FrameMsg_SelectPopupMenuItems,
-                    bool /* user canceled the popup */,
-                    std::vector<int> /* selected indices */)
-#endif
-#endif
-
 // Request to enumerate and return links to all savable resources in the frame
 // Note: this covers only the immediate frame / doesn't cover subframes.
 IPC_MESSAGE_ROUTED0(FrameMsg_GetSavableResourceLinks)
@@ -556,18 +513,10 @@ IPC_MESSAGE_ROUTED3(FrameMsg_GetSerializedHtmlWithLocalLinks,
                     FrameMsg_GetSerializedHtmlWithLocalLinks_FrameRoutingIdMap,
                     bool /* save_with_empty_url */)
 
-// Request to continue running the sequential focus navigation algorithm in
-// this frame.  |source_routing_id| identifies the frame that issued this
-// request.  This message is sent when pressing <tab> or <shift-tab> needs to
-// find the next focusable element in a cross-process frame.
-IPC_MESSAGE_ROUTED2(FrameMsg_AdvanceFocus,
-                    blink::mojom::FocusType /* type */,
-                    int32_t /* source_routing_id */)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
-// Notifies the renderer of updates to the Plugin Power Saver origin whitelist.
-IPC_MESSAGE_ROUTED1(FrameMsg_UpdatePluginContentOriginWhitelist,
-                    std::set<url::Origin> /* origin_whitelist */)
+// Notifies the renderer of updates to the Plugin Power Saver origin allowlist.
+IPC_MESSAGE_ROUTED1(FrameMsg_UpdatePluginContentOriginAllowlist,
+                    std::set<url::Origin> /* origin_allowlist */)
 
 // This message notifies that the frame that the volume of the Pepper instance
 // for |pp_instance| should be changed to |volume|.
@@ -629,21 +578,6 @@ IPC_MESSAGE_ROUTED2(
     int32_t /* subframe_routing_id */,
     blink::FramePolicy /* updated sandbox flags and container policy */)
 
-// Notifies the browser that frame owner properties have changed for a subframe
-// of this frame.
-IPC_MESSAGE_ROUTED2(
-    FrameHostMsg_DidChangeFrameOwnerProperties,
-    int32_t /* subframe_routing_id */,
-    blink::mojom::FrameOwnerProperties /* frame_owner_properties */)
-
-// Following message is used to communicate the values received by the
-// callback binding the JS to Cpp.
-// An instance of browser that has an automation host listening to it can
-// have a javascript send a native value (string, number, boolean) to the
-// listener in Cpp. (DomAutomationController)
-IPC_MESSAGE_ROUTED1(FrameHostMsg_DomOperationResponse,
-                    std::string  /* json_string */)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 // Notification sent from a renderer to the browser that a Pepper plugin
 // instance is created in the DOM.
@@ -828,16 +762,6 @@ IPC_SYNC_MESSAGE_ROUTED1_2(FrameHostMsg_RunBeforeUnloadConfirm,
                            bool /* out - success */,
                            base::string16 /* out - This is ignored.*/)
 
-// Sent when the renderer loads a resource from its memory cache.
-// The security info is non empty if the resource was originally loaded over
-// a secure connection.
-// Note: May only be sent once per URL per frame per committed load.
-IPC_MESSAGE_ROUTED4(FrameHostMsg_DidLoadResourceFromMemoryCache,
-                    GURL /* url */,
-                    std::string /* http method */,
-                    std::string /* mime type */,
-                    network::mojom::RequestDestination)
-
 // Sent as a response to FrameMsg_VisualStateRequest.
 // The message is delivered using RenderWidget::QueueMessage.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_VisualStateResponse, uint64_t /* id */)
@@ -904,15 +828,6 @@ IPC_MESSAGE_ROUTED2(FrameHostMsg_PrintCrossProcessSubframe,
                     gfx::Rect /* rect area of the frame content */,
                     int /* rendered document cookie */)
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-
-// Message to show/hide a popup menu using native controls.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_ShowPopup,
-                    FrameHostMsg_ShowPopup_Params)
-IPC_MESSAGE_ROUTED0(FrameHostMsg_HidePopup)
-
-#endif
-
 // Adding a new message? Stick to the sort order above: first platform
 // independent FrameMsg, then ifdefs for platform specific FrameMsg, then
 // platform independent FrameHostMsg, then ifdefs for platform specific
diff --git a/chromium/content/common/frame_replication_state.cc b/chromium/content/common/frame_replication_state.cc
index abae9b0b53d..91b740a9adf 100644
--- a/chromium/content/common/frame_replication_state.cc
+++ b/chromium/content/common/frame_replication_state.cc
@@ -4,15 +4,15 @@
 
 #include "content/common/frame_replication_state.h"
 
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
+#include "third_party/blink/public/mojom/frame/tree_scope_type.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
-#include "third_party/blink/public/web/web_tree_scope_type.h"
 
 namespace content {
 
 FrameReplicationState::FrameReplicationState()
-    : active_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
-      scope(blink::WebTreeScopeType::kDocument),
+    : active_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
+      scope(blink::mojom::TreeScopeType::kDocument),
       insecure_request_policy(
           blink::mojom::InsecureRequestPolicy::kLeaveInsecureRequestsAlone),
       has_potentially_trustworthy_unique_origin(false),
@@ -20,7 +20,7 @@ FrameReplicationState::FrameReplicationState()
       has_received_user_gesture_before_nav(false) {}
 
 FrameReplicationState::FrameReplicationState(
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const std::string& name,
     const std::string& unique_name,
     blink::mojom::InsecureRequestPolicy insecure_request_policy,
@@ -28,11 +28,10 @@ FrameReplicationState::FrameReplicationState(
     bool has_potentially_trustworthy_unique_origin,
     bool has_received_user_gesture,
     bool has_received_user_gesture_before_nav,
-    blink::FrameOwnerElementType owner_type)
-    : origin(),
-      name(name),
+    blink::mojom::FrameOwnerElementType owner_type)
+    : name(name),
       unique_name(unique_name),
-      active_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
+      active_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       scope(scope),
       insecure_request_policy(insecure_request_policy),
       insecure_navigations_set(insecure_navigations_set),
diff --git a/chromium/content/common/frame_replication_state.h b/chromium/content/common/frame_replication_state.h
index 98226da4dc2..31391e27b13 100644
--- a/chromium/content/common/frame_replication_state.h
+++ b/chromium/content/common/frame_replication_state.h
@@ -11,15 +11,16 @@
 #include "content/common/content_export.h"
 #include "services/network/public/mojom/content_security_policy.mojom.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-shared.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-forward.h"
 #include "url/origin.h"
 
 namespace blink {
-enum class WebTreeScopeType;
-enum class WebSandboxFlags;
+namespace mojom {
+enum class TreeScopeType;
+}
 }
 
 namespace content {
@@ -29,7 +30,7 @@ namespace content {
 struct CONTENT_EXPORT FrameReplicationState {
   FrameReplicationState();
   FrameReplicationState(
-      blink::WebTreeScopeType scope,
+      blink::mojom::TreeScopeType scope,
       const std::string& name,
       const std::string& unique_name,
       blink::mojom::InsecureRequestPolicy insecure_request_policy,
@@ -37,7 +38,7 @@ struct CONTENT_EXPORT FrameReplicationState {
       bool has_potentially_trustworthy_unique_origin,
       bool has_received_user_gesture,
       bool has_received_user_gesture_before_nav,
-      blink::FrameOwnerElementType owner_type);
+      blink::mojom::FrameOwnerElementType owner_type);
   FrameReplicationState(const FrameReplicationState& other);
   ~FrameReplicationState();
 
@@ -86,7 +87,7 @@ struct CONTENT_EXPORT FrameReplicationState {
   // inherited from parent frames, the currently active flags from the <iframe>
   // element hosting this frame, as well as any flags set from a
   // Content-Security-Policy HTTP header.
-  blink::mojom::WebSandboxFlags active_sandbox_flags;
+  network::mojom::WebSandboxFlags active_sandbox_flags;
 
   // Iframe sandbox flags and container policy currently in effect for the
   // frame. Container policy may be empty if this is the top-level frame.
@@ -119,7 +120,7 @@ struct CONTENT_EXPORT FrameReplicationState {
   // created. However, making it const makes it a pain to embed into IPC message
   // params: having a const member implicitly deletes the copy assignment
   // operator.
-  blink::WebTreeScopeType scope;
+  blink::mojom::TreeScopeType scope;
 
   // The insecure request policy that a frame's current document is enforcing.
   // Updates are immediately sent to all frame proxies when frames live in
@@ -148,8 +149,8 @@ struct CONTENT_EXPORT FrameReplicationState {
   // created. However, making it const makes it a pain to embed into IPC message
   // params: having a const member implicitly deletes the copy assignment
   // operator.
-  blink::FrameOwnerElementType frame_owner_element_type =
-      blink::FrameOwnerElementType::kNone;
+  blink::mojom::FrameOwnerElementType frame_owner_element_type =
+      blink::mojom::FrameOwnerElementType::kNone;
 
   // Whether this frame is an ad frame. Once a frame becomes an ad, it stays as
   // an ad throughout its lifetime, even if it later navigates to a non-ad
diff --git a/chromium/content/common/input/actions_parser.cc b/chromium/content/common/input/actions_parser.cc
index b4d6b56120d..7438101a20c 100644
--- a/chromium/content/common/input/actions_parser.cc
+++ b/chromium/content/common/input/actions_parser.cc
@@ -17,7 +17,7 @@ namespace content {
 namespace {
 
 SyntheticPointerActionParams::PointerActionType ToSyntheticPointerActionType(
-    std::string action_type) {
+    const std::string& action_type) {
   if (action_type == "pointerDown")
     return SyntheticPointerActionParams::PointerActionType::PRESS;
   if (action_type == "pointerMove")
@@ -32,15 +32,14 @@ SyntheticPointerActionParams::PointerActionType ToSyntheticPointerActionType(
 }
 
 SyntheticGestureParams::GestureSourceType ToSyntheticGestureSourceType(
-    std::string pointer_type) {
+    const std::string& pointer_type) {
   if (pointer_type == "touch")
     return SyntheticGestureParams::TOUCH_INPUT;
   else if (pointer_type == "mouse")
     return SyntheticGestureParams::MOUSE_INPUT;
   else if (pointer_type == "pen")
     return SyntheticGestureParams::PEN_INPUT;
-  else
-    return SyntheticGestureParams::DEFAULT_INPUT;
+  return SyntheticGestureParams::DEFAULT_INPUT;
 }
 
 SyntheticPointerActionParams::Button ToSyntheticMouseButton(int button) {
@@ -58,7 +57,7 @@ SyntheticPointerActionParams::Button ToSyntheticMouseButton(int button) {
   return SyntheticPointerActionParams::Button();
 }
 
-int ToKeyModifiers(std::string key) {
+int ToKeyModifiers(const std::string& key) {
   if (key == "Alt")
     return blink::WebInputEvent::kAltKey;
   if (key == "Control")
diff --git a/chromium/content/common/input/actions_parser.h b/chromium/content/common/input/actions_parser.h
index 90a55b130b8..4894ac69584 100644
--- a/chromium/content/common/input/actions_parser.h
+++ b/chromium/content/common/input/actions_parser.h
@@ -25,7 +25,7 @@ class CONTENT_EXPORT ActionsParser {
   explicit ActionsParser(base::Value value);
   ~ActionsParser();
   bool ParsePointerActionSequence();
-  std::string error_message() { return error_message_; }
+  const std::string& error_message() const { return error_message_; }
   const SyntheticPointerActionListParams& gesture_params() const {
     return gesture_params_;
   }
diff --git a/chromium/content/common/input/event_with_latency_info.h b/chromium/content/common/input/event_with_latency_info.h
index 58e8b8ca2de..c90359968a6 100644
--- a/chromium/content/common/input/event_with_latency_info.h
+++ b/chromium/content/common/input/event_with_latency_info.h
@@ -41,7 +41,7 @@ class EventWithLatencyInfo {
     if (other.event.GetType() != event.GetType())
       return false;
 
-    return ui::CanCoalesce(other.event, event);
+    return event.CanCoalesce(other.event);
   }
 
   void CoalesceWith(const EventWithLatencyInfo& other) {
@@ -52,7 +52,7 @@ class EventWithLatencyInfo {
     // New events get coalesced into older events, and the newer timestamp
     // should always be preserved.
     const base::TimeTicks time_stamp = other.event.TimeStamp();
-    ui::Coalesce(other.event, &event);
+    event.Coalesce(other.event);
     event.SetTimeStamp(time_stamp);
 
     // When coalescing two input events, we keep the oldest LatencyInfo
diff --git a/chromium/content/common/input/event_with_latency_info_unittest.cc b/chromium/content/common/input/event_with_latency_info_unittest.cc
index 006e05e1e88..c676918c72a 100644
--- a/chromium/content/common/input/event_with_latency_info_unittest.cc
+++ b/chromium/content/common/input/event_with_latency_info_unittest.cc
@@ -47,7 +47,7 @@ MouseWheelEventWithLatencyInfo CreateMouseWheelEvent(
     float deltaY = 0.0f,
     int modifiers = WebInputEvent::kNoModifiers) {
   MouseWheelEventWithLatencyInfo mouse_wheel(
-      WebInputEvent::kMouseWheel, modifiers,
+      WebInputEvent::Type::kMouseWheel, modifiers,
       base::TimeTicks() + base::TimeDelta::FromSecondsD(timestamp),
       ui::LatencyInfo());
   mouse_wheel.event.delta_x = deltaX;
@@ -69,9 +69,9 @@ GestureEventWithLatencyInfo CreateGestureEvent(WebInputEvent::Type type,
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForMouseEvent) {
   MouseEventWithLatencyInfo mouse_0 =
-      CreateMouseEvent(WebInputEvent::kMouseMove, 5.0);
+      CreateMouseEvent(WebInputEvent::Type::kMouseMove, 5.0);
   MouseEventWithLatencyInfo mouse_1 =
-      CreateMouseEvent(WebInputEvent::kMouseMove, 10.0);
+      CreateMouseEvent(WebInputEvent::Type::kMouseMove, 10.0);
 
   ASSERT_TRUE(mouse_0.CanCoalesceWith(mouse_1));
   mouse_0.CoalesceWith(mouse_1);
@@ -91,9 +91,9 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForMouseWheelEvent) {
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForTouchEvent) {
   TouchEventWithLatencyInfo touch_0 =
-      CreateTouchEvent(WebInputEvent::kTouchMove, 5.0);
+      CreateTouchEvent(WebInputEvent::Type::kTouchMove, 5.0);
   TouchEventWithLatencyInfo touch_1 =
-      CreateTouchEvent(WebInputEvent::kTouchMove, 10.0);
+      CreateTouchEvent(WebInputEvent::Type::kTouchMove, 10.0);
 
   ASSERT_TRUE(touch_0.CanCoalesceWith(touch_1));
   touch_0.CoalesceWith(touch_1);
@@ -103,9 +103,9 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForTouchEvent) {
 
 TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForGestureEvent) {
   GestureEventWithLatencyInfo scroll_0 =
-      CreateGestureEvent(WebInputEvent::kGestureScrollUpdate, 5.0);
+      CreateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate, 5.0);
   GestureEventWithLatencyInfo scroll_1 =
-      CreateGestureEvent(WebInputEvent::kGestureScrollUpdate, 10.0);
+      CreateGestureEvent(WebInputEvent::Type::kGestureScrollUpdate, 10.0);
 
   ASSERT_TRUE(scroll_0.CanCoalesceWith(scroll_1));
   scroll_0.CoalesceWith(scroll_1);
@@ -115,11 +115,11 @@ TEST_F(EventWithLatencyInfoTest, TimestampCoalescingForGestureEvent) {
 
 TEST_F(EventWithLatencyInfoTest, LatencyInfoCoalescing) {
   MouseEventWithLatencyInfo mouse_0 =
-      CreateMouseEvent(WebInputEvent::kMouseMove, 5.0);
+      CreateMouseEvent(WebInputEvent::Type::kMouseMove, 5.0);
   mouse_0.latency.AddLatencyNumberWithTimestamp(
       ui::INPUT_EVENT_LATENCY_ORIGINAL_COMPONENT, base::TimeTicks());
   MouseEventWithLatencyInfo mouse_1 =
-      CreateMouseEvent(WebInputEvent::kMouseMove, 10.0);
+      CreateMouseEvent(WebInputEvent::Type::kMouseMove, 10.0);
 
   ASSERT_TRUE(mouse_0.CanCoalesceWith(mouse_1));
 
@@ -166,8 +166,10 @@ void Coalesce(const T& event_to_coalesce, T* event) {
 }
 
 TEST_F(EventWithLatencyInfoTest, TouchEventCoalescing) {
-  TouchEventWithLatencyInfo touch0 = CreateTouch(WebInputEvent::kTouchStart);
-  TouchEventWithLatencyInfo touch1 = CreateTouch(WebInputEvent::kTouchMove);
+  TouchEventWithLatencyInfo touch0 =
+      CreateTouch(WebInputEvent::Type::kTouchStart);
+  TouchEventWithLatencyInfo touch1 =
+      CreateTouch(WebInputEvent::Type::kTouchMove);
 
   // Non touch-moves won't coalesce.
   EXPECT_FALSE(CanCoalesce(touch0, touch0));
@@ -179,78 +181,81 @@ TEST_F(EventWithLatencyInfoTest, TouchEventCoalescing) {
   EXPECT_TRUE(CanCoalesce(touch1, touch1));
 
   // Touch moves with different touch ids should not coalesce.
-  touch0 = CreateTouch(WebInputEvent::kTouchMove);
-  touch1 = CreateTouch(WebInputEvent::kTouchMove);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove);
   touch0.event.touches[0].id = 7;
   EXPECT_FALSE(CanCoalesce(touch0, touch1));
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 2);
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch0.event.touches[0].id = 1;
   touch1.event.touches[0].id = 0;
   EXPECT_FALSE(CanCoalesce(touch0, touch1));
 
   // Touch moves with different touch lengths should not coalesce.
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 1);
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 1);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   EXPECT_FALSE(CanCoalesce(touch0, touch1));
 
   // Touch moves with identical touch ids in different orders should coalesce.
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 2);
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch0.event.touches[0] = touch1.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 1);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 1);
   touch0.event.touches[1] = touch1.event.touches[0] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 0);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 0);
   EXPECT_TRUE(CanCoalesce(touch0, touch1));
 
   // Pointers with the same ID's should coalesce.
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 2);
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch0.event.touches[0] = touch1.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 1);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 1);
   Coalesce(touch0, &touch1);
   ASSERT_EQ(1, touch1.event.touches[0].id);
   ASSERT_EQ(0, touch1.event.touches[1].id);
-  EXPECT_EQ(WebTouchPoint::kStateUndefined, touch1.event.touches[1].state);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, touch1.event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateUndefined,
+            touch1.event.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, touch1.event.touches[0].state);
 
   // Movement from now-stationary pointers should be preserved.
-  touch0 = touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
-  touch0.event.touches[0] = CreateTouchPoint(WebTouchPoint::kStateMoved, 1);
+  touch0 = touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
+  touch0.event.touches[0] =
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 1);
   touch1.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateStationary, 1);
+      CreateTouchPoint(WebTouchPoint::State::kStateStationary, 1);
   touch0.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateStationary, 0);
-  touch1.event.touches[0] = CreateTouchPoint(WebTouchPoint::kStateMoved, 0);
+      CreateTouchPoint(WebTouchPoint::State::kStateStationary, 0);
+  touch1.event.touches[0] =
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 0);
   Coalesce(touch0, &touch1);
   ASSERT_EQ(1, touch1.event.touches[0].id);
   ASSERT_EQ(0, touch1.event.touches[1].id);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, touch1.event.touches[0].state);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, touch1.event.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, touch1.event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, touch1.event.touches[1].state);
 
   // Touch moves with different dispatchTypes coalesce.
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch0.event.dispatch_type = WebInputEvent::DispatchType::kBlocking;
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch1.event.dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
   touch0.event.touches[0] = touch1.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 1);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 1);
   touch0.event.touches[1] = touch1.event.touches[0] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 0);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 0);
   EXPECT_TRUE(CanCoalesce(touch0, touch1));
   Coalesce(touch0, &touch1);
   ASSERT_EQ(WebInputEvent::DispatchType::kBlocking, touch1.event.dispatch_type);
 
-  touch0 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch0 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch0.event.dispatch_type =
       WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling;
-  touch1 = CreateTouch(WebInputEvent::kTouchMove, 2);
+  touch1 = CreateTouch(WebInputEvent::Type::kTouchMove, 2);
   touch1.event.dispatch_type =
       WebInputEvent::DispatchType::kListenersNonBlockingPassive;
   touch0.event.touches[0] = touch1.event.touches[1] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 1);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 1);
   touch0.event.touches[1] = touch1.event.touches[0] =
-      CreateTouchPoint(WebTouchPoint::kStateMoved, 0);
+      CreateTouchPoint(WebTouchPoint::State::kStateMoved, 0);
   EXPECT_TRUE(CanCoalesce(touch0, touch1));
   Coalesce(touch0, &touch1);
   ASSERT_EQ(WebInputEvent::DispatchType::kListenersNonBlockingPassive,
@@ -259,9 +264,9 @@ TEST_F(EventWithLatencyInfoTest, TouchEventCoalescing) {
 
 TEST_F(EventWithLatencyInfoTest, PinchEventCoalescing) {
   GestureEventWithLatencyInfo pinch0 =
-      CreateGesture(WebInputEvent::kGesturePinchBegin, 1, 1);
+      CreateGesture(WebInputEvent::Type::kGesturePinchBegin, 1, 1);
   GestureEventWithLatencyInfo pinch1 =
-      CreateGesture(WebInputEvent::kGesturePinchUpdate, 2, 2);
+      CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 2, 2);
 
   // Only GesturePinchUpdate's coalesce.
   EXPECT_FALSE(CanCoalesce(pinch0, pinch0));
@@ -270,15 +275,15 @@ TEST_F(EventWithLatencyInfoTest, PinchEventCoalescing) {
   EXPECT_FALSE(CanCoalesce(pinch0, pinch1));
 
   // Pinches with different focal points should not coalesce.
-  pinch0 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
-  pinch1 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 2, 2);
+  pinch0 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
+  pinch1 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 2, 2);
   EXPECT_FALSE(CanCoalesce(pinch0, pinch1));
   EXPECT_TRUE(CanCoalesce(pinch0, pinch0));
 
   // Coalesced scales are multiplicative.
-  pinch0 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch0 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch0.event.data.pinch_update.scale = 2.f;
-  pinch1 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch1 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch1.event.data.pinch_update.scale = 3.f;
   EXPECT_TRUE(CanCoalesce(pinch0, pinch0));
   Coalesce(pinch0, &pinch1);
@@ -286,18 +291,18 @@ TEST_F(EventWithLatencyInfoTest, PinchEventCoalescing) {
 
   // Scales have a minimum value and can never reach 0.
   ASSERT_GT(numeric_limits<float>::min(), 0);
-  pinch0 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch0 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch0.event.data.pinch_update.scale = numeric_limits<float>::min() * 2.0f;
-  pinch1 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch1 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch1.event.data.pinch_update.scale = numeric_limits<float>::min() * 5.0f;
   EXPECT_TRUE(CanCoalesce(pinch0, pinch1));
   Coalesce(pinch0, &pinch1);
   EXPECT_EQ(numeric_limits<float>::min(), pinch1.event.data.pinch_update.scale);
 
   // Scales have a maximum value and can never reach Infinity.
-  pinch0 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch0 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch0.event.data.pinch_update.scale = numeric_limits<float>::max() / 2.0f;
-  pinch1 = CreateGesture(WebInputEvent::kGesturePinchUpdate, 1, 1);
+  pinch1 = CreateGesture(WebInputEvent::Type::kGesturePinchUpdate, 1, 1);
   pinch1.event.data.pinch_update.scale = 10.0f;
   EXPECT_TRUE(CanCoalesce(pinch0, pinch1));
   Coalesce(pinch0, &pinch1);
diff --git a/chromium/content/common/input/gesture_event_stream_validator.cc b/chromium/content/common/input/gesture_event_stream_validator.cc
index 005970ca542..489b7d8dc47 100644
--- a/chromium/content/common/input/gesture_event_stream_validator.cc
+++ b/chromium/content/common/input/gesture_event_stream_validator.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/gesture_event_stream_validator.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/strings/stringprintf.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
@@ -31,18 +31,18 @@ bool GestureEventStreamValidator::Validate(
         "Invalid gesture type: %s", WebInputEvent::GetName(event.GetType())));
   }
   switch (event.GetType()) {
-    case WebInputEvent::kGestureScrollBegin:
+    case WebInputEvent::Type::kGestureScrollBegin:
       if (scrolling_)
         error_msg->append("Scroll begin during scroll\n");
       if (pinching_)
         error_msg->append("Scroll begin during pinch\n");
       scrolling_ = true;
       break;
-    case WebInputEvent::kGestureScrollUpdate:
+    case WebInputEvent::Type::kGestureScrollUpdate:
       if (!scrolling_)
         error_msg->append("Scroll update outside of scroll\n");
       break;
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       if (event.SourceDevice() == blink::WebGestureDevice::kTouchscreen &&
           !event.data.fling_start.velocity_x &&
           !event.data.fling_start.velocity_y) {
@@ -55,47 +55,47 @@ bool GestureEventStreamValidator::Validate(
       // Don't reset scrolling_ since the GSE sent by the fling_controller_ at
       // the end of the fling resets it.
       break;
-    case WebInputEvent::kGestureScrollEnd:
+    case WebInputEvent::Type::kGestureScrollEnd:
       if (!scrolling_)
         error_msg->append("Scroll end outside of scroll\n");
       if (pinching_)
         error_msg->append("Ending scroll while pinching\n");
       scrolling_ = false;
       break;
-    case WebInputEvent::kGesturePinchBegin:
+    case WebInputEvent::Type::kGesturePinchBegin:
       if (pinching_)
         error_msg->append("Pinch begin during pinch\n");
       pinching_ = true;
       break;
-    case WebInputEvent::kGesturePinchUpdate:
+    case WebInputEvent::Type::kGesturePinchUpdate:
       if (!pinching_)
         error_msg->append("Pinch update outside of pinch\n");
       break;
-    case WebInputEvent::kGesturePinchEnd:
+    case WebInputEvent::Type::kGesturePinchEnd:
       if (!pinching_)
         error_msg->append("Pinch end outside of pinch\n");
       pinching_ = false;
       break;
-    case WebInputEvent::kGestureTapDown:
+    case WebInputEvent::Type::kGestureTapDown:
       if (waiting_for_tap_end_)
         error_msg->append("Missing tap ending event before TapDown\n");
       waiting_for_tap_end_ = true;
       break;
-    case WebInputEvent::kGestureTapUnconfirmed:
+    case WebInputEvent::Type::kGestureTapUnconfirmed:
       if (!waiting_for_tap_end_)
         error_msg->append("Missing TapDown event before TapUnconfirmed\n");
       break;
-    case WebInputEvent::kGestureTapCancel:
+    case WebInputEvent::Type::kGestureTapCancel:
       if (!waiting_for_tap_end_)
         error_msg->append("Missing TapDown event before TapCancel\n");
       waiting_for_tap_end_ = false;
       break;
-    case WebInputEvent::kGestureTap:
+    case WebInputEvent::Type::kGestureTap:
       if (!waiting_for_tap_end_)
         error_msg->append("Missing TapDown event before Tap\n");
       waiting_for_tap_end_ = false;
       break;
-    case WebInputEvent::kGestureDoubleTap:
+    case WebInputEvent::Type::kGestureDoubleTap:
       // DoubleTap gestures may be synthetically inserted, and do not require a
       // preceding TapDown.
       waiting_for_tap_end_ = false;
diff --git a/chromium/content/common/input/gesture_event_stream_validator_unittest.cc b/chromium/content/common/input/gesture_event_stream_validator_unittest.cc
index b1922934f4d..46c00da677a 100644
--- a/chromium/content/common/input/gesture_event_stream_validator_unittest.cc
+++ b/chromium/content/common/input/gesture_event_stream_validator_unittest.cc
@@ -20,7 +20,7 @@ blink::WebGestureEvent Build(WebInputEvent::Type type) {
   blink::WebGestureEvent event =
       SyntheticWebGestureEventBuilder::Build(type, kDefaultGestureDevice);
   // Default to providing a (valid) non-zero fling velocity.
-  if (type == WebInputEvent::kGestureFlingStart)
+  if (type == WebInputEvent::Type::kGestureFlingStart)
     event.data.fling_start.velocity_x = 5;
   return event;
 }
@@ -32,15 +32,15 @@ TEST(GestureEventStreamValidator, ValidScroll) {
   std::string error_msg;
   WebGestureEvent event;
 
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureScrollUpdate);
+  event = Build(WebInputEvent::Type::kGestureScrollUpdate);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureScrollEnd);
+  event = Build(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 }
@@ -51,30 +51,30 @@ TEST(GestureEventStreamValidator, InvalidScroll) {
   WebGestureEvent event;
 
   // No preceding ScrollBegin.
-  event = Build(WebInputEvent::kGestureScrollUpdate);
+  event = Build(WebInputEvent::Type::kGestureScrollUpdate);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // No preceding ScrollBegin.
-  event = Build(WebInputEvent::kGestureScrollEnd);
+  event = Build(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
   // Already scrolling.
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureScrollEnd);
+  event = Build(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
   // Scroll already ended.
-  event = Build(WebInputEvent::kGestureScrollEnd);
+  event = Build(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 }
@@ -84,11 +84,11 @@ TEST(GestureEventStreamValidator, ValidFling) {
   std::string error_msg;
   WebGestureEvent event;
 
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureFlingStart);
+  event = Build(WebInputEvent::Type::kGestureFlingStart);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 }
@@ -99,16 +99,16 @@ TEST(GestureEventStreamValidator, InvalidFling) {
   WebGestureEvent event;
 
   // No preceding ScrollBegin.
-  event = Build(WebInputEvent::kGestureFlingStart);
+  event = Build(WebInputEvent::Type::kGestureFlingStart);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // Zero velocity.
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureFlingStart);
+  event = Build(WebInputEvent::Type::kGestureFlingStart);
   event.data.fling_start.velocity_x = 0;
   event.data.fling_start.velocity_y = 0;
   EXPECT_FALSE(validator.Validate(event, &error_msg));
@@ -120,15 +120,15 @@ TEST(GestureEventStreamValidator, ValidPinch) {
   std::string error_msg;
   WebGestureEvent event;
 
-  event = Build(WebInputEvent::kGesturePinchBegin);
+  event = Build(WebInputEvent::Type::kGesturePinchBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGesturePinchUpdate);
+  event = Build(WebInputEvent::Type::kGesturePinchUpdate);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGesturePinchEnd);
+  event = Build(WebInputEvent::Type::kGesturePinchEnd);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 }
@@ -139,35 +139,35 @@ TEST(GestureEventStreamValidator, InvalidPinch) {
   WebGestureEvent event;
 
   // No preceding PinchBegin.
-  event = Build(WebInputEvent::kGesturePinchUpdate);
+  event = Build(WebInputEvent::Type::kGesturePinchUpdate);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGesturePinchBegin);
+  event = Build(WebInputEvent::Type::kGesturePinchBegin);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
   // ScrollBegin while pinching.
-  event = Build(WebInputEvent::kGestureScrollBegin);
+  event = Build(WebInputEvent::Type::kGestureScrollBegin);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // ScrollEnd while pinching.
-  event = Build(WebInputEvent::kGestureScrollEnd);
+  event = Build(WebInputEvent::Type::kGestureScrollEnd);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // Pinch already begun.
-  event = Build(WebInputEvent::kGesturePinchBegin);
+  event = Build(WebInputEvent::Type::kGesturePinchBegin);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGesturePinchEnd);
+  event = Build(WebInputEvent::Type::kGesturePinchEnd);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
   // Pinch already ended.
-  event = Build(WebInputEvent::kGesturePinchEnd);
+  event = Build(WebInputEvent::Type::kGesturePinchEnd);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 }
@@ -177,37 +177,37 @@ TEST(GestureEventStreamValidator, ValidTap) {
   std::string error_msg;
   WebGestureEvent event;
 
-  event = Build(WebInputEvent::kGestureTapDown);
+  event = Build(WebInputEvent::Type::kGestureTapDown);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapCancel);
+  event = Build(WebInputEvent::Type::kGestureTapCancel);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapDown);
+  event = Build(WebInputEvent::Type::kGestureTapDown);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapUnconfirmed);
+  event = Build(WebInputEvent::Type::kGestureTapUnconfirmed);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapCancel);
+  event = Build(WebInputEvent::Type::kGestureTapCancel);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapDown);
+  event = Build(WebInputEvent::Type::kGestureTapDown);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTap);
+  event = Build(WebInputEvent::Type::kGestureTap);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
   // DoubleTap does not require a TapDown (unlike Tap, TapUnconfirmed and
   // TapCancel).
-  event = Build(WebInputEvent::kGestureDoubleTap);
+  event = Build(WebInputEvent::Type::kGestureDoubleTap);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 }
@@ -218,41 +218,41 @@ TEST(GestureEventStreamValidator, InvalidTap) {
   WebGestureEvent event;
 
   // No preceding TapDown.
-  event = Build(WebInputEvent::kGestureTapUnconfirmed);
+  event = Build(WebInputEvent::Type::kGestureTapUnconfirmed);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapCancel);
+  event = Build(WebInputEvent::Type::kGestureTapCancel);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTap);
+  event = Build(WebInputEvent::Type::kGestureTap);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // TapDown already terminated.
-  event = Build(WebInputEvent::kGestureTapDown);
+  event = Build(WebInputEvent::Type::kGestureTapDown);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureDoubleTap);
+  event = Build(WebInputEvent::Type::kGestureDoubleTap);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapCancel);
+  event = Build(WebInputEvent::Type::kGestureTapCancel);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 
   // TapDown already terminated.
-  event = Build(WebInputEvent::kGestureTapDown);
+  event = Build(WebInputEvent::Type::kGestureTapDown);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTap);
+  event = Build(WebInputEvent::Type::kGestureTap);
   EXPECT_TRUE(validator.Validate(event, &error_msg));
   EXPECT_TRUE(error_msg.empty());
 
-  event = Build(WebInputEvent::kGestureTapCancel);
+  event = Build(WebInputEvent::Type::kGestureTapCancel);
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
 }
diff --git a/chromium/content/common/input/ime_text_span_conversions.cc b/chromium/content/common/input/ime_text_span_conversions.cc
index 4f70fb2ed0b..e8ed1b511ad 100644
--- a/chromium/content/common/input/ime_text_span_conversions.cc
+++ b/chromium/content/common/input/ime_text_span_conversions.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/ime_text_span_conversions.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 
 namespace content {
 
diff --git a/chromium/content/common/input/input_event_ack.cc b/chromium/content/common/input/input_event_ack.cc
deleted file mode 100644
index 98a50178fd7..00000000000
--- a/chromium/content/common/input/input_event_ack.cc
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/input/input_event_ack.h"
-
-#include <utility>
-
-namespace content {
-
-InputEventAck::InputEventAck(
-    InputEventAckSource source,
-    blink::WebInputEvent::Type type,
-    InputEventAckState state,
-    const ui::LatencyInfo& latency,
-    std::unique_ptr<ui::DidOverscrollParams> overscroll,
-    uint32_t unique_touch_event_id,
-    base::Optional<cc::TouchAction> touch_action)
-    : source(source),
-      type(type),
-      state(state),
-      latency(latency),
-      overscroll(std::move(overscroll)),
-      unique_touch_event_id(unique_touch_event_id),
-      touch_action(touch_action) {}
-
-InputEventAck::InputEventAck(InputEventAckSource source,
-                             blink::WebInputEvent::Type type,
-                             InputEventAckState state,
-                             const ui::LatencyInfo& latency,
-                             uint32_t unique_touch_event_id)
-    : InputEventAck(source,
-                    type,
-                    state,
-                    latency,
-                    nullptr,
-                    unique_touch_event_id,
-                    base::nullopt) {}
-
-InputEventAck::InputEventAck(InputEventAckSource source,
-                             blink::WebInputEvent::Type type,
-                             InputEventAckState state,
-                             uint32_t unique_touch_event_id)
-    : InputEventAck(source,
-                    type,
-                    state,
-                    ui::LatencyInfo(),
-                    unique_touch_event_id) {}
-
-InputEventAck::InputEventAck(InputEventAckSource source,
-                             blink::WebInputEvent::Type type,
-                             InputEventAckState state)
-    : InputEventAck(source, type, state, 0) {}
-
-InputEventAck::InputEventAck()
-    : InputEventAck(InputEventAckSource::UNKNOWN,
-                    blink::WebInputEvent::kUndefined,
-                    INPUT_EVENT_ACK_STATE_UNKNOWN) {}
-
-InputEventAck::~InputEventAck() {
-}
-
-}  // namespace content
diff --git a/chromium/content/common/input/input_event_ack.h b/chromium/content/common/input/input_event_ack.h
deleted file mode 100644
index b9e4b7ca531..00000000000
--- a/chromium/content/common/input/input_event_ack.h
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_H_
-#define CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_H_
-
-#include <stdint.h>
-
-#include <memory>
-
-#include "base/optional.h"
-#include "cc/input/touch_action.h"
-#include "content/common/content_export.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
-#include "third_party/blink/public/common/input/web_input_event.h"
-#include "ui/events/blink/did_overscroll_params.h"
-#include "ui/latency/latency_info.h"
-
-namespace content {
-
-// InputEventAck.
-struct CONTENT_EXPORT InputEventAck {
-  InputEventAck(InputEventAckSource source,
-                blink::WebInputEvent::Type type,
-                InputEventAckState state,
-                const ui::LatencyInfo& latency,
-                std::unique_ptr<ui::DidOverscrollParams> overscroll,
-                uint32_t unique_touch_event_id,
-                base::Optional<cc::TouchAction> touch_action);
-  InputEventAck(InputEventAckSource source,
-                blink::WebInputEvent::Type type,
-                InputEventAckState state,
-                const ui::LatencyInfo& latency,
-                uint32_t unique_touch_event_id);
-  InputEventAck(InputEventAckSource source,
-                blink::WebInputEvent::Type type,
-                InputEventAckState state,
-                uint32_t unique_touch_event_id);
-  InputEventAck(InputEventAckSource source,
-                blink::WebInputEvent::Type type,
-                InputEventAckState state);
-  InputEventAck();
-  ~InputEventAck();
-
-  InputEventAckSource source;
-  blink::WebInputEvent::Type type;
-  InputEventAckState state;
-  ui::LatencyInfo latency;
-  std::unique_ptr<ui::DidOverscrollParams> overscroll;
-  uint32_t unique_touch_event_id;
-  base::Optional<cc::TouchAction> touch_action;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_INPUT_INPUT_EVENT_ACK_H_
diff --git a/chromium/content/common/input/input_event_ack_state.cc b/chromium/content/common/input/input_event_ack_state.cc
index 41b2743e5fc..be8ea3fc81e 100644
--- a/chromium/content/common/input/input_event_ack_state.cc
+++ b/chromium/content/common/input/input_event_ack_state.cc
@@ -2,32 +2,34 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/common/input_event_ack_state.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 
 #include "base/logging.h"
 
 namespace content {
 
-const char* InputEventAckStateToString(InputEventAckState ack_state) {
+const char* InputEventResultStateToString(
+    blink::mojom::InputEventResultState ack_state) {
   switch (ack_state) {
-    case INPUT_EVENT_ACK_STATE_UNKNOWN:
+    case blink::mojom::InputEventResultState::kUnknown:
       return "UNKNOWN";
-    case INPUT_EVENT_ACK_STATE_CONSUMED:
+    case blink::mojom::InputEventResultState::kConsumed:
       return "CONSUMED";
-    case INPUT_EVENT_ACK_STATE_NOT_CONSUMED:
+    case blink::mojom::InputEventResultState::kNotConsumed:
       return "NOT_CONSUMED";
-    case INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE:
+    case blink::mojom::InputEventResultState::kConsumedShouldBubble:
       return "CONSUMED_SHOULD_BUBBLE";
-    case INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS:
+    case blink::mojom::InputEventResultState::kNoConsumerExists:
       return "NO_CONSUMER_EXISTS";
-    case INPUT_EVENT_ACK_STATE_IGNORED:
+    case blink::mojom::InputEventResultState::kIgnored:
       return "IGNORED";
-    case INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING:
+    case blink::mojom::InputEventResultState::kSetNonBlocking:
       return "SET_NON_BLOCKING";
-    case INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING:
+    case blink::mojom::InputEventResultState::kSetNonBlockingDueToFling:
       return "SET_NON_BLOCKING_DUE_TO_FLING";
   }
-  DLOG(WARNING) << "InputEventAckStateToString: Unhandled InputEventAckState.";
+  DLOG(WARNING)
+      << "InputEventResultStateToString: Unhandled InputEventResultState.";
   return "";
 }
 
diff --git a/chromium/content/common/input/input_event_stream_validator.cc b/chromium/content/common/input/input_event_stream_validator.cc
index bb1fd0bcea9..e5f78afa7ff 100644
--- a/chromium/content/common/input/input_event_stream_validator.cc
+++ b/chromium/content/common/input/input_event_stream_validator.cc
@@ -4,8 +4,8 @@
 
 #include "content/common/input/input_event_stream_validator.h"
 
+#include "base/check.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "content/public/common/content_switches.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
diff --git a/chromium/content/common/input/input_handler.mojom b/chromium/content/common/input/input_handler.mojom
index a7853e55a0b..6ae8d0bf969 100644
--- a/chromium/content/common/input/input_handler.mojom
+++ b/chromium/content/common/input/input_handler.mojom
@@ -9,7 +9,13 @@ import "content/common/input/synchronous_compositor.mojom";
 import "content/common/native_types.mojom";
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
+import "third_party/blink/public/mojom/input/gesture_event.mojom";
+import "third_party/blink/public/mojom/input/input_event.mojom";
+import "third_party/blink/public/mojom/input/input_handler.mojom";
+import "third_party/blink/public/mojom/input/input_event_result.mojom";
 import "third_party/blink/public/mojom/input/pointer_lock_result.mojom";
+import "third_party/blink/public/mojom/input/touch_event.mojom";
+import "third_party/blink/public/mojom/input/pointer_lock_context.mojom";
 import "third_party/blink/public/mojom/selection_menu/selection_menu_behavior.mojom";
 import "ui/base/ime/mojom/ime_types.mojom";
 import "ui/events/mojom/event.mojom";
@@ -46,8 +52,8 @@ struct PointerData {
   int32 tilt_y;
   float tangential_pressure;
   int32 twist;
-  Button button;
-  PointerType pointer_type;
+  blink.mojom.Button button;
+  ui.mojom.EventPointerType pointer_type;
   int32 movement_x;
   int32 movement_y;
   bool is_raw_movement_event;
@@ -65,7 +71,7 @@ struct WheelData {
   float acceleration_ratio_y;
   uint8 phase;
   uint8 momentum_phase;
-  Cancelability cancelable;
+  blink.mojom.DispatchType cancelable;
   uint8 event_action;
   uint8 delta_units;
 };
@@ -85,7 +91,7 @@ struct ScrollData {
   float delta_y;
   ui.mojom.ScrollGranularity delta_units;
   bool target_viewport;
-  InertialPhaseState inertial_phase;
+  blink.mojom.InertialPhaseState inertial_phase;
   bool synthetic;
   int32 pointer_count;
   ScrollUpdate? update_details;
@@ -120,9 +126,9 @@ struct TapData {
 struct GestureData {
   gfx.mojom.PointF screen_position;
   gfx.mojom.PointF widget_position;
-  GestureDevice source_device;
+  blink.mojom.GestureDevice source_device;
   bool is_source_touch_event_set_non_blocking;
-  PointerType primary_pointer_type;
+  ui.mojom.EventPointerType primary_pointer_type;
   int32 unique_touch_event_id;
   gfx.mojom.Size? contact_size;
   ScrollData? scroll_data;
@@ -134,7 +140,7 @@ struct GestureData {
 };
 
 struct TouchPoint {
-  TouchState state;
+  blink.mojom.TouchState state;
   float radius_x;
   float radius_y;
   float rotation_angle;
@@ -142,7 +148,7 @@ struct TouchPoint {
 };
 
 struct TouchData {
-  Cancelability cancelable;
+  blink.mojom.DispatchType cancelable;
   bool moved_beyond_slop_region;
   bool touch_start_or_first_move;
   bool hovering;
@@ -151,7 +157,7 @@ struct TouchData {
 };
 
 struct Event {
-  EventType type;
+  blink.mojom.EventType type;
   int32 modifiers;
   mojo_base.mojom.TimeTicks timestamp;
   ui.mojom.LatencyInfo latency;
@@ -161,35 +167,15 @@ struct Event {
   TouchData? touch_data;
 };
 
-struct TouchActionOptional {
-  cc.mojom.TouchAction touch_action;
-};
-
 // Interface exposed by the browser to the renderer.
 interface WidgetInputHandlerHost {
-  // Call platform Fallback Cursor Mode APIs.
-  [EnableIf=is_android]
-  FallbackCursorModeLockCursor(bool left, bool right, bool up, bool down);
-  [EnableIf=is_android]
-  FallbackCursorModeSetCursorVisibility(bool visible);
-
   // When the renderer's main thread computes the touch action, send this to the
   // browser.
   SetTouchActionFromMain(cc.mojom.TouchAction touch_action);
 
-  // The whitelisted touch action and the associated unique touch event id
-  // for a new touch point sent by the compositor. The unique touch event id is
-  // only needed to verify that the whitelisted touch action is being associated
-  // with the correct touch event. The input event ack state is needed when
-  // the touchstart message was not sent to the renderer and the touch
-  // actions need to be reset and the touch ack timeout needs to be started.
-  SetWhiteListedTouchAction(cc.mojom.TouchAction touch_action,
-                            uint32 unique_touch_event_id,
-                            InputEventAckState state);
-
   // Sent by the compositor when input scroll events are dropped due to bounds
   // restrictions on the root scroll offset.
-  DidOverscroll(DidOverscrollParams params);
+  DidOverscroll(blink.mojom.DidOverscrollParams params);
 
   // Sent by the compositor when a GSB has started scrolling the viewport.
   DidStartScrollingViewport();
@@ -223,23 +209,15 @@ interface WidgetInputHandlerHost {
   // |unadjusted_movement| indicates whether the request asked for raw mouse
   // movement data or just what the operating system returns (often accelerated
   // mouse movement).
-  // TODO(jameshollyer-https://crbug.com/1056036): Add a context to this call
-  // so that both sides have a shared state telling them if the mouse is
-  // locked.
+  // |result| kSuccess if the mouse has been locked or the appropriate error
+  // reason if not.
+  // |context| is one end of a mojo pipe that will stay connected as long as
+  // the mouse is locked. Is a NullRemote if |result| is not kSuccess.
   RequestMouseLock(bool from_user_gesture,
                    bool privileged,
                    bool unadjusted_movement)
-                      => (blink.mojom.PointerLockResult result);
-
-  // A request to change the current mouse lock to have the given unadjusted
-  // movement.
-  RequestMouseLockChange(bool unadjusted_movement)
-                          => (blink.mojom.PointerLockResult result);
-
-  // Unlocks the mouse back to its default behavior. This will also returns
-  // mouse movement back to the platform's adjusted movement if unadjusted
-  // movement was true while locking.
-  UnlockMouse();
+      => (blink.mojom.PointerLockResult result,
+          pending_remote<blink.mojom.PointerLockContext>? context);
 };
 
 // Interface exposed by the renderer to the browser. This class represents
@@ -252,29 +230,23 @@ interface WidgetInputHandler {
   // Tells widget mouse capture has been lost.
   MouseCaptureLost();
 
-  // Tells the render side that the mouse has been unlocked.
-  MouseLockLost();
-
   // This message notifies the renderer that the next key event is bound to one
   // or more pre-defined edit commands. If the next key event is not handled
-  // by webkit, the specified edit commands shall be executed against current
+  // by blink, the specified edit commands shall be executed against current
   // focused frame.
   // Parameters
-  // * edit_commands (see chrome/common/edit_command_types.h)
+  // * edit_commands
+  //   See t_p/b/renderer/core/editing/commands/editing_command_type.h
   //   Contains one or more edit commands.
-  // See third_party/WebKit/Source/WebCore/editing/EditorCommand.cpp for
+  // See t_p/b/renderer/core/editing/commands/editor_command.cc for
   // detailed definition of webkit edit commands.
   //
   // This message must be sent just before sending a key event.
-
-  SetEditCommandsForNextKeyEvent(array<content.mojom.EditCommand> commands);
+  SetEditCommandsForNextKeyEvent(array<blink.mojom.EditCommand> edit_commands);
 
   // Sends the cursor visibility state to the render widget.
   CursorVisibilityChanged(bool visible);
 
-  // Notifies the RenderWidget when toggle fallback cursor mode on/off.
-  FallbackCursorModeToggled(bool is_on);
-
   // This message sends a string being composed with an input method.
   ImeSetComposition(mojo_base.mojom.String16 text,
                     array<ui.mojom.ImeTextSpan> ime_text_spans,
@@ -306,9 +278,11 @@ interface WidgetInputHandler {
   // the main thread so DispatchNonBlockingEvent is always preferred if
   // you don't require notification.
   DispatchEvent(Event event)
-      => (InputEventAckSource source, ui.mojom.LatencyInfo updated_latency,
-         InputEventAckState state, DidOverscrollParams? overscroll,
-         TouchActionOptional? touch_action);
+      => (blink.mojom.InputEventResultSource source,
+         ui.mojom.LatencyInfo updated_latency,
+         blink.mojom.InputEventResultState state,
+         blink.mojom.DidOverscrollParams? overscroll,
+         blink.mojom.TouchActionOptional? touch_action);
 
   // Sends a non-blocking input event to the render widget. The behaviour
   // of this API is the same as DispatchEvent just that there is no callback
diff --git a/chromium/content/common/input/sync_compositor_messages.cc b/chromium/content/common/input/sync_compositor_messages.cc
deleted file mode 100644
index 68c6ea75858..00000000000
--- a/chromium/content/common/input/sync_compositor_messages.cc
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/input/sync_compositor_messages.h"
-
-namespace content {
-
-SyncCompositorDemandDrawHwParams::SyncCompositorDemandDrawHwParams() {}
-
-SyncCompositorDemandDrawHwParams::SyncCompositorDemandDrawHwParams(
-    const gfx::Size& viewport_size,
-    const gfx::Rect& viewport_rect_for_tile_priority,
-    const gfx::Transform& transform_for_tile_priority)
-    : viewport_size(viewport_size),
-      viewport_rect_for_tile_priority(viewport_rect_for_tile_priority),
-      transform_for_tile_priority(transform_for_tile_priority) {}
-
-SyncCompositorDemandDrawHwParams::~SyncCompositorDemandDrawHwParams() {}
-
-SyncCompositorDemandDrawSwParams::SyncCompositorDemandDrawSwParams() {}
-
-SyncCompositorDemandDrawSwParams::~SyncCompositorDemandDrawSwParams() {}
-
-SyncCompositorCommonRendererParams::SyncCompositorCommonRendererParams() =
-    default;
-
-SyncCompositorCommonRendererParams::SyncCompositorCommonRendererParams(
-    const SyncCompositorCommonRendererParams& other) = default;
-
-SyncCompositorCommonRendererParams::~SyncCompositorCommonRendererParams() {}
-
-SyncCompositorCommonRendererParams& SyncCompositorCommonRendererParams::
-operator=(const SyncCompositorCommonRendererParams& other) = default;
-
-}  // namespace content
diff --git a/chromium/content/common/input/sync_compositor_messages.h b/chromium/content/common/input/sync_compositor_messages.h
deleted file mode 100644
index ff83875b284..00000000000
--- a/chromium/content/common/input/sync_compositor_messages.h
+++ /dev/null
@@ -1,98 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-#define CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-
-#include <stddef.h>
-
-#include "content/common/content_export.h"
-#include "content/common/content_param_traits.h"
-#include "ipc/ipc_message_macros.h"
-#include "ui/gfx/geometry/point.h"
-#include "ui/gfx/geometry/rect.h"
-#include "ui/gfx/geometry/scroll_offset.h"
-#include "ui/gfx/geometry/size.h"
-#include "ui/gfx/geometry/size_f.h"
-#include "ui/gfx/transform.h"
-
-#ifndef INTERNAL_CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-#define INTERNAL_CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-
-namespace content {
-
-struct SyncCompositorDemandDrawHwParams {
-  SyncCompositorDemandDrawHwParams();
-  SyncCompositorDemandDrawHwParams(
-      const gfx::Size& viewport_size,
-      const gfx::Rect& viewport_rect_for_tile_priority,
-      const gfx::Transform& transform_for_tile_priority);
-  ~SyncCompositorDemandDrawHwParams();
-
-  gfx::Size viewport_size;
-  gfx::Rect viewport_rect_for_tile_priority;
-  gfx::Transform transform_for_tile_priority;
-};
-
-struct SyncCompositorDemandDrawSwParams {
-  SyncCompositorDemandDrawSwParams();
-  ~SyncCompositorDemandDrawSwParams();
-
-  gfx::Size size;
-  gfx::Rect clip;
-  gfx::Transform transform;
-};
-
-struct SyncCompositorCommonRendererParams {
-  SyncCompositorCommonRendererParams();
-  ~SyncCompositorCommonRendererParams();
-
-  // Allow copy.
-  SyncCompositorCommonRendererParams(
-      const SyncCompositorCommonRendererParams& other);
-  SyncCompositorCommonRendererParams& operator=(
-      const SyncCompositorCommonRendererParams& other);
-
-  unsigned int version = 0u;
-  gfx::ScrollOffset total_scroll_offset;
-  gfx::ScrollOffset max_scroll_offset;
-  gfx::SizeF scrollable_size;
-  float page_scale_factor = 0.f;
-  float min_page_scale_factor = 0.f;
-  float max_page_scale_factor = 0.f;
-  uint32_t need_invalidate_count = 0u;
-  bool invalidate_needs_draw = true;
-  uint32_t did_activate_pending_tree_count = 0u;
-};
-
-}  // namespace content
-
-#endif  // INTERNAL_CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
-
-IPC_STRUCT_TRAITS_BEGIN(content::SyncCompositorDemandDrawHwParams)
-  IPC_STRUCT_TRAITS_MEMBER(viewport_size)
-  IPC_STRUCT_TRAITS_MEMBER(viewport_rect_for_tile_priority)
-  IPC_STRUCT_TRAITS_MEMBER(transform_for_tile_priority)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::SyncCompositorDemandDrawSwParams)
-  IPC_STRUCT_TRAITS_MEMBER(size)
-  IPC_STRUCT_TRAITS_MEMBER(clip)
-  IPC_STRUCT_TRAITS_MEMBER(transform)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::SyncCompositorCommonRendererParams)
-  IPC_STRUCT_TRAITS_MEMBER(version)
-  IPC_STRUCT_TRAITS_MEMBER(total_scroll_offset)
-  IPC_STRUCT_TRAITS_MEMBER(max_scroll_offset)
-  IPC_STRUCT_TRAITS_MEMBER(scrollable_size)
-  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(min_page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(max_page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(need_invalidate_count)
-  IPC_STRUCT_TRAITS_MEMBER(invalidate_needs_draw)
-  IPC_STRUCT_TRAITS_MEMBER(did_activate_pending_tree_count)
-IPC_STRUCT_TRAITS_END()
-
-#endif  // CONTENT_COMMON_SYNC_COMPOSITOR_MESSAGES_H_
diff --git a/chromium/content/common/input/synchronous_compositor.mojom b/chromium/content/common/input/synchronous_compositor.mojom
index 858cab6543c..7af71ab1812 100644
--- a/chromium/content/common/input/synchronous_compositor.mojom
+++ b/chromium/content/common/input/synchronous_compositor.mojom
@@ -13,15 +13,32 @@ import "services/viz/public/mojom/compositing/frame_timing_details.mojom";
 import "services/viz/public/mojom/compositing/returned_resource.mojom";
 import "services/viz/public/mojom/hit_test/hit_test_region_list.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
+import "ui/gfx/mojom/transform.mojom";
 
-[Native]
-struct SyncCompositorDemandDrawHwParams;
+struct SyncCompositorDemandDrawHwParams {
+  gfx.mojom.Size viewport_size;
+  gfx.mojom.Rect viewport_rect_for_tile_priority;
+  gfx.mojom.Transform transform_for_tile_priority;
+};
 
-[Native]
-struct SyncCompositorDemandDrawSwParams;
+struct SyncCompositorDemandDrawSwParams {
+  gfx.mojom.Size size;
+  gfx.mojom.Rect clip;
+  gfx.mojom.Transform transform;
+};
 
-[Native]
-struct SyncCompositorCommonRendererParams;
+struct SyncCompositorCommonRendererParams {
+  uint32 version = 0;
+  gfx.mojom.ScrollOffset total_scroll_offset;
+  gfx.mojom.ScrollOffset max_scroll_offset;
+  gfx.mojom.SizeF scrollable_size;
+  float page_scale_factor = 0;
+  float min_page_scale_factor = 0;
+  float max_page_scale_factor = 0;
+  uint32 need_invalidate_count = 0;
+  bool invalidate_needs_draw = true;
+  uint32 did_activate_pending_tree_count = 0;
+};
 
 // The SynchronousCompositor is an interface that is used by Android Webview
 // which must control the compositor synchronously. It does this so that
diff --git a/chromium/content/common/input/synthetic_pinch_gesture_params.cc b/chromium/content/common/input/synthetic_pinch_gesture_params.cc
index b4efcb02b17..bd00e7e1b92 100644
--- a/chromium/content/common/input/synthetic_pinch_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_pinch_gesture_params.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_pinch_gesture_params.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
diff --git a/chromium/content/common/input/synthetic_pointer_action_list_params.cc b/chromium/content/common/input/synthetic_pointer_action_list_params.cc
index b5d0a71de86..56c622c89f8 100644
--- a/chromium/content/common/input/synthetic_pointer_action_list_params.cc
+++ b/chromium/content/common/input/synthetic_pointer_action_list_params.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_pointer_action_list_params.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
diff --git a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
index f5adc46a5a8..f19cc34d065 100644
--- a/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_drag_gesture_params.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_smooth_drag_gesture_params.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 namespace {
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
index d543982aae2..03649c76472 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_smooth_scroll_gesture_params.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 namespace {
@@ -18,7 +18,8 @@ SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams()
       speed_in_pixels_s(kDefaultSpeedInPixelsS),
       fling_velocity_x(0),
       fling_velocity_y(0),
-      granularity(ui::ScrollGranularity::kScrollByPixel) {}
+      granularity(ui::ScrollGranularity::kScrollByPixel),
+      key_modifiers(0) {}
 
 SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams(
     const SyntheticSmoothScrollGestureParams& other) = default;
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
index 131960aa8ca..c9754c9a91e 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
@@ -32,6 +32,8 @@ struct CONTENT_EXPORT SyntheticSmoothScrollGestureParams
   float fling_velocity_x;
   float fling_velocity_y;
   ui::ScrollGranularity granularity;
+  // A bitfield of values from blink::WebInputEvent::Modifiers.
+  int key_modifiers;
 
   static const SyntheticSmoothScrollGestureParams* Cast(
       const SyntheticGestureParams* gesture_params);
diff --git a/chromium/content/common/input/synthetic_tap_gesture_params.cc b/chromium/content/common/input/synthetic_tap_gesture_params.cc
index c3bb8ffee18..8cb2c12cebc 100644
--- a/chromium/content/common/input/synthetic_tap_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_tap_gesture_params.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_tap_gesture_params.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 
 namespace content {
 
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.cc b/chromium/content/common/input/synthetic_web_input_event_builders.cc
index 8ddb6105a71..785640f90b7 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.cc
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/synthetic_web_input_event_builders.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/common/input/web_mouse_wheel_event_traits.h"
 #include "content/common/input/web_touch_event_traits.h"
 #include "ui/events/base_event_utils.h"
@@ -45,7 +45,7 @@ WebMouseEvent SyntheticWebMouseEventBuilder::Build(
 
 WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     WebMouseWheelEvent::Phase phase) {
-  WebMouseWheelEvent result(WebInputEvent::kMouseWheel,
+  WebMouseWheelEvent result(WebInputEvent::Type::kMouseWheel,
                             WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   result.phase = phase;
   result.event_action = WebMouseWheelEventTraits::GetEventAction(result);
@@ -71,7 +71,7 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     float dy,
     int modifiers,
     ui::ScrollGranularity delta_units) {
-  WebMouseWheelEvent result(WebInputEvent::kMouseWheel, modifiers,
+  WebMouseWheelEvent result(WebInputEvent::Type::kMouseWheel, modifiers,
                             ui::EventTimeForNow());
   result.SetPositionInScreen(global_x, global_y);
   result.SetPositionInWidget(x, y);
@@ -102,9 +102,9 @@ WebGestureEvent SyntheticWebGestureEventBuilder::Build(
     int modifiers) {
   DCHECK(WebInputEvent::IsGestureEventType(type));
   WebGestureEvent result(type, modifiers, ui::EventTimeForNow(), source_device);
-  if (type == WebInputEvent::kGestureTap ||
-      type == WebInputEvent::kGestureTapUnconfirmed ||
-      type == WebInputEvent::kGestureDoubleTap) {
+  if (type == WebInputEvent::Type::kGestureTap ||
+      type == WebInputEvent::Type::kGestureTapUnconfirmed ||
+      type == WebInputEvent::Type::kGestureDoubleTap) {
     result.data.tap.tap_count = 1;
     result.data.tap.width = 10;
     result.data.tap.height = 10;
@@ -121,7 +121,7 @@ WebGestureEvent SyntheticWebGestureEventBuilder::BuildScrollBegin(
     blink::WebGestureDevice source_device,
     int pointer_count) {
   WebGestureEvent result =
-      Build(WebInputEvent::kGestureScrollBegin, source_device);
+      Build(WebInputEvent::Type::kGestureScrollBegin, source_device);
   result.data.scroll_begin.delta_x_hint = dx_hint;
   result.data.scroll_begin.delta_y_hint = dy_hint;
   result.data.scroll_begin.pointer_count = pointer_count;
@@ -133,8 +133,8 @@ WebGestureEvent SyntheticWebGestureEventBuilder::BuildScrollUpdate(
     float dy,
     int modifiers,
     blink::WebGestureDevice source_device) {
-  WebGestureEvent result =
-      Build(WebInputEvent::kGestureScrollUpdate, source_device, modifiers);
+  WebGestureEvent result = Build(WebInputEvent::Type::kGestureScrollUpdate,
+                                 source_device, modifiers);
   result.data.scroll_update.delta_x = dx;
   result.data.scroll_update.delta_y = dy;
   return result;
@@ -147,7 +147,7 @@ WebGestureEvent SyntheticWebGestureEventBuilder::BuildPinchUpdate(
     int modifiers,
     blink::WebGestureDevice source_device) {
   WebGestureEvent result =
-      Build(WebInputEvent::kGesturePinchUpdate, source_device, modifiers);
+      Build(WebInputEvent::Type::kGesturePinchUpdate, source_device, modifiers);
   result.data.pinch_update.scale = scale;
   result.SetPositionInWidget(gfx::PointF(anchor_x, anchor_y));
   result.SetPositionInScreen(gfx::PointF(anchor_x, anchor_y));
@@ -159,7 +159,7 @@ WebGestureEvent SyntheticWebGestureEventBuilder::BuildFling(
     float velocity_y,
     blink::WebGestureDevice source_device) {
   WebGestureEvent result =
-      Build(WebInputEvent::kGestureFlingStart, source_device);
+      Build(WebInputEvent::Type::kGestureFlingStart, source_device);
   result.data.fling_start.velocity_x = velocity_x;
   result.data.fling_start.velocity_y = velocity_y;
   return result;
@@ -176,26 +176,26 @@ void SyntheticWebTouchEvent::ResetPoints() {
   unsigned count = 0;
   for (unsigned int i = 0; i < kTouchesLengthCap; ++i) {
     switch (touches[i].state) {
-      case WebTouchPoint::kStatePressed:
-      case WebTouchPoint::kStateMoved:
-      case WebTouchPoint::kStateStationary:
-        touches[i].state = WebTouchPoint::kStateStationary;
+      case WebTouchPoint::State::kStatePressed:
+      case WebTouchPoint::State::kStateMoved:
+      case WebTouchPoint::State::kStateStationary:
+        touches[i].state = WebTouchPoint::State::kStateStationary;
         ++activePointCount;
         ++count;
         break;
-      case WebTouchPoint::kStateReleased:
-      case WebTouchPoint::kStateCancelled:
+      case WebTouchPoint::State::kStateReleased:
+      case WebTouchPoint::State::kStateCancelled:
         touches[i] = WebTouchPoint();
         ++count;
         break;
-      case WebTouchPoint::kStateUndefined:
+      case WebTouchPoint::State::kStateUndefined:
         break;
     }
     if (count >= touches_length)
       break;
   }
   touches_length = activePointCount;
-  type_ = WebInputEvent::kUndefined;
+  type_ = WebInputEvent::Type::kUndefined;
   moved_beyond_slop_region = false;
   unique_touch_event_id = ui::GetNextTouchEventId();
 }
@@ -213,7 +213,7 @@ int SyntheticWebTouchEvent::PressPoint(float x,
   point.id = pointer_id_++;
   point.SetPositionInWidget(x, y);
   point.SetPositionInScreen(x, y);
-  point.state = WebTouchPoint::kStatePressed;
+  point.state = WebTouchPoint::State::kStatePressed;
   point.radius_x = radius_x;
   point.radius_y = radius_y;
   point.rotation_angle = rotation_angle;
@@ -221,7 +221,8 @@ int SyntheticWebTouchEvent::PressPoint(float x,
   point.tilt_x = point.tilt_y = 0;
   point.pointer_type = blink::WebPointerProperties::PointerType::kTouch;
   ++touches_length;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchStart, TimeStamp(), this);
+  WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchStart, TimeStamp(),
+                                 this);
   return index;
 }
 
@@ -240,27 +241,29 @@ void SyntheticWebTouchEvent::MovePoint(int index,
   WebTouchPoint& point = touches[index];
   point.SetPositionInWidget(x, y);
   point.SetPositionInScreen(x, y);
-  point.state = WebTouchPoint::kStateMoved;
+  point.state = WebTouchPoint::State::kStateMoved;
   point.radius_x = radius_x;
   point.radius_y = radius_y;
   point.rotation_angle = rotation_angle;
   point.force = force;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchMove, TimeStamp(), this);
+  WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchMove, TimeStamp(),
+                                 this);
 }
 
 void SyntheticWebTouchEvent::ReleasePoint(int index) {
   CHECK_GE(index, 0);
   CHECK_LT(index, kTouchesLengthCap);
-  touches[index].state = WebTouchPoint::kStateReleased;
+  touches[index].state = WebTouchPoint::State::kStateReleased;
   touches[index].force = 0.f;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchEnd, TimeStamp(), this);
+  WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchEnd, TimeStamp(),
+                                 this);
 }
 
 void SyntheticWebTouchEvent::CancelPoint(int index) {
   CHECK_GE(index, 0);
   CHECK_LT(index, kTouchesLengthCap);
-  touches[index].state = WebTouchPoint::kStateCancelled;
-  WebTouchEventTraits::ResetType(WebInputEvent::kTouchCancel, TimeStamp(),
+  touches[index].state = WebTouchPoint::State::kStateCancelled;
+  WebTouchEventTraits::ResetType(WebInputEvent::Type::kTouchCancel, TimeStamp(),
                                  this);
 }
 
@@ -270,7 +273,7 @@ void SyntheticWebTouchEvent::SetTimestamp(base::TimeTicks timestamp) {
 
 int SyntheticWebTouchEvent::FirstFreeIndex() {
   for (size_t i = 0; i < kTouchesLengthCap; ++i) {
-    if (touches[i].state == WebTouchPoint::kStateUndefined)
+    if (touches[i].state == WebTouchPoint::State::kStateUndefined)
       return i;
   }
   return -1;
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders_unittest.cc b/chromium/content/common/input/synthetic_web_input_event_builders_unittest.cc
index e5f6ca9822f..49a034c65e1 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders_unittest.cc
+++ b/chromium/content/common/input/synthetic_web_input_event_builders_unittest.cc
@@ -18,42 +18,42 @@ TEST(SyntheticWebInputEventBuilders, BuildWebTouchEvent) {
   event.PressPoint(1, 2);
   EXPECT_EQ(1U, event.touches_length);
   EXPECT_EQ(0, event.touches[0].id);
-  EXPECT_EQ(WebTouchPoint::kStatePressed, event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStatePressed, event.touches[0].state);
   EXPECT_EQ(gfx::PointF(1, 2), event.touches[0].PositionInWidget());
   event.ResetPoints();
 
   event.PressPoint(3, 4);
   EXPECT_EQ(2U, event.touches_length);
   EXPECT_EQ(1, event.touches[1].id);
-  EXPECT_EQ(WebTouchPoint::kStatePressed, event.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStatePressed, event.touches[1].state);
   EXPECT_EQ(gfx::PointF(3, 4), event.touches[1].PositionInWidget());
   event.ResetPoints();
 
   event.MovePoint(1, 5, 6);
   EXPECT_EQ(2U, event.touches_length);
   EXPECT_EQ(1, event.touches[1].id);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event.touches[1].state);
   EXPECT_EQ(gfx::PointF(5, 6), event.touches[1].PositionInWidget());
   event.ResetPoints();
 
   event.ReleasePoint(0);
   EXPECT_EQ(2U, event.touches_length);
   EXPECT_EQ(0, event.touches[0].id);
-  EXPECT_EQ(WebTouchPoint::kStateReleased, event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateReleased, event.touches[0].state);
   event.ResetPoints();
 
   event.MovePoint(1, 7, 8);
   EXPECT_EQ(1U, event.touches_length);
   EXPECT_EQ(1, event.touches[1].id);
-  EXPECT_EQ(WebTouchPoint::kStateMoved, event.touches[1].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateMoved, event.touches[1].state);
   EXPECT_EQ(gfx::PointF(7, 8), event.touches[1].PositionInWidget());
-  EXPECT_EQ(WebTouchPoint::kStateUndefined, event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStateUndefined, event.touches[0].state);
   event.ResetPoints();
 
   event.PressPoint(9, 10);
   EXPECT_EQ(2U, event.touches_length);
   EXPECT_EQ(2, event.touches[0].id);
-  EXPECT_EQ(WebTouchPoint::kStatePressed, event.touches[0].state);
+  EXPECT_EQ(WebTouchPoint::State::kStatePressed, event.touches[0].state);
   EXPECT_EQ(gfx::PointF(9, 10), event.touches[0].PositionInWidget());
 }
 
diff --git a/chromium/content/common/input/touch_action_optional_mojom_traits.cc b/chromium/content/common/input/touch_action_optional_mojom_traits.cc
deleted file mode 100644
index a6f8a6b4700..00000000000
--- a/chromium/content/common/input/touch_action_optional_mojom_traits.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/input/touch_action_optional_mojom_traits.h"
-
-#include "content/public/common/common_param_traits_macros.h"
-
-namespace mojo {
-bool StructTraits<
-    content::mojom::TouchActionOptionalDataView,
-    cc::TouchAction>::Read(content::mojom::TouchActionOptionalDataView r,
-                           cc::TouchAction* out) {
-  return r.ReadTouchAction(out);
-}
-}  // namespace mojo
diff --git a/chromium/content/common/input/touch_action_optional_mojom_traits.h b/chromium/content/common/input/touch_action_optional_mojom_traits.h
deleted file mode 100644
index c715a238bab..00000000000
--- a/chromium/content/common/input/touch_action_optional_mojom_traits.h
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_INPUT_TOUCH_ACTION_OPTIONAL_MOJOM_TRAITS_H_
-#define CONTENT_COMMON_INPUT_TOUCH_ACTION_OPTIONAL_MOJOM_TRAITS_H_
-
-#include "base/optional.h"
-#include "content/common/input/input_handler.mojom.h"
-
-namespace mojo {
-
-template <>
-struct StructTraits<content::mojom::TouchActionOptionalDataView,
-                    cc::TouchAction> {
-  static cc::TouchAction touch_action(cc::TouchAction action) { return action; }
-  static bool Read(content::mojom::TouchActionOptionalDataView r,
-                   cc::TouchAction* out);
-};
-
-}  // namespace mojo
-
-#endif  // CONTENT_COMMON_INPUT_TOUCH_ACTION_OPTIONAL_MOJOM_TRAITS_H_
diff --git a/chromium/content/common/input/touch_event_stream_validator.cc b/chromium/content/common/input/touch_event_stream_validator.cc
index 506c62ff04f..a171822ff58 100644
--- a/chromium/content/common/input/touch_event_stream_validator.cc
+++ b/chromium/content/common/input/touch_event_stream_validator.cc
@@ -4,7 +4,7 @@
 
 #include "content/common/input/touch_event_stream_validator.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/strings/stringprintf.h"
 #include "content/common/input/web_touch_event_traits.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
@@ -50,7 +50,7 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
   error_msg->clear();
 
   // TouchScrollStarted is not part of a regular touch event stream.
-  if (event.GetType() == WebInputEvent::kTouchScrollStarted)
+  if (event.GetType() == WebInputEvent::Type::kTouchScrollStarted)
     return true;
 
   WebTouchEvent previous_event = previous_event_;
@@ -75,8 +75,8 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
   // Unreleased points from the previous event should exist in the latest event.
   for (unsigned i = 0; i < previous_event.touches_length; ++i) {
     const WebTouchPoint& previous_point = previous_event.touches[i];
-    if (previous_point.state == WebTouchPoint::kStateCancelled ||
-        previous_point.state == WebTouchPoint::kStateReleased)
+    if (previous_point.state == WebTouchPoint::State::kStateCancelled ||
+        previous_point.state == WebTouchPoint::State::kStateReleased)
       continue;
 
     const WebTouchPoint* point = FindTouchPoint(event, previous_point.id);
@@ -95,14 +95,14 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
 
     // The point should exist in the previous event if it is not a new point.
     if (!previous_point) {
-      if (point.state != WebTouchPoint::kStatePressed)
+      if (point.state != WebTouchPoint::State::kStatePressed)
         error_msg->append(StringPrintf(
             "Active touch point (id=%d) not in previous event (ids=%s).\n",
             point.id, TouchPointIdsToString(previous_event).c_str()));
     } else {
-      if (point.state == WebTouchPoint::kStatePressed &&
-          previous_point->state != WebTouchPoint::kStateCancelled &&
-          previous_point->state != WebTouchPoint::kStateReleased) {
+      if (point.state == WebTouchPoint::State::kStatePressed &&
+          previous_point->state != WebTouchPoint::State::kStateCancelled &&
+          previous_point->state != WebTouchPoint::State::kStateReleased) {
         error_msg->append(StringPrintf(
             "Pressed touch point (id=%d) already exists in previous event "
             "(ids=%s).\n",
@@ -111,13 +111,13 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
     }
 
     switch (point.state) {
-      case WebTouchPoint::kStateUndefined:
+      case WebTouchPoint::State::kStateUndefined:
         error_msg->append(
             StringPrintf("Undefined touch point state (id=%d).\n", point.id));
         break;
 
-      case WebTouchPoint::kStateReleased:
-        if (event.GetType() != WebInputEvent::kTouchEnd) {
+      case WebTouchPoint::State::kStateReleased:
+        if (event.GetType() != WebInputEvent::Type::kTouchEnd) {
           error_msg->append(StringPrintf(
               "Released touch point (id=%d) outside touchend.\n", point.id));
         } else {
@@ -125,8 +125,8 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
         }
         break;
 
-      case WebTouchPoint::kStatePressed:
-        if (event.GetType() != WebInputEvent::kTouchStart) {
+      case WebTouchPoint::State::kStatePressed:
+        if (event.GetType() != WebInputEvent::Type::kTouchStart) {
           error_msg->append(StringPrintf(
               "Pressed touch point (id=%d) outside touchstart.\n", point.id));
         } else {
@@ -134,8 +134,8 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
         }
         break;
 
-      case WebTouchPoint::kStateMoved:
-        if (event.GetType() != WebInputEvent::kTouchMove) {
+      case WebTouchPoint::State::kStateMoved:
+        if (event.GetType() != WebInputEvent::Type::kTouchMove) {
           error_msg->append(StringPrintf(
               "Moved touch point (id=%d) outside touchmove.\n", point.id));
         } else {
@@ -143,11 +143,11 @@ bool TouchEventStreamValidator::Validate(const WebTouchEvent& event,
         }
         break;
 
-      case WebTouchPoint::kStateStationary:
+      case WebTouchPoint::State::kStateStationary:
         break;
 
-      case WebTouchPoint::kStateCancelled:
-        if (event.GetType() != WebInputEvent::kTouchCancel) {
+      case WebTouchPoint::State::kStateCancelled:
+        if (event.GetType() != WebInputEvent::Type::kTouchCancel) {
           error_msg->append(StringPrintf(
               "Cancelled touch point (id=%d) outside touchcancel.\n",
               point.id));
diff --git a/chromium/content/common/input/touch_event_stream_validator_unittest.cc b/chromium/content/common/input/touch_event_stream_validator_unittest.cc
index f022bf21eb0..d8ce67bd0b9 100644
--- a/chromium/content/common/input/touch_event_stream_validator_unittest.cc
+++ b/chromium/content/common/input/touch_event_stream_validator_unittest.cc
@@ -122,13 +122,13 @@ TEST(TouchEventStreamValidator, EmptyEvent) {
 
 TEST(TouchEventStreamValidator, InvalidEventType) {
   TouchEventStreamValidator validator;
-  WebTouchEvent event(WebInputEvent::kGestureScrollBegin,
+  WebTouchEvent event(WebInputEvent::Type::kGestureScrollBegin,
                       WebInputEvent::kNoModifiers,
                       WebInputEvent::GetStaticTimeStampForTests());
   std::string error_msg;
 
   event.touches_length = 1;
-  event.touches[0].state = WebTouchPoint::kStatePressed;
+  event.touches[0].state = WebTouchPoint::State::kStatePressed;
 
   EXPECT_FALSE(validator.Validate(event, &error_msg));
   EXPECT_FALSE(error_msg.empty());
@@ -139,13 +139,17 @@ TEST(TouchEventStreamValidator, InvalidPointStates) {
   std::string error_msg;
 
   WebInputEvent::Type kTouchTypes[4] = {
-      WebInputEvent::kTouchStart, WebInputEvent::kTouchMove,
-      WebInputEvent::kTouchEnd, WebInputEvent::kTouchCancel,
+      WebInputEvent::Type::kTouchStart,
+      WebInputEvent::Type::kTouchMove,
+      WebInputEvent::Type::kTouchEnd,
+      WebInputEvent::Type::kTouchCancel,
   };
 
   WebTouchPoint::State kValidTouchPointStatesForType[4] = {
-      WebTouchPoint::kStatePressed, WebTouchPoint::kStateMoved,
-      WebTouchPoint::kStateReleased, WebTouchPoint::kStateCancelled,
+      WebTouchPoint::State::kStatePressed,
+      WebTouchPoint::State::kStateMoved,
+      WebTouchPoint::State::kStateReleased,
+      WebTouchPoint::State::kStateCancelled,
   };
 
   SyntheticWebTouchEvent start;
@@ -158,8 +162,8 @@ TEST(TouchEventStreamValidator, InvalidPointStates) {
     WebTouchEvent event(kTouchTypes[i], WebInputEvent::kNoModifiers,
                         WebInputEvent::GetStaticTimeStampForTests());
     event.touches_length = 1;
-    for (size_t j = WebTouchPoint::kStateUndefined;
-         j <= WebTouchPoint::kStateCancelled; ++j) {
+    for (size_t j = static_cast<size_t>(WebTouchPoint::State::kStateUndefined);
+         j <= static_cast<size_t>(WebTouchPoint::State::kStateCancelled); ++j) {
       event.touches[0].state = static_cast<WebTouchPoint::State>(j);
       if (event.touches[0].state == kValidTouchPointStatesForType[i]) {
         EXPECT_TRUE(validator.Validate(event, &error_msg));
diff --git a/chromium/content/common/input/web_touch_event_traits.cc b/chromium/content/common/input/web_touch_event_traits.cc
index 664c7a39883..db8d1f730a7 100644
--- a/chromium/content/common/input/web_touch_event_traits.cc
+++ b/chromium/content/common/input/web_touch_event_traits.cc
@@ -6,7 +6,8 @@
 
 #include <stddef.h>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
 
 using blink::WebInputEvent;
@@ -29,21 +30,22 @@ bool WebTouchEventTraits::AllTouchPointsHaveState(
 
 bool WebTouchEventTraits::IsTouchSequenceStart(const WebTouchEvent& event) {
   DCHECK(event.touches_length ||
-         event.GetType() == WebInputEvent::kTouchScrollStarted);
-  if (event.GetType() != WebInputEvent::kTouchStart)
+         event.GetType() == WebInputEvent::Type::kTouchScrollStarted);
+  if (event.GetType() != WebInputEvent::Type::kTouchStart)
     return false;
-  return AllTouchPointsHaveState(event, blink::WebTouchPoint::kStatePressed);
+  return AllTouchPointsHaveState(event,
+                                 blink::WebTouchPoint::State::kStatePressed);
 }
 
 bool WebTouchEventTraits::IsTouchSequenceEnd(const WebTouchEvent& event) {
-  if (event.GetType() != WebInputEvent::kTouchEnd &&
-      event.GetType() != WebInputEvent::kTouchCancel)
+  if (event.GetType() != WebInputEvent::Type::kTouchEnd &&
+      event.GetType() != WebInputEvent::Type::kTouchCancel)
     return false;
   if (!event.touches_length)
     return true;
   for (size_t i = 0; i < event.touches_length; ++i) {
-    if (event.touches[i].state != blink::WebTouchPoint::kStateReleased &&
-        event.touches[i].state != blink::WebTouchPoint::kStateCancelled)
+    if (event.touches[i].state != blink::WebTouchPoint::State::kStateReleased &&
+        event.touches[i].state != blink::WebTouchPoint::State::kStateCancelled)
       return false;
   }
   return true;
@@ -53,12 +55,12 @@ void WebTouchEventTraits::ResetType(WebInputEvent::Type type,
                                     base::TimeTicks timestamp,
                                     WebTouchEvent* event) {
   DCHECK(WebInputEvent::IsTouchEventType(type));
-  DCHECK(type != WebInputEvent::kTouchScrollStarted);
+  DCHECK(type != WebInputEvent::Type::kTouchScrollStarted);
 
   event->SetType(type);
-  event->dispatch_type = type == WebInputEvent::kTouchCancel
-                             ? WebInputEvent::kEventNonBlocking
-                             : WebInputEvent::kBlocking;
+  event->dispatch_type = type == WebInputEvent::Type::kTouchCancel
+                             ? WebInputEvent::DispatchType::kEventNonBlocking
+                             : WebInputEvent::DispatchType::kBlocking;
   event->SetTimeStamp(timestamp);
 }
 
@@ -67,19 +69,19 @@ void WebTouchEventTraits::ResetTypeAndTouchStates(WebInputEvent::Type type,
                                                   WebTouchEvent* event) {
   ResetType(type, timestamp, event);
 
-  WebTouchPoint::State newState = WebTouchPoint::kStateUndefined;
+  WebTouchPoint::State newState = WebTouchPoint::State::kStateUndefined;
   switch (event->GetType()) {
-    case WebInputEvent::kTouchStart:
-      newState = WebTouchPoint::kStatePressed;
+    case WebInputEvent::Type::kTouchStart:
+      newState = WebTouchPoint::State::kStatePressed;
       break;
-    case WebInputEvent::kTouchMove:
-      newState = WebTouchPoint::kStateMoved;
+    case WebInputEvent::Type::kTouchMove:
+      newState = WebTouchPoint::State::kStateMoved;
       break;
-    case WebInputEvent::kTouchEnd:
-      newState = WebTouchPoint::kStateReleased;
+    case WebInputEvent::Type::kTouchEnd:
+      newState = WebTouchPoint::State::kStateReleased;
       break;
-    case WebInputEvent::kTouchCancel:
-      newState = WebTouchPoint::kStateCancelled;
+    case WebInputEvent::Type::kTouchCancel:
+      newState = WebTouchPoint::State::kStateCancelled;
       break;
     default:
       NOTREACHED();
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index cb3488b36c6..7f88de656cb 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -13,9 +13,7 @@
 #include "cc/input/overscroll_behavior.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/common/edit_command.h"
 #include "content/common/input/input_event.h"
-#include "content/common/input/input_event_ack.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/common/input/synthetic_gesture_params.h"
 #include "content/common/input/synthetic_pinch_gesture_params.h"
@@ -24,11 +22,10 @@
 #include "content/common/input/synthetic_smooth_drag_gesture_params.h"
 #include "content/common/input/synthetic_smooth_scroll_gesture_params.h"
 #include "content/common/input/synthetic_tap_gesture_params.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "ipc/ipc_message_macros.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/input/web_pointer_properties.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/ipc/ui_events_param_traits_macros.h"
 #include "ui/gfx/geometry/point.h"
@@ -42,8 +39,6 @@
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
-IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventAckSource,
-                          content::InputEventAckSource::MAX_FROM_RENDERER)
 IPC_ENUM_TRAITS_MAX_VALUE(
     content::SyntheticGestureParams::GestureSourceType,
     content::SyntheticGestureParams::GESTURE_SOURCE_TYPE_MAX)
@@ -59,40 +54,6 @@ IPC_ENUM_TRAITS_MAX_VALUE(
     content::SyntheticPointerActionParams::Button::BUTTON_MAX)
 IPC_ENUM_TRAITS_MAX_VALUE(content::InputEventDispatchType,
                           content::InputEventDispatchType::DISPATCH_TYPE_MAX)
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebPointerProperties::Button,
-                              blink::WebPointerProperties::Button::kNoButton,
-                              blink::WebPointerProperties::Button::kMaxValue)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebPointerProperties::PointerType,
-                          blink::WebPointerProperties::PointerType::kMaxValue)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebGestureDevice,
-                          blink::WebGestureDevice::kMaxValue)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebInputEvent::DispatchType,
-                          blink::WebInputEvent::DispatchType::kLastDispatchType)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebGestureEvent::InertialPhaseState,
-                          blink::WebGestureEvent::InertialPhaseState::kMaxValue)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTouchPoint::State,
-                          blink::WebTouchPoint::State::kStateMax)
-IPC_ENUM_TRAITS_MAX_VALUE(
-    cc::OverscrollBehavior::OverscrollBehaviorType,
-    cc::OverscrollBehavior::OverscrollBehaviorType::kOverscrollBehaviorTypeMax)
-
-IPC_STRUCT_TRAITS_BEGIN(ui::DidOverscrollParams)
-  IPC_STRUCT_TRAITS_MEMBER(accumulated_overscroll)
-  IPC_STRUCT_TRAITS_MEMBER(latest_overscroll_delta)
-  IPC_STRUCT_TRAITS_MEMBER(current_fling_velocity)
-  IPC_STRUCT_TRAITS_MEMBER(causal_event_viewport_point)
-  IPC_STRUCT_TRAITS_MEMBER(overscroll_behavior)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(cc::OverscrollBehavior)
-  IPC_STRUCT_TRAITS_MEMBER(x)
-  IPC_STRUCT_TRAITS_MEMBER(y)
-IPC_STRUCT_TRAITS_END()
-
-IPC_STRUCT_TRAITS_BEGIN(content::EditCommand)
-  IPC_STRUCT_TRAITS_MEMBER(name)
-  IPC_STRUCT_TRAITS_MEMBER(value)
-IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(gesture_source_type)
@@ -114,6 +75,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticSmoothScrollGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_x)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_y)
   IPC_STRUCT_TRAITS_MEMBER(granularity)
+  IPC_STRUCT_TRAITS_MEMBER(key_modifiers)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPinchGestureParams)
diff --git a/chromium/content/common/inter_process_time_ticks_converter.cc b/chromium/content/common/inter_process_time_ticks_converter.cc
index 128abab37eb..c18a0e44c4f 100644
--- a/chromium/content/common/inter_process_time_ticks_converter.cc
+++ b/chromium/content/common/inter_process_time_ticks_converter.cc
@@ -6,7 +6,7 @@
 
 #include <algorithm>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/strings/string_number_conversions.h"
 
 namespace content {
diff --git a/chromium/content/common/mac/attributed_string_coder.mm b/chromium/content/common/mac/attributed_string_coder.mm
index 34f2d0e228f..7cb5f404f2c 100644
--- a/chromium/content/common/mac/attributed_string_coder.mm
+++ b/chromium/content/common/mac/attributed_string_coder.mm
@@ -6,7 +6,7 @@
 
 #include <AppKit/AppKit.h>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/common/media/cdm_info.cc b/chromium/content/common/media/cdm_info.cc
index c5480ecff3e..199574d10f6 100644
--- a/chromium/content/common/media/cdm_info.cc
+++ b/chromium/content/common/media/cdm_info.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/common/cdm_info.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 
 namespace content {
 
@@ -13,12 +13,10 @@ CdmCapability::CdmCapability() = default;
 CdmCapability::CdmCapability(
     std::vector<media::VideoCodec> video_codecs,
     base::flat_set<media::EncryptionScheme> encryption_schemes,
-    base::flat_set<media::CdmSessionType> session_types,
-    base::flat_set<media::CdmProxy::Protocol> cdm_proxy_protocols)
+    base::flat_set<media::CdmSessionType> session_types)
     : video_codecs(std::move(video_codecs)),
       encryption_schemes(std::move(encryption_schemes)),
-      session_types(std::move(session_types)),
-      cdm_proxy_protocols(std::move(cdm_proxy_protocols)) {}
+      session_types(std::move(session_types)) {}
 
 CdmCapability::CdmCapability(const CdmCapability& other) = default;
 
diff --git a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
index efa9408afb6..361de5d0d69 100644
--- a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
@@ -9,7 +9,6 @@ import "media/mojo/mojom/audio_input_stream.mojom";
 import "media/mojo/mojom/audio_parameters.mojom";
 import "media/mojo/mojom/media_types.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
-import "services/audio/public/mojom/audio_processing.mojom";
 
 // This interface is used by the renderer to ask the browser to create input
 // streams. The renderer supplies the desired audio parameters, and a client
@@ -21,8 +20,7 @@ interface RendererAudioInputStreamFactory {
       mojo_base.mojom.UnguessableToken session_id,
       media.mojom.AudioParameters params,
       bool automatic_gain_control,
-      uint32 shared_memory_count,
-      audio.mojom.AudioProcessingConfig? processing_config);
+      uint32 shared_memory_count);
 
   // Associates an output device with an input stream, so that the input knows
   // which output device to cancel echo from. |input_stream_id| is the id
diff --git a/chromium/content/common/native_types.mojom b/chromium/content/common/native_types.mojom
index e8015a14e54..9882968f03c 100644
--- a/chromium/content/common/native_types.mojom
+++ b/chromium/content/common/native_types.mojom
@@ -41,39 +41,6 @@ enum NetworkConnectionType;
 struct WebCursor;
 
 [Native]
-enum Button;
-
-[Native]
-enum PointerType;
-
-[Native]
-struct EditCommand;
-
-[Native]
-enum InputEventAckState;
-
-[Native]
-enum InputEventAckSource;
-
-[Native]
-enum EventType;
-
-[Native]
-enum Cancelability;
-
-[Native]
-enum GestureDevice;
-
-[Native]
-enum InertialPhaseState;
-
-[Native]
-enum TouchState;
-
-[Native]
-struct DidOverscrollParams;
-
-[Native]
 struct SyntheticSmoothDrag;
 
 [Native]
diff --git a/chromium/content/common/navigation_params.mojom b/chromium/content/common/navigation_params.mojom
index 385987aa891..f218c7ad9e9 100644
--- a/chromium/content/common/navigation_params.mojom
+++ b/chromium/content/common/navigation_params.mojom
@@ -24,6 +24,9 @@ import "url/mojom/origin.mojom";
 import "url/mojom/url.mojom";
 
 [Native]
+struct Impression;
+
+[Native]
 enum MixedContentContextType;
 
 [Native]
@@ -90,6 +93,12 @@ enum NavigationType {
 // This struct holds parameters sent by the renderer to the browser, that are
 // needed to start a navigation.
 struct BeginNavigationParams {
+  // Routing id of the initiator of the navigation. This routing id may no
+  // longer be valid by the time the navigation is seen by the browser process,
+  // if the initiator frame is deleted before the navigation IPC arrives. A
+  // value of MSG_ROUTING_NONE indicates this navigation is not associated
+  // with a frame.
+  int32 initiator_routing_id;
 
   // Additional HTTP request headers.
   string headers;
@@ -112,7 +121,7 @@ struct BeginNavigationParams {
   // Whether or not the navigation has been initiated by a form submission.
   bool is_form_submission;
 
- // Whether or not the navigation has been initiated by a link click.
+  // Whether or not the navigation has been initiated by a link click.
   bool was_initiated_by_link_click;
 
   // See WebSearchableFormData for a description of these.
@@ -131,19 +140,21 @@ struct BeginNavigationParams {
   mojo_base.mojom.DictionaryValue? devtools_initiator;
 
   // Whether or not this navigation should unconditionally attach SameSite
-  // cookies. At present, this is used for navigations initiated by extensions,
-  // or having an extension as the site_for_cookies, where the extension has
-  // site permission for the requested page. Such requests should be treated as
-  // first-party, hence SameSite cookies should be attached. This param is
-  // necessary to indicate this, since such requests will otherwise appear as if
-  // they were cross-site due to the site_for_cookies and request URL differing.
-  // See the field of the same name in network::ResourceRequest.
-  bool attach_same_site_cookies = false;
+  // cookies, bypassing the usual site_for_cookies checks. Setting this to true
+  // causes SameSite cookies to be attached for cross-site requests (or requests
+  // that "look" cross-site). See the field of the same name in
+  // network::ResourceRequest.
+  bool force_ignore_site_for_cookies = false;
 
   // Specifies whether, and how, the navigation should execute a Trust Tokens
   // operation (https://github.com/wicg/trust-token-api) and attach headers
   // conveying the result of the operation. Set on some child frame navigations.
   network.mojom.TrustTokenParams? trust_token_params;
+
+  // Carries optional information associated with conversion measurement for
+  // this navigation. Only set on navigations originating from anchors with
+  // relevant impression attributes set.
+  Impression? impression;
 };
 
 // Provided by the browser or the renderer -------------------------------------
@@ -192,10 +203,6 @@ struct CommonNavigationParams {
   int32 previews_state;
 
   // The navigationStart time exposed through the Navigation Timing API to JS.
-  // If this is for a browser-initiated navigation, this can override the
-  // navigation_start value in Blink.
-  // For renderer initiated navigations, this will be set on the
-  // renderer side and sent with FrameHost::BeginNavigation.
   mojo_base.mojom.TimeTicks navigation_start;
 
   // The request method: GET, POST, etc.
diff --git a/chromium/content/common/page_messages.h b/chromium/content/common/page_messages.h
index 285c1517ab5..feb245f47a1 100644
--- a/chromium/content/common/page_messages.h
+++ b/chromium/content/common/page_messages.h
@@ -22,9 +22,6 @@
 
 // Messages sent from the browser to the renderer.
 
-// TODO(yuzus): Migrate this as a part of blink::mojom::SetPageLifecycleState.
-IPC_MESSAGE_ROUTED1(PageMsg_VisibilityChanged, content::PageVisibilityState)
-
 // Sent when the history for this page is altered from another process. The
 // history list should be reset to |history_length| length, and the offset
 // should be reset to |history_offset|.
diff --git a/chromium/content/common/pepper_plugin_list.cc b/chromium/content/common/pepper_plugin_list.cc
index 610670e20b2..78f7c5a03e7 100644
--- a/chromium/content/common/pepper_plugin_list.cc
+++ b/chromium/content/common/pepper_plugin_list.cc
@@ -9,6 +9,7 @@
 
 #include "base/command_line.h"
 #include "base/files/file_util.h"
+#include "base/logging.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/common/process_type.cc b/chromium/content/common/process_type.cc
index ebce0e60141..68b121ae6cb 100644
--- a/chromium/content/common/process_type.cc
+++ b/chromium/content/common/process_type.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/common/process_type.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/public/common/content_client.h"
 
 namespace content {
diff --git a/chromium/content/common/profiling_utils.cc b/chromium/content/common/profiling_utils.cc
index 48772eb0cdc..27a22fe8e73 100644
--- a/chromium/content/common/profiling_utils.cc
+++ b/chromium/content/common/profiling_utils.cc
@@ -2,22 +2,31 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/profiling_utils.h"
+#include "content/public/common/profiling_utils.h"
 
+#include <limits>
 #include <memory>
 
 #include "base/base_paths.h"
+#include "base/bind.h"
+#include "base/callback_forward.h"
+#include "base/clang_profiling_buildflags.h"
 #include "base/environment.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
+#include "base/guid.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/rand_util.h"
+#include "base/run_loop.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/synchronization/waitable_event.h"
+#include "base/task/task_traits.h"
+#include "base/task/thread_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
 
@@ -62,5 +71,47 @@ base::File OpenProfilingFile() {
 
   return file;
 }
+WaitForProcessesToDumpProfilingInfo::WaitForProcessesToDumpProfilingInfo() =
+    default;
+WaitForProcessesToDumpProfilingInfo::~WaitForProcessesToDumpProfilingInfo() =
+    default;
+
+void WaitForProcessesToDumpProfilingInfo::WaitForAll() {
+  base::RunLoop nested_run_loop(base::RunLoop::Type::kNestableTasksAllowed);
+
+  // Some of the waitable events will be signaled on the main thread, use a
+  // nested run loop to ensure we're not preventing them from signaling.
+  base::ThreadPool::PostTask(
+      FROM_HERE, {base::MayBlock(), base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
+      base::BindOnce(
+          &WaitForProcessesToDumpProfilingInfo::WaitForAllOnThreadPool,
+          base::Unretained(this), nested_run_loop.QuitClosure()));
+  nested_run_loop.Run();
+}
+
+void WaitForProcessesToDumpProfilingInfo::WaitForAllOnThreadPool(
+    base::OnceClosure quit_closure) {
+  base::ScopedAllowBaseSyncPrimitivesOutsideBlockingScope allow_blocking;
+
+  std::vector<base::WaitableEvent*> events_raw;
+  events_raw.reserve(events_.size());
+  for (const auto& iter : events_)
+    events_raw.push_back(iter.get());
+
+  // Wait for all the events to be signaled.
+  while (events_raw.size()) {
+    size_t index =
+        base::WaitableEvent::WaitMany(events_raw.data(), events_raw.size());
+    events_raw.erase(events_raw.begin() + index);
+  }
+
+  std::move(quit_closure).Run();
+}
+
+base::WaitableEvent*
+WaitForProcessesToDumpProfilingInfo::GetNewWaitableEvent() {
+  events_.push_back(std::make_unique<base::WaitableEvent>());
+  return events_.back().get();
+}
 
 }  // namespace content
diff --git a/chromium/content/common/profiling_utils.h b/chromium/content/common/profiling_utils.h
deleted file mode 100644
index f9e6e17b376..00000000000
--- a/chromium/content/common/profiling_utils.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_PROFILING_UTILS_H_
-#define CONTENT_COMMON_PROFILING_UTILS_H_
-
-#include <string>
-
-#include "base/files/file.h"
-
-namespace content {
-
-base::File OpenProfilingFile();
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_PROFILING_UTILS_H_
diff --git a/chromium/content/common/render_widget_host_ns_view.mojom b/chromium/content/common/render_widget_host_ns_view.mojom
index 861cbd7b8f8..8a5b18a4261 100644
--- a/chromium/content/common/render_widget_host_ns_view.mojom
+++ b/chromium/content/common/render_widget_host_ns_view.mojom
@@ -8,6 +8,7 @@ import "content/common/native_types.mojom";
 import "content/common/input/input_handler.mojom";
 import "mojo/public/mojom/base/string16.mojom";
 import "ui/base/ime/mojom/ime_types.mojom";
+import "third_party/blink/public/mojom/input/input_handler.mojom";
 import "ui/display/mojom/display.mojom";
 import "ui/events/mojom/event.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
@@ -140,7 +141,7 @@ interface RenderWidgetHostNSViewHost {
       content.mojom.Event event,
       array<uint8> native_event_data,
       bool skip_in_browser,
-      array<content.mojom.EditCommand> commands);
+      array<blink.mojom.EditCommand> commands);
 
   // Forward events to the renderer or the input router, as appropriate.
   RouteOrProcessMouseEvent(content.mojom.Event event);
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 1c5b3e1ae82..309746baa6e 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -63,6 +63,13 @@ struct CreateViewParams {
   // is None (due to site isolation), or a RenderFrame in all other cases.
   FrameReplicationState replicated_frame_state;
 
+  // This represents the frame token for the MainFrame. It will be always set.
+  // If |main_frame_routing_id| is set, it will store a unique identifier for
+  // the  LocalFrame<-->RenderFrameHostImpl mapping.
+  // If |proxy_routing_id| is set, it will store a unique identifier for
+  // the RemoteFrame<-->RenderFrameProxyHost mapping.
+  mojo_base.mojom.UnguessableToken main_frame_frame_token;
+
   // Used for devtools instrumentation and trace-ability. The token is
   // propagated to Blink's LocalFrame and both Blink and content/
   // can tag calls and requests with this instrumentation token in order to
@@ -132,6 +139,10 @@ struct CreateFrameParams {
   // commit.
   int32 previous_routing_id;
 
+  // The frame token. It is a unique identifier for
+  // the LocalFrame<-->RenderFrameHostImpl mapping.
+  mojo_base.mojom.UnguessableToken frame_token;
+
   // Specifies the new frame's opener.  The opener will be null if this is
   // MSG_ROUTING_NONE.
   int32 opener_routing_id;
@@ -240,12 +251,15 @@ interface Renderer {
   // is MSG_ROUTING_NONE.  The new proxy should be created as a child of the
   // object identified by |parent_routing_id| or as top level if that is
   // MSG_ROUTING_NONE.
+  // |proxy_frame_token| is used uniquely identify the
+  // RemoteFrame <--> RenderFrameProxyHost mapping.
   // |devtools_frame_token| is used for devtools instrumentation
   // and trace-ability. It is defined by the browser and is never
   // sent back from the renderer in the control calls.
   CreateFrameProxy(int32 routing_id, int32 render_view_routing_id,
                    int32 opener_routing_id, int32 parent_routing_id,
                    FrameReplicationState replication_state,
+                   mojo_base.mojom.UnguessableToken proxy_frame_token,
                    mojo_base.mojom.UnguessableToken devtools_frame_token);
 
   // Tells the renderer that the network type has changed so that
@@ -316,4 +330,9 @@ interface Renderer {
   // If a main frame exists or is created, the low memory mode will
   // be disabled.
   EnableV8LowMemoryMode();
+
+  // Write out the accumulated code profiling profile to the configured file.
+  // The callback is invoked once the profile has been flushed to disk.
+  [EnableIf=clang_profiling_inside_sandbox]
+  WriteClangProfilingProfile() => ();
 };
diff --git a/chromium/content/common/renderer_host.mojom b/chromium/content/common/renderer_host.mojom
index 67bf20a5fc8..197255e17cc 100644
--- a/chromium/content/common/renderer_host.mojom
+++ b/chromium/content/common/renderer_host.mojom
@@ -4,6 +4,8 @@
 
 module content.mojom;
 
+import "url/mojom/url.mojom";
+
 // The primordial interface implemented by a render process host. This should be
 // used for implementing renderer-to-browser messages.
 interface RendererHost {
@@ -21,4 +23,9 @@ interface RendererHost {
 
   // Sends a string to be recorded by UserMetrics.
   RecordUserMetricsAction(string action);
+
+  // Gets the list of proxies to use for |url|, as a semicolon delimited list
+  // of "<TYPE> <HOST>:<PORT>" | "DIRECT".
+  [Sync]
+  ResolveProxy(url.mojom.Url url) => (string? proxy_list);
 };
diff --git a/chromium/content/common/sandbox_init_mac.cc b/chromium/content/common/sandbox_init_mac.cc
index 525247ac10e..e681cf87b12 100644
--- a/chromium/content/common/sandbox_init_mac.cc
+++ b/chromium/content/common/sandbox_init_mac.cc
@@ -5,9 +5,9 @@
 #include "content/public/common/sandbox_init.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "gpu/config/gpu_feature_info.h"
 #include "gpu/config/gpu_info.h"
 #include "gpu/config/gpu_info_collector.h"
@@ -92,7 +92,7 @@ bool GetSandboxTypeFromCommandLine(service_manager::SandboxType* sandbox_type) {
     return false;
   }
 
-  return *sandbox_type != service_manager::SandboxType::kInvalid;
+  return true;
 }
 
 }  // namespace
@@ -105,7 +105,7 @@ bool InitializeSandbox(service_manager::SandboxType sandbox_type) {
 
 bool InitializeSandbox(base::OnceClosure post_warmup_hook) {
   service_manager::SandboxType sandbox_type =
-      service_manager::SandboxType::kInvalid;
+      service_manager::SandboxType::kNoSandbox;
   return !GetSandboxTypeFromCommandLine(&sandbox_type) ||
          service_manager::Sandbox::Initialize(
              sandbox_type, MaybeWrapWithGPUSandboxHook(
diff --git a/chromium/content/common/sandbox_init_win.cc b/chromium/content/common/sandbox_init_win.cc
index 3abd91344de..e363bd25a6e 100644
--- a/chromium/content/common/sandbox_init_win.cc
+++ b/chromium/content/common/sandbox_init_win.cc
@@ -7,7 +7,6 @@
 #include <string>
 
 #include "base/base_switches.h"
-#include "base/logging.h"
 #include "base/trace_event/trace_event.h"
 #include "base/win/scoped_process_information.h"
 #include "content/public/common/content_switches.h"
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.cc b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
index 35b3053acd5..8f2ac0aff55 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
@@ -11,15 +11,9 @@
 #include <vector>
 
 #include "base/strings/stringprintf.h"
-#include "content/public/common/content_features.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/http/http_util.h"
-#include "net/http/structured_headers.h"
 #include "net/url_request/redirect_util.h"
-#include "services/network/public/cpp/content_security_policy/content_security_policy.h"
-#include "services/network/public/cpp/cross_origin_embedder_policy.h"
-#include "services/network/public/cpp/cross_origin_opener_policy_parser.h"
-#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
@@ -49,37 +43,6 @@ class BlobCompleteCaller : public blink::mojom::BlobReaderClient {
   BlobCompleteCallback callback_;
 };
 
-std::pair<network::mojom::CrossOriginEmbedderPolicyValue,
-          base::Optional<std::string>>
-ParseCrossOriginEmbedderPolicyValueInternal(
-    const net::HttpResponseHeaders* headers,
-    base::StringPiece header_name) {
-  static constexpr char kRequireCorp[] = "require-corp";
-  constexpr auto kNone = network::mojom::CrossOriginEmbedderPolicyValue::kNone;
-  using Item = net::structured_headers::Item;
-  std::string header_value;
-  if (!headers ||
-      !headers->GetNormalizedHeader(header_name.as_string(), &header_value)) {
-    return std::make_pair(kNone, base::nullopt);
-  }
-  const auto item = net::structured_headers::ParseItem(header_value);
-  if (!item || item->item.Type() != Item::kTokenType ||
-      item->item.GetString() != kRequireCorp) {
-    return std::make_pair(kNone, base::nullopt);
-  }
-  base::Optional<std::string> endpoint;
-  auto it = std::find_if(item->params.cbegin(), item->params.cend(),
-                         [](const std::pair<std::string, Item>& param) {
-                           return param.first == "report-to";
-                         });
-  if (it != item->params.end() && it->second.Type() == Item::kStringType) {
-    endpoint = it->second.GetString();
-  }
-  return std::make_pair(
-      network::mojom::CrossOriginEmbedderPolicyValue::kRequireCorp,
-      std::move(endpoint));
-}
-
 }  // namespace
 
 // static
@@ -123,44 +86,6 @@ void ServiceWorkerLoaderHelpers::SaveResponseHeaders(
   // headers.
   if (out_head->content_length == -1)
     out_head->content_length = out_head->headers->GetContentLength();
-
-  // TODO(yhirano): Remove the code duplication with
-  // //services/network/url_loader.cc.
-  if (base::FeatureList::IsEnabled(
-          network::features::kCrossOriginEmbedderPolicy)) {
-    // Parse the Cross-Origin-Embedder-Policy and
-    // Cross-Origin-Embedder-Policy-Report-Only headers.
-
-    static constexpr char kCrossOriginEmbedderPolicyValueHeader[] =
-        "Cross-Origin-Embedder-Policy";
-    static constexpr char kCrossOriginEmbedderPolicyValueReportOnlyHeader[] =
-        "Cross-Origin-Embedder-Policy-Report-Only";
-    network::CrossOriginEmbedderPolicy coep;
-    std::tie(coep.value, coep.reporting_endpoint) =
-        ParseCrossOriginEmbedderPolicyValueInternal(
-            out_head->headers.get(), kCrossOriginEmbedderPolicyValueHeader);
-    std::tie(coep.report_only_value, coep.report_only_reporting_endpoint) =
-        ParseCrossOriginEmbedderPolicyValueInternal(
-            out_head->headers.get(),
-            kCrossOriginEmbedderPolicyValueReportOnlyHeader);
-    out_head->cross_origin_embedder_policy = coep;
-  }
-
-  // TODO(pmeuleman): Remove the code duplication with
-  // //services/network/url_loader.cc.
-  if (base::FeatureList::IsEnabled(
-          network::features::kCrossOriginOpenerPolicy)) {
-    // Parse the Cross-Origin-Opener-Policy header.
-    constexpr char kCrossOriginOpenerPolicyHeader[] =
-        "Cross-Origin-Opener-Policy";
-    std::string raw_coop_string;
-    if (out_head->headers &&
-        out_head->headers->GetNormalizedHeader(kCrossOriginOpenerPolicyHeader,
-                                               &raw_coop_string)) {
-      out_head->cross_origin_opener_policy =
-          network::ParseCrossOriginOpenerPolicyHeader(raw_coop_string);
-    }
-  }
 }
 
 // static
@@ -181,8 +106,7 @@ void ServiceWorkerLoaderHelpers::SaveResponseInfo(
     out_head->cache_storage_cache_name.clear();
   out_head->cors_exposed_header_names = response.cors_exposed_header_names;
   out_head->did_service_worker_navigation_preload = false;
-  out_head->content_security_policy =
-      mojo::Clone(response.content_security_policy);
+  out_head->parsed_headers = mojo::Clone(response.parsed_headers);
 }
 
 // static
diff --git a/chromium/content/common/service_worker/service_worker_utils.cc b/chromium/content/common/service_worker/service_worker_utils.cc
index 8ae4eb596dc..91f1a64250b 100644
--- a/chromium/content/common/service_worker/service_worker_utils.cc
+++ b/chromium/content/common/service_worker/service_worker_utils.cc
@@ -4,9 +4,10 @@
 
 #include "content/common/service_worker/service_worker_utils.h"
 
+#include "base/check.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/numerics/safe_math.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/content_features.h"
@@ -235,8 +236,9 @@ const char* ServiceWorkerUtils::FetchResponseSourceToSuffix(
 }
 
 ServiceWorkerUtils::ResourceResponseHeadAndMetadata::
-    ResourceResponseHeadAndMetadata(network::mojom::URLResponseHeadPtr head,
-                                    std::vector<uint8_t> metadata)
+    ResourceResponseHeadAndMetadata(
+        network::mojom::URLResponseHeadPtr head,
+        scoped_refptr<net::IOBufferWithSize> metadata)
     : head(std::move(head)), metadata(std::move(metadata)) {}
 
 ServiceWorkerUtils::ResourceResponseHeadAndMetadata::
@@ -254,6 +256,7 @@ ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
     base::TimeTicks response_start_time,
     int response_data_size) {
   DCHECK(http_info);
+  DCHECK(http_info->headers);
 
   auto head = network::mojom::URLResponseHead::New();
   head->request_start = request_start_time;
@@ -274,13 +277,7 @@ ServiceWorkerUtils::CreateResourceResponseHeadAndMetadata(
   if (options & network::mojom::kURLLoadOptionSendSSLInfoWithResponse)
     head->ssl_info = http_info->ssl_info;
 
-  std::vector<uint8_t> metadata;
-  if (http_info->metadata) {
-    const uint8_t* data =
-        reinterpret_cast<const uint8_t*>(http_info->metadata->data());
-    metadata = {data, data + http_info->metadata->size()};
-  }
-  return {std::move(head), std::move(metadata)};
+  return {std::move(head), std::move(http_info->metadata)};
 }
 
 bool LongestScopeMatcher::MatchLongest(const GURL& scope) {
diff --git a/chromium/content/common/service_worker/service_worker_utils.h b/chromium/content/common/service_worker/service_worker_utils.h
index 8f09616e767..36955b209cc 100644
--- a/chromium/content/common/service_worker/service_worker_utils.h
+++ b/chromium/content/common/service_worker/service_worker_utils.h
@@ -75,15 +75,16 @@ class ServiceWorkerUtils {
       network::mojom::FetchResponseSource source);
 
   struct CONTENT_EXPORT ResourceResponseHeadAndMetadata {
-    ResourceResponseHeadAndMetadata(network::mojom::URLResponseHeadPtr head,
-                                    std::vector<uint8_t> metadata);
+    ResourceResponseHeadAndMetadata(
+        network::mojom::URLResponseHeadPtr head,
+        scoped_refptr<net::IOBufferWithSize> metadata);
     ResourceResponseHeadAndMetadata(ResourceResponseHeadAndMetadata&& other);
     ResourceResponseHeadAndMetadata(
         const ResourceResponseHeadAndMetadata& other) = delete;
     ~ResourceResponseHeadAndMetadata();
 
     network::mojom::URLResponseHeadPtr head;
-    std::vector<uint8_t> metadata;
+    scoped_refptr<net::IOBufferWithSize> metadata;
   };
 
   CONTENT_EXPORT static ResourceResponseHeadAndMetadata
diff --git a/chromium/content/common/text_input_client_messages.h b/chromium/content/common/text_input_client_messages.h
index c8c8c8e8bb0..17fff0a6442 100644
--- a/chromium/content/common/text_input_client_messages.h
+++ b/chromium/content/common/text_input_client_messages.h
@@ -25,14 +25,6 @@
 // corresponding reply message.
 ////////////////////////////////////////////////////////////////////////////////
 
-// Tells the renderer to send back the character index for a point.
-IPC_MESSAGE_ROUTED1(TextInputClientMsg_CharacterIndexForPoint,
-                    gfx::Point)
-
-// Tells the renderer to send back the rectangle for a given character range.
-IPC_MESSAGE_ROUTED1(TextInputClientMsg_FirstRectForCharacterRange,
-                    gfx::Range)
-
 // Tells the renderer to send back the text fragment in a given range.
 IPC_MESSAGE_ROUTED1(TextInputClientMsg_StringForRange,
                     gfx::Range)
@@ -47,14 +39,6 @@ IPC_MESSAGE_ROUTED1(TextInputClientMsg_StringAtPoint, gfx::Point)
 // These messages are sent in reply to the above messages.
 ////////////////////////////////////////////////////////////////////////////////
 
-// Reply message for TextInputClientMsg_CharacterIndexForPoint.
-IPC_MESSAGE_ROUTED1(TextInputClientReplyMsg_GotCharacterIndexForPoint,
-                    uint32_t /* character index */)
-
-// Reply message for TextInputClientMsg_FirstRectForCharacterRange.
-IPC_MESSAGE_ROUTED1(TextInputClientReplyMsg_GotFirstRectForRange,
-                    gfx::Rect /* frame rectangle */)
-
 #if defined(OS_MACOSX)
 // Reply message for TextInputClientMsg_StringForRange.
 IPC_MESSAGE_ROUTED2(TextInputClientReplyMsg_GotStringForRange,
diff --git a/chromium/content/common/unfreezable_frame_messages.h b/chromium/content/common/unfreezable_frame_messages.h
index 35356561620..78d56781543 100644
--- a/chromium/content/common/unfreezable_frame_messages.h
+++ b/chromium/content/common/unfreezable_frame_messages.h
@@ -20,12 +20,13 @@
 
 #define IPC_MESSAGE_START UnfreezableFrameMsgStart
 
-// Unload this RenderFrame and potentially replace it by a RenderFrameProxy, so
+// Unload this RenderFrame and replace it by a RenderFrameProxy, so
 // the frame can navigate to a document rendered by a different process.
-IPC_MESSAGE_ROUTED3(UnfreezableFrameMsg_Unload,
+IPC_MESSAGE_ROUTED4(UnfreezableFrameMsg_Unload,
                     int /* proxy_routing_id */,
                     bool /* is_loading */,
-                    content::FrameReplicationState /* replication_state */)
+                    content::FrameReplicationState /* replication_state */,
+                    base::UnguessableToken /*proxy_frame_token*/)
 
 // Instructs the renderer to delete the RenderFrame.
 IPC_MESSAGE_ROUTED1(UnfreezableFrameMsg_Delete, content::FrameDeleteIntention)
diff --git a/chromium/content/common/unique_name_helper.cc b/chromium/content/common/unique_name_helper.cc
index f372bd0a4b7..1664eac9b8f 100644
--- a/chromium/content/common/unique_name_helper.cc
+++ b/chromium/content/common/unique_name_helper.cc
@@ -7,7 +7,8 @@
 #include <algorithm>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
+#include "base/notreached.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
diff --git a/chromium/content/common/url_schemes.cc b/chromium/content/common/url_schemes.cc
index d0a31f2406e..c00901a2a4e 100644
--- a/chromium/content/common/url_schemes.cc
+++ b/chromium/content/common/url_schemes.cc
@@ -69,6 +69,7 @@ void RegisterContentSchemes() {
   for (auto& scheme : schemes.referrer_schemes)
     url::AddReferrerScheme(scheme.c_str(), url::SCHEME_WITH_HOST);
 
+  schemes.secure_schemes.push_back(kChromeDevToolsScheme);
   schemes.secure_schemes.push_back(kChromeUIScheme);
   schemes.secure_schemes.push_back(kChromeUIUntrustedScheme);
   schemes.secure_schemes.push_back(kChromeErrorScheme);
diff --git a/chromium/content/common/user_agent.cc b/chromium/content/common/user_agent.cc
index 954209bd8cc..80d658a1906 100644
--- a/chromium/content/common/user_agent.cc
+++ b/chromium/content/common/user_agent.cc
@@ -7,7 +7,7 @@
 #include <stdint.h>
 
 #include "base/feature_list.h"
-#include "base/logging.h"
+#include "base/strings/strcat.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
@@ -24,11 +24,6 @@ namespace content {
 
 namespace {
 
-#if defined(OS_ANDROID)
-const base::Feature kAndroidUserAgentStringContainsBuildId{
-    "AndroidUserAgentStringContainsBuildId", base::FEATURE_DISABLED_BY_DEFAULT};
-#endif  // defined(OS_ANDROID)
-
 std::string GetUserAgentPlatform() {
 #if defined(OS_WIN)
   return "";
@@ -61,7 +56,7 @@ std::string GetWebKitRevision() {
 }
 
 std::string BuildCpuInfo() {
-  std::string cpuinfo = "";
+  std::string cpuinfo;
 
 #if defined(OS_MACOSX)
   cpuinfo = "Intel";
@@ -94,7 +89,36 @@ std::string BuildCpuInfo() {
   return cpuinfo;
 }
 
-std::string GetOSVersion(bool include_android_build_number) {
+// Return the CPU architecture in Linux or Windows and the empty string
+// elsewhere.
+std::string GetLowEntropyCpuArchitecture() {
+#if !defined(OS_MACOSX) && !defined(OS_ANDROID) && defined(OS_POSIX)
+  // This extra cpu_info_str variable is required to make sure the compiler
+  // doesn't optimize the copy away and have the StringPiece point at the
+  // internal std::string, resulting in a memory violation.
+  std::string cpu_info_str = BuildCpuInfo();
+  base::StringPiece cpu_info = cpu_info_str;
+  if (cpu_info.starts_with("arm") || cpu_info.starts_with("aarch")) {
+    return "arm";
+  } else if ((cpu_info.starts_with("i") && cpu_info.substr(2, 2) == "86") ||
+             cpu_info.starts_with("x86")) {
+    return "x86";
+  }
+#elif defined(OS_WIN)
+  base::win::OSInfo::WindowsArchitecture windows_architecture =
+      base::win::OSInfo::GetInstance()->GetArchitecture();
+  if (windows_architecture == base::win::OSInfo::ARM64_ARCHITECTURE) {
+    return "arm";
+  } else if ((windows_architecture == base::win::OSInfo::X86_ARCHITECTURE) ||
+             (windows_architecture == base::win::OSInfo::X64_ARCHITECTURE)) {
+    return "x86";
+  }
+#endif
+  return std::string();
+}
+
+std::string GetOSVersion(IncludeAndroidBuildNumber include_android_build_number,
+                         IncludeAndroidModel include_android_model) {
   std::string os_version;
 #if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
   int32_t os_major_version = 0;
@@ -106,12 +130,13 @@ std::string GetOSVersion(bool include_android_build_number) {
 
 #if defined(OS_ANDROID)
   std::string android_version_str = base::SysInfo::OperatingSystemVersion();
-  std::string android_info_str = GetAndroidOSInfo(include_android_build_number);
+  std::string android_info_str =
+      GetAndroidOSInfo(include_android_build_number, include_android_model);
 #endif
 
   base::StringAppendF(&os_version,
 #if defined(OS_WIN)
-                      "%d.%d; ", os_major_version, os_minor_version
+                      "%d.%d", os_major_version, os_minor_version
 #elif defined(OS_MACOSX)
                       "%d_%d_%d", os_major_version, os_minor_version,
                       os_bugfix_version
@@ -128,9 +153,16 @@ std::string GetOSVersion(bool include_android_build_number) {
   return os_version;
 }
 
-std::string BuildOSCpuInfo(bool include_android_build_number) {
-  std::string cputype = BuildCpuInfo();
-  std::string os_version = GetOSVersion(include_android_build_number);
+std::string BuildOSCpuInfo(
+    IncludeAndroidBuildNumber include_android_build_number,
+    IncludeAndroidModel include_android_model) {
+  return BuildOSCpuInfoFromOSVersionAndCpuType(
+      GetOSVersion(include_android_build_number, include_android_model),
+      BuildCpuInfo());
+}
+
+std::string BuildOSCpuInfoFromOSVersionAndCpuType(const std::string& os_version,
+                                                  const std::string& cpu_type) {
   std::string os_cpu;
 
 #if !defined(OS_ANDROID) && defined(OS_POSIX) && !defined(OS_MACOSX)
@@ -139,15 +171,20 @@ std::string BuildOSCpuInfo(bool include_android_build_number) {
   uname(&unixinfo);
 #endif
 
-  base::StringAppendF(&os_cpu,
 #if defined(OS_WIN)
-                      "Windows NT %s%s", os_version.c_str(), cputype.c_str()
-#elif defined(OS_MACOSX)
-                      "%s Mac OS X %s", cputype.c_str(), os_version.c_str()
+  if (!cpu_type.empty())
+    base::StringAppendF(&os_cpu, "Windows NT %s; %s", os_version.c_str(),
+                        cpu_type.c_str());
+  else
+    base::StringAppendF(&os_cpu, "Windows NT %s", os_version.c_str());
+#else
+  base::StringAppendF(&os_cpu,
+#if defined(OS_MACOSX)
+                      "%s Mac OS X %s", cpu_type.c_str(), os_version.c_str()
 #elif defined(OS_CHROMEOS)
                       "CrOS "
                       "%s %s",
-                      cputype.c_str(),  // e.g. i686
+                      cpu_type.c_str(),  // e.g. i686
                       os_version.c_str()
 #elif defined(OS_ANDROID)
                       "Android %s", os_version.c_str()
@@ -156,9 +193,10 @@ std::string BuildOSCpuInfo(bool include_android_build_number) {
 #elif defined(OS_POSIX)
                       "%s %s",
                       unixinfo.sysname,  // e.g. Linux
-                      cputype.c_str()    // e.g. i686
+                      cpu_type.c_str()   // e.g. i686
 #endif
   );
+#endif
 
   return os_cpu;
 }
@@ -178,12 +216,14 @@ std::string GetFrozenUserAgent(bool mobile, std::string major_version) {
 std::string BuildUserAgentFromProduct(const std::string& product) {
   std::string os_info;
   base::StringAppendF(&os_info, "%s%s", GetUserAgentPlatform().c_str(),
-                      BuildOSCpuInfo(false).c_str());
+                      BuildOSCpuInfo(IncludeAndroidBuildNumber::Exclude,
+                                     IncludeAndroidModel::Include)
+                          .c_str());
   return BuildUserAgentFromOSAndProduct(os_info, product);
 }
 
 std::string BuildModelInfo() {
-  std::string model = "";
+  std::string model;
 #if defined(OS_ANDROID)
   // Only send the model information if on the release build of Android,
   // matching user agent behaviour.
@@ -197,28 +237,32 @@ std::string BuildModelInfo() {
 std::string BuildUserAgentFromProductAndExtraOSInfo(
     const std::string& product,
     const std::string& extra_os_info,
-    bool include_android_build_number) {
+    IncludeAndroidBuildNumber include_android_build_number) {
   std::string os_info;
-  base::StringAppendF(&os_info, "%s%s%s", GetUserAgentPlatform().c_str(),
-                      BuildOSCpuInfo(include_android_build_number).c_str(),
-                      extra_os_info.c_str());
+  base::StrAppend(&os_info, {GetUserAgentPlatform(),
+                             BuildOSCpuInfo(include_android_build_number,
+                                            IncludeAndroidModel::Include),
+                             extra_os_info});
   return BuildUserAgentFromOSAndProduct(os_info, product);
 }
 
-std::string GetAndroidOSInfo(bool include_android_build_number) {
+std::string GetAndroidOSInfo(
+    IncludeAndroidBuildNumber include_android_build_number,
+    IncludeAndroidModel include_android_model) {
   std::string android_info_str;
 
   // Send information about the device.
   bool semicolon_inserted = false;
-  std::string android_device_name = BuildModelInfo();
-  if (!android_device_name.empty()) {
-    android_info_str += "; " + android_device_name;
-    semicolon_inserted = true;
+  if (include_android_model == IncludeAndroidModel::Include) {
+    std::string android_device_name = BuildModelInfo();
+    if (!android_device_name.empty()) {
+      android_info_str += "; " + android_device_name;
+      semicolon_inserted = true;
+    }
   }
 
   // Append the build ID.
-  if (base::FeatureList::IsEnabled(kAndroidUserAgentStringContainsBuildId) ||
-      include_android_build_number) {
+  if (include_android_build_number == IncludeAndroidBuildNumber::Include) {
     std::string android_build_id = base::SysInfo::GetAndroidBuildID();
     if (!android_build_id.empty()) {
       if (!semicolon_inserted)
diff --git a/chromium/content/common/user_agent_unittest.cc b/chromium/content/common/user_agent_unittest.cc
new file mode 100644
index 00000000000..f8cd41abced
--- /dev/null
+++ b/chromium/content/common/user_agent_unittest.cc
@@ -0,0 +1,128 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/user_agent.h"
+
+#include "build/build_config.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+struct BuildOSCpuInfoTestCases {
+  std::string os_version;
+  std::string cpu_type;
+  std::string expected_os_cpu_info;
+};
+
+}  // namespace
+
+TEST(UserAgentStringTest, BuildOSCpuInfoFromOSVersionAndCpuType) {
+  const BuildOSCpuInfoTestCases test_cases[] = {
+#if defined(OS_WIN)
+    // On Windows, it's possible to have an empty string for CPU type.
+    {
+        /*os_version=*/"10.0",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/"Windows NT 10.0",
+    },
+    {
+        /*os_version=*/"10.0",
+        /*cpu_type=*/"WOW64",
+        /*expected_os_cpu_info=*/"Windows NT 10.0; WOW64",
+    },
+    {
+        /*os_version=*/"10.0",
+        /*cpu_type=*/"Win64; x64",
+        /*expected_os_cpu_info=*/"Windows NT 10.0; Win64; x64",
+    },
+    {
+        /*os_version=*/"7.0",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/"Windows NT 7.0",
+    },
+    // These cases should never happen in real life, but may be useful to detect
+    // changes when things are refactored.
+    {
+        /*os_version=*/"",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/"Windows NT ",
+    },
+    {
+        /*os_version=*/"VERSION",
+        /*cpu_type=*/"CPU TYPE",
+        /*expected_os_cpu_info=*/"Windows NT VERSION; CPU TYPE",
+    },
+#elif defined(OS_MACOSX)
+    {
+        /*os_version=*/"10_15_4",
+        /*cpu_type=*/"Intel",
+        /*expected_os_cpu_info=*/"Intel Mac OS X 10_15_4",
+    },
+    // These cases should never happen in real life, but may be useful to detect
+    // changes when things are refactored.
+    {
+        /*os_version=*/"",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/" Mac OS X ",
+    },
+    {
+        /*os_version=*/"VERSION",
+        /*cpu_type=*/"CPU TYPE",
+        /*expected_os_cpu_info=*/"CPU TYPE Mac OS X VERSION",
+    },
+#elif defined(OS_CHROMEOS)
+    {
+        /*os_version=*/"4537.56.0",
+        /*cpu_type=*/"armv7l",
+        /*expected_os_cpu_info=*/"CrOS armv7l 4537.56.0",
+    },
+    // These cases should never happen in real life, but may be useful to detect
+    // changes when things are refactored.
+    {
+        /*os_version=*/"",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/"CrOS  ",
+    },
+    {
+        /*os_version=*/"VERSION",
+        /*cpu_type=*/"CPU TYPE",
+        /*expected_os_cpu_info=*/"CrOS CPU TYPE VERSION",
+    },
+#elif defined(OS_ANDROID)
+    {
+        /*os_version=*/"7.1.1",
+        /*cpu_type=*/"UNUSED",
+        /*expected_os_cpu_info=*/"Android 7.1.1",
+    },
+    // These cases should never happen in real life, but may be useful to detect
+    // changes when things are refactored.
+    {
+        /*os_version=*/"",
+        /*cpu_type=*/"",
+        /*expected_os_cpu_info=*/"Android ",
+    },
+    {
+        /*os_version=*/"VERSION",
+        /*cpu_type=*/"CPU TYPE",
+        /*expected_os_cpu_info=*/"Android VERSION",
+    },
+#elif defined(OS_FUCHSIA)
+    {
+        /*os_version=*/"VERSION",
+        /*cpu_type=*/"CPU TYPE",
+        /*expected_os_cpu_info=*/"Fuchsia",
+    },
+#endif
+  };
+
+  for (const auto& test_case : test_cases) {
+    const std::string os_cpu_info = BuildOSCpuInfoFromOSVersionAndCpuType(
+        test_case.os_version, test_case.cpu_type);
+    EXPECT_EQ(os_cpu_info, test_case.expected_os_cpu_info);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index b75aee16237..85a8c7e9e28 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -42,7 +42,6 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
-#include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
 #include "ui/base/ime/text_input_type.h"
 #include "ui/gfx/color_space.h"
 #include "ui/gfx/geometry/point.h"
@@ -147,13 +146,6 @@ IPC_MESSAGE_ROUTED1(ViewHostMsg_UpdateTargetURL,
 
 IPC_MESSAGE_ROUTED0(ViewHostMsg_Focus)
 
-// Get the list of proxies to use for |url|, as a semicolon delimited list
-// of "<TYPE> <HOST>:<PORT>" | "DIRECT".
-IPC_SYNC_MESSAGE_CONTROL1_2(ViewHostMsg_ResolveProxy,
-                            GURL /* url */,
-                            bool /* result */,
-                            std::string /* proxy list */)
-
 #if BUILDFLAG(ENABLE_PLUGINS)
 // A renderer sends this to the browser process when it wants to access a PPAPI
 // broker. In contrast to FrameHostMsg_OpenChannelToPpapiBroker, this is called
@@ -171,10 +163,6 @@ IPC_MESSAGE_ROUTED3(ViewHostMsg_RequestPpapiBrokerPermission,
 IPC_MESSAGE_ROUTED1(ViewHostMsg_TakeFocus,
                     bool /* reverse */)
 
-IPC_MESSAGE_ROUTED1(
-    ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame,
-    blink::WebTextAutosizerPageInfo /* page_info */)
-
 // Adding a new message? Stick to the sort order above: first platform
 // independent ViewMsg, then ifdefs for platform specific ViewMsg, then platform
 // independent ViewHostMsg, then ifdefs for platform specific ViewHostMsg.
diff --git a/chromium/content/common/widget_messages.h b/chromium/content/common/widget_messages.h
index dfc28946d2e..ae6969230d7 100644
--- a/chromium/content/common/widget_messages.h
+++ b/chromium/content/common/widget_messages.h
@@ -13,7 +13,6 @@
 #include "content/common/common_param_traits_macros.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/content_to_visible_time_reporter.h"
-#include "content/common/cursors/webcursor.h"
 #include "content/common/text_input_state.h"
 #include "content/common/visual_properties.h"
 #include "content/public/common/common_param_traits.h"
@@ -21,7 +20,6 @@
 #include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
-#include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
 #include "ui/base/ime/text_input_action.h"
 #include "ui/base/ime/text_input_mode.h"
 #include "ui/base/ui_base_types.h"
@@ -163,20 +161,6 @@ IPC_MESSAGE_ROUTED1(WidgetMsg_ForceRedraw, int /* snapshot_id */)
 IPC_MESSAGE_ROUTED1(WidgetMsg_SetViewportIntersection,
                     blink::ViewportIntersectionState /* intersection_state */)
 
-// Sent to an OOPIF widget when the browser receives a FrameHostMsg_SetIsInert
-// from the target widget's embedding renderer changing its inertness. When a
-// widget is inert, it is unable to process input events.
-//
-// https://html.spec.whatwg.org/multipage/interaction.html#inert
-IPC_MESSAGE_ROUTED1(WidgetMsg_SetIsInert, bool /* inert */)
-
-// Sets the inherited effective touch action on an out-of-process iframe.
-IPC_MESSAGE_ROUTED1(WidgetMsg_SetInheritedEffectiveTouchAction, cc::TouchAction)
-
-// Toggles render throttling for an out-of-process iframe.
-IPC_MESSAGE_ROUTED2(WidgetMsg_UpdateRenderThrottlingStatus,
-                    bool /* is_throttled */,
-                    bool /* subtree_throttled */)
 
 // Sent by the browser to synchronize with the next compositor frame by
 // requesting an ACK be queued. Used only for tests.
@@ -201,33 +185,11 @@ IPC_MESSAGE_ROUTED1(WidgetHostMsg_SelectionBoundsChanged,
 // throttle these messages.
 IPC_MESSAGE_ROUTED0(WidgetHostMsg_UpdateScreenRects_ACK)
 
-// Only used for SVGs inside of <object> and not for iframes. Informs the
-// browser that hte current frame's intrinsic sizing info has changed. The
-// browser can then notify a containing frame that the frame may need to
-// trigger a new layout.
-//
-// Also see blink::mojom::RemoteFrame::IntrinsicSizingInfoOfChildChanged.
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_IntrinsicSizingInfoChanged,
-                    blink::WebIntrinsicSizingInfo)
-
 // Send the tooltip text for the current mouse position to the browser.
 IPC_MESSAGE_ROUTED2(WidgetHostMsg_SetTooltipText,
                     base::string16 /* tooltip text string */,
                     base::i18n::TextDirection /* text direction hint */)
 
-// Updates the current cursor to be used by the browser for indicating the
-// location of a pointing device.
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_SetCursor, content::WebCursor)
-
-// Request a non-decelerating synthetic fling animation to be latched on the
-// scroller at the start point, and whose velocity can be changed over time by
-// sending multiple AutoscrollFling gestures.  Used for features like
-// middle-click autoscroll.
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_AutoscrollStart, gfx::PointF /* start */)
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_AutoscrollFling,
-                    gfx::Vector2dF /* velocity */)
-IPC_MESSAGE_ROUTED0(WidgetHostMsg_AutoscrollEnd)
-
 // Notifies the browser if the text input state has changed. Primarily useful
 // for IME as they need to know of all changes to update their interpretation
 // of the characters that have been input.
@@ -263,19 +225,4 @@ IPC_MESSAGE_ROUTED0(WidgetHostMsg_WaitForNextFrameForTests_ACK)
 // after the frame widget has painted something.
 IPC_MESSAGE_ROUTED0(WidgetHostMsg_DidFirstVisuallyNonEmptyPaint)
 
-// Notifies whether there are JavaScript touch event handlers or not.
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_HasTouchEventHandlers,
-                    bool /* has_handlers */)
-
-// Sent by a widget to the browser to request a page scale animation in the
-// main-frame's widget.
-IPC_MESSAGE_ROUTED2(WidgetHostMsg_AnimateDoubleTapZoomInMainFrame,
-                    gfx::Point /* tap point */,
-                    gfx::Rect /* rect_to_zoom */)
-
-// Sent by a widget to the browser to request a page scale animation in the
-// main-frame's widget for find-in-page zoom.
-IPC_MESSAGE_ROUTED1(WidgetHostMsg_ZoomToFindInPageRectInMainFrame,
-                    gfx::Rect /* rect_to_zoom */)
-
 #endif  //  CONTENT_COMMON_WIDGET_MESSAGES_H_
diff --git a/chromium/content/dev_ui_content_resources.grd b/chromium/content/dev_ui_content_resources.grd
index b43d1673274..a4ec734dc2a 100644
--- a/chromium/content/dev_ui_content_resources.grd
+++ b/chromium/content/dev_ui_content_resources.grd
@@ -18,6 +18,10 @@ files that belong there instead.
       <include name="IDR_APPCACHE_INTERNALS_HTML" file="browser/resources/appcache/appcache_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
       <include name="IDR_APPCACHE_INTERNALS_JS" file="browser/resources/appcache/appcache_internals.js" flattenhtml="false" compress="gzip" type="BINDATA" />
       <include name="IDR_APPCACHE_INTERNALS_CSS" file="browser/resources/appcache/appcache_internals.css" flattenhtml="true" compress="gzip" type="BINDATA" />
+      <include name="IDR_CONVERSION_INTERNALS_HTML" file="browser/resources/conversions/conversion_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
+      <include name="IDR_CONVERSION_INTERNALS_JS" file="browser/resources/conversions/conversion_internals.js" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
+      <include name="IDR_CONVERSION_INTERNALS_CSS" file="browser/resources/conversions/conversion_internals.css" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
+      <include name="IDR_CONVERSION_INTERNALS_MOJOM_JS" file="${root_gen_dir}/content/browser/conversions/conversion_internals.mojom-lite.js" use_base_dir="false" type="BINDATA" compress="gzip" />
       <include name="IDR_GPU_INTERNALS_HTML" file="browser/resources/gpu/gpu_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
       <include name="IDR_GPU_INTERNALS_JS" file="browser/resources/gpu/gpu_internals.js" flattenhtml="true" compress="gzip" type="BINDATA" />
       <include name="IDR_INDEXED_DB_INTERNALS_HTML" file="browser/resources/indexed_db/indexeddb_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
diff --git a/chromium/content/gpu/gpu_child_thread.cc b/chromium/content/gpu/gpu_child_thread.cc
index 066531c62e2..0ae0a633850 100644
--- a/chromium/content/gpu/gpu_child_thread.cc
+++ b/chromium/content/gpu/gpu_child_thread.cc
@@ -24,7 +24,6 @@
 #include "content/gpu/gpu_service_factory.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/gpu/content_gpu_client.h"
 #include "gpu/command_buffer/common/activity_flags.h"
@@ -42,10 +41,6 @@
 #include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
 #include "third_party/skia/include/core/SkGraphics.h"
 
-#if defined(USE_OZONE)
-#include "ui/ozone/public/ozone_platform.h"
-#endif
-
 #if defined(OS_ANDROID)
 #include "media/base/android/media_drm_bridge_client.h"
 #include "media/mojo/clients/mojo_android_overlay.h"
@@ -57,13 +52,6 @@ namespace {
 ChildThreadImpl::Options GetOptions() {
   ChildThreadImpl::Options::Builder builder;
 
-#if defined(USE_OZONE)
-  IPC::MessageFilter* message_filter =
-      ui::OzonePlatform::GetInstance()->GetGpuMessageFilter();
-  if (message_filter)
-    builder.AddStartupFilter(message_filter);
-#endif
-
   builder.ConnectToBrowser(true);
   builder.ExposesInterfacesToBrowser();
 
@@ -247,7 +235,8 @@ void GpuChildThread::QuitSafelyHelper(
           return;
         GpuChildThread* gpu_child_thread =
             static_cast<GpuChildThread*>(current_child_thread);
-        gpu_child_thread->viz_main_.ExitProcess(/*immediately=*/true);
+        gpu_child_thread->viz_main_.ExitProcess(
+            viz::ExitCode::RESULT_CODE_NORMAL_EXIT);
       }));
 }
 
diff --git a/chromium/content/gpu/gpu_main.cc b/chromium/content/gpu/gpu_main.cc
index 0a96d09d0de..4ba4a150565 100644
--- a/chromium/content/gpu/gpu_main.cc
+++ b/chromium/content/gpu/gpu_main.cc
@@ -46,7 +46,6 @@
 #include "gpu/ipc/service/gpu_init.h"
 #include "gpu/ipc/service/gpu_watchdog_thread.h"
 #include "media/gpu/buildflags.h"
-#include "services/tracing/public/cpp/stack_sampling/tracing_sampler_profiler.h"
 #include "services/tracing/public/cpp/trace_startup.h"
 #include "third_party/angle/src/gpu_info_util/SystemInfo.h"
 #include "ui/events/platform/platform_event_source.h"
@@ -80,8 +79,8 @@
 #if defined(USE_X11)
 #include "ui/base/x/x11_util.h"                          // nogncheck
 #include "ui/gfx/linux/gpu_memory_buffer_support_x11.h"  // nogncheck
-#include "ui/gfx/x/x11_connection.h"                     // nogncheck
 #include "ui/gfx/x/x11_switches.h"                       // nogncheck
+#include "ui/gfx/x/x11_types.h"                          // nogncheck
 #endif
 
 #if defined(OS_LINUX)
@@ -268,11 +267,6 @@ int GpuMain(const MainFunctionParams& parameters) {
         std::make_unique<base::SingleThreadTaskExecutor>(
             base::MessagePumpType::DEFAULT);
 #elif defined(USE_X11)
-    // Depending on how Chrome is running there are multiple threads that can
-    // make Xlib function calls. Call XInitThreads() here to be safe, even if
-    // some configurations don't strictly need it.
-    gfx::InitializeThreadedX11();
-
     // We need a UI loop so that we can grab the Expose events. See GLSurfaceGLX
     // and https://crbug.com/326995.
     ui::SetDefaultX11ErrorHandlers();
@@ -389,10 +383,6 @@ int GpuMain(const MainFunctionParams& parameters) {
     tracing::EnableStartupTracingIfNeeded();
 #endif  // OS_POSIX && !OS_ANDROID && !!OS_MACOSX
 
-  // Setup tracing sampler profiler as early as possible.
-  std::unique_ptr<tracing::TracingSamplerProfiler> tracing_sampler_profiler =
-      tracing::TracingSamplerProfiler::CreateOnMainThread();
-
 #if defined(OS_MACOSX)
   // A GPUEjectPolicy of 'wait' is set in the Info.plist of the browser
   // process, meaning it is "responsible" for making sure it and its
diff --git a/chromium/content/gpu/gpu_sandbox_hook_linux.cc b/chromium/content/gpu/gpu_sandbox_hook_linux.cc
index 6cacc8af640..82736eebc20 100644
--- a/chromium/content/gpu/gpu_sandbox_hook_linux.cc
+++ b/chromium/content/gpu/gpu_sandbox_hook_linux.cc
@@ -143,6 +143,12 @@ void AddV4L2GpuWhitelist(
   // Device node for V4L2 JPEG encode accelerator drivers.
   static const char kDevJpegEncPath[] = "/dev/jpeg-enc";
   permissions->push_back(BrokerFilePermission::ReadWrite(kDevJpegEncPath));
+
+  if (UseChromecastSandboxWhitelist()) {
+    static const char kAmlogicAvcEncoderPath[] = "/dev/amvenc_avc";
+    permissions->push_back(
+        BrokerFilePermission::ReadWrite(kAmlogicAvcEncoderPath));
+  }
 }
 
 void AddArmMaliGpuWhitelist(std::vector<BrokerFilePermission>* permissions) {
@@ -387,6 +393,15 @@ void LoadV4L2Libraries(
   }
 }
 
+void LoadChromecastV4L2Libraries() {
+  for (const char* path : kWhitelistedChromecastPaths) {
+    const std::string library_path(std::string(path) +
+                                   std::string("libvpcodec.so"));
+    if (dlopen(library_path.c_str(), dlopen_flag))
+      break;
+  }
+}
+
 bool LoadLibrariesForGpu(
     const service_manager::SandboxSeccompBPF::Options& options) {
   if (IsChromeOS()) {
@@ -400,6 +415,8 @@ bool LoadLibrariesForGpu(
       return LoadAmdGpuLibraries();
   } else if (UseChromecastSandboxWhitelist() && IsArchitectureArm()) {
     LoadArmGpuLibraries();
+    if (UseV4L2Codec())
+      LoadChromecastV4L2Libraries();
   }
   return true;
 }
diff --git a/chromium/content/gpu/gpu_service_factory.cc b/chromium/content/gpu/gpu_service_factory.cc
index 21d9d6db69b..efda557bd31 100644
--- a/chromium/content/gpu/gpu_service_factory.cc
+++ b/chromium/content/gpu/gpu_service_factory.cc
@@ -16,9 +16,6 @@
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 #include "base/bind.h"
 #include "media/mojo/services/media_service_factory.h"  // nogncheck
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-#include "content/public/gpu/content_gpu_client.h"
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 #endif  // BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 
 namespace content {
@@ -46,13 +43,6 @@ GpuServiceFactory::~GpuServiceFactory() {}
 void GpuServiceFactory::RunMediaService(
     mojo::PendingReceiver<media::mojom::MediaService> receiver) {
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
-  media::CdmProxyFactoryCB cdm_proxy_factory_cb;
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  cdm_proxy_factory_cb =
-      base::BindRepeating(&ContentGpuClient::CreateCdmProxy,
-                          base::Unretained(GetContentClient()->gpu()));
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
   // This service will host audio/video decoders, and if these decoding
   // operations are blocked, user may hear audio glitch or see video freezing,
   // hence "user blocking".
@@ -68,11 +58,11 @@ void GpuServiceFactory::RunMediaService(
 
   using FactoryCallback =
       base::OnceCallback<std::unique_ptr<media::MediaService>()>;
-  FactoryCallback factory = base::BindOnce(
-      &media::CreateGpuMediaService, std::move(receiver), gpu_preferences_,
-      gpu_workarounds_, gpu_feature_info_, task_runner_,
-      media_gpu_channel_manager_, gpu_memory_buffer_factory_,
-      android_overlay_factory_cb_, std::move(cdm_proxy_factory_cb));
+  FactoryCallback factory =
+      base::BindOnce(&media::CreateGpuMediaService, std::move(receiver),
+                     gpu_preferences_, gpu_workarounds_, gpu_feature_info_,
+                     task_runner_, media_gpu_channel_manager_,
+                     gpu_memory_buffer_factory_, android_overlay_factory_cb_);
   task_runner->PostTask(
       FROM_HERE,
       base::BindOnce(
diff --git a/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc b/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
index 1a81714ecc2..cb2244413ab 100644
--- a/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
+++ b/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
@@ -8,7 +8,7 @@
 
 #include <map>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/strings/string16.h"
 #include "base/threading/platform_thread.h"
 #include "build/build_config.h"
diff --git a/chromium/content/ppapi_plugin/ppapi_thread.cc b/chromium/content/ppapi_plugin/ppapi_thread.cc
index ac7bf9ba4e8..79347d2e930 100644
--- a/chromium/content/ppapi_plugin/ppapi_thread.cc
+++ b/chromium/content/ppapi_plugin/ppapi_thread.cc
@@ -35,7 +35,6 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/pepper_plugin_info.h"
 #include "content/public/common/sandbox_init.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_platform_file.h"
diff --git a/chromium/content/public/android/BUILD.gn b/chromium/content/public/android/BUILD.gn
index 086b8c8c56d..fedef329f1c 100644
--- a/chromium/content/public/android/BUILD.gn
+++ b/chromium/content/public/android/BUILD.gn
@@ -106,11 +106,11 @@ android_library("content_java") {
     "//third_party/android_deps:androidx_annotation_annotation_java",
     "//third_party/android_deps:androidx_collection_collection_java",
     "//third_party/android_deps:androidx_core_core_java",
+    "//third_party/android_deps:com_google_code_findbugs_jsr305_java",
     "//third_party/blink/public:blink_headers_java",
     "//third_party/blink/public/mojom:android_mojo_bindings_java",
     "//third_party/blink/public/mojom:mojom_core_java",
     "//third_party/blink/public/mojom:mojom_platform_java",
-    "//third_party/jsr-305:jsr_305_javalib",
     "//ui/android:ui_java",
     "//ui/gfx/geometry/mojom:mojom_java",
     "//url:gurl_java",
@@ -186,8 +186,8 @@ android_library("content_java") {
     "java/src/org/chromium/content/browser/ViewEventSinkImpl.java",
     "java/src/org/chromium/content/browser/WindowEventObserver.java",
     "java/src/org/chromium/content/browser/WindowEventObserverManager.java",
+    "java/src/org/chromium/content/browser/accessibility/AccessibilityEventDispatcher.java",
     "java/src/org/chromium/content/browser/accessibility/BrowserAccessibilityState.java",
-    "java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java",
     "java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java",
     "java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java",
     "java/src/org/chromium/content/browser/accessibility/PieWebContentsAccessibility.java",
@@ -458,16 +458,16 @@ android_library("content_javatests") {
     "//services/test/echo/public/mojom:mojom_java",
     "//third_party/android_deps:androidx_annotation_annotation_java",
     "//third_party/android_deps:androidx_collection_collection_java",
+    "//third_party/android_deps:com_google_code_findbugs_jsr305_java",
     "//third_party/android_support_test_runner:rules_java",
     "//third_party/android_support_test_runner:runner_java",
     "//third_party/blink/public:blink_headers_java",
     "//third_party/blink/public/mojom:android_mojo_bindings_java",
     "//third_party/hamcrest:hamcrest_java",
-    "//third_party/jsr-305:jsr_305_javalib",
     "//third_party/junit",
     "//ui/android:ui_java",
     "//ui/android:ui_java_test_support",
-    "//ui/base/mojom:cursor_type_java",
+    "//ui/base/cursor/mojom:cursor_type_java",
     "//ui/gfx/geometry/mojom:mojom_java",
     "//url:gurl_java",
   ]
@@ -487,7 +487,6 @@ android_library("content_javatests") {
     "javatests/src/org/chromium/content/browser/EncodeHtmlDataUriTest.java",
     "javatests/src/org/chromium/content/browser/GestureDetectorResetTest.java",
     "javatests/src/org/chromium/content/browser/ImportantFileWriterAndroidTest.java",
-    "javatests/src/org/chromium/content/browser/InterstitialPageTest.java",
     "javatests/src/org/chromium/content/browser/JavaBridgeActivityTestRule.java",
     "javatests/src/org/chromium/content/browser/JavaBridgeArrayCoercionTest.java",
     "javatests/src/org/chromium/content/browser/JavaBridgeArrayTest.java",
@@ -508,6 +507,7 @@ android_library("content_javatests") {
     "javatests/src/org/chromium/content/browser/ViewportTest.java",
     "javatests/src/org/chromium/content/browser/WakeLockTest.java",
     "javatests/src/org/chromium/content/browser/WebContentsObserverAndroidTest.java",
+    "javatests/src/org/chromium/content/browser/accessibility/AccessibilityEventDispatcherTest.java",
     "javatests/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityTest.java",
     "javatests/src/org/chromium/content/browser/accessibility/captioning/CaptioningChangeDelegateTest.java",
     "javatests/src/org/chromium/content/browser/androidoverlay/DialogOverlayImplPixelTest.java",
@@ -544,6 +544,7 @@ junit_binary("content_junit_tests") {
   sources = [
     "junit/src/org/chromium/content/browser/BindingManagerTest.java",
     "junit/src/org/chromium/content/browser/ChildProcessRankingTest.java",
+    "junit/src/org/chromium/content/browser/CriteriaHelperTest.java",
     "junit/src/org/chromium/content/browser/ScreenOrientationProviderImplTest.java",
     "junit/src/org/chromium/content/browser/SpareChildConnectionTest.java",
     "junit/src/org/chromium/content/browser/UiThreadTaskTraitsImplTest.java",
@@ -567,6 +568,7 @@ junit_binary("content_junit_tests") {
     "//base:base_java_process_launcher_test_support",
     "//base:base_java_test_support",
     "//base:base_junit_test_support",
+    "//content/public/test/android:content_java_test_support",
     "//media/mojo/mojom:mojom_java",
     "//mojo/public/java:bindings_java",
     "//third_party/blink/public/mojom:android_mojo_bindings_java",
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/CriteriaHelperTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/CriteriaHelperTest.java
new file mode 100644
index 00000000000..fa65ca16c01
--- /dev/null
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/CriteriaHelperTest.java
@@ -0,0 +1,341 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.content.browser;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.assertTrue;
+
+import static org.chromium.base.task.TaskTraits.THREAD_POOL;
+import static org.chromium.content_public.browser.test.util.CriteriaHelper.DEFAULT_POLLING_INTERVAL;
+
+import android.support.test.filters.MediumTest;
+
+import org.junit.Assert;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.ExpectedException;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.ThreadUtils;
+import org.chromium.base.task.PostTask;
+import org.chromium.base.test.BaseRobolectricTestRunner;
+import org.chromium.content_public.browser.test.util.Criteria;
+import org.chromium.content_public.browser.test.util.CriteriaHelper;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+
+/**
+ * Tests for {@link CriteriaHelper}.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+public class CriteriaHelperTest {
+    private static final String ERROR_MESSAGE = "my special error message";
+
+    @Rule
+    public ExpectedException thrown = ExpectedException.none();
+
+    @Test
+    @MediumTest
+    public void testUiThread() {
+        // Robolectric runs the test on UI thread.
+        assertTrue(ThreadUtils.runningOnUiThread());
+        // In Instrumented tests, the tests would be on instrumentation thread instead.
+        // Emulate that behavior by posting the body of the test.
+        PostTask.postTask(THREAD_POOL, () -> {
+            assertFalse(ThreadUtils.runningOnUiThread());
+            CriteriaHelper.pollUiThread(() -> assertTrue(ThreadUtils.runningOnUiThread()));
+        });
+    }
+
+    @Test
+    @MediumTest
+    public void testInstrumentationThread() {
+        // Robolectric runs the test on UI thread.
+        assertTrue(ThreadUtils.runningOnUiThread());
+        // In Instrumented tests, the tests would be on instrumentation thread instead.
+        // Emulate that behavior by posting the body of the test.
+        PostTask.postTask(THREAD_POOL, () -> {
+            assertFalse(ThreadUtils.runningOnUiThread());
+            CriteriaHelper.pollInstrumentationThread(
+                    () -> assertFalse(ThreadUtils.runningOnUiThread()));
+        });
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Runnable_UiThread() {
+        CriteriaHelper.pollUiThread(() -> {});
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Runnable_InstrumentationThread() {
+        CriteriaHelper.pollInstrumentationThread(() -> {});
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Callable_UiThread() {
+        CriteriaHelper.pollUiThread(() -> true);
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Callable_InstrumentationThread() {
+        CriteriaHelper.pollInstrumentationThread(() -> true);
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Criteria_UiThread() {
+        CriteriaHelper.pollUiThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return true;
+            }
+        });
+    }
+
+    @Test
+    @MediumTest
+    public void testPass_Criteria_InstrumentationThread() {
+        CriteriaHelper.pollInstrumentationThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return true;
+            }
+        });
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Runnable_UiThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollUiThread((Runnable) Assert::fail, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Runnable_InstrumentationThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollInstrumentationThread(
+                (Runnable) Assert::fail, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Callable_UiThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollUiThread(() -> false, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Callable_InstrumentationThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollInstrumentationThread(() -> false, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Criteria_UiThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollUiThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testThrow_Criteria_InstrumentationThread() {
+        thrown.expect(AssertionError.class);
+        CriteriaHelper.pollInstrumentationThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Runnable_UiThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollUiThread(() -> Assert.fail(ERROR_MESSAGE), 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Runnable_InstrumentationThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollInstrumentationThread(
+                () -> Assert.fail(ERROR_MESSAGE), 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Callback_UiThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollUiThread(() -> false, ERROR_MESSAGE, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Callback_InstrumentationThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollInstrumentationThread(
+                () -> false, ERROR_MESSAGE, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Criteria_UiThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollUiThread(new Criteria(ERROR_MESSAGE) {
+            @Override
+            public boolean isSatisfied() {
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Criteria_InstrumentationThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollInstrumentationThread(new Criteria(ERROR_MESSAGE) {
+            @Override
+            public boolean isSatisfied() {
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Criteria_dynamic_UiThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollUiThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                updateFailureReason(ERROR_MESSAGE);
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    @Test
+    @MediumTest
+    public void testMessage_Criteria_dynamic_InstrumentationThread() {
+        thrown.expectMessage(ERROR_MESSAGE);
+        CriteriaHelper.pollInstrumentationThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                updateFailureReason(ERROR_MESSAGE);
+                return false;
+            }
+        }, 0, DEFAULT_POLLING_INTERVAL);
+    }
+
+    private String getStackTrace(AssertionError e) {
+        StringWriter sw = new StringWriter();
+        e.printStackTrace(new PrintWriter(sw));
+        return sw.toString();
+    }
+
+    @Test
+    @MediumTest
+    public void testStack_Runnable_UiThread() {
+        try {
+            CriteriaHelper.pollUiThread((Runnable) Assert::fail, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Runnable_UiThread("));
+            return;
+        }
+        Assert.fail();
+    }
+
+    @Test
+    @MediumTest
+    public void testStack_Runnable_InstrumentationThread() {
+        try {
+            CriteriaHelper.pollInstrumentationThread(
+                    (Runnable) Assert::fail, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Runnable_InstrumentationThread("));
+            return;
+        }
+        Assert.fail();
+    }
+
+    @Test
+    @MediumTest
+    public void testStack_Callable_UiThread() {
+        try {
+            CriteriaHelper.pollUiThread(() -> false, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Callable_UiThread("));
+            return;
+        }
+        Assert.fail();
+    }
+
+    @Test
+    @MediumTest
+    public void testStack_Callable_InstrumentationThread() {
+        try {
+            CriteriaHelper.pollInstrumentationThread(() -> false, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Callable_InstrumentationThread("));
+            return;
+        }
+        Assert.fail();
+    }
+
+    @Test
+    @MediumTest
+    public void testStack_Criteria_UiThread() {
+        try {
+            CriteriaHelper.pollUiThread(new Criteria() {
+                @Override
+                public boolean isSatisfied() {
+                    return false;
+                }
+            }, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Criteria_UiThread("));
+            return;
+        }
+        Assert.fail();
+    }
+    @Test
+    @MediumTest
+    public void testStack_Criteria_InstrumentationThread() {
+        try {
+            CriteriaHelper.pollInstrumentationThread(new Criteria() {
+                @Override
+                public boolean isSatisfied() {
+                    return false;
+                }
+            }, 0, DEFAULT_POLLING_INTERVAL);
+        } catch (AssertionError e) {
+            assertThat(getStackTrace(e),
+                    containsString("CriteriaHelperTest.testStack_Criteria_InstrumentationThread("));
+            return;
+        }
+        Assert.fail();
+    }
+}
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
index 4bd7695bd32..2332136c2f3 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
@@ -607,6 +607,43 @@ public class SelectionPopupControllerTest {
         Mockito.verify(spyController, times(3)).finishActionMode();
     }
 
+    @Test
+    @Feature({"TextInput"})
+    public void testSelectionWhenWindowIsNull() {
+        SelectionPopupControllerImpl spyController = Mockito.spy(mController);
+
+        when(mView.startActionMode(any(FloatingActionModeCallback.class), anyInt()))
+                .thenReturn(mActionMode);
+
+        // Long press triggered showSelectionMenu() call.
+        spyController.showSelectionMenu(0, 0, 0, 0, 0, /* isEditable = */ true,
+                /* isPasswordType = */ false, AMPHITHEATRE_FULL, /* selectionOffset = */ 0,
+                /* canSelectAll = */ true,
+                /* canRichlyEdit = */ true, /* shouldSuggest = */ true,
+                MenuSourceType.MENU_SOURCE_LONG_PRESS);
+
+        Mockito.verify(mView).startActionMode(
+                isA(FloatingActionModeCallback.class), eq(ActionMode.TYPE_FLOATING));
+        // showSelectionMenu() will invoke the first call to finishActionMode() in the
+        // showActionModeOrClearOnFailure().
+        Mockito.verify(spyController, times(1)).finishActionMode();
+        assertTrue(spyController.isSelectActionBarShowing());
+
+        // Setting the window to null should clear selections and reset the state.
+        spyController.onWindowAndroidChanged(null);
+        // Changed the focused node attribute to non-editable and non-password.
+        spyController.updateSelectionState(false, false);
+
+        // finishActionMode will be called twice for unselect.
+        Mockito.verify(spyController, times(2)).finishActionMode();
+
+        // SELECTION_HANDLES_CLEARED happens.
+        spyController.onSelectionEvent(SelectionEventType.SELECTION_HANDLES_CLEARED, 0, 0, 1, 1);
+
+        assertFalse(spyController.isSelectActionBarShowing());
+        Mockito.verify(spyController, times(3)).finishActionMode();
+    }
+
     // Result generated by long press "Amphitheatre" in "1600 Amphitheatre Parkway".
     private SelectionClient.Result resultForAmphitheatre() {
         SelectionClient.Result result = new SelectionClient.Result();
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
index a13ee80beee..6466f2270cf 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
@@ -10,7 +10,9 @@ import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.when;
 
+import android.content.Context;
 import android.view.textclassifier.SelectionEvent;
 import android.view.textclassifier.TextClassificationManager;
 import android.view.textclassifier.TextClassifier;
@@ -30,8 +32,10 @@ import org.robolectric.shadows.ShadowLog;
 
 import org.chromium.base.test.BaseRobolectricTestRunner;
 import org.chromium.base.test.util.Feature;
+import org.chromium.content.browser.webcontents.WebContentsImpl;
 import org.chromium.ui.base.WindowAndroid;
 
+import java.lang.ref.WeakReference;
 import java.text.BreakIterator;
 
 /**
@@ -40,6 +44,9 @@ import java.text.BreakIterator;
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(manifest = Config.NONE)
 public class SmartSelectionMetricsLoggerTest {
+    private WebContentsImpl mWebContents;
+    private WindowAndroid mWindowAndroid;
+
     @Mock
     private TextClassifier mTextClassifier;
 
@@ -61,6 +68,13 @@ public class SmartSelectionMetricsLoggerTest {
         MockitoAnnotations.initMocks(this);
         ShadowLog.stream = System.out;
 
+        mWebContents = Mockito.mock(WebContentsImpl.class);
+        mWindowAndroid = Mockito.mock(WindowAndroid.class);
+        when(mWebContents.getTopLevelNativeWindow()).thenReturn(mWindowAndroid);
+        when(mWindowAndroid.getContext())
+                .thenReturn(
+                        new WeakReference<Context>(ApplicationProvider.getApplicationContext()));
+
         TextClassificationManager tcm =
                 ApplicationProvider.getApplicationContext().getSystemService(
                         TextClassificationManager.class);
@@ -304,8 +318,7 @@ public class SmartSelectionMetricsLoggerTest {
     @Test
     @Feature({"TextInput", "SmartSelection"})
     public void testNormalLoggingFlow() {
-        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(
-                new WindowAndroid(ApplicationProvider.getApplicationContext()));
+        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(mWebContents);
         ArgumentCaptor<SelectionEvent> captor = ArgumentCaptor.forClass(SelectionEvent.class);
         InOrder inOrder = inOrder(mTextClassifier);
 
@@ -374,8 +387,7 @@ public class SmartSelectionMetricsLoggerTest {
     @Test
     @Feature({"TextInput", "SmartSelection"})
     public void testMultipleDrag() {
-        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(
-                new WindowAndroid(ApplicationProvider.getApplicationContext()));
+        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(mWebContents);
         ArgumentCaptor<SelectionEvent> captor = ArgumentCaptor.forClass(SelectionEvent.class);
         InOrder inOrder = inOrder(mTextClassifier);
 
@@ -424,8 +436,7 @@ public class SmartSelectionMetricsLoggerTest {
     @Test
     @Feature({"TextInput", "SmartSelection"})
     public void testTextShift() {
-        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(
-                new WindowAndroid(ApplicationProvider.getApplicationContext()));
+        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(mWebContents);
         ArgumentCaptor<SelectionEvent> captor = ArgumentCaptor.forClass(SelectionEvent.class);
         InOrder inOrder = inOrder(mTextClassifier);
 
@@ -468,8 +479,7 @@ public class SmartSelectionMetricsLoggerTest {
     @Test
     @Feature({"TextInput", "SmartSelection"})
     public void testSelectionChanged() {
-        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(
-                new WindowAndroid(ApplicationProvider.getApplicationContext()));
+        SmartSelectionMetricsLogger logger = SmartSelectionMetricsLogger.create(mWebContents);
         ArgumentCaptor<SelectionEvent> captor = ArgumentCaptor.forClass(SelectionEvent.class);
         InOrder inOrder = inOrder(mTextClassifier);
 
diff --git a/chromium/content/public/app/BUILD.gn b/chromium/content/public/app/BUILD.gn
index 93ca75182b6..8a77d9d33bf 100644
--- a/chromium/content/public/app/BUILD.gn
+++ b/chromium/content/public/app/BUILD.gn
@@ -18,7 +18,7 @@
 # foo ->
 #   //content/public/app:child (group; "browser" and "both" ones look the same)
 #     //content (shared library) ->
-#       //content/public/app:both_sources (source set)
+#       //content/public/app:app_sources (source set)
 
 import("//build/config/chrome_build.gni")
 import("//build/config/ui.gni")
@@ -46,7 +46,7 @@ public_app_shared_deps = [
 ]
 
 if (is_component_build) {
-  source_set("both_sources") {
+  source_set("app_sources") {
     # Only the main content shared library can pull this in.
     visibility = [ "//content:content" ]
 
@@ -55,7 +55,7 @@ if (is_component_build) {
     configs += [ "//content:content_implementation" ]
 
     deps = public_app_shared_deps + [
-             "//content/app:both",
+             "//content/app",
              "//content/public/browser:browser_sources",
              "//content/public/gpu:gpu_sources",
              "//content/public/renderer:renderer_sources",
@@ -65,39 +65,20 @@ if (is_component_build) {
     allow_circular_includes_from = [
       # This target is a pair with the non-public version. They always go
       # together and include headers from each other.
-      "//content/app:both",
+      "//content/app",
     ]
   }
 
-  # These all just forward to content, which in turn depends on "both_sources".
-  group("browser") {
-    public_deps = [ "//content" ]
-  }
-  group("child") {
-    public_deps = [ "//content" ]
-  }
-  group("both") {
+  # This just forwards to content, which in turn depends on "app_sources".
+  group("app") {
     public_deps = [ "//content" ]
   }
 } else {
-  # content_main_delegate.cc conditionally includes content_browser_client.h
-  # from //content/public/browser when it's not the child build. However,
-  # the header checker doesn't know this doesn't apply and throws an error.
-  # So all of these targets set check_includes = false.
-  #
-  # TODO(brettw) either teach the header checker to understand simple
-  # ifdefs or split the file apart so we can enable header checking here.
-  # Furthermore, since this file exists in more than one target, they all
-  # have to opt-out of header checking (a file is checked once for all
-  # targets using a source file).
-
-  source_set("both") {
-    check_includes = false  # See comment above.
-
+  source_set("app") {
     sources = public_app_shared_sources
     configs += [ "//content:content_implementation" ]
     deps = public_app_shared_deps + [
-             "//content/app:both",
+             "//content/app",
              "//content/public/browser",
              "//content/public/common",
              "//content/public/gpu:gpu_sources",
@@ -108,61 +89,9 @@ if (is_component_build) {
     allow_circular_includes_from = [
       # This target is a pair with the non-public version. They always go
       # together and include headers from each other.
-      "//content/app:both",
+      "//content/app",
     ]
   }
-
-  if (is_multi_dll_chrome) {
-    source_set("browser") {
-      check_includes = false  # See comment above.
-
-      sources = public_app_shared_sources
-
-      defines = [ "CHROME_MULTIPLE_DLL_BROWSER" ]
-      configs += [ "//content:content_implementation" ]
-
-      deps = public_app_shared_deps + [
-               "//content/app:browser",
-               "//content/public/browser",
-               "//content/public/common",
-             ]
-
-      allow_circular_includes_from = [
-        # This target is a pair with the non-public version. They always go
-        # together and include headers from each other.
-        "//content/app:browser",
-      ]
-    }
-
-    source_set("child") {
-      check_includes = false  # See comment above.
-
-      sources = public_app_shared_sources
-
-      defines = [ "CHROME_MULTIPLE_DLL_CHILD" ]
-      configs += [ "//content:content_implementation" ]
-
-      deps = public_app_shared_deps + [
-               "//content/app:child",
-               "//content/public/common",
-             ]
-
-      allow_circular_includes_from = [
-        # This target is a pair with the non-public version. They always go
-        # together and include headers from each other.
-        "//content/app:child",
-      ]
-    }
-  } else {
-    # When the multi-DLL build is disabled, there is only one type of the
-    # "app" target, and "browser" and "child" are the same as "both".
-    group("browser") {
-      deps = [ ":both" ]
-    }
-    group("child") {
-      deps = [ ":both" ]
-    }
-  }
 }
 
 source_set("content_browser_manifest") {
diff --git a/chromium/content/public/app/OWNERS b/chromium/content/public/app/OWNERS
index 8585617d4df..5c035fbe194 100644
--- a/chromium/content/public/app/OWNERS
+++ b/chromium/content/public/app/OWNERS
@@ -6,3 +6,4 @@ per-file content_browser_manifest.cc=file://ipc/SECURITY_OWNERS
 per-file content_browser_manifest.h=set noparent
 per-file content_browser_manifest.h=file://ipc/SECURITY_OWNERS
 
+per-file mac_helpers.gni=rsesek@chromium.org
diff --git a/chromium/content/public/app/content_main_delegate.cc b/chromium/content/public/app/content_main_delegate.cc
index af1200a0f2e..ed5b0e2c0b4 100644
--- a/chromium/content/public/app/content_main_delegate.cc
+++ b/chromium/content/public/app/content_main_delegate.cc
@@ -4,17 +4,14 @@
 
 #include "content/public/app/content_main_delegate.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "build/build_config.h"
+#include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
 #include "content/public/gpu/content_gpu_client.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/utility/content_utility_client.h"
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
-#include "content/public/browser/content_browser_client.h"
-#endif
-
 namespace content {
 
 bool ContentMainDelegate::BasicStartupComplete(int* exit_code) {
@@ -61,35 +58,19 @@ ContentClient* ContentMainDelegate::CreateContentClient() {
 }
 
 ContentBrowserClient* ContentMainDelegate::CreateContentBrowserClient() {
-#if defined(CHROME_MULTIPLE_DLL_CHILD)
-  return NULL;
-#else
   return new ContentBrowserClient();
-#endif
 }
 
 ContentGpuClient* ContentMainDelegate::CreateContentGpuClient() {
-#if defined(CHROME_MULTIPLE_DLL_BROWSER)
-  return NULL;
-#else
   return new ContentGpuClient();
-#endif
 }
 
 ContentRendererClient* ContentMainDelegate::CreateContentRendererClient() {
-#if defined(CHROME_MULTIPLE_DLL_BROWSER)
-  return NULL;
-#else
   return new ContentRendererClient();
-#endif
 }
 
 ContentUtilityClient* ContentMainDelegate::CreateContentUtilityClient() {
-#if defined(CHROME_MULTIPLE_DLL_BROWSER)
-  return NULL;
-#else
   return new ContentUtilityClient();
-#endif
 }
 
 }  // namespace content
diff --git a/chromium/content/public/app/content_main_delegate.h b/chromium/content/public/app/content_main_delegate.h
index f8590642a8d..2d9ee9fa20a 100644
--- a/chromium/content/public/app/content_main_delegate.h
+++ b/chromium/content/public/app/content_main_delegate.h
@@ -109,7 +109,7 @@ class CONTENT_EXPORT ContentMainDelegate {
   // Allows the embedder to perform initialization once field trials/FeatureList
   // initialization has completed if ShouldCreateFeatureList() returns true.
   // Otherwise, the embedder is responsible for calling this method once feature
-  // list initialization is complete.
+  // list initialization is complete. Called in every process.
   virtual void PostFieldTrialInitialization() {}
 
   // Allows the embedder to perform its own initialization after early content
diff --git a/chromium/content/public/app/mac_helpers.gni b/chromium/content/public/app/mac_helpers.gni
index c1eec33896d..90167be3867 100644
--- a/chromium/content/public/app/mac_helpers.gni
+++ b/chromium/content/public/app/mac_helpers.gni
@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//ppapi/buildflags/buildflags.gni")
+
 # This list defines variants of the helper app bundles that macOS //content
 # embedders need to produce. The different variants are code signed with
 # different entitlements, which afford different capabilities depending on the
@@ -45,13 +47,17 @@ content_mac_helpers = [
     "",
     " (GPU)",
   ],
-
-  # A helper that does not perform library validation, allowing code not signed
-  # by either Apple or the signing identity to be loaded, and that can execute
-  # unsigned memory. This is used by binary plugins like Flash.
-  [
-    "plugin",
-    ".plugin",
-    " (Plugin)",
-  ],
 ]
+
+if (enable_plugins) {
+  content_mac_helpers += [
+    # A helper that does not perform library validation, allowing code not signed
+    # by either Apple or the signing identity to be loaded, and that can execute
+    # unsigned memory. This is used by binary plugins like Flash.
+    [
+      "plugin",
+      ".plugin",
+      " (Plugin)",
+    ],
+  ]
+}
diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
index 6254eaf68b8..fa2aeab0a4a 100644
--- a/chromium/content/public/browser/BUILD.gn
+++ b/chromium/content/public/browser/BUILD.gn
@@ -26,7 +26,10 @@ jumbo_source_set("browser_sources") {
   visibility = [ "//content/*" ]
   sources = [
     "accessibility_tree_formatter.h",
+    "allow_service_worker_result.cc",
+    "allow_service_worker_result.h",
     "android/android_overlay_provider.h",
+    "android/app_web_message_port.h",
     "android/child_process_importance.h",
     "android/compositor.h",
     "android/compositor_client.h",
@@ -124,11 +127,14 @@ jumbo_source_set("browser_sources") {
     "content_index_provider.h",
     "context_menu_params.cc",
     "context_menu_params.h",
+    "cookie_access_details.cc",
+    "cookie_access_details.h",
     "cookie_store_factory.h",
     "cors_exempt_headers.cc",
     "cors_exempt_headers.h",
     "cors_origin_pattern_setter.cc",
     "cors_origin_pattern_setter.h",
+    "dedicated_worker_id.h",
     "dedicated_worker_service.h",
     "desktop_capture.cc",
     "desktop_capture.h",
@@ -160,6 +166,8 @@ jumbo_source_set("browser_sources") {
     "download_manager_delegate.h",
     "download_request_utils.h",
     "download_utils.h",
+    "eye_dropper.h",
+    "eye_dropper_listener.h",
     "favicon_status.cc",
     "favicon_status.h",
     "feature_observer_client.h",
@@ -184,11 +192,9 @@ jumbo_source_set("browser_sources") {
     "hid_chooser.h",
     "hid_delegate.h",
     "histogram_fetcher.h",
+    "idle_manager.h",
     "installability_error.cc",
     "installability_error.h",
-    "interstitial_page.h",
-    "interstitial_page_delegate.cc",
-    "interstitial_page_delegate.h",
     "invalidate_type.h",
     "javascript_dialog_manager.cc",
     "javascript_dialog_manager.h",
@@ -267,6 +273,7 @@ jumbo_source_set("browser_sources") {
     "picture_in_picture_window_controller.h",
     "platform_notification_context.h",
     "platform_notification_service.h",
+    "presentation_receiver_flags.h",
     "presentation_request.cc",
     "presentation_request.h",
     "presentation_screen_availability_listener.h",
@@ -278,6 +285,8 @@ jumbo_source_set("browser_sources") {
     "push_messaging_service.h",
     "quota_permission_context.h",
     "reload_type.h",
+    "render_document_host_user_data.cc",
+    "render_document_host_user_data.h",
     "render_frame_host.h",
     "render_frame_metadata_provider.h",
     "render_process_host.h",
@@ -319,6 +328,7 @@ jumbo_source_set("browser_sources") {
     "session_storage_namespace.h",
     "session_storage_usage_info.h",
     "shared_cors_origin_access_list.h",
+    "shared_worker_id.h",
     "shared_worker_instance.cc",
     "shared_worker_instance.h",
     "shared_worker_service.h",
@@ -392,8 +402,6 @@ jumbo_source_set("browser_sources") {
     "webrtc_log.cc",
     "webrtc_log.h",
     "websocket_handshake_request_info.h",
-    "webvr_service_provider.cc",
-    "webvr_service_provider.h",
   ]
   configs += [
     "//build/config:precompiled_headers",
@@ -519,7 +527,10 @@ jumbo_source_set("browser_sources") {
       "xr_runtime_manager.h",
     ]
 
-    public_deps += [ "//device/vr/public/mojom" ]
+    public_deps += [
+      "//device/vr/public/cpp",
+      "//device/vr/public/mojom",
+    ]
   }
 }
 
diff --git a/chromium/content/public/browser/DEPS b/chromium/content/public/browser/DEPS
index 46a1122bec8..7be5bc6b731 100644
--- a/chromium/content/public/browser/DEPS
+++ b/chromium/content/public/browser/DEPS
@@ -7,6 +7,7 @@ include_rules = [
   "+components/viz/host",
   "+device/fido",
   "+device/vr/buildflags",
+  "+device/vr/public/cpp",
   "+device/vr/public/mojom",
   "+services/audio/public",
   "+services/content/public",
diff --git a/chromium/content/public/browser/allow_service_worker_result.cc b/chromium/content/public/browser/allow_service_worker_result.cc
new file mode 100644
index 00000000000..d3e0aaa574d
--- /dev/null
+++ b/chromium/content/public/browser/allow_service_worker_result.cc
@@ -0,0 +1,40 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/allow_service_worker_result.h"
+
+namespace content {
+
+AllowServiceWorkerResult AllowServiceWorkerResult::Yes() {
+  return AllowServiceWorkerResult(true, false, false);
+}
+
+AllowServiceWorkerResult AllowServiceWorkerResult::No() {
+  return AllowServiceWorkerResult(false, false, false);
+}
+
+AllowServiceWorkerResult AllowServiceWorkerResult::FromPolicy(
+    bool javascript_blocked_by_policy,
+    bool cookies_blocked_by_policy) {
+  return AllowServiceWorkerResult(
+      !javascript_blocked_by_policy && !cookies_blocked_by_policy,
+      javascript_blocked_by_policy, cookies_blocked_by_policy);
+}
+
+AllowServiceWorkerResult::AllowServiceWorkerResult(
+    bool allowed,
+    bool javascript_blocked_by_policy,
+    bool cookies_blocked_by_policy)
+    : allowed_(allowed),
+      javascript_blocked_by_policy_(javascript_blocked_by_policy),
+      cookies_blocked_by_policy_(cookies_blocked_by_policy) {}
+
+bool AllowServiceWorkerResult::operator==(
+    const AllowServiceWorkerResult& other) const {
+  return allowed_ == other.allowed_ &&
+         javascript_blocked_by_policy_ == other.javascript_blocked_by_policy_ &&
+         cookies_blocked_by_policy_ == other.cookies_blocked_by_policy_;
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/allow_service_worker_result.h b/chromium/content/public/browser/allow_service_worker_result.h
new file mode 100644
index 00000000000..e46bd7a316d
--- /dev/null
+++ b/chromium/content/public/browser/allow_service_worker_result.h
@@ -0,0 +1,41 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ALLOW_SERVICE_WORKER_RESULT_H_
+#define CONTENT_PUBLIC_BROWSER_ALLOW_SERVICE_WORKER_RESULT_H_
+
+#include "content/common/content_export.h"
+
+namespace content {
+
+class CONTENT_EXPORT AllowServiceWorkerResult {
+ public:
+  static AllowServiceWorkerResult Yes();
+  static AllowServiceWorkerResult No();
+  static AllowServiceWorkerResult FromPolicy(bool javascript_blocked_by_policy,
+                                             bool cookies_blocked_by_policy);
+
+  operator bool() { return allowed_; }
+
+  bool javascript_blocked_by_policy() const {
+    return javascript_blocked_by_policy_;
+  }
+
+  bool cookies_blocked_by_policy() const { return cookies_blocked_by_policy_; }
+
+  bool operator==(const AllowServiceWorkerResult& other) const;
+
+ private:
+  AllowServiceWorkerResult(bool allowed,
+                           bool javacript_blocked_by_policy,
+                           bool cookies_blocked_by_policy);
+
+  bool allowed_ = false;
+  bool javascript_blocked_by_policy_ = false;
+  bool cookies_blocked_by_policy_ = false;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ALLOW_SERVICE_WORKER_RESULT_H_
diff --git a/chromium/content/public/browser/android/app_web_message_port.h b/chromium/content/public/browser/android/app_web_message_port.h
new file mode 100644
index 00000000000..40485ef28ff
--- /dev/null
+++ b/chromium/content/public/browser/android/app_web_message_port.h
@@ -0,0 +1,36 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
+#define CONTENT_PUBLIC_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
+
+#include "base/android/jni_weak_ref.h"
+#include "base/android/scoped_java_ref.h"
+#include "content/common/content_export.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
+
+namespace content {
+namespace AppWebMessagePort {
+
+// Helper functions for converting between arrays of
+// blink::MessagePortDescriptors (the way message ports are passed around in
+// C++) and Java arrays of AppWebMessagePorts (the way they are passed around
+// in Java). This is exposed for embedders (Android Webview, for example).
+
+// Given an array of AppWebMessagePort objects, unwraps them and returns an
+// equivalent array of blink::MessagePortDescriptors.
+CONTENT_EXPORT std::vector<blink::MessagePortDescriptor> UnwrapJavaArray(
+    JNIEnv* env,
+    const base::android::JavaRef<jobjectArray>& jports);
+
+// Given an array of blink::MessagePortDescriptor objects, wraps them and
+// returns an equivalent array of AppWebMessagePort objects.
+CONTENT_EXPORT base::android::ScopedJavaGlobalRef<jobjectArray> WrapJavaArray(
+    JNIEnv* env,
+    std::vector<blink::MessagePortDescriptor> descriptors);
+
+}  // namespace AppWebMessagePort
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_ANDROID_APP_WEB_MESSAGE_PORT_H_
\ No newline at end of file
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.cc b/chromium/content/public/browser/authenticator_request_client_delegate.cc
index 2a6bd17b512..5030272c2c3 100644
--- a/chromium/content/public/browser/authenticator_request_client_delegate.cc
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.cc
@@ -42,8 +42,7 @@ void AuthenticatorRequestClientDelegate::RegisterActionCallbacks(
     base::OnceClosure cancel_callback,
     base::RepeatingClosure start_over_callback,
     device::FidoRequestHandlerBase::RequestCallback request_callback,
-    base::RepeatingClosure bluetooth_adapter_power_on_callback,
-    device::FidoRequestHandlerBase::BlePairingCallback ble_pairing_callback) {}
+    base::RepeatingClosure bluetooth_adapter_power_on_callback) {}
 
 bool AuthenticatorRequestClientDelegate::ShouldPermitIndividualAttestation(
     const std::string& relying_party_id) {
@@ -157,15 +156,6 @@ void AuthenticatorRequestClientDelegate::FidoAuthenticatorAdded(
 void AuthenticatorRequestClientDelegate::FidoAuthenticatorRemoved(
     base::StringPiece device_id) {}
 
-void AuthenticatorRequestClientDelegate::FidoAuthenticatorIdChanged(
-    base::StringPiece old_authenticator_id,
-    std::string new_authenticator_id) {}
-
-void AuthenticatorRequestClientDelegate::FidoAuthenticatorPairingModeChanged(
-    base::StringPiece authenticator_id,
-    bool is_in_pairing_mode,
-    base::string16 display_name) {}
-
 bool AuthenticatorRequestClientDelegate::SupportsPIN() const {
   return false;
 }
@@ -176,6 +166,12 @@ void AuthenticatorRequestClientDelegate::CollectPIN(
   NOTREACHED();
 }
 
+void AuthenticatorRequestClientDelegate::StartBioEnrollment(
+    base::OnceClosure next_callback) {}
+
+void AuthenticatorRequestClientDelegate::OnSampleCollected(
+    int bio_samples_remaining) {}
+
 void AuthenticatorRequestClientDelegate::FinishCollectToken() {
   NOTREACHED();
 }
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.h b/chromium/content/public/browser/authenticator_request_client_delegate.h
index 795327f8894..e184e0f6fb9 100644
--- a/chromium/content/public/browser/authenticator_request_client_delegate.h
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.h
@@ -99,8 +99,7 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
       base::OnceClosure cancel_callback,
       base::RepeatingClosure start_over_callback,
       device::FidoRequestHandlerBase::RequestCallback request_callback,
-      base::RepeatingClosure bluetooth_adapter_power_on_callback,
-      device::FidoRequestHandlerBase::BlePairingCallback ble_pairing_callback);
+      base::RepeatingClosure bluetooth_adapter_power_on_callback);
 
   // Returns true if the given relying party ID is permitted to receive
   // individual attestation certificates. This:
@@ -242,16 +241,12 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
   void FidoAuthenticatorAdded(
       const device::FidoAuthenticator& authenticator) override;
   void FidoAuthenticatorRemoved(base::StringPiece device_id) override;
-  void FidoAuthenticatorIdChanged(base::StringPiece old_authenticator_id,
-                                  std::string new_authenticator_id) override;
-  void FidoAuthenticatorPairingModeChanged(
-      base::StringPiece authenticator_id,
-      bool is_in_pairing_mode,
-      base::string16 display_name) override;
   bool SupportsPIN() const override;
   void CollectPIN(
       base::Optional<int> attempts,
       base::OnceCallback<void(std::string)> provide_pin_cb) override;
+  void StartBioEnrollment(base::OnceClosure next_callback) override;
+  void OnSampleCollected(int bio_samples_remaining) override;
   void FinishCollectToken() override;
   void OnRetryUserVerification(int attempts) override;
   void OnInternalUserVerificationLocked() override;
diff --git a/chromium/content/public/browser/browser_child_process_host_iterator.cc b/chromium/content/public/browser/browser_child_process_host_iterator.cc
index 82a08aa92a4..999a8117f7f 100644
--- a/chromium/content/public/browser/browser_child_process_host_iterator.cc
+++ b/chromium/content/public/browser/browser_child_process_host_iterator.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/browser_child_process_host_iterator.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/browser/browser_child_process_host_impl.h"
 #include "content/public/browser/browser_thread.h"
 
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index 5e621768a9d..8140c9b0468 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -25,6 +25,7 @@
 #include "net/url_request/url_request_job_factory.h"
 #include "services/content/public/mojom/navigable_contents_factory.mojom-forward.h"
 #include "services/network/public/mojom/cors_origin_pattern.mojom-forward.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom-forward.h"
 #include "third_party/blink/public/mojom/push_messaging/push_messaging_status.mojom-forward.h"
 
@@ -36,17 +37,12 @@ class GURL;
 
 namespace base {
 class FilePath;
-class Token;
 }  // namespace base
 
 namespace download {
 class InProgressDownloadManager;
 }
 
-namespace service_manager {
-class Connector;
-}  // namespace service_manager
-
 namespace storage {
 class ExternalMountPoints;
 }
@@ -92,7 +88,6 @@ class PermissionController;
 class PermissionControllerDelegate;
 class PushMessagingService;
 class ResourceContext;
-class ServiceManagerConnection;
 class SharedCorsOriginAccessList;
 class SiteInstance;
 class StorageNotificationService;
@@ -219,31 +214,6 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
       BrowserContext* browser_context,
       std::unique_ptr<PermissionController> permission_controller);
 
-  // Makes the Service Manager aware of this BrowserContext, and assigns a
-  // instance group ID to it. Should be called for each BrowserContext created.
-  static void Initialize(BrowserContext* browser_context,
-                         const base::FilePath& path);
-
-  // Returns a Service instance group ID associated with this BrowserContext.
-  // This ID is not persistent across runs. See
-  // services/service_manager/public/mojom/connector.mojom. By default,
-  // group ID is randomly generated when Initialize() is called.
-  static const base::Token& GetServiceInstanceGroupFor(
-      BrowserContext* browser_context);
-
-  // Returns the BrowserContext associated with |instance_group|, or nullptr if
-  // no BrowserContext exists for that |instance_group|.
-  static BrowserContext* GetBrowserContextForServiceInstanceGroup(
-      const base::Token& instance_group);
-
-  // Returns a Connector associated with this BrowserContext, which can be used
-  // to connect to service instances bound as this user.
-  static service_manager::Connector* GetConnectorFor(
-      BrowserContext* browser_context);
-
-  static ServiceManagerConnection* GetServiceManagerConnectionFor(
-      BrowserContext* browser_context);
-
   BrowserContext();
 
   ~BrowserContext() override;
diff --git a/chromium/content/public/browser/browser_message_filter.cc b/chromium/content/public/browser/browser_message_filter.cc
index d2941854f88..04b2d4b8808 100644
--- a/chromium/content/public/browser/browser_message_filter.cc
+++ b/chromium/content/public/browser/browser_message_filter.cc
@@ -6,10 +6,11 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/debug/dump_without_crashing.h"
-#include "base/logging.h"
 #include "base/macros.h"
+#include "base/notreached.h"
 #include "base/process/process_handle.h"
 #include "base/task_runner.h"
 #include "build/build_config.h"
diff --git a/chromium/content/public/browser/browser_message_filter.h b/chromium/content/public/browser/browser_message_filter.h
index b4ee929ddc2..1feef469294 100644
--- a/chromium/content/public/browser/browser_message_filter.h
+++ b/chromium/content/public/browser/browser_message_filter.h
@@ -31,6 +31,11 @@ struct BrowserMessageFilterTraits;
 
 // Base class for message filters in the browser process.  You can receive and
 // send messages on any thread.
+//
+// BrowserMessageFilters are ref-counted, and a reference to them is held by the
+// IPC ChannelProxy for which they have been installed, so do not rely on the
+// destructor being called on a specific sequence unless you specify otherwise
+// in OnDestruct().
 class CONTENT_EXPORT BrowserMessageFilter
     : public base::RefCountedThreadSafe<
           BrowserMessageFilter, BrowserMessageFilterTraits>,
diff --git a/chromium/content/public/browser/browser_url_handler.h b/chromium/content/public/browser/browser_url_handler.h
index 5f023acc281..37577880811 100644
--- a/chromium/content/public/browser/browser_url_handler.h
+++ b/chromium/content/public/browser/browser_url_handler.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_PUBLIC_BROWSER_BROWSER_URL_HANDLER_H_
 #define CONTENT_PUBLIC_BROWSER_BROWSER_URL_HANDLER_H_
 
+#include <vector>
+
 #include "content/common/content_export.h"
 
 class GURL;
@@ -40,6 +42,15 @@ class CONTENT_EXPORT BrowserURLHandler {
   virtual void RewriteURLIfNecessary(GURL* url,
                                      BrowserContext* browser_context) = 0;
 
+  // Returns the list of possible rewrites, in order of priority (i.e., index 0
+  // is the rewrite that would be used in RewriteURLIfNecessary()). Note that
+  // this only allows for one rewrite per registered URLHandler (and each gets a
+  // fresh copy of |url|), so it is not necessarily the complete set of all
+  // possible rewrites.
+  virtual std::vector<GURL> GetPossibleRewrites(
+      const GURL& url,
+      BrowserContext* browser_context) = 0;
+
   // Set the specified handler as a preliminary fixup phase to be done before
   // rewriting.  This allows minor cleanup for the URL without having it affect
   // the virtual URL.
diff --git a/chromium/content/public/browser/browsing_data_filter_builder.h b/chromium/content/public/browser/browsing_data_filter_builder.h
index f1080fc2704..3f66b20697a 100644
--- a/chromium/content/public/browser/browsing_data_filter_builder.h
+++ b/chromium/content/public/browser/browsing_data_filter_builder.h
@@ -28,7 +28,7 @@ namespace content {
 // entries can be origins or registrable domains.
 //
 // This class defines interface to build filters for various kinds of browsing
-// data. |BuildGeneralFilter()| is useful for most browsing data storage
+// data. |BuildUrlFilter()| is useful for most browsing data storage
 // backends, but some backends, such as website settings and cookies, use
 // other formats of filter.
 class CONTENT_EXPORT BrowsingDataFilterBuilder {
@@ -63,7 +63,7 @@ class CONTENT_EXPORT BrowsingDataFilterBuilder {
 
   // Builds a filter that matches URLs that are in the whitelist,
   // or aren't in the blacklist.
-  virtual base::RepeatingCallback<bool(const GURL&)> BuildGeneralFilter() = 0;
+  virtual base::RepeatingCallback<bool(const GURL&)> BuildUrlFilter() = 0;
 
   // Builds a filter that can be used with the network service. This uses a Mojo
   // struct rather than a predicate function (as used by the rest of the filters
diff --git a/chromium/content/public/browser/browsing_data_remover.h b/chromium/content/public/browser/browsing_data_remover.h
index d6ded46a2f8..586ecaa5d32 100644
--- a/chromium/content/public/browser/browsing_data_remover.h
+++ b/chromium/content/public/browser/browsing_data_remover.h
@@ -103,8 +103,16 @@ class BrowsingDataRemover {
     // TODO(crbug.com/798760): Remove when fixed.
     DATA_TYPE_AVOID_CLOSING_CONNECTIONS = 1 << 15,
 
+    // Trust Token API (https://github.com/wicg/trust-token-api) persistent
+    // storage.
+    DATA_TYPE_TRUST_TOKENS = 1 << 16,
+
+    // Conversion measurement API
+    // (https://github.com/WICG/conversion-measurement-api) persistent storage.
+    DATA_TYPE_CONVERSIONS = 1 << 17,
+
     // Embedders can add more datatypes beyond this point.
-    DATA_TYPE_CONTENT_END = DATA_TYPE_AVOID_CLOSING_CONNECTIONS,
+    DATA_TYPE_CONTENT_END = DATA_TYPE_CONVERSIONS,
   };
 
   enum OriginType {
diff --git a/chromium/content/public/browser/child_process_security_policy.h b/chromium/content/public/browser/child_process_security_policy.h
index bc2564897ec..650a8d968c9 100644
--- a/chromium/content/public/browser/child_process_security_policy.h
+++ b/chromium/content/public/browser/child_process_security_policy.h
@@ -327,6 +327,9 @@ class ChildProcessSecurityPolicy {
   virtual std::vector<url::Origin> GetIsolatedOrigins(
       base::Optional<IsolatedOriginSource> source = base::nullopt,
       BrowserContext* browser_context = nullptr) = 0;
+
+  // Clears all isolated origins.  This is unsafe to use outside of testing.
+  virtual void ClearIsolatedOriginsForTesting() = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/child_process_termination_info.h b/chromium/content/public/browser/child_process_termination_info.h
index 7957a114fd3..1edb82c008c 100644
--- a/chromium/content/public/browser/child_process_termination_info.h
+++ b/chromium/content/public/browser/child_process_termination_info.h
@@ -6,7 +6,6 @@
 #define CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_TERMINATION_INFO_H_
 
 #include "base/process/kill.h"
-#include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/common/result_codes.h"
@@ -30,10 +29,6 @@ struct CONTENT_EXPORT ChildProcessTerminationInfo {
   // posix, from GetExitCodeProcess on Windows).
   int exit_code = service_manager::RESULT_CODE_NORMAL_EXIT;
 
-  // Time delta between 1) the process start and 2) the time when
-  // ChildProcessTerminationInfo is computed.
-  base::TimeDelta uptime = base::TimeDelta::Max();
-
   // Populated only for renderer process. True if there are any visible
   // clients at the time of process death.
   bool renderer_has_visible_clients = false;
diff --git a/chromium/content/public/browser/client_hints_controller_delegate.h b/chromium/content/public/browser/client_hints_controller_delegate.h
index 2b3da2b4541..47781e7e3c6 100644
--- a/chromium/content/public/browser/client_hints_controller_delegate.h
+++ b/chromium/content/public/browser/client_hints_controller_delegate.h
@@ -43,7 +43,7 @@ class CONTENT_EXPORT ClientHintsControllerDelegate
 
   virtual bool IsJavaScriptAllowed(const GURL& url) = 0;
 
-  virtual std::string GetAcceptLanguageString() = 0;
+  virtual bool UserAgentClientHintEnabled() = 0;
 
   virtual blink::UserAgentMetadata GetUserAgentMetadata() = 0;
 
@@ -53,7 +53,7 @@ class CONTENT_EXPORT ClientHintsControllerDelegate
   // mojom::ClientHints implementation.
   void PersistClientHints(
       const url::Origin& primary_origin,
-      const std::vector<blink::mojom::WebClientHintsType>& client_hints,
+      const std::vector<network::mojom::WebClientHintsType>& client_hints,
       base::TimeDelta expiration_duration) override = 0;
 
   virtual void ResetForTesting() {}
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index 89f33b33f8c..c8c1e668d08 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -9,15 +9,16 @@
 // declarations instead of including more headers. If that is infeasible, adjust
 // the limit. For more info, see
 // https://chromium.googlesource.com/chromium/src/+/HEAD/docs/wmax_tokens.md
-#pragma clang max_tokens_here 820000
+#pragma clang max_tokens_here 840000
 
 #include <utility>
 
+#include "base/check.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
 #include "base/guid.h"
-#include "base/logging.h"
 #include "base/no_destructor.h"
+#include "base/notreached.h"
 #include "base/sequenced_task_runner.h"
 #include "build/build_config.h"
 #include "content/public/browser/authenticator_request_client_delegate.h"
@@ -36,7 +37,6 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_utils.h"
 #include "media/audio/audio_manager.h"
-#include "media/media_buildflags.h"
 #include "media/mojo/mojom/media_service.mojom.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "net/ssl/client_cert_identity.h"
@@ -48,6 +48,7 @@
 #include "services/service_manager/public/cpp/manifest.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "storage/browser/quota/quota_manager.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/mojom/renderer_preference_watcher.mojom.h"
@@ -123,7 +124,7 @@ bool ContentBrowserClient::ShouldUseMobileFlingCurve() {
 
 bool ContentBrowserClient::ShouldUseProcessPerSite(
     BrowserContext* browser_context,
-    const GURL& effective_url) {
+    const GURL& site_url) {
   DCHECK(browser_context);
   return false;
 }
@@ -147,6 +148,11 @@ bool ContentBrowserClient::ShouldLockToOrigin(BrowserContext* browser_context,
   return true;
 }
 
+bool ContentBrowserClient::DoesWebUISchemeRequireProcessLock(
+    base::StringPiece scheme) {
+  return true;
+}
+
 bool ContentBrowserClient::ShouldTreatURLSchemeAsFirstPartyWhenTopLevel(
     base::StringPiece scheme,
     bool is_embedded_origin_secure) {
@@ -237,7 +243,6 @@ bool ContentBrowserClient::OverridesAudioManager() {
 
 void ContentBrowserClient::GetHardwareSecureDecryptionCaps(
     const std::string& key_system,
-    const base::flat_set<media::CdmProxy::Protocol>& cdm_proxy_protocols,
     base::flat_set<media::VideoCodec>* video_codecs,
     base::flat_set<media::EncryptionScheme>* encryption_schemes) {}
 
@@ -300,30 +305,30 @@ base::FilePath ContentBrowserClient::GetLoggingFileName(
   return base::FilePath();
 }
 
-bool ContentBrowserClient::AllowAppCache(const GURL& manifest_url,
-                                         const GURL& first_party,
-                                         BrowserContext* context) {
+bool ContentBrowserClient::AllowAppCache(
+    const GURL& manifest_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin,
+    BrowserContext* context) {
   return true;
 }
 
-bool ContentBrowserClient::AllowServiceWorkerOnIO(
+AllowServiceWorkerResult ContentBrowserClient::AllowServiceWorkerOnIO(
     const GURL& scope,
     const GURL& site_for_cookies,
     const base::Optional<url::Origin>& top_frame_origin,
     const GURL& script_url,
-    ResourceContext* context,
-    base::RepeatingCallback<WebContents*()> wc_getter) {
-  return true;
+    ResourceContext* context) {
+  return AllowServiceWorkerResult::Yes();
 }
 
-bool ContentBrowserClient::AllowServiceWorkerOnUI(
+AllowServiceWorkerResult ContentBrowserClient::AllowServiceWorkerOnUI(
     const GURL& scope,
     const GURL& site_for_cookies,
     const base::Optional<url::Origin>& top_frame_origin,
     const GURL& script_url,
-    BrowserContext* context,
-    base::RepeatingCallback<WebContents*()> wc_getter) {
-  return true;
+    BrowserContext* context) {
+  return AllowServiceWorkerResult::Yes();
 }
 
 bool ContentBrowserClient::AllowSharedWorker(
@@ -423,6 +428,13 @@ void ContentBrowserClient::AllowCertificateError(
   std::move(callback).Run(CERTIFICATE_REQUEST_RESULT_TYPE_DENY);
 }
 
+bool ContentBrowserClient::ShouldDenyRequestOnCertificateError(
+    const GURL main_frame_url) {
+  // Generally we shouldn't deny all certificate errors, but individual
+  // subclasses may override this for special cases.
+  return false;
+}
+
 base::OnceClosure ContentBrowserClient::SelectClientCertificate(
     WebContents* web_contents,
     net::SSLCertRequestInfo* cert_request_info,
@@ -806,20 +818,14 @@ ContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
 void ContentBrowserClient::OnNetworkServiceCreated(
     network::mojom::NetworkService* network_service) {}
 
-mojo::Remote<network::mojom::NetworkContext>
-ContentBrowserClient::CreateNetworkContext(
+void ContentBrowserClient::ConfigureNetworkContextParams(
     BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  DCHECK(context);
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
-  context_params->user_agent = GetUserAgent();
-  context_params->accept_language = "en-us,en";
-  GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  network_context_params->user_agent = GetUserAgent();
+  network_context_params->accept_language = "en-us,en";
 }
 
 std::vector<base::FilePath>
@@ -1074,4 +1080,18 @@ XrIntegrationClient* ContentBrowserClient::GetXrIntegrationClient() {
 }
 #endif
 
+bool ContentBrowserClient::IsOriginTrialRequiredForAppCache(
+    content::BrowserContext* browser_context) {
+  // In Chrome proper, this also considers Profile preferences.
+  // As a default, only consider the base::Feature.
+  // Compare this with the ChromeContentBrowserClient implementation.
+  return base::FeatureList::IsEnabled(
+      blink::features::kAppCacheRequireOriginTrial);
+}
+
+bool ContentBrowserClient::ShouldInheritCrossOriginEmbedderPolicyImplicitly(
+    const GURL& url) {
+  return false;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index 26cd6d1afcb..b211fea9879 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -14,6 +14,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/callback_forward.h"
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
 #include "base/files/file_path.h"
@@ -24,6 +25,7 @@
 #include "base/util/type_safety/strong_alias.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/allow_service_worker_result.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "content/public/browser/generated_code_cache_settings.h"
 #include "content/public/common/page_visibility_state.h"
@@ -31,7 +33,6 @@
 #include "content/public/common/window_container_type.mojom-forward.h"
 #include "device/vr/buildflags/buildflags.h"
 #include "media/base/video_codecs.h"
-#include "media/cdm/cdm_proxy.h"
 #include "media/mojo/mojom/media_service.mojom-forward.h"
 #include "media/mojo/mojom/remoting.mojom-forward.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
@@ -51,6 +52,7 @@
 #include "ui/gfx/image/image_skia.h"
 #include "url/gurl.h"
 #include "url/origin.h"
+#include "url/url_constants.h"
 
 #if (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
 #include "base/posix/global_descriptors.h"
@@ -78,7 +80,6 @@ class SequencedTaskRunner;
 namespace blink {
 namespace mojom {
 class BadgeService;
-class CredentialManager;
 class RendererPreferences;
 class RendererPreferenceWatcher;
 class WebUsbService;
@@ -99,6 +100,11 @@ class AudioManager;
 enum class EncryptionScheme;
 }  // namespace media
 
+namespace mojo {
+template <typename>
+class BinderMapWithContext;
+}  // namespace mojo
+
 namespace network {
 enum class OriginPolicyState;
 class SharedURLLoaderFactory;
@@ -117,9 +123,6 @@ template <typename...>
 class BinderRegistryWithArgs;
 using BinderRegistry = BinderRegistryWithArgs<>;
 
-template <typename>
-class BinderMapWithContext;
-
 namespace mojom {
 class Service;
 }  // namespace mojom
@@ -321,10 +324,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   // curve for scrolling.
   virtual bool ShouldUseMobileFlingCurve();
 
-  // Returns whether all instances of the specified effective URL should be
+  // Returns whether all instances of the specified site URL should be
   // rendered by the same process, rather than using process-per-site-instance.
   virtual bool ShouldUseProcessPerSite(BrowserContext* browser_context,
-                                       const GURL& effective_url);
+                                       const GURL& site_url);
 
   // Returns whether a spare RenderProcessHost should be used for navigating to
   // the specified site URL.
@@ -356,6 +359,12 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual bool ShouldLockToOrigin(BrowserContext* browser_context,
                                   const GURL& effective_url);
 
+  // Returns a boolean indicating whether the WebUI |scheme| requires its
+  // process to be locked to the WebUI origin.
+  // Note: This method can be called from multiple threads. It is not safe to
+  // assume it runs only on the UI thread.
+  virtual bool DoesWebUISchemeRequireProcessLock(base::StringPiece scheme);
+
   // Returns true if everything embedded inside a document with given scheme
   // should be treated as first-party content. |scheme| will be in canonical
   // (lowercased) form. |is_embedded_origin_secure| refers to whether the origin
@@ -573,9 +582,11 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   // Allow the embedder to control if an AppCache can be used for the given url.
   // This is called on the UI thread.
-  virtual bool AllowAppCache(const GURL& manifest_url,
-                             const GURL& first_party,
-                             BrowserContext* context);
+  virtual bool AllowAppCache(
+      const GURL& manifest_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
+      BrowserContext* context);
 
   // Allows the embedder to control if a service worker is allowed at the given
   // |scope| and can be accessed from |site_for_cookies| and |top_frame_origin|.
@@ -592,24 +603,20 @@ class CONTENT_EXPORT ContentBrowserClient {
   // made to access the registration but there is no specific service worker in
   // the registration being acted on.
   //
-  // A null |wc_getter| callback indicates this is for starting a service
-  // worker, which is not necessarily associated with a particular tab.
   // This is called on the IO thread.
-  virtual bool AllowServiceWorkerOnIO(
+  virtual AllowServiceWorkerResult AllowServiceWorkerOnIO(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      ResourceContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter);
+      ResourceContext* context);
   // Same but for the UI thread.
-  virtual bool AllowServiceWorkerOnUI(
+  virtual AllowServiceWorkerResult AllowServiceWorkerOnUI(
       const GURL& scope,
       const GURL& site_for_cookies,
       const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
-      BrowserContext* context,
-      base::RepeatingCallback<WebContents*()> wc_getter);
+      BrowserContext* context);
 
   // Allow the embedder to control if a Shared Worker can be connected from a
   // given tab.
@@ -787,6 +794,10 @@ class CONTENT_EXPORT ContentBrowserClient {
       bool strict_enforcement,
       base::OnceCallback<void(CertificateRequestResultType)> callback);
 
+  // Returns true if all requests with certificate errors should be blocked
+  // for a given |main_frame_url|, regardless of any other security settings.
+  virtual bool ShouldDenyRequestOnCertificateError(const GURL main_frame_url);
+
   // Selects a SSL client certificate and returns it to the |delegate|. Note:
   // |delegate| may be called synchronously or asynchronously.
   //
@@ -979,6 +990,11 @@ class CONTENT_EXPORT ContentBrowserClient {
       blink::AssociatedInterfaceRegistry* associated_registry,
       RenderProcessHost* render_process_host) {}
 
+  // Called to bind additional frame-bound media interfaces to the renderer.
+  virtual void BindMediaServiceReceiver(RenderFrameHost* render_frame_host,
+                                        mojo::GenericPendingReceiver receiver) {
+  }
+
   // Called when RenderFrameHostImpl connects to the Media service. Expose
   // interfaces to the service using |registry|.
   virtual void ExposeInterfacesToMediaService(
@@ -998,20 +1014,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // handling InterfaceProvider's GetInterface() calls (see crbug.com/718652).
   virtual void RegisterBrowserInterfaceBindersForFrame(
       RenderFrameHost* render_frame_host,
-      service_manager::BinderMapWithContext<RenderFrameHost*>* map) {}
-
-  // Content was unable to bind a request for this interface, so the embedder
-  // should try.
-  virtual void BindInterfaceRequestFromFrame(
-      RenderFrameHost* render_frame_host,
-      const std::string& interface_name,
-      mojo::ScopedMessagePipeHandle interface_pipe) {}
-
-  // Content was unable to bind a CredentialManager pending receiver, so the
-  // embedder should try.
-  virtual void BindCredentialManagerReceiver(
-      RenderFrameHost* render_frame_host,
-      mojo::PendingReceiver<blink::mojom::CredentialManager> receiver) {}
+      mojo::BinderMapWithContext<RenderFrameHost*>* map) {}
 
   // Content was unable to bind a receiver for this associated interface, so the
   // embedder should try. Returns true if the |handle| was actually taken and
@@ -1141,13 +1144,9 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   // Gets supported hardware secure |video_codecs| and |encryption_schemes| for
   // the purpose of decrypting encrypted media using a Content Decryption Module
-  // (CDM) and a CdmProxy associated with |key_system|. The CDM supports all
-  // protocols in |cdm_proxy_protocols|, but only one CdmProxy protocol will be
-  // supported by the CdmProxy on the system, for which the capabilities will
-  // be returned.
+  // (CDM) associated with |key_system|.
   virtual void GetHardwareSecureDecryptionCaps(
       const std::string& key_system,
-      const base::flat_set<media::CdmProxy::Protocol>& cdm_proxy_protocols,
       base::flat_set<media::VideoCodec>* video_codecs,
       base::flat_set<media::EncryptionScheme>* encryption_schemes);
 
@@ -1462,15 +1461,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service);
 
-  // Creates a NetworkContext for a BrowserContext's StoragePartition. If the
-  // network service is enabled, it must return a NetworkContext using the
-  // network service. If the network service is disabled, the embedder may
-  // return a NetworkContext, or it may return nullptr, in which case the
-  // StoragePartition will create one wrapping the URLRequestContext obtained
-  // from the BrowserContext.
-  //
-  // Called before the corresonding BrowserContext::CreateRequestContext method
-  // is called.
+  // Configures the NetworkContextParams (|network_context_params|) and
+  // CertVerifierCreationParams (|cert_verifier_creation_params|) for a
+  // BrowserContext's StoragePartition. StoragePartition will use the
+  // NetworkService to create a new NetworkContext using these params.
   //
   // If |in_memory| is true, |relative_partition_path| is still a path that
   // uniquely identifies the storage partition, though nothing should be written
@@ -1478,14 +1472,13 @@ class CONTENT_EXPORT ContentBrowserClient {
   //
   // If |relative_partition_path| is the empty string, it means this needs to
   // create the default NetworkContext for the BrowserContext.
-  //
-  // For NetworkContexts returned from the Network Service, some requirements:
-  //   -enable data URL support (or else data URLs will fail)
-  //   -disable file URL support (for security)
-  virtual mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  virtual void ConfigureNetworkContextParams(
       BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   // Returns the parent paths that contain all the network service's
   // BrowserContexts' storage. Multiple paths can be returned, e.g. in case the
@@ -1812,7 +1805,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Called to log a UKM event for the
   // Extensions.CrossOriginFetchFromContentScript3 metric.  See the metric
   // definition in //tools/metrics/ukm/ukm.xml for more details, including when
-  // this metric should be logged.
+  // this event should be logged.
   //
   // |isolated_world_host| is the hostname of the isolated world origin that has
   // initiated the network request.  See the doc comment for
@@ -1834,6 +1827,14 @@ class CONTENT_EXPORT ContentBrowserClient {
   // functionality.
   virtual XrIntegrationClient* GetXrIntegrationClient();
 #endif
+
+  virtual bool IsOriginTrialRequiredForAppCache(
+      content::BrowserContext* browser_text);
+
+  // Returns true when a context (e.g., iframe) whose URL is |url| should
+  // inherit the parent COEP value implicitly, similar to "blob:"
+  virtual bool ShouldInheritCrossOriginEmbedderPolicyImplicitly(
+      const GURL& url);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/cookie_access_details.cc b/chromium/content/public/browser/cookie_access_details.cc
new file mode 100644
index 00000000000..e0e84f450fa
--- /dev/null
+++ b/chromium/content/public/browser/cookie_access_details.cc
@@ -0,0 +1,28 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/cookie_access_details.h"
+
+namespace content {
+
+CookieAccessDetails::CookieAccessDetails() = default;
+CookieAccessDetails::~CookieAccessDetails() = default;
+
+CookieAccessDetails::CookieAccessDetails(Type type,
+                                         const GURL& url,
+                                         const GURL& first_party_url,
+                                         const net::CookieList& cookie_list,
+                                         bool blocked_by_policy)
+    : type(type),
+      url(url),
+      first_party_url(first_party_url),
+      cookie_list(cookie_list),
+      blocked_by_policy(blocked_by_policy) {}
+
+CookieAccessDetails::CookieAccessDetails(const CookieAccessDetails& details) =
+    default;
+CookieAccessDetails& CookieAccessDetails::operator=(
+    const CookieAccessDetails& details) = default;
+
+}  // namespace content
diff --git a/chromium/content/public/browser/cookie_access_details.h b/chromium/content/public/browser/cookie_access_details.h
new file mode 100644
index 00000000000..56d2d41ca92
--- /dev/null
+++ b/chromium/content/public/browser/cookie_access_details.h
@@ -0,0 +1,38 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_COOKIE_ACCESS_DETAILS_H_
+#define CONTENT_PUBLIC_BROWSER_COOKIE_ACCESS_DETAILS_H_
+
+#include "content/common/content_export.h"
+#include "net/cookies/canonical_cookie.h"
+#include "services/network/public/mojom/cookie_access_observer.mojom.h"
+#include "url/gurl.h"
+
+namespace content {
+
+struct CONTENT_EXPORT CookieAccessDetails {
+  using Type = network::mojom::CookieAccessDetails::Type;
+
+  CookieAccessDetails();
+  CookieAccessDetails(Type type,
+                      const GURL& url,
+                      const GURL& first_party_url,
+                      const net::CookieList& list,
+                      bool blocked_by_policy = false);
+  ~CookieAccessDetails();
+
+  CookieAccessDetails(const CookieAccessDetails&);
+  CookieAccessDetails& operator=(const CookieAccessDetails&);
+
+  Type type;
+  GURL url;
+  GURL first_party_url;
+  net::CookieList cookie_list;
+  bool blocked_by_policy;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_COOKIE_ACCESS_DETAILS_H_
diff --git a/chromium/content/public/browser/dedicated_worker_id.h b/chromium/content/public/browser/dedicated_worker_id.h
new file mode 100644
index 00000000000..c626c53ba12
--- /dev/null
+++ b/chromium/content/public/browser/dedicated_worker_id.h
@@ -0,0 +1,16 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_DEDICATED_WORKER_ID_H_
+#define CONTENT_PUBLIC_BROWSER_DEDICATED_WORKER_ID_H_
+
+#include "base/util/type_safety/id_type.h"
+
+namespace content {
+
+using DedicatedWorkerId = util::IdType64<class DedicatedWorkerTag>;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_DEDICATED_WORKER_ID_H_
diff --git a/chromium/content/public/browser/dedicated_worker_service.h b/chromium/content/public/browser/dedicated_worker_service.h
index 6ca048cc3b8..4c5dae9e6df 100644
--- a/chromium/content/public/browser/dedicated_worker_service.h
+++ b/chromium/content/public/browser/dedicated_worker_service.h
@@ -6,16 +6,14 @@
 #define CONTENT_PUBLIC_BROWSER_DEDICATED_WORKER_SERVICE_H_
 
 #include "base/observer_list_types.h"
-#include "base/util/type_safety/id_type.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/dedicated_worker_id.h"
 #include "content/public/browser/global_routing_id.h"
 
 class GURL;
 
 namespace content {
 
-using DedicatedWorkerId = util::IdType64<class DedicatedWorkerTag>;
-
 // An interface that allows to subscribe to the lifetime of dedicated workers.
 // The service is owned by the StoragePartition and lives on the UI thread.
 class CONTENT_EXPORT DedicatedWorkerService {
diff --git a/chromium/content/public/browser/desktop_media_id.cc b/chromium/content/public/browser/desktop_media_id.cc
index 9330ec65d44..8907eedd8db 100644
--- a/chromium/content/public/browser/desktop_media_id.cc
+++ b/chromium/content/public/browser/desktop_media_id.cc
@@ -114,7 +114,6 @@ std::string DesktopMediaID::ToString() const {
       break;
     case TYPE_WEB_CONTENTS:
       return web_contents_id.ToString();
-      break;
   }
   DCHECK(!prefix.empty());
 
diff --git a/chromium/content/public/browser/download_manager_delegate.cc b/chromium/content/public/browser/download_manager_delegate.cc
index c83cd5aa33a..bea2e24ba8e 100644
--- a/chromium/content/public/browser/download_manager_delegate.cc
+++ b/chromium/content/public/browser/download_manager_delegate.cc
@@ -21,7 +21,14 @@ bool DownloadManagerDelegate::DetermineDownloadTarget(
   return false;
 }
 
-bool DownloadManagerDelegate::ShouldOpenFileBasedOnExtension(
+bool DownloadManagerDelegate::ShouldAutomaticallyOpenFile(
+    const GURL& url,
+    const base::FilePath& path) {
+  return false;
+}
+
+bool DownloadManagerDelegate::ShouldAutomaticallyOpenFileByPolicy(
+    const GURL& url,
     const base::FilePath& path) {
   return false;
 }
diff --git a/chromium/content/public/browser/download_manager_delegate.h b/chromium/content/public/browser/download_manager_delegate.h
index 6048d95f839..5105f4c80c8 100644
--- a/chromium/content/public/browser/download_manager_delegate.h
+++ b/chromium/content/public/browser/download_manager_delegate.h
@@ -21,6 +21,8 @@
 #include "content/public/browser/web_contents.h"
 #include "url/origin.h"
 
+class GURL;
+
 namespace content {
 
 class BrowserContext;
@@ -103,8 +105,18 @@ class CONTENT_EXPORT DownloadManagerDelegate {
   virtual bool DetermineDownloadTarget(download::DownloadItem* item,
                                        DownloadTargetCallback* callback);
 
-  // Tests if a file type should be opened automatically.
-  virtual bool ShouldOpenFileBasedOnExtension(const base::FilePath& path);
+  // Tests if a file type should be opened automatically. This consider both
+  // user and policy settings, and should be called when it doesn't matter
+  // what set the auto-open, just if it is set.
+  virtual bool ShouldAutomaticallyOpenFile(const GURL& url,
+                                           const base::FilePath& path);
+
+  // Tests if a file type should be opened automatically by policy. This
+  // should only be used if it matters if the file will auto-open by policy.
+  // Generally used to determine if we need to show UI indicating an active
+  // policy.
+  virtual bool ShouldAutomaticallyOpenFileByPolicy(const GURL& url,
+                                                   const base::FilePath& path);
 
   // Allows the delegate to delay completion of the download.  This function
   // will either return true (in which case the download may complete)
diff --git a/chromium/content/public/browser/eye_dropper.h b/chromium/content/public/browser/eye_dropper.h
new file mode 100644
index 00000000000..e84ed07be48
--- /dev/null
+++ b/chromium/content/public/browser/eye_dropper.h
@@ -0,0 +1,18 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_EYE_DROPPER_H_
+#define CONTENT_PUBLIC_BROWSER_EYE_DROPPER_H_
+
+namespace content {
+
+// Interface for an eye dropper window.
+class EyeDropper {
+ public:
+  virtual ~EyeDropper() = default;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_EYE_DROPPER_H_
diff --git a/chromium/content/public/browser/eye_dropper_listener.h b/chromium/content/public/browser/eye_dropper_listener.h
new file mode 100644
index 00000000000..770f969d79e
--- /dev/null
+++ b/chromium/content/public/browser/eye_dropper_listener.h
@@ -0,0 +1,25 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_EYE_DROPPER_LISTENER_H_
+#define CONTENT_PUBLIC_BROWSER_EYE_DROPPER_LISTENER_H_
+
+#include <memory>
+
+#include "third_party/skia/include/core/SkColor.h"
+
+namespace content {
+
+// Callback interface to receive the color selection from the eye dropper.
+class EyeDropperListener {
+ public:
+  virtual ~EyeDropperListener() = default;
+
+  virtual void ColorSelected(SkColor color) = 0;
+  virtual void ColorSelectionCanceled() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_EYE_DROPPER_LISTENER_H_
diff --git a/chromium/content/public/browser/global_routing_id.h b/chromium/content/public/browser/global_routing_id.h
index 7cb4ea086f3..c7e5573f5fd 100644
--- a/chromium/content/public/browser/global_routing_id.h
+++ b/chromium/content/public/browser/global_routing_id.h
@@ -69,6 +69,9 @@ struct GlobalFrameRoutingId {
   bool operator!=(const GlobalFrameRoutingId& other) const {
     return !(*this == other);
   }
+  explicit operator bool() const {
+    return frame_routing_id != MSG_ROUTING_NONE;
+  }
 };
 
 struct GlobalFrameRoutingIdHasher {
diff --git a/chromium/content/public/browser/gpu_utils.cc b/chromium/content/public/browser/gpu_utils.cc
index c042dc97454..438d5f19ace 100644
--- a/chromium/content/public/browser/gpu_utils.cc
+++ b/chromium/content/public/browser/gpu_utils.cc
@@ -92,7 +92,7 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
       command_line->HasSwitch(switches::kDisableOopRasterization);
 
   gpu_preferences.enable_oop_rasterization_ddl =
-      command_line->HasSwitch(switches::kEnableOopRasterizationDDL);
+      base::FeatureList::IsEnabled(features::kOopRasterizationDDL);
   gpu_preferences.enforce_vulkan_protected_memory =
       command_line->HasSwitch(switches::kEnforceVulkanProtectedMemory);
   gpu_preferences.disable_vulkan_fallback_to_gl_for_testing =
@@ -135,4 +135,17 @@ gpu::GpuChannelEstablishFactory* GetGpuChannelEstablishFactory() {
   return BrowserMainLoop::GetInstance()->gpu_channel_establish_factory();
 }
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+void DumpGpuProfilingData(base::OnceClosure callback) {
+  content::GpuProcessHost::CallOnIO(
+      content::GPU_PROCESS_KIND_SANDBOXED, false /* force_create */,
+      base::BindOnce(
+          [](base::OnceClosure callback, content::GpuProcessHost* host) {
+            host->gpu_service()->WriteClangProfilingProfile(
+                std::move(callback));
+          },
+          std::move(callback)));
+}
+#endif  // BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+
 }  // namespace content
diff --git a/chromium/content/public/browser/gpu_utils.h b/chromium/content/public/browser/gpu_utils.h
index b1d9fd7f735..b35ec8ea2c5 100644
--- a/chromium/content/public/browser/gpu_utils.h
+++ b/chromium/content/public/browser/gpu_utils.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_GPU_UTILS_H_
 
 #include "base/callback_forward.h"
+#include "base/clang_profiling_buildflags.h"
 #include "content/common/content_export.h"
 #include "gpu/config/gpu_preferences.h"
 
@@ -21,6 +22,10 @@ CONTENT_EXPORT void StopGpuProcess(base::OnceClosure callback);
 
 CONTENT_EXPORT gpu::GpuChannelEstablishFactory* GetGpuChannelEstablishFactory();
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+CONTENT_EXPORT void DumpGpuProfilingData(base::OnceClosure callback);
+#endif
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_GPU_UTILS_H_
diff --git a/chromium/content/public/browser/guest_host.h b/chromium/content/public/browser/guest_host.h
index 6788264fb5b..55b3dd37917 100644
--- a/chromium/content/public/browser/guest_host.h
+++ b/chromium/content/public/browser/guest_host.h
@@ -27,9 +27,6 @@ class GuestHost {
   virtual int LoadURLWithParams(
       const NavigationController::LoadURLParams& load_params) = 0;
 
-  // Sets the size of the guest WebContents.
-  virtual void SizeContents(const gfx::Size& new_size) = 0;
-
   // Called when the GuestHost is about to be destroyed.
   virtual void WillDestroy() = 0;
 };
diff --git a/chromium/content/public/browser/idle_manager.h b/chromium/content/public/browser/idle_manager.h
new file mode 100644
index 00000000000..65052bfe5cd
--- /dev/null
+++ b/chromium/content/public/browser/idle_manager.h
@@ -0,0 +1,60 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_IDLE_MANAGER_H_
+#define CONTENT_PUBLIC_BROWSER_IDLE_MANAGER_H_
+
+#include <memory>
+
+#include "base/time/time.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
+
+namespace url {
+class Origin;
+}
+
+namespace content {
+
+class IdleTimeProvider;
+
+// Provides an interface for handling mojo connections from the renderer,
+// keeping track of clients that are monitoring the user's idle state.
+class IdleManager {
+ public:
+  // Provides an interface for calculating a user's idle time and screen state.
+  class IdleTimeProvider {
+   public:
+    IdleTimeProvider() = default;
+    virtual ~IdleTimeProvider() = default;
+
+    IdleTimeProvider(const IdleTimeProvider&) = delete;
+    IdleTimeProvider& operator=(const IdleTimeProvider&) = delete;
+
+    // See ui/base/idle/idle.h for the semantics of these methods.
+    virtual base::TimeDelta CalculateIdleTime() = 0;
+    virtual bool CheckIdleStateIsLocked() = 0;
+  };
+
+  IdleManager() = default;
+  virtual ~IdleManager() = default;
+
+  IdleManager(const IdleManager&) = delete;
+  IdleManager& operator=(const IdleManager&) = delete;
+
+  virtual void CreateService(
+      mojo::PendingReceiver<blink::mojom::IdleManager> receiver,
+      const url::Origin& origin) = 0;
+
+  // Testing helpers.
+  virtual void SetIdleTimeProviderForTest(
+      std::unique_ptr<IdleTimeProvider> idle_provider) = 0;
+
+  // Tests whether the manager is still polling for updates or not.
+  virtual bool IsPollingForTest() = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_IDLE_MANAGER_H_
diff --git a/chromium/content/public/browser/interstitial_page.h b/chromium/content/public/browser/interstitial_page.h
deleted file mode 100644
index e43373598d2..00000000000
--- a/chromium/content/public/browser/interstitial_page.h
+++ /dev/null
@@ -1,107 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_H_
-#define CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_H_
-
-#include "content/common/content_export.h"
-
-class GURL;
-
-namespace gfx {
-class Size;
-}
-
-namespace content {
-
-class InterstitialPageDelegate;
-class RenderFrameHost;
-class WebContents;
-
-// This class is used for showing interstitial pages, pages that show some
-// informative message asking for user validation before reaching the target
-// page. (Navigating to a page served over bad HTTPS or a page containing
-// malware are typical cases where an interstitial is required.)
-//
-// If specified in the Create function, this class creates a navigation entry so
-// that when the interstitial shows, the current entry is the target URL.
-//
-// InterstitialPage instances take care of deleting themselves when closed
-// through a navigation, the WebContents closing them or the tab containing them
-// being closed.
-
-class InterstitialPage {
- public:
-  // Creates an interstitial page to show in |web_contents|. |new_navigation|
-  // should be set to true when the interstitial is caused by loading a new
-  // page, in which case a temporary navigation entry is created with the URL
-  // |url| and added to the navigation controller (so the interstitial page
-  // appears as a new navigation entry). |new_navigation| should be false when
-  // the interstitial was triggered by a loading a sub-resource in a page. Takes
-  // ownership of |delegate|.
-  //
-  // Reloading the interstitial page will result in a new navigation to |url|.
-  CONTENT_EXPORT static InterstitialPage* Create(
-      WebContents* web_contents,
-      bool new_navigation,
-      const GURL& url,
-      InterstitialPageDelegate* delegate);
-
-  // Returns the InterstitialPage, if any, associated with the specified
-  // |web_contents|. Note: This returns a value from the time the interstitial
-  // page has Show() called on it.
-  //
-  // Compare to WebContents::GetInterstitialPage.
-  CONTENT_EXPORT static InterstitialPage* GetInterstitialPage(
-      WebContents* web_contents);
-
-  // Returns the InterstitialPage that hosts the RenderFrameHost, or nullptr if
-  // |rfh| is not a part of any InterstitialPage.
-  CONTENT_EXPORT static InterstitialPage* FromRenderFrameHost(
-      RenderFrameHost* rfh);
-
-  virtual ~InterstitialPage() {}
-
-  // Shows the interstitial page in the tab.
-  virtual void Show() = 0;
-
-  // Hides the interstitial page.
-  virtual void Hide() = 0;
-
-  // Reverts to the page showing before the interstitial.
-  // Delegates should call this method when the user has chosen NOT to proceed
-  // to the target URL.
-  // Warning: if |new_navigation| was set to true in the constructor, 'this'
-  //          will be deleted when this method returns.
-  virtual void DontProceed() = 0;
-
-  // Delegates should call this method when the user has chosen to proceed to
-  // the target URL.
-  // Warning: 'this' has been deleted when this method returns.
-  virtual void Proceed() = 0;
-
-  // Sizes the RenderViewHost showing the actual interstitial page contents.
-  virtual void SetSize(const gfx::Size& size) = 0;
-
-  // Sets the focus to the interstitial.
-  virtual void Focus() = 0;
-
-  // Get the WebContents in which this interstitial is shown. Warning: Frames
-  // in the intersitital are NOT visible through WebContentObservers' normal
-  // notifications (e.g. RenderFrameDeleted). The only sensible use of this
-  // returned WebContents is to add a WebContentObserver and listen for the
-  // DidAttachInterstitialPage or DidDetachInterstitialPage notifications.
-  virtual WebContents* GetWebContents() = 0;
-
-  // Gets the RenderFrameHost associated with the interstitial page's main
-  // frame. May return nullptr if the interstitial is already hidden.
-  virtual RenderFrameHost* GetMainFrame() = 0;
-
-  virtual InterstitialPageDelegate* GetDelegateForTesting() = 0;
-  virtual void DontCreateViewForTesting() = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_H_
diff --git a/chromium/content/public/browser/interstitial_page_delegate.cc b/chromium/content/public/browser/interstitial_page_delegate.cc
deleted file mode 100644
index b61905adc9f..00000000000
--- a/chromium/content/public/browser/interstitial_page_delegate.cc
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/browser/interstitial_page_delegate.h"
-
-namespace content {
-InterstitialPageDelegate::TypeID InterstitialPageDelegate::GetTypeForTesting() {
-  return nullptr;
-}
-
-}  // namespace content
diff --git a/chromium/content/public/browser/interstitial_page_delegate.h b/chromium/content/public/browser/interstitial_page_delegate.h
deleted file mode 100644
index 3b3a3b7cee1..00000000000
--- a/chromium/content/public/browser/interstitial_page_delegate.h
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_DELEGATE_H_
-#define CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_DELEGATE_H_
-
-#include <string>
-
-#include "content/common/content_export.h"
-
-namespace blink {
-namespace mojom {
-class RendererPreferences;
-}
-}  // namespace blink
-
-namespace content {
-
-class NavigationEntry;
-
-// Controls and provides the html for an interstitial page. The delegate is
-// owned by the InterstitialPage.
-class CONTENT_EXPORT InterstitialPageDelegate {
- public:
-  // An identifier used to identify an InterstitialPage.
-  typedef const void* TypeID;
-
-  virtual ~InterstitialPageDelegate() {}
-
-  // Return the HTML that should be displayed in the page.
-  virtual std::string GetHTMLContents() = 0;
-
-  // Called when the interstitial is proceeded or cancelled. Note that this may
-  // be called by content directly even if the embedder didn't call Proceed or
-  // DontProceed on InterstitialPage, since navigations etc may cancel them.
-  virtual void OnProceed() {}
-  virtual void OnDontProceed() {}
-
-  // Invoked when the page sent a command through DOMAutomation.
-  virtual void CommandReceived(const std::string& command) {}
-
-  // Invoked with the NavigationEntry that is going to be added to the
-  // navigation controller.
-  // Gives an opportunity to delegates to set states on the |entry|.
-  // Note that this is only called if the InterstitialPage was constructed with
-  // |new_navigation| set to true.
-  virtual void OverrideEntry(content::NavigationEntry* entry) {}
-
-  // Allows the delegate to override the renderer preferences structure that's
-  // sent to the new RenderViewHost.
-  virtual void OverrideRendererPrefs(blink::mojom::RendererPreferences* prefs) {
-  }
-
-  // Return the interstitial type for testing.
-  virtual TypeID GetTypeForTesting();
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_INTERSTITIAL_PAGE_DELEGATE_H_
diff --git a/chromium/content/public/browser/load_notification_details.h b/chromium/content/public/browser/load_notification_details.h
index b02e0f0f0a7..3a6fd76518f 100644
--- a/chromium/content/public/browser/load_notification_details.h
+++ b/chromium/content/public/browser/load_notification_details.h
@@ -5,7 +5,6 @@
 #ifndef CONTENT_PUBLIC_BROWSER_LOAD_NOTIFICATION_DETAILS_H_
 #define CONTENT_PUBLIC_BROWSER_LOAD_NOTIFICATION_DETAILS_H_
 
-#include "base/time/time.h"
 #include "content/public/browser/navigation_controller.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
@@ -17,20 +16,15 @@ namespace content {
 // log page load metrics.
 struct LoadNotificationDetails {
   LoadNotificationDetails(const GURL& url,
-                          base::TimeDelta load_time,
                           NavigationController* controller,
                           int session_index)
       : url(url),
-        load_time(load_time),
         session_index(session_index),
         controller(controller) {}
 
   // The URL loaded.
   GURL url;
 
-  // The length of time the page load took.
-  base::TimeDelta load_time;
-
   // The index of the load within the tab session.
   int session_index;
 
diff --git a/chromium/content/public/browser/media_stream_request.cc b/chromium/content/public/browser/media_stream_request.cc
index c0ba844ce3c..d4c0a474951 100644
--- a/chromium/content/public/browser/media_stream_request.cc
+++ b/chromium/content/public/browser/media_stream_request.cc
@@ -17,7 +17,8 @@ MediaStreamRequest::MediaStreamRequest(
     const std::string& requested_video_device_id,
     blink::mojom::MediaStreamType audio_type,
     blink::mojom::MediaStreamType video_type,
-    bool disable_local_echo)
+    bool disable_local_echo,
+    bool request_pan_tilt_zoom_permission)
     : render_process_id(render_process_id),
       render_frame_id(render_frame_id),
       page_request_id(page_request_id),
@@ -29,6 +30,7 @@ MediaStreamRequest::MediaStreamRequest(
       audio_type(audio_type),
       video_type(video_type),
       disable_local_echo(disable_local_echo),
+      request_pan_tilt_zoom_permission(request_pan_tilt_zoom_permission),
       all_ancestors_have_same_origin(false) {}
 
 MediaStreamRequest::MediaStreamRequest(const MediaStreamRequest& other) =
diff --git a/chromium/content/public/browser/media_stream_request.h b/chromium/content/public/browser/media_stream_request.h
index 24bc0cb12cd..9c9e85b7128 100644
--- a/chromium/content/public/browser/media_stream_request.h
+++ b/chromium/content/public/browser/media_stream_request.h
@@ -33,7 +33,8 @@ struct CONTENT_EXPORT MediaStreamRequest {
                      const std::string& requested_video_device_id,
                      blink::mojom::MediaStreamType audio_type,
                      blink::mojom::MediaStreamType video_type,
-                     bool disable_local_echo);
+                     bool disable_local_echo,
+                     bool request_pan_tilt_zoom_permission);
 
   MediaStreamRequest(const MediaStreamRequest& other);
 
@@ -79,6 +80,9 @@ struct CONTENT_EXPORT MediaStreamRequest {
   // audio being played out locally.
   bool disable_local_echo;
 
+  // Flag to indicate whether the request is for PTZ use.
+  bool request_pan_tilt_zoom_permission;
+
   // True if all ancestors of the requesting frame have the same origin.
   bool all_ancestors_have_same_origin;
 };
diff --git a/chromium/content/public/browser/message_port_provider.h b/chromium/content/public/browser/message_port_provider.h
index 38f99c98323..09ac77b21a0 100644
--- a/chromium/content/public/browser/message_port_provider.h
+++ b/chromium/content/public/browser/message_port_provider.h
@@ -52,14 +52,6 @@ class CONTENT_EXPORT MessagePortProvider {
 #endif  // OS_ANDROID
 
 #if defined(OS_FUCHSIA) || BUILDFLAG(IS_CHROMECAST)
-  // TODO(crbug.com/803242): Deprecated and will be shortly removed.
-  // If |target_origin| is unset, then no origin scoping is applied.
-  static void PostMessageToFrame(
-      WebContents* web_contents,
-      const base::string16& source_origin,
-      const base::Optional<base::string16>& target_origin,
-      const base::string16& data,
-      std::vector<mojo::ScopedMessagePipeHandle> channels);
   // If |target_origin| is unset, then no origin scoping is applied.
   static void PostMessageToFrame(
       WebContents* web_contents,
diff --git a/chromium/content/public/browser/mhtml_generation_result.h b/chromium/content/public/browser/mhtml_generation_result.h
index f64a215a3ed..a6cc0748029 100644
--- a/chromium/content/public/browser/mhtml_generation_result.h
+++ b/chromium/content/public/browser/mhtml_generation_result.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
 #define CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
 
+#include "base/callback_forward.h"
 #include "base/optional.h"
 #include "content/common/content_export.h"
 
@@ -34,4 +35,4 @@ struct CONTENT_EXPORT MHTMLGenerationResult {
 
 }  // namespace content
 
-#endif  // CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
\ No newline at end of file
+#endif  // CONTENT_PUBLIC_BROWSER_MHTML_GENERATION_RESULT_H_
diff --git a/chromium/content/public/browser/navigation_controller.cc b/chromium/content/public/browser/navigation_controller.cc
index 472d1f92975..818f0b9aa3a 100644
--- a/chromium/content/public/browser/navigation_controller.cc
+++ b/chromium/content/public/browser/navigation_controller.cc
@@ -17,6 +17,7 @@ NavigationController::LoadURLParams::LoadURLParams(const GURL& url)
 
 NavigationController::LoadURLParams::LoadURLParams(const OpenURLParams& input)
     : url(input.url),
+      initiator_routing_id(input.initiator_routing_id),
       initiator_origin(input.initiator_origin),
       source_site_instance(input.source_site_instance),
       load_type(input.post_data ? LOAD_TYPE_HTTP_POST : LOAD_TYPE_DEFAULT),
@@ -32,7 +33,8 @@ NavigationController::LoadURLParams::LoadURLParams(const OpenURLParams& input)
       started_from_context_menu(input.started_from_context_menu),
       blob_url_loader_factory(input.blob_url_loader_factory),
       href_translate(input.href_translate),
-      reload_type(input.reload_type) {
+      reload_type(input.reload_type),
+      impression(input.impression) {
 #if DCHECK_IS_ON()
   DCHECK(input.Valid());
 #endif
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index 7fa0063f52a..754d13e9688 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -24,6 +24,7 @@
 #include "content/public/browser/restore_type.h"
 #include "content/public/browser/session_storage_namespace.h"
 #include "content/public/browser/site_instance.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/was_activated_option.mojom.h"
 #include "services/network/public/cpp/resource_request_body.h"
@@ -115,11 +116,28 @@ class NavigationController {
 
   // Extra optional parameters for LoadURLWithParams.
   struct CONTENT_EXPORT LoadURLParams {
+    explicit LoadURLParams(const GURL& url);
+
+    // Copies |open_url_params| into LoadURLParams, attempting to copy all
+    // fields that are present in both structs (some properties are ignored
+    // because they are unique to LoadURLParams or OpenURLParams).
+    explicit LoadURLParams(const OpenURLParams& open_url_params);
+
+    ~LoadURLParams();
+
     // The url to load. This field is required.
     GURL url;
 
+    // The routing id of the initiator of the navigation if the
+    // navigation was initiated through trusted, non-web-influenced UI (e.g. via
+    // omnibox, the bookmarks bar, local NTP, etc.). This frame is not
+    // guaranteed to exist at any point during navigation. This can be an
+    // invalid id if the navigation was not associated with a frame, or if the
+    // initiating frame did not exist by the time navigation started.
+    GlobalFrameRoutingId initiator_routing_id;
+
     // The origin of the initiator of the navigation or base::nullopt if the
-    // navigation was initiated through through trusted, non-web-influenced UI
+    // navigation was initiated through trusted, non-web-influenced UI
     // (e.g. via omnibox, the bookmarks bar, local NTP, etc.).
     //
     // All renderer-initiated navigations must have a non-null
@@ -238,14 +256,9 @@ class NavigationController {
     // Indicates the reload type of this navigation.
     ReloadType reload_type = ReloadType::NONE;
 
-    explicit LoadURLParams(const GURL& url);
-
-    // Copies |open_url_params| into LoadURLParams, attempting to copy all
-    // fields that are present in both structs (some properties are ignored
-    // because they are unique to LoadURLParams or OpenURLParams).
-    explicit LoadURLParams(const OpenURLParams& open_url_params);
-
-    ~LoadURLParams();
+    // Impression info associated with this navigation. Should only be populated
+    // for navigations originating from a link click.
+    base::Optional<Impression> impression;
 
     DISALLOW_COPY_AND_ASSIGN(LoadURLParams);
   };
diff --git a/chromium/content/public/browser/navigation_entry.h b/chromium/content/public/browser/navigation_entry.h
index 83a8cde7358..aea4d51e8fd 100644
--- a/chromium/content/public/browser/navigation_entry.h
+++ b/chromium/content/public/browser/navigation_entry.h
@@ -184,7 +184,7 @@ class NavigationEntry : public base::SupportsUserData {
   virtual const GURL& GetOriginalRequestURL() = 0;
 
   // Store whether or not we're overriding the user agent.
-  virtual void SetIsOverridingUserAgent(bool override) = 0;
+  virtual void SetIsOverridingUserAgent(bool override_ua) = 0;
   virtual bool GetIsOverridingUserAgent() = 0;
 
   // The time at which the last known local navigation has
diff --git a/chromium/content/public/browser/navigation_handle.h b/chromium/content/public/browser/navigation_handle.h
index fb82b594945..b9accb65fe4 100644
--- a/chromium/content/public/browser/navigation_handle.h
+++ b/chromium/content/public/browser/navigation_handle.h
@@ -12,12 +12,13 @@
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/reload_type.h"
 #include "content/public/browser/restore_type.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/transferrable_url_loader.mojom.h"
 #include "net/base/auth.h"
 #include "net/base/ip_endpoint.h"
+#include "net/base/isolation_info.h"
 #include "net/base/net_errors.h"
-#include "net/base/network_isolation_key.h"
 #include "net/dns/public/resolve_error_info.h"
 #include "net/http/http_response_info.h"
 #include "services/network/public/cpp/resource_request_body.h"
@@ -123,6 +124,14 @@ class CONTENT_EXPORT NavigationHandle {
   // set if unknown.
   virtual base::TimeTicks NavigationInputStart() = 0;
 
+  // The time the first HTTP request is sent.
+  // See comments on |NavigationRequest::first_request_start_| for details.
+  virtual base::TimeTicks FirstRequestStart() = 0;
+
+  // The time the headers of the first HTTP response is received.
+  // See comments on |NavigationRequest::first_response_start_| for details.
+  virtual base::TimeTicks FirstResponseStart() = 0;
+
   // Whether or not the navigation was started within a context menu.
   virtual bool WasStartedFromContextMenu() = 0;
 
@@ -263,6 +272,15 @@ class CONTENT_EXPORT NavigationHandle {
   virtual void SetRequestHeader(const std::string& header_name,
                                 const std::string& header_value) = 0;
 
+  // Set a request's header that is exempt from CORS checks. This is only
+  // honored if the NetworkContext was configured to allow any cors exempt
+  // header (see
+  // |NetworkContext::mojom::allow_any_cors_exempt_header_for_browser|) or
+  // if |header_name| is specified in
+  // |NetworkContextParams::cors_exempt_header_list|.
+  virtual void SetCorsExemptRequestHeader(const std::string& header_name,
+                                          const std::string& header_value) = 0;
+
   // Returns the response headers for the request, or nullptr if there aren't
   // any response headers or they have not been received yet. The response
   // headers may change during the navigation (e.g. after encountering a server
@@ -289,11 +307,11 @@ class CONTENT_EXPORT NavigationHandle {
   // Returns host resolution error info associated with the request.
   virtual net::ResolveErrorInfo GetResolveErrorInfo() = 0;
 
-  // Gets the NetworkIsolationKey associated with the navigation. Updated as
+  // Gets the net::IsolationInfo associated with the navigation. Updated as
   // redirects are followed. When one of the origins used to construct the
-  // NetworkIsolationKey is opaque, the returned NetworkIsolationKey will not be
-  // consistent between calls.
-  virtual net::NetworkIsolationKey GetNetworkIsolationKey() = 0;
+  // IsolationInfo is opaque, the returned IsolationInfo will not be consistent
+  // between calls.
+  virtual net::IsolationInfo GetIsolationInfo() = 0;
 
   // Returns the ID of the URLRequest associated with this navigation. Can only
   // be called from NavigationThrottle::WillProcessResponse and
@@ -332,6 +350,17 @@ class CONTENT_EXPORT NavigationHandle {
   // initiated from a link that had that attribute set.
   virtual const std::string& GetHrefTranslate() = 0;
 
+  // Returns, if available, the impression associated with the link clicked to
+  // initiate this navigation. The impression is available for the entire
+  // lifetime of the navigation.
+  virtual const base::Optional<Impression>& GetImpression() = 0;
+
+  // Returns the routing id associated with the frame that initiated the
+  // navigation. This can contain a null routing id if the navigation was not
+  // associated with a frame, or may return a valid routing id to a frame that
+  // no longer exists because it was deleted before the navigation began.
+  virtual const GlobalFrameRoutingId& GetInitiatorRoutingId() = 0;
+
   // Returns, if available, the origin of the document that has initiated the
   // navigation for this NavigationHandle.
   virtual const base::Optional<url::Origin>& GetInitiatorOrigin() = 0;
@@ -363,6 +392,11 @@ class CONTENT_EXPORT NavigationHandle {
   virtual void ForceEnableOriginTrials(
       const std::vector<std::string>& trials) = 0;
 
+  // Store whether or not we're overriding the user agent. This may only be
+  // called from DidStartNavigation().
+  virtual void SetIsOverridingUserAgent(bool override_ua) = 0;
+  virtual bool GetIsOverridingUserAgent() = 0;
+
   // Testing methods ----------------------------------------------------------
   //
   // The following methods should be used exclusively for writing unit tests.
diff --git a/chromium/content/public/browser/network_context_client_base.h b/chromium/content/public/browser/network_context_client_base.h
index 0f7fa095216..6b972d03a09 100644
--- a/chromium/content/public/browser/network_context_client_base.h
+++ b/chromium/content/public/browser/network_context_client_base.h
@@ -64,20 +64,6 @@ class CONTENT_EXPORT NetworkContextClientBase
                        const std::string& header_value,
                        int load_flags,
                        OnClearSiteDataCallback callback) override;
-  void OnCookiesChanged(
-      bool is_service_worker,
-      int32_t process_id,
-      int32_t routing_id,
-      const GURL& url,
-      const net::SiteForCookies& site_for_cookies,
-      const std::vector<net::CookieWithStatus>& cookie_list) override;
-  void OnCookiesRead(
-      bool is_service_worker,
-      int32_t process_id,
-      int32_t routing_id,
-      const GURL& url,
-      const net::SiteForCookies& site_for_cookies,
-      const std::vector<net::CookieWithStatus>& cookie_list) override;
 #if defined(OS_ANDROID)
   void OnGenerateHttpNegotiateAuthToken(
       const std::string& server_auth_token,
diff --git a/chromium/content/public/browser/notification_registrar.cc b/chromium/content/public/browser/notification_registrar.cc
index ddf40a0b86c..01299028a95 100644
--- a/chromium/content/public/browser/notification_registrar.cc
+++ b/chromium/content/public/browser/notification_registrar.cc
@@ -8,7 +8,7 @@
 
 #include <algorithm>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/stl_util.h"
 #include "content/browser/notification_service_impl.h"
 
diff --git a/chromium/content/public/browser/overlay_window.h b/chromium/content/public/browser/overlay_window.h
index 26df3fc7f1d..361f8e10162 100644
--- a/chromium/content/public/browser/overlay_window.h
+++ b/chromium/content/public/browser/overlay_window.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "base/macros.h"
 #include "ui/gfx/native_widget_types.h"
 
 namespace gfx {
diff --git a/chromium/content/public/browser/page_navigator.h b/chromium/content/public/browser/page_navigator.h
index f90b19be2d8..40925c7fb33 100644
--- a/chromium/content/public/browser/page_navigator.h
+++ b/chromium/content/public/browser/page_navigator.h
@@ -19,6 +19,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/referrer.h"
 #include "ipc/ipc_message.h"
 #include "services/network/public/cpp/resource_request_body.h"
@@ -70,6 +71,12 @@ struct CONTENT_EXPORT OpenURLParams {
   GURL url;
   Referrer referrer;
 
+  // The routing id of the initiator of the navigation. This is best effort: it
+  // is only defined for some renderer-initiated navigations (e.g., not drag and
+  // drop), and the frame with the corresponding routing ID may have been
+  // deleted before the navigation begins.
+  content::GlobalFrameRoutingId initiator_routing_id;
+
   // The origin of the initiator of the navigation.
   base::Optional<url::Origin> initiator_origin;
 
@@ -137,6 +144,11 @@ struct CONTENT_EXPORT OpenURLParams {
 
   // Indicates if this navigation is a reload.
   ReloadType reload_type;
+
+  // Optional impression associated with this navigation. Only set on
+  // navigations that originate from links with impression attributes. Used for
+  // conversion measurement.
+  base::Optional<Impression> impression;
 };
 
 class PageNavigator {
diff --git a/chromium/content/public/browser/payment_app_provider.h b/chromium/content/public/browser/payment_app_provider.h
index ef29f481719..2489ae9a82e 100644
--- a/chromium/content/public/browser/payment_app_provider.h
+++ b/chromium/content/public/browser/payment_app_provider.h
@@ -64,8 +64,8 @@ class CONTENT_EXPORT PaymentAppProvider {
       payments::mojom::PaymentRequestEventDataPtr event_data,
       const std::string& app_name,
       const SkBitmap& app_icon,
-      const std::string& sw_js_url,
-      const std::string& sw_scope,
+      const GURL& sw_js_url,
+      const GURL& sw_scope,
       bool sw_use_cache,
       const std::string& method,
       const SupportedDelegations& supported_delegations,
diff --git a/chromium/content/public/browser/permission_type.cc b/chromium/content/public/browser/permission_type.cc
index 7170e9ed97b..8bb88e87286 100644
--- a/chromium/content/public/browser/permission_type.cc
+++ b/chromium/content/public/browser/permission_type.cc
@@ -57,7 +57,12 @@ base::Optional<PermissionType> PermissionDescriptorToPermissionType(
     case PermissionName::AUDIO_CAPTURE:
       return PermissionType::AUDIO_CAPTURE;
     case PermissionName::VIDEO_CAPTURE:
-      return PermissionType::VIDEO_CAPTURE;
+      if (descriptor->extension && descriptor->extension->is_camera_device() &&
+          descriptor->extension->get_camera_device()->panTiltZoom) {
+        return PermissionType::CAMERA_PAN_TILT_ZOOM;
+      } else {
+        return PermissionType::VIDEO_CAPTURE;
+      }
     case PermissionName::BACKGROUND_SYNC:
       return PermissionType::BACKGROUND_SYNC;
     case PermissionName::SENSORS:
@@ -82,25 +87,16 @@ base::Optional<PermissionType> PermissionDescriptorToPermissionType(
       return PermissionType::IDLE_DETECTION;
     case PermissionName::PERIODIC_BACKGROUND_SYNC:
       return PermissionType::PERIODIC_BACKGROUND_SYNC;
-    case PermissionName::WAKE_LOCK:
-      if (descriptor->extension && descriptor->extension->is_wake_lock()) {
-        switch (descriptor->extension->get_wake_lock()->type) {
-          case blink::mojom::WakeLockType::kScreen:
-            return PermissionType::WAKE_LOCK_SCREEN;
-            break;
-          case blink::mojom::WakeLockType::kSystem:
-            return PermissionType::WAKE_LOCK_SYSTEM;
-            break;
-          default:
-            NOTREACHED();
-            return base::nullopt;
-        }
-      }
-      break;
+    case PermissionName::SCREEN_WAKE_LOCK:
+      return PermissionType::WAKE_LOCK_SCREEN;
+    case PermissionName::SYSTEM_WAKE_LOCK:
+      return PermissionType::WAKE_LOCK_SYSTEM;
     case PermissionName::NFC:
       return PermissionType::NFC;
     case PermissionName::STORAGE_ACCESS:
       return PermissionType::STORAGE_ACCESS_GRANT;
+    case PermissionName::WINDOW_PLACEMENT:
+      return PermissionType::WINDOW_PLACEMENT;
   }
 
   NOTREACHED();
diff --git a/chromium/content/public/browser/permission_type.h b/chromium/content/public/browser/permission_type.h
index 2082109c416..764190e5544 100644
--- a/chromium/content/public/browser/permission_type.h
+++ b/chromium/content/public/browser/permission_type.h
@@ -47,6 +47,8 @@ enum class PermissionType {
   VR = 25,
   AR = 26,
   STORAGE_ACCESS_GRANT = 27,
+  CAMERA_PAN_TILT_ZOOM = 28,
+  WINDOW_PLACEMENT = 29,
 
   // Always keep this at the end.
   NUM,
diff --git a/chromium/content/public/browser/presentation_receiver_flags.h b/chromium/content/public/browser/presentation_receiver_flags.h
new file mode 100644
index 00000000000..bfb058ad671
--- /dev/null
+++ b/chromium/content/public/browser/presentation_receiver_flags.h
@@ -0,0 +1,22 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_
+#define CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_
+
+#include "services/network/public/cpp/web_sandbox_flags.h"
+
+namespace content {
+
+// Disable popups, modals, and top-level navigation for presentation receivers.
+// See:
+// https://w3c.github.io/presentation-api/#creating-a-receiving-browsing-context
+constexpr network::mojom::WebSandboxFlags kPresentationReceiverSandboxFlags =
+    network::mojom::WebSandboxFlags::kModals |
+    network::mojom::WebSandboxFlags::kPopups |
+    network::mojom::WebSandboxFlags::kTopNavigation;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_
diff --git a/chromium/content/public/browser/render_document_host_user_data.cc b/chromium/content/public/browser/render_document_host_user_data.cc
new file mode 100644
index 00000000000..3b58bf8a3c5
--- /dev/null
+++ b/chromium/content/public/browser/render_document_host_user_data.cc
@@ -0,0 +1,30 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/render_document_host_user_data.h"
+
+#include "content/browser/frame_host/render_frame_host_impl.h"
+
+namespace content {
+
+base::SupportsUserData::Data* GetRenderDocumentHostUserData(
+    const RenderFrameHost* rfh,
+    const void* key) {
+  return static_cast<const RenderFrameHostImpl*>(rfh)
+      ->GetRenderDocumentHostUserData(key);
+}
+
+void SetRenderDocumentHostUserData(
+    RenderFrameHost* rfh,
+    const void* key,
+    std::unique_ptr<base::SupportsUserData::Data> data) {
+  static_cast<RenderFrameHostImpl*>(rfh)->SetRenderDocumentHostUserData(
+      key, std::move(data));
+}
+
+void RemoveRenderDocumentHostUserData(RenderFrameHost* rfh, const void* key) {
+  static_cast<RenderFrameHostImpl*>(rfh)->RemoveRenderDocumentHostUserData(key);
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/render_document_host_user_data.h b/chromium/content/public/browser/render_document_host_user_data.h
new file mode 100644
index 00000000000..a138fd60aa2
--- /dev/null
+++ b/chromium/content/public/browser/render_document_host_user_data.h
@@ -0,0 +1,113 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_RENDER_DOCUMENT_HOST_USER_DATA_H_
+#define CONTENT_PUBLIC_BROWSER_RENDER_DOCUMENT_HOST_USER_DATA_H_
+
+#include "base/memory/ptr_util.h"
+#include "base/supports_user_data.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class RenderFrameHost;
+
+CONTENT_EXPORT base::SupportsUserData::Data* GetRenderDocumentHostUserData(
+    const RenderFrameHost* rfh,
+    const void* key);
+
+CONTENT_EXPORT void SetRenderDocumentHostUserData(
+    RenderFrameHost* rfh,
+    const void* key,
+    std::unique_ptr<base::SupportsUserData::Data> data);
+
+CONTENT_EXPORT void RemoveRenderDocumentHostUserData(RenderFrameHost* rfh,
+                                                     const void* key);
+
+// This class approximates the lifetime of a single blink::Document in the
+// browser process. At the moment RenderFrameHost can correspond to multiple
+// blink::Documents (when RenderFrameHost is reused for same-process
+// navigation). RenderDocumentHostUserData is created when a user of an API
+// inherits this class and calls CreateForCurrentDocument.
+//
+// RenderDocumentHostUserData is cleared when either:
+// - RenderFrameHost is deleted, or
+// - A cross-document non-bfcached navigation is committed in the same
+// RenderFrameHost i.e., RenderDocumentHostUserData persists when a document is
+// put in the BackForwardCache. It will still be present when the user navigates
+// back to the document.
+//
+// RenderDocumentHostUserData is assumed to be associated with the document in
+// the RenderFrameHost. It can be associated even before RenderFrameHost commits
+// i.e., on speculative RFHs and gets destroyed along with speculative RFHs if
+// it ends up never committing.
+//
+// Note: RenderFrameHost is being replaced with RenderDocumentHost
+// [https://crbug.com/936696]. After this is completed, every
+// RenderDocumentHostUserData object will be 1:1 with RenderFrameHost. Also
+// RenderFrameHost/RenderDocument would start inheriting directly from
+// SupportsUserData then we wouldn't need the use of
+// GetRenderDocumentHostUserData/SetRenderDocumentHostUserData anymore.
+//
+// This is similar to WebContentsUserData but attached to a document instead.
+// Example usage of RenderDocumentHostUserData:
+//
+// --- in foo_document_helper.h ---
+// class FooDocumentHelper : public
+// content::RenderDocumentHostUserData<FooDocumentHelper> {
+//  public:
+//   ~FooDocumentHelper() override;
+//   // ... more public stuff here ...
+//  private:
+//   explicit FooDocumentHelper(content::RenderFrameHost* rfh);
+//   friend class content::RenderDocumentHostUserData<FooDocumentHelper>;
+//   RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL();
+//   // ... more private stuff here ...
+// };
+//
+// --- in foo_document_helper.cc ---
+// RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(FooDocumentHelper)
+
+template <typename T>
+class RenderDocumentHostUserData : public base::SupportsUserData::Data {
+ public:
+  static void CreateForCurrentDocument(RenderFrameHost* rfh) {
+    DCHECK(rfh);
+    if (!GetForCurrentDocument(rfh)) {
+      T* data = new T(rfh);
+      SetRenderDocumentHostUserData(rfh, UserDataKey(), base::WrapUnique(data));
+    }
+  }
+
+  static T* GetForCurrentDocument(RenderFrameHost* rfh) {
+    DCHECK(rfh);
+    return static_cast<T*>(GetRenderDocumentHostUserData(rfh, UserDataKey()));
+  }
+
+  static void DeleteForCurrentDocument(RenderFrameHost* rfh) {
+    DCHECK(rfh);
+    DCHECK(GetForCurrentDocument(rfh));
+    RemoveRenderDocumentHostUserData(rfh, UserDataKey());
+  }
+
+  static const void* UserDataKey() { return &T::kUserDataKey; }
+};
+
+// Users won't be able to instantiate the template if they miss declaring the
+// user data key.
+// This macro declares a static variable inside the class that inherits from
+// RenderDocumentHostUserData. The address of this static variable is used as
+// the key to store/retrieve an instance of the class on/from a WebState.
+#define RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL() \
+  static constexpr int kUserDataKey = 0
+
+// This macro instantiates the static variable declared by the previous macro.
+// It must live in a .cc file to ensure that there is only one instantiation
+// of the static variable.
+#define RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(Type) \
+  const int Type::kUserDataKey;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_RENDER_DOCUMENT_HOST_USER_DATA_H_
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 99a5c2bf2c2..94ba0f61dec 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -22,15 +22,15 @@
 #include "ipc/ipc_sender.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
 #include "third_party/blink/public/common/feature_policy/document_policy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-forward.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/sudden_termination_disabler_type.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom-forward.h"
 #include "third_party/blink/public/mojom/webauthn/authenticator.mojom.h"
@@ -57,6 +57,7 @@ CONTENT_EXPORT extern const base::Feature kCrashReporting;
 }  // namespace features
 
 namespace net {
+class IsolationInfo;
 class NetworkIsolationKey;
 }
 
@@ -74,6 +75,9 @@ class RenderProcessHost;
 class RenderViewHost;
 class RenderWidgetHostView;
 class SiteInstance;
+class BrowserContext;
+class StoragePartition;
+class WebUI;
 
 // The interface provides a communication conduit with a frame in the renderer.
 class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
@@ -125,11 +129,21 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Returns the SiteInstance grouping all RenderFrameHosts that have script
   // access to this RenderFrameHost, and must therefore live in the same
   // process.
+  // Associated SiteInstance never changes.
   virtual SiteInstance* GetSiteInstance() = 0;
 
   // Returns the process for this frame.
+  // Associated RenderProcessHost never changes.
   virtual RenderProcessHost* GetProcess() = 0;
 
+  // Returns a StoragePartition associated with this RenderFrameHost.
+  // Associated StoragePartition never changes.
+  virtual StoragePartition* GetStoragePartition() = 0;
+
+  // Returns the user browser context associated with this RenderFrameHost.
+  // Associated BrowserContext never changes.
+  virtual BrowserContext* GetBrowserContext() = 0;
+
   // Returns the RenderWidgetHostView that can be used to control focus and
   // visibility for this frame.
   virtual RenderWidgetHostView* GetView() = 0;
@@ -183,11 +197,12 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // never used to look up the FrameTreeNode instance.
   virtual base::UnguessableToken GetDevToolsFrameToken() = 0;
 
-  // Returns the embedding token for this frame that is used by a remote parent
-  // to uniquely identify it. This will be null if the frame
-  // - is not embedded by a parent
-  // - is a local child
-  // - is not the current RFH (for example, when pending deletion)
+  // Returns the embedding token for the current document in this
+  // RenderFrameHost. This token is used by a remote parent to uniquely identify
+  // it. The token will be changed when a new document commits in this
+  // RenderFrameHost. This will be null if the document is:
+  // - not embedded by a parent
+  // - a local child
   virtual base::Optional<base::UnguessableToken> GetEmbeddingToken() = 0;
 
   // Returns the assigned name of the frame, the name of the iframe tag
@@ -218,8 +233,15 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Returns the network isolation key used for subresources from the currently
   // committed navigation. It's set on commit and does not change until the next
   // navigation is committed.
+  //
+  // TODO(mmenke): Remove this in favor of GetIsolationInfoForSubresoruces().
   virtual const net::NetworkIsolationKey& GetNetworkIsolationKey() = 0;
 
+  // Returns the IsolationInfo used for subresources from the currently
+  // committed navigation. It's set on commit and does not change until the next
+  // navigation is committed.
+  virtual const net::IsolationInfo& GetIsolationInfoForSubresources() = 0;
+
   // Returns the associated widget's native view.
   virtual gfx::NativeView GetNativeView() = 0;
 
@@ -348,6 +370,10 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   virtual void SendInterventionReport(const std::string& id,
                                       const std::string& message) = 0;
 
+  // Returns the WebUI object associated wit this RenderFrameHost or nullptr
+  // otherwise.
+  virtual WebUI* GetWebUI() = 0;
+
   // Tell the render frame to enable a set of javascript bindings. The argument
   // should be a combination of values from BindingsPolicy.
   virtual void AllowBindings(int binding_flags) = 0;
@@ -362,6 +388,10 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
                                 const std::string& value) = 0;
 
 #if defined(OS_ANDROID)
+  // Returns the Java object of this instance.
+  virtual base::android::ScopedJavaLocalRef<jobject>
+  GetJavaRenderFrameHost() = 0;
+
   // Returns an InterfaceProvider for Java-implemented interfaces that are
   // scoped to this RenderFrameHost. This provides access to interfaces
   // implemented in Java in the browser process to C++ code in the browser
@@ -380,18 +410,6 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   virtual bool GetSuddenTerminationDisablerState(
       blink::mojom::SuddenTerminationDisablerType disabler_type) = 0;
 
-  // Returns true if the given |threshold_value| is below the threshold value
-  // specified in the policy for |feature| for this RenderFrameHost. See
-  // third_party/blink/public/common/feature_policy/feature_policy.h for how to
-  // compare values of different types. Use this in the browser process to
-  // determine whether access to a feature is allowed.
-  //
-  // TODO(chenleihu): remove this method when policy with non-boolean value
-  // fully migrated to document policy. After the migration, feature policy
-  // feature will only only hold boolean type value, and this method signature
-  // will no longer be needed.
-  virtual bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature,
-                                blink::PolicyValue threshold_value) = 0;
   // Returns true if the queried FeaturePolicyFeature is allowed by
   // feature policy.
   virtual bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature) = 0;
@@ -444,7 +462,7 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // The effective flags include those which have been set by a
   // Content-Security-Policy header, in addition to those which are set by the
   // embedding frame.
-  virtual bool IsSandboxed(blink::mojom::WebSandboxFlags flags) = 0;
+  virtual bool IsSandboxed(network::mojom::WebSandboxFlags flags) = 0;
 
   // Calls |FlushForTesting()| on Network Service and FrameNavigationControl
   // related interfaces to make sure all in-flight mojo messages have been
@@ -485,9 +503,9 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
 
   // Returns the type of frame owner element for the FrameTreeNode associated
   // with this RenderFrameHost (e.g., <iframe>, <object>, etc). Note that it
-  // returns blink::FrameOwnerElementType::kNone if the RenderFrameHost is a
-  // main frame.
-  virtual blink::FrameOwnerElementType GetFrameOwnerElementType() = 0;
+  // returns blink::mojom::FrameOwnerElementType::kNone if the RenderFrameHost
+  // is a main frame.
+  virtual blink::mojom::FrameOwnerElementType GetFrameOwnerElementType() = 0;
 
   // Returns the transient bit of the User Activation v2 state of the
   // FrameTreeNode associated with this RenderFrameHost.
@@ -522,18 +540,38 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Perform security checks on Web Authentication requests. These can be
   // called by other |Authenticator| mojo interface implementations in the
   // browser process so that they don't have to duplicate security policies.
+  // For requests originating from the render process, |effective_origin| will
+  // be the same as the last committed origin. However, for request originating
+  // from the browser process, this may be different.
   virtual blink::mojom::AuthenticatorStatus
   PerformGetAssertionWebAuthSecurityChecks(
-      const std::string& relying_party_id) = 0;
+      const std::string& relying_party_id,
+      const url::Origin& effective_origin) = 0;
   virtual blink::mojom::AuthenticatorStatus
   PerformMakeCredentialWebAuthSecurityChecks(
-      const std::string& relying_party_id) = 0;
+      const std::string& relying_party_id,
+      const url::Origin& effective_origin) = 0;
 
   // Tells the host that this is part of setting up a WebXR DOM Overlay. This
   // starts a short timer that permits entering fullscreen mode, similar to a
   // recent orientation change.
   virtual void SetIsXrOverlaySetup() = 0;
 
+  // Returns true if this RenderFrameHost is currently stored in the
+  // back-forward cache.
+  //
+  // TODO(hajimehoshi): Introduce an enum value for lifecycle states and replace
+  // IsInBackForwardCache with the enum values and a new function like
+  // DidChangeLifecycleState.
+  virtual bool IsInBackForwardCache() = 0;
+
+  // Return the UKM source id for the page load (last committed cross-document
+  // non-bfcache navigation in the main frame).
+  // This id typically has an associated PageLoad UKM event.
+  // Note: this can be called on any frame, but this id for all subframes is the
+  // same as the id for the main frame.
+  virtual ukm::SourceId GetPageUkmSourceId() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index ad7bf4b8975..675f9251fea 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -13,6 +13,7 @@
 #include <string>
 
 #include "base/callback_list.h"
+#include "base/clang_profiling_buildflags.h"
 #include "base/containers/id_map.h"
 #include "base/process/kill.h"
 #include "base/process/process.h"
@@ -540,6 +541,12 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // RenderProcessHostImpl::AddCorbExceptionForPlugin).
   virtual void CleanupNetworkServicePluginExceptionsUponDestruction() = 0;
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  // Ask the renderer process to dump its profiling data to disk. Invokes
+  // |callback| once this has completed.
+  virtual void DumpProfilingData(base::OnceClosure callback) {}
+#endif
+
   // Static management functions -----------------------------------------------
 
   // Possibly start an unbound, spare RenderProcessHost. A subsequent creation
@@ -595,7 +602,7 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // the current site), in which case we should ensure there is only one
   // RenderProcessHost per site for the entire browser context.
   static bool ShouldUseProcessPerSite(content::BrowserContext* browser_context,
-                                      const GURL& url);
+                                      const GURL& site_url);
 
   // Returns true if the caller should attempt to use an existing
   // RenderProcessHost rather than creating a new one.
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index 5b3da8ecf01..435461c0953 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -12,17 +12,18 @@
 
 #include "base/callback.h"
 #include "base/i18n/rtl.h"
+#include "base/optional.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/native_web_keyboard_event.h"
 #include "content/public/common/drop_data.h"
-#include "content/public/common/input_event_ack_source.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "ipc/ipc_channel.h"
 #include "ipc/ipc_sender.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
+#include "ui/base/ui_base_types.h"
 #include "ui/surface/transport_dib.h"
 
 namespace blink {
@@ -30,6 +31,10 @@ class WebMouseEvent;
 class WebMouseWheelEvent;
 }
 
+namespace cc {
+enum class TouchAction;
+}
+
 namespace gfx {
 class Point;
 }
@@ -239,8 +244,8 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
     virtual ~InputEventObserver() {}
 
     virtual void OnInputEvent(const blink::WebInputEvent&) {}
-    virtual void OnInputEventAck(InputEventAckSource source,
-                                 InputEventAckState state,
+    virtual void OnInputEventAck(blink::mojom::InputEventResultSource source,
+                                 blink::mojom::InputEventResultState state,
                                  const blink::WebInputEvent&) {}
 
 #if defined(OS_ANDROID)
@@ -278,6 +283,9 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
   // Get the screen info corresponding to this render widget.
   virtual void GetScreenInfo(ScreenInfo* result) = 0;
 
+  // Get the allowed touch action corresponding to this render widget.
+  virtual base::Optional<cc::TouchAction> GetAllowedTouchAction() = 0;
+
   // Drag-and-drop drop target messages that get sent to Blink.
   virtual void DragTargetDragEnter(
       const DropData& drop_data,
@@ -318,6 +326,10 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
 
   // Sets cursor to a specified one when it is over this widget.
   virtual void SetCursor(const ui::Cursor& cursor) {}
+
+  // Shows the context menu using the specified point as anchor point.
+  virtual void ShowContextMenuAtPoint(const gfx::Point& point,
+                                      const ui::MenuSourceType source_type) {}
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/service_process_host.h b/chromium/content/public/browser/service_process_host.h
index d051a796349..5bf31c75cf6 100644
--- a/chromium/content/public/browser/service_process_host.h
+++ b/chromium/content/public/browser/service_process_host.h
@@ -26,6 +26,15 @@
 
 namespace content {
 
+// Sandbox type for ServiceProcessHost::Launch<remote>() is found by
+// template matching on |remote|. This provides a safe default. For
+// services that use other sandbox types, consult
+// security-dev@chromium.org and add to an appropriate |service_sandbox_type.h|.
+template <typename Interface>
+inline content::SandboxType GetServiceSandboxType() {
+  return SandboxType::kUtility;
+}
+
 // ServiceProcessHost is used to launch new service processes given basic
 // parameters like sandbox type, as well as a primordial Mojo interface to drive
 // the service's behavior. See |Launch()| methods below for more details.
@@ -35,7 +44,6 @@ namespace content {
 //   constexpr auto kFooServiceIdleTimeout = base::TimeDelta::FromSeconds(5);
 //   auto foo_service = ServiceProcessHost::Launch<foo::mojom::FooService>(
 //       ServiceProcessHost::Options()
-//           .WithSandboxType(SandboxType::kUtility)
 //           .WithDisplayName(IDS_FOO_SERVICE_DISPLAY_NAME)
 //           .Pass());
 //   foo_service.set_idle_handler(
@@ -54,6 +62,7 @@ class CONTENT_EXPORT ServiceProcessHost {
 
     // Specifies the sandbox type with which to launch the service process.
     // Defaults to a generic, restrictive utility process sandbox.
+    // TODO(1065087) Deprecate.
     Options& WithSandboxType(SandboxType type);
 
     // Specifies the display name of the service process. This should generally
@@ -106,6 +115,10 @@ class CONTENT_EXPORT ServiceProcessHost {
   // explicitly reset its corresponding Remote in order to induce service
   // process termination.
   //
+  // The launched process will be sandboxed using the default utility process
+  // sandbox unless a specialized GetServiceSandboxType<Interface> is available.
+  // To add a new specialization, consult with security-dev@chromium.org.
+  //
   // NOTE: The |Interface| type can be inferred from from the |receiver|
   // argument's type.
   //
@@ -113,6 +126,9 @@ class CONTENT_EXPORT ServiceProcessHost {
   template <typename Interface>
   static void Launch(mojo::PendingReceiver<Interface> receiver,
                      Options options = {}) {
+    // TODO(1065087) remove this test once all services are migrated.
+    if (options.sandbox_type == SandboxType::kUtility)
+      options.sandbox_type = content::GetServiceSandboxType<Interface>();
     Launch(mojo::GenericPendingReceiver(std::move(receiver)),
            std::move(options));
   }
@@ -123,6 +139,9 @@ class CONTENT_EXPORT ServiceProcessHost {
   // May be called from any thread.
   template <typename Interface>
   static mojo::Remote<Interface> Launch(Options options = {}) {
+    // TODO(1065087) remove this test once all services are migrated.
+    if (options.sandbox_type == SandboxType::kUtility)
+      options.sandbox_type = content::GetServiceSandboxType<Interface>();
     mojo::Remote<Interface> remote;
     Launch(remote.BindNewPipeAndPassReceiver(), std::move(options));
     return remote;
diff --git a/chromium/content/public/browser/shared_worker_id.h b/chromium/content/public/browser/shared_worker_id.h
new file mode 100644
index 00000000000..1097ab4b397
--- /dev/null
+++ b/chromium/content/public/browser/shared_worker_id.h
@@ -0,0 +1,16 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SHARED_WORKER_ID_H_
+#define CONTENT_PUBLIC_BROWSER_SHARED_WORKER_ID_H_
+
+#include "base/util/type_safety/id_type.h"
+
+namespace content {
+
+using SharedWorkerId = util::IdType64<class SharedWorkerTag>;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SHARED_WORKER_ID_H_
diff --git a/chromium/content/public/browser/shared_worker_instance.cc b/chromium/content/public/browser/shared_worker_instance.cc
index 284730fcf17..59ff3798693 100644
--- a/chromium/content/public/browser/shared_worker_instance.cc
+++ b/chromium/content/public/browser/shared_worker_instance.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/shared_worker_instance.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
 
diff --git a/chromium/content/public/browser/shared_worker_service.h b/chromium/content/public/browser/shared_worker_service.h
index abc8b856e0f..f4fe6dbfe21 100644
--- a/chromium/content/public/browser/shared_worker_service.h
+++ b/chromium/content/public/browser/shared_worker_service.h
@@ -8,9 +8,9 @@
 #include <string>
 
 #include "base/observer_list_types.h"
-#include "base/util/type_safety/id_type.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/global_routing_id.h"
+#include "content/public/browser/shared_worker_id.h"
 
 class GURL;
 
@@ -24,8 +24,6 @@ class Origin;
 
 namespace content {
 
-using SharedWorkerId = util::IdType64<class SharedWorkerTag>;
-
 // An interface for managing shared workers. These may be run in a separate
 // process, since multiple renderer processes can be talking to a single shared
 // worker. All the methods below can only be called on the UI thread.
diff --git a/chromium/content/public/browser/site_instance.h b/chromium/content/public/browser/site_instance.h
index e3095f34c05..0a5aec6455a 100644
--- a/chromium/content/public/browser/site_instance.h
+++ b/chromium/content/public/browser/site_instance.h
@@ -96,7 +96,7 @@ class CONTENT_EXPORT SiteInstance : public base::RefCounted<SiteInstance> {
   // RenderProcessHost (and a new ID).  Note that renderer process crashes leave
   // the current RenderProcessHost (and ID) in place.
   //
-  // For sites that require process-per-site mode (e.g., WebUI), this will
+  // For sites that require process-per-site mode (e.g., NTP), this will
   // ensure only one RenderProcessHost for the site exists within the
   // BrowserContext.
   virtual content::RenderProcessHost* GetProcess() = 0;
@@ -167,8 +167,10 @@ class CONTENT_EXPORT SiteInstance : public base::RefCounted<SiteInstance> {
 
   // Factory method to get the appropriate SiteInstance for the given URL, in
   // a new BrowsingInstance.  Use this instead of Create when you know the URL,
-  // since it allows special site grouping rules to be applied (for example,
-  // to group chrome-ui pages into the same instance).
+  // since it allows special site grouping rules to be applied (for example, to
+  // obey process-per-site for sites that require it, such as NTP, or to use a
+  // default SiteInstance for sites that don't require a dedicated process on
+  // Android).
   static scoped_refptr<SiteInstance> CreateForURL(
       content::BrowserContext* browser_context,
       const GURL& url);
diff --git a/chromium/content/public/browser/site_isolation_policy.cc b/chromium/content/public/browser/site_isolation_policy.cc
index d99be56eaff..77b39af0c7d 100644
--- a/chromium/content/public/browser/site_isolation_policy.cc
+++ b/chromium/content/public/browser/site_isolation_policy.cc
@@ -130,6 +130,20 @@ bool SiteIsolationPolicy::AreDynamicIsolatedOriginsEnabled() {
 }
 
 // static
+bool SiteIsolationPolicy::ArePreloadedIsolatedOriginsEnabled() {
+  if (IsSiteIsolationDisabled())
+    return false;
+
+  // Currently, preloaded isolated origins are redundant when full site
+  // isolation is enabled.  This may be true on Android if full site isolation
+  // is enabled manually or via field trials.
+  if (UseDedicatedProcessesForAllSites())
+    return false;
+
+  return true;
+}
+
+// static
 std::string SiteIsolationPolicy::GetIsolatedOriginsFromCommandLine() {
   std::string cmdline_arg =
       base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
diff --git a/chromium/content/public/browser/site_isolation_policy.h b/chromium/content/public/browser/site_isolation_policy.h
index cf8d6206b0b..fa09d22e112 100644
--- a/chromium/content/public/browser/site_isolation_policy.h
+++ b/chromium/content/public/browser/site_isolation_policy.h
@@ -47,6 +47,11 @@ class CONTENT_EXPORT SiteIsolationPolicy {
   // opting itself into isolation via a header.
   static bool AreDynamicIsolatedOriginsEnabled();
 
+  // Returns true if isolated origins preloaded with the browser should be
+  // applied.  For example, this is used to apply memory limits to preloaded
+  // isolated origins on Android.
+  static bool ArePreloadedIsolatedOriginsEnabled();
+
   // Applies isolated origins from all available sources, including the
   // command-line switch, field trials, enterprise policy, and the embedder.
   // See also AreIsolatedOriginsEnabled. These origins apply globally to the
diff --git a/chromium/content/public/browser/sms_fetcher.h b/chromium/content/public/browser/sms_fetcher.h
index 47b1da5cc9f..002403b3415 100644
--- a/chromium/content/public/browser/sms_fetcher.h
+++ b/chromium/content/public/browser/sms_fetcher.h
@@ -7,7 +7,6 @@
 
 #include <string>
 
-#include "base/memory/weak_ptr.h"
 #include "base/observer_list_types.h"
 #include "content/common/content_export.h"
 
@@ -25,13 +24,12 @@ class RenderFrameHost;
 // There is one SmsFetcher per profile.
 class SmsFetcher {
  public:
+  SmsFetcher() = default;
+  virtual ~SmsFetcher() = default;
+
   // Retrieval for devices that exclusively listen for SMSes coming from other
   // telephony devices. (eg. desktop)
   CONTENT_EXPORT static SmsFetcher* Get(BrowserContext* context);
-  // Retrieval for devices that have telephony capabilities and can receive
-  // SMSes coming from the installed device locally. (eg. Android phones)
-  CONTENT_EXPORT static SmsFetcher* Get(BrowserContext* context,
-                                        base::WeakPtr<RenderFrameHost> rfh);
 
   class Subscriber : public base::CheckedObserver {
    public:
@@ -41,13 +39,18 @@ class SmsFetcher {
     virtual void OnReceive(const std::string& one_time_code) = 0;
   };
 
-  // Idempotent function that subscribes to incoming SMSes from SmsProvider.
+  // Subscribes to incoming SMSes from SmsProvider for subscribers that do not
+  // have telephony capabilities and exclusively listen for SMSes received
+  // on other devices.
   virtual void Subscribe(const url::Origin& origin, Subscriber* subscriber) = 0;
+  // Subscribes to incoming SMSes from SmsProvider for telephony
+  // devices that can receive SMSes locally and can show a permission prompt.
+  virtual void Subscribe(const url::Origin& origin,
+                         Subscriber* subscriber,
+                         RenderFrameHost* render_frame_host) = 0;
   virtual void Unsubscribe(const url::Origin& origin,
                            Subscriber* subscriber) = 0;
   virtual bool HasSubscribers() = 0;
-  // Checks if the device can receive SMSes.
-  virtual bool CanReceiveSms() = 0;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/ssl_status.cc b/chromium/content/public/browser/ssl_status.cc
index 7740146f3c0..bd9b1ff6493 100644
--- a/chromium/content/public/browser/ssl_status.cc
+++ b/chromium/content/public/browser/ssl_status.cc
@@ -24,7 +24,6 @@ SSLStatus::SSLStatus(const net::SSLInfo& ssl_info)
     : initialized(true),
       certificate(ssl_info.cert),
       cert_status(ssl_info.cert_status),
-      public_key_hashes(ssl_info.public_key_hashes),
       key_exchange_group(ssl_info.key_exchange_group),
       peer_signature_algorithm(ssl_info.peer_signature_algorithm),
       connection_status(ssl_info.connection_status),
@@ -36,7 +35,6 @@ SSLStatus::SSLStatus(const SSLStatus& other)
     : initialized(other.initialized),
       certificate(other.certificate),
       cert_status(other.cert_status),
-      public_key_hashes(other.public_key_hashes),
       key_exchange_group(other.key_exchange_group),
       peer_signature_algorithm(other.peer_signature_algorithm),
       connection_status(other.connection_status),
@@ -49,7 +47,6 @@ SSLStatus& SSLStatus::operator=(SSLStatus other) {
   initialized = other.initialized;
   certificate = other.certificate;
   cert_status = other.cert_status;
-  public_key_hashes = other.public_key_hashes;
   key_exchange_group = other.key_exchange_group;
   peer_signature_algorithm = other.peer_signature_algorithm;
   connection_status = other.connection_status;
diff --git a/chromium/content/public/browser/ssl_status.h b/chromium/content/public/browser/ssl_status.h
index 30c5f740b4c..f177d33bcdf 100644
--- a/chromium/content/public/browser/ssl_status.h
+++ b/chromium/content/public/browser/ssl_status.h
@@ -70,10 +70,6 @@ struct CONTENT_EXPORT SSLStatus {
   bool initialized;
   scoped_refptr<net::X509Certificate> certificate;
   net::CertStatus cert_status;
-  // The hashes of the SubjectPublicKeyInfos from each certificate in
-  // |certificate|. This field is not necessarily populated, e.g. for responses
-  // served from disk cache.
-  net::HashValueVector public_key_hashes;
   uint16_t key_exchange_group;
   uint16_t peer_signature_algorithm;
   int connection_status;
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index 022b6373ead..01ab7ba6e2d 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -18,6 +18,7 @@
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/cookie_manager.mojom-forward.h"
 #include "services/network/public/mojom/restricted_cookie_manager.mojom-forward.h"
+#include "services/network/public/mojom/trust_tokens.mojom-forward.h"
 
 class GURL;
 
@@ -65,6 +66,7 @@ class NativeFileSystemEntryFactory;
 class PlatformNotificationContext;
 class ServiceWorkerContext;
 class SharedWorkerService;
+class IdleManager;
 
 #if !defined(OS_ANDROID)
 class HostZoomLevelContext;
@@ -105,20 +107,9 @@ class CONTENT_EXPORT StoragePartition {
   virtual network::mojom::CookieManager*
   GetCookieManagerForBrowserProcess() = 0;
 
-  // See documentation for
-  // ContentBrowserClient::WillCreateRestrictedCookieManager for description of
-  // the parameters. The method here is expected pass things through that hook
-  // and then go to the NetworkContext if needed.
-  virtual void CreateRestrictedCookieManager(
-      network::mojom::RestrictedCookieManagerRole role,
-      const url::Origin& origin,
-      const net::SiteForCookies& site_for_cookies,
-      const url::Origin& top_frame_origin,
-      bool is_service_worker,
-      int process_id,
-      int routing_id,
-      mojo::PendingReceiver<network::mojom::RestrictedCookieManager>
-          receiver) = 0;
+  virtual void CreateHasTrustTokensAnswerer(
+      mojo::PendingReceiver<network::mojom::HasTrustTokensAnswerer> receiver,
+      const url::Origin& top_frame_origin) = 0;
 
   virtual storage::QuotaManager* GetQuotaManager() = 0;
   virtual AppCacheService* GetAppCacheService() = 0;
@@ -126,6 +117,7 @@ class CONTENT_EXPORT StoragePartition {
   virtual storage::FileSystemContext* GetFileSystemContext() = 0;
   virtual storage::DatabaseTracker* GetDatabaseTracker() = 0;
   virtual DOMStorageContext* GetDOMStorageContext() = 0;
+  virtual IdleManager* GetIdleManager() = 0;
   virtual storage::mojom::IndexedDBControl& GetIndexedDBControl() = 0;
   virtual NativeFileSystemEntryFactory* GetNativeFileSystemEntryFactory() = 0;
   virtual ServiceWorkerContext* GetServiceWorkerContext() = 0;
@@ -162,6 +154,7 @@ class CONTENT_EXPORT StoragePartition {
     REMOVE_DATA_MASK_CACHE_STORAGE = 1 << 8,
     REMOVE_DATA_MASK_PLUGIN_PRIVATE_DATA = 1 << 9,
     REMOVE_DATA_MASK_BACKGROUND_FETCH = 1 << 10,
+    REMOVE_DATA_MASK_CONVERSIONS = 1 << 11,
     REMOVE_DATA_MASK_ALL = 0xFFFFFFFF,
 
     // Corresponds to storage::kStorageTypeTemporary.
@@ -267,6 +260,10 @@ class CONTENT_EXPORT StoragePartition {
   // Wait until code cache's shutdown is complete. For test use only.
   virtual void WaitForCodeCacheShutdownForTesting() = 0;
 
+  virtual void SetNetworkContextForTesting(
+      mojo::PendingRemote<network::mojom::NetworkContext>
+          network_context_remote) = 0;
+
   // The value pointed to by |settings| should remain valid until the
   // the function is called again with a new value or a nullptr.
   static void SetDefaultQuotaSettingsForTesting(
diff --git a/chromium/content/public/browser/url_data_source.cc b/chromium/content/public/browser/url_data_source.cc
index 406ecfd3f97..e5b60a8179e 100644
--- a/chromium/content/public/browser/url_data_source.cc
+++ b/chromium/content/public/browser/url_data_source.cc
@@ -8,7 +8,6 @@
 
 #include "base/memory/ptr_util.h"
 #include "base/task_runner_util.h"
-#include "content/browser/resource_context_impl.h"
 #include "content/browser/webui/url_data_manager.h"
 #include "content/browser/webui/url_data_manager_backend.h"
 #include "content/browser/webui/url_data_source_impl.h"
@@ -20,20 +19,6 @@
 
 namespace content {
 
-namespace {
-
-URLDataSource* GetSourceForURLHelper(ResourceContext* resource_context,
-                                     const GURL& url) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
-  URLDataSourceImpl* source =
-      GetURLDataManagerForResourceContext(resource_context)
-          ->GetDataSourceFromURL(url);
-  return source->source();
-}
-
-}  // namespace
-
 // static
 void URLDataSource::Add(BrowserContext* browser_context,
                         std::unique_ptr<URLDataSource> source) {
@@ -41,15 +26,11 @@ void URLDataSource::Add(BrowserContext* browser_context,
 }
 
 // static
-void URLDataSource::GetSourceForURL(
-    BrowserContext* browser_context,
-    const GURL& url,
-    base::OnceCallback<void(URLDataSource*)> callback) {
-  base::PostTaskAndReplyWithResult(
-      GetIOThreadTaskRunner({}).get(), FROM_HERE,
-      base::BindOnce(&GetSourceForURLHelper,
-                     browser_context->GetResourceContext(), url),
-      std::move(callback));
+URLDataSource* URLDataSource::GetSourceForURL(BrowserContext* browser_context,
+                                              const GURL& url) {
+  return URLDataManagerBackend::GetForBrowserContext(browser_context)
+      ->GetDataSourceFromURL(url)
+      ->source();
 }
 
 // static
@@ -65,11 +46,6 @@ std::string URLDataSource::URLToRequestPath(const GURL& url) {
   return std::string();
 }
 
-scoped_refptr<base::SingleThreadTaskRunner>
-URLDataSource::TaskRunnerForRequestPath(const std::string& path) {
-  return GetUIThreadTaskRunner({});
-}
-
 bool URLDataSource::ShouldReplaceExistingSource() {
   return true;
 }
@@ -82,28 +58,32 @@ bool URLDataSource::ShouldAddContentSecurityPolicy() {
   return true;
 }
 
-std::string URLDataSource::GetContentSecurityPolicyScriptSrc() {
-  // Note: Do not add 'unsafe-eval' here. Instead override CSP for the
-  // specific pages that need it, see context http://crbug.com/525224.
-  return "script-src chrome://resources 'self';";
+std::string URLDataSource::GetContentSecurityPolicyChildSrc() {
+  return "child-src 'none';";
+}
+
+std::string URLDataSource::GetContentSecurityPolicyDefaultSrc() {
+  return std::string();
+}
+
+std::string URLDataSource::GetContentSecurityPolicyImgSrc() {
+  return std::string();
 }
 
 std::string URLDataSource::GetContentSecurityPolicyObjectSrc() {
   return "object-src 'none';";
 }
 
-std::string URLDataSource::GetContentSecurityPolicyChildSrc() {
-  return "child-src 'none';";
+std::string URLDataSource::GetContentSecurityPolicyScriptSrc() {
+  // Note: Do not add 'unsafe-eval' here. Instead override CSP for the
+  // specific pages that need it, see context http://crbug.com/525224.
+  return "script-src chrome://resources 'self';";
 }
 
 std::string URLDataSource::GetContentSecurityPolicyStyleSrc() {
   return std::string();
 }
 
-std::string URLDataSource::GetContentSecurityPolicyImgSrc() {
-  return std::string();
-}
-
 std::string URLDataSource::GetContentSecurityPolicyWorkerSrc() {
   return std::string();
 }
@@ -117,7 +97,7 @@ bool URLDataSource::ShouldDenyXFrameOptions() {
 }
 
 bool URLDataSource::ShouldServiceRequest(const GURL& url,
-                                         ResourceContext* resource_context,
+                                         BrowserContext* browser_context,
                                          int render_process_id) {
   return url.SchemeIs(kChromeDevToolsScheme) || url.SchemeIs(kChromeUIScheme) ||
          url.SchemeIs(kChromeUIUntrustedScheme);
diff --git a/chromium/content/public/browser/url_data_source.h b/chromium/content/public/browser/url_data_source.h
index 8b4b164d4ce..b386897a5ff 100644
--- a/chromium/content/public/browser/url_data_source.h
+++ b/chromium/content/public/browser/url_data_source.h
@@ -23,7 +23,6 @@ class RefCountedMemory;
 
 namespace content {
 class BrowserContext;
-class ResourceContext;
 
 // A URLDataSource is an object that can answer requests for WebUI data
 // asynchronously. An implementation of URLDataSource should handle calls to
@@ -36,13 +35,11 @@ class CONTENT_EXPORT URLDataSource {
   static void Add(BrowserContext* browser_context,
                   std::unique_ptr<URLDataSource> source);
 
-  // Gets a reference to the URL data source for |url| and runs |callback| with
-  // it as an argument.
+  // Gets a reference to the URL data source for |url|.
   // TODO (rbpotter): Remove this function when the OOBE page Polymer 2
   // migration is complete.
-  static void GetSourceForURL(BrowserContext* browser_context,
-                              const GURL& url,
-                              base::OnceCallback<void(URLDataSource*)>);
+  static URLDataSource* GetSourceForURL(BrowserContext* browser_context,
+                                        const GURL& url);
 
   // Parse |url| to get the path which will be used to resolve the request. The
   // path is the remaining portion after the scheme and hostname, without the
@@ -65,9 +62,6 @@ class CONTENT_EXPORT URLDataSource {
   using GotDataCallback =
       base::OnceCallback<void(scoped_refptr<base::RefCountedMemory>)>;
 
-  // Must be called on the task runner specified by TaskRunnerForRequestPath,
-  // or the IO thread if TaskRunnerForRequestPath returns nullptr.
-  //
   // Called by URLDataSource to request data at |url|. The child class should
   // run |callback| when the data is available or if the request could not be
   // satisfied. This can be called either in this callback or asynchronously
@@ -79,28 +73,13 @@ class CONTENT_EXPORT URLDataSource {
                                 const WebContents::Getter& wc_getter,
                                 GotDataCallback callback) = 0;
 
-  // The following methods are all called on the IO thread.
-
   // Return the mimetype that should be sent with this response, or empty
   // string to specify no mime type.
   virtual std::string GetMimeType(const std::string& path) = 0;
 
-  // Returns the TaskRunner on which the delegate wishes to have
-  // StartDataRequest called to handle the request for |path|. The default
-  // implementation returns BrowserThread::UI. If the delegate does not care
-  // which thread StartDataRequest is called on, this should return nullptr.
-  // It may be beneficial to return nullptr for requests that are safe to handle
-  // directly on the IO thread.  This can improve performance by satisfying such
-  // requests more rapidly when there is a large amount of UI thread contention.
-  // Or the delegate can return a specific thread's TaskRunner if they wish.
-  virtual scoped_refptr<base::SingleThreadTaskRunner> TaskRunnerForRequestPath(
-      const std::string& path);
-
   // Returns true if the URLDataSource should replace an existing URLDataSource
   // with the same name that has already been registered. The default is true.
   //
-  // WARNING: this is invoked on the IO thread.
-  //
   // TODO: nuke this and convert all callers to not replace.
   virtual bool ShouldReplaceExistingSource();
 
@@ -126,14 +105,16 @@ class CONTENT_EXPORT URLDataSource {
   // It is OK to override the following methods to a custom CSP directive
   // thereby slightly reducing the protection applied to the page.
 
-  // By default, "object-src 'none';" is added to CSP. Override to change this.
-  virtual std::string GetContentSecurityPolicyObjectSrc();
   // By default, "child-src 'none';" is added to CSP. Override to change this.
   virtual std::string GetContentSecurityPolicyChildSrc();
   // By default empty. Override to change this.
-  virtual std::string GetContentSecurityPolicyStyleSrc();
+  virtual std::string GetContentSecurityPolicyDefaultSrc();
   // By default empty. Override to change this.
   virtual std::string GetContentSecurityPolicyImgSrc();
+  // By default, "object-src 'none';" is added to CSP. Override to change this.
+  virtual std::string GetContentSecurityPolicyObjectSrc();
+  // By default empty. Override to change this.
+  virtual std::string GetContentSecurityPolicyStyleSrc();
   // By default empty. Override to change this.
   virtual std::string GetContentSecurityPolicyWorkerSrc();
   // By default, "frame ancestors: 'none'" is added to the CSP unless
@@ -150,7 +131,7 @@ class CONTENT_EXPORT URLDataSource {
   // ContentBrowserClient::GetAdditionalWebUISchemes() to permit additional
   // WebUI scheme support for an embedder.
   virtual bool ShouldServiceRequest(const GURL& url,
-                                    ResourceContext* resource_context,
+                                    BrowserContext* browser_context,
                                     int render_process_id);
 
   // By default, Content-Type: header is not sent along with the response.
diff --git a/chromium/content/public/browser/web_contents.cc b/chromium/content/public/browser/web_contents.cc
index d1d8ff84e1d..f1dcf53ea48 100644
--- a/chromium/content/public/browser/web_contents.cc
+++ b/chromium/content/public/browser/web_contents.cc
@@ -8,6 +8,7 @@
 
 #include "content/public/common/child_process_host.h"
 #include "ipc/ipc_message.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 
 namespace content {
 
@@ -27,7 +28,7 @@ WebContents::CreateParams::CreateParams(BrowserContext* context,
       context(nullptr),
       renderer_initiated_creation(false),
       desired_renderer_state(kOkayToHaveRendererProcess),
-      starting_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
+      starting_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       is_never_visible(false) {}
 
 WebContents::CreateParams::CreateParams(const CreateParams& other) = default;
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index b471bd1f78c..039f001f129 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -36,7 +36,6 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/data_decoder/public/mojom/web_bundler.mojom.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom-forward.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom-forward.h"
@@ -81,7 +80,6 @@ namespace content {
 
 class BrowserContext;
 class BrowserPluginGuestDelegate;
-class InterstitialPage;
 class RenderFrameHost;
 class RenderViewHost;
 class RenderWidgetHost;
@@ -212,7 +210,7 @@ class WebContents : public PageNavigator,
     } desired_renderer_state;
 
     // Sandboxing flags set on the new WebContents.
-    blink::mojom::WebSandboxFlags starting_sandbox_flags;
+    network::mojom::WebSandboxFlags starting_sandbox_flags;
 
     // Value used to set the last time the WebContents was made active, this is
     // the value that'll be returned by GetLastActiveTime(). If this is left
@@ -384,11 +382,24 @@ class WebContents : public PageNavigator,
   virtual WebUI* GetWebUI() = 0;
   virtual WebUI* GetCommittedWebUI() = 0;
 
-  // Allows overriding the user agent used for NavigationEntries it owns.
-  // |override_in_new_tabs| is set when we are overriding user agent for new
-  // tabs.
+  // Sets the user-agent that may be used for navigations in this WebContents.
+  // The user-agent is *only* used when
+  // NavigationEntry::SetIsOverridingUserAgent(true) is used (the value of
+  // is-overriding-user-agent may be specified in LoadURLParams). If
+  // |override_in_new_tabs| is true, and the first navigation in the tab is
+  // renderer initiated, then is-overriding-user-agent is set to true for the
+  // NavigationEntry. See SetRendererInitiatedUserAgentOverrideOption() for
+  // details on how renderer initiated navigations are configured.
   virtual void SetUserAgentOverride(const blink::UserAgentOverride& ua_override,
                                     bool override_in_new_tabs) = 0;
+
+  // Configures the value of is-overriding-user-agent for renderer initiated
+  // navigations. The default is UA_OVERRIDE_INHERIT. This value does not apply
+  // to the first renderer initiated navigation if the tab has no navigations.
+  // See SetUserAgentOverride() for details on that.
+  virtual void SetRendererInitiatedUserAgentOverrideOption(
+      NavigationController::UserAgentOverrideOption option) = 0;
+
   virtual const blink::UserAgentOverride& GetUserAgentOverride() = 0;
 
   // Set the accessibility mode so that accessibility events are forwarded
@@ -612,6 +623,11 @@ class WebContents : public PageNavigator,
   // GetOuterWebContents instead.
   virtual bool IsInnerWebContentsForGuest() = 0;
 
+  // Returns whether this WebContents is a portal. This returns true even when
+  // this WebContents is not attached to its portal host's WebContents tree.
+  // This value may change over time due to portal activation and adoption.
+  virtual bool IsPortal() = 0;
+
   // Returns the outer WebContents frame, the same frame that this WebContents
   // was attached in AttachToOuterWebContentsFrame().
   virtual RenderFrameHost* GetOuterWebContentsFrame() = 0;
@@ -651,19 +667,6 @@ class WebContents : public PageNavigator,
   // page.
   virtual void SyncRendererPrefs() = 0;
 
-  // Notifies WebContents that an attempt has been made to read the cookies in
-  // |cookie_list|.
-  virtual void OnCookiesRead(const GURL& url,
-                             const GURL& first_party_url,
-                             const net::CookieList& cookie_list,
-                             bool blocked_by_policy) = 0;
-
-  // Notifies WebContents that an attempt has been made to set |cookie|.
-  virtual void OnCookieChange(const GURL& url,
-                              const GURL& first_party_url,
-                              const net::CanonicalCookie& cookie,
-                              bool blocked_by_policy) = 0;
-
   // Commands ------------------------------------------------------------------
 
   // Stop any pending navigation.
@@ -771,14 +774,6 @@ class WebContents : public PageNavigator,
   // Various other systems need to know about our interstitials.
   virtual bool ShowingInterstitialPage() = 0;
 
-  // Returns the currently visible interstitial, nullptr if no interstitial is
-  // visible. Note: This returns nullptr from the time the interstitial page has
-  // Show() called on it until the interstitial content is ready and the
-  // interstitial is displayed.
-  //
-  // Compare to InterstitialPage::GetInterstitialPage.
-  virtual InterstitialPage* GetInterstitialPage() = 0;
-
   // Misc state & callbacks ----------------------------------------------------
 
   // Check whether we can do the saving page operation this page given its MIME
@@ -1080,9 +1075,6 @@ class WebContents : public PageNavigator,
   // created from a renderer that originated from this WebContents.
   virtual base::UnguessableToken GetAudioGroupId() = 0;
 
-  // The source ID of the last committed navigation.
-  virtual ukm::SourceId GetLastCommittedSourceId() = 0;
-
   // Returns the raw list of favicon candidates as reported to observers via
   // WebContentsObserver::DidUpdateFaviconURL() since the last navigation start.
   // Consider using FaviconDriver in components/favicon if possible for more
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index 17281521f81..6017278cc0f 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -186,6 +186,12 @@ ColorChooser* WebContentsDelegate::OpenColorChooser(
   return nullptr;
 }
 
+std::unique_ptr<EyeDropper> WebContentsDelegate::OpenEyeDropper(
+    RenderFrameHost* frame,
+    EyeDropperListener* listener) {
+  return nullptr;
+}
+
 void WebContentsDelegate::RunFileChooser(
     RenderFrameHost* render_frame_host,
     std::unique_ptr<FileSelectListener> listener,
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index d10b0f45841..7757c772040 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -18,6 +18,7 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/bluetooth_chooser.h"
 #include "content/public/browser/bluetooth_scanning_prompt.h"
+#include "content/public/browser/eye_dropper.h"
 #include "content/public/browser/invalidate_type.h"
 #include "content/public/browser/media_stream_request.h"
 #include "content/public/browser/serial_chooser.h"
@@ -56,6 +57,7 @@ class FileChooserParams;
 
 namespace content {
 class ColorChooser;
+class EyeDropperListener;
 class FileSelectListener;
 class JavaScriptDialogManager;
 class RenderFrameHost;
@@ -136,14 +138,16 @@ class CONTENT_EXPORT WebContentsDelegate {
   // security state changed and that security UI should be updated.
   virtual void VisibleSecurityStateChanged(WebContents* source) {}
 
-  // Creates a new tab with the already-created WebContents 'new_contents'.
+  // Creates a new tab with the already-created WebContents |new_contents|.
   // The window for the added contents should be reparented correctly when this
-  // method returns.  If |disposition| is NEW_POPUP, |initial_rect| should hold
-  // the initial position and size. If |was_blocked| is non-nullptr, then
-  // |*was_blocked| will be set to true if the popup gets blocked, and left
+  // method returns. |target_url| is set to the value provided when
+  // |new_contents| was created. If |disposition| is NEW_POPUP, |initial_rect|
+  // should hold the initial position and size. If |was_blocked| is non-nullptr,
+  // then |*was_blocked| will be set to true if the popup gets blocked, and left
   // unchanged otherwise.
   virtual void AddNewContents(WebContents* source,
                               std::unique_ptr<WebContents> new_contents,
+                              const GURL& target_url,
                               WindowOpenDisposition disposition,
                               const gfx::Rect& initial_rect,
                               bool user_gesture,
@@ -394,6 +398,14 @@ class CONTENT_EXPORT WebContentsDelegate {
       SkColor color,
       const std::vector<blink::mojom::ColorSuggestionPtr>& suggestions);
 
+  // Called when an eye dropper should open. Returns the eye dropper window.
+  // The eye dropper is responsible for calling listener->ColorSelected() or
+  // listener->ColorSelectionCanceled().
+  // The ownership of the returned pointer is transferred to the caller.
+  virtual std::unique_ptr<EyeDropper> OpenEyeDropper(
+      RenderFrameHost* frame,
+      EyeDropperListener* listener);
+
   // Called when a file selection is to be done.
   // This function is responsible for calling listener->FileSelected() or
   // listener->FileSelectionCanceled().
diff --git a/chromium/content/public/browser/web_contents_observer.cc b/chromium/content/public/browser/web_contents_observer.cc
index 7ddad66ffde..21b9e6a7adf 100644
--- a/chromium/content/public/browser/web_contents_observer.cc
+++ b/chromium/content/public/browser/web_contents_observer.cc
@@ -46,6 +46,19 @@ bool WebContentsObserver::OnMessageReceived(
   return false;
 }
 
+bool WebContentsObserver::ShowPopupMenu(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+    const gfx::Rect& bounds,
+    int32_t item_height,
+    double font_size,
+    int32_t selected_item,
+    std::vector<blink::mojom::MenuItemPtr>* menu_items,
+    bool right_aligned,
+    bool allow_multiple_selection) {
+  return false;
+}
+
 bool WebContentsObserver::OnMessageReceived(const IPC::Message& message) {
   return false;
 }
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index 0b9a8c72a42..f0f6c11f599 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -11,8 +11,11 @@
 #include "base/optional.h"
 #include "base/process/kill.h"
 #include "base/process/process_handle.h"
+#include "base/threading/thread_restrictions.h"
 #include "components/viz/common/vertical_scroll_direction.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/allow_service_worker_result.h"
+#include "content/public/browser/cookie_access_details.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/reload_type.h"
 #include "content/public/browser/visibility.h"
@@ -23,6 +26,7 @@
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
+#include "third_party/blink/public/mojom/choosers/popup_menu.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-forward.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -145,6 +149,9 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // unresponsive.
   virtual void OnRendererUnresponsive(RenderProcessHost* render_process_host) {}
 
+  // See WebContentsDelegate::RendererResponsive().
+  virtual void OnRendererResponsive(RenderProcessHost* render_process_host) {}
+
   // Navigation ----------------------------------------------------------------
 
   // Called when a navigation started in the WebContents. |navigation_handle|
@@ -207,19 +214,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // so do not keep a reference to it afterward.
   virtual void DidFinishNavigation(NavigationHandle* navigation_handle) {}
 
-  // Navigation (obsolete and deprecated) --------------------------------------
-
-  // This method is invoked after the browser process starts a navigation to a
-  // pending NavigationEntry. It is not called for renderer-initiated
-  // navigations unless they are sent to the browser process via OpenURL. It may
-  // be called multiple times for a given navigation, such as a typed URL
-  // followed by a cross-process client or server redirect.
-  //
-  // SOON TO BE DEPRECATED. Use DidStartNavigation instead.
-  // TODO(clamy): Remove this function.
-  virtual void DidStartNavigationToPendingEntry(const GURL& url,
-                                                ReloadType reload_type) {}
-
   // Document load events ------------------------------------------------------
 
   // These three methods correspond to the points in time when a document starts
@@ -280,21 +274,18 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
       const GlobalRequestID& request_id,
       const blink::mojom::ResourceLoadInfo& resource_load_info) {}
 
-  // This method is invoked when a document or resource reads a cookie. Note
-  // that this isn't tied to any particular navigation (e.g., it may be called
-  // after a subsequent navigation commits).
-  virtual void OnCookiesRead(const GURL& url,
-                             const GURL& first_party_url,
-                             const net::CookieList& cookie_list,
-                             bool blocked_by_policy) {}
-
-  // This method is invoked when an attempt has been made to set |cookie|. Note
-  // that this isn't tied to any particular navigation (e.g., it may be called
-  // after a subsequent navigation commits).
-  virtual void OnCookieChange(const GURL& url,
-                              const GURL& first_party_url,
-                              const net::CanonicalCookie& cookie,
-                              bool blocked_by_policy) {}
+  // Called when document reads or sets a cookie (either via document.cookie or
+  // issuing a network request).
+  // Cookie reads/writes for a dedicated worker are attributed to the
+  // RenderFrameHost which created it.
+  virtual void OnCookiesAccessed(RenderFrameHost* render_frame_host,
+                                 const CookieAccessDetails& details) {}
+
+  // Called when a network request issued by the navigation reads or sets a
+  // cookie. If a notification is received after the navigation has committed,
+  // it will be attributed to the RenderFrameHost created by the navigation.
+  virtual void OnCookiesAccessed(NavigationHandle* navigation_handle,
+                                 const CookieAccessDetails& details) {}
 
   // This method is invoked when a new non-pending navigation entry is created.
   // This corresponds to one NavigationController entry being created
@@ -607,6 +598,34 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   virtual void AudioContextPlaybackStopped(
       const AudioContextId& audio_context_id) {}
 
+  // Called after the contents replaces the |predecessor_contents| in its
+  // container due to portal activation. The |predecessor_contents| is now a
+  // portal pending adoption. |predecessor_contents| is non-null, but may
+  // subsequently be destroyed if it is not adopted.
+  virtual void DidActivatePortal(WebContents* predecessor_contents) {}
+
+  // Called when the RenderFrameHost tries to use a ServiceWorker
+  // (e.g. via navigation.serviceWorker API).
+  virtual void OnServiceWorkerAccessed(RenderFrameHost* render_frame_host,
+                                       const GURL& scope,
+                                       AllowServiceWorkerResult allowed) {}
+  // Called when the NavigationHandle accesses ServiceWorker to see if the
+  // network request should be handled by the ServiceWorker instead
+  // (e.g. for navigations to URLs which are in scope of a ServiceWorker).
+  virtual void OnServiceWorkerAccessed(NavigationHandle* navigation_handle,
+                                       const GURL& scope,
+                                       AllowServiceWorkerResult allowed) {}
+  virtual bool ShowPopupMenu(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingRemote<blink::mojom::PopupMenuClient>* popup_client,
+      const gfx::Rect& bounds,
+      int32_t item_height,
+      double font_size,
+      int32_t selected_item,
+      std::vector<blink::mojom::MenuItemPtr>* menu_items,
+      bool right_aligned,
+      bool allow_multiple_selection);
+
   // IPC::Listener implementation.
   // DEPRECATED: Use (i.e. override) the other overload instead:
   //     virtual bool OnMessageReceived(const IPC::Message& message,
diff --git a/chromium/content/public/browser/web_contents_receiver_set.cc b/chromium/content/public/browser/web_contents_receiver_set.cc
index 5170094df4b..dd7d58382b5 100644
--- a/chromium/content/public/browser/web_contents_receiver_set.cc
+++ b/chromium/content/public/browser/web_contents_receiver_set.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 
 namespace content {
diff --git a/chromium/content/public/browser/web_ui_data_source.h b/chromium/content/public/browser/web_ui_data_source.h
index 9b04a3da2bc..e963d50a0ff 100644
--- a/chromium/content/public/browser/web_ui_data_source.h
+++ b/chromium/content/public/browser/web_ui_data_source.h
@@ -20,7 +20,7 @@
 namespace base {
 class DictionaryValue;
 class RefCountedMemory;
-}
+}  // namespace base
 
 namespace content {
 class BrowserContext;
@@ -111,11 +111,16 @@ class WebUIDataSource {
   // Currently only used by embedders for WebUIs with multiple instances.
   virtual void DisableReplaceExistingSource() = 0;
   virtual void DisableContentSecurityPolicy() = 0;
-  virtual void OverrideContentSecurityPolicyScriptSrc(
+  virtual void OverrideContentSecurityPolicyChildSrc(
+      const std::string& data) = 0;
+  virtual void OverrideContentSecurityPolicyDefaultSrc(
       const std::string& data) = 0;
+  virtual void OverrideContentSecurityPolicyImgSrc(const std::string& data) = 0;
   virtual void OverrideContentSecurityPolicyObjectSrc(
       const std::string& data) = 0;
-  virtual void OverrideContentSecurityPolicyChildSrc(
+  virtual void OverrideContentSecurityPolicyScriptSrc(
+      const std::string& data) = 0;
+  virtual void OverrideContentSecurityPolicyStyleSrc(
       const std::string& data) = 0;
   virtual void OverrideContentSecurityPolicyWorkerSrc(
       const std::string& data) = 0;
diff --git a/chromium/content/public/browser/webrtc_event_logger.cc b/chromium/content/public/browser/webrtc_event_logger.cc
index b4de604d672..89be54e16a7 100644
--- a/chromium/content/public/browser/webrtc_event_logger.cc
+++ b/chromium/content/public/browser/webrtc_event_logger.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/webrtc_event_logger.h"
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace content {
diff --git a/chromium/content/public/browser/webvr_service_provider.cc b/chromium/content/public/browser/webvr_service_provider.cc
deleted file mode 100644
index e10aa124eeb..00000000000
--- a/chromium/content/public/browser/webvr_service_provider.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/browser/webvr_service_provider.h"
-
-#include "base/lazy_instance.h"
-
-namespace content {
-
-base::LazyInstance<WebvrServiceProvider::BindWebvrServiceCallback>::Leaky
-    g_callback = LAZY_INSTANCE_INITIALIZER;
-
-void WebvrServiceProvider::BindWebvrService(
-    RenderFrameHost* render_frame_host,
-    mojo::PendingReceiver<device::mojom::VRService> receiver) {
-  // Ignore the pending receiver if the callback is unset.
-  if (g_callback.Get().is_null())
-    return;
-  g_callback.Get().Run(render_frame_host, std::move(receiver));
-}
-
-void WebvrServiceProvider::SetWebvrServiceCallback(
-    BindWebvrServiceCallback callback) {
-  g_callback.Get() = std::move(callback);
-}
-
-}  // namespace content
diff --git a/chromium/content/public/browser/webvr_service_provider.h b/chromium/content/public/browser/webvr_service_provider.h
deleted file mode 100644
index 7235a8f7f15..00000000000
--- a/chromium/content/public/browser/webvr_service_provider.h
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_BROWSER_WEBVR_SERVICE_PROVIDER_H
-#define CONTENT_PUBLIC_BROWSER_WEBVR_SERVICE_PROVIDER_H
-
-#include "base/callback.h"
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/pending_receiver.h"
-
-namespace device {
-namespace mojom {
-class VRService;
-}
-}  // namespace device
-
-namespace content {
-
-class RenderFrameHost;
-
-// Provides access to the browser process representation of a WebVR site
-// session. See VrServiceImpl.
-class WebvrServiceProvider {
- public:
-  static void BindWebvrService(
-      RenderFrameHost* render_frame_host,
-      mojo::PendingReceiver<device::mojom::VRService> receiver);
-
-  using BindWebvrServiceCallback = base::RepeatingCallback<
-      void(RenderFrameHost*, mojo::PendingReceiver<device::mojom::VRService>)>;
-
-  CONTENT_EXPORT static void SetWebvrServiceCallback(
-      BindWebvrServiceCallback callback);
-
- private:
-  WebvrServiceProvider() = default;
-  ~WebvrServiceProvider() = default;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_BROWSER_WEBVR_SERVICE_PROVIDER_H
diff --git a/chromium/content/public/browser/xr_integration_client.cc b/chromium/content/public/browser/xr_integration_client.cc
index 117ba0c9456..4b617dcc7a1 100644
--- a/chromium/content/public/browser/xr_integration_client.cc
+++ b/chromium/content/public/browser/xr_integration_client.cc
@@ -6,6 +6,7 @@
 
 #include "content/public/browser/xr_consent_helper.h"
 #include "content/public/browser/xr_install_helper.h"
+#include "device/vr/public/cpp/vr_device_provider.h"
 #include "device/vr/public/mojom/vr_service.mojom-shared.h"
 
 namespace content {
@@ -20,6 +21,10 @@ std::unique_ptr<XrConsentHelper> XrIntegrationClient::GetConsentHelper(
   return nullptr;
 }
 
+XRProviderList XrIntegrationClient::GetAdditionalProviders() {
+  return {};
+}
+
 #if !defined(OS_ANDROID)
 std::unique_ptr<VrUiHost> XrIntegrationClient::CreateVrUiHost(
     device::mojom::XRDeviceId device_id,
diff --git a/chromium/content/public/browser/xr_integration_client.h b/chromium/content/public/browser/xr_integration_client.h
index f75017b4c2c..bfdf231cd50 100644
--- a/chromium/content/public/browser/xr_integration_client.h
+++ b/chromium/content/public/browser/xr_integration_client.h
@@ -16,10 +16,15 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #endif
 
+namespace device {
+class VRDeviceProvider;
+}
+
 namespace content {
 class XrConsentHelper;
 class XrInstallHelper;
 
+using XRProviderList = std::vector<std::unique_ptr<device::VRDeviceProvider>>;
 #if !defined(OS_ANDROID)
 // This class is intended to provide implementers a means of accessing the
 // the XRCompositorHost returned from a create session call. Content has no
@@ -57,6 +62,10 @@ class CONTENT_EXPORT XrIntegrationClient {
   virtual std::unique_ptr<XrConsentHelper> GetConsentHelper(
       device::mojom::XRDeviceId device_id);
 
+  // Returns a vector of device providers that should be used in addition to
+  // any default providers built-in to //content.
+  virtual XRProviderList GetAdditionalProviders();
+
 #if !defined(OS_ANDROID)
   // Creates a VrUiHost object for the specified device_id, and takes ownership
   // of any XRCompositor supplied from the runtime.
diff --git a/chromium/content/public/browser/xr_runtime_manager.h b/chromium/content/public/browser/xr_runtime_manager.h
index 735f3ba2d5c..cb66d5846d7 100644
--- a/chromium/content/public/browser/xr_runtime_manager.h
+++ b/chromium/content/public/browser/xr_runtime_manager.h
@@ -17,13 +17,27 @@ class BrowserXRRuntime;
 // active BrowserXRRuntime instances. An Observer interface is provided in case
 // runtimes need to interact with runtimes when they are added (e.g. to notify
 // them of any current state that they may need to know about).
-class XRRuntimeManager {
+class CONTENT_EXPORT XRRuntimeManager {
  public:
   class Observer : public base::CheckedObserver {
    public:
     virtual void OnRuntimeAdded(content::BrowserXRRuntime* runtime) {}
   };
 
+  // Provides access to the XRRuntimeManager singleton, if it exists.
+  // This method does not extend the lifetime of the singleton, so you should be
+  // careful with the lifetime of this reference.
+  static content::XRRuntimeManager* GetInstanceIfCreated();
+
+  // Exits any currently presenting immersive session.
+  static void ExitImmersivePresentation();
+
+  // Observer registration methods are static so that observers may subscribe
+  // and unsubscribe independent of the lifecycle of the XRRuntimeManager
+  // Singleton.
+  static void AddObserver(content::XRRuntimeManager::Observer* observer);
+  static void RemoveObserver(content::XRRuntimeManager::Observer* observer);
+
   XRRuntimeManager() = default;
   virtual ~XRRuntimeManager() = default;
 
diff --git a/chromium/content/public/common/BUILD.gn b/chromium/content/public/common/BUILD.gn
index 962a4209382..47b93531c4b 100644
--- a/chromium/content/public/common/BUILD.gn
+++ b/chromium/content/public/common/BUILD.gn
@@ -122,9 +122,10 @@ jumbo_source_set("common_sources") {
     "font_cache_dispatcher_win.h",
     "frame_navigate_params.cc",
     "frame_navigate_params.h",
+    "impression.cc",
+    "impression.h",
     "injection_test_mac.h",
     "injection_test_win.h",
-    "input_event_ack_source.h",
     "input_event_ack_state.h",
     "isolated_world_ids.h",
     "javascript_dialog_type.h",
@@ -212,7 +213,7 @@ jumbo_source_set("common_sources") {
     "//third_party/blink/public:blink_headers",
     "//third_party/blink/public/mojom:mojom_platform_headers",
     "//ui/accessibility",
-    "//ui/base/mojom:cursor_type",
+    "//ui/base/cursor/mojom:cursor_type",
     "//ui/gfx/geometry",
     "//ui/surface",
     "//url/ipc:url_ipc",
@@ -280,6 +281,10 @@ jumbo_source_set("common_sources") {
       "pepper_plugin_info.h",
     ]
   }
+
+  if (use_clang_profiling_inside_sandbox) {
+    sources += [ "profiling_utils.h" ]
+  }
 }
 
 mojom("interfaces") {
@@ -311,21 +316,25 @@ mojom("interfaces") {
     sources += [ "font_cache_win.mojom" ]
   }
 
-  public_deps = [
-    ":client_hints_mojom",
+  public_deps = [ ":client_hints_mojom" ]
+
+  deps = [
     "//mojo/public/mojom/base:base",
     "//services/network/public/mojom",
-    "//services/network/public/mojom:mojom_ip_address",
-    "//services/network/public/mojom:websocket_mojom",
-    "//ui/accessibility:ax_enums_mojo",
     "//url/mojom:url_mojom_gurl",
-    "//url/mojom:url_mojom_origin",
+
+    # This dependency is really a dependency for the typemaps, but we need
+    # it here so that we can override it correctly for the component build.
+    "//third_party/blink/public/mojom:mojom_platform",
   ]
 
   component_output_prefix = "content_public_common_mojo_bindings"
   export_class_attribute = "CONTENT_EXPORT"
   export_define = "CONTENT_IMPLEMENTATION=1"
   export_header = "content/common/content_export.h"
+
+  overridden_deps = [ "//third_party/blink/public/mojom:mojom_platform" ]
+  component_deps = [ "//third_party/blink/public/common" ]
 }
 
 mojom("renderer_type") {
@@ -335,7 +344,11 @@ mojom("renderer_type") {
 mojom("web_preferences_mojom") {
   sources = [ "web_preferences.mojom" ]
 
-  public_deps = [ "//third_party/blink/public/mojom:mojom_platform" ]
+  public_deps = [
+    # This dependency is really a dependency for the typemaps, but we need
+    # it here so that we can override it correctly for the component build.
+    "//third_party/blink/public/mojom:mojom_platform",
+  ]
 
   overridden_deps = [ "//third_party/blink/public/mojom:mojom_platform" ]
   component_deps = [ "//third_party/blink/public/common" ]
@@ -346,7 +359,7 @@ mojom("client_hints_mojom") {
 
   public_deps = [
     "//mojo/public/mojom/base",
-    "//third_party/blink/public/mojom:web_client_hints_types_mojo_bindings",
+    "//services/network/public/mojom",
     "//url/mojom:url_mojom_origin",
   ]
 }
diff --git a/chromium/content/public/common/browser_controls_state.typemap b/chromium/content/public/common/browser_controls_state.typemap
index 7f185e74c4e..137b60a8c62 100644
--- a/chromium/content/public/common/browser_controls_state.typemap
+++ b/chromium/content/public/common/browser_controls_state.typemap
@@ -5,5 +5,23 @@
 mojom = "//content/public/common/browser_controls_state.mojom"
 public_headers = [ "//content/public/common/browser_controls_state.h" ]
 traits_headers = [ "//content/public/common/common_param_traits_macros.h" ]
+public_deps = [
+  # Since the typemappings for browser_controls_state, drop_data and
+  # web_features are all implemented in the monolithic common_param_traits, we
+  # need to duplicate these dependencies into all three typemaps.
+  # Note that we also have a dependency on
+  # //third_party/blink/public/mojom:mojom_platform, but we can't include that
+  # dependency here because we need to override it to support component build.
+
+  "//base",
+  "//ipc",
+  "//services/network/public/cpp:cpp_base",
+  "//services/network/public/mojom",
+  "//third_party/blink/public:blink_headers",
+  "//ui/accessibility:ax_enums_mojo",
+  "//ui/base",
+  "//ui/gfx/ipc",
+  "//ui/surface",
+]
 type_mappings =
     [ "content.mojom.BrowserControlsState=::content::BrowserControlsState" ]
diff --git a/chromium/content/public/common/cdm_info.h b/chromium/content/public/common/cdm_info.h
index f8bcf527e14..c08d0c9a993 100644
--- a/chromium/content/public/common/cdm_info.h
+++ b/chromium/content/public/common/cdm_info.h
@@ -16,7 +16,6 @@
 #include "media/base/content_decryption_module.h"
 #include "media/base/encryption_scheme.h"
 #include "media/base/video_codecs.h"
-#include "media/cdm/cdm_proxy.h"
 
 namespace content {
 
@@ -25,8 +24,7 @@ struct CONTENT_EXPORT CdmCapability {
   CdmCapability();
   CdmCapability(std::vector<media::VideoCodec> video_codecs,
                 base::flat_set<media::EncryptionScheme> encryption_schemes,
-                base::flat_set<media::CdmSessionType> session_types,
-                base::flat_set<media::CdmProxy::Protocol> cdm_proxy_protocols);
+                base::flat_set<media::CdmSessionType> session_types);
   CdmCapability(const CdmCapability& other);
   ~CdmCapability();
 
@@ -48,10 +46,6 @@ struct CONTENT_EXPORT CdmCapability {
 
   // List of session types supported by the CDM.
   base::flat_set<media::CdmSessionType> session_types;
-
-  // List of CdmProxy protocols supported by the CDM. These protocols should
-  // also be supported by the system to support hardware secure decryption.
-  base::flat_set<media::CdmProxy::Protocol> cdm_proxy_protocols;
 };
 
 // Represents a Content Decryption Module implementation and its capabilities.
diff --git a/chromium/content/public/common/client_hints.mojom b/chromium/content/public/common/client_hints.mojom
index 67650690ca8..0c2dac3544b 100644
--- a/chromium/content/public/common/client_hints.mojom
+++ b/chromium/content/public/common/client_hints.mojom
@@ -5,8 +5,7 @@
 module client_hints.mojom;
 
 import "mojo/public/mojom/base/time.mojom";
-import
-"third_party/blink/public/mojom/web_client_hints/web_client_hints_types.mojom";
+import "services/network/public/mojom/web_client_hints_types.mojom";
 import "url/mojom/origin.mojom";
 
 // Sent from renderer to browser process when the lifetime of the client hints
@@ -18,6 +17,6 @@ interface ClientHints {
   // Inputs are the origin setting the opt-in, an array of the hints that were
   // set, and the duration for which the opt-in would be valid.
   PersistClientHints(url.mojom.Origin primary_origin,
-                     array<blink.mojom.WebClientHintsType> client_hints,
+                     array<network.mojom.WebClientHintsType> client_hints,
                      mojo_base.mojom.TimeDelta expiration_duration);
 };
diff --git a/chromium/content/public/common/common_param_traits_macros.h b/chromium/content/public/common/common_param_traits_macros.h
index 0e67ad3c743..c7a871602f5 100644
--- a/chromium/content/public/common/common_param_traits_macros.h
+++ b/chromium/content/public/common/common_param_traits_macros.h
@@ -139,6 +139,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(webgl_errors_to_console_enabled)
   IPC_STRUCT_TRAITS_MEMBER(hide_scrollbars)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_2d_canvas_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(new_canvas_2d_api_enabled)
   IPC_STRUCT_TRAITS_MEMBER(antialiased_2d_canvas_disabled)
   IPC_STRUCT_TRAITS_MEMBER(antialiased_clips_2d_canvas_enabled)
   IPC_STRUCT_TRAITS_MEMBER(accelerated_2d_canvas_msaa_sample_count)
@@ -248,6 +249,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_loading_distance_thresholds_px)
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_first_k_fully_load)
   IPC_STRUCT_TRAITS_MEMBER(allow_mixed_content_upgrades)
+  IPC_STRUCT_TRAITS_MEMBER(always_show_focus)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::mojom::WindowFeatures)
@@ -270,10 +272,14 @@ IPC_ENUM_TRAITS_MAX_VALUE(gfx::FontRenderParams::Hinting,
 IPC_ENUM_TRAITS_MAX_VALUE(gfx::FontRenderParams::SubpixelRendering,
                           gfx::FontRenderParams::SUBPIXEL_RENDERING_MAX)
 
-IPC_STRUCT_TRAITS_BEGIN(blink::UserAgentMetadata)
+IPC_STRUCT_TRAITS_BEGIN(blink::UserAgentBrandVersion)
   IPC_STRUCT_TRAITS_MEMBER(brand)
-  IPC_STRUCT_TRAITS_MEMBER(full_version)
   IPC_STRUCT_TRAITS_MEMBER(major_version)
+IPC_STRUCT_TRAITS_END()
+
+IPC_STRUCT_TRAITS_BEGIN(blink::UserAgentMetadata)
+  IPC_STRUCT_TRAITS_MEMBER(brand_version_list)
+  IPC_STRUCT_TRAITS_MEMBER(full_version)
   IPC_STRUCT_TRAITS_MEMBER(platform)
   IPC_STRUCT_TRAITS_MEMBER(platform_version)
   IPC_STRUCT_TRAITS_MEMBER(architecture)
diff --git a/chromium/content/public/common/content_client.cc b/chromium/content/public/common/content_client.cc
index 494f4ff3bdd..0e78a77d43b 100644
--- a/chromium/content/public/common/content_client.cc
+++ b/chromium/content/public/common/content_client.cc
@@ -4,8 +4,8 @@
 
 #include "content/public/common/content_client.h"
 
-#include "base/logging.h"
 #include "base/no_destructor.h"
+#include "base/notreached.h"
 #include "base/strings/string_piece.h"
 #include "base/values.h"
 #include "build/build_config.h"
diff --git a/chromium/content/public/common/content_features.cc b/chromium/content/public/common/content_features.cc
index a039fcfd9f2..cbe291d39b8 100644
--- a/chromium/content/public/common/content_features.cc
+++ b/chromium/content/public/common/content_features.cc
@@ -130,6 +130,10 @@ const base::Feature kCanvas2DImageChromium {
 const base::Feature kCanvasOopRasterization{"CanvasOopRasterization",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
+// When enabled, code cache does not use a browsing_data filter for deletions.
+extern const base::Feature kCodeCacheDeletionWithoutFilter{
+    "CodeCacheDeletionWithoutFilter", base::FEATURE_DISABLED_BY_DEFAULT};
+
 // When enabled, event.movement is calculated in blink instead of in browser.
 const base::Feature kConsolidatedMovementXY{"ConsolidatedMovementXY",
                                             base::FEATURE_ENABLED_BY_DEFAULT};
@@ -138,10 +142,10 @@ const base::Feature kConsolidatedMovementXY{"ConsolidatedMovementXY",
 const base::Feature kConversionMeasurement{"ConversionMeasurement",
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Show messages in the DevTools console about upcoming deprecations
-// that would affect sent/received cookies.
+// Show messages in DevTools about upcoming deprecations that would affect
+// sent/received cookies.
 const base::Feature kCookieDeprecationMessages{
-    "CookieDeprecationMessages", base::FEATURE_ENABLED_BY_DEFAULT};
+    "CookieDeprecationMessages", base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables Blink cooperative scheduling.
 const base::Feature kCooperativeScheduling{"CooperativeScheduling",
@@ -168,10 +172,10 @@ const base::Feature kDocumentPolicy{"DocumentPolicy",
 // If this feature is enabled and device permission is not granted by the user,
 // media-device enumeration will provide at most one device per type and the
 // device IDs will not be available.
-// TODO(crbug.com/1019176): remove the feature in M82.
+// TODO(crbug.com/1019176): remove the feature in M89.
 const base::Feature kEnumerateDevicesHideDeviceIDs{
   "EnumerateDevicesHideDeviceIDs",
-#if defined(OS_ANDROID)
+#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
       base::FEATURE_DISABLED_BY_DEFAULT
 #else
       base::FEATURE_ENABLED_BY_DEFAULT
@@ -195,13 +199,20 @@ const base::Feature kExtraSafelistedRequestHeadersForOutOfBlinkCors{
 
 // Controls whether Client Hints are guarded by FeaturePolicy.
 const base::Feature kFeaturePolicyForClientHints{
-    "FeaturePolicyForClientHints", base::FEATURE_DISABLED_BY_DEFAULT};
+    "FeaturePolicyForClientHints", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // When enabled Feature Policy propagation is similar to sandbox flags and,
 // sandbox flags are implemented on top of Feature Policy.
 const base::Feature kFeaturePolicyForSandbox{"FeaturePolicyForSandbox",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Controls whether or not First Scroll Latency will be measured and reported.
+// First Scroll Latency (tracking bug: crbug.com/922980) measures, for the
+// first scroll of a navigation, the latency between the user's input and the
+// display's update.
+const base::Feature kFirstScrollLatencyMeasurement{
+    "FirstScrollLatencyMeasurement", base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Enables fixes for matching src: local() for web fonts correctly against full
 // font name or postscript name. Rolling out behind a flag, as enabling this
 // enables a font indexer on Android which we need to test in the field first.
@@ -270,6 +281,11 @@ const base::Feature kInstalledApp{"InstalledApp",
 const base::Feature kInstalledAppProvider{"InstalledAppProvider",
                                           base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Show warning about clearing data from installed apps in the clear browsing
+// data flow. The warning will be shown in a second dialog.
+const base::Feature kInstalledAppsInCbd{"InstalledAppsInCbd",
+                                        base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Alternative to switches::kIsolateOrigins, for turning on origin isolation.
 // List of origins to isolate has to be specified via
 // kIsolateOriginsFieldTrialParamName.
@@ -327,6 +343,11 @@ const base::Feature kMediaDevicesSystemMonitorCache {
 #endif
 };
 
+// If enabled Mojo uses a dedicated background thread to listen for incoming
+// IPCs. Otherwise it's configured to use Content's IO thread for that purpose.
+const base::Feature kMojoDedicatedThread{"MojoDedicatedThread",
+                                         base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Enables/disables the video capture service.
 const base::Feature kMojoVideoCapture{"MojoVideoCapture",
                                       base::FEATURE_ENABLED_BY_DEFAULT};
@@ -383,19 +404,9 @@ const base::Feature kOverscrollHistoryNavigation {
 #endif
 };
 
-// Whether document level event listeners should default 'passive' to true.
-const base::Feature kPassiveDocumentEventListeners{
-    "PassiveDocumentEventListeners", base::FEATURE_ENABLED_BY_DEFAULT};
-
-// Whether document level wheel and mousewheel event listeners should default
-// 'passive' to true.
-const base::Feature kPassiveDocumentWheelEventListeners{
-    "PassiveDocumentWheelEventListeners", base::FEATURE_ENABLED_BY_DEFAULT};
-
-// Whether we should force a touchstart and first touchmove per scroll event
-// listeners to be non-blocking during fling.
-const base::Feature kPassiveEventListenersDueToFling{
-    "PassiveEventListenersDueToFling", base::FEATURE_ENABLED_BY_DEFAULT};
+// Whether ParkableStrings in blink can be written out to disk.
+const base::Feature kParkableStringsToDisk{"ParkableStringsToDisk",
+                                           base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Whether web apps can run periodic tasks upon network connectivity.
 const base::Feature kPeriodicBackgroundSync{"PeriodicBackgroundSync",
@@ -509,10 +520,6 @@ const base::Feature kRunVideoCaptureServiceInBrowserProcess{
 const base::Feature kSavePageAsWebBundle{"SavePageAsWebBundle",
                                          base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Start streaming scripts on script preload.
-const base::Feature kScriptStreamingOnPreload{"ScriptStreamingOnPreload",
-                                              base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Make sendBeacon throw for a Blob with a non simple type.
 const base::Feature kSendBeaconThrowForBlobWithNonSimpleType{
     "SendBeaconThrowForBlobWithNonSimpleType",
@@ -584,6 +591,18 @@ const base::Feature kSignedHTTPExchangePingValidity{
 const base::Feature kSmsReceiver{"SmsReceiver",
                                  base::FEATURE_ENABLED_BY_DEFAULT};
 
+// Controls whether Site Isolation protects against spoofing of origin in
+// mojom::FileSystemManager::Open IPC from compromised renderer processes.  See
+// also https://crbug.com/917457.
+//
+// TODO(lukasza, nasko): Make that feature below enabled by default, after
+// coordinating with the remaining consumers of PPAPI.  This should be possible
+// at the end of 2020, when most PPAPI consumers (Flash, most Chrome Apps) will
+// be gone.
+const base::Feature kSiteIsolationEnforcementForFileSystemApi{
+    "SiteIsolationEnforcementForFileSystemApi",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Controls whether SpareRenderProcessHostManager tries to always have a warm
 // spare renderer process around for the most recently requested BrowserContext.
 // This feature is only consulted in site-per-process mode.
@@ -799,6 +818,10 @@ const base::Feature kWebRtcEcdsaDefault{"WebRTC-EnableWebRtcEcdsa",
 const base::Feature kWebRtcUseGpuMemoryBufferVideoFrames{
     "WebRTC-UseGpuMemoryBufferVideoFrames", base::FEATURE_ENABLED_BY_DEFAULT};
 
+// Enables report-only Trusted Types experiment on WebUIs
+const base::Feature kWebUIReportOnlyTrustedTypes{
+    "WebUIReportOnlyTrustedTypes", base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Controls whether the WebUSB API is enabled:
 // https://wicg.github.io/webusb
 const base::Feature kWebUsb{"WebUSB", base::FEATURE_ENABLED_BY_DEFAULT};
@@ -818,7 +841,7 @@ const base::Feature kWebXrHitTest{"WebXRHitTest",
 const base::Feature kWebXrIncubations{"WebXRIncubations",
                                       base::FEATURE_DISABLED_BY_DEFAULT};
 const base::Feature kWebXrPermissionsApi{"WebXrPermissionsApi",
-                                         base::FEATURE_DISABLED_BY_DEFAULT};
+                                         base::FEATURE_ENABLED_BY_DEFAULT};
 
 #if defined(OS_ANDROID)
 // Autofill Accessibility in Android.
@@ -853,7 +876,7 @@ const base::Feature kWebNfc{"WebNFC", base::FEATURE_ENABLED_BY_DEFAULT};
 // TODO(crbug.com/955194): Remove this once chrome://oobe migrates off of
 // Polymer 1.
 const base::Feature kWebUIPolymer2Exceptions{"WebUIPolymer2Exceptions",
-                                             base::FEATURE_ENABLED_BY_DEFAULT};
+                                             base::FEATURE_DISABLED_BY_DEFAULT};
 #endif  // defined(OS_CHROMEOS)
 
 #if defined(OS_MACOSX)
diff --git a/chromium/content/public/common/content_features.h b/chromium/content/public/common/content_features.h
index 0762f69d6c9..93139ce799c 100644
--- a/chromium/content/public/common/content_features.h
+++ b/chromium/content/public/common/content_features.h
@@ -38,6 +38,7 @@ CONTENT_EXPORT extern const base::Feature kCacheStorageEagerReading;
 CONTENT_EXPORT extern const base::Feature kCacheStorageHighPriorityMatch;
 CONTENT_EXPORT extern const base::Feature kCanvas2DImageChromium;
 CONTENT_EXPORT extern const base::Feature kCanvasOopRasterization;
+CONTENT_EXPORT extern const base::Feature kCodeCacheDeletionWithoutFilter;
 CONTENT_EXPORT extern const base::Feature kConsolidatedMovementXY;
 CONTENT_EXPORT extern const base::Feature kConversionMeasurement;
 CONTENT_EXPORT extern const base::Feature kCookieDeprecationMessages;
@@ -54,6 +55,7 @@ CONTENT_EXPORT extern const base::Feature
     kExtraSafelistedRequestHeadersForOutOfBlinkCors;
 CONTENT_EXPORT extern const base::Feature kFeaturePolicyForClientHints;
 CONTENT_EXPORT extern const base::Feature kFeaturePolicyForSandbox;
+CONTENT_EXPORT extern const base::Feature kFirstScrollLatencyMeasurement;
 CONTENT_EXPORT extern const base::Feature kFontSrcLocalMatching;
 #if !defined(OS_ANDROID)
 CONTENT_EXPORT extern const base::Feature
@@ -67,6 +69,7 @@ CONTENT_EXPORT extern const base::Feature kIdleDetection;
 CONTENT_EXPORT extern const base::Feature kInputPredictorTypeChoice;
 CONTENT_EXPORT extern const base::Feature kInstalledApp;
 CONTENT_EXPORT extern const base::Feature kInstalledAppProvider;
+CONTENT_EXPORT extern const base::Feature kInstalledAppsInCbd;
 CONTENT_EXPORT extern const base::Feature kIsolateOrigins;
 CONTENT_EXPORT extern const char kIsolateOriginsFieldTrialParamName[];
 CONTENT_EXPORT extern const base::Feature kLazyFrameLoading;
@@ -78,6 +81,7 @@ CONTENT_EXPORT extern const base::Feature kLegacyWindowsDWriteFontFallback;
 CONTENT_EXPORT extern const base::Feature kLogJsConsoleMessages;
 CONTENT_EXPORT extern const base::Feature kLowPriorityIframes;
 CONTENT_EXPORT extern const base::Feature kMediaDevicesSystemMonitorCache;
+CONTENT_EXPORT extern const base::Feature kMojoDedicatedThread;
 CONTENT_EXPORT extern const base::Feature kMojoVideoCapture;
 CONTENT_EXPORT extern const base::Feature kMojoVideoCaptureSecondary;
 CONTENT_EXPORT extern const base::Feature kMouseSubframeNoImplicitCapture;
@@ -89,9 +93,7 @@ CONTENT_EXPORT extern const base::Feature kNotificationTriggers;
 CONTENT_EXPORT extern const base::Feature kOriginIsolationHeader;
 CONTENT_EXPORT extern const base::Feature kOriginPolicy;
 CONTENT_EXPORT extern const base::Feature kOverscrollHistoryNavigation;
-CONTENT_EXPORT extern const base::Feature kPassiveDocumentEventListeners;
-CONTENT_EXPORT extern const base::Feature kPassiveDocumentWheelEventListeners;
-CONTENT_EXPORT extern const base::Feature kPassiveEventListenersDueToFling;
+CONTENT_EXPORT extern const base::Feature kParkableStringsToDisk;
 CONTENT_EXPORT extern const base::Feature kPeriodicBackgroundSync;
 CONTENT_EXPORT extern const base::Feature kPepper3DImageChromium;
 CONTENT_EXPORT extern const base::Feature kPepperCrossOriginRedirectRestriction;
@@ -112,7 +114,6 @@ CONTENT_EXPORT extern const base::Feature kResamplingInputEvents;
 CONTENT_EXPORT extern const base::Feature
     kRunVideoCaptureServiceInBrowserProcess;
 CONTENT_EXPORT extern const base::Feature kSavePageAsWebBundle;
-CONTENT_EXPORT extern const base::Feature kScriptStreamingOnPreload;
 CONTENT_EXPORT extern const base::Feature
     kSendBeaconThrowForBlobWithNonSimpleType;
 CONTENT_EXPORT extern const base::Feature kServiceWorkerOnUI;
@@ -128,6 +129,8 @@ CONTENT_EXPORT extern const base::Feature
 CONTENT_EXPORT extern const base::Feature kSignedExchangeSubresourcePrefetch;
 CONTENT_EXPORT extern const base::Feature kSignedHTTPExchange;
 CONTENT_EXPORT extern const base::Feature kSignedHTTPExchangePingValidity;
+CONTENT_EXPORT extern const base::Feature
+    kSiteIsolationEnforcementForFileSystemApi;
 CONTENT_EXPORT extern const base::Feature kSmsReceiver;
 CONTENT_EXPORT extern const base::Feature kSpareRendererForSitePerProcess;
 CONTENT_EXPORT extern const base::Feature kStoragePressureUI;
@@ -165,6 +168,7 @@ CONTENT_EXPORT extern const base::Feature kWebPayments;
 CONTENT_EXPORT extern const base::Feature kWebPaymentsMinimalUI;
 CONTENT_EXPORT extern const base::Feature kWebRtcEcdsaDefault;
 CONTENT_EXPORT extern const base::Feature kWebRtcUseGpuMemoryBufferVideoFrames;
+CONTENT_EXPORT extern const base::Feature kWebUIReportOnlyTrustedTypes;
 CONTENT_EXPORT extern const base::Feature kWebUsb;
 CONTENT_EXPORT extern const base::Feature kWebXr;
 CONTENT_EXPORT extern const base::Feature kWebXrArModule;
diff --git a/chromium/content/public/common/content_switch_dependent_feature_overrides.cc b/chromium/content/public/common/content_switch_dependent_feature_overrides.cc
index c8877972303..c3f1d1658f3 100644
--- a/chromium/content/public/common/content_switch_dependent_feature_overrides.cc
+++ b/chromium/content/public/common/content_switch_dependent_feature_overrides.cc
@@ -6,7 +6,9 @@
 
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "net/base/features.h"
 #include "services/network/public/cpp/features.h"
+#include "third_party/blink/public/common/features.h"
 #include "ui/base/ui_base_features.h"
 
 namespace content {
@@ -23,6 +25,10 @@ GetSwitchDependentFeatureOverrides(const base::CommandLine& command_line) {
     // State to override the feature with.
     base::FeatureList::OverrideState override_state;
   } override_info[] = {
+      {switches::kAppCacheForceEnabled,
+       std::cref(blink::features::kAppCacheRequireOriginTrial),
+       base::FeatureList::OVERRIDE_DISABLE_FEATURE},
+      // Overrides for --enable-experimental-web-platform-features.
       {switches::kEnableExperimentalWebPlatformFeatures,
        std::cref(features::kCookieDeprecationMessages),
        base::FeatureList::OVERRIDE_ENABLE_FEATURE},
@@ -30,6 +36,9 @@ GetSwitchDependentFeatureOverrides(const base::CommandLine& command_line) {
        std::cref(network::features::kCrossOriginOpenerPolicy),
        base::FeatureList::OVERRIDE_ENABLE_FEATURE},
       {switches::kEnableExperimentalWebPlatformFeatures,
+       std::cref(network::features::kCrossOriginOpenerPolicyReporting),
+       base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+      {switches::kEnableExperimentalWebPlatformFeatures,
        std::cref(network::features::kCrossOriginEmbedderPolicy),
        base::FeatureList::OVERRIDE_ENABLE_FEATURE},
       {switches::kEnableExperimentalWebPlatformFeatures,
@@ -47,20 +56,27 @@ GetSwitchDependentFeatureOverrides(const base::CommandLine& command_line) {
       {switches::kEnableExperimentalWebPlatformFeatures,
        std::cref(features::kOriginIsolationHeader),
        base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+
+      // Overrides for --use-legacy-form-controls.
       {switches::kUseLegacyFormControls,
        std::cref(features::kFormControlsRefresh),
        base::FeatureList::OVERRIDE_DISABLE_FEATURE},
-  };
 
-  // TODO(chlily): There are currently a few places where, to check if some
-  // functionality should be enabled, we check base::FeatureList::IsEnabled on
-  // some base::Feature and then also check whether the CommandLine for the
-  // current process has the switch kEnableExperimentalWebPlatformFeatures. It
-  // would be nice to have those features get set up here as switch-dependent
-  // feature overrides. That way, we could eliminate directly checking the
-  // command line for --enable-experimental-web-platform-features, and would
-  // have the base::Feature corresponding to that functionality correctly
-  // reflect whether it should be enabled.
+      // Overrides for --enable-experimental-cookie-features.
+      {switches::kEnableExperimentalCookieFeatures,
+       std::cref(features::kCookieDeprecationMessages),
+       base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+      {switches::kEnableExperimentalCookieFeatures,
+       std::cref(net::features::kCookiesWithoutSameSiteMustBeSecure),
+       base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+      {switches::kEnableExperimentalCookieFeatures,
+       std::cref(net::features::kSameSiteByDefaultCookies),
+       base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+      {switches::kEnableExperimentalCookieFeatures,
+       std::cref(net::features::kSameSiteDefaultChecksMethodRigorously),
+       base::FeatureList::OVERRIDE_ENABLE_FEATURE},
+      // TODO(crbug.com/1030938): Add Schemeful Same-Site.
+  };
 
   std::vector<base::FeatureList::FeatureOverrideInfo> overrides;
   for (const auto& info : override_info) {
diff --git a/chromium/content/public/common/content_switches.cc b/chromium/content/public/common/content_switches.cc
index 36dd3d57221..8e9eb3625f0 100644
--- a/chromium/content/public/common/content_switches.cc
+++ b/chromium/content/public/common/content_switches.cc
@@ -43,6 +43,10 @@ const char kAllowSyncXHRInPageDismissal[] = "allow-sync-xhr-in-page-dimissal";
 // This is used in blimp to emulate android fonts on linux.
 const char kAndroidFontsPath[]          = "android-fonts-path";
 
+// Allows app cache to be forced on, even when gated by an origin trial.
+// TODO(enne): remove this once app cache has been removed.
+const char kAppCacheForceEnabled[] = "app-cache-force-enabled";
+
 // Set blink settings. Format is <name>[=<value],<name>[=<value>],...
 // The names are declared in Settings.json5. For boolean type, use "true",
 // "false", or omit '=<value>' part to set to true. For enum type, use the int
@@ -63,6 +67,9 @@ const char kBrowserSubprocessPath[]         = "browser-subprocess-path";
 // flaky [like monitoring of memory pressure]).
 const char kBrowserTest[] = "browser-test";
 
+// Causes the Conversion Measurement API to run without delays or noise.
+const char kConversionsDebugMode[] = "conversions-debug-mode";
+
 // Sets the tile size used by composited layers.
 const char kDefaultTileWidth[]              = "default-tile-width";
 const char kDefaultTileHeight[]             = "default-tile-height";
@@ -85,6 +92,9 @@ const char kDisable3DAPIs[]                 = "disable-3d-apis";
 // Disable gpu-accelerated 2d canvas.
 const char kDisableAccelerated2dCanvas[]    = "disable-accelerated-2d-canvas";
 
+// Enable in-progress canvas 2d API features.
+const char kEnableNewCanvas2DAPI[] = "new-canvas-2d-api";
+
 // Disables hardware acceleration of video decode, where available.
 const char kDisableAcceleratedVideoDecode[] =
     "disable-accelerated-video-decode";
@@ -346,6 +356,24 @@ const char kEnableBlinkFeatures[]           = "enable-blink-features";
 // just a keyboard. See https://crbug.com/977390 for links to i2i.
 const char kEnableCaretBrowsing[] = "enable-caret-browsing";
 
+// Flag that turns on a group of experimental/newly added cookie-related
+// features together, as a convenience for e.g. testing, to avoid having to set
+// multiple switches individually which may be error-prone (not to mention
+// tedious). There is not a corresponding switch to disable all these features,
+// because that is discouraged, and for testing purposes you'd need to switch
+// them off individually to identify the problematic feature anyway.
+//
+// At present this turns on:
+//   net::features::kCookiesWithoutSameSiteMustBeSecure
+//   net::features::kSameSiteByDefaultCookies
+//   net::features::kSameSiteDefaultChecksMethodRigorously
+// It will soon also turn on:
+//   content_settings::kImprovedCookieControls
+//   content_settings::kImprovedCookieControlsForThirdPartyCookieBlocking
+//   net::features::kSchemefulSameSite
+const char kEnableExperimentalCookieFeatures[] =
+    "enable-experimental-cookie-features";
+
 // Enables experimental WebAssembly features.
 const char kEnableExperimentalWebAssemblyFeatures[] =
     "enable-experimental-webassembly-features";
@@ -480,9 +508,6 @@ const char kDisableOopRasterization[] = "disable-oop-rasterization";
 // would have been used.  Enables the chromium_raster_transport extension.
 const char kEnableOopRasterization[] = "enable-oop-rasterization";
 
-// Turns on skia deferred display list for out of process raster.
-const char kEnableOopRasterizationDDL[] = "enable-oop-rasterization-ddl";
-
 // Pins the default referrer policy to the pre-M80 value of
 // no-referrer-when-downgrade.
 // TODO(crbug.com/1016541): After M82, remove when the corresponding
@@ -841,6 +866,10 @@ const char kUtilityProcess[]                = "utility";
 // Causes the utility process to display a dialog on launch.
 const char kUtilityStartupDialog[] = "utility-startup-dialog";
 
+// This switch indicates the type of a utility process. It is not used by Chrome
+// but is added to the command line for debugging and profiling purposes.
+const char kUtilitySubType[] = "utility-sub-type";
+
 // In debug builds, asserts that the stream of input events is valid.
 const char kValidateInputEventStream[] = "validate-input-event-stream";
 
diff --git a/chromium/content/public/common/content_switches.h b/chromium/content/public/common/content_switches.h
index 79c167eb090..81c110d18ad 100644
--- a/chromium/content/public/common/content_switches.h
+++ b/chromium/content/public/common/content_switches.h
@@ -23,11 +23,13 @@ CONTENT_EXPORT extern const char kAllowLoopbackInPeerConnection[];
 CONTENT_EXPORT extern const char kAllowPopupsDuringPageUnload[];
 CONTENT_EXPORT extern const char kAllowSyncXHRInPageDismissal[];
 CONTENT_EXPORT extern const char kAndroidFontsPath[];
+CONTENT_EXPORT extern const char kAppCacheForceEnabled[];
 CONTENT_EXPORT extern const char kBlinkSettings[];
 CONTENT_EXPORT extern const char kBrowserCrashTest[];
 CONTENT_EXPORT extern const char kBrowserStartupDialog[];
 CONTENT_EXPORT extern const char kBrowserSubprocessPath[];
 CONTENT_EXPORT extern const char kBrowserTest[];
+CONTENT_EXPORT extern const char kConversionsDebugMode[];
 CONTENT_EXPORT extern const char kDefaultTileWidth[];
 CONTENT_EXPORT extern const char kDefaultTileHeight[];
 CONTENT_EXPORT extern const char kMinHeightForGpuRasterTile[];
@@ -113,6 +115,7 @@ CONTENT_EXPORT extern const char kEnablePreferCompositingToLCDText[];
 CONTENT_EXPORT extern const char kEnableBlinkFeatures[];
 CONTENT_EXPORT extern const char kEnableCaretBrowsing[];
 CONTENT_EXPORT extern const char kEnableDisplayList2dCanvas[];
+CONTENT_EXPORT extern const char kEnableExperimentalCookieFeatures[];
 CONTENT_EXPORT extern const char kEnableExperimentalWebAssemblyFeatures[];
 CONTENT_EXPORT extern const char kEnableExperimentalWebPlatformFeatures[];
 CONTENT_EXPORT extern const char kEnableFtp[];
@@ -123,6 +126,7 @@ CONTENT_EXPORT extern const char kEnableLowResTiling[];
 CONTENT_EXPORT extern const char kEnableLCDText[];
 CONTENT_EXPORT extern const char kEnableLogging[];
 CONTENT_EXPORT extern const char kEnableNetworkInformationDownlinkMax[];
+CONTENT_EXPORT extern const char kEnableNewCanvas2DAPI[];
 CONTENT_EXPORT extern const char kDisableNv12DxgiVideo[];
 CONTENT_EXPORT extern const char kEnablePluginPlaceholderTesting[];
 CONTENT_EXPORT extern const char kEnablePreciseMemoryInfo[];
@@ -150,7 +154,6 @@ CONTENT_EXPORT extern const char kFileUrlPathAlias[];
 CONTENT_EXPORT extern const char kForceDisplayList2dCanvas[];
 CONTENT_EXPORT extern const char kDisableOopRasterization[];
 CONTENT_EXPORT extern const char kEnableOopRasterization[];
-CONTENT_EXPORT extern const char kEnableOopRasterizationDDL[];
 CONTENT_EXPORT extern const char kForceLegacyDefaultReferrerPolicy[];
 CONTENT_EXPORT extern const char kForceOverlayFullscreenVideo[];
 CONTENT_EXPORT extern const char kForcePresentationReceiverForTesting[];
@@ -232,6 +235,7 @@ CONTENT_EXPORT extern const char kUseMockCertVerifierForTesting[];
 extern const char kUtilityCmdPrefix[];
 CONTENT_EXPORT extern const char kUtilityProcess[];
 CONTENT_EXPORT extern const char kUtilityStartupDialog[];
+CONTENT_EXPORT extern const char kUtilitySubType[];
 CONTENT_EXPORT extern const char kV8CacheOptions[];
 CONTENT_EXPORT extern const char kValidateInputEventStream[];
 CONTENT_EXPORT extern const char kWaitForDebuggerChildren[];
diff --git a/chromium/content/public/common/drop_data.typemap b/chromium/content/public/common/drop_data.typemap
index eaba6f96419..4ed8b7f7206 100644
--- a/chromium/content/public/common/drop_data.typemap
+++ b/chromium/content/public/common/drop_data.typemap
@@ -5,4 +5,22 @@
 mojom = "//content/public/common/drop_data.mojom"
 public_headers = [ "//content/public/common/drop_data.h" ]
 traits_headers = [ "//content/public/common/common_param_traits_macros.h" ]
+public_deps = [
+  # Since the typemappings for browser_controls_state, drop_data and
+  # web_features are all implemented in the monolithic common_param_traits, we
+  # need to duplicate these dependencies into all three typemaps.
+  # Note that we also have a dependency on
+  # //third_party/blink/public/mojom:mojom_platform, but we can't include that
+  # dependency here because we need to override it to support component build.
+
+  "//base",
+  "//ipc",
+  "//services/network/public/cpp:cpp_base",
+  "//services/network/public/mojom",
+  "//third_party/blink/public:blink_headers",
+  "//ui/accessibility:ax_enums_mojo",
+  "//ui/base",
+  "//ui/gfx/ipc",
+  "//ui/surface",
+]
 type_mappings = [ "content.mojom.DropData=::content::DropData" ]
diff --git a/chromium/content/public/common/impression.cc b/chromium/content/public/common/impression.cc
new file mode 100644
index 00000000000..3cc254494b4
--- /dev/null
+++ b/chromium/content/public/common/impression.cc
@@ -0,0 +1,19 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/impression.h"
+
+#include "third_party/blink/public/platform/web_security_origin.h"
+
+namespace content {
+
+Impression::Impression() = default;
+
+Impression::Impression(const Impression& other) = default;
+
+Impression& Impression::operator=(const Impression& other) = default;
+
+Impression::~Impression() = default;
+
+}  // namespace content
diff --git a/chromium/content/public/common/impression.h b/chromium/content/public/common/impression.h
new file mode 100644
index 00000000000..b009873f02d
--- /dev/null
+++ b/chromium/content/public/common/impression.h
@@ -0,0 +1,52 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_IMPRESSION_H_
+#define CONTENT_PUBLIC_COMMON_IMPRESSION_H_
+
+#include <stdint.h>
+#include <string>
+
+#include "base/time/time.h"
+#include "content/common/content_export.h"
+#include "url/origin.h"
+
+namespace content {
+
+// An impression represents a click on an anchor tag that has special Conversion
+// Measurement attributes declared. When the anchor is clicked, an impression is
+// generated from these attributes and associated with the resulting navigation.
+// When an action is performed on the linked site at a later date, the
+// impression information is used to provide context about the initial
+// navigation that resulted in that action.
+//
+// Used for IPC transport of WebImpression. WebImpression cannot be used
+// directly as it contains non-header-only blink types.
+struct CONTENT_EXPORT Impression {
+  Impression();
+  Impression(const Impression& other);
+  Impression& operator=(const Impression& other);
+  ~Impression();
+
+  // Intended committed top-level origin of the resulting navigation. Must match
+  // the committed navigation's origin to be a valid impression. Declared by
+  // the impression tag.
+  url::Origin conversion_destination;
+
+  // Optional origin that will receive all conversion measurement reports
+  // associated with this impression. Declared by the impression tag.
+  base::Optional<url::Origin> reporting_origin;
+
+  // Data that will be sent in conversion reports to identify this impression.
+  // Declared by the impression tag.
+  uint64_t impression_data;
+
+  // Optional expiry specifying the amount of time this impression can convert.
+  // Declared by the impression tag.
+  base::Optional<base::TimeDelta> expiry;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_IMPRESSION_H_
diff --git a/chromium/content/public/common/input_event_ack_source.h b/chromium/content/public/common/input_event_ack_source.h
deleted file mode 100644
index a7fc9a4be47..00000000000
--- a/chromium/content/public/common/input_event_ack_source.h
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright (c) 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_COMMON_INPUT_EVENT_ACK_SOURCE_H_
-#define CONTENT_PUBLIC_COMMON_INPUT_EVENT_ACK_SOURCE_H_
-
-namespace content {
-
-// Describes the source of where the input event ACK was
-// generated from inside the renderer.
-enum class InputEventAckSource {
-  UNKNOWN,
-  COMPOSITOR_THREAD,
-  MAIN_THREAD,
-  MAX_FROM_RENDERER = MAIN_THREAD,
-  // All values less than or equal to |MAX_FROM_RENDERER| are
-  // permitted to be sent from the renderer on the IPC channel.
-  BROWSER,
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_COMMON_INPUT_EVENT_ACK_SOURCE_H_
diff --git a/chromium/content/public/common/input_event_ack_state.h b/chromium/content/public/common/input_event_ack_state.h
index 16b31e58d94..06a462fadc1 100644
--- a/chromium/content/public/common/input_event_ack_state.h
+++ b/chromium/content/public/common/input_event_ack_state.h
@@ -7,21 +7,8 @@
 
 namespace content {
 
-// Describes the state of the input event ACK coming back to the browser side.
-enum InputEventAckState {
-  INPUT_EVENT_ACK_STATE_UNKNOWN,
-  INPUT_EVENT_ACK_STATE_CONSUMED,
-  INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-  INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE,
-  INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS,
-  INPUT_EVENT_ACK_STATE_IGNORED,
-  INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
-  INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING,
-  INPUT_EVENT_ACK_STATE_MAX =
-      INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING
-};
-
-const char* InputEventAckStateToString(InputEventAckState ack_state);
+const char* InputEventResultStateToString(
+    blink::mojom::InputEventResultState ack_state);
 
 }  // namespace content
 
diff --git a/chromium/content/public/common/navigation_policy.h b/chromium/content/public/common/navigation_policy.h
index d5068bc66d2..22f6574138c 100644
--- a/chromium/content/public/common/navigation_policy.h
+++ b/chromium/content/public/common/navigation_policy.h
@@ -39,7 +39,7 @@ enum class NavigationDownloadType {
   kAdFrame = 10,
 
   // The navigation was initiated from or occurred in an iframe with
-  // |WebSandboxFlags::kDownloads| flag set.
+  // |network::mojom::WebSandboxFlags::kDownloads| flag set.
   kSandbox = 11,
 
   // The navigation was initiated without user activation.
diff --git a/chromium/content/public/common/page_visibility_state.h b/chromium/content/public/common/page_visibility_state.h
index 1b5bbc2c4d7..ba17c5f8dc0 100644
--- a/chromium/content/public/common/page_visibility_state.h
+++ b/chromium/content/public/common/page_visibility_state.h
@@ -5,11 +5,11 @@
 #ifndef CONTENT_PUBLIC_COMMON_PAGE_VISIBILITY_STATE_H_
 #define CONTENT_PUBLIC_COMMON_PAGE_VISIBILITY_STATE_H_
 
-#include "third_party/blink/public/common/page/page_visibility_state.h"
+#include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 
 namespace content {
 
-using PageVisibilityState = blink::PageVisibilityState;
+using PageVisibilityState = blink::mojom::PageVisibilityState;
 
 }  // namespace content
 
diff --git a/chromium/content/public/common/previews_state.cc b/chromium/content/public/common/previews_state.cc
index 02e00399635..c812bc276d0 100644
--- a/chromium/content/public/common/previews_state.cc
+++ b/chromium/content/public/common/previews_state.cc
@@ -28,12 +28,6 @@ STATIC_ASSERT_PREVIEWS_ENUM(RESOURCE_LOADING_HINTS_ON,
                             blink::WebURLRequest::kResourceLoadingHintsOn);
 STATIC_ASSERT_PREVIEWS_ENUM(OFFLINE_PAGE_ON,
                             blink::WebURLRequest::kOfflinePageOn);
-STATIC_ASSERT_PREVIEWS_ENUM(LITE_PAGE_REDIRECT_ON,
-                            blink::WebURLRequest::kLitePageRedirectOn);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_LOAD_DEFERRED,
-                            blink::WebURLRequest::kLazyImageLoadDeferred);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_AUTO_RELOAD,
-                            blink::WebURLRequest::kLazyImageAutoReload);
 STATIC_ASSERT_PREVIEWS_ENUM(SUBRESOURCE_REDIRECT_ON,
                             blink::WebURLRequest::kSubresourceRedirectOn);
 STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_STATE_LAST,
diff --git a/chromium/content/public/common/previews_state.h b/chromium/content/public/common/previews_state.h
index 888cb7a69a1..c519a88b560 100644
--- a/chromium/content/public/common/previews_state.h
+++ b/chromium/content/public/common/previews_state.h
@@ -13,6 +13,8 @@ typedef int PreviewsState;
 // the resource. Previews are optimizations that change the format and
 // content of web pages to improve data savings and / or performance. This enum
 // determines which Previews types to request.
+// Deprecated values should be commented out and not reused since this bitmask
+// is persisted on disk.
 enum PreviewsTypes {
   PREVIEWS_UNSPECIFIED = 0,  // Let the browser process decide whether or
                              // not to request Preview types.
@@ -37,16 +39,13 @@ enum PreviewsTypes {
       1 << 7,  // Request that resource loading hints be used during pageload.
   OFFLINE_PAGE_ON =
       1 << 8,  // Request that an offline page be used if one is stored.
-  LITE_PAGE_REDIRECT_ON = 1 << 9,  // Allow the browser to redirect the resource
-                                   // to a Lite Page server.
-  LAZY_IMAGE_LOAD_DEFERRED = 1 << 10,  // Request the placeholder version of an
-                                       // image that was deferred by lazyload.
-  LAZY_IMAGE_AUTO_RELOAD = 1 << 11,  // Request the full image after previously
-                                     // getting a lazy load placeholder.
-  DEFER_ALL_SCRIPT_ON = 1 << 12,  // Request that script execution be deferred
+  // DEPRECATED: LITE_PAGE_REDIRECT_ON = 1 << 9,  // Allow the browser to
+  // redirect the resource to a Lite Page server. Support for this functionality
+  // has been removed.
+  DEFER_ALL_SCRIPT_ON = 1 << 10,  // Request that script execution be deferred
                                   // until parsing completes.
   SUBRESOURCE_REDIRECT_ON =
-      1 << 13,  // Allow the subresources in the page to be redirected to
+      1 << 11,  // Allow the subresources in the page to be redirected to
                 // serve better optimized resources. Set on subresources.
   PREVIEWS_STATE_LAST = SUBRESOURCE_REDIRECT_ON
 };
@@ -57,9 +56,9 @@ enum PreviewsTypes {
 // deprecated
 
 // Combination of all currently supported previews.
-const PreviewsState ALL_SUPPORTED_PREVIEWS =
-    SERVER_LITE_PAGE_ON | NOSCRIPT_ON | RESOURCE_LOADING_HINTS_ON |
-    OFFLINE_PAGE_ON | LITE_PAGE_REDIRECT_ON;
+const PreviewsState ALL_SUPPORTED_PREVIEWS = SERVER_LITE_PAGE_ON | NOSCRIPT_ON |
+                                             RESOURCE_LOADING_HINTS_ON |
+                                             OFFLINE_PAGE_ON;
 
 }  // namespace content
 
diff --git a/chromium/content/public/common/profiling_utils.h b/chromium/content/public/common/profiling_utils.h
new file mode 100644
index 00000000000..b73149412e3
--- /dev/null
+++ b/chromium/content/public/common/profiling_utils.h
@@ -0,0 +1,52 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_PROFILING_UTILS_H_
+#define CONTENT_PUBLIC_COMMON_PROFILING_UTILS_H_
+
+#include <string>
+#include <vector>
+
+#include "base/callback_forward.h"
+#include "base/files/file.h"
+#include "base/synchronization/waitable_event.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Open the file that should be used by a child process to save its profiling
+// data.
+CONTENT_EXPORT base::File OpenProfilingFile();
+
+// Serves WaitableEvent that should be used by the child processes to signal
+// that they have finished dumping the profiling data.
+class CONTENT_EXPORT WaitForProcessesToDumpProfilingInfo {
+ public:
+  WaitForProcessesToDumpProfilingInfo();
+  ~WaitForProcessesToDumpProfilingInfo();
+  WaitForProcessesToDumpProfilingInfo(
+      const WaitForProcessesToDumpProfilingInfo& other) = delete;
+  WaitForProcessesToDumpProfilingInfo& operator=(
+      const WaitForProcessesToDumpProfilingInfo&) = delete;
+
+  // Wait for all the events served by |GetNewWaitableEvent| to signal.
+  void WaitForAll();
+
+  // Return a new waitable event. Calling |WaitForAll| will wait for this event
+  // to be signaled.
+  // The returned WaitableEvent is owned by this
+  // WaitForProcessesToDumpProfilingInfo instance.
+  base::WaitableEvent* GetNewWaitableEvent();
+
+ private:
+  // Implementation of WaitForAll that will run on the thread pool. This will
+  // run |quit_closure| once it's done waiting.
+  void WaitForAllOnThreadPool(base::OnceClosure quit_closure);
+
+  std::vector<std::unique_ptr<base::WaitableEvent>> events_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_PROFILING_UTILS_H_
diff --git a/chromium/content/public/common/url_constants.cc b/chromium/content/public/common/url_constants.cc
index 9ae5fd3c15a..d954b9e581b 100644
--- a/chromium/content/public/common/url_constants.cc
+++ b/chromium/content/public/common/url_constants.cc
@@ -24,6 +24,7 @@ const char kChromeUIAppCacheInternalsHost[] = "appcache-internals";
 const char kChromeUIIndexedDBInternalsHost[] = "indexeddb-internals";
 const char kChromeUIBlobInternalsHost[] = "blob-internals";
 const char kChromeUIBrowserCrashHost[] = "inducebrowsercrashforrealz";
+const char kChromeUIConversionInternalsHost[] = "conversion-internals";
 const char kChromeUIDinoHost[] = "dino";
 const char kChromeUIGpuHost[] = "gpu";
 const char kChromeUIHistogramHost[] = "histograms";
diff --git a/chromium/content/public/common/url_constants.h b/chromium/content/public/common/url_constants.h
index 6569c60ff30..e09016439f5 100644
--- a/chromium/content/public/common/url_constants.h
+++ b/chromium/content/public/common/url_constants.h
@@ -35,6 +35,7 @@ CONTENT_EXPORT extern const char kChromeUIAccessibilityHost[];
 CONTENT_EXPORT extern const char kChromeUIAppCacheInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIBlobInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIBrowserCrashHost[];
+CONTENT_EXPORT extern const char kChromeUIConversionInternalsHost[];
 CONTENT_EXPORT extern const char kChromeUIDinoHost[];
 CONTENT_EXPORT extern const char kChromeUIGpuHost[];
 CONTENT_EXPORT extern const char kChromeUIHistogramHost[];
diff --git a/chromium/content/public/common/url_utils.cc b/chromium/content/public/common/url_utils.cc
index 4b7a1cdaf2d..16c6b998ad4 100644
--- a/chromium/content/public/common/url_utils.cc
+++ b/chromium/content/public/common/url_utils.cc
@@ -7,9 +7,9 @@
 #include <set>
 #include <string>
 
+#include "base/check_op.h"
 #include "base/containers/flat_set.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/no_destructor.h"
 #include "base/strings/string_piece.h"
 #include "build/build_config.h"
diff --git a/chromium/content/public/common/user_agent.h b/chromium/content/public/common/user_agent.h
index 974cefd6b8c..1726a87aa51 100644
--- a/chromium/content/public/common/user_agent.h
+++ b/chromium/content/public/common/user_agent.h
@@ -30,6 +30,9 @@ const char kAndroidMobile[] =
 
 }  // namespace frozen_user_agent_strings
 
+enum class IncludeAndroidBuildNumber { Include, Exclude };
+enum class IncludeAndroidModel { Include, Exclude };
+
 // Returns the WebKit version, in the form "major.minor (branch@revision)".
 CONTENT_EXPORT std::string GetWebKitVersion();
 
@@ -39,14 +42,29 @@ CONTENT_EXPORT std::string GetWebKitRevision();
 // otherwise).
 CONTENT_EXPORT std::string BuildCpuInfo();
 
-// Builds a User-agent compatible string that describes the OS and CPU type.
-// On Android, the string will only include the build number if true is passed
-// as an argument.
-CONTENT_EXPORT std::string BuildOSCpuInfo(bool include_android_build_number);
+// Takes the cpu info (see BuildCpuInfo()) and extracts the architecture for
+// most common cases.
+CONTENT_EXPORT std::string GetLowEntropyCpuArchitecture();
 
-// Returns the OS version. On Android, the string will only include the build
-// number if true is passed as an argument.
-CONTENT_EXPORT std::string GetOSVersion(bool include_android_build_number);
+// Builds a User-agent compatible string that describes the OS and CPU type.
+// On Android, the string will only include the build number and model if
+// relevant enums indicate they should be included.
+CONTENT_EXPORT std::string BuildOSCpuInfo(
+    IncludeAndroidBuildNumber include_android_build_number,
+    IncludeAndroidModel include_android_model);
+// We may also build the same User-agent compatible string describing OS and CPU
+// type by providing our own |os_version| and |cpu_type|. This is primarily
+// useful in testing.
+CONTENT_EXPORT std::string BuildOSCpuInfoFromOSVersionAndCpuType(
+    const std::string& os_version,
+    const std::string& cpu_type);
+
+// Returns the OS version.
+// On Android, the string will only include the build number and model if
+// relevant enums indicate they should be included.
+CONTENT_EXPORT std::string GetOSVersion(
+    IncludeAndroidBuildNumber include_android_build_number,
+    IncludeAndroidModel include_android_model);
 
 // Returns the frozen User-agent string for
 // https://github.com/WICG/ua-client-hints.
@@ -69,10 +87,12 @@ CONTENT_EXPORT std::string BuildModelInfo();
 CONTENT_EXPORT std::string BuildUserAgentFromProductAndExtraOSInfo(
     const std::string& product,
     const std::string& extra_os_info,
-    bool include_android_build_number);
+    IncludeAndroidBuildNumber include_android_build_number);
 
 // Helper function to generate just the OS info.
-CONTENT_EXPORT std::string GetAndroidOSInfo(bool include_android_build_number);
+CONTENT_EXPORT std::string GetAndroidOSInfo(
+    IncludeAndroidBuildNumber include_android_build_number,
+    IncludeAndroidModel include_android_model);
 #endif
 
 // Builds a full user agent string given a string describing the OS and a
diff --git a/chromium/content/public/common/web_preferences.cc b/chromium/content/public/common/web_preferences.cc
index 13999e87c78..eac2562c779 100644
--- a/chromium/content/public/common/web_preferences.cc
+++ b/chromium/content/public/common/web_preferences.cc
@@ -230,7 +230,8 @@ WebPreferences::WebPreferences()
       translate_service_available(false),
       network_quality_estimator_web_holdback(
           net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN),
-      allow_mixed_content_upgrades(true) {
+      allow_mixed_content_upgrades(true),
+      always_show_focus(false) {
   standard_font_family_map[kCommonScript] =
       base::ASCIIToUTF16("Times New Roman");
   fixed_font_family_map[kCommonScript] = base::ASCIIToUTF16("Courier New");
diff --git a/chromium/content/public/common/web_preferences.h b/chromium/content/public/common/web_preferences.h
index 6c6420ec70b..4ba03d3a621 100644
--- a/chromium/content/public/common/web_preferences.h
+++ b/chromium/content/public/common/web_preferences.h
@@ -123,6 +123,7 @@ struct CONTENT_EXPORT WebPreferences {
   bool webgl_errors_to_console_enabled;
   bool hide_scrollbars;
   bool accelerated_2d_canvas_enabled;
+  bool new_canvas_2d_api_enabled;
   bool antialiased_2d_canvas_disabled;
   bool antialiased_clips_2d_canvas_enabled;
   int accelerated_2d_canvas_msaa_sample_count;
@@ -357,6 +358,10 @@ struct CONTENT_EXPORT WebPreferences {
   // sites.
   bool allow_mixed_content_upgrades;
 
+  // Whether the focused element should always be indicated (for example, by
+  // forcing :focus-visible to match regardless of focus method).
+  bool always_show_focus;
+
   // We try to keep the default values the same as the default values in
   // chrome, except for the cases where it would require lots of extra work for
   // the embedder to use the same default value.
diff --git a/chromium/content/public/common/web_preferences.typemap b/chromium/content/public/common/web_preferences.typemap
index e617cf7a07e..df582b905d7 100644
--- a/chromium/content/public/common/web_preferences.typemap
+++ b/chromium/content/public/common/web_preferences.typemap
@@ -5,4 +5,22 @@
 mojom = "//content/public/common/web_preferences.mojom"
 public_headers = [ "//content/public/common/web_preferences.h" ]
 traits_headers = [ "//content/public/common/common_param_traits_macros.h" ]
+public_deps = [
+  # Since the typemappings for browser_controls_state, drop_data and
+  # web_features are all implemented in the monolithic common_param_traits, we
+  # need to duplicate these dependencies into all three typemaps.
+  # Note that we also have a dependency on
+  # //third_party/blink/public/mojom:mojom_platform, but we can't include that
+  # dependency here because we need to override it to support component build.
+
+  "//base",
+  "//ipc",
+  "//services/network/public/cpp:cpp_base",
+  "//services/network/public/mojom",
+  "//third_party/blink/public:blink_headers",
+  "//ui/accessibility:ax_enums_mojo",
+  "//ui/base",
+  "//ui/gfx/ipc",
+  "//ui/surface",
+]
 type_mappings = [ "content.mojom.WebPreferences=::content::WebPreferences" ]
diff --git a/chromium/content/public/common/webplugininfo.cc b/chromium/content/public/common/webplugininfo.cc
index ee4439f3a32..c3892c6c394 100644
--- a/chromium/content/public/common/webplugininfo.cc
+++ b/chromium/content/public/common/webplugininfo.cc
@@ -8,7 +8,6 @@
 
 #include <algorithm>
 
-#include "base/logging.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chromium/content/public/gpu/content_gpu_client.cc b/chromium/content/public/gpu/content_gpu_client.cc
index 873d53b1d72..ef1b9c7caff 100644
--- a/chromium/content/public/gpu/content_gpu_client.cc
+++ b/chromium/content/public/gpu/content_gpu_client.cc
@@ -4,10 +4,6 @@
 
 #include "content/public/gpu/content_gpu_client.h"
 
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-#include "media/cdm/cdm_proxy.h"
-#endif
-
 namespace content {
 
 gpu::SyncPointManager* ContentGpuClient::GetSyncPointManager() {
@@ -23,11 +19,4 @@ ContentGpuClient::GetVizCompositorThreadRunner() {
   return nullptr;
 }
 
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-std::unique_ptr<media::CdmProxy> ContentGpuClient::CreateCdmProxy(
-    const base::Token& cdm_guid) {
-  return nullptr;
-}
-#endif
-
 }  // namespace content
diff --git a/chromium/content/public/gpu/content_gpu_client.h b/chromium/content/public/gpu/content_gpu_client.h
index f68558bd2c4..88e80bdaecb 100644
--- a/chromium/content/public/gpu/content_gpu_client.h
+++ b/chromium/content/public/gpu/content_gpu_client.h
@@ -11,23 +11,14 @@
 #include "base/metrics/field_trial.h"
 #include "base/single_thread_task_runner.h"
 #include "content/public/common/content_client.h"
-#include "media/media_buildflags.h"
 #include "mojo/public/cpp/bindings/binder_map.h"
 
-namespace base {
-class Token;
-}
-
 namespace gpu {
 struct GpuPreferences;
 class SharedImageManager;
 class SyncPointManager;
 }
 
-namespace media {
-class CdmProxy;
-}
-
 namespace viz {
 class VizCompositorThreadRunner;
 }
@@ -60,13 +51,6 @@ class CONTENT_EXPORT ContentGpuClient {
   virtual gpu::SyncPointManager* GetSyncPointManager();
   virtual gpu::SharedImageManager* GetSharedImageManager();
   virtual viz::VizCompositorThreadRunner* GetVizCompositorThreadRunner();
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  // Creates a media::CdmProxy for the type of Content Decryption Module (CDM)
-  // identified by |cdm_guid|.
-  virtual std::unique_ptr<media::CdmProxy> CreateCdmProxy(
-      const base::Token& cdm_guid);
-#endif
 };
 
 }  // namespace content
diff --git a/chromium/content/public/renderer/content_renderer_client.cc b/chromium/content/public/renderer/content_renderer_client.cc
index 84db33f5fb4..ea6d8e63572 100644
--- a/chromium/content/public/renderer/content_renderer_client.cc
+++ b/chromium/content/public/renderer/content_renderer_client.cc
@@ -4,6 +4,8 @@
 
 #include "content/public/renderer/content_renderer_client.h"
 
+#include "build/build_config.h"
+#include "media/base/demuxer.h"
 #include "media/base/renderer_factory.h"
 #include "third_party/blink/public/platform/web_audio_device.h"
 #include "third_party/blink/public/platform/web_prescient_networking.h"
@@ -52,7 +54,8 @@ bool ContentRendererClient::HasErrorPage(int http_status_code) {
 }
 
 bool ContentRendererClient::ShouldSuppressErrorPage(RenderFrame* render_frame,
-                                                    const GURL& url) {
+                                                    const GURL& url,
+                                                    int error_code) {
   return false;
 }
 
@@ -67,6 +70,13 @@ bool ContentRendererClient::DeferMediaLoad(RenderFrame* render_frame,
   return false;
 }
 
+std::unique_ptr<media::Demuxer> ContentRendererClient::OverrideDemuxerForUrl(
+    RenderFrame* render_frame,
+    const GURL& url,
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
+  return nullptr;
+}
+
 blink::WebThemeEngine* ContentRendererClient::OverrideThemeEngine() {
   return nullptr;
 }
@@ -111,7 +121,7 @@ void ContentRendererClient::WillSendRequest(
     const net::SiteForCookies& site_for_cookies,
     const url::Origin* initiator_origin,
     GURL* new_url,
-    bool* attach_same_site_cookies) {}
+    bool* force_ignore_site_for_cookies) {}
 
 bool ContentRendererClient::IsPrefetchOnly(
     RenderFrame* render_frame,
@@ -176,11 +186,13 @@ ContentRendererClient::CreateWorkerContentSettingsClient(
   return nullptr;
 }
 
+#if !defined(OS_ANDROID)
 std::unique_ptr<media::SpeechRecognitionClient>
 ContentRendererClient::CreateSpeechRecognitionClient(
     RenderFrame* render_frame) {
   return nullptr;
 }
+#endif
 
 bool ContentRendererClient::IsPluginAllowedToUseCameraDeviceAPI(
     const GURL& url) {
diff --git a/chromium/content/public/renderer/content_renderer_client.h b/chromium/content/public/renderer/content_renderer_client.h
index 764556d80f1..7da02ee5414 100644
--- a/chromium/content/public/renderer/content_renderer_client.h
+++ b/chromium/content/public/renderer/content_renderer_client.h
@@ -23,7 +23,6 @@
 #include "content/public/renderer/url_loader_throttle_provider.h"
 #include "content/public/renderer/websocket_handshake_throttle_provider.h"
 #include "media/base/audio_parameters.h"
-#include "media/base/speech_recognition_client.h"
 #include "media/base/supported_types.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "third_party/blink/public/platform/web_content_settings_client.h"
@@ -32,6 +31,10 @@
 #include "ui/base/page_transition_types.h"
 #include "v8/include/v8.h"
 
+#if !defined(OS_ANDROID)
+#include "media/base/speech_recognition_client.h"
+#endif
+
 class GURL;
 class SkBitmap;
 
@@ -55,6 +58,7 @@ struct WebURLError;
 }  // namespace blink
 
 namespace media {
+class Demuxer;
 class KeySystemProperties;
 }
 
@@ -136,9 +140,10 @@ class CONTENT_EXPORT ContentRendererClient {
   virtual bool HasErrorPage(int http_status_code);
 
   // Returns true if the embedder prefers not to show an error page for a failed
-  // navigation to |url| in |render_frame|.
+  // navigation to |url| with |error_code| in |render_frame|.
   virtual bool ShouldSuppressErrorPage(RenderFrame* render_frame,
-                                       const GURL& url);
+                                       const GURL& url,
+                                       int error_code);
 
   // Returns false for new tab page activities, which should be filtered out in
   // UseCounter; returns true otherwise.
@@ -171,6 +176,14 @@ class CONTENT_EXPORT ContentRendererClient {
                               bool has_played_media_before,
                               base::OnceClosure closure);
 
+  // Allows the embedder to override the Demuxer used for certain URLs.
+  // If a non-null value is returned, the object will be used as the source of
+  // media data by the media player instance for which this method was called.
+  virtual std::unique_ptr<media::Demuxer> OverrideDemuxerForUrl(
+      RenderFrame* render_frame,
+      const GURL& url,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
+
   // Allows the embedder to override the WebThemeEngine used. If it returns NULL
   // the content layer will provide an engine.
   virtual blink::WebThemeEngine* OverrideThemeEngine();
@@ -216,9 +229,10 @@ class CONTENT_EXPORT ContentRendererClient {
 
   // Notifies the embedder that the given frame is requesting the resource at
   // |url|. If the function returns a valid |new_url|, the request must be
-  // updated to use it. The |attach_same_site_cookies| output parameter
-  // determines whether SameSite cookies should be attached to the request.
-  // The |site_for_cookies| is the site_for_cookies of the request. (This is
+  // updated to use it. The |force_ignore_site_for_cookies| output parameter
+  // indicates whether SameSite cookies should be unconditionally attached to
+  // the request, bypassing the usual |site_for_cookies| checks. The
+  // |site_for_cookies| is the site_for_cookies of the request. (This is
   // approximately the URL of the main frame. It is empty in the case of
   // cross-site iframes.)
   //
@@ -231,7 +245,7 @@ class CONTENT_EXPORT ContentRendererClient {
                                const net::SiteForCookies& site_for_cookies,
                                const url::Origin* initiator_origin,
                                GURL* new_url,
-                               bool* attach_same_site_cookies);
+                               bool* force_ignore_site_for_cookies);
 
   // Returns true if the request is associated with a document that is in
   // ""prefetch only" mode, and will not be rendered.
@@ -287,9 +301,11 @@ class CONTENT_EXPORT ContentRendererClient {
   virtual std::unique_ptr<blink::WebContentSettingsClient>
   CreateWorkerContentSettingsClient(RenderFrame* render_frame);
 
+#if !defined(OS_ANDROID)
   // Creates a speech recognition client used to transcribe audio into captions.
   virtual std::unique_ptr<media::SpeechRecognitionClient>
   CreateSpeechRecognitionClient(RenderFrame* render_frame);
+#endif
 
   // Returns true if the page at |url| can use Pepper CameraDevice APIs.
   virtual bool IsPluginAllowedToUseCameraDeviceAPI(const GURL& url);
diff --git a/chromium/content/public/renderer/key_system_support.cc b/chromium/content/public/renderer/key_system_support.cc
index ef77fc5473d..ab189d803d5 100644
--- a/chromium/content/public/renderer/key_system_support.cc
+++ b/chromium/content/public/renderer/key_system_support.cc
@@ -9,7 +9,6 @@
 #include "content/public/renderer/render_thread.h"
 #include "media/mojo/mojom/key_system_support.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
 
diff --git a/chromium/content/public/renderer/plugin_instance_throttler.h b/chromium/content/public/renderer/plugin_instance_throttler.h
index a0f098f81e9..0aafcfc2ebc 100644
--- a/chromium/content/public/renderer/plugin_instance_throttler.h
+++ b/chromium/content/public/renderer/plugin_instance_throttler.h
@@ -51,7 +51,7 @@ class CONTENT_EXPORT PluginInstanceThrottler {
     UNTHROTTLE_METHOD_DO_NOT_RECORD = -1,  // Sentinel value to skip recording.
     UNTHROTTLE_METHOD_NEVER = 0,
     UNTHROTTLE_METHOD_BY_CLICK = 1,
-    UNTHROTTLE_METHOD_BY_WHITELIST = 2,
+    UNTHROTTLE_METHOD_BY_ALLOWLIST = 2,
     UNTHROTTLE_METHOD_BY_AUDIO = 3,
     UNTHROTTLE_METHOD_BY_SIZE_CHANGE = 4,
     UNTHROTTLE_METHOD_BY_OMNIBOX_ICON = 5,
diff --git a/chromium/content/public/renderer/render_frame.h b/chromium/content/public/renderer/render_frame.h
index 6ed21d38738..77b499ea74f 100644
--- a/chromium/content/public/renderer/render_frame.h
+++ b/chromium/content/public/renderer/render_frame.h
@@ -99,7 +99,7 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
     // Content is essential even though it's cross-origin, because it's large.
     CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_BIG = 2,
     // Content is essential because there's large content from the same origin.
-    CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED = 3,
+    CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED = 3,
     // Content is tiny in size. These are usually blocked.
     CONTENT_STATUS_TINY = 4,
     // Deprecated, as now entirely obscured content is treated as tiny.
@@ -210,7 +210,7 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
 
 #if BUILDFLAG(ENABLE_PLUGINS)
   // Registers a plugin that has been marked peripheral. If the origin
-  // whitelist is later updated and includes |content_origin|, then
+  // allowlist is later updated and includes |content_origin|, then
   // |unthrottle_callback| will be called.
   virtual void RegisterPeripheralPlugin(
       const url::Origin& content_origin,
@@ -238,9 +238,9 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
       const gfx::Size& unobscured_size,
       RecordPeripheralDecision record_decision) = 0;
 
-  // Whitelists a |content_origin| so its content will never be throttled in
-  // this RenderFrame. Whitelist is cleared by top level navigation.
-  virtual void WhitelistContentOrigin(const url::Origin& content_origin) = 0;
+  // Allowlists a |content_origin| so its content will never be throttled in
+  // this RenderFrame. Allowlist is cleared by top level navigation.
+  virtual void AllowlistContentOrigin(const url::Origin& content_origin) = 0;
 
   // Used by plugins that load data in this RenderFrame to update the loading
   // notifications.
diff --git a/chromium/content/public/renderer/render_frame_observer.h b/chromium/content/public/renderer/render_frame_observer.h
index 172b2a246e6..831a3574055 100644
--- a/chromium/content/public/renderer/render_frame_observer.h
+++ b/chromium/content/public/renderer/render_frame_observer.h
@@ -21,7 +21,6 @@
 #include "third_party/blink/public/common/loader/loading_behavior_flag.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 #include "third_party/blink/public/mojom/use_counter/css_property_id.mojom.h"
-#include "third_party/blink/public/mojom/web_client_hints/web_client_hints_types.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
 #include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/web_local_frame_client.h"
@@ -179,6 +178,13 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
   virtual void DidObserveLayoutShift(double score, bool after_input_or_scroll) {
   }
 
+  // Reports the number of LayoutBlock creation, and LayoutObject::UpdateLayout
+  // calls. All values are deltas since the last calls of this function.
+  virtual void DidObserveLayoutNg(uint32_t all_block_count,
+                                  uint32_t ng_block_count,
+                                  uint32_t all_call_count,
+                                  uint32_t ng_call_count) {}
+
   // Reports lazy loaded behavior when the frame or image is fully deferred or
   // if the frame or image is loaded after being deferred by lazy load.
   // Called every time the behavior occurs. This does not apply to image
diff --git a/chromium/content/public/renderer/render_view.h b/chromium/content/public/renderer/render_view.h
index ada13ce26b2..fbd64f30004 100644
--- a/chromium/content/public/renderer/render_view.h
+++ b/chromium/content/public/renderer/render_view.h
@@ -82,14 +82,6 @@ class CONTENT_EXPORT RenderView : public IPC::Sender {
   // false, but set to true by some tests.
   virtual bool GetContentStateImmediately() = 0;
 
-  // Inject edit commands to be used for the next keyboard event.
-  // TODO(alexmos): Currently, these are used only by BlinkTestRunner.  They
-  // should be removed from RenderView and instead be plumbed through the
-  // target frame and WebFrameTestProxy.
-  virtual void SetEditCommandForNextKeyEvent(const std::string& name,
-                                             const std::string& value) = 0;
-  virtual void ClearEditCommands() = 0;
-
   // Returns |renderer_preferences_.accept_languages| value.
   virtual const std::string& GetAcceptLanguages() = 0;
 
diff --git a/chromium/content/public/renderer/render_view_observer.h b/chromium/content/public/renderer/render_view_observer.h
index 0b8c1b0f1fa..4fcd0492c4e 100644
--- a/chromium/content/public/renderer/render_view_observer.h
+++ b/chromium/content/public/renderer/render_view_observer.h
@@ -12,12 +12,7 @@
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
 
-namespace blink {
-class WebLocalFrame;
-}
-
 namespace content {
-
 class RenderView;
 class RenderViewImpl;
 
@@ -32,7 +27,6 @@ class CONTENT_EXPORT RenderViewObserver : public IPC::Listener,
   virtual void OnDestruct() = 0;
 
   // These match the WebKit API notifications
-  virtual void DidClearWindowObject(blink::WebLocalFrame* frame) {}
   virtual void DidCommitCompositorFrame() {}
   virtual void DidUpdateMainFrameLayout() {}
 
diff --git a/chromium/content/public/renderer/request_peer.h b/chromium/content/public/renderer/request_peer.h
index c46104057ca..bea493705b8 100644
--- a/chromium/content/public/renderer/request_peer.h
+++ b/chromium/content/public/renderer/request_peer.h
@@ -39,12 +39,15 @@ class CONTENT_EXPORT RequestPeer {
   // note: only for requests with upload progress enabled.
   virtual void OnUploadProgress(uint64_t position, uint64_t size) = 0;
 
-  // Called when a redirect occurs.  The implementation may return false to
-  // suppress the redirect.  The URLResponseHead provides information about
+  // Called when a redirect occurs. The implementation may return false to
+  // suppress the redirect. The URLResponseHead provides information about
   // the redirect response and the RedirectInfo includes information about the
-  // request to be made if the method returns true.
-  virtual bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                                  network::mojom::URLResponseHeadPtr head) = 0;
+  // request to be made if the method returns true. |removed_headers| outputs
+  // header field names that need to be removed.
+  virtual bool OnReceivedRedirect(
+      const net::RedirectInfo& redirect_info,
+      network::mojom::URLResponseHeadPtr head,
+      std::vector<std::string>* removed_headers) = 0;
 
   // Called when response headers are available (after all redirects have
   // been followed).
diff --git a/chromium/content/public/test/android/BUILD.gn b/chromium/content/public/test/android/BUILD.gn
index d3ecdb5c4b5..bbe969b2e3f 100644
--- a/chromium/content/public/test/android/BUILD.gn
+++ b/chromium/content/public/test/android/BUILD.gn
@@ -29,7 +29,6 @@ android_library("content_java_test_support") {
     "javatests/src/org/chromium/content_public/browser/test/ChildProcessAllocatorSettings.java",
     "javatests/src/org/chromium/content_public/browser/test/ChildProcessAllocatorSettingsHook.java",
     "javatests/src/org/chromium/content_public/browser/test/ContentJUnit4ClassRunner.java",
-    "javatests/src/org/chromium/content_public/browser/test/InterstitialPageDelegateAndroid.java",
     "javatests/src/org/chromium/content_public/browser/test/NativeLibraryTestRule.java",
     "javatests/src/org/chromium/content_public/browser/test/RenderFrameHostTestExt.java",
     "javatests/src/org/chromium/content_public/browser/test/mock/MockNavigationController.java",
@@ -63,7 +62,6 @@ android_library("content_java_test_support") {
 generate_jni("content_test_jni") {
   testonly = true
   sources = [
-    "javatests/src/org/chromium/content_public/browser/test/InterstitialPageDelegateAndroid.java",
     "javatests/src/org/chromium/content_public/browser/test/RenderFrameHostTestExt.java",
     "javatests/src/org/chromium/content_public/browser/test/util/DOMUtils.java",
     "javatests/src/org/chromium/content_public/browser/test/util/UiThreadSchedulerTestUtils.java",
@@ -82,8 +80,6 @@ static_library("content_native_test_support") {
 
   sources = [
     "dom_utils.cc",
-    "interstitial_page_delegate_android.cc",
-    "interstitial_page_delegate_android.h",
     "render_frame_host_test_ext.cc",
     "render_frame_host_test_ext.h",
     "ui_thread_scheduler_test_utils.cc",
diff --git a/chromium/content/public/test/test_service.mojom b/chromium/content/public/test/test_service.mojom
index 3580ebd9223..473e78edae1 100644
--- a/chromium/content/public/test/test_service.mojom
+++ b/chromium/content/public/test/test_service.mojom
@@ -41,4 +41,7 @@ interface TestService {
   // exactly.
   CreateUnsafeSharedMemoryRegion(string message)
       => (mojo_base.mojom.UnsafeSharedMemoryRegion? region);
+
+  // Returns the result of service_manager::Sandbox::IsProcessSandboxed().
+  IsProcessSandboxed() => (bool is_sandboxed);
 };
diff --git a/chromium/content/public/utility/content_utility_client.h b/chromium/content/public/utility/content_utility_client.h
index e521fbd4c5e..51667228d48 100644
--- a/chromium/content/public/utility/content_utility_client.h
+++ b/chromium/content/public/utility/content_utility_client.h
@@ -10,8 +10,8 @@
 
 #include "base/callback_forward.h"
 #include "content/public/common/content_client.h"
+#include "mojo/public/cpp/bindings/binder_map.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
-#include "services/service_manager/public/cpp/binder_map.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/service.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
diff --git a/chromium/content/renderer/BUILD.gn b/chromium/content/renderer/BUILD.gn
index 32fc54e791a..12e9157d582 100644
--- a/chromium/content/renderer/BUILD.gn
+++ b/chromium/content/renderer/BUILD.gn
@@ -39,8 +39,6 @@ target(link_target_type, "renderer") {
     "accessibility/ax_image_annotator.h",
     "accessibility/blink_ax_action_target.cc",
     "accessibility/blink_ax_action_target.h",
-    "accessibility/blink_ax_enum_conversion.cc",
-    "accessibility/blink_ax_enum_conversion.h",
     "accessibility/blink_ax_tree_source.cc",
     "accessibility/blink_ax_tree_source.h",
     "accessibility/render_accessibility_impl.cc",
@@ -57,9 +55,6 @@ target(link_target_type, "renderer") {
     "child_frame_compositing_helper.h",
     "child_frame_compositor.h",
     "compositor/compositor_dependencies.h",
-    "compositor/layer_tree_view.cc",
-    "compositor/layer_tree_view.h",
-    "compositor/layer_tree_view_delegate.h",
     "content_security_policy_util.cc",
     "content_security_policy_util.h",
     "context_menu_params_builder.cc",
@@ -88,6 +83,8 @@ target(link_target_type, "renderer") {
     "history_serialization.h",
     "ime_event_guard.cc",
     "ime_event_guard.h",
+    "impression_conversions.cc",
+    "impression_conversions.h",
     "in_process_renderer_thread.cc",
     "in_process_renderer_thread.h",
     "input/frame_input_handler_impl.cc",
@@ -104,8 +101,6 @@ target(link_target_type, "renderer") {
     "input/render_widget_input_handler.cc",
     "input/render_widget_input_handler.h",
     "input/render_widget_input_handler_delegate.h",
-    "input/scoped_web_input_event_with_latency_info.cc",
-    "input/scoped_web_input_event_with_latency_info.h",
     "input/widget_input_handler_impl.cc",
     "input/widget_input_handler_impl.h",
     "input/widget_input_handler_manager.cc",
@@ -191,6 +186,8 @@ target(link_target_type, "renderer") {
     "media/inspector_media_event_handler.h",
     "media/media_factory.cc",
     "media/media_factory.h",
+    "media/media_interface_factory.cc",
+    "media/media_interface_factory.h",
     "media/media_permission_dispatcher.cc",
     "media/media_permission_dispatcher.h",
     "media/power_status_helper_impl.cc",
@@ -409,6 +406,7 @@ target(link_target_type, "renderer") {
     "//ui/accessibility",
     "//ui/base",
     "//ui/base/clipboard",
+    "//ui/base/cursor",
     "//ui/base/ime",
     "//ui/display",
     "//ui/events:dom_keycode_converter",
@@ -423,13 +421,6 @@ target(link_target_type, "renderer") {
   ]
   allow_circular_includes_from = []
 
-  if (use_external_popup_menu) {
-    sources += [
-      "external_popup_menu.cc",
-      "external_popup_menu.h",
-    ]
-  }
-
   if (is_android) {
     set_sources_assignment_filter([])
     sources += [
@@ -648,10 +639,11 @@ target(link_target_type, "renderer") {
       "//ppapi/host",
       "//ppapi/proxy",
       "//ppapi/shared_impl",
+      "//printing/mojom",
       "//third_party/libvpx",
       "//third_party/opus",
       "//ui/base/cursor",
-      "//ui/base/mojom:cursor_type",
+      "//ui/base/cursor/mojom:cursor_type",
     ]
   }
 
@@ -659,17 +651,17 @@ target(link_target_type, "renderer") {
     deps += [ "//printing" ]
   }
 
-  if (enable_mojo_media) {
-    sources += [
-      "media/media_interface_factory.cc",
-      "media/media_interface_factory.h",
-    ]
-  }
-
   if (is_linux || is_android) {
     deps += [ "//sandbox:sandbox_buildflags" ]
   }
 
+  if (is_chromeos) {
+    deps += [
+      "//chromeos:chromeos_export",
+      "//chromeos/system:system",
+    ]
+  }
+
   if (use_ozone) {
     deps += [ "//ui/ozone" ]
   }
@@ -682,7 +674,7 @@ target(link_target_type, "renderer") {
 # See comment at the top of //content/BUILD.gn for how this works.
 group("for_content_tests") {
   visibility = [
-    "//content/shell/test_runner",
+    "//content/shell:web_test_renderer",
     "//content/test/*",
   ]
 
diff --git a/chromium/content/renderer/DEPS b/chromium/content/renderer/DEPS
index 9d9a9a0a4ff..aee8b4d69cc 100644
--- a/chromium/content/renderer/DEPS
+++ b/chromium/content/renderer/DEPS
@@ -16,6 +16,7 @@ include_rules = [
   # If adding a new component dependency, email content/OWNERS first.
   # ****************************************************************************
 
+  "+chromeos/system/core_scheduling.h",
   "+content/public/child",
   "+content/public/renderer",
   "+content/child",
@@ -30,6 +31,7 @@ include_rules = [
   "+third_party/hyphen/hyphen.h",
   "+third_party/webrtc_overrides",
   "+third_party/blink/public/common",
+  "+third_party/blink/public/mojom",
   "+v8/include",
   "+v8/src/third_party/vtune",
 ]
diff --git a/chromium/content/renderer/OWNERS b/chromium/content/renderer/OWNERS
index 9a367842cfc..a97b9653677 100644
--- a/chromium/content/renderer/OWNERS
+++ b/chromium/content/renderer/OWNERS
@@ -1,6 +1,7 @@
 dcheng@chromium.org
 haraken@chromium.org
 szager@chromium.org
+danakj@chromium.org
 
 # These are for the common case of adding or renaming files. If you're doing
 # structural changes, please get a review from a reviewer in this file.
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.cc b/chromium/content/renderer/accessibility/ax_image_annotator.cc
index a5b7e079568..3a38e7be07f 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.cc
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.cc
@@ -28,10 +28,8 @@ namespace content {
 
 AXImageAnnotator::AXImageAnnotator(
     RenderAccessibilityImpl* const render_accessibility,
-    const std::string& preferred_language,
     mojo::PendingRemote<image_annotation::mojom::Annotator> annotator)
     : render_accessibility_(render_accessibility),
-      preferred_language_(preferred_language),
       annotator_(std::move(annotator)) {
   DCHECK(render_accessibility_);
 }
@@ -82,12 +80,13 @@ void AXImageAnnotator::OnImageAdded(blink::WebAXObject& image) {
   image_annotations_.emplace(image.AxID(), image);
   ImageInfo& image_info = image_annotations_.at(image.AxID());
   // Fetch image annotation.
-  annotator_->AnnotateImage(image_id, preferred_language_,
+  annotator_->AnnotateImage(image_id, render_accessibility_->GetLanguage(),
                             image_info.GetImageProcessor(),
                             base::BindOnce(&AXImageAnnotator::OnImageAnnotated,
                                            weak_factory_.GetWeakPtr(), image));
   VLOG(1) << "Requesting annotation for " << image_id << " with language '"
-          << preferred_language_ << "' from page " << GetDocumentUrl();
+          << render_accessibility_->GetLanguage() << "' from page "
+          << GetDocumentUrl();
 }
 
 void AXImageAnnotator::OnImageUpdated(blink::WebAXObject& image) {
@@ -99,7 +98,7 @@ void AXImageAnnotator::OnImageUpdated(blink::WebAXObject& image) {
 
   ImageInfo& image_info = image_annotations_.at(image.AxID());
   // Update annotation.
-  annotator_->AnnotateImage(image_id, preferred_language_,
+  annotator_->AnnotateImage(image_id, render_accessibility_->GetLanguage(),
                             image_info.GetImageProcessor(),
                             base::BindOnce(&AXImageAnnotator::OnImageAnnotated,
                                            weak_factory_.GetWeakPtr(), image));
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.h b/chromium/content/renderer/accessibility/ax_image_annotator.h
index 9b574244842..fcc1a316106 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.h
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.h
@@ -40,7 +40,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
  public:
   AXImageAnnotator(
       RenderAccessibilityImpl* const render_accessibility,
-      const std::string& preferred_language,
       mojo::PendingRemote<image_annotation::mojom::Annotator> annotator);
   ~AXImageAnnotator() override;
 
@@ -56,10 +55,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
   void OnImageUpdated(blink::WebAXObject& image);
   void OnImageRemoved(blink::WebAXObject& image);
 
-  void set_preferred_language(const std::string& language) {
-    preferred_language_ = language;
-  }
-
  private:
   // Keeps track of the image data and the automatic annotation for each image.
   class ImageInfo final {
@@ -122,9 +117,6 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
   // Weak, owns us.
   RenderAccessibilityImpl* const render_accessibility_;
 
-  // The language in which to request image descriptions.
-  std::string preferred_language_;
-
   // A pointer to the automatic image annotation service.
   mojo::Remote<image_annotation::mojom::Annotator> annotator_;
 
diff --git a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc b/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc
deleted file mode 100644
index 656c0c2bfed..00000000000
--- a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.cc
+++ /dev/null
@@ -1,83 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
-
-#include "base/logging.h"
-
-namespace content {
-
-void AXStateFromBlink(const blink::WebAXObject& o, ui::AXNodeData* dst) {
-  blink::WebAXExpanded expanded = o.IsExpanded();
-  if (expanded) {
-    if (expanded == blink::kWebAXExpandedCollapsed)
-      dst->AddState(ax::mojom::State::kCollapsed);
-    else if (expanded == blink::kWebAXExpandedExpanded)
-      dst->AddState(ax::mojom::State::kExpanded);
-  }
-
-  if (o.CanSetFocusAttribute())
-    dst->AddState(ax::mojom::State::kFocusable);
-
-  if (o.HasPopup() != ax::mojom::HasPopup::kFalse)
-    dst->SetHasPopup(o.HasPopup());
-  else if (o.Role() == ax::mojom::Role::kPopUpButton)
-    dst->SetHasPopup(ax::mojom::HasPopup::kMenu);
-
-  if (o.IsAutofillAvailable())
-    dst->AddState(ax::mojom::State::kAutofillAvailable);
-
-  if (o.IsDefault())
-    dst->AddState(ax::mojom::State::kDefault);
-
-  // aria-grabbed is deprecated in WAI-ARIA 1.1.
-  if (o.IsGrabbed() != blink::kWebAXGrabbedStateUndefined)
-    dst->AddBoolAttribute(ax::mojom::BoolAttribute::kGrabbed,
-                          o.IsGrabbed() == blink::kWebAXGrabbedStateTrue);
-
-  if (o.IsHovered())
-    dst->AddState(ax::mojom::State::kHovered);
-
-  if (!o.IsVisible())
-    dst->AddState(ax::mojom::State::kInvisible);
-
-  if (o.IsLinked())
-    dst->AddState(ax::mojom::State::kLinked);
-
-  if (o.IsMultiline())
-    dst->AddState(ax::mojom::State::kMultiline);
-
-  if (o.IsMultiSelectable())
-    dst->AddState(ax::mojom::State::kMultiselectable);
-
-  if (o.IsPasswordField())
-    dst->AddState(ax::mojom::State::kProtected);
-
-  if (o.IsRequired())
-    dst->AddState(ax::mojom::State::kRequired);
-
-  if (o.IsEditable())
-    dst->AddState(ax::mojom::State::kEditable);
-
-  if (o.IsSelected() != blink::kWebAXSelectedStateUndefined) {
-    dst->AddBoolAttribute(ax::mojom::BoolAttribute::kSelected,
-                          o.IsSelected() == blink::kWebAXSelectedStateTrue);
-  }
-
-  if (o.IsRichlyEditable())
-    dst->AddState(ax::mojom::State::kRichlyEditable);
-
-  if (o.IsVisited())
-    dst->AddState(ax::mojom::State::kVisited);
-
-  if (o.Orientation() == blink::kWebAXOrientationVertical)
-    dst->AddState(ax::mojom::State::kVertical);
-  else if (o.Orientation() == blink::kWebAXOrientationHorizontal)
-    dst->AddState(ax::mojom::State::kHorizontal);
-
-  if (o.AccessibilityIsIgnored())
-    dst->AddState(ax::mojom::State::kIgnored);
-}
-
-}  // namespace content.
diff --git a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h b/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h
deleted file mode 100644
index 64c32dd3cbb..00000000000
--- a/chromium/content/renderer/accessibility/blink_ax_enum_conversion.h
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
-#define CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
-
-#include <stdint.h>
-
-#include "third_party/blink/public/web/web_ax_object.h"
-#include "ui/accessibility/ax_enums.mojom-forward.h"
-#include "ui/accessibility/ax_node_data.h"
-
-namespace content {
-
-// Provides a conversion between the WebAXObject state
-// accessors and a state bitmask stored in an AXNodeData.
-// (Note that some rare states are sent as boolean attributes
-// in AXNodeData instead.)
-void AXStateFromBlink(const blink::WebAXObject& o, ui::AXNodeData* dst);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
diff --git a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
index 3a89fdbbd6d..370c3edcba2 100644
--- a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -15,9 +15,9 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "content/common/ax_serialization_utils.h"
 #include "content/public/common/content_features.h"
 #include "content/renderer/accessibility/ax_image_annotator.h"
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
 #include "content/renderer/accessibility/render_accessibility_impl.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_frame_proxy.h"
@@ -550,6 +550,10 @@ WebAXObject BlinkAXTreeSource::GetNull() const {
   return WebAXObject();
 }
 
+std::string BlinkAXTreeSource::GetDebugString(blink::WebAXObject node) const {
+  return node.ToString(true).Utf8();
+}
+
 void BlinkAXTreeSource::SerializeNode(WebAXObject src,
                                       AXContentNodeData* dst) const {
 #if DCHECK_IS_ON()
@@ -559,8 +563,12 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
   blink::WebDisallowTransitionScope disallow(&document);
 #endif
 
+  // TODO(crbug.com/1068668): AX onion soup - finish migrating the rest of
+  // this function inside of AXObject::Serialize and removing
+  // unneeded WebAXObject interfaces.
+  src.Serialize(dst);
+
   dst->role = src.Role();
-  AXStateFromBlink(src, dst);
   dst->id = src.AxID();
 
   TRACE_EVENT1("accessibility", "BlinkAXTreeSource::SerializeNode", "role",
@@ -573,8 +581,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
   src.GetRelativeBounds(offset_container, bounds_in_container,
                         container_transform, &clips_children);
   dst->relative_bounds.bounds = bounds_in_container;
-#if !defined(OS_ANDROID) && !defined(OS_MACOSX)
-  if (src.Equals(root())) {
+  if (content::AXShouldIncludePageScaleFactorInRoot() && src.Equals(root())) {
     WebView* web_view = render_frame_->GetRenderView()->GetWebView();
     std::unique_ptr<gfx::Transform> container_transform_gfx =
         std::make_unique<gfx::Transform>(container_transform);
@@ -584,14 +591,10 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
         -web_view->VisualViewportOffset().OffsetFromOrigin());
     if (!container_transform_gfx->IsIdentity())
       dst->relative_bounds.transform = std::move(container_transform_gfx);
-  } else if (!container_transform.isIdentity())
+  } else if (!container_transform.isIdentity()) {
     dst->relative_bounds.transform =
         base::WrapUnique(new gfx::Transform(container_transform));
-#else
-  if (!container_transform.isIdentity())
-    dst->relative_bounds.transform =
-        base::WrapUnique(new gfx::Transform(container_transform));
-#endif  // !defined(OS_ANDROID) && !defined(OS_MACOSX)
+  }
   if (!offset_container.IsDetached())
     dst->relative_bounds.offset_container_id = offset_container.AxID();
   if (clips_children)
@@ -958,7 +961,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
         dst->role == ax::mojom::Role::kSlider ||
         dst->role == ax::mojom::Role::kSpinButton ||
         (dst->role == ax::mojom::Role::kSplitter &&
-         src.CanSetFocusAttribute())) {
+         dst->HasState(ax::mojom::State::kFocusable))) {
       float value;
       if (src.ValueForRange(&value))
         dst->AddFloatAttribute(ax::mojom::FloatAttribute::kValueForRange,
@@ -983,8 +986,7 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       }
     }
 
-    if (dst->role == ax::mojom::Role::kDialog ||
-        dst->role == ax::mojom::Role::kAlertDialog) {
+    if (ui::IsDialog(dst->role)) {
       dst->AddBoolAttribute(ax::mojom::BoolAttribute::kModal, src.IsModal());
     }
 
@@ -994,42 +996,32 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
 
     const bool is_table_like_role = ui::IsTableLike(dst->role);
     if (is_table_like_role) {
-      int column_count = src.ColumnCount();
-      int row_count = src.RowCount();
-      if (column_count > 0 && row_count > 0) {
-        dst->AddIntAttribute(ax::mojom::IntAttribute::kTableColumnCount,
-                             column_count);
-        dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowCount,
-                             row_count);
-      }
-
       int aria_colcount = src.AriaColumnCount();
-      if (aria_colcount)
+      if (aria_colcount) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaColumnCount,
                              aria_colcount);
+      }
 
       int aria_rowcount = src.AriaRowCount();
-      if (aria_rowcount)
+      if (aria_rowcount) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaRowCount,
                              aria_rowcount);
+      }
     }
 
     if (ui::IsTableRow(dst->role)) {
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowIndex,
-                           src.RowIndex());
       WebAXObject header = src.RowHeader();
-      if (!header.IsDetached())
+      if (!header.IsDetached()) {
+        // TODO(accessibility): these should be computed by ui::AXTableInfo and
+        // removed here.
         dst->AddIntAttribute(ax::mojom::IntAttribute::kTableRowHeaderId,
                              header.AxID());
+      }
     }
 
     if (ui::IsCellOrTableHeader(dst->role)) {
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellColumnIndex,
-                           src.CellColumnIndex());
       dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellColumnSpan,
                            src.CellColumnSpan());
-      dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellRowIndex,
-                           src.CellRowIndex());
       dst->AddIntAttribute(ax::mojom::IntAttribute::kTableCellRowSpan,
                            src.CellRowSpan());
     }
@@ -1038,9 +1030,10 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       // aria-rowindex and aria-colindex are supported on cells, headers and
       // rows.
       int aria_rowindex = src.AriaRowIndex();
-      if (aria_rowindex)
+      if (aria_rowindex) {
         dst->AddIntAttribute(ax::mojom::IntAttribute::kAriaCellRowIndex,
                              aria_rowindex);
+      }
 
       int aria_colindex = src.AriaColumnIndex();
       if (aria_colindex) {
@@ -1124,7 +1117,8 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
       if (src.IsEditableRoot())
         dst->AddBoolAttribute(ax::mojom::BoolAttribute::kEditableRoot, true);
 
-      if (src.IsControl() && !src.IsRichlyEditable()) {
+      if (src.IsControl() &&
+          !dst->HasState(ax::mojom::State::kRichlyEditable)) {
         // Only for simple input controls -- rich editable areas use AXTreeData.
           dst->AddIntAttribute(ax::mojom::IntAttribute::kTextSelStart,
                                src.SelectionStart());
@@ -1148,9 +1142,13 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
     if (src.HasAriaAttribute())
       dst->AddBoolAttribute(ax::mojom::BoolAttribute::kHasAriaAttribute, true);
 
-    // Frames and iframes.
+    // Frames and iframes:
+    // If there are children, the fallback content has been rendered and should
+    // be used instead. For example, the fallback content may be rendered if
+    // there was an error loading an <object>. In that case, only expose the
+    // children. A node should not have both children and a child tree.
     WebFrame* frame = WebFrame::FromFrameOwnerElement(element);
-    if (frame)
+    if (frame && !src.ChildCount())
       dst->child_routing_id = RenderFrame::GetRoutingIdForWebFrame(frame);
   }
 
diff --git a/chromium/content/renderer/accessibility/blink_ax_tree_source.h b/chromium/content/renderer/accessibility/blink_ax_tree_source.h
index 97f20cbf8a5..1cfefe0cbe8 100644
--- a/chromium/content/renderer/accessibility/blink_ax_tree_source.h
+++ b/chromium/content/renderer/accessibility/blink_ax_tree_source.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include <set>
+#include <string>
 
 #include "base/optional.h"
 #include "content/common/ax_content_node_data.h"
@@ -112,6 +113,7 @@ class BlinkAXTreeSource
   bool IsEqual(blink::WebAXObject node1,
                blink::WebAXObject node2) const override;
   blink::WebAXObject GetNull() const override;
+  std::string GetDebugString(blink::WebAXObject node) const override;
 
   blink::WebDocument GetMainDocument() const;
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl.cc b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
index 4d9d7604deb..a504fc800b9 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
@@ -7,7 +7,9 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <memory>
+#include <algorithm>
+#include <set>
+#include <string>
 #include <utility>
 
 #include "base/bind.h"
@@ -24,7 +26,6 @@
 #include "content/renderer/accessibility/ax_action_target_factory.h"
 #include "content/renderer/accessibility/ax_image_annotator.h"
 #include "content/renderer/accessibility/blink_ax_action_target.h"
-#include "content/renderer/accessibility/blink_ax_enum_conversion.h"
 #include "content/renderer/accessibility/render_accessibility_manager.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_frame_proxy.h"
@@ -39,7 +40,7 @@
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/accessibility/accessibility_switches.h"
 #include "ui/accessibility/ax_enum_util.h"
-#include "ui/accessibility/ax_event.h"
+#include "ui/accessibility/ax_event_intent.h"
 #include "ui/accessibility/ax_node.h"
 #include "ui/accessibility/ax_role_properties.h"
 
@@ -72,12 +73,6 @@ void SetAccessibilityCrashKey(ui::AXMode mode) {
     base::debug::SetCrashKeyString(ax_mode_crash_key, mode.ToString());
 }
 
-// Returns the first language in the accept languages list.
-std::string GetPreferredLanguage(const std::string& accept_languages) {
-  const std::vector<std::string> tokens = base::SplitString(
-      accept_languages, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
-  return tokens.empty() ? "" : tokens[0];
-}
 }
 
 namespace content {
@@ -208,18 +203,14 @@ RenderAccessibilityImpl::RenderAccessibilityImpl(
     // It's possible that the webview has already loaded a webpage without
     // accessibility being enabled. Initialize the browser's cached
     // accessibility tree by sending it a notification.
-    HandleAXEvent(WebAXObject::FromWebDocument(document),
-                  ax::mojom::Event::kLayoutComplete);
+    WebAXObject root_object = WebAXObject::FromWebDocument(document);
+    HandleAXEvent(
+        ui::AXEvent(root_object.AxID(), ax::mojom::Event::kLayoutComplete));
   }
 
   image_annotation_debugging_ =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           ::switches::kEnableExperimentalAccessibilityLabelsDebugging);
-
-  if (render_frame->render_view()) {
-    render_frame_->render_view()->RegisterRendererPreferenceWatcher(
-        pref_watcher_receiver_.BindNewPipeAndPassRemote());
-  }
 }
 
 RenderAccessibilityImpl::~RenderAccessibilityImpl() = default;
@@ -244,6 +235,7 @@ void RenderAccessibilityImpl::DidCommitProvisionalLoad(
   tree_source_.RemoveImageAnnotator();
   ax_image_annotator_->Destroy();
   ax_image_annotator_.release();
+  page_language_.clear();
 }
 
 void RenderAccessibilityImpl::AccessibilityModeChanged(const ui::AXMode& mode) {
@@ -282,11 +274,11 @@ void RenderAccessibilityImpl::AccessibilityModeChanged(const ui::AXMode& mode) {
     // If there are any events in flight, |HandleAXEvent| will refuse to process
     // our new event.
     pending_events_.clear();
-    auto webax_object = WebAXObject::FromWebDocument(document);
-    ax::mojom::Event event = webax_object.IsLoaded()
+    auto root_object = WebAXObject::FromWebDocument(document);
+    ax::mojom::Event event = root_object.IsLoaded()
                                  ? ax::mojom::Event::kLoadComplete
                                  : ax::mojom::Event::kLayoutComplete;
-    HandleAXEvent(webax_object, event);
+    HandleAXEvent(ui::AXEvent(root_object.AxID(), event));
   }
 }
 
@@ -318,8 +310,10 @@ void RenderAccessibilityImpl::HitTest(
   tree_source_.SerializeNode(ax_object, &data);
   if (data.child_routing_id == MSG_ROUTING_NONE) {
     // Otherwise, send an event on the node that was hit.
-    HandleAXEvent(ax_object, action_data.hit_test_event_to_fire,
-                  ax::mojom::EventFrom::kAction, action_data.request_id);
+    const std::vector<ui::AXEventIntent> intents;
+    HandleAXEvent(ui::AXEvent(
+        ax_object.AxID(), action_data.hit_test_event_to_fire,
+        ax::mojom::EventFrom::kAction, intents, action_data.request_id));
 
     // The mojo message still needs a reply.
     std::move(callback).Run(/*child_frame_hit_test_info=*/nullptr);
@@ -412,7 +406,8 @@ void RenderAccessibilityImpl::PerformAction(const ui::AXActionData& data) {
     case ax::mojom::Action::kSetSelection:
       anchor->SetSelection(anchor.get(), data.anchor_offset, focus.get(),
                            data.focus_offset);
-      HandleAXEvent(root, ax::mojom::Event::kLayoutComplete);
+      HandleAXEvent(
+          ui::AXEvent(root.AxID(), ax::mojom::Event::kLayoutComplete));
       break;
     case ax::mojom::Action::kSetSequentialFocusNavigationStartingPoint:
       target->SetSequentialFocusNavigationStartingPoint();
@@ -455,7 +450,7 @@ void RenderAccessibilityImpl::PerformAction(const ui::AXActionData& data) {
       // Wait for 100ms to allow pending events to come in
       base::PlatformThread::Sleep(base::TimeDelta::FromMilliseconds(100));
 
-      HandleAXEvent(root, ax::mojom::Event::kEndOfTest);
+      HandleAXEvent(ui::AXEvent(root.AxID(), ax::mojom::Event::kEndOfTest));
       break;
     case ax::mojom::Action::kShowTooltip:
     case ax::mojom::Action::kHideTooltip:
@@ -473,26 +468,17 @@ void RenderAccessibilityImpl::Reset(int32_t reset_token) {
   if (!document.IsNull()) {
     // Tree-only mode gets used by the automation extension API which requires a
     // load complete event to invoke listener callbacks.
-    auto webax_object = WebAXObject::FromWebDocument(document);
-    ax::mojom::Event evt = webax_object.IsLoaded()
-                               ? ax::mojom::Event::kLoadComplete
-                               : ax::mojom::Event::kLayoutComplete;
-    HandleAXEvent(webax_object, evt);
+    auto root_object = WebAXObject::FromWebDocument(document);
+    ax::mojom::Event event = root_object.IsLoaded()
+                                 ? ax::mojom::Event::kLoadComplete
+                                 : ax::mojom::Event::kLayoutComplete;
+    HandleAXEvent(ui::AXEvent(root_object.AxID(), event));
   }
 }
 
-void RenderAccessibilityImpl::NotifyUpdate(
-    blink::mojom::RendererPreferencesPtr new_prefs) {
-  if (ax_image_annotator_)
-    ax_image_annotator_->set_preferred_language(
-        GetPreferredLanguage(new_prefs->accept_languages));
-}
-
 void RenderAccessibilityImpl::HandleWebAccessibilityEvent(
-    const WebAXObject& obj,
-    ax::mojom::Event event,
-    ax::mojom::EventFrom event_from) {
-  HandleAXEvent(obj, event, event_from);
+    const ui::AXEvent& event) {
+  HandleAXEvent(event);
 }
 
 void RenderAccessibilityImpl::MarkWebAXObjectDirty(const WebAXObject& obj,
@@ -508,14 +494,15 @@ void RenderAccessibilityImpl::MarkWebAXObjectDirty(const WebAXObject& obj,
   ScheduleSendAccessibilityEventsIfNeeded();
 }
 
-void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
-                                            ax::mojom::Event event,
-                                            ax::mojom::EventFrom event_from,
-                                            int action_request_id) {
+void RenderAccessibilityImpl::HandleAXEvent(const ui::AXEvent& event) {
   const WebDocument& document = GetMainDocument();
   if (document.IsNull())
     return;
 
+  auto obj = WebAXObject::FromWebDocumentByID(document, event.id);
+  if (obj.IsDetached())
+    return;
+
   if (document.GetFrame()) {
     gfx::Size scroll_offset = document.GetFrame()->GetScrollOffset();
     if (scroll_offset != last_scroll_offset_) {
@@ -525,10 +512,11 @@ void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
       // TODO(dmazzoni): remove this as soon as
       // https://bugs.webkit.org/show_bug.cgi?id=73460 is fixed.
       last_scroll_offset_ = scroll_offset;
-      auto webax_object = WebAXObject::FromWebDocument(document);
-      if (!obj.Equals(webax_object)) {
-        HandleAXEvent(webax_object, ax::mojom::Event::kLayoutComplete,
-                      event_from);
+      auto root_object = WebAXObject::FromWebDocument(document);
+      if (!obj.Equals(root_object)) {
+        HandleAXEvent(ui::AXEvent(root_object.AxID(),
+                                  ax::mojom::Event::kLayoutComplete,
+                                  event.event_from));
       }
     }
   }
@@ -536,47 +524,30 @@ void RenderAccessibilityImpl::HandleAXEvent(const WebAXObject& obj,
 #if defined(OS_ANDROID)
   // Force the newly focused node to be re-serialized so we include its
   // inline text boxes.
-  if (event == ax::mojom::Event::kFocus)
+  if (event.event_type == ax::mojom::Event::kFocus)
     serializer_.InvalidateSubtree(obj);
 #endif
 
-  // If some cell IDs have been added or removed, we need to update the whole
-  // table.
-  if (obj.Role() == ax::mojom::Role::kRow &&
-      event == ax::mojom::Event::kChildrenChanged) {
-    WebAXObject table_like_object = obj.ParentObject();
-    if (!table_like_object.IsDetached()) {
-      serializer_.InvalidateSubtree(table_like_object);
-      HandleAXEvent(table_like_object, ax::mojom::Event::kChildrenChanged);
-    }
-  }
-
   // If a select tag is opened or closed, all the children must be updated
   // because their visibility may have changed.
   if (obj.Role() == ax::mojom::Role::kMenuListPopup &&
-      event == ax::mojom::Event::kChildrenChanged) {
+      event.event_type == ax::mojom::Event::kChildrenChanged) {
     WebAXObject popup_like_object = obj.ParentObject();
     if (!popup_like_object.IsDetached()) {
       serializer_.InvalidateSubtree(popup_like_object);
-      HandleAXEvent(popup_like_object, ax::mojom::Event::kChildrenChanged);
+      HandleAXEvent(ui::AXEvent(popup_like_object.AxID(),
+                                ax::mojom::Event::kChildrenChanged));
     }
   }
 
-  // Add the accessibility object to our cache and ensure it's valid.
-  ui::AXEvent acc_event;
-  acc_event.id = obj.AxID();
-  acc_event.event_type = event;
-  acc_event.event_from = event_from;
-  acc_event.action_request_id = action_request_id;
-
   // Discard duplicate accessibility events.
-  for (uint32_t i = 0; i < pending_events_.size(); ++i) {
-    if (pending_events_[i].id == acc_event.id &&
-        pending_events_[i].event_type == acc_event.event_type) {
+  for (const ui::AXEvent& pending_event : pending_events_) {
+    if (pending_event.id == event.id &&
+        pending_event.event_type == event.event_type) {
       return;
     }
   }
-  pending_events_.push_back(acc_event);
+  pending_events_.push_back(event);
 
   ScheduleSendAccessibilityEventsIfNeeded();
 }
@@ -635,7 +606,8 @@ void RenderAccessibilityImpl::OnPluginRootNodeUpdated() {
     if (!node.IsNull() && node.IsElementNode()) {
       WebElement element = node.To<WebElement>();
       if (element.HasHTMLTagName("embed")) {
-        HandleAXEvent(obj, ax::mojom::Event::kChildrenChanged);
+        HandleAXEvent(
+            ui::AXEvent(obj.AxID(), ax::mojom::Event::kChildrenChanged));
         break;
       }
     }
@@ -654,6 +626,10 @@ WebDocument RenderAccessibilityImpl::GetMainDocument() {
   return WebDocument();
 }
 
+std::string RenderAccessibilityImpl::GetLanguage() {
+  return page_language_;
+}
+
 void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
   TRACE_EVENT0("accessibility",
                "RenderAccessibilityImpl::SendPendingAccessibilityEvents");
@@ -689,6 +665,10 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
 
   ScopedFreezeBlinkAXTreeSource freeze(&tree_source_);
 
+  // Save the page language.
+  WebAXObject root = tree_source_.GetRoot();
+  page_language_ = root.Language().Utf8();
+
   // Loop over each event and generate an updated event message.
   for (auto& event : src_events) {
     if (event.event_type == ax::mojom::Event::kLayoutComplete)
@@ -750,18 +730,6 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
 
     events.push_back(event);
 
-    // Whenever there's a change within a table, invalidate the
-    // whole table so that row and cell indexes are recomputed.
-    const ax::mojom::Role role = obj.Role();
-    if (ui::IsTableLike(role) || role == ax::mojom::Role::kRow ||
-        ui::IsCellOrTableHeader(role)) {
-      auto table = obj;
-      while (!table.IsDetached() && !ui::IsTableLike(table.Role()))
-        table = table.ParentObject();
-      if (!table.IsDetached())
-        serializer_.InvalidateSubtree(table);
-    }
-
     VLOG(1) << "Accessibility event: " << ui::ToString(event.event_type)
             << " on node id " << event.id;
 
@@ -949,7 +917,7 @@ void RenderAccessibilityImpl::OnLoadInlineTextBoxes(
   serializer_.InvalidateSubtree(obj);
 
   // Explicitly send a tree change update event now.
-  HandleAXEvent(obj, ax::mojom::Event::kTreeChanged);
+  HandleAXEvent(ui::AXEvent(obj.AxID(), ax::mojom::Event::kTreeChanged));
 }
 
 void RenderAccessibilityImpl::OnGetImageData(const ui::AXActionTarget* target,
@@ -972,7 +940,7 @@ void RenderAccessibilityImpl::OnGetImageData(const ui::AXActionTarget* target,
     return;
 
   serializer_.InvalidateSubtree(obj);
-  HandleAXEvent(obj, ax::mojom::Event::kImageFrameUpdated);
+  HandleAXEvent(ui::AXEvent(obj.AxID(), ax::mojom::Event::kImageFrameUpdated));
 }
 
 void RenderAccessibilityImpl::OnDestruct() {
@@ -1021,13 +989,8 @@ void RenderAccessibilityImpl::CreateAXImageAnnotator() {
   render_frame_->GetBrowserInterfaceBroker()->GetInterface(
       annotator.InitWithNewPipeAndPassReceiver());
 
-  const std::string preferred_language =
-      render_frame_->render_view()
-          ? GetPreferredLanguage(
-                render_frame_->render_view()->GetAcceptLanguages())
-          : std::string();
-  ax_image_annotator_ = std::make_unique<AXImageAnnotator>(
-      this, preferred_language, std::move(annotator));
+  ax_image_annotator_ =
+      std::make_unique<AXImageAnnotator>(this, std::move(annotator));
   tree_source_.AddImageAnnotator(ax_image_annotator_.get());
 }
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl.h b/chromium/content/renderer/accessibility/render_accessibility_impl.h
index f064ebf3119..47814c1adcc 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl.h
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 #define CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 
+#include <memory>
 #include <unordered_map>
 #include <vector>
 
@@ -18,9 +19,9 @@
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/renderer/accessibility/blink_ax_tree_source.h"
-#include "third_party/blink/public/mojom/renderer_preference_watcher.mojom.h"
 #include "third_party/blink/public/web/web_ax_context.h"
 #include "third_party/blink/public/web/web_ax_object.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_relative_bounds.h"
 #include "ui/accessibility/ax_tree.h"
 #include "ui/accessibility/ax_tree_serializer.h"
@@ -91,10 +92,8 @@ class AXTreeSnapshotterImpl : public AXTreeSnapshotter {
 // representation of that tree whenever it changes. It also handles requests
 // from the browser to perform accessibility actions on nodes in the tree (e.g.,
 // change focus, or click on a button).
-class CONTENT_EXPORT RenderAccessibilityImpl
-    : public RenderAccessibility,
-      public RenderFrameObserver,
-      public blink::mojom::RendererPreferenceWatcher {
+class CONTENT_EXPORT RenderAccessibilityImpl : public RenderAccessibility,
+                                               public RenderFrameObserver {
  public:
   // Request a one-time snapshot of the accessibility tree without
   // enabling accessibility if it wasn't already enabled.
@@ -128,25 +127,19 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   void PerformAction(const ui::AXActionData& data);
   void Reset(int32_t reset_token);
 
-  // blink::mojom::RendererPreferenceObserver implementation.
-  void NotifyUpdate(blink::mojom::RendererPreferencesPtr new_prefs) override;
-
   // Called when an accessibility notification occurs in Blink.
-  void HandleWebAccessibilityEvent(const blink::WebAXObject& obj,
-                                   ax::mojom::Event event,
-                                   ax::mojom::EventFrom event_from);
+  void HandleWebAccessibilityEvent(const ui::AXEvent& event);
   void MarkWebAXObjectDirty(const blink::WebAXObject& obj, bool subtree);
 
-  void HandleAXEvent(
-      const blink::WebAXObject& obj,
-      ax::mojom::Event event,
-      ax::mojom::EventFrom event_from = ax::mojom::EventFrom::kNone,
-      int action_request_id = -1);
+  void HandleAXEvent(const ui::AXEvent& event);
 
   // Returns the main top-level document for this page, or NULL if there's
   // no view or frame.
   blink::WebDocument GetMainDocument();
 
+  // Returns the page language.
+  std::string GetLanguage();
+
  protected:
   // Send queued events from the renderer to the browser.
   void SendPendingAccessibilityEvents();
@@ -210,10 +203,6 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   // Manages the automatic image annotations, if enabled.
   std::unique_ptr<AXImageAnnotator> ax_image_annotator_;
 
-  // The Mojo receiver for this object as a RenderPreferenceWatcher.
-  mojo::Receiver<blink::mojom::RendererPreferenceWatcher>
-      pref_watcher_receiver_{this};
-
   // Events from Blink are collected until they are ready to be
   // sent to the browser.
   std::vector<ui::AXEvent> pending_events_;
@@ -259,6 +248,9 @@ class CONTENT_EXPORT RenderAccessibilityImpl
   // for debugging.
   bool image_annotation_debugging_ = false;
 
+  // The specified page language, or empty if unknown.
+  std::string page_language_;
+
   // So we can queue up tasks to be executed later.
   base::WeakPtrFactory<RenderAccessibilityImpl> weak_factory_{this};
 
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
index b46fb4e0342..3781c691064 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
@@ -50,6 +50,8 @@
 #include "third_party/blink/public/web/web_node.h"
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/accessibility/ax_action_target.h"
+#include "ui/accessibility/ax_enums.mojom.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/null_ax_action_target.h"
@@ -61,13 +63,24 @@ using blink::WebAXObject;
 using blink::WebDocument;
 using testing::ElementsAre;
 
+namespace {
+
+#if !defined(OS_ANDROID)
+bool IsSelected(const WebAXObject& obj) {
+  ui::AXNodeData node_data;
+  obj.Serialize(&node_data);
+  return node_data.GetBoolAttribute(ax::mojom::BoolAttribute::kSelected);
+}
+#endif  // !defined(OS_ANDROID)
+
+}  // namespace
+
 class TestAXImageAnnotator : public AXImageAnnotator {
  public:
   TestAXImageAnnotator(
       RenderAccessibilityImpl* const render_accessibility,
       mojo::PendingRemote<image_annotation::mojom::Annotator> annotator)
       : AXImageAnnotator(render_accessibility,
-                         std::string() /* preferred_language */,
                          std::move(annotator)) {}
   ~TestAXImageAnnotator() override = default;
 
@@ -262,7 +275,7 @@ class RenderAccessibilityImplTest : public RenderViewTest {
     WebAXObject root_obj = WebAXObject::FromWebDocument(document);
     EXPECT_FALSE(root_obj.IsNull());
     GetRenderAccessibilityImpl()->HandleAXEvent(
-        root_obj, ax::mojom::Event::kLayoutComplete);
+        ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
     SendPendingAccessibilityEvents();
   }
 
@@ -356,7 +369,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   WebDocument document = GetMainFrame()->GetDocument();
   WebAXObject root_obj = WebAXObject::FromWebDocument(document);
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      root_obj, ax::mojom::Event::kLayoutComplete);
+      ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(1, CountAccessibilityNodesSentToBrowser());
   {
@@ -373,7 +386,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   root_obj = WebAXObject::FromWebDocument(document);
   ClearHandledUpdates();
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      root_obj, ax::mojom::Event::kLayoutComplete);
+      ui::AXEvent(root_obj.AxID(), ax::mojom::Event::kLayoutComplete));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(5, CountAccessibilityNodesSentToBrowser());
 
@@ -386,7 +399,7 @@ TEST_F(RenderAccessibilityImplTest, SendFullAccessibilityTreeOnReload) {
   ClearHandledUpdates();
   const WebAXObject& first_child = root_obj.ChildAt(0);
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      first_child, ax::mojom::Event::kLiveRegionChanged);
+      ui::AXEvent(first_child.AxID(), ax::mojom::Event::kLiveRegionChanged));
   SendPendingAccessibilityEvents();
   EXPECT_EQ(5, CountAccessibilityNodesSentToBrowser());
 }
@@ -424,7 +437,7 @@ TEST_F(RenderAccessibilityImplTest, HideAccessibilityObject) {
   // Send a childrenChanged on "A".
   ClearHandledUpdates();
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      node_a, ax::mojom::Event::kChildrenChanged);
+      ui::AXEvent(node_a.AxID(), ax::mojom::Event::kChildrenChanged));
   SendPendingAccessibilityEvents();
   AXContentTreeUpdate update = GetLastAccUpdate();
   ASSERT_EQ(2U, update.nodes.size());
@@ -472,7 +485,7 @@ TEST_F(RenderAccessibilityImplTest, ShowAccessibilityObject) {
   ClearHandledUpdates();
 
   GetRenderAccessibilityImpl()->HandleAXEvent(
-      node_a, ax::mojom::Event::kChildrenChanged);
+      ui::AXEvent(node_a.AxID(), ax::mojom::Event::kChildrenChanged));
   SendPendingAccessibilityEvents();
   AXContentTreeUpdate update = GetLastAccUpdate();
 
@@ -708,9 +721,9 @@ TEST_F(BlinkAXActionTargetTest, TestMethods) {
 
   // Android does not produce accessible items for option elements.
 #if !defined(OS_ANDROID)
-  EXPECT_EQ(blink::kWebAXSelectedStateFalse, option.IsSelected());
+  EXPECT_FALSE(IsSelected(option));
   EXPECT_TRUE(option_action_target->SetSelected(true));
-  EXPECT_EQ(blink::kWebAXSelectedStateTrue, option.IsSelected());
+  EXPECT_TRUE(IsSelected(option));
 #endif
 
   std::string value_to_set("test-value");
diff --git a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
index 1716c649c2c..d002a87ab24 100644
--- a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
+++ b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
@@ -8,9 +8,10 @@
 
 #include "base/auto_reset.h"
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "cc/trees/layer_tree_frame_sink_client.h"
@@ -137,7 +138,9 @@ class SynchronousLayerTreeFrameSink::SoftwareOutputSurface
 };
 
 base::TimeDelta SynchronousLayerTreeFrameSink::StubDisplayClient::
-    GetPreferredFrameIntervalForFrameSinkId(const viz::FrameSinkId& id) {
+    GetPreferredFrameIntervalForFrameSinkId(
+        const viz::FrameSinkId& id,
+        viz::mojom::CompositorFrameSinkType* type) {
   return viz::BeginFrameArgs::MinInterval();
 }
 
diff --git a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
index 14b9c3b12e1..8e2a2c39220 100644
--- a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
+++ b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.h
@@ -188,9 +188,11 @@ class SynchronousLayerTreeFrameSink
     void DisplayDidReceiveCALayerParams(
         const gfx::CALayerParams& ca_layer_params) override {}
     void DisplayDidCompleteSwapWithSize(const gfx::Size& pixel_size) override {}
+    void SetWideColorEnabled(bool enabled) override {}
     void SetPreferredFrameInterval(base::TimeDelta interval) override {}
     base::TimeDelta GetPreferredFrameIntervalForFrameSinkId(
-        const viz::FrameSinkId& id) override;
+        const viz::FrameSinkId& id,
+        viz::mojom::CompositorFrameSinkType* type) override;
   };
 
   // TODO(danakj): These don't to be stored in unique_ptrs when OutputSurface
diff --git a/chromium/content/renderer/browser_render_view_browsertest.cc b/chromium/content/renderer/browser_render_view_browsertest.cc
index 28e0505c030..7431feb78d8 100644
--- a/chromium/content/renderer/browser_render_view_browsertest.cc
+++ b/chromium/content/renderer/browser_render_view_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_view.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -156,18 +157,8 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   GURL test_url(embedded_test_server()->GetURL("/nocache-with-etag.html"));
   NavigateToURLAndWaitForTitle(test_url, "Nocache Test Page", 1);
 
-  // Reload same URL after forcing an error from the the network layer;
-  // confirm that the error page is told the cached copy exists.
-  {
-    mojo::ScopedAllowSyncCallForTesting allow_sync_call;
-    content::StoragePartition* partition = shell()
-                                               ->web_contents()
-                                               ->GetMainFrame()
-                                               ->GetProcess()
-                                               ->GetStoragePartition();
-    partition->GetNetworkContext()->SetFailingHttpTransactionForTesting(
-        net::ERR_FAILED);
-  }
+  // Shut down the server to force a network error.
+  ASSERT_TRUE(embedded_test_server()->ShutdownAndWaitUntilComplete());
 
   // An error results in one completed navigation.
   NavigateToURLBlockUntilNavigationsComplete(shell(), test_url, 1);
@@ -175,7 +166,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   bool stale_cache_entry_present = false;
   ASSERT_TRUE(GetLatestErrorFromRendererClient(
       &error_code, &stale_cache_entry_present));
-  EXPECT_EQ(net::ERR_FAILED, error_code);
+  EXPECT_EQ(net::ERR_CONNECTION_REFUSED, error_code);
   EXPECT_TRUE(stale_cache_entry_present);
 
   // Clear the cache and repeat; confirm lack of entry in cache reported.
@@ -198,7 +189,7 @@ IN_PROC_BROWSER_TEST_F(RenderViewBrowserTest,
   stale_cache_entry_present = true;
   ASSERT_TRUE(GetLatestErrorFromRendererClient(
       &error_code, &stale_cache_entry_present));
-  EXPECT_EQ(net::ERR_FAILED, error_code);
+  EXPECT_EQ(net::ERR_CONNECTION_REFUSED, error_code);
   EXPECT_FALSE(stale_cache_entry_present);
 }
 
diff --git a/chromium/content/renderer/categorized_worker_pool.cc b/chromium/content/renderer/categorized_worker_pool.cc
index 7e010566456..7ada1cfffac 100644
--- a/chromium/content/renderer/categorized_worker_pool.cc
+++ b/chromium/content/renderer/categorized_worker_pool.cc
@@ -239,9 +239,10 @@ bool CategorizedWorkerPool::PostDelayedTask(const base::Location& from_here,
   DCHECK(completed_tasks_.empty());
   CollectCompletedTasksWithLockAcquired(namespace_token_, &completed_tasks_);
 
-  base::EraseIf(tasks_, [this](const scoped_refptr<cc::Task>& e) {
-    return base::Contains(this->completed_tasks_, e);
-  });
+  base::EraseIf(tasks_, [this](const scoped_refptr<cc::Task>& e)
+                            EXCLUSIVE_LOCKS_REQUIRED(lock_) {
+                              return base::Contains(this->completed_tasks_, e);
+                            });
 
   tasks_.push_back(base::MakeRefCounted<ClosureTask>(std::move(task)));
   graph_.Reset();
diff --git a/chromium/content/renderer/categorized_worker_pool.h b/chromium/content/renderer/categorized_worker_pool.h
index 24c1b2a0f54..ab0b9959702 100644
--- a/chromium/content/renderer/categorized_worker_pool.h
+++ b/chromium/content/renderer/categorized_worker_pool.h
@@ -12,6 +12,7 @@
 #include "base/sequenced_task_runner.h"
 #include "base/synchronization/condition_variable.h"
 #include "base/task_runner.h"
+#include "base/thread_annotations.h"
 #include "base/threading/simple_thread.h"
 #include "cc/raster/task_category.h"
 #include "cc/raster/task_graph_runner.h"
@@ -104,25 +105,31 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   };
 
   void ScheduleTasksWithLockAcquired(cc::NamespaceToken token,
-                                     cc::TaskGraph* graph);
+                                     cc::TaskGraph* graph)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
   void CollectCompletedTasksWithLockAcquired(cc::NamespaceToken token,
-                                             cc::Task::Vector* completed_tasks);
+                                             cc::Task::Vector* completed_tasks)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Runs a task from one of the provided categories. Categories listed first
   // have higher priority. Returns false if there were no tasks to run.
-  bool RunTaskWithLockAcquired(const std::vector<cc::TaskCategory>& categories);
+  bool RunTaskWithLockAcquired(const std::vector<cc::TaskCategory>& categories)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Run next task for the given category. Caller must acquire |lock_| prior to
   // calling this function and make sure at least one task is ready to run.
-  void RunTaskInCategoryWithLockAcquired(cc::TaskCategory category);
+  void RunTaskInCategoryWithLockAcquired(cc::TaskCategory category)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Helper function which signals worker threads if tasks are ready to run.
-  void SignalHasReadyToRunTasksWithLockAcquired();
+  void SignalHasReadyToRunTasksWithLockAcquired()
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Determines if we should run a new task for the given category. This factors
   // in whether a task is available and whether the count of running tasks is
   // low enough to start a new one.
-  bool ShouldRunTaskForCategoryWithLockAcquired(cc::TaskCategory category);
+  bool ShouldRunTaskForCategoryWithLockAcquired(cc::TaskCategory category)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // The actual threads where work is done.
   std::vector<std::unique_ptr<base::SimpleThread>> threads_;
@@ -131,16 +138,16 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   // implement the TaskRunner and TaskGraphRunner interfaces.
   base::Lock lock_;
   // Stores the tasks to be run, sorted by priority.
-  cc::TaskGraphWorkQueue work_queue_;
+  cc::TaskGraphWorkQueue work_queue_ GUARDED_BY(lock_);
   // Namespace used to schedule tasks in the task graph runner.
-  cc::NamespaceToken namespace_token_;
+  const cc::NamespaceToken namespace_token_;
   // List of tasks currently queued up for execution.
-  cc::Task::Vector tasks_;
+  cc::Task::Vector tasks_ GUARDED_BY(lock_);
   // Graph object used for scheduling tasks.
-  cc::TaskGraph graph_;
+  cc::TaskGraph graph_ GUARDED_BY(lock_);
   // Cached vector to avoid allocation when getting the list of complete
   // tasks.
-  cc::Task::Vector completed_tasks_;
+  cc::Task::Vector completed_tasks_ GUARDED_BY(lock_);
   // Condition variables for foreground and background tasks.
   base::ConditionVariable has_ready_to_run_foreground_tasks_cv_;
   base::ConditionVariable has_ready_to_run_background_tasks_cv_;
@@ -148,7 +155,7 @@ class CONTENT_EXPORT CategorizedWorkerPool : public base::TaskRunner,
   // has finished running all associated tasks.
   base::ConditionVariable has_namespaces_with_finished_running_tasks_cv_;
   // Set during shutdown. Tells Run() to return when no more tasks are pending.
-  bool shutdown_;
+  bool shutdown_ GUARDED_BY(lock_);
 
   base::OnceCallback<void(base::PlatformThreadId)> backgrounding_callback_;
   scoped_refptr<base::SingleThreadTaskRunner> background_task_runner_;
diff --git a/chromium/content/renderer/compositor/compositor_dependencies.h b/chromium/content/renderer/compositor/compositor_dependencies.h
index d0e022df4f5..7d00b7c14ac 100644
--- a/chromium/content/renderer/compositor/compositor_dependencies.h
+++ b/chromium/content/renderer/compositor/compositor_dependencies.h
@@ -47,12 +47,7 @@ class CONTENT_EXPORT CompositorDependencies {
   virtual bool IsGpuMemoryBufferCompositorResourcesEnabled() = 0;
   virtual bool IsElasticOverscrollEnabled() = 0;
   virtual bool IsUseZoomForDSFEnabled() = 0;
-  virtual scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorMainThreadTaskRunner() = 0;
-  // Returns null if the compositor is in single-threaded mode (ie. there is no
-  // compositor thread).
-  virtual scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorImplThreadTaskRunner() = 0;
+  virtual bool IsSingleThreaded() = 0;
   virtual scoped_refptr<base::SingleThreadTaskRunner>
   GetCleanupTaskRunner() = 0;
   virtual blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() = 0;
diff --git a/chromium/content/renderer/compositor/layer_tree_view.cc b/chromium/content/renderer/compositor/layer_tree_view.cc
deleted file mode 100644
index d26fe9db351..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view.cc
+++ /dev/null
@@ -1,369 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/compositor/layer_tree_view.h"
-
-#include <stddef.h>
-#include <string>
-#include <utility>
-
-#include "base/auto_reset.h"
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/feature_list.h"
-#include "base/location.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/single_thread_task_runner.h"
-#include "base/task/post_task.h"
-#include "base/task/task_traits.h"
-#include "base/task/thread_pool.h"
-#include "base/task/thread_pool/thread_pool_instance.h"
-#include "base/time/time.h"
-#include "base/values.h"
-#include "cc/animation/animation_host.h"
-#include "cc/animation/animation_timeline.h"
-#include "cc/base/region.h"
-#include "cc/benchmarks/micro_benchmark.h"
-#include "cc/debug/layer_tree_debug_state.h"
-#include "cc/input/layer_selection_bound.h"
-#include "cc/layers/layer.h"
-#include "cc/trees/layer_tree_host.h"
-#include "cc/trees/layer_tree_mutator.h"
-#include "cc/trees/render_frame_metadata_observer.h"
-#include "cc/trees/swap_promise.h"
-#include "cc/trees/ukm_manager.h"
-#include "components/viz/common/frame_sinks/begin_frame_args.h"
-#include "components/viz/common/frame_sinks/begin_frame_source.h"
-#include "components/viz/common/quads/compositor_frame_metadata.h"
-#include "components/viz/common/resources/single_release_callback.h"
-#include "content/renderer/compositor/layer_tree_view_delegate.h"
-#include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_runtime_features.h"
-#include "third_party/blink/public/web/blink.h"
-#include "ui/gfx/presentation_feedback.h"
-
-namespace base {
-class Value;
-}
-
-namespace cc {
-class Layer;
-}
-
-namespace content {
-
-LayerTreeView::LayerTreeView(
-    LayerTreeViewDelegate* delegate,
-    scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-    scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-    cc::TaskGraphRunner* task_graph_runner,
-    blink::scheduler::WebThreadScheduler* scheduler)
-    : main_thread_(std::move(main_thread)),
-      compositor_thread_(std::move(compositor_thread)),
-      task_graph_runner_(task_graph_runner),
-      web_main_thread_scheduler_(scheduler),
-      animation_host_(cc::AnimationHost::CreateMainInstance()),
-      delegate_(delegate) {}
-
-LayerTreeView::~LayerTreeView() = default;
-
-void LayerTreeView::Initialize(
-    const cc::LayerTreeSettings& settings,
-    std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory) {
-  DCHECK(delegate_);
-  const bool is_threaded = !!compositor_thread_;
-
-  cc::LayerTreeHost::InitParams params;
-  params.client = this;
-  params.scheduling_client = this;
-  params.settings = &settings;
-  params.task_graph_runner = task_graph_runner_;
-  params.main_task_runner = main_thread_;
-  params.mutator_host = animation_host_.get();
-  params.ukm_recorder_factory = std::move(ukm_recorder_factory);
-  if (base::ThreadPoolInstance::Get()) {
-    // The image worker thread needs to allow waiting since it makes discardable
-    // shared memory allocations which need to make synchronous calls to the
-    // IO thread.
-    params.image_worker_task_runner =
-        base::ThreadPool::CreateSequencedTaskRunner(
-            {base::WithBaseSyncPrimitives(), base::TaskPriority::USER_VISIBLE,
-             base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN});
-  }
-  if (!is_threaded) {
-    // Single-threaded web tests, and unit tests.
-    layer_tree_host_ =
-        cc::LayerTreeHost::CreateSingleThreaded(this, std::move(params));
-  } else {
-    layer_tree_host_ = cc::LayerTreeHost::CreateThreaded(compositor_thread_,
-                                                         std::move(params));
-  }
-}
-
-void LayerTreeView::Disconnect() {
-  DCHECK(delegate_);
-  // Drop compositor resources immediately, while keeping the compositor alive
-  // until after this class is destroyed.
-  layer_tree_host_->SetVisible(false);
-  layer_tree_host_->ReleaseLayerTreeFrameSink();
-  delegate_ = nullptr;
-}
-
-void LayerTreeView::SetVisible(bool visible) {
-  DCHECK(delegate_);
-  layer_tree_host_->SetVisible(visible);
-
-  if (visible && layer_tree_frame_sink_request_failed_while_invisible_)
-    DidFailToInitializeLayerTreeFrameSink();
-}
-
-void LayerTreeView::SetLayerTreeFrameSink(
-    std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink,
-    std::unique_ptr<cc::RenderFrameMetadataObserver>
-        render_frame_metadata_observer) {
-  DCHECK(delegate_);
-  if (!layer_tree_frame_sink) {
-    DidFailToInitializeLayerTreeFrameSink();
-    return;
-  }
-  if (render_frame_metadata_observer) {
-    layer_tree_host_->SetRenderFrameObserver(
-        std::move(render_frame_metadata_observer));
-  }
-  layer_tree_host_->SetLayerTreeFrameSink(std::move(layer_tree_frame_sink));
-}
-
-void LayerTreeView::WillBeginMainFrame() {
-  if (!delegate_)
-    return;
-  delegate_->WillBeginCompositorFrame();
-}
-
-void LayerTreeView::DidBeginMainFrame() {
-  if (!delegate_)
-    return;
-  delegate_->DidBeginMainFrame();
-}
-
-void LayerTreeView::WillUpdateLayers() {
-  if (!delegate_)
-    return;
-  delegate_->BeginUpdateLayers();
-}
-
-void LayerTreeView::DidUpdateLayers() {
-  if (!delegate_)
-    return;
-  delegate_->EndUpdateLayers();
-  // Dump property trees and layers if run with:
-  //   --vmodule=layer_tree_view=3
-  VLOG(3) << "After updating layers:\n"
-          << "property trees:\n"
-          << layer_tree_host_->property_trees()->ToString() << "\n"
-          << "cc::Layers:\n"
-          << layer_tree_host_->LayersAsString();
-}
-
-void LayerTreeView::BeginMainFrame(const viz::BeginFrameArgs& args) {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->WillBeginFrame(args);
-  delegate_->BeginMainFrame(args.frame_time);
-}
-
-void LayerTreeView::OnDeferMainFrameUpdatesChanged(bool status) {
-  if (!delegate_)
-    return;
-  delegate_->OnDeferMainFrameUpdatesChanged(status);
-}
-
-void LayerTreeView::OnDeferCommitsChanged(bool status) {
-  if (!delegate_)
-    return;
-  delegate_->OnDeferCommitsChanged(status);
-}
-
-void LayerTreeView::BeginMainFrameNotExpectedSoon() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->BeginFrameNotExpectedSoon();
-}
-
-void LayerTreeView::BeginMainFrameNotExpectedUntil(base::TimeTicks time) {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->BeginMainFrameNotExpectedUntil(time);
-}
-
-void LayerTreeView::UpdateLayerTreeHost() {
-  if (!delegate_)
-    return;
-  delegate_->UpdateVisualState();
-}
-
-void LayerTreeView::ApplyViewportChanges(
-    const cc::ApplyViewportChangesArgs& args) {
-  if (!delegate_)
-    return;
-  delegate_->ApplyViewportChanges(args);
-}
-
-void LayerTreeView::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
-  if (!delegate_)
-    return;
-  delegate_->RecordManipulationTypeCounts(info);
-}
-
-void LayerTreeView::SendOverscrollEventFromImplSide(
-    const gfx::Vector2dF& overscroll_delta,
-    cc::ElementId scroll_latched_element_id) {
-  if (!delegate_)
-    return;
-  delegate_->SendOverscrollEventFromImplSide(overscroll_delta,
-                                             scroll_latched_element_id);
-}
-
-void LayerTreeView::SendScrollEndEventFromImplSide(
-    cc::ElementId scroll_latched_element_id) {
-  if (!delegate_)
-    return;
-  delegate_->SendScrollEndEventFromImplSide(scroll_latched_element_id);
-}
-
-void LayerTreeView::RequestNewLayerTreeFrameSink() {
-  if (!delegate_)
-    return;
-  // When the compositor is not visible it would not request a
-  // LayerTreeFrameSink so this is a race where it requested one on the
-  // compositor thread while becoming non-visible on the main thread. In that
-  // case, we can wait for it to become visible again before replying.
-  if (!layer_tree_host_->IsVisible()) {
-    layer_tree_frame_sink_request_failed_while_invisible_ = true;
-    return;
-  }
-
-  delegate_->RequestNewLayerTreeFrameSink(base::BindOnce(
-      &LayerTreeView::SetLayerTreeFrameSink, weak_factory_.GetWeakPtr()));
-}
-
-void LayerTreeView::DidInitializeLayerTreeFrameSink() {}
-
-void LayerTreeView::DidFailToInitializeLayerTreeFrameSink() {
-  if (!delegate_)
-    return;
-  // When the RenderWidget is made hidden while an async request for a
-  // LayerTreeFrameSink is being processed, then if it fails we would arrive
-  // here. Since the compositor does not request a LayerTreeFrameSink while not
-  // visible, we can delay trying again until becoming visible again.
-  if (!layer_tree_host_->IsVisible()) {
-    layer_tree_frame_sink_request_failed_while_invisible_ = true;
-    return;
-  }
-  layer_tree_frame_sink_request_failed_while_invisible_ = false;
-  layer_tree_host_->GetTaskRunnerProvider()->MainThreadTaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&LayerTreeView::RequestNewLayerTreeFrameSink,
-                                weak_factory_.GetWeakPtr()));
-}
-
-void LayerTreeView::WillCommit() {
-  if (!delegate_)
-    return;
-  delegate_->WillCommitCompositorFrame();
-}
-
-void LayerTreeView::DidCommit(base::TimeTicks commit_start_time) {
-  if (!delegate_)
-    return;
-  delegate_->DidCommitCompositorFrame(commit_start_time);
-  web_main_thread_scheduler_->DidCommitFrameToCompositor();
-}
-
-void LayerTreeView::DidCommitAndDrawFrame() {
-  if (!delegate_)
-    return;
-  delegate_->DidCommitAndDrawCompositorFrame();
-}
-
-void LayerTreeView::DidCompletePageScaleAnimation() {
-  if (!delegate_)
-    return;
-  delegate_->DidCompletePageScaleAnimation();
-}
-
-void LayerTreeView::DidPresentCompositorFrame(
-    uint32_t frame_token,
-    const gfx::PresentationFeedback& feedback) {
-  if (!delegate_)
-    return;
-  DCHECK(layer_tree_host_->GetTaskRunnerProvider()
-             ->MainThreadTaskRunner()
-             ->RunsTasksInCurrentSequence());
-  while (!presentation_callbacks_.empty()) {
-    const auto& front = presentation_callbacks_.begin();
-    if (viz::FrameTokenGT(front->first, frame_token))
-      break;
-    for (auto& callback : front->second)
-      std::move(callback).Run(feedback.timestamp);
-    presentation_callbacks_.erase(front);
-  }
-}
-
-void LayerTreeView::RecordStartOfFrameMetrics() {
-  if (!delegate_)
-    return;
-  delegate_->RecordStartOfFrameMetrics();
-}
-
-void LayerTreeView::RecordEndOfFrameMetrics(
-    base::TimeTicks frame_begin_time,
-    cc::ActiveFrameSequenceTrackers trackers) {
-  if (!delegate_)
-    return;
-  delegate_->RecordEndOfFrameMetrics(frame_begin_time, trackers);
-}
-
-std::unique_ptr<cc::BeginMainFrameMetrics>
-LayerTreeView::GetBeginMainFrameMetrics() {
-  if (!delegate_)
-    return nullptr;
-  return delegate_->GetBeginMainFrameMetrics();
-}
-
-void LayerTreeView::DidScheduleBeginMainFrame() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->DidScheduleBeginMainFrame();
-}
-
-void LayerTreeView::DidRunBeginMainFrame() {
-  if (!delegate_)
-    return;
-  web_main_thread_scheduler_->DidRunBeginMainFrame();
-}
-
-void LayerTreeView::DidSubmitCompositorFrame() {}
-
-void LayerTreeView::DidLoseLayerTreeFrameSink() {}
-
-void LayerTreeView::AddPresentationCallback(
-    uint32_t frame_token,
-    base::OnceCallback<void(base::TimeTicks)> callback) {
-  DCHECK(delegate_);
-  if (!presentation_callbacks_.empty()) {
-    auto& previous = presentation_callbacks_.back();
-    uint32_t previous_frame_token = previous.first;
-    if (previous_frame_token == frame_token) {
-      previous.second.push_back(std::move(callback));
-      DCHECK_LE(previous.second.size(), 250u);
-      return;
-    }
-    DCHECK(viz::FrameTokenGT(frame_token, previous_frame_token));
-  }
-  std::vector<base::OnceCallback<void(base::TimeTicks)>> callbacks;
-  callbacks.push_back(std::move(callback));
-  presentation_callbacks_.push_back({frame_token, std::move(callbacks)});
-  DCHECK_LE(presentation_callbacks_.size(), 25u);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/compositor/layer_tree_view.h b/chromium/content/renderer/compositor/layer_tree_view.h
deleted file mode 100644
index 343c2a9bf82..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view.h
+++ /dev/null
@@ -1,162 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
-#define CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
-
-#include <stdint.h>
-
-#include "base/callback.h"
-#include "base/containers/circular_deque.h"
-#include "base/memory/weak_ptr.h"
-#include "base/single_thread_task_runner.h"
-#include "base/time/time.h"
-#include "base/values.h"
-#include "cc/input/browser_controls_state.h"
-#include "cc/trees/layer_tree_host_client.h"
-#include "cc/trees/layer_tree_host_single_thread_client.h"
-#include "cc/trees/swap_promise.h"
-#include "cc/trees/swap_promise_monitor.h"
-#include "content/common/content_export.h"
-#include "ui/gfx/geometry/rect.h"
-
-namespace blink {
-namespace scheduler {
-class WebThreadScheduler;
-}
-}  // namespace blink
-
-namespace cc {
-class AnimationHost;
-class LayerTreeFrameSink;
-class LayerTreeHost;
-class LayerTreeSettings;
-class RenderFrameMetadataObserver;
-class TaskGraphRunner;
-class UkmRecorderFactory;
-}  // namespace cc
-
-namespace content {
-class LayerTreeViewDelegate;
-
-class CONTENT_EXPORT LayerTreeView : public cc::LayerTreeHostClient,
-                                     public cc::LayerTreeHostSingleThreadClient,
-                                     public cc::LayerTreeHostSchedulingClient {
- public:
-  // The |main_thread| is the task runner that the compositor will use for the
-  // main thread (where it is constructed). The |compositor_thread| is the task
-  // runner for the compositor thread, but is null if the compositor will run in
-  // single-threaded mode (in tests only).
-  LayerTreeView(LayerTreeViewDelegate* delegate,
-                scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-                scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-                cc::TaskGraphRunner* task_graph_runner,
-                blink::scheduler::WebThreadScheduler* scheduler);
-  ~LayerTreeView() override;
-
-  // The |ukm_recorder_factory| may be null to disable recording (in tests
-  // only).
-  void Initialize(const cc::LayerTreeSettings& settings,
-                  std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory);
-
-  // Drops any references back to the delegate in preparation for being
-  // destroyed.
-  void Disconnect();
-
-  cc::AnimationHost* animation_host() { return animation_host_.get(); }
-
-  void SetVisible(bool visible);
-
-  // cc::LayerTreeHostClient implementation.
-  void WillBeginMainFrame() override;
-  void DidBeginMainFrame() override;
-  void WillUpdateLayers() override;
-  void DidUpdateLayers() override;
-  void BeginMainFrame(const viz::BeginFrameArgs& args) override;
-  void OnDeferMainFrameUpdatesChanged(bool) override;
-  void OnDeferCommitsChanged(bool) override;
-  void BeginMainFrameNotExpectedSoon() override;
-  void BeginMainFrameNotExpectedUntil(base::TimeTicks time) override;
-  void UpdateLayerTreeHost() override;
-  void ApplyViewportChanges(const cc::ApplyViewportChangesArgs& args) override;
-  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
-  void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) override;
-  void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) override;
-  void RequestNewLayerTreeFrameSink() override;
-  void DidInitializeLayerTreeFrameSink() override;
-  void DidFailToInitializeLayerTreeFrameSink() override;
-  void WillCommit() override;
-  void DidCommit(base::TimeTicks commit_start_time) override;
-  void DidCommitAndDrawFrame() override;
-  void DidReceiveCompositorFrameAck() override {}
-  void DidCompletePageScaleAnimation() override;
-  void DidPresentCompositorFrame(
-      uint32_t frame_token,
-      const gfx::PresentationFeedback& feedback) override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
-
-  // cc::LayerTreeHostSingleThreadClient implementation.
-  void DidSubmitCompositorFrame() override;
-  void DidLoseLayerTreeFrameSink() override;
-
-  // cc::LayerTreeHostSchedulingClient implementation.
-  void DidScheduleBeginMainFrame() override;
-  void DidRunBeginMainFrame() override;
-
-  void AddPresentationCallback(
-      uint32_t frame_token,
-      base::OnceCallback<void(base::TimeTicks)> callback);
-
-  cc::LayerTreeHost* layer_tree_host() { return layer_tree_host_.get(); }
-  const cc::LayerTreeHost* layer_tree_host() const {
-    return layer_tree_host_.get();
-  }
-
- protected:
-  friend class RenderViewImplScaleFactorTest;
-
- private:
-  void SetLayerTreeFrameSink(
-      std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink,
-      std::unique_ptr<cc::RenderFrameMetadataObserver>
-          render_frame_metadata_observer);
-
-  const scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  const scoped_refptr<base::SingleThreadTaskRunner> compositor_thread_;
-  cc::TaskGraphRunner* const task_graph_runner_;
-  blink::scheduler::WebThreadScheduler* const web_main_thread_scheduler_;
-  const std::unique_ptr<cc::AnimationHost> animation_host_;
-
-  // The delegate_ becomes null when Disconnect() is called. After that, the
-  // class should do nothing in calls from the LayerTreeHost, and just wait to
-  // be destroyed. It is not expected to be used at all after Disconnect()
-  // outside of handling/dropping LayerTreeHost client calls.
-  LayerTreeViewDelegate* delegate_;
-  std::unique_ptr<cc::LayerTreeHost> layer_tree_host_;
-
-  // This class should do nothing and access no pointers once this value becomes
-  // true.
-  bool layer_tree_frame_sink_request_failed_while_invisible_ = false;
-
-  base::circular_deque<
-      std::pair<uint32_t,
-                std::vector<base::OnceCallback<void(base::TimeTicks)>>>>
-      presentation_callbacks_;
-
-  base::WeakPtrFactory<LayerTreeView> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeView);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_H_
diff --git a/chromium/content/renderer/compositor/layer_tree_view_delegate.h b/chromium/content/renderer/compositor/layer_tree_view_delegate.h
deleted file mode 100644
index 45deac5fd7c..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view_delegate.h
+++ /dev/null
@@ -1,123 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
-#define CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
-
-#include <memory>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/time/time.h"
-#include "cc/trees/layer_tree_host_client.h"
-
-namespace cc {
-class LayerTreeFrameSink;
-struct BeginMainFrameMetrics;
-struct ElementId;
-class RenderFrameMetadataObserver;
-}  // namespace cc
-
-namespace content {
-
-// Consumers of LayerTreeView implement this delegate in order to
-// transport compositing information across processes.
-class LayerTreeViewDelegate {
- public:
-  using LayerTreeFrameSinkCallback = base::OnceCallback<void(
-      std::unique_ptr<cc::LayerTreeFrameSink>,
-      std::unique_ptr<cc::RenderFrameMetadataObserver>)>;
-
-  // Report viewport related properties during a commit from the compositor
-  // thread.
-  virtual void ApplyViewportChanges(
-      const cc::ApplyViewportChangesArgs& args) = 0;
-
-  // Record use counts of different methods of scrolling (e.g. wheel, touch,
-  // precision touchpad, etc.).
-  virtual void RecordManipulationTypeCounts(cc::ManipulationInfo info) = 0;
-
-  // Send overscroll DOM event when overscrolling has happened on the compositor
-  // thread.
-  virtual void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) = 0;
-
-  // Send scrollend DOM event when gesture scrolling on the compositor thread
-  // has finished.
-  virtual void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) = 0;
-
-  // Notifies that the compositor has issued a BeginMainFrame.
-  virtual void BeginMainFrame(base::TimeTicks frame_time) = 0;
-
-  virtual void OnDeferMainFrameUpdatesChanged(bool) = 0;
-  virtual void OnDeferCommitsChanged(bool) = 0;
-
-  // Notifies that the layer tree host has completed a call to
-  // RequestMainFrameUpdate in response to a BeginMainFrame.
-  virtual void DidBeginMainFrame() = 0;
-
-  // Requests a LayerTreeFrameSink to submit CompositorFrames to.
-  virtual void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) = 0;
-
-  // Notifies that the draw commands for a committed frame have been issued.
-  virtual void DidCommitAndDrawCompositorFrame() = 0;
-
-  // Notifies that a compositor frame commit operation is about to start.
-  virtual void WillCommitCompositorFrame() = 0;
-
-  // Notifies about a compositor frame commit operation having finished.
-  // The commit_start_time is the time that the impl thread started processing
-  // the commit.
-  virtual void DidCommitCompositorFrame(base::TimeTicks commit_start_time) = 0;
-
-  // Called by the compositor when page scale animation completed.
-  virtual void DidCompletePageScaleAnimation() = 0;
-
-  // Requests that a UMA and UKM metrics be recorded for the total frame time
-  // and the portion of frame time spent in various sub-systems.
-  // Call RecordStartOfFrameMetrics when a main frame is starting, and call
-  // RecordEndOfFrameMetrics as soon as the total frame time becomes known for
-  // a given frame. For example, ProxyMain::BeginMainFrame calls
-  // RecordStartOfFrameMetrics just be WillBeginCompositorFrame() and
-  // RecordEndOfFrameMetrics immediately before aborting or completing the
-  // BeginMainFrame method.
-  virtual void RecordStartOfFrameMetrics() = 0;
-  virtual void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) = 0;
-  // Return metrics information for the stages of BeginMainFrame. This is
-  // ultimately implemented by Blink's LocalFrameUKMAggregator. It must be a
-  // distinct call from the FrameMetrics above because the BeginMainFrameMetrics
-  // for compositor latency must be gathered before the layer tree is
-  // committed to the compositor, which is before the call to
-  // RecordEndOfFrameMetrics.
-  virtual std::unique_ptr<cc::BeginMainFrameMetrics>
-  GetBeginMainFrameMetrics() = 0;
-
-  // Notification of the beginning and end of LayerTreeHost::UpdateLayers, for
-  // metrics collection.
-  virtual void BeginUpdateLayers() = 0;
-  virtual void EndUpdateLayers() = 0;
-
-  // Requests a visual frame-based update to the state of the delegate if there
-  // is an update available.
-  virtual void UpdateVisualState() = 0;
-
-  // Indicates that the compositor is about to begin a frame. This is primarily
-  // to signal to flow control mechanisms that a frame is beginning, not to
-  // perform actual painting work. When |record_main_frame_metrics| is true
-  // we are in a frame that shoujld capture metrics data, and the local frame's
-  // UKM aggregator must be informed that the frame is starting.
-  virtual void WillBeginCompositorFrame() = 0;
-
- protected:
-  virtual ~LayerTreeViewDelegate() {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_COMPOSITOR_LAYER_TREE_VIEW_DELEGATE_H_
diff --git a/chromium/content/renderer/compositor/layer_tree_view_unittest.cc b/chromium/content/renderer/compositor/layer_tree_view_unittest.cc
deleted file mode 100644
index c45ef845302..00000000000
--- a/chromium/content/renderer/compositor/layer_tree_view_unittest.cc
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/compositor/layer_tree_view.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/macros.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/test/metrics/histogram_tester.h"
-#include "base/test/task_environment.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "build/build_config.h"
-#include "cc/test/fake_layer_tree_frame_sink.h"
-#include "cc/test/test_task_graph_runner.h"
-#include "cc/test/test_ukm_recorder_factory.h"
-#include "cc/trees/layer_tree_host.h"
-#include "cc/trees/render_frame_metadata_observer.h"
-#include "components/viz/common/frame_sinks/copy_output_request.h"
-#include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
-#include "components/viz/test/test_context_provider.h"
-#include "content/test/stub_layer_tree_view_delegate.h"
-#include "gpu/GLES2/gl2extchromium.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/scheduler/test/web_fake_thread_scheduler.h"
-
-using testing::AllOf;
-using testing::Field;
-
-namespace content {
-namespace {
-
-enum FailureMode {
-  NO_FAILURE,
-  BIND_CONTEXT_FAILURE,
-  GPU_CHANNEL_FAILURE,
-};
-
-class FakeLayerTreeViewDelegate : public StubLayerTreeViewDelegate {
- public:
-  FakeLayerTreeViewDelegate() = default;
-
-  void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) override {
-    // Subtract one cuz the current request has already been counted but should
-    // not be included for this.
-    if (num_requests_since_last_success_ - 1 < num_requests_before_success_) {
-      std::move(callback).Run(nullptr, nullptr);
-      return;
-    }
-
-    auto context_provider = viz::TestContextProvider::Create();
-    if (num_failures_since_last_success_ < num_failures_before_success_) {
-      context_provider->UnboundTestContextGL()->LoseContextCHROMIUM(
-          GL_GUILTY_CONTEXT_RESET_ARB, GL_INNOCENT_CONTEXT_RESET_ARB);
-    }
-    std::move(callback).Run(
-        cc::FakeLayerTreeFrameSink::Create3d(std::move(context_provider)),
-        nullptr);
-  }
-
-  void Reset() {
-    num_requests_ = 0;
-    num_requests_before_success_ = 0;
-    num_requests_since_last_success_ = 0;
-    num_failures_ = 0;
-    num_failures_before_success_ = 0;
-    num_failures_since_last_success_ = 0;
-    num_successes_ = 0;
-  }
-
-  void add_success() {
-    ++num_successes_;
-    num_requests_since_last_success_ = 0;
-    num_failures_since_last_success_ = 0;
-  }
-  int num_successes() const { return num_successes_; }
-
-  void add_request() {
-    ++num_requests_since_last_success_;
-    ++num_requests_;
-  }
-  int num_requests() const { return num_requests_; }
-
-  void add_failure() {
-    ++num_failures_since_last_success_;
-    ++num_failures_;
-  }
-  int num_failures() const { return num_failures_; }
-
-  void set_num_requests_before_success(int n) {
-    num_requests_before_success_ = n;
-  }
-  void set_num_failures_before_success(int n) {
-    num_failures_before_success_ = n;
-  }
-  int num_failures_before_success() const {
-    return num_failures_before_success_;
-  }
-
- private:
-  int num_requests_ = 0;
-  int num_requests_before_success_ = 0;
-  int num_requests_since_last_success_ = 0;
-  int num_failures_ = 0;
-  int num_failures_before_success_ = 0;
-  int num_failures_since_last_success_ = 0;
-  int num_successes_ = 0;
-
-  DISALLOW_COPY_AND_ASSIGN(FakeLayerTreeViewDelegate);
-};
-
-// Verify that failing to create an output surface will cause the compositor
-// to attempt to repeatedly create another output surface.
-// The use null output surface parameter allows testing whether failures
-// from RenderWidget (couldn't create an output surface) vs failures from
-// the compositor (couldn't bind the output surface) are handled identically.
-class LayerTreeViewWithFrameSinkTracking : public LayerTreeView {
- public:
-  LayerTreeViewWithFrameSinkTracking(
-      FakeLayerTreeViewDelegate* delegate,
-      scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-      scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-      cc::TaskGraphRunner* task_graph_runner,
-      blink::scheduler::WebThreadScheduler* scheduler)
-      : LayerTreeView(delegate,
-                      std::move(main_thread),
-                      std::move(compositor_thread),
-                      task_graph_runner,
-                      scheduler),
-        delegate_(delegate) {}
-
-  // Force a new output surface to be created.
-  void SynchronousComposite() {
-    layer_tree_host()->SetVisible(false);
-    layer_tree_host()->ReleaseLayerTreeFrameSink();
-    layer_tree_host()->SetVisible(true);
-
-    base::TimeTicks some_time;
-    layer_tree_host()->Composite(some_time, true /* raster */);
-  }
-
-  void RequestNewLayerTreeFrameSink() override {
-    delegate_->add_request();
-    LayerTreeView::RequestNewLayerTreeFrameSink();
-  }
-
-  void DidInitializeLayerTreeFrameSink() override {
-    LayerTreeView::DidInitializeLayerTreeFrameSink();
-    delegate_->add_success();
-    if (delegate_->num_successes() == expected_successes_) {
-      EXPECT_EQ(delegate_->num_requests(), expected_requests_);
-      EndTest();
-    } else {
-      // Post the synchronous composite task so that it is not called
-      // reentrantly as a part of RequestNewLayerTreeFrameSink.
-      blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostTask(
-          FROM_HERE,
-          base::BindOnce(
-              &LayerTreeViewWithFrameSinkTracking::SynchronousComposite,
-              base::Unretained(this)));
-    }
-  }
-
-  void DidFailToInitializeLayerTreeFrameSink() override {
-    LayerTreeView::DidFailToInitializeLayerTreeFrameSink();
-    delegate_->add_failure();
-    if (delegate_->num_requests() == expected_requests_) {
-      EXPECT_EQ(delegate_->num_successes(), expected_successes_);
-      EndTest();
-      return;
-    }
-  }
-
-  void SetUp(int expected_successes,
-             int num_tries,
-             FailureMode failure_mode,
-             base::RunLoop* run_loop) {
-    run_loop_ = run_loop;
-    failure_mode_ = failure_mode;
-    expected_successes_ = expected_successes;
-    switch (failure_mode_) {
-      case NO_FAILURE:
-        expected_requests_ = expected_successes;
-        break;
-      case BIND_CONTEXT_FAILURE:
-      case GPU_CHANNEL_FAILURE:
-        expected_requests_ = num_tries * std::max(1, expected_successes);
-        break;
-    }
-  }
-
-  void EndTest() { run_loop_->Quit(); }
-
- private:
-  FakeLayerTreeViewDelegate* delegate_;
-  base::RunLoop* run_loop_ = nullptr;
-  int expected_successes_ = 0;
-  int expected_requests_ = 0;
-  FailureMode failure_mode_ = NO_FAILURE;
-
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeViewWithFrameSinkTracking);
-};
-
-class LayerTreeViewWithFrameSinkTrackingTest : public testing::Test {
- public:
-  LayerTreeViewWithFrameSinkTrackingTest()
-      : layer_tree_view_(
-            &layer_tree_view_delegate_,
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-            /*compositor_thread=*/nullptr,
-            &test_task_graph_runner_,
-            &fake_thread_scheduler_) {
-    cc::LayerTreeSettings settings;
-    settings.single_thread_proxy_scheduler = false;
-    layer_tree_view_.Initialize(settings,
-                                std::make_unique<cc::TestUkmRecorderFactory>());
-  }
-
-  void RunTest(int expected_successes, FailureMode failure_mode) {
-    layer_tree_view_delegate_.Reset();
-    // 6 is just an artibrary "large" number to show it keeps trying.
-    const int kTries = 6;
-    // If it should fail, then it will fail every attempt, otherwise it fails
-    // until the last attempt.
-    int tries_before_success = kTries - (expected_successes ? 1 : 0);
-    switch (failure_mode) {
-      case NO_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(0);
-        layer_tree_view_delegate_.set_num_requests_before_success(0);
-        break;
-      case BIND_CONTEXT_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(
-            tries_before_success);
-        layer_tree_view_delegate_.set_num_requests_before_success(0);
-        break;
-      case GPU_CHANNEL_FAILURE:
-        layer_tree_view_delegate_.set_num_failures_before_success(0);
-        layer_tree_view_delegate_.set_num_requests_before_success(
-            tries_before_success);
-        break;
-    }
-    base::RunLoop run_loop;
-    layer_tree_view_.SetUp(expected_successes, kTries, failure_mode, &run_loop);
-    layer_tree_view_.SetVisible(true);
-    blink::scheduler::GetSingleThreadTaskRunnerForTesting()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &LayerTreeViewWithFrameSinkTracking::SynchronousComposite,
-            base::Unretained(&layer_tree_view_)));
-    run_loop.Run();
-  }
-
- protected:
-  base::test::TaskEnvironment task_environment_;
-  cc::TestTaskGraphRunner test_task_graph_runner_;
-  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler_;
-  FakeLayerTreeViewDelegate layer_tree_view_delegate_;
-  LayerTreeViewWithFrameSinkTracking layer_tree_view_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(LayerTreeViewWithFrameSinkTrackingTest);
-};
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce) {
-  RunTest(1, NO_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce_AfterNullChannel) {
-  RunTest(1, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedOnce_AfterLostContext) {
-  RunTest(1, BIND_CONTEXT_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice) {
-  RunTest(2, NO_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice_AfterNullChannel) {
-  RunTest(2, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, SucceedTwice_AfterLostContext) {
-  RunTest(2, BIND_CONTEXT_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, FailWithNullChannel) {
-  RunTest(0, GPU_CHANNEL_FAILURE);
-}
-
-TEST_F(LayerTreeViewWithFrameSinkTrackingTest, FailWithLostContext) {
-  RunTest(0, BIND_CONTEXT_FAILURE);
-}
-
-class VisibilityTestLayerTreeView : public LayerTreeView {
- public:
-  VisibilityTestLayerTreeView(
-      StubLayerTreeViewDelegate* delegate,
-      scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-      scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
-      cc::TaskGraphRunner* task_graph_runner,
-      blink::scheduler::WebThreadScheduler* scheduler)
-      : LayerTreeView(delegate,
-                      std::move(main_thread),
-                      std::move(compositor_thread),
-                      task_graph_runner,
-                      scheduler) {}
-
-  void RequestNewLayerTreeFrameSink() override {
-    LayerTreeView::RequestNewLayerTreeFrameSink();
-    num_requests_sent_++;
-    if (run_loop_)
-      run_loop_->Quit();
-  }
-
-  void set_run_loop(base::RunLoop* run_loop) { run_loop_ = run_loop; }
-  int num_requests_sent() { return num_requests_sent_; }
-
- private:
-  int num_requests_sent_ = 0;
-  base::RunLoop* run_loop_;
-};
-
-TEST(LayerTreeViewTest, VisibilityTest) {
-  // Test that LayerTreeView does not retry FrameSink request while
-  // invisible.
-
-  base::test::TaskEnvironment task_environment;
-
-  cc::TestTaskGraphRunner test_task_graph_runner;
-  blink::scheduler::WebFakeThreadScheduler fake_thread_scheduler;
-  // Synchronously callback with null FrameSink.
-  StubLayerTreeViewDelegate layer_tree_view_delegate;
-  VisibilityTestLayerTreeView layer_tree_view(
-      &layer_tree_view_delegate,
-      blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-      /*compositor_thread=*/nullptr, &test_task_graph_runner,
-      &fake_thread_scheduler);
-
-  layer_tree_view.Initialize(cc::LayerTreeSettings(),
-                             std::make_unique<cc::TestUkmRecorderFactory>());
-
-  {
-    // Make one request and stop immediately while invisible.
-    base::RunLoop run_loop;
-    layer_tree_view.set_run_loop(&run_loop);
-    layer_tree_view.SetVisible(false);
-    layer_tree_view.RequestNewLayerTreeFrameSink();
-    run_loop.Run();
-    layer_tree_view.set_run_loop(nullptr);
-    EXPECT_EQ(1, layer_tree_view.num_requests_sent());
-  }
-
-  {
-    // Make sure there are no more requests.
-    base::RunLoop run_loop;
-    run_loop.RunUntilIdle();
-    EXPECT_EQ(1, layer_tree_view.num_requests_sent());
-  }
-
-  {
-    // Becoming visible retries request.
-    base::RunLoop run_loop;
-    layer_tree_view.set_run_loop(&run_loop);
-    layer_tree_view.SetVisible(true);
-    run_loop.Run();
-    layer_tree_view.set_run_loop(nullptr);
-    EXPECT_EQ(2, layer_tree_view.num_requests_sent());
-  }
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/renderer/content_security_policy_util.cc b/chromium/content/renderer/content_security_policy_util.cc
index b4187bdb485..4d05093aefa 100644
--- a/chromium/content/renderer/content_security_policy_util.cc
+++ b/chromium/content/renderer/content_security_policy_util.cc
@@ -42,6 +42,7 @@ network::mojom::ContentSecurityPolicyPtr BuildContentSecurityPolicy(
     auto name = network::ToCSPDirectiveName(directive.name.Utf8());
     policy->directives[name] = BuildCSPSourceList(directive.source_list);
   }
+  policy->upgrade_insecure_requests = policy_in.upgrade_insecure_requests;
 
   for (const blink::WebString& endpoint : policy_in.report_endpoints)
     policy->report_endpoints.push_back(endpoint.Utf8());
diff --git a/chromium/content/renderer/dom_automation_controller.cc b/chromium/content/renderer/dom_automation_controller.cc
index af3e1e727ea..f0162ba4ce9 100644
--- a/chromium/content/renderer/dom_automation_controller.cc
+++ b/chromium/content/renderer/dom_automation_controller.cc
@@ -106,7 +106,17 @@ bool DomAutomationController::SendMsg(const gin::Arguments& args) {
   if (!value || !serializer.Serialize(*value))
     return false;
 
-  return Send(new FrameHostMsg_DomOperationResponse(routing_id(), json));
+  GetDomAutomationControllerHost()->DomOperationResponse(json);
+  return true;
+}
+
+const mojo::AssociatedRemote<mojom::DomAutomationControllerHost>&
+DomAutomationController::GetDomAutomationControllerHost() {
+  if (!dom_automation_controller_host_) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(
+        &dom_automation_controller_host_);
+  }
+  return dom_automation_controller_host_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/dom_automation_controller.h b/chromium/content/renderer/dom_automation_controller.h
index 9dff350ec16..fb532ab4c1d 100644
--- a/chromium/content/renderer/dom_automation_controller.h
+++ b/chromium/content/renderer/dom_automation_controller.h
@@ -8,8 +8,10 @@
 #include <stdint.h>
 
 #include "base/macros.h"
+#include "content/common/dom_automation_controller.mojom.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "gin/wrappable.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 
 namespace blink {
 class WebLocalFrame;
@@ -27,8 +29,6 @@ class RenderFrame;
 // Javascript can call domAutomationController.send(...) to send arbitrary data
 // to the browser.  On the browser side, the data is received via one of the
 // following:
-// - Product code:
-//   - Explicit handlers of FrameHostMsg_DomOperationResponse IPC
 // - Test code:
 //   - DOMMessageQueue class
 //   - ExecuteScriptAndExtractInt/Bool/String functions
@@ -58,6 +58,12 @@ class DomAutomationController : public gin::Wrappable<DomAutomationController>,
   void DidCreateScriptContext(v8::Local<v8::Context> context,
                               int32_t world_id) override;
 
+  const mojo::AssociatedRemote<mojom::DomAutomationControllerHost>&
+  GetDomAutomationControllerHost();
+
+  mojo::AssociatedRemote<mojom::DomAutomationControllerHost>
+      dom_automation_controller_host_;
+
   DISALLOW_COPY_AND_ASSIGN(DomAutomationController);
 };
 
diff --git a/chromium/content/renderer/dom_serializer_browsertest.cc b/chromium/content/renderer/dom_serializer_browsertest.cc
index eaf66a5e840..63da2c9fff1 100644
--- a/chromium/content/renderer/dom_serializer_browsertest.cc
+++ b/chromium/content/renderer/dom_serializer_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_view.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/frame_load_waiter.h"
diff --git a/chromium/content/renderer/external_popup_menu.cc b/chromium/content/renderer/external_popup_menu.cc
deleted file mode 100644
index c61530a96d4..00000000000
--- a/chromium/content/renderer/external_popup_menu.cc
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/external_popup_menu.h"
-
-#include <stddef.h>
-
-#include "build/build_config.h"
-#include "content/common/frame_messages.h"
-#include "content/renderer/menu_item_builder.h"
-#include "content/renderer/render_frame_impl.h"
-#include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/web/web_external_popup_menu_client.h"
-
-namespace content {
-
-ExternalPopupMenu::ExternalPopupMenu(
-    RenderFrameImpl* render_frame,
-    const blink::WebPopupMenuInfo& popup_menu_info,
-    blink::WebExternalPopupMenuClient* popup_menu_client)
-    : render_frame_(render_frame),
-      popup_menu_info_(popup_menu_info),
-      popup_menu_client_(popup_menu_client),
-      origin_scale_for_emulation_(0) {
-}
-
-void ExternalPopupMenu::SetOriginScaleForEmulation(float scale) {
-  origin_scale_for_emulation_ = scale;
-}
-
-void ExternalPopupMenu::Show(const blink::WebRect& bounds) {
-  blink::WebRect rect = bounds;
-  if (origin_scale_for_emulation_) {
-    rect.x *= origin_scale_for_emulation_;
-    rect.y *= origin_scale_for_emulation_;
-  }
-
-  FrameHostMsg_ShowPopup_Params popup_params;
-  popup_params.bounds = rect;
-  popup_params.item_height = popup_menu_info_.item_height;
-  popup_params.item_font_size = popup_menu_info_.item_font_size;
-  popup_params.selected_item = popup_menu_info_.selected_index;
-  for (size_t i = 0; i < popup_menu_info_.items.size(); ++i) {
-    popup_params.popup_items.push_back(
-        MenuItemBuilder::Build(popup_menu_info_.items[i]));
-  }
-  popup_params.right_aligned = popup_menu_info_.right_aligned;
-  popup_params.allow_multiple_selection =
-      popup_menu_info_.allow_multiple_selection;
-  render_frame_->Send(
-      new FrameHostMsg_ShowPopup(render_frame_->GetRoutingID(), popup_params));
-}
-
-void ExternalPopupMenu::Close() {
-  render_frame_->Send(
-      new FrameHostMsg_HidePopup(render_frame_->GetRoutingID()));
-  render_frame_->DidHideExternalPopupMenu();
-  // |this| was deleted.
-}
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-void ExternalPopupMenu::DidSelectItem(int index) {
-  if (!popup_menu_client_)
-    return;
-  if (index == -1)
-    popup_menu_client_->DidCancel();
-  else
-    popup_menu_client_->DidAcceptIndex(index);
-}
-#else
-void ExternalPopupMenu::DidSelectItems(bool canceled,
-                                       const std::vector<int>& indices) {
-  if (!popup_menu_client_)
-    return;
-  if (canceled)
-    popup_menu_client_->DidCancel();
-  else
-    popup_menu_client_->DidAcceptIndices(indices);
-}
-#endif
-#endif
-
-}  // namespace content
diff --git a/chromium/content/renderer/external_popup_menu.h b/chromium/content/renderer/external_popup_menu.h
deleted file mode 100644
index 8b25066507c..00000000000
--- a/chromium/content/renderer/external_popup_menu.h
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
-#define CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
-
-#include <vector>
-
-#include "base/macros.h"
-#include "build/build_config.h"
-#include "content/common/buildflags.h"
-#include "third_party/blink/public/web/web_external_popup_menu.h"
-#include "third_party/blink/public/web/web_popup_menu_info.h"
-#include "ui/gfx/geometry/point_f.h"
-
-namespace blink {
-class WebExternalPopupMenuClient;
-}
-
-namespace content {
-class RenderFrameImpl;
-
-class ExternalPopupMenu : public blink::WebExternalPopupMenu {
- public:
-  ExternalPopupMenu(RenderFrameImpl* render_frame,
-                    const blink::WebPopupMenuInfo& popup_menu_info,
-                    blink::WebExternalPopupMenuClient* popup_menu_client);
-
-  virtual ~ExternalPopupMenu() {}
-
-  void SetOriginScaleForEmulation(float scale);
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-  // Called when the user has selected an item. |selected_item| is -1 if the
-  // user canceled the popup.
-  void DidSelectItem(int selected_index);
-#else
-  // Called when the user has selected items or canceled the popup.
-  void DidSelectItems(bool canceled, const std::vector<int>& selected_indices);
-#endif
-#endif
-
-  // blink::WebExternalPopupMenu implementation:
-  void Show(const blink::WebRect& bounds) override;
-  void Close() override;
-
- private:
-  RenderFrameImpl* render_frame_;
-  blink::WebPopupMenuInfo popup_menu_info_;
-  blink::WebExternalPopupMenuClient* popup_menu_client_;
-
-  // Popups may be displaced when screen metrics emulation is enabled.
-  // These scale and offset are used to properly adjust popup position.
-  float origin_scale_for_emulation_;
-
-  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenu);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_EXTERNAL_POPUP_MENU_H_
diff --git a/chromium/content/renderer/external_popup_menu_browsertest.cc b/chromium/content/renderer/external_popup_menu_browsertest.cc
deleted file mode 100644
index 1816b99f1f7..00000000000
--- a/chromium/content/renderer/external_popup_menu_browsertest.cc
+++ /dev/null
@@ -1,238 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <tuple>
-
-#include "base/macros.h"
-#include "base/strings/utf_string_conversions.h"
-#include "content/common/frame_messages.h"
-#include "content/public/test/render_view_test.h"
-#include "content/renderer/render_frame_impl.h"
-#include "content/renderer/render_view_impl.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/web_size.h"
-#include "third_party/blink/public/web/web_local_frame.h"
-#include "third_party/blink/public/web/web_view.h"
-
-// Tests for the external select popup menu (Mac specific).
-
-namespace content {
-namespace {
-
-const char* const kSelectID = "mySelect";
-const char* const kEmptySelectID = "myEmptySelect";
-
-}  // namespace
-
-class ExternalPopupMenuTest : public RenderViewTest {
- public:
-  ExternalPopupMenuTest() {}
-
-  RenderViewImpl* view() {
-    return static_cast<RenderViewImpl*>(view_);
-  }
-
-  RenderWidget* main_frame_widget() {
-    return view()->GetMainRenderFrame()->GetLocalRootRenderWidget();
-  }
-
-  RenderFrameImpl* frame() {
-    return view()->GetMainRenderFrame();
-  }
-
-  void SetUp() override {
-    RenderViewTest::SetUp();
-    // We need to set this explictly as RenderMain is not run.
-    blink::WebView::SetUseExternalPopupMenus(true);
-
-    std::string html = "<select id='mySelect' onchange='selectChanged(this)'>"
-                       "  <option>zero</option>"
-                       "  <option selected='1'>one</option>"
-                       "  <option>two</option>"
-                       "</select>"
-                       "<select id='myEmptySelect'>"
-                       "</select>";
-    if (ShouldRemoveSelectOnChange()) {
-      html += "<script>"
-              "  function selectChanged(select) {"
-              "    select.parentNode.removeChild(select);"
-              "  }"
-              "</script>";
-    }
-
-    // Load the test page.
-    LoadHTML(html.c_str());
-
-    // Set a minimum size and give focus so simulated events work.
-    main_frame_widget()->GetWebWidget()->Resize(blink::WebSize(500, 500));
-    main_frame_widget()->GetWebWidget()->SetFocus(true);
-  }
-
-  int GetSelectedIndex() {
-    base::string16 script(base::ASCIIToUTF16(kSelectID));
-    script.append(base::ASCIIToUTF16(".selectedIndex"));
-    int selected_index = -1;
-    ExecuteJavaScriptAndReturnIntValue(script, &selected_index);
-    return selected_index;
-  }
-
- protected:
-  virtual bool ShouldRemoveSelectOnChange() const { return false; }
-
-  DISALLOW_COPY_AND_ASSIGN(ExternalPopupMenuTest);
-};
-
-// Normal case: test showing a select popup, canceling/selecting an item.
-TEST_F(ExternalPopupMenuTest, NormalCase) {
-  IPC::TestSink& sink = render_thread_->sink();
-
-  // Click the text field once.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // We should have sent a message to the browser to show the popup menu.
-  const IPC::Message* message =
-      sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  std::tuple<FrameHostMsg_ShowPopup_Params> param;
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  ASSERT_EQ(3U, std::get<0>(param).popup_items.size());
-  EXPECT_EQ(1, std::get<0>(param).selected_item);
-
-  // Simulate the user canceling the popup; the index should not have changed.
-  frame()->OnSelectPopupMenuItem(-1);
-  EXPECT_EQ(1, GetSelectedIndex());
-
-  // Show the pop-up again and this time make a selection.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-  frame()->OnSelectPopupMenuItem(0);
-  EXPECT_EQ(0, GetSelectedIndex());
-
-  // Show the pop-up again and make another selection.
-  sink.ClearMessages();
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-  message = sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  ASSERT_EQ(3U, std::get<0>(param).popup_items.size());
-  EXPECT_EQ(0, std::get<0>(param).selected_item);
-}
-
-// Page shows popup, then navigates away while popup showing, then select.
-TEST_F(ExternalPopupMenuTest, ShowPopupThenNavigate) {
-  // Click the text field once.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Now we navigate to another pager.
-  LoadHTML("<blink>Awesome page!</blink>");
-
-  // Now the user selects something, we should not crash.
-  frame()->OnSelectPopupMenuItem(-1);
-}
-
-// An empty select should not cause a crash when clicked.
-// http://crbug.com/63774
-TEST_F(ExternalPopupMenuTest, EmptySelect) {
-  EXPECT_TRUE(SimulateElementClick(kEmptySelectID));
-}
-
-class ExternalPopupMenuRemoveTest : public ExternalPopupMenuTest {
- public:
-  ExternalPopupMenuRemoveTest() {}
-
- protected:
-  bool ShouldRemoveSelectOnChange() const override { return true; }
-};
-
-// Tests that nothing bad happen when the page removes the select when it
-// changes. (http://crbug.com/61997)
-TEST_F(ExternalPopupMenuRemoveTest, RemoveOnChange) {
-  // Click the text field once to show the popup.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Select something, it causes the select to be removed from the page.
-  frame()->OnSelectPopupMenuItem(0);
-
-  // Just to check the soundness of the test, call SimulateElementClick again.
-  // It should return false as the select has been removed.
-  EXPECT_FALSE(SimulateElementClick(kSelectID));
-}
-
-// crbug.com/912211
-TEST_F(ExternalPopupMenuRemoveTest, RemoveFrameOnChange) {
-  LoadHTML(
-      "<style>* { margin: 0; } iframe { border: 0; }</style>"
-      "<body><iframe srcdoc=\""
-      "<style>* { margin: 0; }</style><select><option>opt1<option>opt2"
-      "\"></iframe>"
-      "<script>"
-      "onload = function() {"
-      "  const frame = document.querySelector('iframe');"
-      "  frame.contentDocument.querySelector('select').onchange = "
-      "      () => { frame.remove(); };"
-      "};"
-      "</script>");
-  // Open a popup.
-  SimulatePointClick(gfx::Point(8, 8));
-  // Select something on the sub-frame, it causes the frame to be removed from
-  // the page.
-  auto* child_web_frame =
-      static_cast<blink::WebLocalFrame*>(frame()->GetWebFrame()->FirstChild());
-  static_cast<RenderFrameImpl*>(RenderFrame::FromWebFrame(child_web_frame))
-      ->OnSelectPopupMenuItem(1);
-  // The test passes if the test didn't crash and ASAN didn't complain.
-}
-
-class ExternalPopupMenuDisplayNoneTest : public ExternalPopupMenuTest {
-  public:
-  ExternalPopupMenuDisplayNoneTest() {}
-
-  void SetUp() override {
-    RenderViewTest::SetUp();
-    // We need to set this explictly as RenderMain is not run.
-    blink::WebView::SetUseExternalPopupMenus(true);
-
-    std::string html = "<select id='mySelect'>"
-                       "  <option value='zero'>zero</option>"
-                       "  <optgroup label='hide' style='display: none'>"
-                       "    <option value='one'>one</option>"
-                       "  </optgroup>"
-                       "  <option value='two'>two</option>"
-                       "  <option value='three'>three</option>"
-                       "  <option value='four'>four</option>"
-                       "  <option value='five'>five</option>"
-                       "</select>";
-    // Load the test page.
-    LoadHTML(html.c_str());
-
-    // Set a minimum size and give focus so simulated events work.
-    main_frame_widget()->GetWebWidget()->Resize(blink::WebSize(500, 500));
-    main_frame_widget()->GetWebWidget()->SetFocus(true);
-  }
-
-};
-
-TEST_F(ExternalPopupMenuDisplayNoneTest, SelectItem) {
-  IPC::TestSink& sink = render_thread_->sink();
-
-  // Click the text field once to show the popup.
-  EXPECT_TRUE(SimulateElementClick(kSelectID));
-
-  // Read the message sent to browser to show the popup menu.
-  const IPC::Message* message =
-      sink.GetUniqueMessageMatching(FrameHostMsg_ShowPopup::ID);
-  ASSERT_TRUE(message != NULL);
-  std::tuple<FrameHostMsg_ShowPopup_Params> param;
-  FrameHostMsg_ShowPopup::Read(message, &param);
-  // Number of items should match item count minus the number
-  // of "display: none" items.
-  ASSERT_EQ(5U, std::get<0>(param).popup_items.size());
-
-  // Select index 1 item. This should select item with index 2,
-  // skipping the item with 'display: none'
-  frame()->OnSelectPopupMenuItem(1);
-
-  EXPECT_EQ(2, GetSelectedIndex());
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/frame_swap_message_queue.cc b/chromium/content/renderer/frame_swap_message_queue.cc
index 2e9f14e6008..d85fe7038e8 100644
--- a/chromium/content/renderer/frame_swap_message_queue.cc
+++ b/chromium/content/renderer/frame_swap_message_queue.cc
@@ -9,7 +9,7 @@
 #include <memory>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/macros.h"
 #include "base/stl_util.h"
 #include "ipc/ipc_message.h"
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.cc b/chromium/content/renderer/gpu_benchmarking_extension.cc
index 8bc1d09a4f8..45766087a71 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.cc
+++ b/chromium/content/renderer/gpu_benchmarking_extension.cc
@@ -48,7 +48,7 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
-#include "third_party/blink/public/common/page/page_visibility_state.h"
+#include "third_party/blink/public/mojom/page/page_visibility_state.mojom.h"
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_image_cache.h"
@@ -284,22 +284,66 @@ bool ThrowIfPointOutOfBounds(GpuBenchmarkingContext* context,
   return false;
 }
 
+base::Optional<gfx::Vector2dF> ToVector(const std::string& direction,
+                                        float distance) {
+  if (direction == "down") {
+    return gfx::Vector2dF(0, distance);
+  } else if (direction == "up") {
+    return gfx::Vector2dF(0, -distance);
+  } else if (direction == "right") {
+    return gfx::Vector2dF(distance, 0);
+  } else if (direction == "left") {
+    return gfx::Vector2dF(-distance, 0);
+  } else if (direction == "upleft") {
+    return gfx::Vector2dF(-distance, -distance);
+  } else if (direction == "upright") {
+    return gfx::Vector2dF(distance, -distance);
+  } else if (direction == "downleft") {
+    return gfx::Vector2dF(-distance, distance);
+  } else if (direction == "downright") {
+    return gfx::Vector2dF(distance, distance);
+  }
+  return base::nullopt;
+}
+
+int ToKeyModifiers(const base::StringPiece& key) {
+  if (key == "Alt")
+    return blink::WebInputEvent::kAltKey;
+  if (key == "Control")
+    return blink::WebInputEvent::kControlKey;
+  if (key == "Meta")
+    return blink::WebInputEvent::kMetaKey;
+  if (key == "Shift")
+    return blink::WebInputEvent::kShiftKey;
+  if (key == "CapsLock")
+    return blink::WebInputEvent::kCapsLockOn;
+  if (key == "NumLock")
+    return blink::WebInputEvent::kNumLockOn;
+  if (key == "AltGraph")
+    return blink::WebInputEvent::kAltGrKey;
+  NOTREACHED() << "invalid key modifier";
+  return 0;
+}
+
+// BeginSmoothScroll takes pixels_to_scroll_x and pixels_to_scroll_y, positive
+// pixels_to_scroll_y means scroll down, positive pixels_to_scroll_x means
+// scroll right.
 bool BeginSmoothScroll(GpuBenchmarkingContext* context,
                        gin::Arguments* args,
                        const mojo::Remote<mojom::InputInjector>& injector,
-                       float pixels_to_scroll,
+                       const gfx::Vector2dF& pixels_to_scroll,
                        v8::Local<v8::Function> callback,
                        int gesture_source_type,
-                       const std::string& direction,
                        float speed_in_pixels_s,
                        bool prevent_fling,
                        float start_x,
                        float start_y,
-                       float fling_velocity,
+                       const gfx::Vector2dF& fling_velocity,
                        bool precise_scrolling_deltas,
                        bool scroll_by_page,
                        bool cursor_visible,
-                       bool scroll_by_percentage) {
+                       bool scroll_by_percentage,
+                       int key_modifiers) {
   DCHECK(!(precise_scrolling_deltas && scroll_by_page));
   DCHECK(!(precise_scrolling_deltas && scroll_by_percentage));
   DCHECK(!(scroll_by_page && scroll_by_percentage));
@@ -312,13 +356,13 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
     // Ensure the mouse is visible and move to start position, in case it will
     // trigger any hover or mousemove effects.
     context->web_view()->SetIsActive(true);
-    blink::WebMouseEvent mouseMove(blink::WebInputEvent::kMouseMove,
+    blink::WebMouseEvent mouseMove(blink::WebInputEvent::Type::kMouseMove,
                                    blink::WebInputEvent::kNoModifiers,
                                    ui::EventTimeForNow());
     mouseMove.SetPositionInWidget(start_x, start_y);
     CHECK(context->web_view()->MainFrameWidget());
     context->web_view()->MainFrameWidget()->HandleInputEvent(
-        blink::WebCoalescedInputEvent(mouseMove));
+        blink::WebCoalescedInputEvent(mouseMove, ui::LatencyInfo()));
     context->web_view()->MainFrameWidget()->SetCursorVisibilityState(
         cursor_visible);
   }
@@ -352,45 +396,17 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
   gesture_params.anchor.SetPoint(start_x, start_y);
 
   DCHECK(gesture_source_type != SyntheticGestureParams::TOUCH_INPUT ||
-         fling_velocity == 0);
-  float distance_length = pixels_to_scroll;
-  gfx::Vector2dF distance;
-  if (direction == "down") {
-    distance.set_y(-distance_length);
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else if (direction == "up") {
-    distance.set_y(distance_length);
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "right") {
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-  } else if (direction == "left") {
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-  } else if (direction == "upleft") {
-    distance.set_y(distance_length);
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "upright") {
-    distance.set_y(distance_length);
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-    gesture_params.fling_velocity_y = -fling_velocity;
-  } else if (direction == "downleft") {
-    distance.set_y(-distance_length);
-    distance.set_x(distance_length);
-    gesture_params.fling_velocity_x = -fling_velocity;
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else if (direction == "downright") {
-    distance.set_y(-distance_length);
-    distance.set_x(-distance_length);
-    gesture_params.fling_velocity_x = fling_velocity;
-    gesture_params.fling_velocity_y = fling_velocity;
-  } else {
-    return false;
-  }
-  gesture_params.distances.push_back(distance);
+         fling_velocity.IsZero());
+  // Positive pixels_to_scroll_y means scroll down, positive pixels_to_scroll_x
+  // means scroll right, but SyntheticSmoothScrollGestureParams requests
+  // Positive X/Y to scroll left/up, which is opposite. Positive
+  // fling_velocity_x and fling_velocity_y means scroll left and up, which is
+  // the same direction with SyntheticSmoothScrollGestureParams.
+  gesture_params.fling_velocity_x = fling_velocity.x();
+  gesture_params.fling_velocity_y = fling_velocity.y();
+  gesture_params.distances.push_back(-pixels_to_scroll);
+
+  gesture_params.key_modifiers = key_modifiers;
 
   injector->QueueSyntheticSmoothScroll(
       gesture_params, base::BindOnce(&OnSyntheticGestureCompleted,
@@ -579,6 +595,7 @@ gin::ObjectTemplateBuilder GpuBenchmarking::GetObjectTemplateBuilder(
       .SetMethod("gestureSourceTypeSupported",
                  &GpuBenchmarking::GestureSourceTypeSupported)
       .SetMethod("smoothScrollBy", &GpuBenchmarking::SmoothScrollBy)
+      .SetMethod("smoothScrollByXY", &GpuBenchmarking::SmoothScrollByXY)
       .SetMethod("smoothDrag", &GpuBenchmarking::SmoothDrag)
       .SetMethod("swipe", &GpuBenchmarking::Swipe)
       .SetMethod("scrollBounce", &GpuBenchmarking::ScrollBounce)
@@ -601,6 +618,8 @@ gin::ObjectTemplateBuilder GpuBenchmarking::GetObjectTemplateBuilder(
       .SetMethod("hasGpuChannel", &GpuBenchmarking::HasGpuChannel)
       .SetMethod("hasGpuProcess", &GpuBenchmarking::HasGpuProcess)
       .SetMethod("crashGpuProcess", &GpuBenchmarking::CrashGpuProcess)
+      .SetMethod("terminateGpuProcessNormally",
+                 &GpuBenchmarking::TerminateGpuProcessNormally)
       .SetMethod("getGpuDriverBugWorkarounds",
                  &GpuBenchmarking::GetGpuDriverBugWorkarounds)
       .SetMethod("startProfiling", &GpuBenchmarking::StartProfiling)
@@ -680,6 +699,8 @@ bool GpuBenchmarking::GestureSourceTypeSupported(int gesture_source_type) {
           gesture_source_type));
 }
 
+// TODO(lanwei): this is will be removed after this is replaced by
+// SmoothScrollByXY in telemetry/internal/actions/scroll.js.
 bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   GpuBenchmarkingContext context(render_frame_.get());
   blink::WebRect rect = context.render_widget()->ViewRect();
@@ -695,6 +716,7 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   bool scroll_by_page = false;
   bool cursor_visible = true;
   bool scroll_by_percentage = false;
+  std::string keys_value;
 
   if (!GetOptionalArg(args, &pixels_to_scroll) ||
       !GetOptionalArg(args, &callback) || !GetOptionalArg(args, &start_x) ||
@@ -705,7 +727,8 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
       !GetOptionalArg(args, &precise_scrolling_deltas) ||
       !GetOptionalArg(args, &scroll_by_page) ||
       !GetOptionalArg(args, &cursor_visible) ||
-      !GetOptionalArg(args, &scroll_by_percentage)) {
+      !GetOptionalArg(args, &scroll_by_percentage) ||
+      !GetOptionalArg(args, &keys_value)) {
     return false;
   }
 
@@ -718,13 +741,98 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
   // Scroll by percentage only for mouse inputs.
   DCHECK(!scroll_by_percentage ||
          gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+  // Scroll by percentage does not require speed in pixels
+  DCHECK(!scroll_by_percentage || (speed_in_pixels_s == 800));
+
+  base::Optional<gfx::Vector2dF> pixels_to_scrol_vector =
+      ToVector(direction, pixels_to_scroll);
+  if (!pixels_to_scrol_vector.has_value())
+    return false;
+  gfx::Vector2dF fling_velocity(0, 0);
+  int key_modifiers = 0;
+  std::vector<base::StringPiece> key_list = base::SplitStringPiece(
+      keys_value, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+  for (const base::StringPiece& key : key_list) {
+    int key_modifier = ToKeyModifiers(key);
+    if (key_modifier == 0) {
+      return false;
+    }
+    key_modifiers |= key_modifier;
+  }
 
   EnsureRemoteInterface();
-  return BeginSmoothScroll(&context, args, input_injector_, pixels_to_scroll,
-                           callback, gesture_source_type, direction,
-                           speed_in_pixels_s, true, start_x, start_y, 0,
-                           precise_scrolling_deltas, scroll_by_page,
-                           cursor_visible, scroll_by_percentage);
+  return BeginSmoothScroll(
+      &context, args, input_injector_, pixels_to_scrol_vector.value(), callback,
+      gesture_source_type, speed_in_pixels_s, true /* prevent_fling */, start_x,
+      start_y, fling_velocity, precise_scrolling_deltas, scroll_by_page,
+      cursor_visible, scroll_by_percentage, key_modifiers);
+}
+
+// SmoothScrollByXY does not take direction as one of the arguments, and
+// instead we pass two scroll delta values for both x and y directions, when
+// pixels_to_scroll_y is positive, it will scroll down, otherwise scroll up.
+// When pixels_to_scroll_x is positive, it will scroll right, otherwise
+// scroll left.
+bool GpuBenchmarking::SmoothScrollByXY(gin::Arguments* args) {
+  GpuBenchmarkingContext context(render_frame_.get());
+  blink::WebRect rect = context.render_widget()->ViewRect();
+
+  float pixels_to_scroll_x = 0;
+  float pixels_to_scroll_y = 0;
+  v8::Local<v8::Function> callback;
+  float start_x = rect.width / 2;
+  float start_y = rect.height / 2;
+  int gesture_source_type = SyntheticGestureParams::DEFAULT_INPUT;
+  float speed_in_pixels_s = 800;
+  bool precise_scrolling_deltas = true;
+  bool scroll_by_page = false;
+  bool cursor_visible = true;
+  bool scroll_by_percentage = false;
+  std::string keys_value;
+
+  if (!GetOptionalArg(args, &pixels_to_scroll_x) ||
+      !GetOptionalArg(args, &pixels_to_scroll_y) ||
+      !GetOptionalArg(args, &callback) || !GetOptionalArg(args, &start_x) ||
+      !GetOptionalArg(args, &start_y) ||
+      !GetOptionalArg(args, &gesture_source_type) ||
+      !GetOptionalArg(args, &speed_in_pixels_s) ||
+      !GetOptionalArg(args, &precise_scrolling_deltas) ||
+      !GetOptionalArg(args, &scroll_by_page) ||
+      !GetOptionalArg(args, &cursor_visible) ||
+      !GetOptionalArg(args, &scroll_by_percentage) ||
+      !GetOptionalArg(args, &keys_value)) {
+    return false;
+  }
+
+  // For all touch inputs, always scroll by precise deltas.
+  DCHECK(gesture_source_type != SyntheticGestureParams::TOUCH_INPUT ||
+         precise_scrolling_deltas);
+  // Scroll by page only for mouse inputs.
+  DCHECK(!scroll_by_page ||
+         gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+  // Scroll by percentage only for mouse inputs.
+  DCHECK(!scroll_by_percentage ||
+         gesture_source_type == SyntheticGestureParams::MOUSE_INPUT);
+
+  gfx::Vector2dF distances(pixels_to_scroll_x, pixels_to_scroll_y);
+  gfx::Vector2dF fling_velocity(0, 0);
+  int key_modifiers = 0;
+  std::vector<base::StringPiece> key_list = base::SplitStringPiece(
+      keys_value, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+  for (const base::StringPiece& key : key_list) {
+    int key_modifier = ToKeyModifiers(key);
+    if (key_modifier == 0) {
+      return false;
+    }
+    key_modifiers |= key_modifier;
+  }
+
+  EnsureRemoteInterface();
+  return BeginSmoothScroll(
+      &context, args, input_injector_, distances, callback, gesture_source_type,
+      speed_in_pixels_s, true /* prevent_fling */, start_x, start_y,
+      fling_velocity, precise_scrolling_deltas, scroll_by_page, cursor_visible,
+      scroll_by_percentage, key_modifiers);
 }
 
 bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
@@ -751,6 +859,10 @@ bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
                          speed_in_pixels_s);
 }
 
+// TODO(lanwei): Swipe takes pixels_to_scroll and direction. When the
+// pixels_to_scroll is positive and direction is up, it means the finger moves
+// up, but the page scrolls down, which is opposite to SmoothScrollBy. We
+// should change this to match with SmoothScrollBy or SmoothScrollByXY.
 bool GpuBenchmarking::Swipe(gin::Arguments* args) {
   GpuBenchmarkingContext context(render_frame_.get());
   blink::WebRect rect = context.render_widget()->ViewRect();
@@ -778,16 +890,27 @@ bool GpuBenchmarking::Swipe(gin::Arguments* args) {
   // needed for touchscreen swipe, because we will calculate the velocity in
   // our code.
   if (gesture_source_type == SyntheticGestureParams::TOUCHPAD_INPUT &&
-      fling_velocity == 0)
+      fling_velocity == 0) {
     fling_velocity = 1000;
+  }
+
+  base::Optional<gfx::Vector2dF> pixels_to_scrol_vector =
+      ToVector(direction, pixels_to_scroll);
+  base::Optional<gfx::Vector2dF> fling_velocity_vector =
+      ToVector(direction, fling_velocity);
+  if (!pixels_to_scrol_vector.has_value() ||
+      !fling_velocity_vector.has_value()) {
+    return false;
+  }
 
   EnsureRemoteInterface();
   return BeginSmoothScroll(
-      &context, args, input_injector_, -pixels_to_scroll, callback,
-      gesture_source_type, direction, speed_in_pixels_s, false, start_x,
-      start_y, fling_velocity, true /* precise_scrolling_deltas */,
+      &context, args, input_injector_, -pixels_to_scrol_vector.value(),
+      callback, gesture_source_type, speed_in_pixels_s,
+      false /* prevent_fling */, start_x, start_y,
+      fling_velocity_vector.value(), true /* precise_scrolling_deltas */,
       false /* scroll_by_page */, true /* cursor_visible */,
-      false /* scroll_by_percentage */);
+      false /* scroll_by_percentage */, 0 /* key_modifiers */);
 }
 
 bool GpuBenchmarking::ScrollBounce(gin::Arguments* args) {
@@ -1132,6 +1255,15 @@ void GpuBenchmarking::CrashGpuProcess() {
   gpu_channel->CrashGpuProcessForTesting();
 }
 
+// Terminates the GPU process with an exit code of 0.
+void GpuBenchmarking::TerminateGpuProcessNormally() {
+  gpu::GpuChannelHost* gpu_channel =
+      RenderThreadImpl::current()->GetGpuChannel();
+  if (!gpu_channel)
+    return;
+  gpu_channel->TerminateGpuProcessForTesting();
+}
+
 void GpuBenchmarking::GetGpuDriverBugWorkarounds(gin::Arguments* args) {
   std::vector<std::string> gpu_driver_bug_workarounds;
   gpu::GpuChannelHost* gpu_channel =
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.h b/chromium/content/renderer/gpu_benchmarking_extension.h
index 1f13e97d625..edd2c918aec 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.h
+++ b/chromium/content/renderer/gpu_benchmarking_extension.h
@@ -50,6 +50,7 @@ class GpuBenchmarking : public gin::Wrappable<GpuBenchmarking> {
 
   // All arguments in these methods are in visual viewport coordinates.
   bool SmoothScrollBy(gin::Arguments* args);
+  bool SmoothScrollByXY(gin::Arguments* args);
   bool SmoothDrag(gin::Arguments* args);
   bool Swipe(gin::Arguments* args);
   bool ScrollBounce(gin::Arguments* args);
@@ -82,6 +83,7 @@ class GpuBenchmarking : public gin::Wrappable<GpuBenchmarking> {
   bool HasGpuChannel();
   bool HasGpuProcess();
   void CrashGpuProcess();
+  void TerminateGpuProcessNormally();
   void GetGpuDriverBugWorkarounds(gin::Arguments* args);
 
   // Starts/stops the sampling profiler. StartProfiling takes one optional
diff --git a/chromium/content/renderer/impression_conversions.cc b/chromium/content/renderer/impression_conversions.cc
new file mode 100644
index 00000000000..81c7aee83b8
--- /dev/null
+++ b/chromium/content/renderer/impression_conversions.cc
@@ -0,0 +1,27 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/impression_conversions.h"
+
+#include <algorithm>
+#include <iterator>
+
+#include "third_party/blink/public/platform/web_security_origin.h"
+#include "third_party/blink/public/platform/web_string.h"
+
+namespace content {
+
+Impression ConvertWebImpressionToImpression(
+    const blink::WebImpression& web_impression) {
+  Impression result;
+
+  result.impression_data = web_impression.impression_data;
+  result.expiry = web_impression.expiry;
+  result.reporting_origin = web_impression.reporting_origin;
+  result.conversion_destination = web_impression.conversion_destination;
+
+  return result;
+}
+
+}  // namespace content
diff --git a/chromium/content/renderer/impression_conversions.h b/chromium/content/renderer/impression_conversions.h
new file mode 100644
index 00000000000..bf856b9809d
--- /dev/null
+++ b/chromium/content/renderer/impression_conversions.h
@@ -0,0 +1,18 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
+#define CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
+
+#include "content/public/common/impression.h"
+#include "third_party/blink/public/platform/web_impression.h"
+
+namespace content {
+
+Impression ConvertWebImpressionToImpression(
+    const blink::WebImpression& web_impression);
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_IMPRESSION_CONVERSIONS_H_
diff --git a/chromium/content/renderer/in_process_renderer_thread.cc b/chromium/content/renderer/in_process_renderer_thread.cc
index 1b60fd0d630..b662e2927b5 100644
--- a/chromium/content/renderer/in_process_renderer_thread.cc
+++ b/chromium/content/renderer/in_process_renderer_thread.cc
@@ -8,6 +8,7 @@
 #include "content/renderer/render_process.h"
 #include "content/renderer/render_process_impl.h"
 #include "content/renderer/render_thread_impl.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 
 #if defined(OS_ANDROID)
@@ -38,6 +39,7 @@ void InProcessRendererThread::Init() {
   // Android. Temporary CHECK() to debug http://crbug.com/514141
   CHECK(!render_process_);
 #endif
+  blink::Platform::InitializeBlink();
   std::unique_ptr<blink::scheduler::WebThreadScheduler> main_thread_scheduler =
       blink::scheduler::WebThreadScheduler::CreateMainThreadScheduler();
 
diff --git a/chromium/content/renderer/input/frame_input_handler_impl.cc b/chromium/content/renderer/input/frame_input_handler_impl.cc
index e0f8cf58899..3f710c7066e 100644
--- a/chromium/content/renderer/input/frame_input_handler_impl.cc
+++ b/chromium/content/renderer/input/frame_input_handler_impl.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/input/ime_text_span_conversions.h"
 #include "content/common/input/input_handler.mojom.h"
 #include "content/renderer/ime_event_guard.h"
diff --git a/chromium/content/renderer/input/input_event_prediction.cc b/chromium/content/renderer/input/input_event_prediction.cc
index b8a79476e80..30a63b7f73d 100644
--- a/chromium/content/renderer/input/input_event_prediction.cc
+++ b/chromium/content/renderer/input/input_event_prediction.cc
@@ -51,10 +51,10 @@ InputEventPrediction::InputEventPrediction(bool enable_resampling)
 
   if (predictor_name.empty())
     selected_predictor_type_ =
-        ui::input_prediction::PredictorType::kScrollPredictorTypeKalman;
+        blink::input_prediction::PredictorType::kScrollPredictorTypeKalman;
   else
     selected_predictor_type_ =
-        ui::PredictorFactory::GetPredictorTypeFromName(predictor_name);
+        blink::PredictorFactory::GetPredictorTypeFromName(predictor_name);
 
   mouse_predictor_ = CreatePredictor();
 }
@@ -65,9 +65,9 @@ void InputEventPrediction::HandleEvents(
     blink::WebCoalescedInputEvent& coalesced_event,
     base::TimeTicks frame_time) {
   switch (coalesced_event.Event().GetType()) {
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kPointerMove: {
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kPointerMove: {
       size_t coalesced_size = coalesced_event.CoalescedEventSize();
       for (size_t i = 0; i < coalesced_size; i++)
         UpdatePrediction(coalesced_event.CoalescedEvent(i));
@@ -78,8 +78,8 @@ void InputEventPrediction::HandleEvents(
       AddPredictedEvents(coalesced_event);
       break;
     }
-    case WebInputEvent::kTouchScrollStarted:
-    case WebInputEvent::kPointerCausedUaAction:
+    case WebInputEvent::Type::kTouchScrollStarted:
+    case WebInputEvent::Type::kPointerCausedUaAction:
       pointer_id_predictor_map_.clear();
       break;
     default:
@@ -87,23 +87,24 @@ void InputEventPrediction::HandleEvents(
   }
 }
 
-std::unique_ptr<ui::InputPredictor> InputEventPrediction::CreatePredictor()
+std::unique_ptr<blink::InputPredictor> InputEventPrediction::CreatePredictor()
     const {
-  return ui::PredictorFactory::GetPredictor(selected_predictor_type_);
+  return blink::PredictorFactory::GetPredictor(selected_predictor_type_);
 }
 
 void InputEventPrediction::UpdatePrediction(const WebInputEvent& event) {
   if (WebInputEvent::IsTouchEventType(event.GetType())) {
-    DCHECK(event.GetType() == WebInputEvent::kTouchMove);
+    DCHECK(event.GetType() == WebInputEvent::Type::kTouchMove);
     const WebTouchEvent& touch_event = static_cast<const WebTouchEvent&>(event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
-      if (touch_event.touches[i].state == blink::WebTouchPoint::kStateMoved) {
+      if (touch_event.touches[i].state ==
+          blink::WebTouchPoint::State::kStateMoved) {
         UpdateSinglePointer(touch_event.touches[i], touch_event.TimeStamp());
       }
     }
   } else {
-    DCHECK(event.GetType() == WebInputEvent::kMouseMove ||
-           event.GetType() == WebInputEvent::kPointerMove);
+    DCHECK(event.GetType() == WebInputEvent::Type::kMouseMove ||
+           event.GetType() == WebInputEvent::Type::kPointerMove);
     UpdateSinglePointer(*ToWebPointerProperties(&event), event.TimeStamp());
   }
   last_event_timestamp_ = event.TimeStamp();
@@ -114,10 +115,11 @@ void InputEventPrediction::ApplyResampling(base::TimeTicks frame_time,
   base::TimeDelta prediction_delta = frame_time - event->TimeStamp();
   base::TimeTicks predict_time;
 
-  if (event->GetType() == WebInputEvent::kTouchMove) {
+  if (event->GetType() == WebInputEvent::Type::kTouchMove) {
     WebTouchEvent* touch_event = static_cast<WebTouchEvent*>(event);
     for (unsigned i = 0; i < touch_event->touches_length; ++i) {
-      if (touch_event->touches[i].state == blink::WebTouchPoint::kStateMoved) {
+      if (touch_event->touches[i].state ==
+          blink::WebTouchPoint::State::kStateMoved) {
         if (auto* predictor = GetPredictor(touch_event->touches[i])) {
           // When resampling, we don't want to predict too far away because the
           // result will likely be inaccurate in that case. We then cut off the
@@ -149,9 +151,10 @@ void InputEventPrediction::ResetPredictor(const WebInputEvent& event) {
   if (WebInputEvent::IsTouchEventType(event.GetType())) {
     const WebTouchEvent& touch_event = static_cast<const WebTouchEvent&>(event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
-      if (touch_event.touches[i].state != blink::WebTouchPoint::kStateMoved &&
+      if (touch_event.touches[i].state !=
+              blink::WebTouchPoint::State::kStateMoved &&
           touch_event.touches[i].state !=
-              blink::WebTouchPoint::kStateStationary)
+              blink::WebTouchPoint::State::kStateStationary)
         pointer_id_predictor_map_.erase(touch_event.touches[i].id);
     }
   } else if (WebInputEvent::IsMouseEventType(event.GetType())) {
@@ -168,9 +171,10 @@ void InputEventPrediction::AddPredictedEvents(
       last_event_timestamp_ + mouse_predictor_->MaxPredictionTime();
   bool success = true;
   while (success) {
-    ui::WebScopedInputEvent predicted_event = coalesced_event.Event().Clone();
+    std::unique_ptr<WebInputEvent> predicted_event =
+        coalesced_event.Event().Clone();
     success = false;
-    if (predicted_event->GetType() == WebInputEvent::kTouchMove) {
+    if (predicted_event->GetType() == WebInputEvent::Type::kTouchMove) {
       WebTouchEvent& touch_event =
           static_cast<WebTouchEvent&>(*predicted_event);
       // Average all touch intervals
@@ -183,7 +187,7 @@ void InputEventPrediction::AddPredictedEvents(
       if (predict_time <= max_prediction_timestamp) {
         for (unsigned i = 0; i < touch_event.touches_length; ++i) {
           if (touch_event.touches[i].state ==
-              blink::WebTouchPoint::kStateMoved) {
+              blink::WebTouchPoint::State::kStateMoved) {
             success =
                 GetPointerPrediction(predict_time, &touch_event.touches[i]);
           }
@@ -203,7 +207,7 @@ void InputEventPrediction::AddPredictedEvents(
   }
 }
 
-ui::InputPredictor* InputEventPrediction::GetPredictor(
+blink::InputPredictor* InputEventPrediction::GetPredictor(
     const WebPointerProperties& event) const {
   if (event.pointer_type == WebPointerProperties::PointerType::kMouse)
     return mouse_predictor_.get();
@@ -225,7 +229,8 @@ base::TimeDelta InputEventPrediction::GetPredictionTimeInterval(
 void InputEventPrediction::UpdateSinglePointer(
     const WebPointerProperties& event,
     base::TimeTicks event_time) {
-  ui::InputPredictor::InputData data = {event.PositionInWidget(), event_time};
+  blink::InputPredictor::InputData data = {event.PositionInWidget(),
+                                           event_time};
   if (auto* predictor = GetPredictor(event)) {
     predictor->Update(data);
   } else {
diff --git a/chromium/content/renderer/input/input_event_prediction.h b/chromium/content/renderer/input/input_event_prediction.h
index 65456eb65a3..75610fe976a 100644
--- a/chromium/content/renderer/input/input_event_prediction.h
+++ b/chromium/content/renderer/input/input_event_prediction.h
@@ -8,10 +8,11 @@
 #include <list>
 #include <unordered_map>
 
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
+#include "content/common/content_export.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/platform/input/input_predictor.h"
+#include "third_party/blink/public/platform/input/predictor_factory.h"
 #include "ui/events/blink/blink_features.h"
-#include "ui/events/blink/prediction/input_predictor.h"
-#include "ui/events/blink/prediction/predictor_factory.h"
 #include "ui/events/event.h"
 
 using blink::WebInputEvent;
@@ -38,7 +39,7 @@ class CONTENT_EXPORT InputEventPrediction {
                     base::TimeTicks frame_time);
 
   // Initialize predictor for different pointer.
-  std::unique_ptr<ui::InputPredictor> CreatePredictor() const;
+  std::unique_ptr<blink::InputPredictor> CreatePredictor() const;
 
  private:
   friend class InputEventPredictionTest;
@@ -67,7 +68,7 @@ class CONTENT_EXPORT InputEventPrediction {
       const WebPointerProperties& event) const;
 
   // Returns a pointer to the predictor for given WebPointerProperties.
-  ui::InputPredictor* GetPredictor(const WebPointerProperties& event) const;
+  blink::InputPredictor* GetPredictor(const WebPointerProperties& event) const;
 
   // Get single predictor based on event id and type, and update the predictor
   // with new events coords.
@@ -84,13 +85,13 @@ class CONTENT_EXPORT InputEventPrediction {
   // predictor, for other pointer type, remove it from mapping.
   void ResetSinglePredictor(const WebPointerProperties& event);
 
-  std::unordered_map<ui::PointerId, std::unique_ptr<ui::InputPredictor>>
+  std::unordered_map<ui::PointerId, std::unique_ptr<blink::InputPredictor>>
       pointer_id_predictor_map_;
-  std::unique_ptr<ui::InputPredictor> mouse_predictor_;
+  std::unique_ptr<blink::InputPredictor> mouse_predictor_;
 
   // Store the field trial parameter used for choosing different types of
   // predictor.
-  ui::input_prediction::PredictorType selected_predictor_type_;
+  blink::input_prediction::PredictorType selected_predictor_type_;
 
   bool enable_resampling_ = false;
 
diff --git a/chromium/content/renderer/input/input_event_prediction_unittest.cc b/chromium/content/renderer/input/input_event_prediction_unittest.cc
index afc0a1ebdd9..0ad1d1df08f 100644
--- a/chromium/content/renderer/input/input_event_prediction_unittest.cc
+++ b/chromium/content/renderer/input/input_event_prediction_unittest.cc
@@ -10,9 +10,8 @@
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/public/common/content_features.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/features.h"
 #include "ui/events/base_event_utils.h"
-#include "ui/events/blink/prediction/empty_predictor.h"
-#include "ui/events/blink/prediction/predictor_factory.h"
 
 namespace content {
 
@@ -21,7 +20,7 @@ using blink::WebInputEvent;
 using blink::WebMouseEvent;
 using blink::WebPointerProperties;
 using blink::WebTouchEvent;
-using ui::input_prediction::PredictorType;
+using blink::input_prediction::PredictorType;
 }  // namespace
 
 class InputEventPredictionTest : public testing::Test {
@@ -30,14 +29,14 @@ class InputEventPredictionTest : public testing::Test {
     // Default to enable resampling with empty predictor for testing.
     ConfigureFieldTrialAndInitialize(
         features::kResamplingInputEvents,
-        ui::input_prediction::kScrollPredictorNameEmpty);
+        blink::features::kScrollPredictorNameEmpty);
   }
 
   int GetPredictorMapSize() const {
     return event_predictor_->pointer_id_predictor_map_.size();
   }
 
-  std::unique_ptr<ui::InputPredictor::InputData> GetPrediction(
+  std::unique_ptr<blink::InputPredictor::InputData> GetPrediction(
       const WebPointerProperties& event) const {
     if (event.pointer_type == WebPointerProperties::PointerType::kMouse) {
       return event_predictor_->mouse_predictor_->GeneratePrediction(
@@ -52,7 +51,7 @@ class InputEventPredictionTest : public testing::Test {
   }
 
   void HandleEvents(const WebInputEvent& event) {
-    blink::WebCoalescedInputEvent coalesced_event(event);
+    blink::WebCoalescedInputEvent coalesced_event(event, ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
   }
 
@@ -88,27 +87,23 @@ TEST_F(InputEventPredictionTest, PredictorType) {
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeEmpty);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameEmpty);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameEmpty);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeEmpty);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameLsq);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameLsq);
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeLsq);
 
@@ -117,9 +112,8 @@ TEST_F(InputEventPredictionTest, PredictorType) {
   EXPECT_EQ(event_predictor_->selected_predictor_type_,
             PredictorType::kScrollPredictorTypeKalman);
 
-  ConfigureFieldTrialAndInitialize(
-      features::kInputPredictorTypeChoice,
-      ui::input_prediction::kScrollPredictorNameLsq);
+  ConfigureFieldTrialAndInitialize(features::kInputPredictorTypeChoice,
+                                   blink::features::kScrollPredictorNameLsq);
   EXPECT_FALSE(event_predictor_->enable_resampling_);
   // When enable_resampling_ is true, kInputPredictorTypeChoice flag has no
   // effect.
@@ -130,7 +124,7 @@ TEST_F(InputEventPredictionTest, PredictorType) {
 
 TEST_F(InputEventPredictionTest, MouseEvent) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   EXPECT_FALSE(GetPrediction(mouse_move));
 
@@ -142,7 +136,7 @@ TEST_F(InputEventPredictionTest, MouseEvent) {
   EXPECT_EQ(predicted_point->pos.y(), 10);
 
   WebMouseEvent mouse_down = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
 
   HandleEvents(mouse_down);
   EXPECT_FALSE(GetPrediction(mouse_down));
@@ -173,7 +167,7 @@ TEST_F(InputEventPredictionTest, SingleTouchPoint) {
 
 TEST_F(InputEventPredictionTest, MouseEventTypePen) {
   WebMouseEvent pen_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0,
+      WebInputEvent::Type::kMouseMove, 10, 10, 0,
       WebPointerProperties::PointerType::kPen);
 
   EXPECT_FALSE(GetPrediction(pen_move));
@@ -185,7 +179,7 @@ TEST_F(InputEventPredictionTest, MouseEventTypePen) {
   EXPECT_EQ(predicted_point->pos.y(), 10);
 
   WebMouseEvent pen_leave = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseLeave, 10, 10, 0,
+      WebInputEvent::Type::kMouseLeave, 10, 10, 0,
       WebPointerProperties::PointerType::kPen);
 
   HandleEvents(pen_leave);
@@ -232,14 +226,14 @@ TEST_F(InputEventPredictionTest, MultipleTouchPoint) {
 
 TEST_F(InputEventPredictionTest, TouchAndStylusResetMousePredictor) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   HandleEvents(mouse_move);
   auto predicted_point = GetPrediction(mouse_move);
   EXPECT_TRUE(predicted_point);
 
   WebMouseEvent pen_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 20, 20, 0,
+      WebInputEvent::Type::kMouseMove, 20, 20, 0,
       WebPointerProperties::PointerType::kPen);
   pen_move.id = 1;
 
@@ -284,7 +278,7 @@ TEST_F(InputEventPredictionTest, TouchScrollStartedRemoveAllTouchPoints) {
   HandleEvents(touch_event);
   EXPECT_EQ(GetPredictorMapSize(), 2);
 
-  touch_event.SetType(WebInputEvent::kTouchScrollStarted);
+  touch_event.SetType(WebInputEvent::Type::kTouchScrollStarted);
   HandleEvents(touch_event);
   EXPECT_EQ(GetPredictorMapSize(), 0);
 }
@@ -298,21 +292,21 @@ TEST_F(InputEventPredictionTest, ResamplingDisabled) {
 
   // Send 3 mouse move to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   HandleEvents(mouse_move);
 
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   HandleEvents(mouse_move);
 
   // The 4th move event should generate predicted events.
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 13, 7, 0);
-  blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 13, 7, 0);
+  blink::WebCoalescedInputEvent coalesced_event(mouse_move, ui::LatencyInfo());
   event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
 
   EXPECT_GT(coalesced_event.PredictedEventSize(), 0u);
@@ -327,9 +321,8 @@ TEST_F(InputEventPredictionTest, ResamplingDisabled) {
 
 // Test that when dt > maxResampling, resampling is cut off .
 TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
 
   base::TimeDelta predictor_max_resample_time =
       event_predictor_->mouse_predictor_->MaxResampleTime();
@@ -337,25 +330,26 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
   base::TimeTicks event_time = ui::EventTimeForNow();
   // Send 3 mouse move each has 8ms interval to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   mouse_move.SetTimeStamp(event_time);
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
   HandleEvents(mouse_move);
 
   {
     // When frame_time is 8ms away from the last event, we have both resampling
     // and 3 predicted events.
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      13, 7, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 13, 7, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     base::TimeTicks frame_time =
         event_time + predictor_max_resample_time;  // No cut off
     event_predictor_->HandleEvents(coalesced_event, frame_time);
@@ -376,10 +370,11 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
     // Test When the delta time between the frame time and the event is greater
     // than the maximum resampling time for a predictor, the resampling is cut
     // off to the maximum allowed by the predictor
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      14, 6, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 14, 6, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(8));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     base::TimeTicks frame_time =
         event_time + predictor_max_resample_time +
         base::TimeDelta::FromMilliseconds(10);  // overpredict on purpose
@@ -402,30 +397,30 @@ TEST_F(InputEventPredictionTest, NoResampleWhenExceedMaxResampleTime) {
 
 // Test that when dt between events is 6ms, first predicted point is 6ms ahead.
 TEST_F(InputEventPredictionTest, PredictedEventsTimeIntervalEqualRealEvents) {
-  ConfigureFieldTrialAndInitialize(
-      features::kResamplingInputEvents,
-      ui::input_prediction::kScrollPredictorNameKalman);
+  ConfigureFieldTrialAndInitialize(features::kResamplingInputEvents,
+                                   blink::features::kScrollPredictorNameKalman);
 
   base::TimeTicks event_time = ui::EventTimeForNow();
   // Send 3 mouse move each has 6ms interval to get kalman predictor ready.
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   mouse_move.SetTimeStamp(event_time);
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 11, 9, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 11, 9, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
   HandleEvents(mouse_move);
-  mouse_move =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove, 12, 8, 0);
+  mouse_move = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseMove, 12, 8, 0);
   mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
   HandleEvents(mouse_move);
 
   {
-    mouse_move = SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseMove,
-                                                      13, 7, 0);
+    mouse_move = SyntheticWebMouseEventBuilder::Build(
+        WebInputEvent::Type::kMouseMove, 13, 7, 0);
     mouse_move.SetTimeStamp(event_time += base::TimeDelta::FromMilliseconds(6));
-    blink::WebCoalescedInputEvent coalesced_event(mouse_move);
+    blink::WebCoalescedInputEvent coalesced_event(mouse_move,
+                                                  ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, event_time);
 
     EXPECT_EQ(coalesced_event.PredictedEventSize(), 4u);
@@ -446,13 +441,16 @@ TEST_F(InputEventPredictionTest, TouchPointStates) {
     HandleEvents(touch_event);
   }
 
-  for (int state = blink::WebTouchPoint::kStateUndefined;
-       state <= blink::WebTouchPoint::kStateMax; state++) {
+  for (size_t state =
+           static_cast<size_t>(blink::WebTouchPoint::State::kStateUndefined);
+       state <= static_cast<size_t>(blink::WebTouchPoint::State::kStateMax);
+       state++) {
     touch_event.touches[0].state =
         static_cast<blink::WebTouchPoint::State>(state);
-    blink::WebCoalescedInputEvent coalesced_event(touch_event);
+    blink::WebCoalescedInputEvent coalesced_event(touch_event,
+                                                  ui::LatencyInfo());
     event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
-    if (state == blink::WebTouchPoint::kStateMoved)
+    if (state == static_cast<size_t>(blink::WebTouchPoint::State::kStateMoved))
       EXPECT_GT(coalesced_event.PredictedEventSize(), 0u);
     else
       EXPECT_EQ(coalesced_event.PredictedEventSize(), 0u);
diff --git a/chromium/content/renderer/input/input_target_client_impl.cc b/chromium/content/renderer/input/input_target_client_impl.cc
index c5b1dd957c4..021c306fb72 100644
--- a/chromium/content/renderer/input/input_target_client_impl.cc
+++ b/chromium/content/renderer/input/input_target_client_impl.cc
@@ -5,7 +5,7 @@
 #include "content/renderer/input/input_target_client_impl.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_widget.h"
 
diff --git a/chromium/content/renderer/input/main_thread_event_queue.cc b/chromium/content/renderer/input/main_thread_event_queue.cc
index 1f979e5a38a..ac3ef9423a1 100644
--- a/chromium/content/renderer/input/main_thread_event_queue.cc
+++ b/chromium/content/renderer/input/main_thread_event_queue.cc
@@ -12,6 +12,7 @@
 #include "content/common/input/event_with_latency_info.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/render_widget.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event_attribution.h"
 
 namespace content {
@@ -47,7 +48,7 @@ constexpr base::TimeDelta kAsyncTouchMoveInterval =
 
 }  // namespace
 
-class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
+class QueuedWebInputEvent : public blink::WebCoalescedInputEvent,
                             public MainThreadEventQueueTask {
  public:
   QueuedWebInputEvent(ui::WebScopedInputEvent event,
@@ -56,7 +57,7 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
                       HandledEventCallback callback,
                       bool known_by_scheduler,
                       const blink::WebInputEventAttribution& attribution)
-      : ScopedWebInputEventWithLatencyInfo(std::move(event), latency),
+      : WebCoalescedInputEvent(std::move(event), latency),
         originally_cancelable_(originally_cancelable),
         callback_(std::move(callback)),
         known_by_scheduler_count_(known_by_scheduler ? 1 : 0),
@@ -64,12 +65,22 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
 
   ~QueuedWebInputEvent() override {}
 
-  bool ArePointerMoveEventTypes(QueuedWebInputEvent* other_event) {
+  bool AreCoalescablePointerRawUpdateEvents(QueuedWebInputEvent* other_event) {
     // There is no pointermove at this point in the queue.
-    DCHECK(event().GetType() != WebInputEvent::kPointerMove &&
-           other_event->event().GetType() != WebInputEvent::kPointerMove);
-    return event().GetType() == WebInputEvent::kPointerRawUpdate &&
-           other_event->event().GetType() == WebInputEvent::kPointerRawUpdate;
+    DCHECK(Event().GetType() != WebInputEvent::Type::kPointerMove &&
+           other_event->Event().GetType() != WebInputEvent::Type::kPointerMove);
+    // Events with modifiers differing by kRelativeMotionEvent should not be
+    // coalesced. In case of a pointer lock, kRelativeMotionEvent is sent
+    // when the cursor is recentered. Events post the recentered event have
+    // a big delta compared to the previous events and hence should not be
+    // coalesced.
+    return Event().GetType() == WebInputEvent::Type::kPointerRawUpdate &&
+           other_event->Event().GetType() ==
+               WebInputEvent::Type::kPointerRawUpdate &&
+           ((Event().GetModifiers() &
+             blink::WebInputEvent::Modifiers::kRelativeMotionEvent) ==
+            (other_event->Event().GetModifiers() &
+             blink::WebInputEvent::Modifiers::kRelativeMotionEvent));
   }
 
   FilterResult FilterNewEvent(MainThreadEventQueueTask* other_task) override {
@@ -78,30 +89,39 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
 
     QueuedWebInputEvent* other_event =
         static_cast<QueuedWebInputEvent*>(other_task);
-    if (other_event->event().GetType() ==
-        blink::WebInputEvent::kTouchScrollStarted) {
+    if (other_event->Event().GetType() ==
+        blink::WebInputEvent::Type::kTouchScrollStarted) {
       return HandleTouchScrollStartQueued();
     }
 
-    if (!event().IsSameEventClass(other_event->event()))
+    if (!Event().IsSameEventClass(other_event->Event()))
       return FilterResult::KeepIterating;
 
-    if (!ScopedWebInputEventWithLatencyInfo::CanCoalesceWith(*other_event)) {
+    if (!CanCoalesceWith(*other_event)) {
       // Two pointerevents may not be able to coalesce but we should continue
       // looking further down the queue if both of them were rawupdate or move
       // events and only their pointer_type, id, or event_type was different.
-      if (ArePointerMoveEventTypes(other_event))
+      if (AreCoalescablePointerRawUpdateEvents(other_event))
         return FilterResult::KeepIterating;
       return FilterResult::StopIterating;
     }
 
-    // If the other event was blocking store its callback to call later.
+    // If the other event was blocking store its callback to call later, but we
+    // also save the trace_id to ensure the flow events correct show the
+    // critical path.
+    //
+    // IMPORTANT: this if has to remain above CoalesceWith because that will
+    // overwrite other_event->latency_info() to be equal to |latency_|
+    // (including
+    //  trace_id).
     if (other_event->callback_) {
       blocking_coalesced_callbacks_.push_back(
-          std::move(other_event->callback_));
+          std::make_pair(std::move(other_event->callback_),
+                         other_event->latency_info().trace_id()));
     }
+
     known_by_scheduler_count_ += other_event->known_by_scheduler_count_;
-    ScopedWebInputEventWithLatencyInfo::CoalesceWith(*other_event);
+    CoalesceWith(*other_event);
 
     // The newest event (|other_item|) always wins when updating fields.
     originally_cancelable_ = other_event->originally_cancelable_;
@@ -115,19 +135,19 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
     HandledEventCallback callback =
         base::BindOnce(&QueuedWebInputEvent::HandledEvent,
                        base::Unretained(this), base::RetainedRef(queue));
-    if (!queue->HandleEventOnMainThread(coalesced_event(), latencyInfo(),
-                                        attribution(), std::move(callback))) {
+    if (!queue->HandleEventOnMainThread(*this, attribution(),
+                                        std::move(callback))) {
       // The |callback| won't be run, so our stored |callback_| should run
       // indicating error.
-      HandledEvent(queue, INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latencyInfo(),
-                   nullptr, base::nullopt);
+      HandledEvent(queue, blink::mojom::InputEventResultState::kNotConsumed,
+                   latency_info(), nullptr, base::nullopt);
     }
   }
 
   void HandledEvent(MainThreadEventQueue* queue,
-                    InputEventAckState ack_result,
+                    blink::mojom::InputEventResultState ack_result,
                     const ui::LatencyInfo& latency_info,
-                    std::unique_ptr<ui::DidOverscrollParams> overscroll,
+                    blink::mojom::DidOverscrollParamsPtr overscroll,
                     base::Optional<cc::TouchAction> touch_action) {
     if (callback_) {
       std::move(callback_).Run(ack_result, latency_info, std::move(overscroll),
@@ -140,8 +160,9 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
       ui::LatencyInfo coalesced_latency_info = latency_info;
       coalesced_latency_info.set_coalesced();
       for (auto&& callback : blocking_coalesced_callbacks_) {
-        std::move(callback).Run(ack_result, coalesced_latency_info, nullptr,
-                                base::nullopt);
+        coalesced_latency_info.set_trace_id(callback.second);
+        std::move(callback.first)
+            .Run(ack_result, coalesced_latency_info, nullptr, base::nullopt);
       }
     }
 
@@ -150,9 +171,10 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
       // events processed.
       for (size_t i = 0; i < known_by_scheduler_count_; ++i) {
         queue->main_thread_scheduler_->DidHandleInputEventOnMainThread(
-            event(), ack_result == INPUT_EVENT_ACK_STATE_CONSUMED
-                         ? blink::WebInputEventResult::kHandledApplication
-                         : blink::WebInputEventResult::kNotHandled);
+            Event(),
+            ack_result == blink::mojom::InputEventResultState::kConsumed
+                ? blink::WebInputEventResult::kHandledApplication
+                : blink::WebInputEventResult::kNotHandled);
       }
     }
   }
@@ -165,27 +187,29 @@ class QueuedWebInputEvent : public ScopedWebInputEventWithLatencyInfo,
   FilterResult HandleTouchScrollStartQueued() {
     // A TouchScrollStart will queued after this touch move which will make all
     // previous touch moves that are queued uncancelable.
-    switch (event().GetType()) {
-      case blink::WebInputEvent::kTouchMove: {
-        blink::WebTouchEvent& touch_event =
-            static_cast<blink::WebTouchEvent&>(event());
-        if (touch_event.dispatch_type ==
+    switch (Event().GetType()) {
+      case blink::WebInputEvent::Type::kTouchMove: {
+        blink::WebTouchEvent* touch_event =
+            static_cast<blink::WebTouchEvent*>(EventPointer());
+        if (touch_event->dispatch_type ==
             blink::WebInputEvent::DispatchType::kBlocking) {
-          touch_event.dispatch_type =
+          touch_event->dispatch_type =
               blink::WebInputEvent::DispatchType::kEventNonBlocking;
         }
         return FilterResult::KeepIterating;
       }
-      case blink::WebInputEvent::kTouchStart:
-      case blink::WebInputEvent::kTouchEnd:
+      case blink::WebInputEvent::Type::kTouchStart:
+      case blink::WebInputEvent::Type::kTouchEnd:
         return FilterResult::StopIterating;
       default:
         return FilterResult::KeepIterating;
     }
   }
 
-  // Contains the pending callbacks to be called.
-  base::circular_deque<HandledEventCallback> blocking_coalesced_callbacks_;
+  // Contains the pending callbacks to be called, along with their associated
+  // trace_ids.
+  base::circular_deque<std::pair<HandledEventCallback, int64_t>>
+      blocking_coalesced_callbacks_;
   // Contains the number of non-blocking events coalesced.
 
   // Whether the received event was originally cancelable or not. The compositor
@@ -213,8 +237,6 @@ MainThreadEventQueue::MainThreadEventQueue(
     bool allow_raf_aligned_input)
     : client_(client),
       last_touch_start_forced_nonblocking_due_to_fling_(false),
-      enable_fling_passive_listener_flag_(base::FeatureList::IsEnabled(
-          features::kPassiveEventListenersDueToFling)),
       needs_low_latency_(false),
       needs_unbuffered_input_for_debugger_(false),
       allow_raf_aligned_input_(allow_raf_aligned_input),
@@ -233,20 +255,22 @@ void MainThreadEventQueue::HandleEvent(
     ui::WebScopedInputEvent event,
     const ui::LatencyInfo& latency,
     InputEventDispatchType original_dispatch_type,
-    InputEventAckState ack_result,
+    blink::mojom::InputEventResultState ack_result,
     const blink::WebInputEventAttribution& attribution,
     HandledEventCallback callback) {
   TRACE_EVENT2("input", "MainThreadEventQueue::HandleEvent", "dispatch_type",
                original_dispatch_type, "event_type", event->GetType());
   DCHECK(original_dispatch_type == DISPATCH_TYPE_BLOCKING ||
          original_dispatch_type == DISPATCH_TYPE_NON_BLOCKING);
-  DCHECK(ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING ||
-         ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
-         ack_result == INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-
-  bool non_blocking = original_dispatch_type == DISPATCH_TYPE_NON_BLOCKING ||
-                      ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING;
-  bool is_wheel = event->GetType() == blink::WebInputEvent::kMouseWheel;
+  DCHECK(ack_result == blink::mojom::InputEventResultState::kSetNonBlocking ||
+         ack_result ==
+             blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
+         ack_result == blink::mojom::InputEventResultState::kNotConsumed);
+
+  bool is_blocking =
+      original_dispatch_type == DISPATCH_TYPE_BLOCKING &&
+      ack_result != blink::mojom::InputEventResultState::kSetNonBlocking;
+  bool is_wheel = event->GetType() == blink::WebInputEvent::Type::kMouseWheel;
   bool is_touch = blink::WebInputEvent::IsTouchEventType(event->GetType());
   bool originally_cancelable = false;
 
@@ -254,76 +278,77 @@ void MainThreadEventQueue::HandleEvent(
     blink::WebTouchEvent* touch_event =
         static_cast<blink::WebTouchEvent*>(event.get());
 
-    originally_cancelable =
-        touch_event->dispatch_type == blink::WebInputEvent::kBlocking;
+    originally_cancelable = touch_event->dispatch_type ==
+                            blink::WebInputEvent::DispatchType::kBlocking;
 
     // Adjust the |dispatchType| on the event since the compositor
     // determined all event listeners are passive.
-    if (non_blocking) {
+    if (!is_blocking) {
       touch_event->dispatch_type =
-          blink::WebInputEvent::kListenersNonBlockingPassive;
+          blink::WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     }
-    if (touch_event->GetType() == blink::WebInputEvent::kTouchStart)
+    if (touch_event->GetType() == blink::WebInputEvent::Type::kTouchStart)
       last_touch_start_forced_nonblocking_due_to_fling_ = false;
 
-    if (enable_fling_passive_listener_flag_ &&
-        touch_event->touch_start_or_first_touch_move &&
-        touch_event->dispatch_type == blink::WebInputEvent::kBlocking) {
+    if (touch_event->touch_start_or_first_touch_move &&
+        touch_event->dispatch_type ==
+            blink::WebInputEvent::DispatchType::kBlocking) {
       // If the touch start is forced to be passive due to fling, its following
       // touch move should also be passive.
-      if (ack_result == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
+      if (ack_result ==
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
           last_touch_start_forced_nonblocking_due_to_fling_) {
-        touch_event->dispatch_type =
-            blink::WebInputEvent::kListenersForcedNonBlockingDueToFling;
-        non_blocking = true;
+        touch_event->dispatch_type = blink::WebInputEvent::DispatchType::
+            kListenersForcedNonBlockingDueToFling;
+        is_blocking = false;
         last_touch_start_forced_nonblocking_due_to_fling_ = true;
       }
     }
 
     // If the event is non-cancelable ACK it right away.
-    if (!non_blocking &&
-        touch_event->dispatch_type != blink::WebInputEvent::kBlocking)
-      non_blocking = true;
+    if (is_blocking && touch_event->dispatch_type !=
+                           blink::WebInputEvent::DispatchType::kBlocking)
+      is_blocking = false;
   }
 
   if (is_wheel) {
     blink::WebMouseWheelEvent* wheel_event =
         static_cast<blink::WebMouseWheelEvent*>(event.get());
-    originally_cancelable =
-        wheel_event->dispatch_type == blink::WebInputEvent::kBlocking;
-    if (non_blocking) {
+    originally_cancelable = wheel_event->dispatch_type ==
+                            blink::WebInputEvent::DispatchType::kBlocking;
+    if (!is_blocking) {
       // Adjust the |dispatchType| on the event since the compositor
       // determined all event listeners are passive.
       wheel_event->dispatch_type =
-          blink::WebInputEvent::kListenersNonBlockingPassive;
+          blink::WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     }
   }
 
   HandledEventCallback event_callback;
-  if (!non_blocking) {
-    TRACE_EVENT_INSTANT0("input", "NonBlocking", TRACE_EVENT_SCOPE_THREAD);
+  if (is_blocking) {
+    TRACE_EVENT_INSTANT0("input", "Blocking", TRACE_EVENT_SCOPE_THREAD);
     event_callback = std::move(callback);
   }
 
   if (has_pointerrawupdate_handlers_) {
-    if (event->GetType() == WebInputEvent::kMouseMove) {
+    if (event->GetType() == WebInputEvent::Type::kMouseMove) {
       ui::WebScopedInputEvent raw_event(new blink::WebPointerEvent(
-          WebInputEvent::kPointerRawUpdate,
+          WebInputEvent::Type::kPointerRawUpdate,
           *(static_cast<blink::WebMouseEvent*>(event.get()))));
       std::unique_ptr<QueuedWebInputEvent> raw_queued_event(
           new QueuedWebInputEvent(std::move(raw_event), latency, false,
                                   HandledEventCallback(), false, attribution));
 
       QueueEvent(std::move(raw_queued_event));
-    } else if (event->GetType() == WebInputEvent::kTouchMove) {
+    } else if (event->GetType() == WebInputEvent::Type::kTouchMove) {
       const blink::WebTouchEvent& touch_event =
           *static_cast<const blink::WebTouchEvent*>(event.get());
       for (unsigned i = 0; i < touch_event.touches_length; ++i) {
         const blink::WebTouchPoint& touch_point = touch_event.touches[i];
-        if (touch_point.state == blink::WebTouchPoint::kStateMoved) {
+        if (touch_point.state == blink::WebTouchPoint::State::kStateMoved) {
           ui::WebScopedInputEvent raw_event(
               new blink::WebPointerEvent(touch_event, touch_point));
-          raw_event->SetType(WebInputEvent::kPointerRawUpdate);
+          raw_event->SetType(WebInputEvent::Type::kPointerRawUpdate);
           std::unique_ptr<QueuedWebInputEvent> raw_queued_event(
               new QueuedWebInputEvent(std::move(raw_event), latency, false,
                                       HandledEventCallback(), false,
@@ -453,10 +478,10 @@ static bool IsAsyncTouchMove(
     return false;
   const QueuedWebInputEvent* event =
       static_cast<const QueuedWebInputEvent*>(queued_item.get());
-  if (event->event().GetType() != blink::WebInputEvent::kTouchMove)
+  if (event->Event().GetType() != blink::WebInputEvent::Type::kTouchMove)
     return false;
   const blink::WebTouchEvent& touch_event =
-      static_cast<const blink::WebTouchEvent&>(event->event());
+      static_cast<const blink::WebTouchEvent&>(event->Event());
   return touch_event.moved_beyond_slop_region && !event->originallyCancelable();
 }
 
@@ -522,12 +547,12 @@ void MainThreadEventQueue::QueueEvent(
   // Record the input event's type prior to enqueueing so that the scheduler
   // can be notified of its dispatch (if the event is not coalesced).
   bool is_input_event = event->IsWebInputEvent();
-  WebInputEvent::Type input_event_type = WebInputEvent::kUndefined;
+  WebInputEvent::Type input_event_type = WebInputEvent::Type::kUndefined;
   blink::WebInputEventAttribution attribution;
   if (is_input_event) {
     auto* queued_input_event =
         static_cast<const QueuedWebInputEvent*>(event.get());
-    input_event_type = queued_input_event->event().GetType();
+    input_event_type = queued_input_event->Event().GetType();
     attribution = queued_input_event->attribution();
   }
 
@@ -562,8 +587,8 @@ bool MainThreadEventQueue::IsRawUpdateEvent(
     const std::unique_ptr<MainThreadEventQueueTask>& item) const {
   return item->IsWebInputEvent() &&
          static_cast<const QueuedWebInputEvent*>(item.get())
-                 ->event()
-                 .GetType() == blink::WebInputEvent::kPointerRawUpdate;
+                 ->Event()
+                 .GetType() == blink::WebInputEvent::Type::kPointerRawUpdate;
 }
 
 bool MainThreadEventQueue::ShouldFlushQueue(
@@ -579,10 +604,10 @@ bool MainThreadEventQueue::IsRafAlignedEvent(
     return false;
   const QueuedWebInputEvent* event =
       static_cast<const QueuedWebInputEvent*>(item.get());
-  switch (event->event().GetType()) {
-    case blink::WebInputEvent::kMouseMove:
-    case blink::WebInputEvent::kMouseWheel:
-    case blink::WebInputEvent::kTouchMove:
+  switch (event->Event().GetType()) {
+    case blink::WebInputEvent::Type::kMouseMove:
+    case blink::WebInputEvent::Type::kMouseWheel:
+    case blink::WebInputEvent::Type::kTouchMove:
       return allow_raf_aligned_input_ && !needs_low_latency_ &&
              !needs_low_latency_until_pointer_up_ &&
              !needs_unbuffered_input_for_debugger_;
@@ -596,13 +621,12 @@ void MainThreadEventQueue::HandleEventResampling(
     base::TimeTicks frame_time) {
   if (item->IsWebInputEvent() && allow_raf_aligned_input_ && event_predictor_) {
     QueuedWebInputEvent* event = static_cast<QueuedWebInputEvent*>(item.get());
-    event_predictor_->HandleEvents(event->coalesced_event(), frame_time);
+    event_predictor_->HandleEvents(*event, frame_time);
   }
 }
 
 bool MainThreadEventQueue::HandleEventOnMainThread(
     const blink::WebCoalescedInputEvent& event,
-    const ui::LatencyInfo& latency,
     const blink::WebInputEventAttribution& attribution,
     HandledEventCallback handled_callback) {
   // Notify the scheduler that the main thread is about to execute handlers.
@@ -612,18 +636,17 @@ bool MainThreadEventQueue::HandleEventOnMainThread(
 
   bool handled = false;
   if (client_) {
-    handled =
-        client_->HandleInputEvent(event, latency, std::move(handled_callback));
+    handled = client_->HandleInputEvent(event, std::move(handled_callback));
   }
 
   if (needs_low_latency_until_pointer_up_) {
     // Reset the needs low latency until pointer up mode if necessary.
     switch (event.Event().GetType()) {
-      case blink::WebInputEvent::kMouseUp:
-      case blink::WebInputEvent::kTouchCancel:
-      case blink::WebInputEvent::kTouchEnd:
-      case blink::WebInputEvent::kPointerCancel:
-      case blink::WebInputEvent::kPointerUp:
+      case blink::WebInputEvent::Type::kMouseUp:
+      case blink::WebInputEvent::Type::kTouchCancel:
+      case blink::WebInputEvent::Type::kTouchEnd:
+      case blink::WebInputEvent::Type::kPointerCancel:
+      case blink::WebInputEvent::Type::kPointerUp:
         needs_low_latency_until_pointer_up_ = false;
         break;
       default:
diff --git a/chromium/content/renderer/input/main_thread_event_queue.h b/chromium/content/renderer/input/main_thread_event_queue.h
index 0709a790c6b..8f338767dbc 100644
--- a/chromium/content/renderer/input/main_thread_event_queue.h
+++ b/chromium/content/renderer/input/main_thread_event_queue.h
@@ -13,22 +13,21 @@
 #include "content/common/content_export.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/renderer/input/input_event_prediction.h"
 #include "content/renderer/input/main_thread_event_queue_task_list.h"
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/latency/latency_info.h"
 
 namespace content {
 
 using HandledEventCallback =
-    base::OnceCallback<void(InputEventAckState ack_state,
+    base::OnceCallback<void(blink::mojom::InputEventResultState ack_state,
                             const ui::LatencyInfo& latency_info,
-                            std::unique_ptr<ui::DidOverscrollParams>,
+                            blink::mojom::DidOverscrollParamsPtr,
                             base::Optional<cc::TouchAction>)>;
 
 // All interaction with the MainThreadEventQueueClient will occur
@@ -39,7 +38,6 @@ class CONTENT_EXPORT MainThreadEventQueueClient {
   // another event). Returns false if the event will not be handled, and the
   // |handled_callback| will not be run.
   virtual bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                                const ui::LatencyInfo& latency_info,
                                 HandledEventCallback handled_callback) = 0;
   // Requests a BeginMainFrame callback from the compositor.
   virtual void SetNeedsMainFrame() = 0;
@@ -95,7 +93,7 @@ class CONTENT_EXPORT MainThreadEventQueue
   void HandleEvent(ui::WebScopedInputEvent event,
                    const ui::LatencyInfo& latency,
                    InputEventDispatchType dispatch_type,
-                   InputEventAckState ack_result,
+                   blink::mojom::InputEventResultState ack_result,
                    const blink::WebInputEventAttribution& attribution,
                    HandledEventCallback handled_callback);
   void DispatchRafAlignedInput(base::TimeTicks frame_time);
@@ -115,9 +113,11 @@ class CONTENT_EXPORT MainThreadEventQueue
       const std::unique_ptr<MainThreadEventQueueTask>& item,
       base::TimeTicks frame_time);
 
-  static bool IsForwardedAndSchedulerKnown(InputEventAckState ack_state) {
-    return ack_state == INPUT_EVENT_ACK_STATE_NOT_CONSUMED ||
-           ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING;
+  static bool IsForwardedAndSchedulerKnown(
+      blink::mojom::InputEventResultState ack_state) {
+    return ack_state == blink::mojom::InputEventResultState::kNotConsumed ||
+           ack_state ==
+               blink::mojom::InputEventResultState::kSetNonBlockingDueToFling;
   }
 
  protected:
@@ -132,7 +132,6 @@ class CONTENT_EXPORT MainThreadEventQueue
   // will not be run.
   bool HandleEventOnMainThread(
       const blink::WebCoalescedInputEvent& event,
-      const ui::LatencyInfo& latency,
       const blink::WebInputEventAttribution& attribution,
       HandledEventCallback handled_callback);
 
@@ -153,7 +152,6 @@ class CONTENT_EXPORT MainThreadEventQueue
   friend class MainThreadEventQueueInitializationTest;
   MainThreadEventQueueClient* client_;
   bool last_touch_start_forced_nonblocking_due_to_fling_;
-  bool enable_fling_passive_listener_flag_;
   bool needs_low_latency_;
   bool needs_unbuffered_input_for_debugger_;
   bool allow_raf_aligned_input_;
diff --git a/chromium/content/renderer/input/main_thread_event_queue_task.h b/chromium/content/renderer/input/main_thread_event_queue_task.h
index b5503f9c2d8..e9baf679dab 100644
--- a/chromium/content/renderer/input/main_thread_event_queue_task.h
+++ b/chromium/content/renderer/input/main_thread_event_queue_task.h
@@ -5,8 +5,8 @@
 #ifndef CONTENT_RENDERER_INPUT_MAIN_THREAD_EVENT_QUEUE_TASK_H_
 #define CONTENT_RENDERER_INPUT_MAIN_THREAD_EVENT_QUEUE_TASK_H_
 
-#include "content/public/common/input_event_ack_state.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 
 namespace content {
diff --git a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
index c35f8ded6f2..69894a688df 100644
--- a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
+++ b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
@@ -83,7 +83,7 @@ bool Equal(const WebMouseWheelEvent& lhs, const WebMouseWheelEvent& rhs) {
 
 class HandledTask {
  public:
-  virtual ~HandledTask() {}
+  virtual ~HandledTask() = default;
 
   virtual blink::WebCoalescedInputEvent* taskAsEvent() = 0;
   virtual unsigned taskAsClosure() const = 0;
@@ -92,10 +92,8 @@ class HandledTask {
 class HandledEvent : public HandledTask {
  public:
   explicit HandledEvent(const blink::WebCoalescedInputEvent& event)
-      : event_(event.Event(),
-               event.GetCoalescedEventsPointers(),
-               event.GetPredictedEventsPointers()) {}
-  ~HandledEvent() override {}
+      : event_(event) {}
+  ~HandledEvent() override = default;
 
   blink::WebCoalescedInputEvent* taskAsEvent() override { return &event_; }
   unsigned taskAsClosure() const override {
@@ -110,7 +108,7 @@ class HandledEvent : public HandledTask {
 class HandledClosure : public HandledTask {
  public:
   explicit HandledClosure(unsigned closure_id) : closure_id_(closure_id) {}
-  ~HandledClosure() override {}
+  ~HandledClosure() override = default;
 
   blink::WebCoalescedInputEvent* taskAsEvent() override {
     NOTREACHED();
@@ -160,9 +158,9 @@ class HandledEventCallbackTracker {
   }
 
   void DidHandleEvent(size_t index,
-                      InputEventAckState ack_result,
+                      blink::mojom::InputEventResultState ack_result,
                       const ui::LatencyInfo& latency,
-                      std::unique_ptr<ui::DidOverscrollParams> params,
+                      blink::mojom::DidOverscrollParamsPtr params,
                       base::Optional<cc::TouchAction> touch_action) {
     callbacks_received_[index] = ReceivedCallback(
         handling_event_ ? CallbackReceivedState::kCalledWhileHandlingEvent
@@ -196,7 +194,8 @@ class MainThreadEventQueueTest : public testing::Test,
     queue_->set_use_raf_fallback_timer(false);
   }
 
-  void HandleEvent(WebInputEvent& event, InputEventAckState ack_result) {
+  void HandleEvent(WebInputEvent& event,
+                   blink::mojom::InputEventResultState ack_result) {
     base::AutoReset<bool> in_handle_event(&handler_callback_->handling_event_,
                                           true);
     queue_->HandleEvent(
@@ -227,10 +226,6 @@ class MainThreadEventQueueTest : public testing::Test,
     return queue_->last_touch_start_forced_nonblocking_due_to_fling_;
   }
 
-  void set_enable_fling_passive_listener_flag(bool enable_flag) {
-    queue_->enable_fling_passive_listener_flag_ = enable_flag;
-  }
-
   void RunPendingTasksWithSimulatedRaf() {
     while (needs_main_frame_ || main_task_runner_->HasPendingTask()) {
       main_task_runner_->RunUntilIdle();
@@ -250,14 +245,13 @@ class MainThreadEventQueueTest : public testing::Test,
 
   // MainThreadEventQueueClient overrides.
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                        const ui::LatencyInfo& latency,
                         HandledEventCallback callback) override {
     if (!handle_input_event_)
       return false;
     std::unique_ptr<HandledTask> handled_event(new HandledEvent(event));
     handled_tasks_.push_back(std::move(handled_event));
-    std::move(callback).Run(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latency,
-                            nullptr, base::nullopt);
+    std::move(callback).Run(blink::mojom::InputEventResultState::kNotConsumed,
+                            event.latency_info(), nullptr, base::nullopt);
     return true;
   }
   void SetNeedsMainFrame() override { needs_main_frame_ = true; }
@@ -303,7 +297,7 @@ TEST_F(MainThreadEventQueueTest, ClientDoesntHandleInputEvent) {
   event.MovePoint(0, 20, 20);
   WebMouseWheelEvent event2 = SyntheticWebMouseWheelEventBuilder::Build(
       10, 10, 0, 53, 0, ui::ScrollGranularity::kScrollByPixel);
-  HandleEvent(event2, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(event2, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
 
   std::vector<ReceivedCallback> received = GetAndResetCallbackResults();
@@ -340,7 +334,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
       .Times(0);
 
   for (WebMouseWheelEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -364,7 +358,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
     EXPECT_EQ(WebInputEvent::DispatchType::kListenersNonBlockingPassive,
               last_wheel_event->dispatch_type);
     WebMouseWheelEvent coalesced_event = kEvents[0];
-    ui::Coalesce(kEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -372,17 +366,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
 
   {
     WebMouseWheelEvent coalesced_event = kEvents[0];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[0]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebMouseWheelEvent* coalesced_wheel_event0 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[0]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event0));
 
     coalesced_event = kEvents[1];
     const WebMouseWheelEvent* coalesced_wheel_event1 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[1]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event1));
@@ -393,7 +387,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
         static_cast<const WebMouseWheelEvent*>(
             handled_tasks_.at(1)->taskAsEvent()->EventPointer());
     WebMouseWheelEvent coalesced_event = kEvents[2];
-    ui::Coalesce(kEvents[3], &coalesced_event);
+    coalesced_event.Coalesce(kEvents[3]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -401,17 +395,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
 
   {
     WebMouseWheelEvent coalesced_event = kEvents[2];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[1]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebMouseWheelEvent* coalesced_wheel_event0 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[0]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event0));
 
     coalesced_event = kEvents[3];
     const WebMouseWheelEvent* coalesced_wheel_event1 =
-        static_cast<const WebMouseWheelEvent*>(coalesced_events[1]);
+        static_cast<const WebMouseWheelEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_wheel_event1));
@@ -434,7 +428,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   kEvents[3].MovePoint(0, 35, 35);
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -457,8 +451,10 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(1u, handled_tasks_[0]->taskAsEvent()->CoalescedEventSize());
     const WebTouchEvent* coalesced_touch_event =
-        static_cast<const WebTouchEvent*>(
-            handled_tasks_[0]->taskAsEvent()->GetCoalescedEventsPointers()[0]);
+        static_cast<const WebTouchEvent*>(handled_tasks_[0]
+                                              ->taskAsEvent()
+                                              ->GetCoalescedEventsPointers()[0]
+                                              .get());
     EXPECT_TRUE(Equal(kEvents[0], *coalesced_touch_event));
   }
 
@@ -473,8 +469,10 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(1u, handled_tasks_[1]->taskAsEvent()->CoalescedEventSize());
     const WebTouchEvent* coalesced_touch_event =
-        static_cast<const WebTouchEvent*>(
-            handled_tasks_[1]->taskAsEvent()->GetCoalescedEventsPointers()[0]);
+        static_cast<const WebTouchEvent*>(handled_tasks_[1]
+                                              ->taskAsEvent()
+                                              ->GetCoalescedEventsPointers()[0]
+                                              .get());
     EXPECT_TRUE(Equal(kEvents[1], *coalesced_touch_event));
   }
 
@@ -483,7 +481,7 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   WebTouchEvent coalesced_event = kEvents[2];
-  ui::Coalesce(kEvents[3], &coalesced_event);
+  coalesced_event.Coalesce(kEvents[3]);
   coalesced_event.dispatch_type =
       WebInputEvent::DispatchType::kListenersNonBlockingPassive;
   EXPECT_TRUE(Equal(coalesced_event, *last_touch_event));
@@ -491,17 +489,17 @@ TEST_F(MainThreadEventQueueTest, NonBlockingTouch) {
   {
     EXPECT_EQ(2u, handled_tasks_[2]->taskAsEvent()->CoalescedEventSize());
     WebTouchEvent coalesced_event = kEvents[2];
-    blink::WebVector<const WebInputEvent*> coalesced_events =
+    const auto& coalesced_events =
         handled_tasks_[2]->taskAsEvent()->GetCoalescedEventsPointers();
     const WebTouchEvent* coalesced_touch_event0 =
-        static_cast<const WebTouchEvent*>(coalesced_events[0]);
+        static_cast<const WebTouchEvent*>(coalesced_events[0].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_touch_event0));
 
     coalesced_event = kEvents[3];
     const WebTouchEvent* coalesced_touch_event1 =
-        static_cast<const WebTouchEvent*>(coalesced_events[1]);
+        static_cast<const WebTouchEvent*>(coalesced_events[1].get());
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *coalesced_touch_event1));
@@ -523,10 +521,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouch) {
       .Times(3);
   {
     // Ensure that coalescing takes place.
-    HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-    HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-    HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-    HandleEvent(kEvents[3], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[0],
+                blink::mojom::InputEventResultState::kSetNonBlocking);
+    HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+    HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kNotConsumed);
+    HandleEvent(kEvents[3], blink::mojom::InputEventResultState::kNotConsumed);
 
     EXPECT_EQ(2u, event_queue().size());
     EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -551,9 +550,9 @@ TEST_F(MainThreadEventQueueTest, BlockingTouch) {
               last_touch_event->unique_touch_event_id);
   }
 
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[3], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[3], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -581,10 +580,14 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
-  HandleEvent(kWheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kTouchEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kWheelEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kTouchEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kWheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kTouchEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kWheelEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kTouchEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -604,7 +607,7 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
     EXPECT_EQ(WebInputEvent::DispatchType::kListenersNonBlockingPassive,
               last_wheel_event->dispatch_type);
     WebMouseWheelEvent coalesced_event = kWheelEvents[0];
-    ui::Coalesce(kWheelEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kWheelEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_wheel_event));
@@ -615,7 +618,7 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
     const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
         handled_tasks_.at(1)->taskAsEvent()->EventPointer());
     WebTouchEvent coalesced_event = kTouchEvents[0];
-    ui::Coalesce(kTouchEvents[1], &coalesced_event);
+    coalesced_event.Coalesce(kTouchEvents[1]);
     coalesced_event.dispatch_type =
         WebInputEvent::DispatchType::kListenersNonBlockingPassive;
     EXPECT_TRUE(Equal(coalesced_event, *last_touch_event));
@@ -624,13 +627,13 @@ TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
 
 TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   WebMouseEvent mouseDown = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
 
   WebMouseEvent mouseMove = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
-  WebMouseEvent mouseUp =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseUp, 10, 10, 0);
+  WebMouseEvent mouseUp = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseUp, 10, 10, 0);
 
   WebMouseWheelEvent wheelEvents[3] = {
       SyntheticWebMouseWheelEventBuilder::Build(
@@ -652,11 +655,13 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   // then a discrete event. The last discrete event should flush the
   // continuous events so the aren't aligned to rAF and are processed
   // immediately.
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseMove, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseUp, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseMove, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[1],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseUp, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(4u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -670,8 +675,9 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
 
   // Simulate the rAF running before the PostTask occurs. The rAF
   // will consume everything.
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   RunSimulatedRafOnce();
@@ -685,11 +691,14 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
   // Simulate event consumption but no rAF signal. The mouse wheel events
   // should still be in the queue.
   handled_tasks_.clear();
-  HandleEvent(mouseDown, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouseUp, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[2], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(wheelEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouseDown, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouseUp, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[2],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(wheelEvents[0],
+              blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(5u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -725,7 +734,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   // continuous events so the aren't aligned to rAF and are processed
   // immediately.
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -739,8 +748,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
 
   // Simulate the rAF running before the PostTask occurs. The rAF
   // will consume everything.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   RunSimulatedRafOnce();
@@ -754,8 +763,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   // Simulate event consumption but no rAF signal. The touch events
   // should still be in the queue.
   handled_tasks_.clear();
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -771,7 +780,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInput) {
   kEvents[1].touch_start_or_first_touch_move = true;
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(event, blink::mojom::InputEventResultState::kNotConsumed);
 
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -788,7 +797,7 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
   kEvents[0].MovePoint(0, 50, 50);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 20);
-  kEvents[0].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[0].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
@@ -800,11 +809,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
   {
     // Send a non-blocking input event and then blocking  event.
     // The events should coalesce together.
-    HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1u, event_queue().size());
     EXPECT_FALSE(main_task_runner_->HasPendingTask());
     EXPECT_TRUE(needs_main_frame_);
-    HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+    HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
     EXPECT_EQ(1u, event_queue().size());
     EXPECT_FALSE(main_task_runner_->HasPendingTask());
     EXPECT_TRUE(needs_main_frame_);
@@ -821,11 +830,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
 
   // Send a non-cancelable ack required event, and then a non-ack
   // required event they should be coalesced together.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -837,11 +846,11 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputCoalescedMoves) {
 
   // Send a non-ack required event, and then a non-cancelable ack
   // required event they should be coalesced together.
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -860,17 +869,17 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputThrottlingMoves) {
   SyntheticWebTouchEvent kEvents[2];
   kEvents[0].PressPoint(10, 10);
   kEvents[0].MovePoint(0, 50, 50);
-  kEvents[0].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[0].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 20);
-  kEvents[1].dispatch_type = WebInputEvent::kEventNonBlocking;
+  kEvents[1].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
   // Send a non-cancelable touch move and then send it another one. The
   // second one shouldn't go out with the next rAF call and should be throttled.
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -878,8 +887,8 @@ TEST_F(MainThreadEventQueueTest, RafAlignedTouchInputThrottlingMoves) {
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
                   CallbackReceivedState::kCalledWhileHandlingEvent, false)));
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_TRUE(needs_main_frame_);
@@ -913,7 +922,7 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
       .Times(0);
 
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -926,12 +935,13 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
 
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   WebMouseWheelEvent mouse_wheel = SyntheticWebMouseWheelEventBuilder::Build(
       10, 10, 0, 53, 0, ui::ScrollGranularity::kScrollByPixel);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_wheel, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_wheel,
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -945,7 +955,7 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   // Now turn off low latency mode.
   queue_->SetNeedsLowLatency(false);
   for (SyntheticWebTouchEvent& event : kEvents)
-    HandleEvent(event, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+    HandleEvent(event, blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
@@ -957,8 +967,9 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_wheel, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_wheel,
+              blink::mojom::InputEventResultState::kSetNonBlocking);
 
   EXPECT_EQ(2u, event_queue().size());
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -974,14 +985,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   SyntheticWebTouchEvent kEvents;
   kEvents.PressPoint(10, 10);
   kEvents.touch_start_or_first_touch_move = true;
-  set_enable_fling_passive_listener_flag(true);
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(4);
 
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -994,12 +1005,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_TRUE(last_touch_start_forced_nonblocking_due_to_fling());
   const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(0)->taskAsEvent()->EventPointer());
-  kEvents.dispatch_type = WebInputEvent::kListenersForcedNonBlockingDueToFling;
+  kEvents.dispatch_type =
+      WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling;
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 30, 30);
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1013,12 +1026,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_TRUE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(1)->taskAsEvent()->EventPointer());
-  kEvents.dispatch_type = WebInputEvent::kListenersForcedNonBlockingDueToFling;
+  kEvents.dispatch_type =
+      WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling;
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 50, 50);
   kEvents.touch_start_or_first_touch_move = false;
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1028,13 +1043,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_EQ(3u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(2)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.ReleasePoint(0);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING);
+  HandleEvent(kEvents,
+              blink::mojom::InputEventResultState::kSetNonBlockingDueToFling);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1044,7 +1060,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesDuringFling) {
   EXPECT_EQ(4u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(3)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(3)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
@@ -1054,13 +1070,12 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   SyntheticWebTouchEvent kEvents;
   kEvents.PressPoint(10, 10);
   kEvents.touch_start_or_first_touch_move = true;
-  set_enable_fling_passive_listener_flag(false);
 
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(4);
 
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1070,14 +1085,13 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(1u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(0)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   const WebTouchEvent* last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(0)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
-  set_enable_fling_passive_listener_flag(false);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1087,14 +1101,13 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(2u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(1)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(1)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
-  set_enable_fling_passive_listener_flag(true);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1104,14 +1117,14 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(3u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(2)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(2)->taskAsEvent()->EventPointer());
   EXPECT_TRUE(Equal(kEvents, *last_touch_event));
 
   kEvents.MovePoint(0, 30, 30);
-  HandleEvent(kEvents, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents, blink::mojom::InputEventResultState::kNotConsumed);
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
               testing::Each(ReceivedCallback(
@@ -1121,7 +1134,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchesOutsideFling) {
   EXPECT_EQ(4u, handled_tasks_.size());
   EXPECT_EQ(kEvents.GetType(),
             handled_tasks_.at(3)->taskAsEvent()->Event().GetType());
-  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::kBlocking);
+  EXPECT_EQ(kEvents.dispatch_type, WebInputEvent::DispatchType::kBlocking);
   EXPECT_FALSE(last_touch_start_forced_nonblocking_due_to_fling());
   last_touch_event = static_cast<const WebTouchEvent*>(
       handled_tasks_.at(3)->taskAsEvent()->EventPointer());
@@ -1132,13 +1145,12 @@ class MainThreadEventQueueInitializationTest
     : public testing::Test,
       public MainThreadEventQueueClient {
  public:
-  MainThreadEventQueueInitializationTest() {}
+  MainThreadEventQueueInitializationTest() = default;
 
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& event,
-                        const ui::LatencyInfo& latency,
                         HandledEventCallback callback) override {
-    std::move(callback).Run(INPUT_EVENT_ACK_STATE_NOT_CONSUMED, latency,
-                            nullptr, base::nullopt);
+    std::move(callback).Run(blink::mojom::InputEventResultState::kNotConsumed,
+                            event.latency_info(), nullptr, base::nullopt);
     return true;
   }
 
@@ -1182,12 +1194,12 @@ TEST_F(MainThreadEventQueueTest, QueuingClosureWithRafEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(2);
 
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   QueueClosure();
   EXPECT_EQ(3u, event_queue().size());
   EXPECT_TRUE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(4u, event_queue().size());
 
   EXPECT_TRUE(needs_main_frame_);
@@ -1226,10 +1238,10 @@ TEST_F(MainThreadEventQueueTest, QueuingClosuresBetweenEvents) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(2);
 
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   QueueClosure();
   QueueClosure();
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(4u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
   main_task_runner_->RunUntilIdle();
@@ -1255,8 +1267,8 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   kEvents[1].SetModifiers(1);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].MovePoint(0, 20, 30);
-  kEvents[1].dispatch_type = WebInputEvent::kEventNonBlocking;
-  WebTouchEvent scroll_start(WebInputEvent::kTouchScrollStarted,
+  kEvents[1].dispatch_type = WebInputEvent::DispatchType::kEventNonBlocking;
+  WebTouchEvent scroll_start(WebInputEvent::Type::kTouchScrollStarted,
                              WebInputEvent::kNoModifiers,
                              WebInputEvent::GetStaticTimeStampForTests());
 
@@ -1266,11 +1278,12 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(scroll_start, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
+            kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(scroll_start, blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(3u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1285,11 +1298,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveBecomesNonBlocking) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
 
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(0)->taskAsEvent()->Event())
                 .dispatch_type);
-  EXPECT_EQ(WebInputEvent::kEventNonBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kEventNonBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(1)->taskAsEvent()->Event())
                 .dispatch_type);
@@ -1301,7 +1314,7 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   kEvents[0].MovePoint(0, 20, 20);
   kEvents[1].PressPoint(10, 10);
   kEvents[1].ReleasePoint(0);
-  WebTouchEvent scroll_start(WebInputEvent::kTouchScrollStarted,
+  WebTouchEvent scroll_start(WebInputEvent::Type::kTouchScrollStarted,
                              WebInputEvent::kNoModifiers,
                              WebInputEvent::GetStaticTimeStampForTests());
 
@@ -1311,11 +1324,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   EXPECT_CALL(thread_scheduler_,
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
-  HandleEvent(scroll_start, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
+  HandleEvent(scroll_start, blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(3u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_THAT(GetAndResetCallbackResults(),
@@ -1325,11 +1338,11 @@ TEST_F(MainThreadEventQueueTest, BlockingTouchMoveWithTouchEnd) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_FALSE(needs_main_frame_);
 
-  EXPECT_EQ(WebInputEvent::kBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(0)->taskAsEvent()->Event())
                 .dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking,
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking,
             static_cast<const WebTouchEvent&>(
                 handled_tasks_.at(1)->taskAsEvent()->Event())
                 .dispatch_type);
@@ -1350,22 +1363,22 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchTouchEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(3);
 
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[0].dispatch_type);
-  EXPECT_EQ(WebInputEvent::kBlocking, kEvents[1].dispatch_type);
-  HandleEvent(kEvents[0], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[0].dispatch_type);
+  EXPECT_EQ(WebInputEvent::DispatchType::kBlocking, kEvents[1].dispatch_type);
+  HandleEvent(kEvents[0], blink::mojom::InputEventResultState::kNotConsumed);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(kEvents[1], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[1], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(kEvents[2], INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
+  HandleEvent(kEvents[2], blink::mojom::InputEventResultState::kNotConsumed);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_FALSE(needs_low_latency_until_pointer_up());
@@ -1375,7 +1388,7 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchTouchEvent) {
 TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
   queue_->HasPointerRawUpdateEventHandlers(true);
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
   SyntheticWebTouchEvent touch_move;
   touch_move.PressPoint(10, 10);
   touch_move.MovePoint(0, 50, 50);
@@ -1383,14 +1396,14 @@ TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(4u, event_queue().size());
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(4u, event_queue().size());
 
   main_task_runner_->RunUntilIdle();
@@ -1403,7 +1416,7 @@ TEST_F(MainThreadEventQueueTest, PointerEventsCoalescing) {
 
 TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
@@ -1412,14 +1425,14 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(0);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
 
   queue_->HasPointerRawUpdateEventHandlers(true);
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
@@ -1429,14 +1442,14 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
   SyntheticWebTouchEvent touch_move;
   touch_move.PressPoint(10, 10);
   touch_move.MovePoint(0, 50, 50);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
   EXPECT_FALSE(needs_main_frame_);
 
   queue_->HasPointerRawUpdateEventHandlers(true);
-  HandleEvent(touch_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(touch_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   EXPECT_EQ(2u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_EQ(0u, event_queue().size());
@@ -1445,11 +1458,11 @@ TEST_F(MainThreadEventQueueTest, PointerRawUpdateEvents) {
 
 TEST_F(MainThreadEventQueueTest, UnbufferedDispatchMouseEvent) {
   WebMouseEvent mouse_down = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseDown, 10, 10, 0);
+      WebInputEvent::Type::kMouseDown, 10, 10, 0);
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
-      WebInputEvent::kMouseMove, 10, 10, 0);
-  WebMouseEvent mouse_up =
-      SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseUp, 10, 10, 0);
+      WebInputEvent::Type::kMouseMove, 10, 10, 0);
+  WebMouseEvent mouse_up = SyntheticWebMouseEventBuilder::Build(
+      WebInputEvent::Type::kMouseUp, 10, 10, 0);
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
   EXPECT_EQ(0u, event_queue().size());
@@ -1458,21 +1471,21 @@ TEST_F(MainThreadEventQueueTest, UnbufferedDispatchMouseEvent) {
               DidHandleInputEventOnMainThread(testing::_, testing::_))
       .Times(0);
 
-  HandleEvent(mouse_down, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_down, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_move, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
   EXPECT_TRUE(needs_low_latency_until_pointer_up());
   EXPECT_FALSE(needs_main_frame_);
 
-  HandleEvent(mouse_up, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
+  HandleEvent(mouse_up, blink::mojom::InputEventResultState::kSetNonBlocking);
   queue_->RequestUnbufferedInputEvents();
   EXPECT_EQ(1u, event_queue().size());
   RunPendingTasksWithSimulatedRaf();
diff --git a/chromium/content/renderer/input/render_widget_input_handler.cc b/chromium/content/renderer/input/render_widget_input_handler.cc
index d62433920cf..a3ce13879aa 100644
--- a/chromium/content/renderer/input/render_widget_input_handler.cc
+++ b/chromium/content/renderer/input/render_widget_input_handler.cc
@@ -16,9 +16,7 @@
 #include "cc/paint/element_id.h"
 #include "cc/trees/latency_info_swap_promise_monitor.h"
 #include "components/viz/common/surfaces/frame_sink_id.h"
-#include "content/common/input/input_event_ack.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/render_widget_input_handler_delegate.h"
@@ -34,13 +32,13 @@
 #include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
 #include "third_party/blink/public/common/input/web_pointer_event.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_node.h"
 #include "ui/events/blink/blink_event_util.h"
-#include "ui/events/blink/event_with_callback.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/gfx/geometry/dip_util.h"
 #include "ui/gfx/geometry/point_conversions.h"
@@ -79,9 +77,7 @@ void LogInputEventLatencyUma(const WebInputEvent& event, base::TimeTicks now) {
 }
 
 void LogPassiveEventListenersUma(WebInputEventResult result,
-                                 WebInputEvent::DispatchType dispatch_type,
-                                 base::TimeTicks event_timestamp,
-                                 const ui::LatencyInfo& latency_info) {
+                                 WebInputEvent::DispatchType dispatch_type) {
   // This enum is backing a histogram. Do not remove or reorder members.
   enum ListenerEnum {
     PASSIVE_LISTENER_UMA_ENUM_PASSIVE,
@@ -96,16 +92,16 @@ void LogPassiveEventListenersUma(WebInputEventResult result,
 
   ListenerEnum enum_value;
   switch (dispatch_type) {
-    case WebInputEvent::kListenersForcedNonBlockingDueToFling:
+    case WebInputEvent::DispatchType::kListenersForcedNonBlockingDueToFling:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_FORCED_NON_BLOCKING_DUE_TO_FLING;
       break;
-    case WebInputEvent::kListenersNonBlockingPassive:
+    case WebInputEvent::DispatchType::kListenersNonBlockingPassive:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_PASSIVE;
       break;
-    case WebInputEvent::kEventNonBlocking:
+    case WebInputEvent::DispatchType::kEventNonBlocking:
       enum_value = PASSIVE_LISTENER_UMA_ENUM_UNCANCELABLE;
       break;
-    case WebInputEvent::kBlocking:
+    case WebInputEvent::DispatchType::kBlocking:
       if (result == WebInputEventResult::kHandledApplication)
         enum_value = PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED;
       else if (result == WebInputEventResult::kHandledSuppressed)
@@ -123,59 +119,60 @@ void LogPassiveEventListenersUma(WebInputEventResult result,
 }
 
 void LogAllPassiveEventListenersUma(const WebInputEvent& input_event,
-                                    WebInputEventResult result,
-                                    const ui::LatencyInfo& latency_info) {
+                                    WebInputEventResult result) {
   // TODO(dtapuska): Use the input_event.timeStampSeconds as the start
   // ideally this should be when the event was sent by the compositor to the
   // renderer. https://crbug.com/565348.
-  if (input_event.GetType() == WebInputEvent::kTouchStart ||
-      input_event.GetType() == WebInputEvent::kTouchMove ||
-      input_event.GetType() == WebInputEvent::kTouchEnd) {
+  if (input_event.GetType() == WebInputEvent::Type::kTouchStart ||
+      input_event.GetType() == WebInputEvent::Type::kTouchMove ||
+      input_event.GetType() == WebInputEvent::Type::kTouchEnd) {
     const WebTouchEvent& touch = static_cast<const WebTouchEvent&>(input_event);
 
-    LogPassiveEventListenersUma(result, touch.dispatch_type,
-                                input_event.TimeStamp(), latency_info);
-  } else if (input_event.GetType() == WebInputEvent::kMouseWheel) {
+    LogPassiveEventListenersUma(result, touch.dispatch_type);
+  } else if (input_event.GetType() == WebInputEvent::Type::kMouseWheel) {
     LogPassiveEventListenersUma(
         result,
-        static_cast<const WebMouseWheelEvent&>(input_event).dispatch_type,
-        input_event.TimeStamp(), latency_info);
+        static_cast<const WebMouseWheelEvent&>(input_event).dispatch_type);
   }
 }
 
 blink::WebCoalescedInputEvent GetCoalescedWebPointerEventForTouch(
     const WebPointerEvent& pointer_event,
-    blink::WebVector<const WebInputEvent*> coalesced_events,
-    blink::WebVector<const WebInputEvent*> predicted_events) {
-  blink::WebVector<WebPointerEvent> related_pointer_events;
-  for (const WebInputEvent* event : coalesced_events) {
+    const std::vector<std::unique_ptr<WebInputEvent>>& coalesced_events,
+    const std::vector<std::unique_ptr<WebInputEvent>>& predicted_events,
+    const ui::LatencyInfo& latency) {
+  std::vector<std::unique_ptr<WebInputEvent>> related_pointer_events;
+  for (const std::unique_ptr<WebInputEvent>& event : coalesced_events) {
     DCHECK(WebInputEvent::IsTouchEventType(event->GetType()));
     const WebTouchEvent& touch_event =
         static_cast<const WebTouchEvent&>(*event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
       if (touch_event.touches[i].id == pointer_event.id &&
-          touch_event.touches[i].state != WebTouchPoint::kStateStationary) {
-        related_pointer_events.emplace_back(
-            WebPointerEvent(touch_event, touch_event.touches[i]));
+          touch_event.touches[i].state !=
+              WebTouchPoint::State::kStateStationary) {
+        related_pointer_events.emplace_back(std::make_unique<WebPointerEvent>(
+            touch_event, touch_event.touches[i]));
       }
     }
   }
-  blink::WebVector<WebPointerEvent> predicted_pointer_events;
-  for (const WebInputEvent* event : predicted_events) {
+  std::vector<std::unique_ptr<WebInputEvent>> predicted_pointer_events;
+  for (const std::unique_ptr<WebInputEvent>& event : predicted_events) {
     DCHECK(WebInputEvent::IsTouchEventType(event->GetType()));
     const WebTouchEvent& touch_event =
         static_cast<const WebTouchEvent&>(*event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
       if (touch_event.touches[i].id == pointer_event.id &&
-          touch_event.touches[i].state != WebTouchPoint::kStateStationary) {
-        predicted_pointer_events.emplace_back(
-            WebPointerEvent(touch_event, touch_event.touches[i]));
+          touch_event.touches[i].state !=
+              WebTouchPoint::State::kStateStationary) {
+        predicted_pointer_events.emplace_back(std::make_unique<WebPointerEvent>(
+            touch_event, touch_event.touches[i]));
       }
     }
   }
 
-  return blink::WebCoalescedInputEvent(pointer_event, related_pointer_events,
-                                       predicted_pointer_events);
+  return blink::WebCoalescedInputEvent(
+      pointer_event.Clone(), std::move(related_pointer_events),
+      std::move(predicted_pointer_events), latency);
 }
 
 viz::FrameSinkId GetRemoteFrameSinkId(const blink::WebHitTestResult& result) {
@@ -192,10 +189,11 @@ viz::FrameSinkId GetRemoteFrameSinkId(const blink::WebHitTestResult& result) {
   return RenderFrameProxy::FromWebFrame(remote_frame)->frame_sink_id();
 }
 
-InputEventAckState GetAckResult(WebInputEventResult processed) {
+blink::mojom::InputEventResultState GetAckResult(
+    WebInputEventResult processed) {
   return processed == WebInputEventResult::kNotHandled
-             ? INPUT_EVENT_ACK_STATE_NOT_CONSUMED
-             : INPUT_EVENT_ACK_STATE_CONSUMED;
+             ? blink::mojom::InputEventResultState::kNotConsumed
+             : blink::mojom::InputEventResultState::kConsumed;
 }
 
 }  // namespace
@@ -228,7 +226,7 @@ class RenderWidgetInputHandler::HandlingState {
   // handled. If the event causes overscroll, the overscroll metadata can be
   // bundled in the event ack, saving an IPC.  Note that we must continue
   // supporting overscroll IPC notifications due to fling animation updates.
-  std::unique_ptr<ui::DidOverscrollParams> event_overscroll;
+  blink::mojom::DidOverscrollParamsPtr event_overscroll;
 
   base::Optional<cc::TouchAction> touch_action;
 
@@ -266,8 +264,7 @@ blink::WebHitTestResult RenderWidgetInputHandler::GetHitTestResultAtPoint(
     point_in_pixel = gfx::ConvertPointToPixel(
         widget_->GetOriginalScreenInfo().device_scale_factor, point_in_pixel);
   }
-  return widget_->GetWebWidget()->HitTestResultAt(
-      ToRoundedPoint(point_in_pixel));
+  return widget_->GetWebWidget()->HitTestResultAt(point_in_pixel);
 }
 
 viz::FrameSinkId RenderWidgetInputHandler::GetFrameSinkIdAtPoint(
@@ -306,26 +303,28 @@ WebInputEventResult RenderWidgetInputHandler::HandleTouchEvent(
     const blink::WebCoalescedInputEvent& coalesced_event) {
   const WebInputEvent& input_event = coalesced_event.Event();
 
-  if (input_event.GetType() == WebInputEvent::kTouchScrollStarted) {
+  if (input_event.GetType() == WebInputEvent::Type::kTouchScrollStarted) {
     WebPointerEvent pointer_event =
         WebPointerEvent::CreatePointerCausesUaActionEvent(
             blink::WebPointerProperties::PointerType::kUnknown,
             input_event.TimeStamp());
     return widget_->GetWebWidget()->HandleInputEvent(
-        blink::WebCoalescedInputEvent(pointer_event));
+        blink::WebCoalescedInputEvent(pointer_event,
+                                      coalesced_event.latency_info()));
   }
 
   const WebTouchEvent touch_event =
       static_cast<const WebTouchEvent&>(input_event);
   for (unsigned i = 0; i < touch_event.touches_length; ++i) {
     const WebTouchPoint& touch_point = touch_event.touches[i];
-    if (touch_point.state != blink::WebTouchPoint::kStateStationary) {
+    if (touch_point.state != blink::WebTouchPoint::State::kStateStationary) {
       const WebPointerEvent& pointer_event =
           WebPointerEvent(touch_event, touch_point);
       const blink::WebCoalescedInputEvent& coalesced_pointer_event =
           GetCoalescedWebPointerEventForTouch(
               pointer_event, coalesced_event.GetCoalescedEventsPointers(),
-              coalesced_event.GetPredictedEventsPointers());
+              coalesced_event.GetPredictedEventsPointers(),
+              coalesced_event.latency_info());
       widget_->GetWebWidget()->HandleInputEvent(coalesced_pointer_event);
     }
   }
@@ -334,7 +333,6 @@ WebInputEventResult RenderWidgetInputHandler::HandleTouchEvent(
 
 void RenderWidgetInputHandler::HandleInputEvent(
     const blink::WebCoalescedInputEvent& coalesced_event,
-    const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
   const WebInputEvent& input_event = coalesced_event.Event();
 
@@ -355,14 +353,15 @@ void RenderWidgetInputHandler::HandleInputEvent(
   TRACE_EVENT1("renderer,benchmark,rail",
                "RenderWidgetInputHandler::OnHandleInputEvent", "event",
                WebInputEvent::GetName(input_event.GetType()));
+  int64_t trace_id = coalesced_event.latency_info().trace_id();
   TRACE_EVENT("input,benchmark", "LatencyInfo.Flow",
-              [&latency_info](perfetto::EventContext ctx) {
+              [trace_id](perfetto::EventContext ctx) {
                 ChromeLatencyInfo* info =
                     ctx.event()->set_chrome_latency_info();
-                info->set_trace_id(latency_info.trace_id());
+                info->set_trace_id(trace_id);
                 info->set_step(ChromeLatencyInfo::STEP_HANDLE_INPUT_EVENT_MAIN);
                 tracing::FillFlowEvent(ctx, TrackEvent::LegacyEvent::FLOW_INOUT,
-                                       latency_info.trace_id());
+                                       trace_id);
               });
 
   // If we don't have a high res timer, these metrics won't be accurate enough
@@ -370,7 +369,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   if (!start_time.is_null())
     LogInputEventLatencyUma(input_event, start_time);
 
-  ui::LatencyInfo swap_latency_info(latency_info);
+  ui::LatencyInfo swap_latency_info(coalesced_event.latency_info());
   swap_latency_info.AddLatencyNumber(
       ui::LatencyComponentType::INPUT_EVENT_LATENCY_RENDERER_MAIN_COMPONENT);
   cc::LatencyInfoSwapPromiseMonitor swap_promise_monitor(
@@ -378,9 +377,9 @@ void RenderWidgetInputHandler::HandleInputEvent(
       nullptr);
   auto scoped_event_metrics_monitor =
       widget_->layer_tree_host()->GetScopedEventMetricsMonitor(
-          {ui::WebEventTypeToEventType(input_event.GetType()),
-           input_event.TimeStamp(),
-           ui::GetScrollInputTypeForEvent(input_event)});
+          cc::EventMetrics::Create(input_event.GetTypeAsUiEventType(),
+                                   input_event.TimeStamp(),
+                                   input_event.GetScrollInputType()));
 
   bool prevent_default = false;
   bool show_virtual_keyboard_for_mouse = false;
@@ -395,11 +394,11 @@ void RenderWidgetInputHandler::HandleInputEvent(
 
     // Reset the last known cursor if mouse has left this widget. So next
     // time that the mouse enters we always set the cursor accordingly.
-    if (mouse_event.GetType() == WebInputEvent::kMouseLeave)
+    if (mouse_event.GetType() == WebInputEvent::Type::kMouseLeave)
       current_cursor_.reset();
 
     if (mouse_event.button == WebPointerProperties::Button::kLeft &&
-        mouse_event.GetType() == WebInputEvent::kMouseUp) {
+        mouse_event.GetType() == WebInputEvent::Type::kMouseUp) {
       show_virtual_keyboard_for_mouse = true;
     }
   }
@@ -421,7 +420,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
         widget_->GetTextInputType() != ui::TEXT_INPUT_TYPE_NONE) {
       // Show the keyboard on keyup (not keydown) to match the behavior of
       // Android's TextView.
-      if (key_event.GetType() == WebInputEvent::kKeyUp)
+      if (key_event.GetType() == WebInputEvent::Type::kKeyUp)
         widget_->ShowVirtualKeyboardOnElementFocus();
       // Prevent default for both keydown and keyup (letting the keydown go
       // through to the web app would cause compatibility problems since
@@ -441,7 +440,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   WebInputEventResult processed = prevent_default
                                       ? WebInputEventResult::kHandledSuppressed
                                       : WebInputEventResult::kNotHandled;
-  if (input_event.GetType() != WebInputEvent::kChar ||
+  if (input_event.GetType() != WebInputEvent::Type::kChar ||
       !suppress_next_char_events_) {
     suppress_next_char_events_ = false;
     if (processed == WebInputEventResult::kNotHandled &&
@@ -471,13 +470,13 @@ void RenderWidgetInputHandler::HandleInputEvent(
   // |input_event| to avoid nested monitors.
   scoped_event_metrics_monitor = nullptr;
 
-  LogAllPassiveEventListenersUma(input_event, processed, latency_info);
+  LogAllPassiveEventListenersUma(input_event, processed);
 
   // If this RawKeyDown event corresponds to a browser keyboard shortcut and
   // it's not processed by webkit, then we need to suppress the upcoming Char
   // events.
   bool is_keyboard_shortcut =
-      input_event.GetType() == WebInputEvent::kRawKeyDown &&
+      input_event.GetType() == WebInputEvent::Type::kRawKeyDown &&
       static_cast<const WebKeyboardEvent&>(input_event).is_browser_shortcut;
   if (processed == WebInputEventResult::kNotHandled && is_keyboard_shortcut)
     suppress_next_char_events_ = true;
@@ -490,17 +489,18 @@ void RenderWidgetInputHandler::HandleInputEvent(
       handling_state.injected_scroll_params->size()) {
     HandleInjectedScrollGestures(
         std::move(*handling_state.injected_scroll_params), input_event,
-        latency_info);
+        coalesced_event.latency_info());
   }
 
   // Send gesture scroll events and their dispositions to the compositor thread,
-  // so that they can be used to produce the elastic overscroll effect on Mac.
-  if (input_event.GetType() == WebInputEvent::kGestureScrollBegin ||
-      input_event.GetType() == WebInputEvent::kGestureScrollEnd ||
-      input_event.GetType() == WebInputEvent::kGestureScrollUpdate) {
+  // so that they can be used to produce the elastic overscroll effect.
+  if (input_event.GetType() == WebInputEvent::Type::kGestureScrollBegin ||
+      input_event.GetType() == WebInputEvent::Type::kGestureScrollEnd ||
+      input_event.GetType() == WebInputEvent::Type::kGestureScrollUpdate) {
     const WebGestureEvent& gesture_event =
         static_cast<const WebGestureEvent&>(input_event);
-    if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchpad) {
+    if (gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchpad ||
+        gesture_event.SourceDevice() == blink::WebGestureDevice::kTouchscreen) {
       gfx::Vector2dF latest_overscroll_delta =
           handling_state.event_overscroll
               ? handling_state.event_overscroll->latest_overscroll_delta
@@ -527,7 +527,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
   // Show the virtual keyboard if enabled and a user gesture triggers a focus
   // change.
   if ((processed != WebInputEventResult::kNotHandled &&
-       input_event.GetType() == WebInputEvent::kTouchEnd) ||
+       input_event.GetType() == WebInputEvent::Type::kTouchEnd) ||
       show_virtual_keyboard_for_mouse) {
     delegate_->ShowVirtualKeyboard();
   }
@@ -541,8 +541,8 @@ void RenderWidgetInputHandler::HandleInputEvent(
 #if !defined(OS_ANDROID)
   // Virtual keyboard is not supported, so react to focus change immediately.
   if ((processed != WebInputEventResult::kNotHandled &&
-       input_event.GetType() == WebInputEvent::kMouseDown) ||
-      input_event.GetType() == WebInputEvent::kGestureTap) {
+       input_event.GetType() == WebInputEvent::Type::kMouseDown) ||
+      input_event.GetType() == WebInputEvent::Type::kGestureTap) {
     delegate_->FocusChangeComplete();
   }
 #endif
@@ -559,12 +559,9 @@ void RenderWidgetInputHandler::DidOverscrollFromBlink(
     const gfx::PointF& position,
     const gfx::Vector2dF& velocity,
     const cc::OverscrollBehavior& behavior) {
-  std::unique_ptr<DidOverscrollParams> params(new DidOverscrollParams());
-  params->accumulated_overscroll = accumulatedOverscroll;
-  params->latest_overscroll_delta = overscrollDelta;
-  params->current_fling_velocity = velocity;
-  params->causal_event_viewport_point = position;
-  params->overscroll_behavior = behavior;
+  blink::mojom::DidOverscrollParamsPtr params =
+      blink::mojom::DidOverscrollParams::New(
+          accumulatedOverscroll, overscrollDelta, velocity, position, behavior);
 
   // If we're currently handling an event, stash the overscroll data such that
   // it can be bundled in the event ack.
@@ -573,7 +570,7 @@ void RenderWidgetInputHandler::DidOverscrollFromBlink(
     return;
   }
 
-  delegate_->OnDidOverscroll(*params);
+  delegate_->OnDidOverscroll(std::move(params));
 }
 
 void RenderWidgetInputHandler::InjectGestureScrollEvent(
@@ -609,7 +606,7 @@ void RenderWidgetInputHandler::InjectGestureScrollEvent(
   } else {
     base::TimeTicks now = base::TimeTicks::Now();
     std::unique_ptr<WebGestureEvent> gesture_event =
-        ui::GenerateInjectedScrollGesture(
+        WebGestureEvent::GenerateInjectedScrollGesture(
             injected_type, now, device, gfx::PointF(0, 0), delta, granularity);
     if (injected_type == WebInputEvent::Type::kGestureScrollBegin) {
       gesture_event->data.scroll_begin.scrollable_area_element_id =
@@ -624,8 +621,9 @@ void RenderWidgetInputHandler::InjectGestureScrollEvent(
 
     widget_->GetInputEventQueue()->HandleEvent(
         std::move(web_scoped_gesture_event), latency_info,
-        DISPATCH_TYPE_NON_BLOCKING, INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-        attribution, HandledEventCallback());
+        DISPATCH_TYPE_NON_BLOCKING,
+        blink::mojom::InputEventResultState::kNotConsumed, attribution,
+        HandledEventCallback());
   }
 }
 
@@ -683,7 +681,7 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
     }
 
     std::unique_ptr<WebGestureEvent> gesture_event =
-        ui::GenerateInjectedScrollGesture(
+        WebGestureEvent::GenerateInjectedScrollGesture(
             params.type, input_event.TimeStamp(), params.device, position,
             params.scroll_delta, params.granularity);
     if (params.type == WebInputEvent::Type::kGestureScrollBegin) {
@@ -700,16 +698,16 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
           widget_->layer_tree_host()->GetSwapPromiseManager(), nullptr);
       auto scoped_event_metrics_monitor =
           widget_->layer_tree_host()->GetScopedEventMetricsMonitor(
-              {ui::WebEventTypeToEventType(gesture_event->GetType()),
-               gesture_event->TimeStamp(),
-               ui::GetScrollInputTypeForEvent(*gesture_event)});
-      widget_->GetWebWidget()->HandleInputEvent(
-          blink::WebCoalescedInputEvent(*gesture_event));
+              cc::EventMetrics::Create(gesture_event->GetTypeAsUiEventType(),
+                                       gesture_event->TimeStamp(),
+                                       gesture_event->GetScrollInputType()));
+      widget_->GetWebWidget()->HandleInputEvent(blink::WebCoalescedInputEvent(
+          *gesture_event, scrollbar_latency_info));
     }
   }
 }
 
-bool RenderWidgetInputHandler::DidChangeCursor(const WebCursor& cursor) {
+bool RenderWidgetInputHandler::DidChangeCursor(const ui::Cursor& cursor) {
   if (current_cursor_.has_value() && current_cursor_.value() == cursor)
     return false;
   current_cursor_ = cursor;
@@ -722,7 +720,7 @@ bool RenderWidgetInputHandler::ProcessTouchAction(
     return false;
   // Ignore setTouchAction calls that result from synthetic touch events (eg.
   // when blink is emulating touch with mouse).
-  if (handling_input_state_->event_type != WebInputEvent::kTouchStart)
+  if (handling_input_state_->event_type != WebInputEvent::Type::kTouchStart)
     return false;
 
   handling_input_state_->touch_action = touch_action;
diff --git a/chromium/content/renderer/input/render_widget_input_handler.h b/chromium/content/renderer/input/render_widget_input_handler.h
index 9fe496450e9..289cb9ccc0a 100644
--- a/chromium/content/renderer/input/render_widget_input_handler.h
+++ b/chromium/content/renderer/input/render_widget_input_handler.h
@@ -9,13 +9,14 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/time/time.h"
-#include "content/common/cursors/webcursor.h"
-#include "content/common/input/input_event_ack.h"
 #include "content/common/input/input_event_dispatch_type.h"
 #include "content/renderer/input/main_thread_event_queue.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/web/web_hit_test_result.h"
+#include "ui/base/cursor/cursor.h"
 #include "ui/base/ui_base_types.h"
 #include "ui/events/blink/did_overscroll_params.h"
 #include "ui/events/types/scroll_types.h"
@@ -55,7 +56,6 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
   // Handle input events from the input event provider.
   virtual void HandleInputEvent(
       const blink::WebCoalescedInputEvent& coalesced_event,
-      const ui::LatencyInfo& latency_info,
       HandledEventCallback callback);
 
   // Handle overscroll from Blink.
@@ -82,7 +82,7 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
 
   // Process the new cursor and returns true if it has changed from the last
   // cursor.
-  bool DidChangeCursor(const WebCursor& cursor);
+  bool DidChangeCursor(const ui::Cursor& cursor);
 
   // Do a hit test for a given point in viewport coordinate.
   blink::WebHitTestResult GetHitTestResultAtPoint(const gfx::PointF& point);
@@ -118,7 +118,7 @@ class CONTENT_EXPORT RenderWidgetInputHandler {
 
   // We store the current cursor object so we can avoid spamming SetCursor
   // messages.
-  base::Optional<WebCursor> current_cursor_;
+  base::Optional<ui::Cursor> current_cursor_;
 
   // Indicates if the next sequence of Char events should be suppressed or not.
   bool suppress_next_char_events_ = false;
diff --git a/chromium/content/renderer/input/render_widget_input_handler_delegate.h b/chromium/content/renderer/input/render_widget_input_handler_delegate.h
index 4491717c56e..69686ad2cf4 100644
--- a/chromium/content/renderer/input/render_widget_input_handler_delegate.h
+++ b/chromium/content/renderer/input/render_widget_input_handler_delegate.h
@@ -8,7 +8,7 @@
 #include <memory>
 
 #include "content/common/content_export.h"
-#include "content/common/input/input_event_ack.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom.h"
 #include "third_party/blink/public/platform/web_input_event_result.h"
 
 namespace blink {
@@ -43,7 +43,7 @@ class CONTENT_EXPORT RenderWidgetInputHandlerDelegate {
   virtual void OnDidHandleKeyEvent() = 0;
 
   // Notifies that an overscroll was completed from Blink.
-  virtual void OnDidOverscroll(const ui::DidOverscrollParams& params) = 0;
+  virtual void OnDidOverscroll(blink::mojom::DidOverscrollParamsPtr params) = 0;
 
   // Notifies the delegate of the |input_handler| managing it.
   virtual void SetInputHandler(RenderWidgetInputHandler* input_handler) = 0;
diff --git a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc b/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc
deleted file mode 100644
index 6968fa959cd..00000000000
--- a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.cc
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/input/scoped_web_input_event_with_latency_info.h"
-
-using blink::WebInputEvent;
-
-namespace content {
-
-ScopedWebInputEventWithLatencyInfo::ScopedWebInputEventWithLatencyInfo(
-    ui::WebScopedInputEvent event,
-    const ui::LatencyInfo& latency_info)
-    : event_(new blink::WebCoalescedInputEvent(*(event.get()))),
-      latency_(latency_info) {}
-
-ScopedWebInputEventWithLatencyInfo::~ScopedWebInputEventWithLatencyInfo() {}
-
-bool ScopedWebInputEventWithLatencyInfo::CanCoalesceWith(
-    const ScopedWebInputEventWithLatencyInfo& other) const {
-  return ui::CanCoalesce(other.event(), event());
-}
-
-void ScopedWebInputEventWithLatencyInfo::CoalesceWith(
-    const ScopedWebInputEventWithLatencyInfo& other) {
-  // |other| should be a newer event than |this|.
-  if (other.latency_.trace_id() >= 0 && latency_.trace_id() >= 0)
-    DCHECK_GT(other.latency_.trace_id(), latency_.trace_id());
-
-  // New events get coalesced into older events, and the newer timestamp
-  // should always be preserved.
-  const base::TimeTicks time_stamp = other.event().TimeStamp();
-  ui::Coalesce(other.event(), event_->EventPointer());
-  event_->EventPointer()->SetTimeStamp(time_stamp);
-  event_->AddCoalescedEvent(other.event());
-
-  // When coalescing two input events, we keep the oldest LatencyInfo
-  // since it will represent the longest latency. If it's a GestureScrollUpdate
-  // event, update the old event's last timestamp and scroll delta using the
-  // newer event's latency info.
-  if (event().GetType() == WebInputEvent::kGestureScrollUpdate)
-    latency_.CoalesceScrollUpdateWith(other.latency_);
-  other.latency_ = latency_;
-  other.latency_.set_coalesced();
-}
-
-const blink::WebInputEvent& ScopedWebInputEventWithLatencyInfo::event() const {
-  return event_->Event();
-}
-
-blink::WebInputEvent& ScopedWebInputEventWithLatencyInfo::event() {
-  return *event_->EventPointer();
-}
-
-const blink::WebCoalescedInputEvent&
-ScopedWebInputEventWithLatencyInfo::coalesced_event() const {
-  return *event_;
-}
-
-blink::WebCoalescedInputEvent&
-ScopedWebInputEventWithLatencyInfo::coalesced_event() {
-  return *event_;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h b/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h
deleted file mode 100644
index a1dc3b00e09..00000000000
--- a/chromium/content/renderer/input/scoped_web_input_event_with_latency_info.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
-#define CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
-
-#include "base/compiler_specific.h"
-#include "base/logging.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/input/web_gesture_event.h"
-#include "third_party/blink/public/common/input/web_mouse_wheel_event.h"
-#include "third_party/blink/public/common/input/web_touch_event.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
-#include "ui/events/blink/blink_event_util.h"
-#include "ui/events/blink/web_input_event_traits.h"
-#include "ui/latency/latency_info.h"
-
-namespace content {
-
-class ScopedWebInputEventWithLatencyInfo {
- public:
-  ScopedWebInputEventWithLatencyInfo(ui::WebScopedInputEvent,
-                                     const ui::LatencyInfo&);
-
-  ~ScopedWebInputEventWithLatencyInfo();
-
-  bool CanCoalesceWith(const ScopedWebInputEventWithLatencyInfo& other) const
-      WARN_UNUSED_RESULT;
-
-  const blink::WebInputEvent& event() const;
-  const blink::WebCoalescedInputEvent& coalesced_event() const;
-  blink::WebInputEvent& event();
-  blink::WebCoalescedInputEvent& coalesced_event();
-  const ui::LatencyInfo latencyInfo() const { return latency_; }
-
-  void CoalesceWith(const ScopedWebInputEventWithLatencyInfo& other);
-
- private:
-  blink::WebScopedCoalescedInputEvent event_;
-  mutable ui::LatencyInfo latency_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_SCOPED_WEB_INPUT_EVENT_WITH_LATENCY_INFO_H_
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.cc b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
index 83a490ff7b2..d95fa790edb 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.cc
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
@@ -10,7 +10,6 @@
 #include "base/memory/shared_memory_mapping.h"
 #include "components/viz/common/features.h"
 #include "content/common/android/sync_compositor_statics.h"
-#include "content/common/input/sync_compositor_messages.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sender.h"
@@ -23,7 +22,7 @@
 namespace content {
 
 SynchronousCompositorProxy::SynchronousCompositorProxy(
-    ui::SynchronousInputHandlerProxy* input_handler_proxy)
+    blink::SynchronousInputHandlerProxy* input_handler_proxy)
     : input_handler_proxy_(input_handler_proxy),
       use_in_process_zero_copy_software_draw_(
           base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -99,8 +98,10 @@ void SynchronousCompositorProxy::DidActivatePendingTree() {
   SendAsyncRendererStateIfNeeded();
 }
 
-void SynchronousCompositorProxy::PopulateCommonParams(
-    SyncCompositorCommonRendererParams* params) {
+mojom::SyncCompositorCommonRendererParamsPtr
+SynchronousCompositorProxy::PopulateNewCommonParams() {
+  mojom::SyncCompositorCommonRendererParamsPtr params =
+      mojom::SyncCompositorCommonRendererParams::New();
   params->version = ++version_;
   params->total_scroll_offset = total_scroll_offset_;
   params->max_scroll_offset = max_scroll_offset_;
@@ -111,36 +112,35 @@ void SynchronousCompositorProxy::PopulateCommonParams(
   params->need_invalidate_count = need_invalidate_count_;
   params->invalidate_needs_draw = invalidate_needs_draw_;
   params->did_activate_pending_tree_count = did_activate_pending_tree_count_;
+  return params;
 }
 
 void SynchronousCompositorProxy::DemandDrawHwAsync(
-    const SyncCompositorDemandDrawHwParams& params) {
+    mojom::SyncCompositorDemandDrawHwParamsPtr params) {
   DemandDrawHw(
-      params,
+      std::move(params),
       base::BindOnce(&SynchronousCompositorProxy::SendDemandDrawHwAsyncReply,
                      base::Unretained(this)));
 }
 
 void SynchronousCompositorProxy::DemandDrawHw(
-    const SyncCompositorDemandDrawHwParams& params,
+    mojom::SyncCompositorDemandDrawHwParamsPtr params,
     DemandDrawHwCallback callback) {
   invalidate_needs_draw_ = false;
   hardware_draw_reply_ = std::move(callback);
 
   if (layer_tree_frame_sink_) {
-    layer_tree_frame_sink_->DemandDrawHw(params.viewport_size,
-                                         params.viewport_rect_for_tile_priority,
-                                         params.transform_for_tile_priority);
+    layer_tree_frame_sink_->DemandDrawHw(
+        params->viewport_size, params->viewport_rect_for_tile_priority,
+        params->transform_for_tile_priority);
   }
 
   // Ensure that a response is always sent even if the reply hasn't
   // generated a compostior frame.
   if (hardware_draw_reply_) {
-    SyncCompositorCommonRendererParams common_renderer_params;
-    PopulateCommonParams(&common_renderer_params);
     // Did not swap.
     std::move(hardware_draw_reply_)
-        .Run(common_renderer_params, 0u, 0u, base::nullopt, base::nullopt);
+        .Run(PopulateNewCommonParams(), 0u, 0u, base::nullopt, base::nullopt);
   }
 }
 
@@ -173,7 +173,7 @@ void SynchronousCompositorProxy::ZeroSharedMemory() {
 }
 
 void SynchronousCompositorProxy::DemandDrawSw(
-    const SyncCompositorDemandDrawSwParams& params,
+    mojom::SyncCompositorDemandDrawSwParamsPtr params,
     DemandDrawSwCallback callback) {
   invalidate_needs_draw_ = false;
   software_draw_reply_ = std::move(callback);
@@ -184,29 +184,27 @@ void SynchronousCompositorProxy::DemandDrawSw(
       layer_tree_frame_sink_->DemandDrawSw(sk_canvas_for_draw);
     } else {
       DCHECK(!sk_canvas_for_draw);
-      DoDemandDrawSw(params);
+      DoDemandDrawSw(std::move(params));
     }
   }
 
   // Ensure that a response is always sent even if the reply hasn't
   // generated a compostior frame.
   if (software_draw_reply_) {
-    SyncCompositorCommonRendererParams common_renderer_params;
-    PopulateCommonParams(&common_renderer_params);
     // Did not swap.
     std::move(software_draw_reply_)
-        .Run(common_renderer_params, 0u, base::nullopt);
+        .Run(PopulateNewCommonParams(), 0u, base::nullopt);
   }
 }
 
 void SynchronousCompositorProxy::DoDemandDrawSw(
-    const SyncCompositorDemandDrawSwParams& params) {
+    mojom::SyncCompositorDemandDrawSwParamsPtr params) {
   DCHECK(layer_tree_frame_sink_);
   DCHECK(software_draw_shm_->zeroed);
   software_draw_shm_->zeroed = false;
 
   SkImageInfo info =
-      SkImageInfo::MakeN32Premul(params.size.width(), params.size.height());
+      SkImageInfo::MakeN32Premul(params->size.width(), params->size.height());
   size_t stride = info.minRowBytes();
   size_t buffer_size = info.computeByteSize(stride);
   DCHECK_EQ(software_draw_shm_->buffer_size, buffer_size);
@@ -217,8 +215,8 @@ void SynchronousCompositorProxy::DoDemandDrawSw(
     return;
   }
   SkCanvas canvas(bitmap);
-  canvas.clipRect(gfx::RectToSkRect(params.clip));
-  canvas.concat(SkMatrix(params.transform.matrix()));
+  canvas.clipRect(gfx::RectToSkRect(params->clip));
+  canvas.concat(SkMatrix(params->transform.matrix()));
 
   layer_tree_frame_sink_->DemandDrawSw(&canvas);
 }
@@ -229,20 +227,20 @@ void SynchronousCompositorProxy::SubmitCompositorFrame(
     base::Optional<viz::HitTestRegionList> hit_test_region_list) {
   // Verify that exactly one of these is true.
   DCHECK(hardware_draw_reply_.is_null() ^ software_draw_reply_.is_null());
-  SyncCompositorCommonRendererParams common_renderer_params;
-  PopulateCommonParams(&common_renderer_params);
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params =
+      PopulateNewCommonParams();
 
   if (hardware_draw_reply_) {
     // For viz the CF was submitted directly via CompositorFrameSink
     DCHECK(frame || viz_frame_submission_enabled_);
     std::move(hardware_draw_reply_)
-        .Run(common_renderer_params, layer_tree_frame_sink_id,
+        .Run(std::move(common_renderer_params), layer_tree_frame_sink_id,
              NextMetadataVersion(), std::move(frame),
              std::move(hit_test_region_list));
   } else if (software_draw_reply_) {
     DCHECK(frame);
     std::move(software_draw_reply_)
-        .Run(common_renderer_params, NextMetadataVersion(),
+        .Run(std::move(common_renderer_params), NextMetadataVersion(),
              std::move(frame->metadata));
   } else {
     NOTREACHED();
@@ -277,9 +275,7 @@ void SynchronousCompositorProxy::BeginFrame(
       layer_tree_frame_sink_->BeginFrame(args);
   }
 
-  SyncCompositorCommonRendererParams param;
-  PopulateCommonParams(&param);
-  SendBeginFrameResponse(param);
+  SendBeginFrameResponse(PopulateNewCommonParams());
 }
 
 void SynchronousCompositorProxy::SetScroll(
@@ -308,17 +304,20 @@ void SynchronousCompositorProxy::SetSharedMemory(
     base::WritableSharedMemoryRegion shm_region,
     SetSharedMemoryCallback callback) {
   bool success = false;
-  SyncCompositorCommonRendererParams common_renderer_params;
+  mojom::SyncCompositorCommonRendererParamsPtr common_renderer_params;
   if (shm_region.IsValid()) {
     base::WritableSharedMemoryMapping shm_mapping = shm_region.Map();
     if (shm_mapping.IsValid()) {
       software_draw_shm_ = std::make_unique<SharedMemoryWithSize>(
           std::move(shm_mapping), shm_mapping.size());
-      PopulateCommonParams(&common_renderer_params);
+      common_renderer_params = PopulateNewCommonParams();
       success = true;
     }
   }
-  std::move(callback).Run(success, common_renderer_params);
+  if (!common_renderer_params) {
+    common_renderer_params = mojom::SyncCompositorCommonRendererParams::New();
+  }
+  std::move(callback).Run(success, std::move(common_renderer_params));
 }
 
 void SynchronousCompositorProxy::ZoomBy(float zoom_delta,
@@ -326,9 +325,7 @@ void SynchronousCompositorProxy::ZoomBy(float zoom_delta,
                                         ZoomByCallback callback) {
   zoom_by_reply_ = std::move(callback);
   input_handler_proxy_->SynchronouslyZoomBy(zoom_delta, anchor);
-  SyncCompositorCommonRendererParams common_renderer_params;
-  PopulateCommonParams(&common_renderer_params);
-  std::move(zoom_by_reply_).Run(common_renderer_params);
+  std::move(zoom_by_reply_).Run(PopulateNewCommonParams());
 }
 
 uint32_t SynchronousCompositorProxy::NextMetadataVersion() {
@@ -336,7 +333,7 @@ uint32_t SynchronousCompositorProxy::NextMetadataVersion() {
 }
 
 void SynchronousCompositorProxy::SendDemandDrawHwAsyncReply(
-    const content::SyncCompositorCommonRendererParams&,
+    mojom::SyncCompositorCommonRendererParamsPtr,
     uint32_t layer_tree_frame_sink_id,
     uint32_t metadata_version,
     base::Optional<viz::CompositorFrame> frame,
@@ -346,17 +343,15 @@ void SynchronousCompositorProxy::SendDemandDrawHwAsyncReply(
 }
 
 void SynchronousCompositorProxy::SendBeginFrameResponse(
-    const content::SyncCompositorCommonRendererParams& param) {
-  control_host_->BeginFrameResponse(param);
+    mojom::SyncCompositorCommonRendererParamsPtr param) {
+  control_host_->BeginFrameResponse(std::move(param));
 }
 
 void SynchronousCompositorProxy::SendAsyncRendererStateIfNeeded() {
   if (hardware_draw_reply_ || software_draw_reply_ || zoom_by_reply_ || !host_)
     return;
 
-  SyncCompositorCommonRendererParams params;
-  PopulateCommonParams(&params);
-  host_->UpdateState(params);
+  host_->UpdateState(PopulateNewCommonParams());
 }
 
 void SynchronousCompositorProxy::LayerTreeFrameSinkCreated() {
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.h b/chromium/content/renderer/input/synchronous_compositor_proxy.h
index 5dbf7cc0b00..703fb153e96 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.h
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.h
@@ -14,12 +14,12 @@
 #include "base/optional.h"
 #include "components/viz/common/frame_timing_details_map.h"
 #include "content/common/input/synchronous_compositor.mojom.h"
-#include "content/public/common/input_event_ack_state.h"
 #include "content/renderer/android/synchronous_layer_tree_frame_sink.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "ui/events/blink/synchronous_input_handler_proxy.h"
+#include "third_party/blink/public/mojom/input/input_event_result.mojom-shared.h"
+#include "third_party/blink/public/platform/input/synchronous_input_handler_proxy.h"
 #include "ui/gfx/geometry/scroll_offset.h"
 #include "ui/gfx/geometry/size_f.h"
 
@@ -30,16 +30,13 @@ class CompositorFrame;
 namespace content {
 
 class SynchronousLayerTreeFrameSink;
-struct SyncCompositorCommonRendererParams;
-struct SyncCompositorDemandDrawHwParams;
-struct SyncCompositorDemandDrawSwParams;
 
-class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
+class SynchronousCompositorProxy : public blink::SynchronousInputHandler,
                                    public SynchronousLayerTreeFrameSinkClient,
                                    public mojom::SynchronousCompositor {
  public:
   SynchronousCompositorProxy(
-      ui::SynchronousInputHandlerProxy* input_handler_proxy);
+      blink::SynchronousInputHandlerProxy* input_handler_proxy);
   ~SynchronousCompositorProxy() override;
 
   void Init();
@@ -49,7 +46,7 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
       mojo::PendingAssociatedReceiver<mojom::SynchronousCompositor>
           compositor_request);
 
-  // ui::SynchronousInputHandler overrides.
+  // blink::SynchronousInputHandler overrides.
   void UpdateRootLayerState(const gfx::ScrollOffset& total_scroll_offset,
                             const gfx::ScrollOffset& max_scroll_offset,
                             const gfx::SizeF& scrollable_size,
@@ -69,16 +66,17 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
 
   void SetLayerTreeFrameSink(
       SynchronousLayerTreeFrameSink* layer_tree_frame_sink);
-  void PopulateCommonParams(SyncCompositorCommonRendererParams* params);
+
+  mojom::SyncCompositorCommonRendererParamsPtr PopulateNewCommonParams();
 
   // mojom::SynchronousCompositor overrides.
   void DemandDrawHwAsync(
-      const SyncCompositorDemandDrawHwParams& draw_params) final;
-  void DemandDrawHw(const SyncCompositorDemandDrawHwParams& params,
+      mojom::SyncCompositorDemandDrawHwParamsPtr draw_params) final;
+  void DemandDrawHw(mojom::SyncCompositorDemandDrawHwParamsPtr params,
                     DemandDrawHwCallback callback) final;
   void SetSharedMemory(base::WritableSharedMemoryRegion shm_region,
                        SetSharedMemoryCallback callback) final;
-  void DemandDrawSw(const SyncCompositorDemandDrawSwParams& params,
+  void DemandDrawSw(mojom::SyncCompositorDemandDrawSwParamsPtr params,
                     DemandDrawSwCallback callback) final;
   void WillSkipDraw() final;
   void ZeroSharedMemory() final;
@@ -95,10 +93,9 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
  protected:
   void SendAsyncRendererStateIfNeeded();
   void LayerTreeFrameSinkCreated();
-  void SendBeginFrameResponse(
-      const content::SyncCompositorCommonRendererParams&);
+  void SendBeginFrameResponse(mojom::SyncCompositorCommonRendererParamsPtr);
   void SendDemandDrawHwAsyncReply(
-      const content::SyncCompositorCommonRendererParams&,
+      mojom::SyncCompositorCommonRendererParamsPtr,
       uint32_t layer_tree_frame_sink_id,
       uint32_t metadata_version,
       base::Optional<viz::CompositorFrame>,
@@ -111,13 +108,13 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
   bool begin_frame_paused_ = false;
 
  private:
-  void DoDemandDrawSw(const SyncCompositorDemandDrawSwParams& params);
+  void DoDemandDrawSw(mojom::SyncCompositorDemandDrawSwParamsPtr params);
   uint32_t NextMetadataVersion();
   void HostDisconnected();
 
   struct SharedMemoryWithSize;
 
-  ui::SynchronousInputHandlerProxy* const input_handler_proxy_;
+  blink::SynchronousInputHandlerProxy* const input_handler_proxy_;
   mojo::Remote<mojom::SynchronousCompositorControlHost> control_host_;
   mojo::AssociatedRemote<mojom::SynchronousCompositorHost> host_;
   mojo::AssociatedReceiver<mojom::SynchronousCompositor> receiver_{this};
diff --git a/chromium/content/renderer/input/widget_input_handler_impl.cc b/chromium/content/renderer/input/widget_input_handler_impl.cc
index d4c6e39f25b..d27b93ea269 100644
--- a/chromium/content/renderer/input/widget_input_handler_impl.cc
+++ b/chromium/content/renderer/input/widget_input_handler_impl.cc
@@ -7,17 +7,17 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/input/ime_text_span_conversions.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_widget.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 
@@ -85,16 +85,11 @@ void WidgetInputHandlerImpl::MouseCaptureLost() {
       base::BindOnce(&RenderWidget::OnMouseCaptureLost, render_widget_));
 }
 
-void WidgetInputHandlerImpl::MouseLockLost() {
-  RunOnMainThread(
-      base::BindOnce(&RenderWidget::PointerLockLost, render_widget_));
-}
-
 void WidgetInputHandlerImpl::SetEditCommandsForNextKeyEvent(
-    const std::vector<EditCommand>& commands) {
+    std::vector<blink::mojom::EditCommandPtr> commands) {
   RunOnMainThread(
       base::BindOnce(&RenderWidget::OnSetEditCommandsForNextKeyEvent,
-                     render_widget_, commands));
+                     render_widget_, std::move(commands)));
 }
 
 void WidgetInputHandlerImpl::CursorVisibilityChanged(bool visible) {
@@ -102,11 +97,6 @@ void WidgetInputHandlerImpl::CursorVisibilityChanged(bool visible) {
                                  render_widget_, visible));
 }
 
-void WidgetInputHandlerImpl::FallbackCursorModeToggled(bool is_on) {
-  RunOnMainThread(base::BindOnce(&RenderWidget::OnFallbackCursorModeToggled,
-                                 render_widget_, is_on));
-}
-
 void WidgetInputHandlerImpl::ImeSetComposition(
     const base::string16& text,
     const std::vector<ui::ImeTextSpan>& ime_text_spans,
diff --git a/chromium/content/renderer/input/widget_input_handler_impl.h b/chromium/content/renderer/input/widget_input_handler_impl.h
index dd982798a5a..86d288b5967 100644
--- a/chromium/content/renderer/input/widget_input_handler_impl.h
+++ b/chromium/content/renderer/input/widget_input_handler_impl.h
@@ -37,11 +37,9 @@ class WidgetInputHandlerImpl : public mojom::WidgetInputHandler {
 
   void SetFocus(bool focused) override;
   void MouseCaptureLost() override;
-  void MouseLockLost() override;
   void SetEditCommandsForNextKeyEvent(
-      const std::vector<EditCommand>& commands) override;
+      std::vector<blink::mojom::EditCommandPtr> commands) override;
   void CursorVisibilityChanged(bool visible) override;
-  void FallbackCursorModeToggled(bool is_on) override;
   void ImeSetComposition(const base::string16& text,
                          const std::vector<ui::ImeTextSpan>& ime_text_spans,
                          const gfx::Range& range,
diff --git a/chromium/content/renderer/input/widget_input_handler_manager.cc b/chromium/content/renderer/input/widget_input_handler_manager.cc
index d06f3a92645..4c606edf453 100644
--- a/chromium/content/renderer/input/widget_input_handler_manager.cc
+++ b/chromium/content/renderer/input/widget_input_handler_manager.cc
@@ -7,20 +7,24 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "content/common/input_messages.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/widget_input_handler_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_widget.h"
+#include "services/tracing/public/cpp/perfetto/flow_event_utils.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event_attribution.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "ui/events/base_event_utils.h"
+#include "ui/events/blink/blink_event_util.h"
+#include "ui/events/blink/did_overscroll_params.h"
 
 #if defined(OS_ANDROID)
 #include "content/public/common/content_client.h"
@@ -29,38 +33,57 @@
 #endif
 
 namespace content {
+
+using ::perfetto::protos::pbzero::ChromeLatencyInfo;
+using ::perfetto::protos::pbzero::TrackEvent;
+
 namespace {
+
+blink::mojom::DidOverscrollParamsPtr ToDidOverscrollParams(
+    const blink::InputHandlerProxy::DidOverscrollParams* overscroll_params) {
+  if (!overscroll_params)
+    return nullptr;
+  return blink::mojom::DidOverscrollParams::New(
+      overscroll_params->accumulated_overscroll,
+      overscroll_params->latest_overscroll_delta,
+      overscroll_params->current_fling_velocity,
+      overscroll_params->causal_event_viewport_point,
+      overscroll_params->overscroll_behavior);
+}
+
 void CallCallback(mojom::WidgetInputHandler::DispatchEventCallback callback,
-                  InputEventAckState ack_state,
+                  blink::mojom::InputEventResultState result_state,
                   const ui::LatencyInfo& latency_info,
-                  std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+                  blink::mojom::DidOverscrollParamsPtr overscroll_params,
                   base::Optional<cc::TouchAction> touch_action) {
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_HANDLED_INPUT_EVENT_IMPL);
   std::move(callback).Run(
-      InputEventAckSource::MAIN_THREAD, latency_info, ack_state,
-      overscroll_params
-          ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-          : base::nullopt,
-      touch_action);
+      blink::mojom::InputEventResultSource::kMainThread, latency_info,
+      result_state, std::move(overscroll_params),
+      touch_action
+          ? blink::mojom::TouchActionOptional::New(touch_action.value())
+          : nullptr);
 }
 
-InputEventAckState InputEventDispositionToAck(
-    ui::InputHandlerProxy::EventDisposition disposition) {
+blink::mojom::InputEventResultState InputEventDispositionToAck(
+    blink::InputHandlerProxy::EventDisposition disposition) {
   switch (disposition) {
-    case ui::InputHandlerProxy::DID_HANDLE:
-      return INPUT_EVENT_ACK_STATE_CONSUMED;
-    case ui::InputHandlerProxy::DID_NOT_HANDLE:
-      return INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
-    case ui::InputHandlerProxy::DID_NOT_HANDLE_NON_BLOCKING_DUE_TO_FLING:
-      return INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING;
-    case ui::InputHandlerProxy::DROP_EVENT:
-      return INPUT_EVENT_ACK_STATE_NO_CONSUMER_EXISTS;
-    case ui::InputHandlerProxy::DID_HANDLE_NON_BLOCKING:
-      return INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING;
-    case ui::InputHandlerProxy::DID_HANDLE_SHOULD_BUBBLE:
-      return INPUT_EVENT_ACK_STATE_CONSUMED_SHOULD_BUBBLE;
+    case blink::InputHandlerProxy::DID_HANDLE:
+      return blink::mojom::InputEventResultState::kConsumed;
+    case blink::InputHandlerProxy::DID_NOT_HANDLE:
+      return blink::mojom::InputEventResultState::kNotConsumed;
+    case blink::InputHandlerProxy::DID_NOT_HANDLE_NON_BLOCKING_DUE_TO_FLING:
+      return blink::mojom::InputEventResultState::kSetNonBlockingDueToFling;
+    case blink::InputHandlerProxy::DROP_EVENT:
+      return blink::mojom::InputEventResultState::kNoConsumerExists;
+    case blink::InputHandlerProxy::DID_HANDLE_NON_BLOCKING:
+      return blink::mojom::InputEventResultState::kSetNonBlocking;
+    case blink::InputHandlerProxy::DID_HANDLE_SHOULD_BUBBLE:
+      return blink::mojom::InputEventResultState::kConsumedShouldBubble;
   }
   NOTREACHED();
-  return INPUT_EVENT_ACK_STATE_UNKNOWN;
+  return blink::mojom::InputEventResultState::kUnknown;
 }
 
 }  // namespace
@@ -79,7 +102,7 @@ class SynchronousCompositorProxyRegistry
     DCHECK(!proxy_);
   }
 
-  void CreateProxy(ui::SynchronousInputHandlerProxy* handler) {
+  void CreateProxy(blink::SynchronousInputHandlerProxy* handler) {
     DCHECK(compositor_task_runner_->BelongsToCurrentThread());
     proxy_ = std::make_unique<SynchronousCompositorProxy>(handler);
     proxy_->Init();
@@ -133,6 +156,12 @@ scoped_refptr<WidgetInputHandlerManager> WidgetInputHandlerManager::Create(
   if (uses_input_handler)
     manager->InitInputHandler();
 
+  // A compositor thread implies we're using an input handler.
+  DCHECK(!manager->compositor_task_runner_ || uses_input_handler);
+  // Conversely, if we don't use an input handler we must not have a compositor
+  // thread.
+  DCHECK(uses_input_handler || !manager->compositor_task_runner_);
+
   return manager;
 }
 
@@ -218,10 +247,10 @@ void WidgetInputHandlerManager::DispatchNonBlockingEventToMainThread(
     const ui::LatencyInfo& latency_info,
     const blink::WebInputEventAttribution& attribution) {
   DCHECK(input_event_queue_);
-  input_event_queue_->HandleEvent(std::move(event), latency_info,
-                                  DISPATCH_TYPE_NON_BLOCKING,
-                                  INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
-                                  attribution, HandledEventCallback());
+  input_event_queue_->HandleEvent(
+      std::move(event), latency_info, DISPATCH_TYPE_NON_BLOCKING,
+      blink::mojom::InputEventResultState::kSetNonBlocking, attribution,
+      HandledEventCallback());
 }
 
 void WidgetInputHandlerManager::FindScrollTargetOnMainThread(
@@ -236,24 +265,6 @@ void WidgetInputHandlerManager::FindScrollTargetOnMainThread(
       FROM_HERE, base::BindOnce(std::move(callback), element_id));
 }
 
-void WidgetInputHandlerManager::DidOverscroll(
-    const gfx::Vector2dF& accumulated_overscroll,
-    const gfx::Vector2dF& latest_overscroll_delta,
-    const gfx::Vector2dF& current_fling_velocity,
-    const gfx::PointF& causal_event_viewport_point,
-    const cc::OverscrollBehavior& overscroll_behavior) {
-  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
-  if (!host)
-    return;
-  ui::DidOverscrollParams params;
-  params.accumulated_overscroll = accumulated_overscroll;
-  params.latest_overscroll_delta = latest_overscroll_delta;
-  params.current_fling_velocity = current_fling_velocity;
-  params.causal_event_viewport_point = causal_event_viewport_point;
-  params.overscroll_behavior = overscroll_behavior;
-  host->DidOverscroll(params);
-}
-
 void WidgetInputHandlerManager::DidAnimateForInput() {
   main_thread_scheduler_->DidAnimateForInputOnCompositorThread();
 }
@@ -268,7 +279,8 @@ void WidgetInputHandlerManager::DidStartScrollingViewport() {
 void WidgetInputHandlerManager::GenerateScrollBeginAndSendToMainThread(
     const blink::WebGestureEvent& update_event,
     const blink::WebInputEventAttribution& attribution) {
-  DCHECK_EQ(update_event.GetType(), blink::WebInputEvent::kGestureScrollUpdate);
+  DCHECK_EQ(update_event.GetType(),
+            blink::WebInputEvent::Type::kGestureScrollUpdate);
   blink::WebGestureEvent scroll_begin =
       ui::ScrollBeginFromScrollUpdate(update_event);
 
@@ -279,17 +291,8 @@ void WidgetInputHandlerManager::GenerateScrollBeginAndSendToMainThread(
 void WidgetInputHandlerManager::SetWhiteListedTouchAction(
     cc::TouchAction touch_action,
     uint32_t unique_touch_event_id,
-    ui::InputHandlerProxy::EventDisposition event_disposition) {
-  if (base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {
-    white_listed_touch_action_ = touch_action;
-    return;
-  }
-  mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost();
-  if (!host)
-    return;
-  InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  host->SetWhiteListedTouchAction(touch_action, unique_touch_event_id,
-                                  ack_state);
+    blink::InputHandlerProxy::EventDisposition event_disposition) {
+  white_listed_touch_action_ = touch_action;
 }
 
 void WidgetInputHandlerManager::ProcessTouchAction(
@@ -357,8 +360,8 @@ void WidgetInputHandlerManager::DispatchEvent(
     // handled.
     if (callback) {
       std::move(callback).Run(
-          InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-          INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+          blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
@@ -381,8 +384,8 @@ void WidgetInputHandlerManager::DispatchEvent(
   if (renderer_deferral_state_ && !allow_pre_commit_input_ && !event_is_move) {
     if (callback) {
       std::move(callback).Run(
-          InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-          INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+          blink::mojom::InputEventResultSource::kMainThread, ui::LatencyInfo(),
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
@@ -399,19 +402,29 @@ void WidgetInputHandlerManager::DispatchEvent(
     if (!input_handler_proxy_) {
       if (callback) {
         std::move(callback).Run(
-            InputEventAckSource::MAIN_THREAD, ui::LatencyInfo(),
-            INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt, base::nullopt);
+            blink::mojom::InputEventResultSource::kMainThread,
+            ui::LatencyInfo(),
+            blink::mojom::InputEventResultState::kNotConsumed, nullptr,
+            nullptr);
       }
       return;
     }
+
+    // The InputHandlerProxy will be the first to try handing the event on the
+    // compositor thread. It will respond to this class by calling
+    // DidHandleInputEventSentToCompositor with the result of its attempt. Based
+    // on the resulting disposition, DidHandleInputEventSentToCompositor will
+    // either ACK the event as handled to the browser or forward it to the main
+    // thread.
     input_handler_proxy_->HandleInputEventWithLatencyInfo(
         std::move(event->web_event), event->latency_info,
         base::BindOnce(
-            &WidgetInputHandlerManager::DidHandleInputEventAndOverscroll, this,
-            std::move(callback)));
+            &WidgetInputHandlerManager::DidHandleInputEventSentToCompositor,
+            this, std::move(callback)));
   } else {
-    HandleInputEvent(std::move(event->web_event), event->latency_info,
-                     std::move(callback));
+    DCHECK(!input_handler_proxy_);
+    DispatchDirectlyToWidget(std::move(event->web_event), event->latency_info,
+                             std::move(callback));
   }
 }
 
@@ -485,24 +498,6 @@ void WidgetInputHandlerManager::WaitForInputProcessed(
       base::BindOnce(&WaitForInputProcessedFromMain, render_widget_));
 }
 
-void WidgetInputHandlerManager::FallbackCursorModeLockCursor(bool left,
-                                                             bool right,
-                                                             bool up,
-                                                             bool down) {
-#if defined(OS_ANDROID)
-  if (mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost())
-    host->FallbackCursorModeLockCursor(left, right, up, down);
-#endif
-}
-
-void WidgetInputHandlerManager::FallbackCursorModeSetCursorVisibility(
-    bool visible) {
-#if defined(OS_ANDROID)
-  if (mojom::WidgetInputHandlerHost* host = GetWidgetInputHandlerHost())
-    host->FallbackCursorModeSetCursorVisibility(visible);
-#endif
-}
-
 void WidgetInputHandlerManager::DidNavigate() {
   renderer_deferral_state_ = 0;
   have_emitted_uma_ = false;
@@ -532,6 +527,7 @@ void WidgetInputHandlerManager::InitOnInputHandlingThread(
     const base::WeakPtr<cc::InputHandler>& input_handler,
     bool sync_compositing) {
   DCHECK(InputThreadTaskRunner()->BelongsToCurrentThread());
+  DCHECK(uses_input_handler_);
 
   // It is possible that the input_handle has already been destroyed before this
   // Init() call was invoked. If so, early out.
@@ -542,7 +538,7 @@ void WidgetInputHandlerManager::InitOnInputHandlingThread(
   // to go through the main thread.
   bool force_input_handling_on_main = !compositor_task_runner_;
 
-  input_handler_proxy_ = std::make_unique<ui::InputHandlerProxy>(
+  input_handler_proxy_ = std::make_unique<blink::InputHandlerProxy>(
       input_handler.get(), this, force_input_handling_on_main);
 
 #if defined(OS_ANDROID)
@@ -577,41 +573,53 @@ void WidgetInputHandlerManager::BindChannel(
   handler->SetReceiver(std::move(receiver));
 }
 
-void WidgetInputHandlerManager::HandleInputEvent(
+void WidgetInputHandlerManager::DispatchDirectlyToWidget(
     const ui::WebScopedInputEvent& event,
     const ui::LatencyInfo& latency,
     mojom::WidgetInputHandler::DispatchEventCallback callback) {
+  // This path should only be taken by non-frame RenderWidgets that don't use a
+  // compositor (e.g. popups, plugins). Events bounds for a frame RenderWidget
+  // must be passed through the InputHandlerProxy first.
+  DCHECK(!uses_input_handler_);
+
   // Input messages must not be processed if the RenderWidget was destroyed or
   // was just recreated for a provisional frame.
   if (!render_widget_ || render_widget_->IsForProvisionalFrame()) {
     if (callback) {
-      std::move(callback).Run(InputEventAckSource::MAIN_THREAD, latency,
-                              INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt,
-                              base::nullopt);
+      std::move(callback).Run(
+          blink::mojom::InputEventResultSource::kMainThread, latency,
+          blink::mojom::InputEventResultState::kNotConsumed, nullptr, nullptr);
     }
     return;
   }
-  auto send_callback = base::BindOnce(
-      &WidgetInputHandlerManager::HandledInputEvent, this, std::move(callback));
 
-  blink::WebCoalescedInputEvent coalesced_event(*event);
-  render_widget_->HandleInputEvent(coalesced_event, latency,
-                                   std::move(send_callback));
+  auto send_callback =
+      base::BindOnce(&WidgetInputHandlerManager::DidHandleInputEventSentToMain,
+                     this, std::move(callback));
+
+  blink::WebCoalescedInputEvent coalesced_event(*event, latency);
+  render_widget_->HandleInputEvent(coalesced_event, std::move(send_callback));
 }
 
-void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
+void WidgetInputHandlerManager::DidHandleInputEventSentToCompositor(
     mojom::WidgetInputHandler::DispatchEventCallback callback,
-    ui::InputHandlerProxy::EventDisposition event_disposition,
+    blink::InputHandlerProxy::EventDisposition event_disposition,
     ui::WebScopedInputEvent input_event,
     const ui::LatencyInfo& latency_info,
-    std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+    std::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams>
+        overscroll_params,
     const blink::WebInputEventAttribution& attribution) {
   TRACE_EVENT1("input",
-               "WidgetInputHandlerManager::DidHandleInputEventAndOverscroll",
+               "WidgetInputHandlerManager::DidHandleInputEventSentToCompositor",
                "Disposition", event_disposition);
+  DCHECK(InputThreadTaskRunner()->BelongsToCurrentThread());
+
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_DID_HANDLE_INPUT_AND_OVERSCROLL);
 
-  InputEventAckState ack_state = InputEventDispositionToAck(event_disposition);
-  if (ack_state == INPUT_EVENT_ACK_STATE_CONSUMED) {
+  blink::mojom::InputEventResultState ack_state =
+      InputEventDispositionToAck(event_disposition);
+  if (ack_state == blink::mojom::InputEventResultState::kConsumed) {
     main_thread_scheduler_->DidHandleInputEventOnCompositorThread(
         *input_event, blink::scheduler::WebThreadScheduler::InputEventState::
                           EVENT_CONSUMED_BY_COMPOSITOR);
@@ -621,17 +629,18 @@ void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
                           EVENT_FORWARDED_TO_MAIN_THREAD);
   }
 
-  if (ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING ||
-      ack_state == INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING_DUE_TO_FLING ||
-      ack_state == INPUT_EVENT_ACK_STATE_NOT_CONSUMED) {
+  if (ack_state == blink::mojom::InputEventResultState::kSetNonBlocking ||
+      ack_state ==
+          blink::mojom::InputEventResultState::kSetNonBlockingDueToFling ||
+      ack_state == blink::mojom::InputEventResultState::kNotConsumed) {
     DCHECK(!overscroll_params);
     DCHECK(!latency_info.coalesced());
     InputEventDispatchType dispatch_type = callback.is_null()
                                                ? DISPATCH_TYPE_NON_BLOCKING
                                                : DISPATCH_TYPE_BLOCKING;
-    HandledEventCallback handled_event =
-        base::BindOnce(&WidgetInputHandlerManager::HandledInputEvent, this,
-                       std::move(callback));
+    HandledEventCallback handled_event = base::BindOnce(
+        &WidgetInputHandlerManager::DidHandleInputEventSentToMain, this,
+        std::move(callback));
     input_event_queue_->HandleEvent(std::move(input_event), latency_info,
                                     dispatch_type, ack_state, attribution,
                                     std::move(handled_event));
@@ -639,27 +648,29 @@ void WidgetInputHandlerManager::DidHandleInputEventAndOverscroll(
   }
   if (callback) {
     std::move(callback).Run(
-        InputEventAckSource::COMPOSITOR_THREAD, latency_info, ack_state,
-        overscroll_params
-            ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-            : base::nullopt,
-        base::nullopt);
+        blink::mojom::InputEventResultSource::kCompositorThread, latency_info,
+        ack_state, ToDidOverscrollParams(overscroll_params.get()), nullptr);
   }
 }
 
-void WidgetInputHandlerManager::HandledInputEvent(
+void WidgetInputHandlerManager::DidHandleInputEventSentToMain(
     mojom::WidgetInputHandler::DispatchEventCallback callback,
-    InputEventAckState ack_state,
+    blink::mojom::InputEventResultState ack_state,
     const ui::LatencyInfo& latency_info,
-    std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+    blink::mojom::DidOverscrollParamsPtr overscroll_params,
     base::Optional<cc::TouchAction> touch_action) {
   if (!callback)
     return;
 
-  TRACE_EVENT1("input", "WidgetInputHandlerManager::HandledInputEvent",
+  TRACE_EVENT1("input",
+               "WidgetInputHandlerManager::DidHandleInputEventSentToMain",
                "ack_state", ack_state);
+  ui::LatencyInfo::TraceIntermediateFlowEvents(
+      {latency_info}, ChromeLatencyInfo::STEP_HANDLED_INPUT_EVENT_MAIN_OR_IMPL);
 
   if (!touch_action.has_value()) {
+    TRACE_EVENT_INSTANT0("input", "Using white_listed_touch_action",
+                         TRACE_EVENT_SCOPE_THREAD);
     touch_action = white_listed_touch_action_;
     white_listed_touch_action_.reset();
   }
@@ -679,13 +690,13 @@ void WidgetInputHandlerManager::HandledInputEvent(
   } else {
     // Otherwise call the callback immediately.
     std::move(callback).Run(
-        is_compositor_thread ? InputEventAckSource::COMPOSITOR_THREAD
-                             : InputEventAckSource::MAIN_THREAD,
-        latency_info, ack_state,
-        overscroll_params
-            ? base::Optional<ui::DidOverscrollParams>(*overscroll_params)
-            : base::nullopt,
-        touch_action);
+        is_compositor_thread
+            ? blink::mojom::InputEventResultSource::kCompositorThread
+            : blink::mojom::InputEventResultSource::kMainThread,
+        latency_info, ack_state, std::move(overscroll_params),
+        touch_action
+            ? blink::mojom::TouchActionOptional::New(touch_action.value())
+            : nullptr);
   }
 }
 
@@ -694,8 +705,8 @@ void WidgetInputHandlerManager::ObserveGestureEventOnInputHandlingThread(
     const cc::InputHandlerScrollResult& scroll_result) {
   if (!input_handler_proxy_)
     return;
-  DCHECK(input_handler_proxy_->scroll_elasticity_controller());
-  input_handler_proxy_->scroll_elasticity_controller()
+  DCHECK(input_handler_proxy_->elastic_overscroll_controller());
+  input_handler_proxy_->elastic_overscroll_controller()
       ->ObserveGestureEventAndResult(gesture_event, scroll_result);
 }
 
diff --git a/chromium/content/renderer/input/widget_input_handler_manager.h b/chromium/content/renderer/input/widget_input_handler_manager.h
index dc109d9a1be..d5d95972da8 100644
--- a/chromium/content/renderer/input/widget_input_handler_manager.h
+++ b/chromium/content/renderer/input/widget_input_handler_manager.h
@@ -14,8 +14,8 @@
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/shared_remote.h"
-#include "ui/events/blink/input_handler_proxy.h"
-#include "ui/events/blink/input_handler_proxy_client.h"
+#include "third_party/blink/public/platform/input/input_handler_proxy.h"
+#include "third_party/blink/public/platform/input/input_handler_proxy_client.h"
 
 namespace blink {
 class WebInputEventAttribution;
@@ -38,7 +38,7 @@ class SynchronousCompositorProxyRegistry;
 // The lifecycle of this object matches that of the RenderWidget.
 class CONTENT_EXPORT WidgetInputHandlerManager final
     : public base::RefCountedThreadSafe<WidgetInputHandlerManager>,
-      public ui::InputHandlerProxyClient,
+      public blink::InputHandlerProxyClient,
       public base::SupportsWeakPtr<WidgetInputHandlerManager> {
   // Used in UMA metrics reporting. Do not re-order, and rename the metric if
   // additional states are required.
@@ -81,12 +81,6 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
       const ui::LatencyInfo& latency_info,
       const blink::WebInputEventAttribution& attribution) override;
 
-  void DidOverscroll(
-      const gfx::Vector2dF& accumulated_overscroll,
-      const gfx::Vector2dF& latest_overscroll_delta,
-      const gfx::Vector2dF& current_fling_velocity,
-      const gfx::PointF& causal_event_viewport_point,
-      const cc::OverscrollBehavior& overscroll_behavior) override;
   void DidAnimateForInput() override;
   void DidStartScrollingViewport() override;
   void GenerateScrollBeginAndSendToMainThread(
@@ -95,7 +89,7 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void SetWhiteListedTouchAction(
       cc::TouchAction touch_action,
       uint32_t unique_touch_event_id,
-      ui::InputHandlerProxy::EventDisposition event_disposition) override;
+      blink::InputHandlerProxy::EventDisposition event_disposition) override;
 
   void ObserveGestureEventOnMainThread(
       const blink::WebGestureEvent& gesture_event,
@@ -122,9 +116,6 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void InputWasProcessed(const gfx::PresentationFeedback& feedback);
   void WaitForInputProcessed(base::OnceClosure callback);
 
-  void FallbackCursorModeLockCursor(bool left, bool right, bool up, bool down);
-  void FallbackCursorModeSetCursorVisibility(bool visible);
-
   // Called when the RenderWidget is notified of a navigation. Resets
   // the renderer pipeline deferral status, and resets the UMA recorder for
   // time of first input.
@@ -165,23 +156,45 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   void BindAssociatedChannel(
       mojo::PendingAssociatedReceiver<mojom::WidgetInputHandler> receiver);
   void BindChannel(mojo::PendingReceiver<mojom::WidgetInputHandler> receiver);
-  void HandleInputEvent(
+
+  // This method skips the input handler proxy and sends the event directly to
+  // the RenderWidget (main thread). Should only be used by non-frame
+  // RenderWidgets that don't use a compositor (e.g. popups, plugins). Events
+  // for a frame RenderWidget should always be passed through the
+  // InputHandlerProxy by calling DispatchEvent which will re-route to the main
+  // thread if needed.
+  void DispatchDirectlyToWidget(
       const ui::WebScopedInputEvent& event,
       const ui::LatencyInfo& latency,
       mojom::WidgetInputHandler::DispatchEventCallback callback);
-  void DidHandleInputEventAndOverscroll(
+
+  // This method is the callback used by the compositor input handler to
+  // communicate back whether the event was successfully handled on the
+  // compositor thread or whether it needs to forwarded to the main thread.
+  // This method is responsible for passing the event on to the main thread or
+  // replying to the browser that the event was handled. This is always called
+  // on the input handling thread (i.e. if a compositor thread exists, it'll be
+  // called from it).
+  void DidHandleInputEventSentToCompositor(
       mojom::WidgetInputHandler::DispatchEventCallback callback,
-      ui::InputHandlerProxy::EventDisposition event_disposition,
+      blink::InputHandlerProxy::EventDisposition event_disposition,
       ui::WebScopedInputEvent input_event,
       const ui::LatencyInfo& latency_info,
-      std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+      std::unique_ptr<blink::InputHandlerProxy::DidOverscrollParams>
+          overscroll_params,
       const blink::WebInputEventAttribution& attribution);
-  void HandledInputEvent(
+
+  // Similar to the above; this is used by the main thread input handler to
+  // communicate back the result of handling the event. Note: this may be
+  // called on either thread as non-blocking events sent to the main thread
+  // will be ACKed immediately when added to the main thread event queue.
+  void DidHandleInputEventSentToMain(
       mojom::WidgetInputHandler::DispatchEventCallback callback,
-      InputEventAckState ack_state,
+      blink::mojom::InputEventResultState ack_state,
       const ui::LatencyInfo& latency_info,
-      std::unique_ptr<ui::DidOverscrollParams> overscroll_params,
+      blink::mojom::DidOverscrollParamsPtr overscroll_params,
       base::Optional<cc::TouchAction> touch_action);
+
   void ObserveGestureEventOnInputHandlingThread(
       const blink::WebGestureEvent& gesture_event,
       const cc::InputHandlerScrollResult& scroll_result);
@@ -199,7 +212,7 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
 
   // InputHandlerProxy is only interacted with on the compositor
   // thread.
-  std::unique_ptr<ui::InputHandlerProxy> input_handler_proxy_;
+  std::unique_ptr<blink::InputHandlerProxy> input_handler_proxy_;
 
   // The WidgetInputHandlerHost is bound on the compositor task runner
   // but class can be called on the compositor and main thread.
@@ -222,7 +235,10 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
   base::OnceClosure input_processed_callback_;
 
   // Whether this widget uses an InputHandler or forwards all input to the
-  // WebWidget (Popups, Plugins).
+  // WebWidget (Popups, Plugins). This is always true if we have a compositor
+  // thread; however, we can use an input handler if we don't have a compositor
+  // thread (e.g. in tests). Conversely, if we're not using an input handler,
+  // we definitely don't have a compositor thread.
   bool uses_input_handler_ = false;
 
   // State tracking which parts of the rendering pipeline are currently
@@ -246,8 +262,10 @@ class CONTENT_EXPORT WidgetInputHandlerManager final
 
   // Control of UMA. We emit one UMA metric per navigation telling us
   // whether any non-move input arrived before we starting updating the page or
-  // displaying content to the user.
-  bool have_emitted_uma_ = false;
+  // displaying content to the user. It must be atomic because navigation can
+  // occur on the renderer thread (resetting this) coincident with the UMA
+  // being sent on the compositor thread.
+  std::atomic<bool> have_emitted_uma_{false};
 
 #if defined(OS_ANDROID)
   std::unique_ptr<SynchronousCompositorProxyRegistry>
diff --git a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
index d4250987af2..efbe934eedb 100644
--- a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
+++ b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
@@ -9,7 +9,7 @@
 #include <utility>
 #include <vector>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
 #include "url/gurl.h"
@@ -31,18 +31,21 @@ class URLLoaderRelay : public network::mojom::URLLoaderClient,
         client_sink_(std::move(client_sink)) {}
 
   // network::mojom::URLLoader implementation:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_request_headers,
-                      const base::Optional<GURL>& new_url) override {
-    DCHECK(removed_headers.empty() && modified_request_headers.IsEmpty())
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_request_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_request_headers,
+      const base::Optional<GURL>& new_url) override {
+    DCHECK(removed_headers.empty() && modified_request_headers.IsEmpty() &&
+           modified_cors_exempt_request_headers.IsEmpty())
         << "Redirect with removed or modified headers was not supported yet. "
            "crbug.com/845683";
     DCHECK(!new_url.has_value())
         << "Redirect with modified URL was not supported yet. "
            "crbug.com/845683";
-    loader_sink_->FollowRedirect({} /* removed_headers */,
-                                 {} /* modified_headers */,
-                                 base::nullopt /* new_url */);
+    loader_sink_->FollowRedirect(
+        {} /* removed_headers */, {} /* modified_headers */,
+        {} /* modified_cors_exempt_headers */, base::nullopt /* new_url */);
   }
 
   void SetPriority(net::RequestPriority priority,
diff --git a/chromium/content/renderer/loader/request_extra_data.cc b/chromium/content/renderer/loader/request_extra_data.cc
index 690d8e9915e..90e0f6bc6a6 100644
--- a/chromium/content/renderer/loader/request_extra_data.cc
+++ b/chromium/content/renderer/loader/request_extra_data.cc
@@ -21,7 +21,7 @@ void RequestExtraData::CopyToResourceRequest(
   request->transition_type = transition_type_;
   request->originated_from_service_worker = originated_from_service_worker_;
 
-  request->attach_same_site_cookies = attach_same_site_cookies_;
+  request->force_ignore_site_for_cookies = force_ignore_site_for_cookies_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/loader/resource_dispatcher.cc b/chromium/content/renderer/loader/resource_dispatcher.cc
index 1e145c72e95..4f6b3a9ce1c 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher.cc
@@ -43,6 +43,7 @@
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/loader/resource_type_util.h"
 #include "third_party/blink/public/common/loader/throttling_url_loader.h"
 #include "third_party/blink/public/mojom/loader/resource_load_info.mojom-shared.h"
@@ -221,13 +222,18 @@ void ResourceDispatcher::OnReceivedRedirect(
                                     redirect_info.new_url);
 
   ToLocalURLResponseHead(*request_info, *response_head);
-  if (request_info->peer->OnReceivedRedirect(redirect_info,
-                                             response_head.Clone())) {
+  std::vector<std::string> removed_headers;
+  if (request_info->peer->OnReceivedRedirect(
+          redirect_info, response_head.Clone(), &removed_headers)) {
     // Double-check if the request is still around. The call above could
     // potentially remove it.
     request_info = GetPendingRequestInfo(request_id);
     if (!request_info)
       return;
+    // TODO(yoav): If request_info doesn't change above, we could avoid this
+    // copy.
+    request_info->removed_headers = removed_headers;
+
     request_info->response_url = redirect_info.new_url;
     request_info->has_pending_redirect = true;
     NotifyResourceRedirectReceived(request_info->render_frame_id,
@@ -252,8 +258,9 @@ void ResourceDispatcher::FollowPendingRedirect(
     if (request_info->redirect_requires_loader_restart) {
       request_info->url_loader->FollowRedirectForcingRestart();
     } else {
-      request_info->url_loader->FollowRedirect({} /* removed_headers */,
-                                               {} /* modified_headers */);
+      request_info->url_loader->FollowRedirect(
+          request_info->removed_headers, {} /* modified_headers */,
+          {} /* modified_cors_exempt_headers */);
     }
   }
 }
@@ -468,8 +475,9 @@ void ResourceDispatcher::StartSync(
 
   while (response->context_for_redirect) {
     DCHECK(response->redirect_info);
-    bool follow_redirect = peer->OnReceivedRedirect(*response->redirect_info,
-                                                    response->head.Clone());
+    bool follow_redirect = peer->OnReceivedRedirect(
+        *response->redirect_info, response->head.Clone(),
+        nullptr /* removed_headers */);
     redirect_or_response_event.Reset();
     if (follow_redirect) {
       task_runner->PostTask(
diff --git a/chromium/content/renderer/loader/resource_dispatcher.h b/chromium/content/renderer/loader/resource_dispatcher.h
index 1158c63433c..949cc1ecdfa 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.h
+++ b/chromium/content/renderer/loader/resource_dispatcher.h
@@ -213,6 +213,9 @@ class CONTENT_EXPORT ResourceDispatcher {
     // For mojo loading.
     std::unique_ptr<blink::ThrottlingURLLoader> url_loader;
     std::unique_ptr<URLLoaderClientImpl> url_loader_client;
+
+    // The Client Hints headers that need to be removed from a redirect.
+    std::vector<std::string> removed_headers;
   };
   using PendingRequestMap = std::map<int, std::unique_ptr<PendingRequestInfo>>;
 
diff --git a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
index eb5e8f042a5..12b48703417 100644
--- a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
@@ -200,7 +200,8 @@ class TestResourceDispatcherDelegate : public ResourceDispatcherDelegate {
     void OnUploadProgress(uint64_t position, uint64_t size) override {}
 
     bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                            network::mojom::URLResponseHeadPtr head) override {
+                            network::mojom::URLResponseHeadPtr head,
+                            std::vector<std::string>*) override {
       return false;
     }
 
diff --git a/chromium/content/renderer/loader/sync_load_context.cc b/chromium/content/renderer/loader/sync_load_context.cc
index 3145b378699..ba16da6106d 100644
--- a/chromium/content/renderer/loader/sync_load_context.cc
+++ b/chromium/content/renderer/loader/sync_load_context.cc
@@ -7,7 +7,7 @@
 #include <string>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/ptr_util.h"
 #include "base/optional.h"
 #include "base/synchronization/waitable_event.h"
@@ -18,6 +18,7 @@
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 
 namespace content {
@@ -149,8 +150,16 @@ void SyncLoadContext::OnUploadProgress(uint64_t position, uint64_t size) {}
 
 bool SyncLoadContext::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
   DCHECK(!Completed());
+  if (removed_headers) {
+    // TODO(yoav): Get the actual FeaturePolicy here to support selective
+    // removal for sync XHR.
+    blink::FindClientHintsToRemove(nullptr /* feature_policy */,
+                                   redirect_info.new_url, removed_headers);
+  }
+
   response_->url = redirect_info.new_url;
   response_->head = std::move(head);
   response_->redirect_info = redirect_info;
diff --git a/chromium/content/renderer/loader/sync_load_context.h b/chromium/content/renderer/loader/sync_load_context.h
index 0c82bdaf485..f7565e5dab0 100644
--- a/chromium/content/renderer/loader/sync_load_context.h
+++ b/chromium/content/renderer/loader/sync_load_context.h
@@ -90,7 +90,8 @@ class CONTENT_EXPORT SyncLoadContext : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
diff --git a/chromium/content/renderer/loader/test_request_peer.cc b/chromium/content/renderer/loader/test_request_peer.cc
index f345a4b32ec..d453d676626 100644
--- a/chromium/content/renderer/loader/test_request_peer.cc
+++ b/chromium/content/renderer/loader/test_request_peer.cc
@@ -24,7 +24,8 @@ void TestRequestPeer::OnUploadProgress(uint64_t position, uint64_t size) {
 
 bool TestRequestPeer::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>*) {
   EXPECT_FALSE(context_->cancelled);
   EXPECT_FALSE(context_->complete);
   ++context_->seen_redirects;
diff --git a/chromium/content/renderer/loader/test_request_peer.h b/chromium/content/renderer/loader/test_request_peer.h
index d61c1e8554c..f9a4f14488e 100644
--- a/chromium/content/renderer/loader/test_request_peer.h
+++ b/chromium/content/renderer/loader/test_request_peer.h
@@ -33,7 +33,8 @@ class TestRequestPeer : public RequestPeer {
 
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
diff --git a/chromium/content/renderer/loader/url_loader_client_impl.cc b/chromium/content/renderer/loader/url_loader_client_impl.cc
index 44fe52b2a8e..795d7d70312 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl.cc
@@ -9,6 +9,7 @@
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/feature_list.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -237,7 +238,12 @@ void URLLoaderClientImpl::Bind(
 
 void URLLoaderClientImpl::OnReceiveResponse(
     network::mojom::URLResponseHeadPtr response_head) {
+  TRACE_EVENT1("loading", "URLLoaderClientImpl::OnReceiveResponse", "url",
+               last_loaded_url_.possibly_invalid_spec());
+
   has_received_response_head_ = true;
+  on_receive_response_time_ = base::TimeTicks::Now();
+
   if (NeedsStoringMessage()) {
     StoreAndDispatch(
         std::make_unique<DeferredOnReceiveResponse>(std::move(response_head)));
@@ -309,6 +315,12 @@ void URLLoaderClientImpl::OnStartLoadingResponseBody(
   DCHECK(!has_received_response_body_);
   has_received_response_body_ = true;
 
+  if (!on_receive_response_time_.is_null()) {
+    UMA_HISTOGRAM_TIMES(
+        "Renderer.OnReceiveResponseToOnStartLoadingResponseBody",
+        base::TimeTicks::Now() - on_receive_response_time_);
+  }
+
   if (NeedsStoringMessage()) {
     StoreAndDispatch(
         std::make_unique<DeferredOnStartLoadingResponseBody>(std::move(body)));
diff --git a/chromium/content/renderer/loader/url_loader_client_impl.h b/chromium/content/renderer/loader/url_loader_client_impl.h
index b8498e181a6..6a3c19ce8a5 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl.h
+++ b/chromium/content/renderer/loader/url_loader_client_impl.h
@@ -7,9 +7,11 @@
 
 #include <stdint.h>
 #include <vector>
+
 #include "base/callback_forward.h"
-#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
+#include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -99,6 +101,9 @@ class CONTENT_EXPORT URLLoaderClientImpl final
   bool bypass_redirect_checks_ = false;
   GURL last_loaded_url_;
 
+  // For UMA.
+  base::TimeTicks on_receive_response_time_;
+
   mojo::Remote<network::mojom::URLLoader> url_loader_;
   mojo::Receiver<network::mojom::URLLoaderClient> url_loader_client_receiver_{
       this};
diff --git a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
index c14c92f7f70..0569dc79ee9 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
@@ -52,13 +52,8 @@ class URLLoaderClientImplTest : public ::testing::Test,
  protected:
   URLLoaderClientImplTest() : dispatcher_(new ResourceDispatcher()) {
     auto request = std::make_unique<network::ResourceRequest>();
-    // Set request context type to fetch so that ResourceDispatcher doesn't
-    // install MimeSniffingThrottle, which makes URLLoaderThrottleLoader
-    // defer the request.
-    request->fetch_request_context_type =
-        static_cast<int>(blink::mojom::RequestContextType::FETCH);
     request_id_ = dispatcher_->StartAsync(
-        std::move(request), 0,
+        std::move(request), 0 /* loader_option */,
         blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
         TRAFFIC_ANNOTATION_FOR_TESTS, false,
         std::make_unique<TestRequestPeer>(dispatcher_.get(),
diff --git a/chromium/content/renderer/loader/web_url_loader_impl.cc b/chromium/content/renderer/loader/web_url_loader_impl.cc
index b5a203b4b20..a506772220c 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl.cc
@@ -15,11 +15,12 @@
 #include "base/auto_reset.h"
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "base/optional.h"
 #include "base/sequence_checker.h"
 #include "base/single_thread_task_runner.h"
@@ -61,6 +62,7 @@
 #include "net/ssl/ssl_info.h"
 #include "services/network/public/cpp/http_raw_request_response_info.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/trust_tokens.mojom-shared.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/features.h"
@@ -304,7 +306,8 @@ bool IsBannedCrossSiteAuth(network::ResourceRequest* resource_request,
         extra_data->allow_cross_origin_auth_prompt();
   }
 
-  if (first_party.IsFirstParty(request_url)) {
+  if (first_party.IsFirstPartyWithSchemefulMode(
+          request_url, /*compute_schemefully=*/false)) {
     // If the first party is secure but the subresource is not, this is
     // mixed-content. Do not allow the image.
     if (!allow_cross_origin_auth_prompt &&
@@ -379,7 +382,8 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context> {
 
   void OnUploadProgress(uint64_t position, uint64_t size);
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head);
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>* removed_headers);
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head);
   void OnStartLoadingResponseBody(mojo::ScopedDataPipeConsumerHandle body);
   void OnTransferSizeUpdated(int transfer_size_diff);
@@ -443,7 +447,8 @@ class WebURLLoaderImpl::RequestPeerImpl : public RequestPeer {
   // RequestPeer methods:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override;
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>* removed_headers) override;
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
@@ -472,7 +477,8 @@ class WebURLLoaderImpl::SinkPeer : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override {}
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          network::mojom::URLResponseHeadPtr head) override {
+                          network::mojom::URLResponseHeadPtr head,
+                          std::vector<std::string>*) override {
     return true;
   }
   void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override {}
@@ -721,7 +727,8 @@ void WebURLLoaderImpl::Context::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::Context::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
   if (!client_)
     return false;
 
@@ -739,7 +746,7 @@ bool WebURLLoaderImpl::Context::OnReceivedRedirect(
       Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
           redirect_info.new_referrer_policy),
       WebString::FromUTF8(redirect_info.new_method), response,
-      report_raw_headers_);
+      report_raw_headers_, removed_headers);
 }
 
 void WebURLLoaderImpl::Context::OnReceivedResponse(
@@ -772,6 +779,10 @@ void WebURLLoaderImpl::Context::OnStartLoadingResponseBody(
     mojo::ScopedDataPipeConsumerHandle body) {
   if (client_)
     client_->DidStartLoadingResponseBody(std::move(body));
+
+  TRACE_EVENT_WITH_FLOW0(
+      "loading", "WebURLLoaderImpl::Context::OnStartLoadingResponseBody", this,
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 }
 
 void WebURLLoaderImpl::Context::OnTransferSizeUpdated(int transfer_size_diff) {
@@ -840,8 +851,10 @@ void WebURLLoaderImpl::RequestPeerImpl::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::RequestPeerImpl::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr head) {
-  return context_->OnReceivedRedirect(redirect_info, std::move(head));
+    network::mojom::URLResponseHeadPtr head,
+    std::vector<std::string>* removed_headers) {
+  return context_->OnReceivedRedirect(redirect_info, std::move(head),
+                                      removed_headers);
 }
 
 void WebURLLoaderImpl::RequestPeerImpl::OnReceivedResponse(
@@ -1021,6 +1034,19 @@ WebURLError WebURLLoaderImpl::PopulateURLError(
     return WebURLError(*status.blocked_by_response_reason,
                        status.resolve_error_info, has_copy_in_cache, url);
   }
+
+  if (status.trust_token_operation_status !=
+      network::mojom::TrustTokenOperationStatus::kOk) {
+    DCHECK(status.error_code == net::ERR_TRUST_TOKEN_OPERATION_CACHE_HIT ||
+           status.error_code == net::ERR_TRUST_TOKEN_OPERATION_FAILED)
+        << "Unexpected error code on Trust Token operation failure (or cache "
+           "hit): "
+        << status.error_code;
+
+    return WebURLError(status.error_code, status.trust_token_operation_status,
+                       url);
+  }
+
   return WebURLError(status.error_code, status.extended_error_code,
                      status.resolve_error_info, has_copy_in_cache,
                      WebURLError::IsWebSecurityViolation::kFalse, url);
diff --git a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
index 30a489e52c7..738a24488cb 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
@@ -195,7 +195,8 @@ class TestWebURLLoaderClient : public blink::WebURLLoaderClient {
                           network::mojom::ReferrerPolicy new_referrer_policy,
                           const blink::WebString& new_method,
                           const blink::WebURLResponse& passed_redirect_response,
-                          bool& report_raw_headers) override {
+                          bool& report_raw_headers,
+                          std::vector<std::string>*) override {
     EXPECT_TRUE(loader_);
 
     // No test currently simulates mutiple redirects.
@@ -326,8 +327,10 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_url = GURL(kTestURL);
     redirect_info.new_site_for_cookies =
         net::SiteForCookies::FromUrl(GURL(kTestURL));
+    std::vector<std::string> removed_headers;
     peer()->OnReceivedRedirect(redirect_info,
-                               network::mojom::URLResponseHead::New());
+                               network::mojom::URLResponseHead::New(),
+                               &removed_headers);
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
@@ -340,7 +343,7 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_site_for_cookies =
         net::SiteForCookies::FromUrl(GURL(kTestHTTPSURL));
     peer()->OnReceivedRedirect(redirect_info,
-                               network::mojom::URLResponseHead::New());
+                               network::mojom::URLResponseHead::New(), nullptr);
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
diff --git a/chromium/content/renderer/loader/web_url_request_util.cc b/chromium/content/renderer/loader/web_url_request_util.cc
index 828286ed859..3c58401723c 100644
--- a/chromium/content/renderer/loader/web_url_request_util.cc
+++ b/chromium/content/renderer/loader/web_url_request_util.cc
@@ -9,7 +9,8 @@
 
 #include <limits>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "content/child/child_thread_impl.h"
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
index 99607546cca..5e7b8b3b7e8 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
@@ -574,10 +574,6 @@ void WebWorkerFetchContextImpl::set_top_frame_origin(
   top_frame_origin_ = top_frame_origin;
 }
 
-void WebWorkerFetchContextImpl::set_origin_url(const GURL& origin_url) {
-  origin_url_ = origin_url;
-}
-
 void WebWorkerFetchContextImpl::set_client_id(const std::string& client_id) {
   client_id_ = client_id;
 }
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
index 3638f058d27..6d08e2d5be3 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "base/strings/string_piece.h"
 #include "base/synchronization/waitable_event.h"
 #include "content/common/child_process.mojom.h"
 #include "content/common/content_export.h"
@@ -162,9 +163,6 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   void set_site_for_cookies(const net::SiteForCookies& site_for_cookies);
   void set_top_frame_origin(const blink::WebSecurityOrigin& top_frame_origin);
 
-  // Sets whether the worker context is a secure context.
-  // https://w3c.github.io/webappsec-secure-contexts/
-  void set_origin_url(const GURL& origin_url);
   void set_client_id(const std::string& client_id);
 
   // PlzWorker with off-the-main-thread worker script fetch:
@@ -172,7 +170,7 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   void SetResponseOverrideForMainScript(
       std::unique_ptr<NavigationResponseOverrideParameters> response_override);
 
-  using RewriteURLFunction = blink::WebURL (*)(const std::string&, bool);
+  using RewriteURLFunction = blink::WebURL (*)(base::StringPiece, bool);
   static void InstallRewriteURLFunction(RewriteURLFunction rewrite_url);
 
   blink::WebString GetAcceptLanguages() const override;
@@ -334,7 +332,6 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   scoped_refptr<FrameRequestBlocker> frame_request_blocker_;
   net::SiteForCookies site_for_cookies_;
   base::Optional<url::Origin> top_frame_origin_;
-  GURL origin_url_;
 
   blink::mojom::RendererPreferences renderer_preferences_;
 
diff --git a/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc b/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
index 9a8609f919c..748ae92ffae 100644
--- a/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
+++ b/chromium/content/renderer/media/android/flinging_renderer_client_factory.cc
@@ -8,7 +8,7 @@
 #include <string>
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/media/android/flinging_renderer_client.h"
 #include "media/mojo/clients/mojo_renderer.h"
 #include "media/mojo/clients/mojo_renderer_factory.h"
diff --git a/chromium/content/renderer/media/android/media_player_renderer_client.cc b/chromium/content/renderer/media/android/media_player_renderer_client.cc
index 4e59230f922..fc95fdf46cc 100644
--- a/chromium/content/renderer/media/android/media_player_renderer_client.cc
+++ b/chromium/content/renderer/media/android/media_player_renderer_client.cc
@@ -55,17 +55,13 @@ void MediaPlayerRendererClient::Initialize(
   client_ = client;
   init_cb_ = std::move(init_cb);
 
-  // Initialize the StreamTexture using a 1x1 texture because we do not have
-  // any size information from the MediaPlayer yet.
-  // The size will be automatically updated in OnVideoNaturalSizeChange() once
-  // we parse the media's metadata.
   // Unretained is safe here because |stream_texture_wrapper_| resets the
   // Closure it has before destroying itself on |compositor_task_runner_|,
   // and |this| is garanteed to live until the Closure has been reset.
   stream_texture_wrapper_->Initialize(
       base::BindRepeating(&MediaPlayerRendererClient::OnFrameAvailable,
                           base::Unretained(this)),
-      gfx::Size(1, 1), compositor_task_runner_,
+      compositor_task_runner_,
       base::BindOnce(
           &MediaPlayerRendererClient::OnStreamTextureWrapperInitialized,
           weak_factory_.GetWeakPtr(), media_resource));
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.cc b/chromium/content/renderer/media/android/stream_texture_factory.cc
index 4612a3c21cb..e180ab95ee9 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.cc
+++ b/chromium/content/renderer/media/android/stream_texture_factory.cc
@@ -23,12 +23,12 @@ void StreamTextureProxy::Release() {
   ClearReceivedFrameCB();
 
   // |this| can be deleted by the |task_runner_| on the compositor thread by
-  // posting task to that thread. So we need to clear the |set_ycbcr_info_cb_|
-  // here first so that its not called on the compositor thread before |this| is
-  // deleted. The problem is that |set_ycbcr_info_cb_| is provided by the owner
-  // of StreamTextureProxy, which is being destroyed and is releasing
-  // StreamTextureProxy.
-  ClearSetYcbcrInfoCB();
+  // posting task to that thread. So we need to clear the
+  // |create_video_frame_cb_| here first so that its not called on the
+  // compositor thread before |this| is deleted. The problem is that
+  // |create_video_frame_cb_| is provided by the owner of StreamTextureProxy,
+  // which is being destroyed and is releasing StreamTextureProxy.
+  ClearCreateVideoFrameCB();
 
   // Release is analogous to the destructor, so there should be no more external
   // calls to this object in Release. Therefore there is no need to acquire the
@@ -44,14 +44,14 @@ void StreamTextureProxy::ClearReceivedFrameCB() {
   received_frame_cb_.Reset();
 }
 
-void StreamTextureProxy::ClearSetYcbcrInfoCB() {
+void StreamTextureProxy::ClearCreateVideoFrameCB() {
   base::AutoLock lock(lock_);
-  set_ycbcr_info_cb_.Reset();
+  create_video_frame_cb_.Reset();
 }
 
 void StreamTextureProxy::BindToTaskRunner(
     const base::RepeatingClosure& received_frame_cb,
-    SetYcbcrInfoCb set_ycbcr_info_cb,
+    const CreateVideoFrameCB& create_video_frame_cb,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   DCHECK(task_runner.get());
 
@@ -60,7 +60,7 @@ void StreamTextureProxy::BindToTaskRunner(
     DCHECK(!task_runner_.get() || (task_runner.get() == task_runner_.get()));
     task_runner_ = task_runner;
     received_frame_cb_ = received_frame_cb;
-    set_ycbcr_info_cb_ = std::move(set_ycbcr_info_cb);
+    create_video_frame_cb_ = create_video_frame_cb;
   }
 
   if (task_runner->BelongsToCurrentThread()) {
@@ -84,13 +84,16 @@ void StreamTextureProxy::OnFrameAvailable() {
     received_frame_cb_.Run();
 }
 
-void StreamTextureProxy::OnFrameWithYcbcrInfoAvailable(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+void StreamTextureProxy::OnFrameWithInfoAvailable(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
   base::AutoLock lock(lock_);
   // Set the ycbcr info before running the received frame callback so that the
   // first frame has it.
-  if (!set_ycbcr_info_cb_.is_null())
-    std::move(set_ycbcr_info_cb_).Run(std::move(ycbcr_info));
+  if (!create_video_frame_cb_.is_null())
+    create_video_frame_cb_.Run(mailbox, coded_size, visible_rect, ycbcr_info);
   if (!received_frame_cb_.is_null())
     received_frame_cb_.Run();
 }
@@ -100,14 +103,8 @@ void StreamTextureProxy::ForwardStreamTextureForSurfaceRequest(
   host_->ForwardStreamTextureForSurfaceRequest(request_token);
 }
 
-void StreamTextureProxy::CreateSharedImage(
-    const gfx::Size& size,
-    gpu::Mailbox* mailbox,
-    gpu::SyncToken* unverified_sync_token) {
-  *mailbox = host_->CreateSharedImage(size);
-  if (mailbox->IsZero())
-    return;
-  *unverified_sync_token = host_->GenUnverifiedSyncToken();
+void StreamTextureProxy::UpdateRotatedVisibleSize(const gfx::Size& size) {
+  host_->UpdateRotatedVisibleSize(size);
 }
 
 // static
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.h b/chromium/content/renderer/media/android/stream_texture_factory.h
index c2f1b0a534a..28bffd74185 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.h
+++ b/chromium/content/renderer/media/android/stream_texture_factory.h
@@ -17,13 +17,13 @@
 #include "content/common/content_export.h"
 #include "content/renderer/stream_texture_host_android.h"
 #include "gpu/command_buffer/common/mailbox.h"
+#include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace gpu {
 class ClientSharedImageInterface;
 class GpuChannelHost;
 class SharedImageInterface;
-struct SyncToken;
 struct VulkanYCbCrInfo;
 }  // namespace gpu
 
@@ -35,8 +35,11 @@ class StreamTextureFactory;
 // when a new video frame is available.
 class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
  public:
-  using SetYcbcrInfoCb =
-      base::OnceCallback<void(base::Optional<gpu::VulkanYCbCrInfo>)>;
+  using CreateVideoFrameCB = base::RepeatingCallback<void(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>&)>;
 
   ~StreamTextureProxy() override;
 
@@ -45,13 +48,16 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   // must be called with the same |task_runner| every time.
   void BindToTaskRunner(
       const base::RepeatingClosure& received_frame_cb,
-      SetYcbcrInfoCb set_ycbcr_info_cb,
+      const CreateVideoFrameCB& create_video_frame_cb,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   // StreamTextureHost::Listener implementation:
   void OnFrameAvailable() override;
-  void OnFrameWithYcbcrInfoAvailable(
-      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) override;
+  void OnFrameWithInfoAvailable(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) override;
 
   // Sends an IPC to the GPU process.
   // Asks the StreamTexture to forward its SurfaceTexture to the
@@ -59,14 +65,9 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   void ForwardStreamTextureForSurfaceRequest(
       const base::UnguessableToken& request_token);
 
-  // Creates a SharedImage for the provided texture size. Returns the
-  // |mailbox| for the SharedImage, as well as an |unverified_sync_token|
-  // representing SharedImage creation.
-  // If creation fails, returns an empty |mailbox| and does not modify
-  // |unverified_sync_token|.
-  void CreateSharedImage(const gfx::Size& size,
-                         gpu::Mailbox* mailbox,
-                         gpu::SyncToken* unverified_sync_token);
+  // Notifies StreamTexture that video size has been changed and so it can
+  // recreate shared image.
+  void UpdateRotatedVisibleSize(const gfx::Size& size);
 
   // Clears |received_frame_cb_| in a thread safe way.
   void ClearReceivedFrameCB();
@@ -82,15 +83,15 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   void BindOnThread();
   void Release();
 
-  // Clears |set_ycbcr_info_cb_| in a thread safe way.
-  void ClearSetYcbcrInfoCB();
+  // Clears |create_video_frame_cb_| in a thread safe way.
+  void ClearCreateVideoFrameCB();
 
   const std::unique_ptr<StreamTextureHost> host_;
 
   // Protects access to |received_frame_cb_| and |task_runner_|.
   base::Lock lock_;
   base::RepeatingClosure received_frame_cb_;
-  SetYcbcrInfoCb set_ycbcr_info_cb_;
+  CreateVideoFrameCB create_video_frame_cb_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StreamTextureProxy);
@@ -101,7 +102,7 @@ typedef std::unique_ptr<StreamTextureProxy, StreamTextureProxy::Deleter>
 
 // Factory class for managing stream textures.
 class CONTENT_EXPORT StreamTextureFactory
-    : public base::RefCounted<StreamTextureFactory> {
+    : public base::RefCountedThreadSafe<StreamTextureFactory> {
  public:
   static scoped_refptr<StreamTextureFactory> Create(
       scoped_refptr<gpu::GpuChannelHost> channel);
@@ -118,7 +119,7 @@ class CONTENT_EXPORT StreamTextureFactory
   gpu::SharedImageInterface* SharedImageInterface();
 
  private:
-  friend class base::RefCounted<StreamTextureFactory>;
+  friend class base::RefCountedThreadSafe<StreamTextureFactory>;
   StreamTextureFactory(scoped_refptr<gpu::GpuChannelHost> channel);
   ~StreamTextureFactory();
   // Creates a gpu::StreamTexture and returns its id.
diff --git a/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc b/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
index b6cb3b4cc6f..74e03d6f4d2 100644
--- a/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
+++ b/chromium/content/renderer/media/android/stream_texture_proxy_unittest.cc
@@ -63,18 +63,17 @@ class StreamTextureProxyTest : public testing::Test {
   scoped_refptr<TestGpuChannelHost> channel_;
 };
 
-// This test is to make sure CreateSharedImage() do not crash even if
+// This test is to make sure UpdateRotatedVisibleSize() do not crash even if
 // StreamTextureHost's |channel_| is null.
 TEST_F(StreamTextureProxyTest,
-       CreateSharedImageDoesNotCrashWithNullGpuChannelHost) {
+       UpdateRotatedVisibleSizeDoesNotCrashWithNullGpuChannelHost) {
   auto proxy = CreateProxyWithNullGpuChannelHost();
   gpu::Mailbox mailbox;
   gpu::SyncToken texture_mailbox_sync_token;
 
   // This method should not crash even if the StreamTextureHost's |channel_| is
   // null.
-  proxy->CreateSharedImage(gfx::Size(1, 1), &mailbox,
-                           &texture_mailbox_sync_token);
+  proxy->UpdateRotatedVisibleSize(gfx::Size(1, 1));
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
index 781a32571bc..a02c70aac50 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
@@ -51,17 +51,16 @@ scoped_refptr<media::VideoFrame> StreamTextureWrapperImpl::GetCurrentFrame() {
   return current_frame_;
 }
 
-void StreamTextureWrapperImpl::ReallocateVideoFrame() {
-  DVLOG(2) << __func__;
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-
-  gpu::Mailbox mailbox;
-  gpu::SyncToken texture_mailbox_sync_token;
-  stream_texture_proxy_->CreateSharedImage(natural_size_, &mailbox,
-                                           &texture_mailbox_sync_token);
+void StreamTextureWrapperImpl::CreateVideoFrame(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
+  // This message comes from GPU process when the SharedImage is already
+  // created, so we don't need to wait on any synctoken, mailbox is ready to
+  // use.
   gpu::MailboxHolder holders[media::VideoFrame::kMaxPlanes] = {
-      gpu::MailboxHolder(mailbox, texture_mailbox_sync_token,
-                         GL_TEXTURE_EXTERNAL_OES)};
+      gpu::MailboxHolder(mailbox, gpu::SyncToken(), GL_TEXTURE_EXTERNAL_OES)};
 
   // The pixel format doesn't matter here as long as it's valid for texture
   // frames. But SkiaRenderer wants to ensure that the format of the resource
@@ -73,11 +72,11 @@ void StreamTextureWrapperImpl::ReallocateVideoFrame() {
   scoped_refptr<media::VideoFrame> new_frame =
       media::VideoFrame::WrapNativeTextures(
           media::PIXEL_FORMAT_ABGR, holders,
-          media::BindToCurrentLoop(
+          media::BindToLoop(
+              main_task_runner_,
               base::BindOnce(&OnReleaseVideoFrame, factory_, mailbox)),
-          natural_size_, gfx::Rect(natural_size_), natural_size_,
-          base::TimeDelta());
-  new_frame->set_ycbcr_info(ycbcr_info_);
+          coded_size, visible_rect, visible_rect.size(), base::TimeDelta());
+  new_frame->set_ycbcr_info(ycbcr_info);
 
   if (enable_texture_copy_) {
     new_frame->metadata()->SetBoolean(media::VideoFrameMetadata::COPY_REQUIRED,
@@ -104,14 +103,6 @@ void StreamTextureWrapperImpl::SetCurrentFrameInternal(
   current_frame_ = std::move(video_frame);
 }
 
-void StreamTextureWrapperImpl::SetYcbcrInfo(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
-  DCHECK(!ycbcr_info_);
-
-  current_frame_->set_ycbcr_info(ycbcr_info);
-  ycbcr_info_ = std::move(ycbcr_info);
-}
-
 void StreamTextureWrapperImpl::UpdateTextureSize(const gfx::Size& new_size) {
   DVLOG(2) << __func__;
 
@@ -126,22 +117,20 @@ void StreamTextureWrapperImpl::UpdateTextureSize(const gfx::Size& new_size) {
   if (!stream_texture_proxy_)
     return;
 
-  if (natural_size_ == new_size)
+  if (rotated_visible_size_ == new_size)
     return;
 
-  natural_size_ = new_size;
-  ReallocateVideoFrame();
+  rotated_visible_size_ = new_size;
+  stream_texture_proxy_->UpdateRotatedVisibleSize(rotated_visible_size_);
 }
 
 void StreamTextureWrapperImpl::Initialize(
     const base::RepeatingClosure& received_frame_cb,
-    const gfx::Size& natural_size,
     scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner,
     StreamTextureWrapperInitCB init_cb) {
   DVLOG(2) << __func__;
 
   compositor_task_runner_ = compositor_task_runner;
-  natural_size_ = natural_size;
 
   main_task_runner_->PostTask(
       FROM_HERE,
@@ -169,15 +158,13 @@ void StreamTextureWrapperImpl::InitializeOnMainThread(
     return;
   }
 
-  ReallocateVideoFrame();
-
   // Unretained is safe here since |stream_texture_proxy_| is a scoped member of
   // the this StreamTextureWrapperImpl class which clears/resets this callback
   // before |this| is destroyed.
   stream_texture_proxy_->BindToTaskRunner(
       received_frame_cb,
-      base::BindOnce(&StreamTextureWrapperImpl::SetYcbcrInfo,
-                     base::Unretained(this)),
+      base::BindRepeating(&StreamTextureWrapperImpl::CreateVideoFrame,
+                          base::Unretained(this)),
       compositor_task_runner_);
 
   std::move(init_cb).Run(true);
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
index f200d9ff094..87735abffa4 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
@@ -63,13 +63,12 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
   //     DidReceiveFrame() method.
   void Initialize(
       const base::RepeatingClosure& received_frame_cb,
-      const gfx::Size& natural_size,
       scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner,
       StreamTextureWrapperInitCB init_cb) override;
 
   // Should be called when the Video size changes.
   // Can be called from any thread, but runs on |main_task_runner_|.
-  void UpdateTextureSize(const gfx::Size& natural_size) override;
+  void UpdateTextureSize(const gfx::Size& rotated_visible_size) override;
 
   // Returns the latest frame.
   // N.B: We create a single VideoFrame at initialization time (and update it
@@ -101,30 +100,26 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
   void InitializeOnMainThread(const base::RepeatingClosure& received_frame_cb,
                               StreamTextureWrapperInitCB init_cb);
 
-  void ReallocateVideoFrame();
+  void CreateVideoFrame(const gpu::Mailbox& mailbox,
+                        const gfx::Size& coded_size,
+                        const gfx::Rect& visible_rect,
+                        const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info);
 
   void SetCurrentFrameInternal(scoped_refptr<media::VideoFrame> video_frame);
 
-  // Sets the ycbcr_info on the |current_frame_|. This is called before the
-  // first frame becomes available, at which point no frames are in use, so
-  // modification of the frame is safe. The same info is re-used for all future
-  // frames.
-  void SetYcbcrInfo(base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
-
   bool enable_texture_copy_;
 
   // Object for calling back the compositor thread to repaint the video when a
   // frame is available. It should be bound to |compositor_task_runner_|.
   ScopedStreamTextureProxy stream_texture_proxy_;
 
-  // Size of the video frames.
-  gfx::Size natural_size_;
+  // Visible size of the video with rotation applied.
+  gfx::Size rotated_visible_size_;
 
   scoped_refptr<StreamTextureFactory> factory_;
 
   base::Lock current_frame_lock_;
   scoped_refptr<media::VideoFrame> current_frame_;
-  base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info_;
 
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner_;
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc b/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
index 8cb8fc07646..398974fd01d 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl_unittest.cc
@@ -35,9 +35,9 @@ TEST_F(StreamTextureWrapperImplTest, ConstructionDestruction_ShouldSucceed) {
   // we try to initialize it.
   int result = 0;
   stream_texture_wrapper->Initialize(
-      base::DoNothing(), gfx::Size(0, 0),
+      base::DoNothing(),
       blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
-      base::BindRepeating(
+      base::BindOnce(
           [](int* result_out, bool result) { *result_out = result ? 1 : 2; },
           &result));
   base::RunLoop().RunUntilIdle();
diff --git a/chromium/content/renderer/media/audio/audio_device_factory.cc b/chromium/content/renderer/media/audio/audio_device_factory.cc
index be4148045ef..2a5d45c9e1f 100644
--- a/chromium/content/renderer/media/audio/audio_device_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_device_factory.cc
@@ -7,9 +7,10 @@
 #include <algorithm>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
+#include "base/notreached.h"
 #include "base/task/post_task.h"
 #include "base/task/thread_pool.h"
 #include "base/threading/platform_thread.h"
diff --git a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
index 4b49ebecb60..f5cc6d7f1b4 100644
--- a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/sequenced_task_runner.h"
 #include "base/single_thread_task_runner.h"
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
@@ -16,7 +16,6 @@
 #include "content/renderer/render_frame_impl.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
 namespace content {
@@ -27,22 +26,14 @@ void CreateMojoAudioInputStreamOnMainThread(
     int frame_id,
     const media::AudioSourceParameters& source_params,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(frame_id);
   if (frame) {
-    audio::mojom::AudioProcessingConfigPtr processing_config;
-    if (source_params.processing) {
-      processing_config = audio::mojom::AudioProcessingConfig::New(
-          std::move(controls_receiver), source_params.processing->id,
-          source_params.processing->settings);
-    }
     frame->GetAudioInputStreamFactory()->CreateStream(
         std::move(client), source_params.session_id, params,
-        automatic_gain_control, total_segments, std::move(processing_config));
+        automatic_gain_control, total_segments);
   }
 }
 
@@ -51,16 +42,14 @@ void CreateMojoAudioInputStream(
     int frame_id,
     const media::AudioSourceParameters& source_params,
     mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
   main_task_runner->PostTask(
-      FROM_HERE, base::BindOnce(&CreateMojoAudioInputStreamOnMainThread,
-                                frame_id, source_params, std::move(client),
-                                std::move(controls_receiver), params,
-                                automatic_gain_control, total_segments));
+      FROM_HERE,
+      base::BindOnce(&CreateMojoAudioInputStreamOnMainThread, frame_id,
+                     source_params, std::move(client), params,
+                     automatic_gain_control, total_segments));
 }
 
 void AssociateInputAndOutputForAec(
diff --git a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
index 3db25eea212..072201d3761 100644
--- a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/single_thread_task_runner.h"
 #include "content/renderer/media/audio/mojo_audio_output_ipc.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
diff --git a/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc b/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
index 0a2874ca7ef..e419f90b3ba 100644
--- a/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
+++ b/chromium/content/renderer/media/audio/audio_renderer_mixer_manager_unittest.cc
@@ -8,9 +8,9 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
 #include "media/audio/audio_device_description.h"
diff --git a/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc b/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
index 15a735b3e15..f2e459ff715 100644
--- a/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
+++ b/chromium/content/renderer/media/audio/audio_renderer_sink_cache_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "media/audio/audio_device_description.h"
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
index ec5afced2f4..450acb418f5 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
@@ -44,12 +44,7 @@ void MojoAudioInputIPC::CreateStream(media::AudioInputIPCDelegate* delegate,
   factory_client_receiver_.set_disconnect_handler(base::BindOnce(
       &media::AudioInputIPCDelegate::OnError, base::Unretained(delegate_)));
 
-  stream_creation_start_time_ = base::TimeTicks::Now();
-  mojo::PendingReceiver<audio::mojom::AudioProcessorControls> controls_receiver;
-  if (source_params_.processing.has_value())
-    controls_receiver = processor_controls_.BindNewPipeAndPassReceiver();
-  stream_creator_.Run(source_params_, std::move(client),
-                      std::move(controls_receiver), params,
+  stream_creator_.Run(source_params_, std::move(client), params,
                       automatic_gain_control, total_segments);
 }
 
@@ -74,35 +69,12 @@ void MojoAudioInputIPC::SetOutputDeviceForAec(
     stream_associator_.Run(*stream_id_, output_device_id);
 }
 
-media::AudioProcessorControls* MojoAudioInputIPC::GetProcessorControls() {
-  return processor_controls_ ? this : nullptr;
-}
-
 void MojoAudioInputIPC::CloseStream() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   delegate_ = nullptr;
   factory_client_receiver_.reset();
   stream_client_receiver_.reset();
   stream_.reset();
-  processor_controls_.reset();
-}
-
-void MojoAudioInputIPC::GetStats(GetStatsCB callback) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->GetStats(std::move(callback));
-}
-
-void MojoAudioInputIPC::StartEchoCancellationDump(base::File file) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->StartEchoCancellationDump(std::move(file));
-}
-
-void MojoAudioInputIPC::StopEchoCancellationDump() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (processor_controls_)
-    processor_controls_->StopEchoCancellationDump();
 }
 
 void MojoAudioInputIPC::StreamCreated(
@@ -117,9 +89,6 @@ void MojoAudioInputIPC::StreamCreated(
   DCHECK(!stream_);
   DCHECK(!stream_client_receiver_.is_bound());
 
-  UMA_HISTOGRAM_TIMES("Media.Audio.Render.InputDeviceStreamCreationTime",
-                      base::TimeTicks::Now() - stream_creation_start_time_);
-
   stream_.Bind(std::move(stream));
   stream_client_receiver_.Bind(std::move(stream_client_receiver));
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
index b55a073beec..58efe08d0bc 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
@@ -22,7 +22,6 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace content {
 
@@ -31,7 +30,6 @@ namespace content {
 // thread.
 class CONTENT_EXPORT MojoAudioInputIPC
     : public media::AudioInputIPC,
-      public media::AudioProcessorControls,
       public mojom::RendererAudioInputStreamFactoryClient,
       public media::mojom::AudioInputStreamClient {
  public:
@@ -41,8 +39,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
   using StreamCreatorCB = base::RepeatingCallback<void(
       const media::AudioSourceParameters& source_params,
       mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
-      mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-          controls_receiver,
       const media::AudioParameters& params,
       bool automatic_gain_control,
       uint32_t total_segments)>;
@@ -65,14 +61,8 @@ class CONTENT_EXPORT MojoAudioInputIPC
   void RecordStream() override;
   void SetVolume(double volume) override;
   void SetOutputDeviceForAec(const std::string& output_device_id) override;
-  AudioProcessorControls* GetProcessorControls() override;
   void CloseStream() override;
 
-  // AudioProcessorControls implementation
-  void GetStats(GetStatsCB callback) override;
-  void StartEchoCancellationDump(base::File file) override;
-  void StopEchoCancellationDump() override;
-
  private:
   void StreamCreated(
       mojo::PendingRemote<media::mojom::AudioInputStream> stream,
@@ -92,7 +82,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
   StreamAssociatorCB stream_associator_;
 
   mojo::Remote<media::mojom::AudioInputStream> stream_;
-  mojo::Remote<audio::mojom::AudioProcessorControls> processor_controls_;
   // Initialized on StreamCreated.
   base::Optional<base::UnguessableToken> stream_id_;
   mojo::Receiver<AudioInputStreamClient> stream_client_receiver_{this};
@@ -100,8 +89,6 @@ class CONTENT_EXPORT MojoAudioInputIPC
       factory_client_receiver_{this};
   media::AudioInputIPCDelegate* delegate_ = nullptr;
 
-  base::TimeTicks stream_creation_start_time_;
-
   base::WeakPtrFactory<MojoAudioInputIPC> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(MojoAudioInputIPC);
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
index cdceed092f6..22681946813 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
@@ -85,8 +85,6 @@ class FakeStreamCreator {
   void Create(const media::AudioSourceParameters& source_params,
               mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
                   factory_client,
-              mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-                  controls_receiver,
               const media::AudioParameters& params,
               bool automatic_gain_control,
               uint32_t total_segments) {
@@ -173,8 +171,6 @@ TEST(MojoAudioInputIPC, FactoryDisconnected_SendsError) {
           [](const media::AudioSourceParameters&,
              mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
                  factory_client,
-             mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
-                 controls_receiver,
              const media::AudioParameters& params, bool automatic_gain_control,
              uint32_t total_segments) {}),
       base::BindRepeating(&AssociateOutputForAec));
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
index fe1e35db5eb..73611d345aa 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
@@ -83,7 +83,6 @@ void MojoAudioOutputIPC::CreateStream(
   DCHECK_EQ(delegate_, delegate);
   // Since the creation callback won't fire if the provider receiver is gone
   // and |this| owns |stream_provider_|, unretained is safe.
-  stream_creation_start_time_ = base::TimeTicks::Now();
   mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
       client_remote;
   receiver_.Bind(client_remote.InitWithNewPipeAndPassReceiver());
@@ -91,7 +90,7 @@ void MojoAudioOutputIPC::CreateStream(
   receiver_.set_disconnect_with_reason_handler(
       base::BindOnce(&MojoAudioOutputIPC::ProviderClientBindingDisconnected,
                      base::Unretained(this)));
-  stream_provider_->Acquire(params, std::move(client_remote), processing_id);
+  stream_provider_->Acquire(params, std::move(client_remote));
 }
 
 void MojoAudioOutputIPC::PlayStream() {
@@ -231,8 +230,6 @@ void MojoAudioOutputIPC::Created(
   DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
 
-  UMA_HISTOGRAM_TIMES("Media.Audio.Render.OutputDeviceStreamCreationTime",
-                      base::TimeTicks::Now() - stream_creation_start_time_);
   stream_.reset();
   stream_.Bind(std::move(pending_stream));
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
index 6a957c553f4..52fb420b9eb 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
@@ -101,8 +101,6 @@ class CONTENT_EXPORT MojoAudioOutputIPC
   media::AudioOutputIPCDelegate* delegate_ = nullptr;
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
-  base::TimeTicks stream_creation_start_time_;
-
   // To make sure we don't send an "authorization completed" callback for a
   // stream after it's closed, we use this weak factory.
   base::WeakPtrFactory<MojoAudioOutputIPC> weak_factory_{this};
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
index 796eb40dd38..4c08247893b 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
@@ -63,8 +63,7 @@ class TestStreamProvider : public media::mojom::AudioOutputStreamProvider {
   void Acquire(
       const media::AudioParameters& params,
       mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
-          pending_provider_client,
-      const base::Optional<base::UnguessableToken>& processing_id) override {
+          pending_provider_client) override {
     EXPECT_EQ(receiver_, base::nullopt);
     EXPECT_NE(stream_, nullptr);
     provider_client_.reset();
diff --git a/chromium/content/renderer/media/audio_decoder.cc b/chromium/content/renderer/media/audio_decoder.cc
index bb90a36a243..077d1b5e0fc 100644
--- a/chromium/content/renderer/media/audio_decoder.cc
+++ b/chromium/content/renderer/media/audio_decoder.cc
@@ -8,6 +8,7 @@
 
 #include <vector>
 
+#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/time/time.h"
 #include "media/base/audio_bus.h"
diff --git a/chromium/content/renderer/media/batching_media_log.cc b/chromium/content/renderer/media/batching_media_log.cc
index eadbd33807b..a1a101687cc 100644
--- a/chromium/content/renderer/media/batching_media_log.cc
+++ b/chromium/content/renderer/media/batching_media_log.cc
@@ -53,10 +53,10 @@ namespace content {
 BatchingMediaLog::BatchingMediaLog(
     const GURL& security_origin,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-    std::unique_ptr<EventHandler> event_handler)
+    std::vector<std::unique_ptr<EventHandler>> event_handlers)
     : security_origin_(security_origin),
       task_runner_(std::move(task_runner)),
-      event_handler_(std::move(event_handler)),
+      event_handlers_(std::move(event_handlers)),
       tick_clock_(base::DefaultTickClock::GetInstance()),
       last_ipc_send_time_(tick_clock_->NowTicks()),
       ipc_send_pending_(false) {
@@ -81,7 +81,8 @@ BatchingMediaLog::~BatchingMediaLog() {
 }
 
 void BatchingMediaLog::OnWebMediaPlayerDestroyedLocked() {
-  event_handler_->OnWebMediaPlayerDestroyed();
+  for (const auto& handler : event_handlers_)
+    handler->OnWebMediaPlayerDestroyed();
 }
 
 void BatchingMediaLog::AddLogRecordLocked(
@@ -182,7 +183,7 @@ std::string BatchingMediaLog::MediaEventToMessageString(
           static_cast<media::PipelineStatus>(error_code));
     }
     case media::MediaLogRecord::Type::kMessage: {
-      std::string result = "";
+      std::string result;
       if (event.params.GetString(
               MediaLogMessageLevelToString(media::MediaLogMessageLevel::kERROR),
               &result)) {
@@ -217,7 +218,8 @@ void BatchingMediaLog::SendQueuedMediaEvents() {
   if (events_to_send.empty())
     return;
 
-  event_handler_->SendQueuedMediaEvents(std::move(events_to_send));
+  for (const auto& handler : event_handlers_)
+    handler->SendQueuedMediaEvents(events_to_send);
 }
 
 void BatchingMediaLog::SetTickClockForTesting(
diff --git a/chromium/content/renderer/media/batching_media_log.h b/chromium/content/renderer/media/batching_media_log.h
index 57a226c86b5..32e2bbb87ec 100644
--- a/chromium/content/renderer/media/batching_media_log.h
+++ b/chromium/content/renderer/media/batching_media_log.h
@@ -40,7 +40,7 @@ class CONTENT_EXPORT BatchingMediaLog : public media::MediaLog {
 
   BatchingMediaLog(const GURL& security_origin,
                    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
-                   std::unique_ptr<EventHandler> impl);
+                   std::vector<std::unique_ptr<EventHandler>> impl);
   ~BatchingMediaLog() override;
 
   // Will reset |last_ipc_send_time_| with the value of NowTicks().
@@ -66,7 +66,7 @@ class CONTENT_EXPORT BatchingMediaLog : public media::MediaLog {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   // impl for sending queued events.
-  std::unique_ptr<EventHandler> event_handler_;
+  std::vector<std::unique_ptr<EventHandler>> event_handlers_;
 
   // |lock_| protects access to all of the following member variables.  It
   // allows any render process thread to AddEvent(), while preserving their
diff --git a/chromium/content/renderer/media/batching_media_log_unittest.cc b/chromium/content/renderer/media/batching_media_log_unittest.cc
index 52bf499f90f..ccd285a3c04 100644
--- a/chromium/content/renderer/media/batching_media_log_unittest.cc
+++ b/chromium/content/renderer/media/batching_media_log_unittest.cc
@@ -25,6 +25,13 @@ class TestEventHandler : public BatchingMediaLog::EventHandler {
       std::vector<media::MediaLogRecord> events) override;
   void OnWebMediaPlayerDestroyed() override;
 
+  static std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> Create(
+      BatchingMediaLogTest* ptr) {
+    std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> move_me;
+    move_me.push_back(std::make_unique<TestEventHandler>(ptr));
+    return move_me;
+  }
+
  private:
   BatchingMediaLogTest* test_cls_;
 };
@@ -35,7 +42,7 @@ class BatchingMediaLogTest : public testing::Test {
       : task_runner_(new base::TestMockTimeTaskRunner()),
         log_(GURL("http://foo.com"),
              task_runner_,
-             std::make_unique<TestEventHandler>(this)) {
+             TestEventHandler::Create(this)) {
     log_.SetTickClockForTesting(&tick_clock_);
   }
 
diff --git a/chromium/content/renderer/media/inspector_media_event_handler.cc b/chromium/content/renderer/media/inspector_media_event_handler.cc
index d9bffa83193..1d3a59348a4 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler.cc
@@ -22,6 +22,21 @@ blink::WebString ToString(const base::Value& value) {
   return blink::WebString::FromUTF8(output_str);
 }
 
+// TODO(tmathmeyer) stop using a string here eventually. This means rewriting
+// the MediaLogRecord mojom interface.
+blink::InspectorPlayerMessage::Level LevelFromString(const std::string& level) {
+  if (level == "error")
+    return blink::InspectorPlayerMessage::Level::kError;
+  if (level == "warning")
+    return blink::InspectorPlayerMessage::Level::kWarning;
+  if (level == "info")
+    return blink::InspectorPlayerMessage::Level::kInfo;
+  if (level == "debug")
+    return blink::InspectorPlayerMessage::Level::kDebug;
+  NOTREACHED();
+  return blink::InspectorPlayerMessage::Level::kError;
+}
+
 }  // namespace
 
 InspectorMediaEventHandler::InspectorMediaEventHandler(
@@ -38,17 +53,19 @@ void InspectorMediaEventHandler::SendQueuedMediaEvents(
   if (video_player_destroyed_)
     return;
 
-  blink::InspectorPlayerEvents events;
   blink::InspectorPlayerProperties properties;
+  blink::InspectorPlayerMessages messages;
+  blink::InspectorPlayerEvents events;
+  blink::InspectorPlayerErrors errors;
 
   for (media::MediaLogRecord event : events_to_send) {
     switch (event.type) {
       case media::MediaLogRecord::Type::kMessage: {
         for (auto&& itr : event.params.DictItems()) {
-          blink::InspectorPlayerEvent ev = {
-              blink::InspectorPlayerEvent::MESSAGE_EVENT, event.time,
-              blink::WebString::FromUTF8(itr.first), ToString(itr.second)};
-          events.emplace_back(std::move(ev));
+          blink::InspectorPlayerMessage msg = {
+              LevelFromString(itr.first),
+              blink::WebString::FromUTF8(itr.second.GetString())};
+          messages.emplace_back(std::move(msg));
         }
         break;
       }
@@ -61,28 +78,32 @@ void InspectorMediaEventHandler::SendQueuedMediaEvents(
         break;
       }
       case media::MediaLogRecord::Type::kMediaEventTriggered: {
-        blink::InspectorPlayerEvent ev = {
-            blink::InspectorPlayerEvent::TRIGGERED_EVENT, event.time,
-            blink::WebString::FromUTF8("event"), ToString(event.params)};
+        blink::InspectorPlayerEvent ev = {event.time, ToString(event.params)};
         events.emplace_back(std::move(ev));
         break;
       }
       case media::MediaLogRecord::Type::kMediaStatus: {
-        // TODO(tmathmeyer) Make a new type in the browser protocol instead
-        // of overloading InspectorPlayerEvent.
-        blink::InspectorPlayerEvent ev = {
-            blink::InspectorPlayerEvent::ERROR_EVENT, event.time,
-            blink::WebString::FromUTF8("error"), ToString(event.params)};
-        events.emplace_back(std::move(ev));
+        base::Value* code = event.params.FindKey(media::MediaLog::kStatusText);
+        DCHECK_NE(code, nullptr);
+        blink::InspectorPlayerError error = {
+            blink::InspectorPlayerError::Type::kPipelineError, ToString(*code)};
+        errors.emplace_back(std::move(error));
         break;
       }
     }
   }
+
   if (!events.empty())
-    inspector_context_->NotifyPlayerEvents(player_id_, events);
+    inspector_context_->NotifyPlayerEvents(player_id_, std::move(events));
 
   if (!properties.empty())
-    inspector_context_->SetPlayerProperties(player_id_, properties);
+    inspector_context_->SetPlayerProperties(player_id_, std::move(properties));
+
+  if (!messages.empty())
+    inspector_context_->NotifyPlayerMessages(player_id_, std::move(messages));
+
+  if (!errors.empty())
+    inspector_context_->NotifyPlayerErrors(player_id_, std::move(errors));
 }
 
 void InspectorMediaEventHandler::OnWebMediaPlayerDestroyed() {
diff --git a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
index c24700d9fb4..f647f469c88 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
@@ -23,17 +23,31 @@ class MockMediaInspectorContext : public blink::MediaInspectorContext {
   blink::WebString CreatePlayer() override { return "TestPlayer"; }
 
   void NotifyPlayerEvents(blink::WebString id,
-                          blink::InspectorPlayerEvents events) override {
+                          const blink::InspectorPlayerEvents& events) override {
     MockNotifyPlayerEvents(events);
   }
 
-  void SetPlayerProperties(blink::WebString id,
-                           blink::InspectorPlayerProperties props) override {
+  void SetPlayerProperties(
+      blink::WebString id,
+      const blink::InspectorPlayerProperties& props) override {
     MockSetPlayerProperties(props);
   }
 
+  void NotifyPlayerErrors(blink::WebString id,
+                          const blink::InspectorPlayerErrors& errors) override {
+    MockNotifyPlayerErrors(errors);
+  }
+
+  void NotifyPlayerMessages(
+      blink::WebString id,
+      const blink::InspectorPlayerMessages& messages) override {
+    MockNotifyPlayerMessages(messages);
+  }
+
   MOCK_METHOD1(MockNotifyPlayerEvents, void(blink::InspectorPlayerEvents));
   MOCK_METHOD1(MockSetPlayerProperties, void(blink::InspectorPlayerProperties));
+  MOCK_METHOD1(MockNotifyPlayerErrors, void(blink::InspectorPlayerErrors));
+  MOCK_METHOD1(MockNotifyPlayerMessages, void(blink::InspectorPlayerMessages));
 };
 
 class InspectorMediaEventHandlerTest : public testing::Test {
@@ -59,7 +73,7 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
-  media::MediaLogRecord CreatePropChangeEvent(
+  media::MediaLogRecord CreatePropChange(
       std::vector<std::pair<std::string, std::string>> props) {
     media::MediaLogRecord event;
     event.id = 0;
@@ -71,7 +85,7 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
-  media::MediaLogRecord CreateLogEvent(std::string msg) {
+  media::MediaLogRecord CreateMessage(std::string msg) {
     media::MediaLogRecord event;
     event.id = 0;
     event.type = media::MediaLogRecord::Type::kMessage;
@@ -80,6 +94,15 @@ class InspectorMediaEventHandlerTest : public testing::Test {
     return event;
   }
 
+  media::MediaLogRecord CreateError(int errorcode) {
+    media::MediaLogRecord error;
+    error.id = 0;
+    error.type = media::MediaLogRecord::Type::kMediaStatus;
+    error.time = base::TimeTicks();
+    error.params.SetIntPath(media::MediaLog::kStatusText, errorcode);
+    return error;
+  }
+
   DISALLOW_COPY_AND_ASSIGN(InspectorMediaEventHandlerTest);
 };
 
@@ -95,8 +118,7 @@ bool operator!=(const blink::InspectorPlayerProperty& lhs,
 
 bool operator==(const blink::InspectorPlayerEvent& lhs,
                 const blink::InspectorPlayerEvent& rhs) {
-  return lhs.type == rhs.type && lhs.timestamp == rhs.timestamp &&
-         lhs.key == rhs.key && lhs.value == rhs.value;
+  return lhs.timestamp == rhs.timestamp && lhs.value == rhs.value;
 }
 
 bool operator!=(const blink::InspectorPlayerEvent& lhs,
@@ -104,6 +126,26 @@ bool operator!=(const blink::InspectorPlayerEvent& lhs,
   return !(lhs == rhs);
 }
 
+bool operator==(const blink::InspectorPlayerMessage& lhs,
+                const blink::InspectorPlayerMessage& rhs) {
+  return lhs.level == rhs.level && lhs.message == rhs.message;
+}
+
+bool operator!=(const blink::InspectorPlayerMessage& lhs,
+                const blink::InspectorPlayerMessage& rhs) {
+  return !(lhs == rhs);
+}
+
+bool operator==(const blink::InspectorPlayerError& lhs,
+                const blink::InspectorPlayerError& rhs) {
+  return lhs.errorCode == rhs.errorCode;
+}
+
+bool operator!=(const blink::InspectorPlayerError& lhs,
+                const blink::InspectorPlayerError& rhs) {
+  return !(lhs == rhs);
+}
+
 MATCHER_P(PropertiesEqualTo, props, "") {
   if (props.size() != arg.size())
     return false;
@@ -122,9 +164,27 @@ MATCHER_P(EventsEqualTo, events, "") {
   return true;
 }
 
+MATCHER_P(MessagesEqualTo, messages, "") {
+  if (messages.size() != arg.size())
+    return false;
+  for (size_t i = 0; i < messages.size(); i++)
+    if (messages[i] != arg[i])
+      return false;
+  return true;
+}
+
+MATCHER_P(ErrorsEqualTo, errors, "") {
+  if (errors.size() != arg.size())
+    return false;
+  for (size_t i = 0; i < errors.size(); i++)
+    if (errors[i] != arg[i])
+      return false;
+  return true;
+}
+
 TEST_F(InspectorMediaEventHandlerTest, ConvertsProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreatePropChangeEvent({{"test_key", "test_value"}})};
+      CreatePropChange({{"test_key", "test_value"}})};
 
   blink::InspectorPlayerProperties expected;
   blink::InspectorPlayerProperty prop = {
@@ -141,7 +201,7 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsProperties) {
 
 TEST_F(InspectorMediaEventHandlerTest, SplitsDoubleProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreatePropChangeEvent({{"test_key", "test_value"}, {"foo", "bar"}})};
+      CreatePropChange({{"test_key", "test_value"}, {"foo", "bar"}})};
 
   blink::InspectorPlayerProperties expected;
   blink::InspectorPlayerProperty prop_test = {
@@ -161,19 +221,19 @@ TEST_F(InspectorMediaEventHandlerTest, SplitsDoubleProperties) {
 
 TEST_F(InspectorMediaEventHandlerTest, ConvertsMessageEvent) {
   std::vector<media::MediaLogRecord> events = {
-      CreateLogEvent("Has Anyone Really Been Far Even as Decided to Use Even "
-                     "Go Want to do Look More Like?")};
+      CreateMessage("Has Anyone Really Been Far Even as Decided to Use Even "
+                    "Go Want to do Look More Like?")};
 
-  blink::InspectorPlayerEvents expected;
-  blink::InspectorPlayerEvent e = {
-      blink::InspectorPlayerEvent::MESSAGE_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("warning"),
+  blink::InspectorPlayerMessages expected;
+  blink::InspectorPlayerMessage e = {
+      blink::InspectorPlayerMessage::Level::kWarning,
       blink::WebString::FromUTF8("Has Anyone Really Been Far Even as Decided "
                                  "to Use Even Go Want to do Look More Like?")};
   expected.emplace_back(e);
 
   EXPECT_CALL(*mock_context_, MockSetPlayerProperties(_)).Times(0);
-  EXPECT_CALL(*mock_context_, MockNotifyPlayerEvents(EventsEqualTo(expected)))
+  EXPECT_CALL(*mock_context_,
+              MockNotifyPlayerMessages(MessagesEqualTo(expected)))
       .Times(1);
 
   handler_->SendQueuedMediaEvents(events);
@@ -181,16 +241,15 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsMessageEvent) {
 
 TEST_F(InspectorMediaEventHandlerTest, ConvertsEventsAndProperties) {
   std::vector<media::MediaLogRecord> events = {
-      CreateLogEvent("100% medically accurate"),
-      CreatePropChangeEvent(
+      CreateMessage("100% medically accurate"),
+      CreatePropChange(
           {{"free_puppies", "all_taken"}, {"illuminati", "confirmed"}})};
 
-  blink::InspectorPlayerEvents expected_events;
-  blink::InspectorPlayerEvent e = {
-      blink::InspectorPlayerEvent::MESSAGE_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("warning"),
+  blink::InspectorPlayerMessages expected_messages;
+  blink::InspectorPlayerMessage e = {
+      blink::InspectorPlayerMessage::Level::kWarning,
       blink::WebString::FromUTF8("100% medically accurate")};
-  expected_events.emplace_back(e);
+  expected_messages.emplace_back(e);
 
   blink::InspectorPlayerProperties expected_properties;
   blink::InspectorPlayerProperty puppies = {
@@ -206,7 +265,7 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsEventsAndProperties) {
               MockSetPlayerProperties(PropertiesEqualTo(expected_properties)))
       .Times(1);
   EXPECT_CALL(*mock_context_,
-              MockNotifyPlayerEvents(EventsEqualTo(expected_events)))
+              MockNotifyPlayerMessages(MessagesEqualTo(expected_messages)))
       .Times(1);
 
   handler_->SendQueuedMediaEvents(events);
@@ -219,13 +278,9 @@ TEST_F(InspectorMediaEventHandlerTest, PassesPlayAndPauseEvents) {
 
   blink::InspectorPlayerEvents expected_events;
   blink::InspectorPlayerEvent play = {
-      blink::InspectorPlayerEvent::TRIGGERED_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("event"),
-      blink::WebString::FromUTF8("{\"event\":\"kPlay\"}")};
+      base::TimeTicks(), blink::WebString::FromUTF8("{\"event\":\"kPlay\"}")};
   blink::InspectorPlayerEvent pause = {
-      blink::InspectorPlayerEvent::TRIGGERED_EVENT, base::TimeTicks(),
-      blink::WebString::FromUTF8("event"),
-      blink::WebString::FromUTF8("{\"event\":\"kPause\"}")};
+      base::TimeTicks(), blink::WebString::FromUTF8("{\"event\":\"kPause\"}")};
   expected_events.emplace_back(play);
   expected_events.emplace_back(pause);
 
@@ -236,4 +291,24 @@ TEST_F(InspectorMediaEventHandlerTest, PassesPlayAndPauseEvents) {
   handler_->SendQueuedMediaEvents(events);
 }
 
+TEST_F(InspectorMediaEventHandlerTest, PassesErrorEvents) {
+  std::vector<media::MediaLogRecord> errors = {CreateError(5), CreateError(7)};
+
+  blink::InspectorPlayerErrors expected_errors;
+  blink::InspectorPlayerError first = {
+      blink::InspectorPlayerError::Type::kPipelineError,
+      blink::WebString::FromUTF8("5")};
+  blink::InspectorPlayerError second = {
+      blink::InspectorPlayerError::Type::kPipelineError,
+      blink::WebString::FromUTF8("7")};
+  expected_errors.emplace_back(first);
+  expected_errors.emplace_back(second);
+
+  EXPECT_CALL(*mock_context_,
+              MockNotifyPlayerErrors(ErrorsEqualTo(expected_errors)))
+      .Times(1);
+
+  handler_->SendQueuedMediaEvents(errors);
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/media/media_factory.cc b/chromium/content/renderer/media/media_factory.cc
index 9c8d0b0adec..a1c33d76de6 100644
--- a/chromium/content/renderer/media/media_factory.cc
+++ b/chromium/content/renderer/media/media_factory.cc
@@ -21,6 +21,7 @@
 #include "content/renderer/media/audio/audio_device_factory.h"
 #include "content/renderer/media/batching_media_log.h"
 #include "content/renderer/media/inspector_media_event_handler.h"
+#include "content/renderer/media/media_interface_factory.h"
 #include "content/renderer/media/power_status_helper_impl.h"
 #include "content/renderer/media/render_media_event_handler.h"
 #include "content/renderer/media/renderer_webmediaplayer_delegate.h"
@@ -30,6 +31,7 @@
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/cdm_factory.h"
 #include "media/base/decoder_factory.h"
+#include "media/base/demuxer.h"
 #include "media/base/media_switches.h"
 #include "media/base/renderer_factory_selector.h"
 #include "media/blink/remote_playback_client_wrapper_impl.h"
@@ -71,10 +73,6 @@
 #include "content/renderer/media/cast_renderer_client_factory.h"
 #endif
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
-#include "content/renderer/media/media_interface_factory.h"
-#endif
-
 #if defined(OS_FUCHSIA)
 #include "content/renderer/media/fuchsia_renderer_factory.h"
 #include "media/fuchsia/cdm/client/fuchsia_cdm_util.h"
@@ -147,9 +145,16 @@ void PostContextProviderToCallback(
                      unwanted_context_provider));
 }
 
-void LogRoughness(int size, base::TimeDelta duration, double roughness) {
+void LogRoughness(media::MediaLog* media_log,
+                  int size,
+                  base::TimeDelta duration,
+                  double roughness) {
+  // This function can be called from any thread. Don't do anything that assumes
+  // a certain task runner.
   double fps = size / duration.InSecondsF();
-  DVLOG(1) << "Video playback roughness: " << roughness << " FPS: " << fps;
+  media_log->SetProperty<media::MediaLogProperty::kVideoPlaybackRoughness>(
+      roughness);
+  media_log->SetProperty<media::MediaLogProperty::kFramerate>(fps);
 }
 
 }  // namespace
@@ -230,7 +235,8 @@ bool UseMediaPlayerRenderer(const GURL& url) {
 std::unique_ptr<blink::WebVideoFrameSubmitter> MediaFactory::CreateSubmitter(
     scoped_refptr<base::SingleThreadTaskRunner>*
         video_frame_compositor_task_runner,
-    const cc::LayerTreeSettings& settings) {
+    const cc::LayerTreeSettings& settings,
+    media::MediaLog* media_log) {
   blink::WebMediaPlayer::SurfaceLayerMode use_surface_layer_for_video =
       GetVideoSurfaceLayerMode();
   content::RenderThreadImpl* render_thread =
@@ -267,11 +273,14 @@ std::unique_ptr<blink::WebVideoFrameSubmitter> MediaFactory::CreateSubmitter(
 
   if (use_surface_layer_for_video !=
       blink::WebMediaPlayer::SurfaceLayerMode::kNever) {
+    auto log_roughness_cb =
+        base::BindRepeating(LogRoughness, base::Owned(media_log->Clone()));
+    auto post_to_context_provider_cb = base::BindRepeating(
+        &PostContextProviderToCallback,
+        RenderThreadImpl::current()->GetCompositorMainThreadTaskRunner());
     submitter = blink::WebVideoFrameSubmitter::Create(
-        base::BindRepeating(
-            &PostContextProviderToCallback,
-            RenderThreadImpl::current()->GetCompositorMainThreadTaskRunner()),
-        base::BindRepeating(LogRoughness), settings, use_sync_primitives);
+        std::move(post_to_context_provider_cb), std::move(log_roughness_cb),
+        settings, use_sync_primitives);
   }
 
   DCHECK(*video_frame_compositor_task_runner);
@@ -334,12 +343,12 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
           media::kMemoryPressureBasedSourceBufferGC,
           "enable_instant_source_buffer_gc", false);
 
-  std::unique_ptr<BatchingMediaLog::EventHandler> event_handler;
+  std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> handlers;
+  handlers.push_back(std::make_unique<RenderMediaEventHandler>());
+
   if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
-    event_handler =
-        std::make_unique<InspectorMediaEventHandler>(inspector_context);
-  } else {
-    event_handler = std::make_unique<RenderMediaEventHandler>();
+    handlers.push_back(
+        std::make_unique<InspectorMediaEventHandler>(inspector_context));
   }
 
   // This must be created for every new WebMediaPlayer, each instance generates
@@ -347,7 +356,7 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
   auto media_log = std::make_unique<BatchingMediaLog>(
       url::Origin(security_origin).GetURL(),
       render_frame_->GetTaskRunner(blink::TaskType::kInternalMedia),
-      std::move(event_handler));
+      std::move(handlers));
 
   base::WeakPtr<media::MediaObserver> media_observer;
   auto factory_selector = CreateRendererFactorySelector(
@@ -396,8 +405,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
 
   scoped_refptr<base::SingleThreadTaskRunner>
       video_frame_compositor_task_runner;
-  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter =
-      CreateSubmitter(&video_frame_compositor_task_runner, settings);
+  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter = CreateSubmitter(
+      &video_frame_compositor_task_runner, settings, media_log.get());
 
   scoped_refptr<base::SingleThreadTaskRunner> media_task_runner =
       render_thread->GetMediaThreadTaskRunner();
@@ -427,7 +436,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
           enable_instant_source_buffer_gc, embedded_media_experience_enabled,
           std::move(metrics_provider),
           base::BindOnce(&blink::WebSurfaceLayerBridge::Create,
-                         parent_frame_sink_id),
+                         parent_frame_sink_id,
+                         blink::WebSurfaceLayerBridge::ContainsVideo::kYes),
           RenderThreadImpl::current()->SharedMainThreadContextProvider(),
           GetVideoSurfaceLayerMode(),
           render_frame_->GetRenderFrameMediaPlaybackOptions()
@@ -438,6 +448,8 @@ blink::WebMediaPlayer* MediaFactory::CreateMediaPlayer(
               .is_background_video_track_optimization_supported,
           render_frame_->GetRenderFrameMediaPlaybackOptions()
               .is_remoting_renderer_enabled(),
+          GetContentClient()->renderer()->OverrideDemuxerForUrl(
+              render_frame_, url, media_task_runner),
           std::move(power_status_helper)));
 
   std::unique_ptr<media::VideoFrameCompositor> vfc =
@@ -542,27 +554,31 @@ MediaFactory::CreateRendererFactorySelector(
 #endif  // BUILDFLAG(ENABLE_MOJO_RENDERER)
 
 #if defined(OS_FUCHSIA)
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableFuchsiaAudioConsumer)) {
-    use_default_renderer_factory = false;
-    factory_selector->AddBaseFactory(
-        FactoryType::kFuchsia,
-        std::make_unique<FuchsiaRendererFactory>(
-            media_log, decoder_factory,
-            base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
-                                base::Unretained(render_thread)),
-            render_frame_->GetBrowserInterfaceBroker()));
-  }
+  use_default_renderer_factory = false;
+  factory_selector->AddBaseFactory(
+      FactoryType::kFuchsia,
+      std::make_unique<FuchsiaRendererFactory>(
+          media_log, decoder_factory,
+          base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                              base::Unretained(render_thread)),
+          render_frame_->GetBrowserInterfaceBroker()));
 #endif  // defined(OS_FUCHSIA)
 
   if (use_default_renderer_factory) {
-    factory_selector->AddBaseFactory(
-        FactoryType::kDefault,
-        std::make_unique<media::DefaultRendererFactory>(
-            media_log, decoder_factory,
-            base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
-                                base::Unretained(render_thread)),
-            render_frame_->CreateSpeechRecognitionClient()));
+#if defined(OS_ANDROID)
+    auto default_factory = std::make_unique<media::DefaultRendererFactory>(
+        media_log, decoder_factory,
+        base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                            base::Unretained(render_thread)));
+#else
+    auto default_factory = std::make_unique<media::DefaultRendererFactory>(
+        media_log, decoder_factory,
+        base::BindRepeating(&RenderThreadImpl::GetGpuFactories,
+                            base::Unretained(render_thread)),
+        render_frame_->CreateSpeechRecognitionClient());
+#endif
+    factory_selector->AddBaseFactory(FactoryType::kDefault,
+                                     std::move(default_factory));
   }
 
 #if BUILDFLAG(ENABLE_MEDIA_REMOTING)
@@ -605,15 +621,13 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
 
   scoped_refptr<base::SingleThreadTaskRunner>
       video_frame_compositor_task_runner;
-  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter =
-      CreateSubmitter(&video_frame_compositor_task_runner, settings);
 
-  std::unique_ptr<BatchingMediaLog::EventHandler> event_handler;
+  std::vector<std::unique_ptr<BatchingMediaLog::EventHandler>> handlers;
+  handlers.push_back(std::make_unique<RenderMediaEventHandler>());
+
   if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
-    event_handler =
-        std::make_unique<InspectorMediaEventHandler>(inspector_context);
-  } else {
-    event_handler = std::make_unique<RenderMediaEventHandler>();
+    handlers.push_back(
+        std::make_unique<InspectorMediaEventHandler>(inspector_context));
   }
 
   // This must be created for every new WebMediaPlayer, each instance generates
@@ -621,7 +635,10 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
   auto media_log = std::make_unique<BatchingMediaLog>(
       url::Origin(security_origin).GetURL(),
       render_frame_->GetTaskRunner(blink::TaskType::kInternalMedia),
-      std::move(event_handler));
+      std::move(handlers));
+
+  std::unique_ptr<blink::WebVideoFrameSubmitter> submitter = CreateSubmitter(
+      &video_frame_compositor_task_runner, settings, media_log.get());
 
   return new blink::WebMediaPlayerMS(
       frame, client, GetWebMediaPlayerDelegate(), std::move(media_log),
@@ -632,7 +649,8 @@ blink::WebMediaPlayer* MediaFactory::CreateWebMediaPlayerForMediaStream(
       render_thread->GetWorkerTaskRunner(), render_thread->GetGpuFactories(),
       sink_id,
       base::BindOnce(&blink::WebSurfaceLayerBridge::Create,
-                     parent_frame_sink_id),
+                     parent_frame_sink_id,
+                     blink::WebSurfaceLayerBridge::ContainsVideo::kYes),
       std::move(submitter), GetVideoSurfaceLayerMode());
 }
 
@@ -688,7 +706,6 @@ media::CdmFactory* MediaFactory::GetCdmFactory() {
   return cdm_factory_.get();
 }
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
 media::mojom::InterfaceFactory* MediaFactory::GetMediaInterfaceFactory() {
   DCHECK(interface_broker_);
 
@@ -705,6 +722,5 @@ MediaFactory::CreateMojoRendererFactory() {
   return std::make_unique<media::MojoRendererFactory>(
       GetMediaInterfaceFactory());
 }
-#endif  // BUILDFLAG(ENABLE_MOJO_MEDIA)
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/media_factory.h b/chromium/content/renderer/media/media_factory.h
index 0c65658918f..508690707a4 100644
--- a/chromium/content/renderer/media/media_factory.h
+++ b/chromium/content/renderer/media/media_factory.h
@@ -16,6 +16,8 @@
 #include "media/blink/webmediaplayer_params.h"
 #include "media/media_buildflags.h"
 #include "media/mojo/buildflags.h"
+#include "media/mojo/clients/mojo_renderer_factory.h"
+#include "media/mojo/mojom/interface_factory.mojom.h"
 #include "media/mojo/mojom/remoting.mojom.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/platform/web_media_player_source.h"
@@ -24,11 +26,6 @@
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/web_media_inspector.h"
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
-#include "media/mojo/clients/mojo_renderer_factory.h"  // nogncheck
-#include "media/mojo/mojom/interface_factory.mojom.h"  // nogncheck
-#endif
-
 namespace blink {
 class BrowserInterfaceBrokerProxy;
 class WebContentDecryptionModule;
@@ -86,7 +83,8 @@ class MediaFactory {
   std::unique_ptr<blink::WebVideoFrameSubmitter> CreateSubmitter(
       scoped_refptr<base::SingleThreadTaskRunner>*
           video_frame_compositor_task_runner,
-      const cc::LayerTreeSettings& settings);
+      const cc::LayerTreeSettings& settings,
+      media::MediaLog* media_log);
 
   // Creates a new WebMediaPlayer for the given |source| (either a stream or
   // URL). All pointers other than |initial_cdm| are required to be non-null.
@@ -142,19 +140,17 @@ class MediaFactory {
 
   media::CdmFactory* GetCdmFactory();
 
-#if BUILDFLAG(ENABLE_MOJO_MEDIA)
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
 
   std::unique_ptr<media::MojoRendererFactory> CreateMojoRendererFactory();
 
-  // The media interface provider attached to this frame, lazily initialized.
-  std::unique_ptr<MediaInterfaceFactory> media_interface_factory_;
-#endif
-
   // The render frame we're helping. RenderFrameImpl owns this factory, so the
   // pointer will always be valid.
   RenderFrameImpl* render_frame_;
 
+  // The media interface provider attached to this frame, lazily initialized.
+  std::unique_ptr<MediaInterfaceFactory> media_interface_factory_;
+
   // Injected callback for requesting overlay routing tokens.
   media::RequestRoutingTokenCallback request_routing_token_cb_;
 
diff --git a/chromium/content/renderer/media/media_interface_factory.cc b/chromium/content/renderer/media/media_interface_factory.cc
index e816e91020a..8bd2766133a 100644
--- a/chromium/content/renderer/media/media_interface_factory.cc
+++ b/chromium/content/renderer/media/media_interface_factory.cc
@@ -143,28 +143,6 @@ void MediaInterfaceFactory::CreateCdm(
   GetMediaInterfaceFactory()->CreateCdm(key_system, std::move(receiver));
 }
 
-void MediaInterfaceFactory::CreateDecryptor(
-    int cdm_id,
-    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {
-  if (!task_runner_->BelongsToCurrentThread()) {
-    task_runner_->PostTask(
-        FROM_HERE, base::BindOnce(&MediaInterfaceFactory::CreateDecryptor,
-                                  weak_this_, cdm_id, std::move(receiver)));
-    return;
-  }
-
-  DVLOG(1) << __func__;
-  GetMediaInterfaceFactory()->CreateDecryptor(cdm_id, std::move(receiver));
-}
-
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-void MediaInterfaceFactory::CreateCdmProxy(
-    const base::Token& cdm_guid,
-    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
-  NOTREACHED() << "CdmProxy should only be connected from a library CDM";
-}
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
-
 media::mojom::InterfaceFactory*
 MediaInterfaceFactory::GetMediaInterfaceFactory() {
   DVLOG(1) << __func__;
diff --git a/chromium/content/renderer/media/media_interface_factory.h b/chromium/content/renderer/media/media_interface_factory.h
index b876ba0517f..0f5e08c5f95 100644
--- a/chromium/content/renderer/media/media_interface_factory.h
+++ b/chromium/content/renderer/media/media_interface_factory.h
@@ -65,14 +65,6 @@ class CONTENT_EXPORT MediaInterfaceFactory
   void CreateCdm(const std::string& key_system,
                  mojo::PendingReceiver<media::mojom::ContentDecryptionModule>
                      receiver) final;
-  void CreateDecryptor(
-      int cdm_id,
-      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
-#if BUILDFLAG(ENABLE_CDM_PROXY)
-  void CreateCdmProxy(
-      const base::Token& cdm_guid,
-      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
-#endif  // BUILDFLAG(ENABLE_CDM_PROXY)
 
  private:
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
diff --git a/chromium/content/renderer/media/render_media_client.cc b/chromium/content/renderer/media/render_media_client.cc
index e1878231f4e..ae86139534d 100644
--- a/chromium/content/renderer/media/render_media_client.cc
+++ b/chromium/content/renderer/media/render_media_client.cc
@@ -5,7 +5,6 @@
 #include "content/renderer/media/render_media_client.h"
 
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/time/default_tick_clock.h"
 #include "content/public/common/content_client.h"
 #include "content/public/renderer/content_renderer_client.h"
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc b/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
index 40dd3becb0e..7eefa1dd352 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl.cc
@@ -10,8 +10,11 @@
 #include <string>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/command_line.h"
-#include "base/logging.h"
+#include "base/notreached.h"
+#include "base/task/task_traits.h"
+#include "base/task/thread_pool.h"
 #include "base/time/time.h"
 #include "content/renderer/media/audio/audio_device_factory.h"
 #include "content/renderer/render_frame_impl.h"
@@ -61,15 +64,12 @@ int GetOutputBufferSize(const blink::WebAudioLatencyHint& latency_hint,
     case media::AudioLatency::LATENCY_INTERACTIVE:
       return media::AudioLatency::GetInteractiveBufferSize(
           hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_RTC:
       return media::AudioLatency::GetRtcBufferSize(
           hardware_params.sample_rate(), hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_PLAYBACK:
       return media::AudioLatency::GetHighLatencyBufferSize(
           hardware_params.sample_rate(), hardware_params.frames_per_buffer());
-      break;
     case media::AudioLatency::LATENCY_EXACT_MS:
       return media::AudioLatency::GetExactBufferSize(
           base::TimeDelta::FromSecondsD(latency_hint.Seconds()),
@@ -77,7 +77,6 @@ int GetOutputBufferSize(const blink::WebAudioLatencyHint& latency_hint,
           hardware_capabilities.min_frames_per_buffer,
           hardware_capabilities.max_frames_per_buffer,
           media::limits::kMaxWebAudioBufferSize);
-      break;
     default:
       NOTREACHED();
   }
@@ -180,12 +179,12 @@ void RendererWebAudioDeviceImpl::Start() {
       GetLatencyHintSourceType(latency_hint_.Category()), frame_id_,
       media::AudioSinkParameters(session_id_, std::string()));
 
-  // Use the media thread instead of the render thread for fake Render() calls
+  // Use a task runner instead of the render thread for fake Render() calls
   // since it has special connotations for Blink and garbage collection. Timeout
   // value chosen to be highly unlikely in the normal case.
   webaudio_suspender_.reset(new media::SilentSinkSuspender(
       this, base::TimeDelta::FromSeconds(30), sink_params_, sink_,
-      GetMediaTaskRunner()));
+      GetSuspenderTaskRunner()));
   sink_->Initialize(sink_params_, webaudio_suspender_.get());
 
   sink_->Start();
@@ -196,6 +195,8 @@ void RendererWebAudioDeviceImpl::Pause() {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (sink_)
     sink_->Pause();
+  if (webaudio_suspender_)
+    webaudio_suspender_->OnPaused();
 }
 
 void RendererWebAudioDeviceImpl::Resume() {
@@ -222,6 +223,14 @@ int RendererWebAudioDeviceImpl::FramesPerBuffer() {
   return sink_params_.frames_per_buffer();
 }
 
+void RendererWebAudioDeviceImpl::SetDetectSilence(
+    bool enable_silence_detection) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  if (webaudio_suspender_)
+    webaudio_suspender_->SetDetectSilence(enable_silence_detection);
+}
+
 int RendererWebAudioDeviceImpl::Render(base::TimeDelta delay,
                                        base::TimeTicks delay_timestamp,
                                        int prior_frames_skipped,
@@ -249,18 +258,19 @@ void RendererWebAudioDeviceImpl::OnRenderError() {
   // TODO(crogers): implement error handling.
 }
 
-void RendererWebAudioDeviceImpl::SetMediaTaskRunnerForTesting(
-    const scoped_refptr<base::SingleThreadTaskRunner>& media_task_runner) {
-  media_task_runner_ = media_task_runner;
+void RendererWebAudioDeviceImpl::SetSuspenderTaskRunnerForTesting(
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
+  suspender_task_runner_ = std::move(task_runner);
 }
 
-const scoped_refptr<base::SingleThreadTaskRunner>&
-RendererWebAudioDeviceImpl::GetMediaTaskRunner() {
-  if (!media_task_runner_) {
-    media_task_runner_ =
-        RenderThreadImpl::current()->GetMediaThreadTaskRunner();
+scoped_refptr<base::SingleThreadTaskRunner>
+RendererWebAudioDeviceImpl::GetSuspenderTaskRunner() {
+  if (!suspender_task_runner_) {
+    suspender_task_runner_ = base::ThreadPool::CreateSingleThreadTaskRunner(
+        {base::TaskPriority::USER_VISIBLE,
+         base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
   }
-  return media_task_runner_;
+  return suspender_task_runner_;
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl.h b/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
index 8dc13163ca6..870cf492fc7 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl.h
@@ -50,6 +50,10 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
   double SampleRate() override;
   int FramesPerBuffer() override;
 
+  // Sets the detect silence flag for SilentSinkSuspender. Invoked by Blink Web
+  // Audio.
+  void SetDetectSilence(bool enable_silence_detection) override;
+
   // AudioRendererSink::RenderCallback implementation.
   int Render(base::TimeDelta delay,
              base::TimeTicks delay_timestamp,
@@ -58,8 +62,8 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
 
   void OnRenderError() override;
 
-  void SetMediaTaskRunnerForTesting(
-      const scoped_refptr<base::SingleThreadTaskRunner>& media_task_runner);
+  void SetSuspenderTaskRunnerForTesting(
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   const media::AudioParameters& get_sink_params_for_testing() {
     return sink_params_;
@@ -84,7 +88,7 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
                              RenderFrameIdCallback render_frame_id_cb);
 
  private:
-  const scoped_refptr<base::SingleThreadTaskRunner>& GetMediaTaskRunner();
+  scoped_refptr<base::SingleThreadTaskRunner> GetSuspenderTaskRunner();
 
   media::AudioParameters sink_params_;
 
@@ -109,8 +113,8 @@ class CONTENT_EXPORT RendererWebAudioDeviceImpl
   // Render frame routing ID for the current context.
   int frame_id_;
 
-  // Allow unit tests to set a custom MediaThreadTaskRunner.
-  scoped_refptr<base::SingleThreadTaskRunner> media_task_runner_;
+  // Allow unit tests to set a custom TaskRunner for |webaudio_suspender_|.
+  scoped_refptr<base::SingleThreadTaskRunner> suspender_task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(RendererWebAudioDeviceImpl);
 };
diff --git a/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc b/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
index 9d993147d95..8d0e3ca1099 100644
--- a/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
+++ b/chromium/content/renderer/media/renderer_webaudiodevice_impl_unittest.cc
@@ -71,7 +71,7 @@ class RendererWebAudioDeviceImplTest
     webaudio_device_.reset(new RendererWebAudioDeviceImplUnderTest(
         media::CHANNEL_LAYOUT_MONO, 1, latencyHint, this,
         base::UnguessableToken()));
-    webaudio_device_->SetMediaTaskRunnerForTesting(
+    webaudio_device_->SetSuspenderTaskRunnerForTesting(
         blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   }
 
@@ -81,7 +81,7 @@ class RendererWebAudioDeviceImplTest
         blink::WebAudioLatencyHint(
             blink::WebAudioLatencyHint::kCategoryInteractive),
         this, base::UnguessableToken()));
-    webaudio_device_->SetMediaTaskRunnerForTesting(
+    webaudio_device_->SetSuspenderTaskRunnerForTesting(
         blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   }
 
diff --git a/chromium/content/renderer/mouse_lock_dispatcher.cc b/chromium/content/renderer/mouse_lock_dispatcher.cc
index 34e33042f02..2ed4f462d0f 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher.cc
+++ b/chromium/content/renderer/mouse_lock_dispatcher.cc
@@ -4,14 +4,13 @@
 
 #include "content/renderer/mouse_lock_dispatcher.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 
 namespace content {
 
 MouseLockDispatcher::MouseLockDispatcher()
-    : mouse_locked_(false),
-      pending_lock_request_(false),
+    : pending_lock_request_(false),
       pending_unlock_request_(false),
       target_(nullptr) {}
 
@@ -39,23 +38,27 @@ bool MouseLockDispatcher::ChangeMouseLock(
     blink::WebLocalFrame* requester_frame,
     blink::WebWidgetClient::PointerLockCallback callback,
     bool request_unadjusted_movement) {
-  if (pending_lock_request_ || pending_unlock_request_)
+  if (!mouse_lock_context_)
     return false;
 
-  pending_lock_request_ = true;
-  target_ = target;
-
   lock_mouse_callback_ = std::move(callback);
-
-  SendChangeLockRequest(requester_frame, request_unadjusted_movement);
+  // Unretained is safe because |this| owns the mojo::Remote
+  mouse_lock_context_->RequestMouseLockChange(
+      request_unadjusted_movement,
+      base::BindOnce(&MouseLockDispatcher::OnChangeLockAck,
+                     base::Unretained(this)));
   return true;
 }
 
-void MouseLockDispatcher::UnlockMouse(LockTarget* target) {
-  if (target && target == target_ && !pending_unlock_request_) {
-    pending_unlock_request_ = true;
+void MouseLockDispatcher::FlushContextPipeForTesting() {
+  if (mouse_lock_context_)
+    mouse_lock_context_.FlushForTesting();
+}
 
-    SendUnlockMouseRequest();
+void MouseLockDispatcher::UnlockMouse(LockTarget* target) {
+  if (IsMouseLockedTo(target)) {
+    mouse_lock_context_.reset();
+    target->OnMouseLockLost();
   }
 }
 
@@ -71,12 +74,12 @@ void MouseLockDispatcher::ClearLockTarget() {
 }
 
 bool MouseLockDispatcher::IsMouseLockedTo(LockTarget* target) {
-  return mouse_locked_ && target_ == target;
+  return mouse_lock_context_ && target_ == target;
 }
 
 bool MouseLockDispatcher::WillHandleMouseEvent(
     const blink::WebMouseEvent& event) {
-  if (mouse_locked_ && target_)
+  if (mouse_lock_context_ && target_)
     return target_->HandleMouseLockedInputEvent(event);
   return false;
 }
@@ -90,24 +93,31 @@ void MouseLockDispatcher::OnChangeLockAck(
 }
 
 void MouseLockDispatcher::OnLockMouseACK(
-    blink::mojom::PointerLockResult result) {
-  DCHECK(!mouse_locked_ && pending_lock_request_);
+    blink::mojom::PointerLockResult result,
+    mojo::PendingRemote<blink::mojom::PointerLockContext> context) {
+  DCHECK(!mouse_lock_context_ && pending_lock_request_);
 
-  mouse_locked_ = result == blink::mojom::PointerLockResult::kSuccess;
   pending_lock_request_ = false;
-  if (pending_unlock_request_ && !mouse_locked_) {
+  if (pending_unlock_request_ && !context) {
     // We have sent an unlock request after the lock request. However, since
     // the lock request has failed, the unlock request will be ignored by the
     // browser side and there won't be any response to it.
     pending_unlock_request_ = false;
   }
 
-  if (lock_mouse_callback_) {
-    std::move(lock_mouse_callback_).Run(result);
+  if (context) {
+    mouse_lock_context_.Bind(std::move(context));
+    // The browser might unlock the mouse for many reasons including closing
+    // the tab, the user hitting esc, the page losing focus, and more.
+    mouse_lock_context_.set_disconnect_handler(base::BindOnce(
+        &MouseLockDispatcher::OnMouseLockLost, base::Unretained(this)));
   }
 
+  if (lock_mouse_callback_)
+    std::move(lock_mouse_callback_).Run(result);
+
   LockTarget* last_target = target_;
-  if (!mouse_locked_)
+  if (!mouse_lock_context_)
     target_ = nullptr;
 
   // Callbacks made after all state modification to prevent reentrant errors
@@ -119,9 +129,8 @@ void MouseLockDispatcher::OnLockMouseACK(
 }
 
 void MouseLockDispatcher::OnMouseLockLost() {
-  DCHECK(mouse_locked_ && !pending_lock_request_);
-
-  mouse_locked_ = false;
+  DCHECK(mouse_lock_context_ && !pending_lock_request_);
+  mouse_lock_context_.reset();
   pending_unlock_request_ = false;
 
   LockTarget* last_target = target_;
diff --git a/chromium/content/renderer/mouse_lock_dispatcher.h b/chromium/content/renderer/mouse_lock_dispatcher.h
index 9e5f13a78c6..7e2838de8a5 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher.h
+++ b/chromium/content/renderer/mouse_lock_dispatcher.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/common/input/input_handler.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/web/web_widget_client.h"
 
 namespace blink {
@@ -45,8 +46,8 @@ class CONTENT_EXPORT MouseLockDispatcher {
                        blink::WebLocalFrame* requester_frame,
                        blink::WebWidgetClient::PointerLockCallback callback,
                        bool request_unadjusted_movement);
-  // Request to unlock the mouse. An asynchronous response to
-  // target->OnMouseLockLost() will follow.
+  // Request to unlock the mouse. This call destroys the |mouse_lock_context_|.
+  // A response to target->OnMouseLockLost() will follow.
   void UnlockMouse(LockTarget* target);
   // Clears out the reference to the |target| because it has or is being
   // destroyed. Unlocks if locked. The pointer will not be accessed.
@@ -60,35 +61,34 @@ class CONTENT_EXPORT MouseLockDispatcher {
 
   // Subclasses or users have to call these methods to report mouse lock events
   // from the browser.
-  void OnLockMouseACK(blink::mojom::PointerLockResult result);
+  void OnLockMouseACK(
+      blink::mojom::PointerLockResult result,
+      mojo::PendingRemote<blink::mojom::PointerLockContext> context);
   void OnChangeLockAck(blink::mojom::PointerLockResult result);
-  void OnMouseLockLost();
+
+  void FlushContextPipeForTesting();
 
  protected:
   // Subclasses must implement these methods to send mouse lock requests to the
   // browser.
   virtual void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                                     bool request_unadjusted_movement) = 0;
-  virtual void SendChangeLockRequest(blink::WebLocalFrame* requester_frame,
-                                     bool request_unadjusted_movement) {}
-  virtual void SendUnlockMouseRequest() = 0;
-
-  base::WeakPtr<MouseLockDispatcher> AsWeakPtr() {
-    return weak_ptr_factory_.GetWeakPtr();
-  }
 
  private:
   bool MouseLockedOrPendingAction() const {
-    return mouse_locked_ || pending_lock_request_ || pending_unlock_request_;
+    return mouse_lock_context_ || pending_lock_request_ ||
+           pending_unlock_request_;
   }
 
-  bool mouse_locked_;
+  void OnMouseLockLost();
+
   // If both |pending_lock_request_| and |pending_unlock_request_| are true,
   // it means a lock request was sent before an unlock request and we haven't
   // received responses for them. The logic in LockMouse() makes sure that a
   // lock request won't be sent when there is a pending unlock request.
   bool pending_lock_request_;
   bool pending_unlock_request_;
+  mojo::Remote<blink::mojom::PointerLockContext> mouse_lock_context_;
 
   blink::WebWidgetClient::PointerLockCallback lock_mouse_callback_;
 
@@ -97,8 +97,6 @@ class CONTENT_EXPORT MouseLockDispatcher {
   // when it is destroyed.
   LockTarget* target_;
 
-  base::WeakPtrFactory<MouseLockDispatcher> weak_ptr_factory_{this};
-
   DISALLOW_COPY_AND_ASSIGN(MouseLockDispatcher);
 };
 
diff --git a/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc b/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
index 0fb45b6dfa0..af32de7cafe 100644
--- a/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
+++ b/chromium/content/renderer/mouse_lock_dispatcher_browsertest.cc
@@ -8,6 +8,7 @@
 #include "content/public/test/render_view_test.h"
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/render_view_impl.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
@@ -25,6 +26,13 @@ class MockLockTarget : public MouseLockDispatcher::LockTarget {
                 bool(const blink::WebMouseEvent&));
 };
 
+class PointerLockContextImpl : public blink::mojom::PointerLockContext {
+ public:
+  void RequestMouseLockChange(
+      bool unadjusted_movement,
+      PointerLockContext::RequestMouseLockChangeCallback response) override {}
+};
+
 // MouseLockDispatcher is a RenderViewObserver, and we test it by creating a
 // fixture containing a RenderViewImpl view() and interacting to that interface.
 class MouseLockDispatcherTest : public RenderViewTest {
@@ -66,19 +74,27 @@ TEST_F(MouseLockDispatcherTest, BasicWebWidget) {
   EXPECT_TRUE(widget()->RequestPointerLock(
       view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(widget()->IsPointerLocked());
 
   // Unlock.
   widget()->RequestPointerUnlock();
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(widget()->IsPointerLocked());
 
   // Attempt a lock, and have it fail.
   EXPECT_TRUE(widget()->RequestPointerLock(
       view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
   EXPECT_FALSE(widget()->IsPointerLocked());
 }
 
@@ -98,22 +114,28 @@ TEST_F(MouseLockDispatcherTest, BasicMockLockTarget) {
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Receive mouse event.
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
 
   // Unlock.
-  dispatcher()->UnlockMouse(target_);
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 
   // Attempt a lock, and have it fail.
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
@@ -122,22 +144,28 @@ TEST_F(MouseLockDispatcherTest, DeleteAndUnlock) {
   ::testing::InSequence expect_calls_in_sequence;
   EXPECT_CALL(*target_, OnLockMouseACK(/*succeeded=*/true));
   EXPECT_CALL(*target_, HandleMouseLockedInputEvent(_)).Times(0);
-  EXPECT_CALL(*target_, OnMouseLockLost()).Times(0);
+  EXPECT_CALL(*target_, OnMouseLockLost()).Times(1);
 
   // Lock.
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
-  // Unlock, with a deleted target.
-  // Don't receive mouse events or lock lost.
+  // Unlock, with a deleted target and context destruction.
+  // Don't receive mouse events.
   dispatcher()->OnLockTargetDestroyed(target_);
   delete target_;
   target_ = nullptr;
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
@@ -158,7 +186,9 @@ TEST_F(MouseLockDispatcherTest, DeleteWithPendingLockSuccess) {
   target_ = nullptr;
 
   // Lock response.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> context;
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(context));
 }
 
 // Test deleting a target that is pending a lock request failure response.
@@ -178,7 +208,8 @@ TEST_F(MouseLockDispatcherTest, DeleteWithPendingLockFail) {
   target_ = nullptr;
 
   // Lock response.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError);
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kUnknownError,
+                               mojo::NullRemote());
 }
 
 // Test not receiving mouse events when a target is not locked.
@@ -197,15 +228,20 @@ TEST_F(MouseLockDispatcherTest, MouseEventsNotReceived) {
   EXPECT_TRUE(dispatcher()->LockMouse(
       target_, view()->GetMainRenderFrame()->GetWebFrame(), base::DoNothing(),
       false /* unadjusted_movement */));
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Receive mouse event.
   dispatcher()->WillHandleMouseEvent(blink::WebMouseEvent());
 
   // Unlock.
-  dispatcher()->UnlockMouse(target_);
-  widget()->PointerLockLost();
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 
   // (Don't) receive mouse event.
@@ -234,7 +270,14 @@ TEST_F(MouseLockDispatcherTest, MultipleTargets) {
       base::DoNothing(), false /* unadjusted_movement */));
 
   // Lock completion for target.
-  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess);
+
+  mojo::PendingRemote<blink::mojom::PointerLockContext> remote_context;
+  auto receiver_context = mojo::MakeSelfOwnedReceiver(
+      std::make_unique<PointerLockContextImpl>(),
+      remote_context.InitWithNewPipeAndPassReceiver());
+
+  dispatcher()->OnLockMouseACK(blink::mojom::PointerLockResult::kSuccess,
+                               std::move(remote_context));
   EXPECT_TRUE(dispatcher()->IsMouseLockedTo(target_));
 
   // Fail attempt to lock alternate.
@@ -252,9 +295,10 @@ TEST_F(MouseLockDispatcherTest, MultipleTargets) {
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(alternate_target_));
 
   // Though the call to UnlockMouse should not unlock any target, we will
-  // cause an unlock (as if e.g. user escaped mouse lock) and verify the
-  // correct target is unlocked.
-  widget()->PointerLockLost();
+  // cause an unlock by disconnecting the pipe (e.g. user escaped
+  // mouse lock) and verify the correct target is unlocked.
+  receiver_context->Close();
+  dispatcher()->FlushContextPipeForTesting();
   EXPECT_FALSE(dispatcher()->IsMouseLockedTo(target_));
 }
 
diff --git a/chromium/content/renderer/navigation_state.h b/chromium/content/renderer/navigation_state.h
index 0d505d791c9..375495ca33d 100644
--- a/chromium/content/renderer/navigation_state.h
+++ b/chromium/content/renderer/navigation_state.h
@@ -77,10 +77,6 @@ class CONTENT_EXPORT NavigationState {
     navigation_client_ = std::move(navigation_client_impl);
   }
 
-  void set_navigation_start(const base::TimeTicks& navigation_start) {
-    common_params_->navigation_start = navigation_start;
-  }
-
   void RunCommitNavigationCallback(blink::mojom::CommitResult result);
 
   void RunPerNavigationInterfaceCommitNavigationCallback(
diff --git a/chromium/content/renderer/pepper/DEPS b/chromium/content/renderer/pepper/DEPS
index 016a0618b4f..f39485257d4 100644
--- a/chromium/content/renderer/pepper/DEPS
+++ b/chromium/content/renderer/pepper/DEPS
@@ -9,4 +9,5 @@ include_rules = [
   "+third_party/opus",
   "+ui/base/ime",
   "+ui/base/range",
+  "+ui/events/keycodes/keyboard_codes.h",
 ]
diff --git a/chromium/content/renderer/pepper/audio_helper.cc b/chromium/content/renderer/pepper/audio_helper.cc
index d9c0b1d37bb..eb8462c7940 100644
--- a/chromium/content/renderer/pepper/audio_helper.cc
+++ b/chromium/content/renderer/pepper/audio_helper.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/audio_helper.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/pepper_file_util.h"
 #include "ppapi/c/pp_completion_callback.h"
 #include "ppapi/c/pp_errors.h"
diff --git a/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc b/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
index a7f102fe9f9..8892d3c050d 100644
--- a/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
+++ b/chromium/content/renderer/pepper/content_renderer_pepper_host_factory.cc
@@ -6,8 +6,9 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ptr_util.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "content/common/content_switches_internal.h"
diff --git a/chromium/content/renderer/pepper/event_conversion.cc b/chromium/content/renderer/pepper/event_conversion.cc
index b2df311ac6f..0f8b87b33d2 100644
--- a/chromium/content/renderer/pepper/event_conversion.cc
+++ b/chromium/content/renderer/pepper/event_conversion.cc
@@ -11,9 +11,10 @@
 #include <algorithm>
 #include <memory>
 
+#include "base/check_op.h"
 #include "base/feature_list.h"
 #include "base/i18n/char_iterator.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -95,40 +96,40 @@ static_assert(static_cast<int>(PP_INPUTEVENT_MODIFIER_ISRIGHT) ==
 
 PP_InputEvent_Type ConvertEventTypes(const WebInputEvent& event) {
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
+    case WebInputEvent::Type::kMouseDown:
       return PP_INPUTEVENT_TYPE_MOUSEDOWN;
-    case WebInputEvent::kMouseUp:
+    case WebInputEvent::Type::kMouseUp:
       return PP_INPUTEVENT_TYPE_MOUSEUP;
-    case WebInputEvent::kMouseMove:
+    case WebInputEvent::Type::kMouseMove:
       return PP_INPUTEVENT_TYPE_MOUSEMOVE;
-    case WebInputEvent::kMouseEnter:
+    case WebInputEvent::Type::kMouseEnter:
       return PP_INPUTEVENT_TYPE_MOUSEENTER;
-    case WebInputEvent::kMouseLeave:
+    case WebInputEvent::Type::kMouseLeave:
       return PP_INPUTEVENT_TYPE_MOUSELEAVE;
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kContextMenu:
       return PP_INPUTEVENT_TYPE_CONTEXTMENU;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       return PP_INPUTEVENT_TYPE_WHEEL;
-    case WebInputEvent::kRawKeyDown:
+    case WebInputEvent::Type::kRawKeyDown:
       // In the past blink has always returned kKeyDown passed into plugins
       // although PPAPI had a RAWKEYDOWN definition. However implementations are
       // broken now that blink passes kRawKeyDown so convert it to a keydown.
       return PP_INPUTEVENT_TYPE_KEYDOWN;
-    case WebInputEvent::kKeyDown:
+    case WebInputEvent::Type::kKeyDown:
       return PP_INPUTEVENT_TYPE_KEYDOWN;
-    case WebInputEvent::kKeyUp:
+    case WebInputEvent::Type::kKeyUp:
       return PP_INPUTEVENT_TYPE_KEYUP;
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kChar:
       return PP_INPUTEVENT_TYPE_CHAR;
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchStart:
       return PP_INPUTEVENT_TYPE_TOUCHSTART;
-    case WebInputEvent::kTouchMove:
+    case WebInputEvent::Type::kTouchMove:
       return PP_INPUTEVENT_TYPE_TOUCHMOVE;
-    case WebInputEvent::kTouchEnd:
+    case WebInputEvent::Type::kTouchEnd:
       return PP_INPUTEVENT_TYPE_TOUCHEND;
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchCancel:
       return PP_INPUTEVENT_TYPE_TOUCHCANCEL;
-    case WebInputEvent::kUndefined:
+    case WebInputEvent::Type::kUndefined:
     default:
       return PP_INPUTEVENT_TYPE_UNDEFINED;
   }
@@ -220,9 +221,9 @@ void AppendMouseEvent(const WebInputEvent& event,
   const WebMouseEvent& mouse_event = static_cast<const WebMouseEvent&>(event);
   InputEventData result = GetEventWithCommonFieldsAndType(event);
   result.event_modifiers = ConvertEventModifiers(mouse_event.GetModifiers());
-  if (mouse_event.GetType() == WebInputEvent::kMouseDown ||
-      mouse_event.GetType() == WebInputEvent::kMouseMove ||
-      mouse_event.GetType() == WebInputEvent::kMouseUp) {
+  if (mouse_event.GetType() == WebInputEvent::Type::kMouseDown ||
+      mouse_event.GetType() == WebInputEvent::Type::kMouseMove ||
+      mouse_event.GetType() == WebInputEvent::Type::kMouseUp) {
     switch (mouse_event.button) {
       case WebMouseEvent::Button::kNoButton:
       case WebMouseEvent::Button::kLeft:
@@ -240,7 +241,7 @@ void AppendMouseEvent(const WebInputEvent& event,
   result.mouse_click_count = mouse_event.click_count;
 
   if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY)) {
-    if (mouse_event.GetType() == WebInputEvent::kMouseMove &&
+    if (mouse_event.GetType() == WebInputEvent::Type::kMouseMove &&
         *in_out_last_mouse_position) {
       result.mouse_movement.x = mouse_event.PositionInScreen().x() -
                                 (*in_out_last_mouse_position)->x();
@@ -292,13 +293,13 @@ void SetPPTouchPoints(const WebTouchPoint* touches,
   for (uint32_t i = 0; i < touches_length; i++) {
     const WebTouchPoint& touch_point = touches[i];
     if (included_types == ACTIVE &&
-        (touch_point.state == WebTouchPoint::kStateReleased ||
-         touch_point.state == WebTouchPoint::kStateCancelled)) {
+        (touch_point.state == WebTouchPoint::State::kStateReleased ||
+         touch_point.state == WebTouchPoint::State::kStateCancelled)) {
       continue;
     }
     if (included_types == CHANGED &&
-        (touch_point.state == WebTouchPoint::kStateUndefined ||
-         touch_point.state == WebTouchPoint::kStateStationary)) {
+        (touch_point.state == WebTouchPoint::State::kStateUndefined ||
+         touch_point.state == WebTouchPoint::State::kStateStationary)) {
       continue;
     }
     PP_TouchPoint pp_pt;
@@ -397,24 +398,24 @@ void SetWebTouchPointsIfNotYetSet(
 
 WebTouchEvent* BuildTouchEvent(const InputEventData& event) {
   WebTouchEvent* web_event = new WebTouchEvent();
-  WebTouchPoint::State state = WebTouchPoint::kStateUndefined;
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebTouchPoint::State state = WebTouchPoint::State::kStateUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_TOUCHSTART:
-      type = WebInputEvent::kTouchStart;
-      state = WebTouchPoint::kStatePressed;
+      type = WebInputEvent::Type::kTouchStart;
+      state = WebTouchPoint::State::kStatePressed;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHMOVE:
-      type = WebInputEvent::kTouchMove;
-      state = WebTouchPoint::kStateMoved;
+      type = WebInputEvent::Type::kTouchMove;
+      state = WebTouchPoint::State::kStateMoved;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHEND:
-      type = WebInputEvent::kTouchEnd;
-      state = WebTouchPoint::kStateReleased;
+      type = WebInputEvent::Type::kTouchEnd;
+      state = WebTouchPoint::State::kStateReleased;
       break;
     case PP_INPUTEVENT_TYPE_TOUCHCANCEL:
-      type = WebInputEvent::kTouchCancel;
-      state = WebTouchPoint::kStateCancelled;
+      type = WebInputEvent::Type::kTouchCancel;
+      state = WebTouchPoint::State::kStateCancelled;
       break;
     default:
       NOTREACHED();
@@ -429,7 +430,8 @@ WebTouchEvent* BuildTouchEvent(const InputEventData& event) {
   // (stationary) touches.
   SetWebTouchPointsIfNotYetSet(event.changed_touches, state, web_event->touches,
                                &web_event->touches_length);
-  SetWebTouchPointsIfNotYetSet(event.touches, WebTouchPoint::kStateStationary,
+  SetWebTouchPointsIfNotYetSet(event.touches,
+                               WebTouchPoint::State::kStateStationary,
                                web_event->touches, &web_event->touches_length);
 
   return web_event;
@@ -439,13 +441,13 @@ WebKeyboardEvent* BuildKeyEvent(const InputEventData& event) {
   WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_RAWKEYDOWN:
-      type = WebInputEvent::kRawKeyDown;
+      type = WebInputEvent::Type::kRawKeyDown;
       break;
     case PP_INPUTEVENT_TYPE_KEYDOWN:
-      type = WebInputEvent::kKeyDown;
+      type = WebInputEvent::Type::kKeyDown;
       break;
     case PP_INPUTEVENT_TYPE_KEYUP:
-      type = WebInputEvent::kKeyUp;
+      type = WebInputEvent::Type::kKeyUp;
       break;
     default:
       NOTREACHED();
@@ -460,7 +462,7 @@ WebKeyboardEvent* BuildKeyEvent(const InputEventData& event) {
 
 WebKeyboardEvent* BuildCharEvent(const InputEventData& event) {
   WebKeyboardEvent* key_event = new WebKeyboardEvent(
-      WebInputEvent::kChar, event.event_modifiers,
+      WebInputEvent::Type::kChar, event.event_modifiers,
       base::TimeTicks() +
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
 
@@ -477,25 +479,25 @@ WebKeyboardEvent* BuildCharEvent(const InputEventData& event) {
 }
 
 WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (event.event_type) {
     case PP_INPUTEVENT_TYPE_MOUSEDOWN:
-      type = WebInputEvent::kMouseDown;
+      type = WebInputEvent::Type::kMouseDown;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEUP:
-      type = WebInputEvent::kMouseUp;
+      type = WebInputEvent::Type::kMouseUp;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEMOVE:
-      type = WebInputEvent::kMouseMove;
+      type = WebInputEvent::Type::kMouseMove;
       break;
     case PP_INPUTEVENT_TYPE_MOUSEENTER:
-      type = WebInputEvent::kMouseEnter;
+      type = WebInputEvent::Type::kMouseEnter;
       break;
     case PP_INPUTEVENT_TYPE_MOUSELEAVE:
-      type = WebInputEvent::kMouseLeave;
+      type = WebInputEvent::Type::kMouseLeave;
       break;
     case PP_INPUTEVENT_TYPE_CONTEXTMENU:
-      type = WebInputEvent::kContextMenu;
+      type = WebInputEvent::Type::kContextMenu;
       break;
     default:
       NOTREACHED();
@@ -506,7 +508,7 @@ WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
   mouse_event->pointer_type = blink::WebPointerProperties::PointerType::kMouse;
   mouse_event->button = static_cast<WebMouseEvent::Button>(event.mouse_button);
-  if (mouse_event->GetType() == WebInputEvent::kMouseMove) {
+  if (mouse_event->GetType() == WebInputEvent::Type::kMouseMove) {
     if (mouse_event->GetModifiers() & WebInputEvent::kLeftButtonDown)
       mouse_event->button = WebMouseEvent::Button::kLeft;
     else if (mouse_event->GetModifiers() & WebInputEvent::kMiddleButtonDown)
@@ -524,7 +526,7 @@ WebMouseEvent* BuildMouseEvent(const InputEventData& event) {
 
 WebMouseWheelEvent* BuildMouseWheelEvent(const InputEventData& event) {
   WebMouseWheelEvent* mouse_wheel_event = new WebMouseWheelEvent(
-      WebInputEvent::kMouseWheel, event.event_modifiers,
+      WebInputEvent::Type::kMouseWheel, event.event_modifiers,
       base::TimeTicks() +
           base::TimeDelta::FromSecondsD(event.event_time_stamp));
   mouse_wheel_event->delta_x = event.wheel_delta.x;
@@ -558,7 +560,7 @@ WebMouseWheelEvent* BuildMouseWheelEvent(const InputEventData& event) {
 #endif
 
 // Convert a character string to a Windows virtual key code. Adapted from
-// src/content/shell/test_runner/event_sender.cc. This
+// src/content/shell/renderer/web_test/event_sender.cc. This
 // is used by CreateSimulatedWebInputEvents to convert keyboard events.
 void GetKeyCode(const std::string& char_text,
                 uint16_t* code,
@@ -630,32 +632,32 @@ void CreateInputEventData(
   result->clear();
 
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
-    case WebInputEvent::kMouseUp:
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kMouseEnter:
-    case WebInputEvent::kMouseLeave:
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kMouseDown:
+    case WebInputEvent::Type::kMouseUp:
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kMouseEnter:
+    case WebInputEvent::Type::kMouseLeave:
+    case WebInputEvent::Type::kContextMenu:
       AppendMouseEvent(event, in_out_last_mouse_position, result);
       break;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       AppendMouseWheelEvent(event, result);
       break;
-    case WebInputEvent::kRawKeyDown:
-    case WebInputEvent::kKeyDown:
-    case WebInputEvent::kKeyUp:
+    case WebInputEvent::Type::kRawKeyDown:
+    case WebInputEvent::Type::kKeyDown:
+    case WebInputEvent::Type::kKeyUp:
       AppendKeyEvent(event, result);
       break;
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kChar:
       AppendCharEvent(event, result);
       break;
-    case WebInputEvent::kTouchStart:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kTouchEnd:
-    case WebInputEvent::kTouchCancel:
+    case WebInputEvent::Type::kTouchStart:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kTouchEnd:
+    case WebInputEvent::Type::kTouchCancel:
       AppendTouchEvent(event, result);
       break;
-    case WebInputEvent::kUndefined:
+    case WebInputEvent::Type::kUndefined:
     default:
       break;
   }
@@ -705,7 +707,7 @@ WebInputEvent* CreateWebInputEvent(const InputEventData& event) {
 }
 
 // Generate a coherent sequence of input events to simulate a user event.
-// From src/content/shell/test_runner/event_sender.cc.
+// From src/content/shell/renderer/web_test/event_sender.cc.
 std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
     const ppapi::InputEventData& event,
     int plugin_x,
@@ -729,7 +731,8 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
           static_cast<blink::WebTouchEvent*>(original_event.get());
       for (unsigned i = 0; i < touch_event->touches_length; ++i) {
         const blink::WebTouchPoint& touch_point = touch_event->touches[i];
-        if (touch_point.state != blink::WebTouchPoint::kStateStationary) {
+        if (touch_point.state !=
+            blink::WebTouchPoint::State::kStateStationary) {
           events.push_back(
               std::make_unique<WebPointerEvent>(*touch_event, touch_point));
         }
@@ -750,8 +753,8 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 #if defined(OS_WIN)
       WebKeyboardEvent* web_keyboard_event =
           static_cast<WebKeyboardEvent*>(original_event.get());
-      if (web_keyboard_event->GetType() == WebInputEvent::kKeyDown)
-        web_keyboard_event->SetType(WebInputEvent::kRawKeyDown);
+      if (web_keyboard_event->GetType() == WebInputEvent::Type::kKeyDown)
+        web_keyboard_event->SetType(WebInputEvent::Type::kRawKeyDown);
 #endif
       events.push_back(std::move(original_event));
       break;
@@ -771,7 +774,7 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 
       // Synthesize key down and key up events in all cases.
       std::unique_ptr<WebKeyboardEvent> key_down_event(new WebKeyboardEvent(
-          WebInputEvent::kRawKeyDown,
+          WebInputEvent::Type::kRawKeyDown,
           needs_shift_modifier ? WebInputEvent::kShiftKey
                                : WebInputEvent::kNoModifiers,
           web_char_event->TimeStamp()));
@@ -791,11 +794,11 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
       events.push_back(std::move(key_down_event));
 
       if (generate_char) {
-        web_char_event->SetType(WebInputEvent::kChar);
+        web_char_event->SetType(WebInputEvent::Type::kChar);
         events.push_back(std::move(original_event));
       }
 
-      key_up_event->SetType(WebInputEvent::kKeyUp);
+      key_up_event->SetType(WebInputEvent::Type::kKeyUp);
       events.push_back(std::move(key_up_event));
       break;
     }
@@ -808,26 +811,26 @@ std::vector<std::unique_ptr<WebInputEvent>> CreateSimulatedWebInputEvents(
 
 PP_InputEvent_Class ClassifyInputEvent(const WebInputEvent& event) {
   switch (event.GetType()) {
-    case WebInputEvent::kMouseDown:
-    case WebInputEvent::kMouseUp:
-    case WebInputEvent::kMouseMove:
-    case WebInputEvent::kMouseEnter:
-    case WebInputEvent::kMouseLeave:
-    case WebInputEvent::kContextMenu:
+    case WebInputEvent::Type::kMouseDown:
+    case WebInputEvent::Type::kMouseUp:
+    case WebInputEvent::Type::kMouseMove:
+    case WebInputEvent::Type::kMouseEnter:
+    case WebInputEvent::Type::kMouseLeave:
+    case WebInputEvent::Type::kContextMenu:
       return PP_INPUTEVENT_CLASS_MOUSE;
-    case WebInputEvent::kMouseWheel:
+    case WebInputEvent::Type::kMouseWheel:
       return PP_INPUTEVENT_CLASS_WHEEL;
-    case WebInputEvent::kRawKeyDown:
-    case WebInputEvent::kKeyDown:
-    case WebInputEvent::kKeyUp:
-    case WebInputEvent::kChar:
+    case WebInputEvent::Type::kRawKeyDown:
+    case WebInputEvent::Type::kKeyDown:
+    case WebInputEvent::Type::kKeyUp:
+    case WebInputEvent::Type::kChar:
       return PP_INPUTEVENT_CLASS_KEYBOARD;
-    case WebInputEvent::kTouchCancel:
-    case WebInputEvent::kTouchEnd:
-    case WebInputEvent::kTouchMove:
-    case WebInputEvent::kTouchStart:
+    case WebInputEvent::Type::kTouchCancel:
+    case WebInputEvent::Type::kTouchEnd:
+    case WebInputEvent::Type::kTouchMove:
+    case WebInputEvent::Type::kTouchStart:
       return PP_INPUTEVENT_CLASS_TOUCH;
-    case WebInputEvent::kTouchScrollStarted:
+    case WebInputEvent::Type::kTouchScrollStarted:
       return PP_InputEvent_Class(0);
     default:
       CHECK(WebInputEvent::IsGestureEventType(event.GetType()));
diff --git a/chromium/content/renderer/pepper/event_conversion_unittest.cc b/chromium/content/renderer/pepper/event_conversion_unittest.cc
index 29af5d533c0..f1cb3204a76 100644
--- a/chromium/content/renderer/pepper/event_conversion_unittest.cc
+++ b/chromium/content/renderer/pepper/event_conversion_unittest.cc
@@ -8,7 +8,6 @@
 
 #include <memory>
 
-#include "base/logging.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "ppapi/shared_impl/ppb_input_event_shared.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -155,7 +154,7 @@ TEST_F(EventConversionTest, TouchCancel) {
 TEST_F(EventConversionTest, MouseMove) {
   std::unique_ptr<gfx::PointF> last_mouse_position;
   blink::WebMouseEvent mouse_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 100, 200, 0);
+      blink::WebInputEvent::Type::kMouseMove, 100, 200, 0);
 
   std::vector<ppapi::InputEventData> pp_events;
   CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
@@ -172,7 +171,7 @@ TEST_F(EventConversionTest, MouseMove) {
   }
 
   mouse_event = SyntheticWebMouseEventBuilder::Build(
-      blink::WebInputEvent::kMouseMove, 123, 188, 0);
+      blink::WebInputEvent::Type::kMouseMove, 123, 188, 0);
   CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
   ASSERT_EQ(PP_INPUTEVENT_TYPE_MOUSEMOVE, pp_event.event_type);
   ASSERT_EQ(pp_event.mouse_position.x, mouse_event.PositionInWidget().x());
diff --git a/chromium/content/renderer/pepper/host_array_buffer_var.cc b/chromium/content/renderer/pepper/host_array_buffer_var.cc
index ddd173ae68e..729d28de884 100644
--- a/chromium/content/renderer/pepper/host_array_buffer_var.cc
+++ b/chromium/content/renderer/pepper/host_array_buffer_var.cc
@@ -9,7 +9,6 @@
 
 #include <memory>
 
-#include "base/logging.h"
 #include "base/memory/shared_memory_mapping.h"
 #include "base/memory/unsafe_shared_memory_region.h"
 #include "base/process/process_handle.h"
diff --git a/chromium/content/renderer/pepper/host_var_tracker.cc b/chromium/content/renderer/pepper/host_var_tracker.cc
index 9141cc4618a..089cb866c1e 100644
--- a/chromium/content/renderer/pepper/host_var_tracker.cc
+++ b/chromium/content/renderer/pepper/host_var_tracker.cc
@@ -6,7 +6,8 @@
 
 #include <tuple>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/host_array_buffer_var.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/host_resource_var.h"
diff --git a/chromium/content/renderer/pepper/pepper_audio_input_host.cc b/chromium/content/renderer/pepper/pepper_audio_input_host.cc
index 75700b8a20f..6e183116bde 100644
--- a/chromium/content/renderer/pepper/pepper_audio_input_host.cc
+++ b/chromium/content/renderer/pepper/pepper_audio_input_host.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/pepper_audio_input_host.h"
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "build/build_config.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
diff --git a/chromium/content/renderer/pepper/pepper_audio_output_host.cc b/chromium/content/renderer/pepper/pepper_audio_output_host.cc
index 472731e6a89..40a2b3b41fd 100644
--- a/chromium/content/renderer/pepper/pepper_audio_output_host.cc
+++ b/chromium/content/renderer/pepper/pepper_audio_output_host.cc
@@ -4,7 +4,8 @@
 
 #include "content/renderer/pepper/pepper_audio_output_host.h"
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "build/build_config.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/pepper/pepper_audio_controller.h"
diff --git a/chromium/content/renderer/pepper/pepper_broker_unittest.cc b/chromium/content/renderer/pepper/pepper_broker_unittest.cc
index 0592f73e9e0..96e0b880f5e 100644
--- a/chromium/content/renderer/pepper/pepper_broker_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_broker_unittest.cc
@@ -11,7 +11,7 @@
 
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
-#include "content/test/mock_render_process.h"
+#include "content/renderer/render_process.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -22,7 +22,7 @@ class PepperBrokerTest : public ::testing::Test {
       : task_environment_(base::test::TaskEnvironment::MainThreadType::IO) {}
   base::test::TaskEnvironment task_environment_;
   // We need a render process for ppapi::proxy::ProxyChannel to work.
-  MockRenderProcess mock_process_;
+  RenderProcess process_;
 };
 
 // Try to initialize PepperBrokerDispatcherWrapper with invalid ChannelHandle.
diff --git a/chromium/content/renderer/pepper/pepper_browser_connection.cc b/chromium/content/renderer/pepper/pepper_browser_connection.cc
index dbb3a94e3f6..1c26446a2e5 100644
--- a/chromium/content/renderer/pepper/pepper_browser_connection.cc
+++ b/chromium/content/renderer/pepper/pepper_browser_connection.cc
@@ -6,7 +6,7 @@
 
 #include <limits>
 
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "content/common/frame_messages.h"
 #include "content/renderer/pepper/pepper_in_process_router.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
index 3d3fd0580fd..ae714b7897e 100644
--- a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
+++ b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_device_enumeration_host_helper.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
index 6ee9f765ab9..feefd15086e 100644
--- a/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
@@ -7,8 +7,8 @@
 
 #include <map>
 
+#include "base/check.h"
 #include "base/compiler_specific.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
diff --git a/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc b/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
index 354a6e5dbf4..1179913ffc5 100644
--- a/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
+++ b/chromium/content/renderer/pepper/pepper_graphics_2d_host.cc
@@ -8,8 +8,8 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/read_only_shared_memory_region.h"
 #include "base/numerics/checked_math.h"
 #include "base/single_thread_task_runner.h"
@@ -705,7 +705,8 @@ bool PepperGraphics2DHost::PrepareTransferableResource(
                           viz::ResourceFormatToClosestSkColorType(true, format),
                           kUnknown_SkAlphaType);
     ri->WaitSyncTokenCHROMIUM(in_sync_token.GetConstData());
-    ri->WritePixels(gpu_mailbox, 0, 0, texture_target, src_info, src);
+    ri->WritePixels(gpu_mailbox, 0, 0, texture_target, src_info.minRowBytes(),
+                    src_info, src);
 
     gpu::SyncToken out_sync_token;
     ri->GenUnverifiedSyncTokenCHROMIUM(out_sync_token.GetData());
diff --git a/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc b/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
index 29331380673..bd311fdc583 100644
--- a/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
+++ b/chromium/content/renderer/pepper/pepper_in_process_resource_creation.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_in_process_resource_creation.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
 #include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
 #include "content/child/browser_font_resource_trusted.h"
 #include "content/renderer/pepper/pepper_in_process_router.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_device_manager.cc b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
index 9b90bc48692..c00f38126ad 100644
--- a/chromium/content/renderer/pepper/pepper_media_device_manager.cc
+++ b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
@@ -5,9 +5,10 @@
 #include "content/renderer/pepper/pepper_media_device_manager.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/feature_list.h"
 #include "base/location.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_task_runner_handle.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc b/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
index af26f982e6a..5a8bc7db9ac 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_audio_track_host.cc
@@ -7,8 +7,8 @@
 #include <algorithm>
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/numerics/safe_math.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc b/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
index 6d205fb5659..25fbe3563e1 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_track_host_base.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/memory/unsafe_shared_memory_region.h"
 #include "base/numerics/safe_math.h"
 #include "content/common/pepper_file_util.h"
diff --git a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
index 807a126f1d3..adcc1128610 100644
--- a/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
+++ b/chromium/content/renderer/pepper/pepper_media_stream_video_track_host.cc
@@ -537,8 +537,8 @@ void PepperMediaStreamVideoTrackHost::InitBlinkTrack() {
   const bool enabled = true;
   track_ = blink::MediaStreamVideoTrack::CreateVideoTrack(
       source,
-      base::BindRepeating(&PepperMediaStreamVideoTrackHost::OnTrackStarted,
-                          base::Unretained(this)),
+      base::BindOnce(&PepperMediaStreamVideoTrackHost::OnTrackStarted,
+                     base::Unretained(this)),
       enabled);
   // Note: The call to CreateVideoTrack() returned a track that holds a
   // ref-counted reference to |webkit_source| (and, implicitly, |source|).
diff --git a/chromium/content/renderer/pepper/pepper_platform_audio_input.cc b/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
index 41016baca10..3a0d7f90fdd 100644
--- a/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_audio_input.cc
@@ -5,8 +5,8 @@
 #include "content/renderer/pepper/pepper_platform_audio_input.h"
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_audio_output.cc b/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
index 10d99da1cea..8a058d19b27 100644
--- a/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_audio_output.cc
@@ -5,8 +5,9 @@
 #include "content/renderer/pepper/pepper_platform_audio_output.h"
 
 #include "base/bind.h"
+#include "base/check_op.h"
 #include "base/location.h"
-#include "base/logging.h"
+#include "base/notreached.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_camera_device.cc b/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
index 8b8cb288861..35aff32c3eb 100644
--- a/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_camera_device.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/pepper/gfx_conversion.h"
 #include "content/renderer/pepper/pepper_camera_device_host.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
diff --git a/chromium/content/renderer/pepper/pepper_platform_video_capture.cc b/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
index 72dd4ce3f39..ab6546536be 100644
--- a/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
+++ b/chromium/content/renderer/pepper/pepper_platform_video_capture.cc
@@ -5,8 +5,9 @@
 #include "content/renderer/pepper/pepper_platform_video_capture.h"
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
 #include "content/renderer/pepper/pepper_video_capture_host.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 44680376952..e0a663c1e38 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -91,14 +91,15 @@
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_buffer_api.h"
 #include "printing/buildflags/buildflags.h"
+#include "printing/mojom/print.mojom.h"
 #include "skia/ext/platform_canvas.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
 #include "third_party/blink/public/common/input/web_pointer_event.h"
 #include "third_party/blink/public/common/input/web_touch_event.h"
 #include "third_party/blink/public/platform/url_conversion.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
@@ -328,8 +329,8 @@ std::unique_ptr<const char* []> StringVectorToArgArray(
 // for things like screen brightness and volume control.
 bool IsReservedSystemInputEvent(const blink::WebInputEvent& event) {
 #if defined(OS_CHROMEOS)
-  if (event.GetType() != WebInputEvent::kKeyDown &&
-      event.GetType() != WebInputEvent::kKeyUp)
+  if (event.GetType() != WebInputEvent::Type::kKeyDown &&
+      event.GetType() != WebInputEvent::Type::kKeyUp)
     return false;
   const blink::WebKeyboardEvent& key_event =
       static_cast<const blink::WebKeyboardEvent&>(event);
@@ -388,6 +389,13 @@ void PrintPDFOutput(PP_Resource print_output,
 #endif  // BUILDFLAG(ENABLE_PRINTING)
 }
 
+constexpr char kChromePrint[] = "chrome://print/";
+
+bool IsPrintPreviewUrl(const GURL& document_url) {
+  return url::Origin::Create(document_url.GetOrigin()) ==
+         url::Origin::Create(GURL(kChromePrint));
+}
+
 }  // namespace
 
 // static
@@ -1109,7 +1117,7 @@ bool PepperPluginInstanceImpl::HandleInputEvent(
     return false;
 
   if (!has_been_clicked_ && is_flash_plugin_ &&
-      event.GetType() == blink::WebInputEvent::kMouseDown &&
+      event.GetType() == blink::WebInputEvent::Type::kMouseDown &&
       (event.GetModifiers() & blink::WebInputEvent::kLeftButtonDown)) {
     has_been_clicked_ = true;
   }
@@ -2013,16 +2021,17 @@ bool PepperPluginInstanceImpl::GetPrintPresetOptionsFromDocument(
   preset_options->is_scaling_disabled = PP_ToBool(options.is_scaling_disabled);
   switch (options.duplex) {
     case PP_PRIVATEDUPLEXMODE_SIMPLEX:
-      preset_options->duplex_mode = blink::kWebSimplex;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kSimplex;
       break;
     case PP_PRIVATEDUPLEXMODE_SHORT_EDGE:
-      preset_options->duplex_mode = blink::kWebShortEdge;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kShortEdge;
       break;
     case PP_PRIVATEDUPLEXMODE_LONG_EDGE:
-      preset_options->duplex_mode = blink::kWebLongEdge;
+      preset_options->duplex_mode = printing::mojom::DuplexMode::kLongEdge;
       break;
     default:
-      preset_options->duplex_mode = blink::kWebUnknownDuplexMode;
+      preset_options->duplex_mode =
+          printing::mojom::DuplexMode::kUnknownDuplexMode;
       break;
   }
   preset_options->copies = options.copies;
@@ -2229,6 +2238,12 @@ void PepperPluginInstanceImpl::OnHiddenForPlaceholder(bool hidden) {
   UpdateLayer(false /* device_changed */);
 }
 
+bool PepperPluginInstanceImpl::SupportsKeyboardFocus() {
+  // Only PDF plugin supports keyboard focus. PDF plugin shouldn't be focusable
+  // if it's embedded in Print Preview.
+  return LoadPdfInterface() && !IsPrintPreviewUrl(document_url_);
+}
+
 void PepperPluginInstanceImpl::AddPluginObject(PluginObject* plugin_object) {
   DCHECK(live_plugin_objects_.find(plugin_object) ==
          live_plugin_objects_.end());
@@ -2279,8 +2294,9 @@ void PepperPluginInstanceImpl::SimulateInputEvent(
       CreateSimulatedWebInputEvents(
           input_event, view_data_.rect.point.x + view_data_.rect.size.width / 2,
           view_data_.rect.point.y + view_data_.rect.size.height / 2);
-  for (auto it = events.begin(); it != events.end(); ++it) {
-    widget->HandleInputEvent(blink::WebCoalescedInputEvent(*it->get()));
+  for (auto& event : events) {
+    widget->HandleInputEvent(
+        blink::WebCoalescedInputEvent(std::move(event), ui::LatencyInfo()));
   }
   if (input_event.event_type == PP_INPUTEVENT_TYPE_TOUCHSTART ||
       input_event.event_type == PP_INPUTEVENT_TYPE_TOUCHMOVE ||
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
index e358c31ec0e..4409f64a62d 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
@@ -63,8 +63,8 @@
 #include "third_party/blink/public/web/web_plugin.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/cursor/cursor.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/ime/text_input_type.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
 #include "ui/gfx/geometry/rect.h"
 #include "url/gurl.h"
 #include "v8/include/v8.h"
@@ -522,6 +522,8 @@ class CONTENT_EXPORT PepperPluginInstanceImpl
   // Should be used only for logging.
   bool is_flash_plugin() const { return is_flash_plugin_; }
 
+  bool SupportsKeyboardFocus();
+
  private:
   friend class base::RefCounted<PepperPluginInstanceImpl>;
   friend class PpapiPluginInstanceTest;
diff --git a/chromium/content/renderer/pepper/pepper_url_request_unittest.cc b/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
index 8286b7e126d..901bfa697bc 100644
--- a/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_url_request_unittest.cc
@@ -76,6 +76,22 @@ class URLRequestInfoTest : public RenderViewTest {
     return web_request.GetRequestContext();
   }
 
+  network::mojom::RequestDestination GetDestination() {
+    WebURLRequest web_request;
+    URLRequestInfoData data = info_->GetData();
+    if (!CreateWebURLRequest(pp_instance_, &data, GetMainFrame(), &web_request))
+      return network::mojom::RequestDestination::kEmpty;
+    return web_request.GetRequestDestination();
+  }
+
+  network::mojom::RequestMode GetMode() {
+    WebURLRequest web_request;
+    URLRequestInfoData data = info_->GetData();
+    if (!CreateWebURLRequest(pp_instance_, &data, GetMainFrame(), &web_request))
+      return network::mojom::RequestMode::kNavigate;
+    return web_request.GetMode();
+  }
+
   WebString GetHeaderValue(const char* field) {
     WebURLRequest web_request;
     URLRequestInfoData data = info_->GetData();
@@ -214,9 +230,11 @@ TEST_F(URLRequestInfoTest, SetHeaders) {
   EXPECT_STREQ("baz", GetHeaderValue("bar").Utf8().data());
 }
 
-TEST_F(URLRequestInfoTest, RequestContext) {
-  // Test context is PLUGIN.
+TEST_F(URLRequestInfoTest, RequestContextAndDestination) {
+  // Test context and destination for PLUGIN.
   EXPECT_EQ(blink::mojom::RequestContextType::PLUGIN, GetContext());
+  EXPECT_EQ(network::mojom::RequestDestination::kEmbed, GetDestination());
+  EXPECT_EQ(network::mojom::RequestMode::kNoCors, GetMode());
 }
 
 // TODO(bbudge) Unit tests for AppendDataToBody, AppendFileToBody.
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
index b42240a5792..57d85b9f56a 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
@@ -13,6 +13,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/pepper/message_channel.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
@@ -23,9 +24,12 @@
 #include "content/renderer/renderer_blink_platform_impl.h"
 #include "ppapi/shared_impl/ppapi_globals.h"
 #include "ppapi/shared_impl/var_tracker.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/common/input/web_input_event.h"
+#include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+#include "third_party/blink/public/mojom/input/focus_type.mojom.h"
 #include "third_party/blink/public/platform/platform.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_size.h"
 #include "third_party/blink/public/web/web_associated_url_loader_client.h"
@@ -37,6 +41,8 @@
 #include "third_party/blink/public/web/web_print_params.h"
 #include "third_party/blink/public/web/web_print_preset_options.h"
 #include "third_party/blink/public/web/web_print_scaling_option.h"
+#include "ui/base/cursor/cursor.h"
+#include "ui/events/keycodes/keyboard_codes.h"
 #include "url/gurl.h"
 
 using ppapi::V8ObjectVar;
@@ -187,6 +193,10 @@ v8::Local<v8::Object> PepperWebPluginImpl::V8ScriptableObject(
   return result;
 }
 
+bool PepperWebPluginImpl::SupportsKeyboardFocus() const {
+  return instance_ && instance_->SupportsKeyboardFocus();
+}
+
 void PepperWebPluginImpl::Paint(cc::PaintCanvas* canvas, const WebRect& rect) {
   // Re-entrancy may cause JS to try to execute script on the plugin before it
   // is fully initialized. See: crbug.com/715747.
@@ -208,8 +218,33 @@ void PepperWebPluginImpl::UpdateFocus(bool focused,
                                       blink::mojom::FocusType focus_type) {
   // Re-entrancy may cause JS to try to execute script on the plugin before it
   // is fully initialized. See: crbug.com/715747.
-  if (instance_)
+  if (instance_) {
     instance_->SetWebKitFocus(focused);
+
+    if (focused && instance_->SupportsKeyboardFocus()) {
+      switch (focus_type) {
+        case blink::mojom::FocusType::kForward:
+        case blink::mojom::FocusType::kBackward: {
+          int modifiers = blink::WebInputEvent::kNoModifiers;
+          if (focus_type == blink::mojom::FocusType::kBackward)
+            modifiers |= blink::WebInputEvent::kShiftKey;
+          // As part of focus management for plugin, blink brings plugin to
+          // focus but does not forward the tab event to plugin. Hence
+          // simulating tab event here to enable seamless tabbing across UI &
+          // plugin.
+          blink::WebKeyboardEvent simulated_event(
+              blink::WebInputEvent::Type::kKeyDown, modifiers,
+              base::TimeTicks());
+          simulated_event.windows_key_code = ui::KeyboardCode::VKEY_TAB;
+          ui::Cursor cursor;
+          instance_->HandleInputEvent(simulated_event, &cursor);
+          break;
+        }
+        default:
+          break;
+      }
+    }
+  }
 }
 
 void PepperWebPluginImpl::UpdateVisibility(bool visible) {}
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.h b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
index 03a48405c7b..1e751f4cd57 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.h
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
@@ -44,6 +44,7 @@ class PepperWebPluginImpl : public blink::WebPlugin {
   bool Initialize(blink::WebPluginContainer* container) override;
   void Destroy() override;
   v8::Local<v8::Object> V8ScriptableObject(v8::Isolate* isolate) override;
+  bool SupportsKeyboardFocus() const override;
   void UpdateAllLifecyclePhases(blink::DocumentUpdateReason) override {}
   void Paint(cc::PaintCanvas* canvas, const blink::WebRect& rect) override;
   void UpdateGeometry(const blink::WebRect& window_rect,
diff --git a/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc b/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
index 9af6c928ab7..dd4d081d31b 100644
--- a/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
+++ b/chromium/content/renderer/pepper/plugin_instance_throttler_impl.cc
@@ -161,7 +161,7 @@ void PluginInstanceThrottlerImpl::Initialize(
         observer.OnPeripheralStateChange();
 
       if (status == RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_BIG)
-        frame->WhitelistContentOrigin(content_origin);
+        frame->AllowlistContentOrigin(content_origin);
 
       return;
     }
@@ -172,7 +172,7 @@ void PluginInstanceThrottlerImpl::Initialize(
         content_origin,
         base::BindOnce(&PluginInstanceThrottlerImpl::MarkPluginEssential,
                        weak_factory_.GetWeakPtr(),
-                       UNTHROTTLE_METHOD_BY_WHITELIST));
+                       UNTHROTTLE_METHOD_BY_ALLOWLIST));
   }
 }
 
@@ -206,7 +206,7 @@ bool PluginInstanceThrottlerImpl::ConsumeInputEvent(
     return false;
 
   if (state_ != THROTTLER_STATE_MARKED_ESSENTIAL &&
-      event.GetType() == blink::WebInputEvent::kMouseUp &&
+      event.GetType() == blink::WebInputEvent::Type::kMouseUp &&
       (event.GetModifiers() & blink::WebInputEvent::kLeftButtonDown)) {
     bool was_throttled = IsThrottled();
     MarkPluginEssential(UNTHROTTLE_METHOD_BY_CLICK);
diff --git a/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc b/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
index ad67ea66949..dcf187803f9 100644
--- a/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
+++ b/chromium/content/renderer/pepper/plugin_instance_throttler_impl_unittest.cc
@@ -7,8 +7,8 @@
 #include <memory>
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/test/task_environment.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
@@ -54,9 +54,9 @@ class PluginInstanceThrottlerImplTest
     return throttler_.get();
   }
 
-  void DisablePowerSaverByRetroactiveWhitelist() {
+  void DisablePowerSaverByRetroactiveAllowlist() {
     throttler()->MarkPluginEssential(
-        PluginInstanceThrottlerImpl::UNTHROTTLE_METHOD_BY_WHITELIST);
+        PluginInstanceThrottlerImpl::UNTHROTTLE_METHOD_BY_ALLOWLIST);
   }
 
   int change_callback_calls() { return change_callback_calls_; }
@@ -145,18 +145,18 @@ TEST_F(PluginInstanceThrottlerImplTest, IgnoreThrottlingAfterMouseUp) {
   EXPECT_EQ(0, change_callback_calls());
 }
 
-TEST_F(PluginInstanceThrottlerImplTest, FastWhitelisting) {
+TEST_F(PluginInstanceThrottlerImplTest, FastAllowlisting) {
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 
-  DisablePowerSaverByRetroactiveWhitelist();
+  DisablePowerSaverByRetroactiveAllowlist();
 
   EngageThrottle();
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 }
 
-TEST_F(PluginInstanceThrottlerImplTest, SlowWhitelisting) {
+TEST_F(PluginInstanceThrottlerImplTest, SlowAllowlisting) {
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(0, change_callback_calls());
 
@@ -164,7 +164,7 @@ TEST_F(PluginInstanceThrottlerImplTest, SlowWhitelisting) {
   EXPECT_TRUE(throttler()->IsThrottled());
   EXPECT_EQ(1, change_callback_calls());
 
-  DisablePowerSaverByRetroactiveWhitelist();
+  DisablePowerSaverByRetroactiveAllowlist();
   EXPECT_FALSE(throttler()->IsThrottled());
   EXPECT_EQ(2, change_callback_calls());
 }
diff --git a/chromium/content/renderer/pepper/plugin_object.cc b/chromium/content/renderer/pepper/plugin_object.cc
index 7c36cd0abdb..09e8e8f1056 100644
--- a/chromium/content/renderer/pepper/plugin_object.cc
+++ b/chromium/content/renderer/pepper/plugin_object.cc
@@ -9,8 +9,9 @@
 #include <memory>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
index 3d3cc75e47c..4b088e4634f 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
@@ -49,15 +49,15 @@ void PluginPowerSaverHelper::DidCommitProvisionalLoad(
   if (frame->Parent() || is_same_document_navigation)
     return;  // Not a top-level navigation.
 
-  origin_whitelist_.clear();
+  origin_allowlist_.clear();
 }
 
 bool PluginPowerSaverHelper::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PluginPowerSaverHelper, message)
-  IPC_MESSAGE_HANDLER(FrameMsg_UpdatePluginContentOriginWhitelist,
-                      OnUpdatePluginContentOriginWhitelist)
-  IPC_MESSAGE_UNHANDLED(handled = false)
+    IPC_MESSAGE_HANDLER(FrameMsg_UpdatePluginContentOriginAllowlist,
+                        OnUpdatePluginContentOriginAllowlist)
+    IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
 }
@@ -66,14 +66,14 @@ void PluginPowerSaverHelper::OnDestruct() {
   delete this;
 }
 
-void PluginPowerSaverHelper::OnUpdatePluginContentOriginWhitelist(
-    const std::set<url::Origin>& origin_whitelist) {
-  origin_whitelist_ = origin_whitelist;
+void PluginPowerSaverHelper::OnUpdatePluginContentOriginAllowlist(
+    const std::set<url::Origin>& origin_allowlist) {
+  origin_allowlist_ = origin_allowlist;
 
   // Check throttled plugin instances to see if any can be unthrottled.
   auto it = peripheral_plugins_.begin();
   while (it != peripheral_plugins_.end()) {
-    if (origin_whitelist.count(it->content_origin)) {
+    if (origin_allowlist.count(it->content_origin)) {
       // Because the unthrottle callback may register another peripheral plugin
       // and invalidate our iterator, we cannot run it synchronously.
       render_frame()
@@ -105,12 +105,12 @@ PluginPowerSaverHelper::GetPeripheralContentStatus(
   }
 
   return PeripheralContentHeuristic::GetPeripheralStatus(
-      origin_whitelist_, main_frame_origin, content_origin, unobscured_size);
+      origin_allowlist_, main_frame_origin, content_origin, unobscured_size);
 }
 
-void PluginPowerSaverHelper::WhitelistContentOrigin(
+void PluginPowerSaverHelper::AllowlistContentOrigin(
     const url::Origin& content_origin) {
-  if (origin_whitelist_.insert(content_origin).second) {
+  if (origin_allowlist_.insert(content_origin).second) {
     Send(new FrameHostMsg_PluginContentOriginAllowed(
         render_frame()->GetRoutingID(), content_origin));
   }
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper.h b/chromium/content/renderer/pepper/plugin_power_saver_helper.h
index ba682b0a501..ff8497e7c15 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper.h
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper.h
@@ -49,7 +49,7 @@ class CONTENT_EXPORT PluginPowerSaverHelper : public RenderFrameObserver {
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size,
       RenderFrame::RecordPeripheralDecision record_decision) const;
-  void WhitelistContentOrigin(const url::Origin& content_origin);
+  void AllowlistContentOrigin(const url::Origin& content_origin);
 
   // RenderFrameObserver implementation.
   void DidCommitProvisionalLoad(bool is_same_document_navigation,
@@ -57,11 +57,11 @@ class CONTENT_EXPORT PluginPowerSaverHelper : public RenderFrameObserver {
   bool OnMessageReceived(const IPC::Message& message) override;
   void OnDestruct() override;
 
-  void OnUpdatePluginContentOriginWhitelist(
-      const std::set<url::Origin>& origin_whitelist);
+  void OnUpdatePluginContentOriginAllowlist(
+      const std::set<url::Origin>& origin_allowlist);
 
-  // Local copy of the whitelist for the entire tab.
-  std::set<url::Origin> origin_whitelist_;
+  // Local copy of the allowlist for the entire tab.
+  std::set<url::Origin> origin_allowlist_;
 
   // Set of peripheral plugins eligible to be unthrottled ex post facto.
   std::vector<PeripheralPlugin> peripheral_plugins_;
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc b/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
index 3496efeda9e..70096cd34d4 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper_browsertest.cc
@@ -42,7 +42,7 @@ class PluginPowerSaverHelperTest : public RenderViewTest {
   DISALLOW_COPY_AND_ASSIGN(PluginPowerSaverHelperTest);
 };
 
-TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
+TEST_F(PluginPowerSaverHelperTest, TemporaryOriginAllowlist) {
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_PERIPHERAL,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
@@ -52,10 +52,10 @@ TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
   // Clear out other messages so we find just the plugin power saver IPCs.
   sink_->ClearMessages();
 
-  frame()->WhitelistContentOrigin(
+  frame()->AllowlistContentOrigin(
       url::Origin::Create(GURL("http://other.com")));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
                 url::Origin::Create(GURL("http://other.com")),
@@ -72,25 +72,25 @@ TEST_F(PluginPowerSaverHelperTest, TemporaryOriginWhitelist) {
                   .IsSameOriginWith(std::get<0>(params)));
 }
 
-TEST_F(PluginPowerSaverHelperTest, UnthrottleOnExPostFactoWhitelist) {
+TEST_F(PluginPowerSaverHelperTest, UnthrottleOnExPostFactoAllowlist) {
   base::RunLoop loop;
   frame()->RegisterPeripheralPlugin(
       url::Origin::Create(GURL("http://other.com")), loop.QuitClosure());
 
-  std::set<url::Origin> origin_whitelist;
-  origin_whitelist.insert(url::Origin::Create(GURL("http://other.com")));
-  frame()->OnMessageReceived(FrameMsg_UpdatePluginContentOriginWhitelist(
-      frame()->GetRoutingID(), origin_whitelist));
+  std::set<url::Origin> origin_allowlist;
+  origin_allowlist.insert(url::Origin::Create(GURL("http://other.com")));
+  frame()->OnMessageReceived(FrameMsg_UpdatePluginContentOriginAllowlist(
+      frame()->GetRoutingID(), origin_allowlist));
 
   // Runs until the unthrottle closure is run.
   loop.Run();
 }
 
-TEST_F(PluginPowerSaverHelperTest, ClearWhitelistOnNavigate) {
-  frame()->WhitelistContentOrigin(
+TEST_F(PluginPowerSaverHelperTest, ClearAllowlistOnNavigate) {
+  frame()->AllowlistContentOrigin(
       url::Origin::Create(GURL("http://other.com")));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             frame()->GetPeripheralContentStatus(
                 url::Origin::Create(GURL("http://same.com")),
                 url::Origin::Create(GURL("http://other.com")),
diff --git a/chromium/content/renderer/pepper/ppb_audio_impl.cc b/chromium/content/renderer/pepper/ppb_audio_impl.cc
index 964afa8ff08..cd91a137591 100644
--- a/chromium/content/renderer/pepper/ppb_audio_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_audio_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/ppb_audio_impl.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/renderer/pepper/pepper_audio_controller.h"
 #include "content/renderer/pepper/pepper_platform_audio_output.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/ppb_broker_impl.cc b/chromium/content/renderer/pepper/ppb_broker_impl.cc
index 3488c65dc7e..41c36f9db49 100644
--- a/chromium/content/renderer/pepper/ppb_broker_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_broker_impl.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/ppb_broker_impl.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/metrics/histogram_macros.h"
 #include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
diff --git a/chromium/content/renderer/pepper/ppb_buffer_impl.cc b/chromium/content/renderer/pepper/ppb_buffer_impl.cc
index 207aa2fe5d3..6b0df315b0c 100644
--- a/chromium/content/renderer/pepper/ppb_buffer_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_buffer_impl.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/common/pepper_file_util.h"
 #include "content/renderer/render_thread_impl.h"
 #include "ppapi/c/dev/ppb_buffer_dev.h"
diff --git a/chromium/content/renderer/pepper/ppb_image_data_impl.cc b/chromium/content/renderer/pepper/ppb_image_data_impl.cc
index 20b953e6ada..2bb34645548 100644
--- a/chromium/content/renderer/pepper/ppb_image_data_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_image_data_impl.cc
@@ -8,7 +8,8 @@
 #include <limits>
 #include <memory>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "content/common/pepper_file_util.h"
 #include "content/common/view_messages.h"
 #include "content/renderer/render_thread_impl.h"
diff --git a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
index 735637b353f..aeda13db576 100644
--- a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
@@ -6,8 +6,9 @@
 
 #include <string>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/notreached.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
 #include "content/renderer/pepper/plugin_module.h"
diff --git a/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc b/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
index d01779026bb..21c9507179b 100644
--- a/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
+++ b/chromium/content/renderer/pepper/renderer_ppapi_host_impl.cc
@@ -5,9 +5,9 @@
 #include "content/renderer/pepper/renderer_ppapi_host_impl.h"
 
 #include "base/bind.h"
+#include "base/check.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/process/process_handle.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
diff --git a/chromium/content/renderer/pepper/url_request_info_util.cc b/chromium/content/renderer/pepper/url_request_info_util.cc
index cb0f5e593c8..84c4667e596 100644
--- a/chromium/content/renderer/pepper/url_request_info_util.cc
+++ b/chromium/content/renderer/pepper/url_request_info_util.cc
@@ -7,7 +7,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "base/logging.h"
+#include "base/check.h"
+#include "base/notreached.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/renderer/loader/request_extra_data.h"
@@ -253,6 +254,11 @@ bool CreateWebURLRequest(PP_Instance instance,
   }
 
   dest->SetRequestContext(blink::mojom::RequestContextType::PLUGIN);
+  // TODO(lyf): We don't currently distinguish between plugin content loaded
+  // via `<embed>` or `<object>` as https://github.com/whatwg/fetch/pull/948
+  // asks us to do. See `content::PepperURLLoaderHost::InternalOnHostMsgOpen`
+  // for details.
+  dest->SetRequestDestination(network::mojom::RequestDestination::kEmbed);
 
   return true;
 }
diff --git a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
index d699fd8a7c0..ae60ce11f33 100644
--- a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
+++ b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
@@ -12,8 +12,9 @@
 #include <unordered_map>
 
 #include "base/bind.h"
-#include "base/logging.h"
+#include "base/check.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/run_loop.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/test/task_environment.h"
diff --git a/chromium/content/renderer/pepper/v8object_var.cc b/chromium/content/renderer/pepper/v8object_var.cc
index 9e7ee57c3c1..374dc7ddec1 100644
--- a/chromium/content/renderer/pepper/v8object_var.cc
+++ b/chromium/content/renderer/pepper/v8object_var.cc
@@ -4,7 +4,7 @@
 
 #include "content/renderer/pepper/v8object_var.h"
 
-#include "base/logging.h"
+#include "base/check.h"
 #include "content/public/renderer/pepper_plugin_instance.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
diff --git a/chromium/content/renderer/pepper/video_decoder_shim.cc b/chromium/content/renderer/pepper/video_decoder_shim.cc
index a61cc93a64a..e0add969e80 100644
--- a/chromium/content/renderer/pepper/video_decoder_shim.cc
+++ b/chromium/content/renderer/pepper/video_decoder_shim.cc
@@ -12,11 +12,12 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/containers/queue.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "base/notreached.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -382,11 +383,15 @@ void VideoDecoderShim::YUVConverter::Convert(const media::VideoFrame* frame,
     //   U - 128  : Turns unsigned U into signed U [-128,127]
     //   V - 128  : Turns unsigned V into signed V [-128,127]
     static const float yuv_adjust_constrained[3] = {
-        -0.0625f, -0.5f, -0.5f,
+        -0.0625f,
+        -0.5f,
+        -0.5f,
     };
     // Same as above, but without the head and footroom.
     static const float yuv_adjust_full[3] = {
-        0.0f, -0.5f, -0.5f,
+        0.0f,
+        -0.5f,
+        -0.5f,
     };
 
     yuv_adjust = yuv_adjust_constrained;
@@ -1020,8 +1025,7 @@ void VideoDecoderShim::OnOutputComplete(std::unique_ptr<PendingFrame> frame) {
       // all textures to |textures_to_dismiss_| and dismiss any that aren't in
       // use by the plugin. We will dismiss the rest as they are recycled.
       for (TextureIdMap::const_iterator it = texture_id_map_.begin();
-           it != texture_id_map_.end();
-           ++it) {
+           it != texture_id_map_.end(); ++it) {
         textures_to_dismiss_.insert(it->first);
       }
       for (auto it = available_textures_.begin();
diff --git a/chromium/content/renderer/peripheral_content_heuristic.cc b/chromium/content/renderer/peripheral_content_heuristic.cc
index c6b87517f04..5bfb7e1889e 100644
--- a/chromium/content/renderer/peripheral_content_heuristic.cc
+++ b/chromium/content/renderer/peripheral_content_heuristic.cc
@@ -40,7 +40,7 @@ bool IsTiny(const gfx::Size& unobscured_size) {
 // static
 RenderFrame::PeripheralContentStatus
 PeripheralContentHeuristic::GetPeripheralStatus(
-    const std::set<url::Origin>& origin_whitelist,
+    const std::set<url::Origin>& origin_allowlist,
     const url::Origin& main_frame_origin,
     const url::Origin& content_origin,
     const gfx::Size& unobscured_size) {
@@ -50,8 +50,8 @@ PeripheralContentHeuristic::GetPeripheralStatus(
   if (main_frame_origin.IsSameOriginWith(content_origin))
     return RenderFrame::CONTENT_STATUS_ESSENTIAL_SAME_ORIGIN;
 
-  if (origin_whitelist.count(content_origin))
-    return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED;
+  if (origin_allowlist.count(content_origin))
+    return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED;
 
   if (IsLargeContent(unobscured_size))
     return RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_BIG;
diff --git a/chromium/content/renderer/peripheral_content_heuristic.h b/chromium/content/renderer/peripheral_content_heuristic.h
index 251edaa966c..11c22ce136f 100644
--- a/chromium/content/renderer/peripheral_content_heuristic.h
+++ b/chromium/content/renderer/peripheral_content_heuristic.h
@@ -30,7 +30,7 @@ class CONTENT_EXPORT PeripheralContentHeuristic {
   //  - Cross-origin:  a.com -> b.com/iframe.html -> b.com/plugin.swf
   //  - Same-origin:   a.com -> b.com/iframe-to-a.html -> a.com/plugin.swf
   //
-  // |origin_whitelist| is the whitelist of content origins.
+  // |origin_allowlist| is the allowlist of content origins.
   //
   // |main_frame_origin| is the origin of the main frame.
   //
@@ -38,7 +38,7 @@ class CONTENT_EXPORT PeripheralContentHeuristic {
   //
   // |unobscured_size| is in zoom and device scale independent logical pixels.
   static RenderFrame::PeripheralContentStatus GetPeripheralStatus(
-      const std::set<url::Origin>& origin_whitelist,
+      const std::set<url::Origin>& origin_allowlist,
       const url::Origin& main_frame_origin,
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size);
diff --git a/chromium/content/renderer/peripheral_content_heuristic_unittest.cc b/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
index 56d006c815e..c74f934a0fb 100644
--- a/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
+++ b/chromium/content/renderer/peripheral_content_heuristic_unittest.cc
@@ -61,34 +61,34 @@ TEST(PeripheralContentHeuristic, TinyContent) {
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(10, 10)));
 }
 
-TEST(PeripheralContentHeuristic, TemporaryOriginWhitelist) {
+TEST(PeripheralContentHeuristic, TemporaryOriginAllowlist) {
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_PERIPHERAL,
             PeripheralContentHeuristic::GetPeripheralStatus(
                 std::set<url::Origin>(), url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(100, 100)));
 
-  std::set<url::Origin> whitelist;
-  whitelist.insert(url::Origin::Create(GURL(kOtherOrigin)));
+  std::set<url::Origin> allowlist;
+  allowlist.insert(url::Origin::Create(GURL(kOtherOrigin)));
 
-  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_WHITELISTED,
+  EXPECT_EQ(RenderFrame::CONTENT_STATUS_ESSENTIAL_CROSS_ORIGIN_ALLOWLISTED,
             PeripheralContentHeuristic::GetPeripheralStatus(
-                whitelist, url::Origin::Create(GURL(kSameOrigin)),
+                allowlist, url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size(100, 100)));
 }
 
 TEST(PeripheralContentHeuristic, UndefinedSize) {
   // Undefined size plugins from any origin (including same-origin and
-  // whitelisted origins) are marked tiny until proven otherwise.
+  // allowlisted origins) are marked tiny until proven otherwise.
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
             PeripheralContentHeuristic::GetPeripheralStatus(
                 std::set<url::Origin>(), url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kSameOrigin)), gfx::Size()));
 
-  std::set<url::Origin> whitelist;
-  whitelist.insert(url::Origin::Create(GURL(kOtherOrigin)));
+  std::set<url::Origin> allowlist;
+  allowlist.insert(url::Origin::Create(GURL(kOtherOrigin)));
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
             PeripheralContentHeuristic::GetPeripheralStatus(
-                whitelist, url::Origin::Create(GURL(kSameOrigin)),
+                allowlist, url::Origin::Create(GURL(kSameOrigin)),
                 url::Origin::Create(GURL(kOtherOrigin)), gfx::Size()));
 
   EXPECT_EQ(RenderFrame::CONTENT_STATUS_TINY,
diff --git a/chromium/content/renderer/queue_message_swap_promise_unittest.cc b/chromium/content/renderer/queue_message_swap_promise_unittest.cc
index e3c705c7898..f9cb7f1df14 100644
--- a/chromium/content/renderer/queue_message_swap_promise_unittest.cc
+++ b/chromium/content/renderer/queue_message_swap_promise_unittest.cc
@@ -17,7 +17,6 @@
 #include "content/common/widget_messages.h"
 #include "content/renderer/frame_swap_message_queue.h"
 #include "content/renderer/render_widget.h"
-#include "content/test/mock_render_process.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "ipc/ipc_test_sink.h"
diff --git a/chromium/content/renderer/render_frame_impl.cc b/chromium/content/renderer/render_frame_impl.cc
index 2ab5e79b71c..d3461419137 100644
--- a/chromium/content/renderer/render_frame_impl.cc
+++ b/chromium/content/renderer/render_frame_impl.cc
@@ -52,7 +52,6 @@
 #include "content/common/associated_interfaces.mojom.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_navigation_policy.h"
-#include "content/common/edit_command.h"
 #include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_replication_state.h"
@@ -72,10 +71,10 @@
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/isolated_world_ids.h"
 #include "content/public/common/navigation_policy.h"
 #include "content/public/common/page_state.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/untrustworthy_context_menu_params.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
@@ -96,12 +95,12 @@
 #include "content/renderer/crash_helpers.h"
 #include "content/renderer/dom_automation_controller.h"
 #include "content/renderer/effective_connection_type_helper.h"
-#include "content/renderer/external_popup_menu.h"
 #include "content/renderer/frame_owner_properties_converter.h"
 #include "content/renderer/gpu_benchmarking_extension.h"
 #include "content/renderer/history_entry.h"
 #include "content/renderer/history_serialization.h"
 #include "content/renderer/ime_event_guard.h"
+#include "content/renderer/impression_conversions.h"
 #include "content/renderer/input/frame_input_handler_impl.h"
 #include "content/renderer/input/input_target_client_impl.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
@@ -140,6 +139,7 @@
 #include "content/renderer/web_ui_extension_data.h"
 #include "content/renderer/worker/dedicated_worker_host_factory_client.h"
 #include "crypto/sha2.h"
+#include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
@@ -160,7 +160,6 @@
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/logging/logging_utils.h"
@@ -172,6 +171,7 @@
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom.h"
 #include "third_party/blink/public/mojom/permissions/permission.mojom.h"
 #include "third_party/blink/public/mojom/referrer.mojom.h"
@@ -254,8 +254,6 @@ using blink::WebDOMEvent;
 using blink::WebDOMMessageEvent;
 using blink::WebElement;
 using blink::WebElementCollection;
-using blink::WebExternalPopupMenu;
-using blink::WebExternalPopupMenuClient;
 using blink::WebFrame;
 using blink::WebFrameLoadType;
 using blink::WebFrameSerializer;
@@ -272,7 +270,6 @@ using blink::WebNavigationType;
 using blink::WebNode;
 using blink::WebPluginDocument;
 using blink::WebPluginParams;
-using blink::WebPopupMenuInfo;
 using blink::WebRange;
 using blink::WebRect;
 using blink::WebScriptSource;
@@ -1386,7 +1383,8 @@ RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
 
   WebLocalFrame* web_frame = WebLocalFrame::CreateMainFrame(
       render_view->GetWebView(), render_frame,
-      render_frame->blink_interface_registry_.get(), opener,
+      render_frame->blink_interface_registry_.get(),
+      params->main_frame_frame_token, opener,
       // This conversion is a little sad, as this often comes from a
       // WebString...
       WebString::FromUTF8(params->replicated_frame_state.name),
@@ -1397,7 +1395,6 @@ RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
 
   std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
       params->main_frame_widget_routing_id, compositor_deps,
-      params->visual_properties.display_mode,
       render_view->widgets_never_composited());
   render_widget->set_delegate(render_view);
 
@@ -1444,6 +1441,7 @@ void RenderFrameImpl::CreateFrame(
     int opener_routing_id,
     int parent_routing_id,
     int previous_sibling_routing_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const FrameReplicationState& replicated_state,
     CompositorDependencies* compositor_deps,
@@ -1494,7 +1492,7 @@ void RenderFrameImpl::CreateFrame(
         render_frame->blink_interface_registry_.get(),
         previous_sibling_web_frame,
         frame_owner_properties->To<blink::WebFrameOwnerProperties>(),
-        replicated_state.frame_owner_element_type,
+        replicated_state.frame_owner_element_type, frame_token,
         ResolveWebFrame(opener_routing_id));
 
     // The RenderFrame is created and inserted into the frame tree in the above
@@ -1530,7 +1528,7 @@ void RenderFrameImpl::CreateFrame(
       previous_proxy->set_provisional_frame_routing_id(routing_id);
     web_frame = blink::WebLocalFrame::CreateProvisional(
         render_frame, render_frame->blink_interface_registry_.get(),
-        previous_web_frame, replicated_state.frame_policy,
+        frame_token, previous_web_frame, replicated_state.frame_policy,
         WebString::FromUTF8(replicated_state.name));
     // The new |web_frame| is a main frame iff the proxy's frame was.
     DCHECK_EQ(!previous_web_frame->Parent(), !web_frame->Parent());
@@ -1561,7 +1559,6 @@ void RenderFrameImpl::CreateFrame(
 
     std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
         widget_params->routing_id, compositor_deps,
-        widget_params->visual_properties.display_mode,
         render_view->widgets_never_composited());
     render_widget->set_delegate(render_view);
 
@@ -1611,7 +1608,6 @@ void RenderFrameImpl::CreateFrame(
     // space/context.
     std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
         widget_params->routing_id, compositor_deps,
-        widget_params->visual_properties.display_mode,
         render_view->widgets_never_composited());
 
     // Non-owning pointer that is self-referencing and destroyed by calling
@@ -2152,14 +2148,6 @@ bool RenderFrameImpl::Send(IPC::Message* message) {
   return RenderThread::Get()->Send(message);
 }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void RenderFrameImpl::DidHideExternalPopupMenu() {
-  // We need to clear external_popup_menu_ as soon as ExternalPopupMenu::close
-  // is called. Otherwise, createExternalPopupMenu() for new popup will fail.
-  external_popup_menu_.reset();
-}
-#endif
-
 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
   // Page IPCs are routed via the main frame (both local and remote) and then
   // forwarded to the RenderView. See comment in
@@ -2190,8 +2178,6 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameImpl, msg)
     IPC_MESSAGE_HANDLER(UnfreezableFrameMsg_Unload, OnUnload)
-    IPC_MESSAGE_HANDLER(FrameMsg_SwapIn, OnSwapIn)
-    IPC_MESSAGE_HANDLER(FrameMsg_Stop, OnStop)
     IPC_MESSAGE_HANDLER(FrameMsg_ContextMenuClosed, OnContextMenuClosed)
     IPC_MESSAGE_HANDLER(FrameMsg_CustomContextMenuAction,
                         OnCustomContextMenuAction)
@@ -2202,21 +2188,12 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
                         OnVisualStateRequest)
     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
     IPC_MESSAGE_HANDLER(FrameMsg_UpdateOpener, OnUpdateOpener)
-    IPC_MESSAGE_HANDLER(FrameMsg_AdvanceFocus, OnAdvanceFocus)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSavableResourceLinks,
                         OnGetSavableResourceLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSerializedHtmlWithLocalLinks,
                         OnGetSerializedHtmlWithLocalLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_MixedContentFound, OnMixedContentFound)
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-    IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItem, OnSelectPopupMenuItem)
-#else
-    IPC_MESSAGE_HANDLER(FrameMsg_SelectPopupMenuItems, OnSelectPopupMenuItems)
-#endif
-#endif
     IPC_MESSAGE_HANDLER(UnfreezableFrameMsg_Delete, OnDeleteFrame)
-
   IPC_END_MESSAGE_MAP()
 
   return handled;
@@ -2287,7 +2264,8 @@ void RenderFrameImpl::BindNavigationClient(
 void RenderFrameImpl::OnUnload(
     int proxy_routing_id,
     bool is_loading,
-    const FrameReplicationState& replicated_frame_state) {
+    const FrameReplicationState& replicated_frame_state,
+    const base::UnguessableToken& frame_token) {
   TRACE_EVENT1("navigation,rail", "RenderFrameImpl::OnUnload", "id",
                routing_id_);
   DCHECK(!base::RunLoop::IsNestedOnCurrentThread());
@@ -2299,7 +2277,7 @@ void RenderFrameImpl::OnUnload(
   // so its routing id is registered for receiving IPC messages.
   CHECK_NE(proxy_routing_id, MSG_ROUTING_NONE);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyToReplaceFrame(
-      this, proxy_routing_id, replicated_frame_state.scope);
+      this, proxy_routing_id, replicated_frame_state.scope, frame_token);
 
   RenderViewImpl* render_view = render_view_;
   bool is_main_frame = is_main_frame_;
@@ -2364,10 +2342,6 @@ void RenderFrameImpl::OnUnload(
   task_runner->PostTask(FROM_HERE, std::move(send_unload_ack));
 }
 
-void RenderFrameImpl::OnSwapIn() {
-  SwapIn();
-}
-
 void RenderFrameImpl::OnDeleteFrame(FrameDeleteIntention intent) {
   // The main frame (when not provisional) is owned by the renderer's frame tree
   // via WebViewImpl. When a provisional main frame is swapped in, the ownership
@@ -2632,6 +2606,10 @@ void RenderFrameImpl::OnPortalActivated(
                             std::move(callback));
 }
 
+void RenderFrameImpl::SwapIn() {
+  SwapInInternal();
+}
+
 void RenderFrameImpl::ForwardMessageFromHost(
     blink::TransferableMessage message,
     const url::Origin& source_origin,
@@ -2701,53 +2679,6 @@ void RenderFrameImpl::OnUpdateOpener(int opener_routing_id) {
   frame_->SetOpener(opener);
 }
 
-void RenderFrameImpl::OnAdvanceFocus(blink::mojom::FocusType type,
-                                     int32_t source_routing_id) {
-  RenderFrameProxy* source_frame =
-      RenderFrameProxy::FromRoutingID(source_routing_id);
-  if (!source_frame) {
-    render_view_->GetWebView()->SetInitialFocus(
-        type == blink::mojom::FocusType::kBackward);
-    return;
-  }
-
-  render_view_->GetWebView()->AdvanceFocusAcrossFrames(
-      type, source_frame->web_frame(), frame_);
-}
-
-void RenderFrameImpl::PostMessageEvent(int32_t source_routing_id,
-                                       const base::string16& source_origin,
-                                       const base::string16& target_origin,
-                                       blink::TransferableMessage message) {
-  // Make sure that |message| owns its data so that the data is alive even after
-  // moved.
-  message.EnsureDataIsOwned();
-
-  // Find the source frame if it exists.
-  WebFrame* source_frame = nullptr;
-  if (source_routing_id != MSG_ROUTING_NONE) {
-    RenderFrameProxy* source_proxy =
-        RenderFrameProxy::FromRoutingID(source_routing_id);
-    if (source_proxy)
-      source_frame = source_proxy->web_frame();
-  }
-
-  // We must pass in the target_origin to do the security check on this side,
-  // since it may have changed since the original postMessage call was made.
-  WebSecurityOrigin target_security_origin;
-  if (!target_origin.empty()) {
-    target_security_origin = WebSecurityOrigin::CreateFromString(
-        WebString::FromUTF16(target_origin));
-  }
-
-  WebDOMMessageEvent msg_event(std::move(message),
-                               WebString::FromUTF16(source_origin),
-                               source_frame, frame_->GetDocument());
-
-  frame_->DispatchMessageEventWithOriginCheck(target_security_origin,
-                                              msg_event);
-}
-
 void RenderFrameImpl::OnReload() {
   frame_->StartReload(WebFrameLoadType::kReload);
 }
@@ -2921,9 +2852,9 @@ RenderFrameImpl::GetPeripheralContentStatus(
       main_frame_origin, content_origin, unobscured_size, record_decision);
 }
 
-void RenderFrameImpl::WhitelistContentOrigin(
+void RenderFrameImpl::AllowlistContentOrigin(
     const url::Origin& content_origin) {
-  return plugin_power_saver_helper_->WhitelistContentOrigin(content_origin);
+  return plugin_power_saver_helper_->AllowlistContentOrigin(content_origin);
 }
 
 void RenderFrameImpl::PluginDidStartLoading() {
@@ -3048,9 +2979,6 @@ void RenderFrameImpl::AllowBindings(int32_t enabled_bindings_flags) {
   }
 
   enabled_bindings_ |= enabled_bindings_flags;
-
-  // Keep track of the total bindings accumulated in this process.
-  RenderProcess::current()->AddBindings(enabled_bindings_flags);
 }
 
 void RenderFrameImpl::EnableMojoJsBindings() {
@@ -3678,7 +3606,7 @@ void RenderFrameImpl::UpdateSubresourceLoaderFactories(
 void RenderFrameImpl::BindDevToolsAgent(
     mojo::PendingAssociatedRemote<blink::mojom::DevToolsAgentHost> host,
     mojo::PendingAssociatedReceiver<blink::mojom::DevToolsAgent> receiver) {
-  frame_->BindDevToolsAgent(host.PassHandle(), receiver.PassHandle());
+  frame_->BindDevToolsAgent(std::move(host), std::move(receiver));
 }
 
 // blink::WebLocalFrameClient implementation
@@ -3776,12 +3704,14 @@ RenderFrameImpl::CreateWorkerContentSettingsClient() {
       this);
 }
 
+#if !defined(OS_ANDROID)
 std::unique_ptr<media::SpeechRecognitionClient>
 RenderFrameImpl::CreateSpeechRecognitionClient() {
   if (!frame_ || !frame_->View())
     return nullptr;
   return GetContentClient()->renderer()->CreateSpeechRecognitionClient(this);
 }
+#endif
 
 scoped_refptr<blink::WebWorkerFetchContext>
 RenderFrameImpl::CreateWorkerFetchContext() {
@@ -3810,8 +3740,6 @@ RenderFrameImpl::CreateWorkerFetchContext() {
       frame_->GetDocument().SiteForCookies());
   worker_fetch_context->set_top_frame_origin(
       frame_->GetDocument().TopFrameOrigin());
-  worker_fetch_context->set_origin_url(
-      GURL(frame_->GetDocument().Url()).GetOrigin());
 
   for (auto& observer : observers_)
     observer.WillCreateWorkerFetchContext(worker_fetch_context.get());
@@ -3840,36 +3768,12 @@ RenderFrameImpl::CreateWorkerFetchContextForPlzDedicatedWorker(
       frame_->GetDocument().SiteForCookies());
   worker_fetch_context->set_top_frame_origin(
       frame_->GetDocument().TopFrameOrigin());
-  worker_fetch_context->set_origin_url(
-      GURL(frame_->GetDocument().Url()).GetOrigin());
 
   for (auto& observer : observers_)
     observer.WillCreateWorkerFetchContext(worker_fetch_context.get());
   return worker_fetch_context;
 }
 
-WebExternalPopupMenu* RenderFrameImpl::CreateExternalPopupMenu(
-    const WebPopupMenuInfo& popup_menu_info,
-    WebExternalPopupMenuClient* popup_menu_client) {
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  // An IPC message is sent to the browser to build and display the actual
-  // popup. The user could have time to click a different select by the time
-  // the popup is shown. In that case external_popup_menu_ is non NULL.
-  // By returning NULL in that case, we instruct Blink to cancel that new
-  // popup. So from the user perspective, only the first one will show, and
-  // will have to close the first one before another one can be shown.
-  if (external_popup_menu_)
-    return nullptr;
-  external_popup_menu_ = std::make_unique<ExternalPopupMenu>(
-      this, popup_menu_info, popup_menu_client);
-  external_popup_menu_->SetOriginScaleForEmulation(
-      GetLocalRootRenderWidget()->GetEmulatorScale());
-  return external_popup_menu_.get();
-#else
-  return nullptr;
-#endif
-}
-
 std::unique_ptr<blink::WebPrescientNetworking>
 RenderFrameImpl::CreatePrescientNetworking() {
   return GetContentClient()->renderer()->CreatePrescientNetworking(this);
@@ -3912,12 +3816,12 @@ RenderFrameImpl::GetRemoteNavigationAssociatedInterfaces() {
 
 blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
     blink::WebLocalFrame* parent,
-    blink::WebTreeScopeType scope,
+    blink::mojom::TreeScopeType scope,
     const blink::WebString& name,
     const blink::WebString& fallback_name,
     const blink::FramePolicy& frame_policy,
     const blink::WebFrameOwnerProperties& frame_owner_properties,
-    blink::FrameOwnerElementType frame_owner_element_type) {
+    blink::mojom::FrameOwnerElementType frame_owner_element_type) {
   DCHECK_EQ(frame_, parent);
 
   // Synchronously notify the browser of a child frame creation to get the
@@ -3991,7 +3895,8 @@ blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
   child_render_frame->InitializeBlameContext(this);
   blink::WebLocalFrame* web_frame = parent->CreateLocalChild(
       scope, child_render_frame,
-      child_render_frame->blink_interface_registry_.get());
+      child_render_frame->blink_interface_registry_.get(),
+      params_reply.frame_token);
 
   child_render_frame->in_frame_tree_ = true;
   child_render_frame->Initialize();
@@ -4001,22 +3906,23 @@ blink::WebLocalFrame* RenderFrameImpl::CreateChildFrame(
 
 std::pair<blink::WebRemoteFrame*, base::UnguessableToken>
 RenderFrameImpl::CreatePortal(
-    mojo::ScopedInterfaceEndpointHandle portal_endpoint,
-    mojo::ScopedInterfaceEndpointHandle client_endpoint,
+    blink::CrossVariantMojoAssociatedReceiver<blink::mojom::PortalInterfaceBase>
+        portal_endpoint,
+    blink::CrossVariantMojoAssociatedRemote<
+        blink::mojom::PortalClientInterfaceBase> client_endpoint,
     const blink::WebElement& portal_element) {
   int proxy_routing_id = MSG_ROUTING_NONE;
   FrameReplicationState initial_replicated_state;
   base::UnguessableToken portal_token;
+  base::UnguessableToken frame_token;
   base::UnguessableToken devtools_frame_token;
-  GetFrameHost()->CreatePortal(
-      mojo::PendingAssociatedReceiver<blink::mojom::Portal>(
-          std::move(portal_endpoint)),
-      mojo::PendingAssociatedRemote<blink::mojom::PortalClient>(
-          std::move(client_endpoint), blink::mojom::PortalClient::Version_),
-      &proxy_routing_id, &initial_replicated_state, &portal_token,
-      &devtools_frame_token);
+  GetFrameHost()->CreatePortal(std::move(portal_endpoint),
+                               std::move(client_endpoint), &proxy_routing_id,
+                               &initial_replicated_state, &portal_token,
+                               &frame_token, &devtools_frame_token);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyForPortal(
-      this, proxy_routing_id, devtools_frame_token, portal_element);
+      this, proxy_routing_id, frame_token, devtools_frame_token,
+      portal_element);
   proxy->SetReplicatedState(initial_replicated_state);
   return std::make_pair(proxy->web_frame(), portal_token);
 }
@@ -4025,13 +3931,16 @@ blink::WebRemoteFrame* RenderFrameImpl::AdoptPortal(
     const base::UnguessableToken& portal_token,
     const blink::WebElement& portal_element) {
   int proxy_routing_id = MSG_ROUTING_NONE;
+  base::UnguessableToken frame_token;
   base::UnguessableToken devtools_frame_token;
   FrameReplicationState replicated_state;
   viz::FrameSinkId frame_sink_id;
   GetFrameHost()->AdoptPortal(portal_token, &proxy_routing_id, &frame_sink_id,
-                              &replicated_state, &devtools_frame_token);
+                              &replicated_state, &frame_token,
+                              &devtools_frame_token);
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyForPortal(
-      this, proxy_routing_id, devtools_frame_token, portal_element);
+      this, proxy_routing_id, frame_token, devtools_frame_token,
+      portal_element);
   proxy->FrameSinkIdChanged(frame_sink_id);
   proxy->SetReplicatedState(replicated_state);
   return proxy->web_frame();
@@ -4144,26 +4053,17 @@ void RenderFrameImpl::DidChangeFramePolicy(
 }
 
 void RenderFrameImpl::DidSetFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags flags,
+    network::mojom::WebSandboxFlags flags,
     const blink::ParsedFeaturePolicy& fp_header,
     const blink::DocumentPolicy::FeatureState& dp_header) {
   // If any of Feature Policy or Sandbox Flags or Document Policy are different
   // from the default (empty) values, then send them to the browser.
   if (!dp_header.empty() || !fp_header.empty() ||
-      flags != blink::mojom::WebSandboxFlags::kNone) {
+      flags != network::mojom::WebSandboxFlags::kNone) {
     GetFrameHost()->DidSetFramePolicyHeaders(flags, fp_header, dp_header);
   }
 }
 
-void RenderFrameImpl::DidChangeFrameOwnerProperties(
-    blink::WebFrame* child_frame,
-    const blink::WebFrameOwnerProperties& frame_owner_properties) {
-  Send(new FrameHostMsg_DidChangeFrameOwnerProperties(
-      routing_id_, RenderFrame::GetRoutingIdForWebFrame(child_frame),
-      *(blink::mojom::FrameOwnerProperties::From(frame_owner_properties)
-            .get())));
-}
-
 void RenderFrameImpl::DidMatchCSS(
     const blink::WebVector<blink::WebString>& newly_matching_selectors,
     const blink::WebVector<blink::WebString>& stopped_matching_selectors) {
@@ -4254,39 +4154,25 @@ void RenderFrameImpl::DidCommitNavigation(
                "id", routing_id_,
                "url", GetLoadingUrl().possibly_invalid_spec());
 
-  base::Optional<base::UnguessableToken> embedding_token = base::nullopt;
-  if (previous_routing_id_ != MSG_ROUTING_NONE) {
+  bool is_provisional_frame = previous_routing_id_ != MSG_ROUTING_NONE;
+  if (is_provisional_frame) {
     // If this is a provisional frame associated with a proxy (i.e., a frame
     // created for a remote-to-local navigation), swap it into the frame tree
     // now.
-    if (!SwapIn())
+    if (!SwapInInternal())
       return;
+  }
 
-    // Main frames don't require an embedding token since they aren't embedded
-    // in anything. Frames local to their parent also aren't considered to be
-    // embedded.
-    if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame()) {
-      embedding_token = base::UnguessableToken::Create();
-      GetWebFrame()->SetEmbeddingToken(embedding_token.value());
-    }
-  } else {
-    // If this is not a provisional frame then use the old embedding token. This
-    // will be base::nullopt if there was no old embedding token.
-    embedding_token = GetWebFrame()->GetEmbeddingToken();
-
-    // In the case a crashed subframe is navigating to the same site
-    // e.g. https://crbug.com/634368 then generate a new embedding token to
-    // restore a sane state.
-    //
-    // Logic behind this behavior:
-    // - Main frames don't have embedding tokens.
-    // - A remote subframe *must* have an embedding token.
-    // - If a remote subframe doesn't have an embedding token to re-use we
-    //   need to create one.
-    if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame() &&
-        !embedding_token.has_value()) {
-      embedding_token = base::UnguessableToken::Create();
-      GetWebFrame()->SetEmbeddingToken(embedding_token.value());
+  // Main frames don't require an embedding token since they aren't embedded
+  // in anything. Frames local to their parent also aren't considered to be
+  // embedded.
+  if (!is_main_frame_ && frame_->Parent()->IsWebRemoteFrame()) {
+    // Provisional frames need a new token. Non-provisional frames need one if
+    // they don't already have one, e.g. a crashed subframe navigating to same
+    // site (https://crbug.com/634368).
+    if (is_provisional_frame ||
+        !GetWebFrame()->GetEmbeddingToken().has_value()) {
+      GetWebFrame()->SetEmbeddingToken(base::UnguessableToken::Create());
     }
   }
 
@@ -4380,7 +4266,7 @@ void RenderFrameImpl::DidCommitNavigation(
                 std::move(remote_interface_provider_receiver),
                 std::move(browser_interface_broker_receiver))
           : nullptr,
-      embedding_token);
+      GetWebFrame()->GetEmbeddingToken());
 
   // If we end up reusing this WebRequest (for example, due to a #ref click),
   // we don't want the transition type to persist.  Just clear it.
@@ -4398,7 +4284,7 @@ void RenderFrameImpl::DidCreateInitialEmptyDocument() {
     observer.DidCreateNewDocument();
 }
 
-void RenderFrameImpl::DidCommitJavascriptUrlNavigation(
+void RenderFrameImpl::DidCommitDocumentReplacementNavigation(
     blink::WebDocumentLoader* document_loader) {
   // TODO(https://crbug.com/855189): figure out which of the following observer
   // calls are necessary, if any.
@@ -4433,8 +4319,6 @@ void RenderFrameImpl::DidClearWindowObject() {
   if (command_line.HasSwitch(switches::kEnableSkiaBenchmarking))
     SkiaBenchmarking::Install(frame_);
 
-  for (auto& observer : render_view_->observers())
-    observer.DidClearWindowObject(frame_);
   for (auto& observer : observers_)
     observer.DidClearWindowObject();
 }
@@ -4620,12 +4504,12 @@ void RenderFrameImpl::DidChangeSelection(bool is_empty_selection) {
 
 bool RenderFrameImpl::HandleCurrentKeyboardEvent() {
   bool did_execute_command = false;
-  for (auto command : GetLocalRootRenderWidget()->edit_commands()) {
+  for (const auto& command : GetLocalRootRenderWidget()->edit_commands()) {
     // In gtk and cocoa, it's possible to bind multiple edit commands to one
     // key (but it's the exception). Once one edit command is not executed, it
     // seems safest to not execute the rest.
-    if (!frame_->ExecuteCommand(blink::WebString::FromUTF8(command.name),
-                                blink::WebString::FromUTF8(command.value)))
+    if (!frame_->ExecuteCommand(blink::WebString::FromUTF8(command->name),
+                                blink::WebString::FromUTF8(command->value)))
       break;
     did_execute_command = true;
   }
@@ -4725,7 +4609,7 @@ void RenderFrameImpl::WillSendRequestInternal(
 
   ApplyFilePathAlias(&request);
   GURL new_url;
-  bool attach_same_site_cookies = false;
+  bool force_ignore_site_for_cookies = false;
   base::Optional<url::Origin> initiator_origin =
       request.RequestorOrigin().IsNull()
           ? base::Optional<url::Origin>()
@@ -4733,7 +4617,7 @@ void RenderFrameImpl::WillSendRequestInternal(
   GetContentClient()->renderer()->WillSendRequest(
       frame_, transition_type, request.Url(), request.SiteForCookies(),
       base::OptionalOrNullptr(initiator_origin), &new_url,
-      &attach_same_site_cookies);
+      &force_ignore_site_for_cookies);
   if (!new_url.is_empty())
     request.SetUrl(WebURL(new_url));
 
@@ -4770,7 +4654,7 @@ void RenderFrameImpl::WillSendRequestInternal(
   bool is_for_no_state_prefetch =
       GetContentClient()->renderer()->IsPrefetchOnly(this, request);
   extra_data->set_is_for_no_state_prefetch(is_for_no_state_prefetch);
-  extra_data->set_attach_same_site_cookies(attach_same_site_cookies);
+  extra_data->set_force_ignore_site_for_cookies(force_ignore_site_for_cookies);
   extra_data->set_frame_request_blocker(frame_request_blocker_);
   extra_data->set_allow_cross_origin_auth_prompt(
       render_view_->renderer_preferences().allow_cross_origin_auth_prompt);
@@ -4803,24 +4687,11 @@ void RenderFrameImpl::WillSendRequestInternal(
 void RenderFrameImpl::DidLoadResourceFromMemoryCache(
     const blink::WebURLRequest& request,
     const blink::WebURLResponse& response) {
-  // The recipients of this message have no use for data: URLs: they don't
-  // affect the page's insecure content list and are not in the disk cache. To
-  // prevent large (1M+) data: URLs from crashing in the IPC system, we simply
-  // filter them out here.
-  if (request.Url().ProtocolIs(url::kDataScheme))
-    return;
-
   for (auto& observer : observers_) {
     observer.DidLoadResourceFromMemoryCache(
         request.Url(), response.RequestId(), response.EncodedBodyLength(),
         response.MimeType().Utf8(), response.FromArchive());
   }
-
-  // Let the browser know we loaded a resource from the memory cache.  This
-  // message is needed to display the correct SSL indicators.
-  Send(new FrameHostMsg_DidLoadResourceFromMemoryCache(
-      routing_id_, request.Url(), request.HttpMethod().Utf8(),
-      response.MimeType().Utf8(), request.GetRequestDestination()));
 }
 
 void RenderFrameImpl::DidStartResponse(
@@ -4909,6 +4780,15 @@ void RenderFrameImpl::DidObserveLayoutShift(double score,
     observer.DidObserveLayoutShift(score, after_input_or_scroll);
 }
 
+void RenderFrameImpl::DidObserveLayoutNg(uint32_t all_block_count,
+                                         uint32_t ng_block_count,
+                                         uint32_t all_call_count,
+                                         uint32_t ng_call_count) {
+  for (auto& observer : observers_)
+    observer.DidObserveLayoutNg(all_block_count, ng_block_count, all_call_count,
+                                ng_call_count);
+}
+
 void RenderFrameImpl::DidObserveLazyLoadBehavior(
     WebLocalFrameClient::LazyLoadBehavior lazy_load_behavior) {
   for (auto& observer : observers_)
@@ -5018,14 +4898,12 @@ bool RenderFrameImpl::AllowContentInitiatedDataUrlNavigations(
   return url.GetString() == kUnreachableWebDataURL;
 }
 
-void RenderFrameImpl::PostAccessibilityEvent(const blink::WebAXObject& obj,
-                                             ax::mojom::Event event,
-                                             ax::mojom::EventFrom event_from) {
+void RenderFrameImpl::PostAccessibilityEvent(const ui::AXEvent& event) {
   if (!IsAccessibilityEnabled())
     return;
 
   render_accessibility_manager_->GetRenderAccessibilityImpl()
-      ->HandleWebAccessibilityEvent(obj, event, event_from);
+      ->HandleWebAccessibilityEvent(event);
 }
 
 void RenderFrameImpl::MarkWebAXObjectDirty(const blink::WebAXObject& obj,
@@ -5055,20 +4933,6 @@ void RenderFrameImpl::RemoveObserver(RenderFrameObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
-void RenderFrameImpl::OnStop() {
-  DCHECK(frame_);
-
-  // The stopLoading call may run script, which may cause this frame to be
-  // detached/deleted.  If that happens, return immediately.
-  base::WeakPtr<RenderFrameImpl> weak_this = weak_factory_.GetWeakPtr();
-  frame_->StopLoading();
-  if (!weak_this)
-    return;
-
-  for (auto& observer : observers_)
-    observer.OnStop();
-}
-
 void RenderFrameImpl::OnDroppedNavigation() {
   browser_side_navigation_pending_ = false;
   browser_side_navigation_pending_url_ = GURL();
@@ -5514,7 +5378,7 @@ blink::mojom::CommitResult RenderFrameImpl::PrepareForHistoryNavigationCommit(
   return blink::mojom::CommitResult::Ok;
 }
 
-bool RenderFrameImpl::SwapIn() {
+bool RenderFrameImpl::SwapInInternal() {
   CHECK_NE(previous_routing_id_, MSG_ROUTING_NONE);
   CHECK(!in_frame_tree_);
 
@@ -5707,9 +5571,10 @@ void RenderFrameImpl::BeginNavigation(
     // All navigations to or from WebUI URLs or within WebUI-enabled
     // RenderProcesses must be handled by the browser process so that the
     // correct bindings and data sources can be registered.
-    int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
+    // All frames in a WebUI process must have the same enabled_bindings_, so
+    // we can do a per-frame check here rather than a process-wide check.
     bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
-                       (cumulative_bindings & kWebUIBindingsPolicyMask);
+                       (enabled_bindings_ & kWebUIBindingsPolicyMask);
     if (should_fork) {
       OpenURL(std::move(info));
       return;  // Suppress the load here.
@@ -5728,9 +5593,7 @@ void RenderFrameImpl::BeginNavigation(
         !weak_self) {
       return;
     }
-  }
 
-  if (info->navigation_policy == blink::kWebNavigationPolicyCurrentTab) {
     if (!info->form.IsNull()) {
       for (auto& observer : observers_)
         observer.WillSubmitForm(info->form);
@@ -5947,44 +5810,6 @@ void RenderFrameImpl::RequestOverlayRoutingToken(
       base::Unretained(this), std::move(callback)));
 }
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-void RenderFrameImpl::OnSelectPopupMenuItem(int selected_index) {
-  if (external_popup_menu_ == NULL)
-    return;
-
-  if (frame_)
-    frame_->NotifyUserActivation();
-  // We need to reset |external_popup_menu_| before calling DidSelectItem(),
-  // which might delete |this|.
-  // See ExternalPopupMenuRemoveTest.RemoveFrameOnChange
-  std::unique_ptr<ExternalPopupMenu> popup;
-  popup.swap(external_popup_menu_);
-  popup->DidSelectItem(selected_index);
-}
-#else
-void RenderFrameImpl::OnSelectPopupMenuItems(
-    bool canceled,
-    const std::vector<int>& selected_indices) {
-  // It is possible to receive more than one of these calls if the user presses
-  // a select faster than it takes for the show-select-popup IPC message to make
-  // it to the browser UI thread. Ignore the extra-messages.
-  // TODO(jcivelli): http:/b/5793321 Implement a better fix, as detailed in bug.
-  if (!external_popup_menu_)
-    return;
-
-  if (frame_)
-    frame_->NotifyUserActivation();
-  // We need to reset |external_popup_menu_| before calling DidSelectItems(),
-  // which might delete |this|.
-  // See ExternalPopupMenuRemoveTest.RemoveFrameOnChange
-  std::unique_ptr<ExternalPopupMenu> popup;
-  popup.swap(external_popup_menu_);
-  popup->DidSelectItems(canceled, selected_indices);
-}
-#endif
-#endif
-
 void RenderFrameImpl::OpenURL(std::unique_ptr<blink::WebNavigationInfo> info) {
   // A valid RequestorOrigin is always expected to be present.
   DCHECK(!info->url_request.RequestorOrigin().IsNull());
@@ -6007,17 +5832,27 @@ void RenderFrameImpl::OpenURL(std::unique_ptr<blink::WebNavigationInfo> info) {
       info->frame_load_type == WebFrameLoadType::kReplaceCurrentItem &&
       render_view_->history_list_length_;
   params.user_gesture = info->has_transient_user_activation;
+
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(info->initiator_frame);
+  params.initiator_routing_id = initiator_render_frame
+                                    ? initiator_render_frame->GetRoutingID()
+                                    : MSG_ROUTING_NONE;
+
+  if (info->impression)
+    params.impression = ConvertWebImpressionToImpression(*info->impression);
+
   if (GetContentClient()->renderer()->AllowPopup())
     params.user_gesture = true;
 
-  // TODO(csharrison,dgozman): FrameLoader::StartNavigation already consumes for
-  // all main frame navigations, except in the case where page A is navigating
-  // page B (e.g. using anchor targets). This edge case can go away when
-  // UserActivationV2 ships, which would make the conditional below redundant.
-  if (is_main_frame_ || policy == blink::kWebNavigationPolicyNewBackgroundTab ||
-      policy == blink::kWebNavigationPolicyNewForegroundTab ||
-      policy == blink::kWebNavigationPolicyNewWindow ||
-      policy == blink::kWebNavigationPolicyNewPopup) {
+  // A main frame navigation should already have consumed an activation in
+  // FrameLoader::StartNavigation.
+  DCHECK(!is_main_frame_ || !frame_->HasTransientUserActivation());
+  if (!is_main_frame_ &&
+      (policy == blink::kWebNavigationPolicyNewBackgroundTab ||
+       policy == blink::kWebNavigationPolicyNewForegroundTab ||
+       policy == blink::kWebNavigationPolicyNewWindow ||
+       policy == blink::kWebNavigationPolicyNewPopup)) {
     frame_->ConsumeTransientUserActivation();
   }
 
@@ -6307,8 +6142,16 @@ void RenderFrameImpl::BeginNavigationInternal(
     initiator = base::DictionaryValue::From(
         base::JSONReader::ReadDeprecated(info->devtools_initiator_info.Utf8()));
   }
+
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(info->initiator_frame);
+  int initiator_frame_routing_id = initiator_render_frame
+                                       ? initiator_render_frame->GetRoutingID()
+                                       : MSG_ROUTING_NONE;
+
   mojom::BeginNavigationParamsPtr begin_navigation_params =
       mojom::BeginNavigationParams::New(
+          initiator_frame_routing_id,
           GetWebURLRequestHeadersAsString(info->url_request), load_flags,
           info->url_request.GetSkipServiceWorker(),
           GetRequestContextTypeForWebURLRequest(info->url_request),
@@ -6318,10 +6161,14 @@ void RenderFrameImpl::BeginNavigationInternal(
           searchable_form_encoding, client_side_redirect_url,
           initiator ? base::make_optional<base::Value>(std::move(*initiator))
                     : base::nullopt,
-          info->url_request.GetExtraData()->attach_same_site_cookies(),
+          info->url_request.GetExtraData()->force_ignore_site_for_cookies(),
           info->url_request.TrustTokenParams()
               ? info->url_request.TrustTokenParams()->Clone()
-              : nullptr);
+              : nullptr,
+          info->impression
+              ? base::make_optional<Impression>(
+                    ConvertWebImpressionToImpression(*info->impression))
+              : base::nullopt);
 
   mojo::PendingAssociatedRemote<mojom::NavigationClient>
       navigation_client_remote;
@@ -6405,7 +6252,7 @@ bool RenderFrameImpl::ShouldDisplayErrorPageForFailedLoad(
 
   // Allow the embedder to suppress an error page.
   if (GetContentClient()->renderer()->ShouldSuppressErrorPage(
-          this, unreachable_url)) {
+          this, unreachable_url, error_code)) {
     return false;
   }
 
@@ -6439,7 +6286,7 @@ void RenderFrameImpl::HandlePepperImeCommit(const base::string16& text) {
     base::i18n::UTF16CharIterator iterator(&text);
     int32_t i = 0;
     while (iterator.Advance()) {
-      blink::WebKeyboardEvent char_event(blink::WebInputEvent::kChar,
+      blink::WebKeyboardEvent char_event(blink::WebInputEvent::Type::kChar,
                                          blink::WebInputEvent::kNoModifiers,
                                          ui::EventTimeForNow());
       char_event.windows_key_code = text[i];
@@ -6453,7 +6300,7 @@ void RenderFrameImpl::HandlePepperImeCommit(const base::string16& text) {
 
       if (GetLocalRootRenderWidget()->GetWebWidget())
         GetLocalRootRenderWidget()->GetWebWidget()->HandleInputEvent(
-            blink::WebCoalescedInputEvent(char_event));
+            blink::WebCoalescedInputEvent(char_event, ui::LatencyInfo()));
     }
   } else {
     // Mimics the order of events sent by WebKit.
@@ -6544,6 +6391,11 @@ RenderFrameImpl::CreateURLLoaderFactory() {
   return std::make_unique<FrameURLLoaderFactory>(weak_factory_.GetWeakPtr());
 }
 
+void RenderFrameImpl::OnStopLoading() {
+  for (auto& observer : observers_)
+    observer.OnStop();
+}
+
 void RenderFrameImpl::DraggableRegionsChanged() {
   for (auto& observer : observers_)
     observer.DraggableRegionsChanged();
@@ -6789,6 +6641,16 @@ void RenderFrameImpl::TransferUserActivationFrom(
   }
 }
 
+bool RenderFrameImpl::GetCaretBoundsFromFocusedPlugin(gfx::Rect& rect) {
+#if BUILDFLAG(ENABLE_PLUGINS)
+  if (focused_pepper_plugin_) {
+    rect = focused_pepper_plugin_->GetCaretBounds();
+    return true;
+  }
+#endif
+  return false;
+}
+
 void RenderFrameImpl::AddMessageToConsoleImpl(
     blink::mojom::ConsoleMessageLevel level,
     const std::string& message,
diff --git a/chromium/content/renderer/render_frame_impl.h b/chromium/content/renderer/render_frame_impl.h
index 6a33dcf8df3..0963dea51a8 100644
--- a/chromium/content/renderer/render_frame_impl.h
+++ b/chromium/content/renderer/render_frame_impl.h
@@ -79,7 +79,6 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/loader/loading_behavior_flag.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/autoplay/autoplay.mojom.h"
@@ -88,6 +87,7 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-forward.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame_owner_element_type.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-forward.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-forward.h"
@@ -103,6 +103,7 @@
 #include "third_party/blink/public/web/web_local_frame_client.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
 #include "third_party/blink/public/web/web_script_execution_callback.h"
+#include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/gfx/range/range.h"
 #include "url/gurl.h"
@@ -139,7 +140,9 @@ class Range;
 
 namespace media {
 class MediaPermission;
+#if !defined(OS_ANDROID)
 class SpeechRecognitionClient;
+#endif
 }
 
 namespace service_manager {
@@ -159,7 +162,6 @@ namespace content {
 class BlinkInterfaceRegistryImpl;
 class CompositorDependencies;
 class DocumentState;
-class ExternalPopupMenu;
 class FrameRequestBlocker;
 class MediaPermissionDispatcher;
 class NavigationClient;
@@ -225,6 +227,7 @@ class CONTENT_EXPORT RenderFrameImpl
       int opener_routing_id,
       int parent_routing_id,
       int previous_sibling_routing_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const FrameReplicationState& replicated_state,
       CompositorDependencies* compositor_deps,
@@ -308,10 +311,12 @@ class CONTENT_EXPORT RenderFrameImpl
   // Returns the RenderWidget associated with this frame.
   RenderWidget* GetLocalRootRenderWidget();
 
-  // This method must be called after the frame has been added to the frame
-  // tree. It creates all objects that depend on the frame being at its proper
-  // spot.
-  void Initialize();
+  // This method must be called after the WebLocalFrame backing this RenderFrame
+  // has been created and added to the frame tree. It creates all objects that
+  // depend on the frame being at its proper spot.
+  //
+  // Virtual for web tests to inject their own behaviour into the WebLocalFrame.
+  virtual void Initialize();
 
   // Notifications from RenderWidget.
   void WasHidden();
@@ -414,10 +419,6 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void ScriptedPrint(bool user_initiated);
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void DidHideExternalPopupMenu();
-#endif
-
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
 
@@ -459,7 +460,7 @@ class CONTENT_EXPORT RenderFrameImpl
       const url::Origin& content_origin,
       const gfx::Size& unobscured_size,
       RecordPeripheralDecision record_decision) override;
-  void WhitelistContentOrigin(const url::Origin& content_origin) override;
+  void AllowlistContentOrigin(const url::Origin& content_origin) override;
   void PluginDidStartLoading() override;
   void PluginDidStopLoading() override;
 #endif
@@ -524,10 +525,6 @@ class CONTENT_EXPORT RenderFrameImpl
   void EnableMojoJsBindings() override;
 
   // mojom::FrameNavigationControl implementation:
-  void PostMessageEvent(int32_t source_routing_id,
-                        const base::string16& source_origin,
-                        const base::string16& target_origin,
-                        blink::TransferableMessage message) override;
   void ForwardMessageFromHost(
       blink::TransferableMessage message,
       const url::Origin& source_origin,
@@ -621,6 +618,7 @@ class CONTENT_EXPORT RenderFrameImpl
       mojo::PendingAssociatedReceiver<blink::mojom::PortalClient> portal_client,
       blink::TransferableMessage data,
       OnPortalActivatedCallback callback) override;
+  void SwapIn() override;
 
   // mojom::FullscreenVideoElementHandler implementation:
   void RequestFullscreenVideoElement() override;
@@ -641,16 +639,15 @@ class CONTENT_EXPORT RenderFrameImpl
       const blink::WebString& sink_id) override;
   std::unique_ptr<blink::WebContentSettingsClient>
   CreateWorkerContentSettingsClient() override;
+#if !defined(OS_ANDROID)
   std::unique_ptr<media::SpeechRecognitionClient>
   CreateSpeechRecognitionClient();
+#endif
   scoped_refptr<blink::WebWorkerFetchContext> CreateWorkerFetchContext()
       override;
   scoped_refptr<blink::WebWorkerFetchContext>
   CreateWorkerFetchContextForPlzDedicatedWorker(
       blink::WebDedicatedWorkerHostFactoryClient* factory_client) override;
-  blink::WebExternalPopupMenu* CreateExternalPopupMenu(
-      const blink::WebPopupMenuInfo& popup_menu_info,
-      blink::WebExternalPopupMenuClient* popup_menu_client) override;
   std::unique_ptr<blink::WebPrescientNetworking> CreatePrescientNetworking()
       override;
   blink::BlameContext* GetFrameBlameContext() override;
@@ -660,15 +657,17 @@ class CONTENT_EXPORT RenderFrameImpl
       override;
   blink::WebLocalFrame* CreateChildFrame(
       blink::WebLocalFrame* parent,
-      blink::WebTreeScopeType scope,
+      blink::mojom::TreeScopeType scope,
       const blink::WebString& name,
       const blink::WebString& fallback_name,
       const blink::FramePolicy& frame_policy,
       const blink::WebFrameOwnerProperties& frame_owner_properties,
-      blink::FrameOwnerElementType frame_owner_element_type) override;
+      blink::mojom::FrameOwnerElementType frame_owner_element_type) override;
   std::pair<blink::WebRemoteFrame*, base::UnguessableToken> CreatePortal(
-      mojo::ScopedInterfaceEndpointHandle portal_endpoint,
-      mojo::ScopedInterfaceEndpointHandle client_endpoint,
+      blink::CrossVariantMojoAssociatedReceiver<
+          blink::mojom::PortalInterfaceBase> portal_endpoint,
+      blink::CrossVariantMojoAssociatedRemote<
+          blink::mojom::PortalClientInterfaceBase> client_endpoint,
       const blink::WebElement& portal_element) override;
   blink::WebRemoteFrame* AdoptPortal(
       const base::UnguessableToken& portal_token,
@@ -680,12 +679,9 @@ class CONTENT_EXPORT RenderFrameImpl
   void DidChangeFramePolicy(blink::WebFrame* child_frame,
                             const blink::FramePolicy& frame_policy) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags flags,
+      network::mojom::WebSandboxFlags flags,
       const blink::ParsedFeaturePolicy& fp_header,
       const blink::DocumentPolicy::FeatureState& dp_header) override;
-  void DidChangeFrameOwnerProperties(
-      blink::WebFrame* child_frame,
-      const blink::WebFrameOwnerProperties& frame_owner_properties) override;
   void DidMatchCSS(
       const blink::WebVector<blink::WebString>& newly_matching_selectors,
       const blink::WebVector<blink::WebString>& stopped_matching_selectors)
@@ -705,7 +701,7 @@ class CONTENT_EXPORT RenderFrameImpl
                            blink::WebHistoryCommitType commit_type,
                            bool should_reset_browser_interface_broker) override;
   void DidCreateInitialEmptyDocument() override;
-  void DidCommitJavascriptUrlNavigation(
+  void DidCommitDocumentReplacementNavigation(
       blink::WebDocumentLoader* document_loader) override;
   void DidClearWindowObject() override;
   void DidCreateDocumentElement() override;
@@ -745,6 +741,10 @@ class CONTENT_EXPORT RenderFrameImpl
   void DidObserveNewCssPropertyUsage(blink::mojom::CSSSampleId css_property,
                                      bool is_animated) override;
   void DidObserveLayoutShift(double score, bool after_input_or_scroll) override;
+  void DidObserveLayoutNg(uint32_t all_block_count,
+                          uint32_t ng_block_count,
+                          uint32_t all_call_count,
+                          uint32_t ng_call_count) override;
   void DidObserveLazyLoadBehavior(
       blink::WebLocalFrameClient::LazyLoadBehavior lazy_load_behavior) override;
   bool ShouldTrackUseCounter(const blink::WebURL& url) override;
@@ -761,15 +761,14 @@ class CONTENT_EXPORT RenderFrameImpl
   mojom::RendererAudioInputStreamFactory* GetAudioInputStreamFactory();
   bool AllowContentInitiatedDataUrlNavigations(
       const blink::WebURL& url) override;
-  void PostAccessibilityEvent(const blink::WebAXObject& obj,
-                              ax::mojom::Event event,
-                              ax::mojom::EventFrom event_from) override;
+  void PostAccessibilityEvent(const ui::AXEvent& event) override;
   void MarkWebAXObjectDirty(const blink::WebAXObject& obj,
                             bool subtree) override;
   void CheckIfAudioSinkExistsAndIsAuthorized(
       const blink::WebString& sink_id,
       blink::WebSetSinkIdCompleteCallback callback) override;
   std::unique_ptr<blink::WebURLLoaderFactory> CreateURLLoaderFactory() override;
+  void OnStopLoading() override;
   void DraggableRegionsChanged() override;
   blink::BrowserInterfaceBrokerProxy* GetBrowserInterfaceBroker() override;
 
@@ -910,6 +909,8 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void TransferUserActivationFrom(blink::WebLocalFrame* source_frame) override;
 
+  bool GetCaretBoundsFromFocusedPlugin(gfx::Rect& rect) override;
+
   // Used in tests to install a fake WebURLLoaderFactory via
   // RenderViewTest::CreateFakeWebURLLoaderFactory().
   void SetWebURLLoaderFactoryOverrideForTest(
@@ -926,11 +927,6 @@ class CONTENT_EXPORT RenderFrameImpl
   friend class RenderFrameObserver;
   friend class TestRenderFrame;
 
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuDisplayNoneTest, SelectItem);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuRemoveTest, RemoveFrameOnChange);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuRemoveTest, RemoveOnChange);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuTest, NormalCase);
-  FRIEND_TEST_ALL_PREFIXES(ExternalPopupMenuTest, ShowPopupThenNavigate);
   FRIEND_TEST_ALL_PREFIXES(RenderAccessibilityImplTest,
                            AccessibilityMessagesQueueWhileSwappedOut);
   FRIEND_TEST_ALL_PREFIXES(RenderFrameImplTest, LocalChildFrameWasShown);
@@ -1009,12 +1005,12 @@ class CONTENT_EXPORT RenderFrameImpl
   void RemoveObserver(RenderFrameObserver* observer);
 
   // Swaps the current frame into the frame tree, replacing the
-  // RenderFrameProxy it is associated with.  Return value indicates whether
-  // the swap operation succeeded.  This should only be used for provisional
-  // frames associated with a proxy, while the proxy is still in the frame
-  // tree. If the associated proxy has been detached before this is called,
-  // this returns false and aborts the swap.
-  bool SwapIn();
+  // RenderFrameProxy it is associated with. Return value indicates whether
+  // the swap operation succeeded. This should only be used for provisional
+  // frames associated with a proxy, while the proxy is still in the frame tree.
+  // If the associated proxy has been detached before this is called, this
+  // returns false and aborts the swap.
+  bool SwapInInternal();
 
   // Returns the RenderWidget associated with the main frame.
   // TODO(ajwong): This method should go away when cross-frame property setting
@@ -1028,12 +1024,11 @@ class CONTENT_EXPORT RenderFrameImpl
   //
   // The documentation for these functions should be in
   // content/common/*_messages.h for the message that the function is handling.
-  void OnSwapIn();
   void OnUnload(int proxy_routing_id,
                 bool is_loading,
-                const FrameReplicationState& replicated_frame_state);
+                const FrameReplicationState& replicated_frame_state,
+                const base::UnguessableToken& frame_token);
   void OnDeleteFrame(FrameDeleteIntention intent);
-  void OnStop();
   void OnShowContextMenu(const gfx::Point& location);
   void OnContextMenuClosed(const CustomContextMenuContext& custom_context);
   void OnCustomContextMenuAction(const CustomContextMenuContext& custom_context,
@@ -1045,7 +1040,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // TODO(https://crbug.com/995428): Deprecated.
   void OnReload();
   void OnUpdateOpener(int opener_routing_id);
-  void OnAdvanceFocus(blink::mojom::FocusType type, int32_t source_routing_id);
   void OnGetSavableResourceLinks();
   void OnGetSerializedHtmlWithLocalLinks(
       const std::map<GURL, base::FilePath>& url_to_local_path,
@@ -1054,15 +1048,6 @@ class CONTENT_EXPORT RenderFrameImpl
   void OnSuppressFurtherDialogs();
   void OnMixedContentFound(const FrameMsg_MixedContentFound_Params& params);
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-#if defined(OS_MACOSX)
-  void OnSelectPopupMenuItem(int selected_index);
-#else
-  void OnSelectPopupMenuItems(bool canceled,
-                              const std::vector<int>& selected_indices);
-#endif
-#endif
-
   // Callback scheduled from SerializeAsMHTML for when writing serialized
   // MHTML to the handle has been completed in the file thread.
   void OnWriteMHTMLComplete(
@@ -1361,7 +1346,7 @@ class CONTENT_EXPORT RenderFrameImpl
   bool in_frame_tree_;
 
   RenderViewImpl* render_view_;
-  int routing_id_;
+  const int routing_id_;
 
   // If this RenderFrame was created to replace a previous object, this will
   // store its routing id. The previous object can be:
@@ -1459,11 +1444,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // Whether or not this RenderFrame is currently pasting.
   bool is_pasting_;
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  // The external popup for the currently showing select popup.
-  std::unique_ptr<ExternalPopupMenu> external_popup_menu_;
-#endif
-
   std::unique_ptr<FrameBlameContext> blame_context_;
 
   // Plugins -------------------------------------------------------------------
diff --git a/chromium/content/renderer/render_frame_impl_browsertest.cc b/chromium/content/renderer/render_frame_impl_browsertest.cc
index 1f6d2113836..866a4905895 100644
--- a/chromium/content/renderer/render_frame_impl_browsertest.cc
+++ b/chromium/content/renderer/render_frame_impl_browsertest.cc
@@ -113,7 +113,8 @@ class RenderFrameImplTest : public RenderViewTest {
 
     RenderFrameImpl::FromWebFrame(
         view_->GetMainRenderFrame()->GetWebFrame()->FirstChild())
-        ->OnUnload(kFrameProxyRouteId, false, frame_replication_state);
+        ->OnUnload(kFrameProxyRouteId, false, frame_replication_state,
+                   base::UnguessableToken::Create());
 
     mojo::PendingRemote<service_manager::mojom::InterfaceProvider>
         stub_interface_provider;
@@ -128,8 +129,8 @@ class RenderFrameImplTest : public RenderViewTest {
         kSubframeRouteId, std::move(stub_interface_provider),
         std::move(stub_browser_interface_broker), MSG_ROUTING_NONE,
         MSG_ROUTING_NONE, kFrameProxyRouteId, MSG_ROUTING_NONE,
-        base::UnguessableToken::Create(), frame_replication_state,
-        &compositor_deps_, std::move(widget_params),
+        base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+        frame_replication_state, &compositor_deps_, std::move(widget_params),
         blink::mojom::FrameOwnerProperties::New(),
         /*has_committed_real_load=*/true);
 
@@ -289,8 +290,9 @@ TEST_F(RenderFrameImplTest, LocalChildFrameWasShown) {
   blink::WebLocalFrame* parent_web_frame = frame()->GetWebFrame();
 
   parent_web_frame->CreateLocalChild(
-      blink::WebTreeScopeType::kDocument, grandchild,
-      grandchild->blink_interface_registry_.get());
+      blink::mojom::TreeScopeType::kDocument, grandchild,
+      grandchild->blink_interface_registry_.get(),
+      base::UnguessableToken::Create());
   grandchild->in_frame_tree_ = true;
   grandchild->Initialize();
 
@@ -538,8 +540,7 @@ TEST_F(RenderFrameImplTest, DISABLED_MainFrameDocumentIntersectionRecorded) {
   frame_widget()->OnMessageReceived(set_viewport_intersection_message);
   // Setting a new frame intersection in a local frame triggers the render frame
   // observer call.
-  EXPECT_EQ(observer.last_intersection_rect(),
-            blink::WebRect(7, -11, 200, 140));
+  EXPECT_EQ(observer.last_intersection_rect(), blink::WebRect(0, 0, 200, 140));
 }
 
 // Used to annotate the source of an interface request.
diff --git a/chromium/content/renderer/render_frame_proxy.cc b/chromium/content/renderer/render_frame_proxy.cc
index 676217a665c..fb083b2f555 100644
--- a/chromium/content/renderer/render_frame_proxy.cc
+++ b/chromium/content/renderer/render_frame_proxy.cc
@@ -21,16 +21,19 @@
 #include "content/common/view_messages.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/impression.h"
 #include "content/public/common/screen_info.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/child_frame_compositing_helper.h"
+#include "content/renderer/impression_conversions.h"
 #include "content/renderer/loader/web_url_request_util.h"
 #include "content/renderer/mojo/blink_interface_registry_impl.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
+#include "ipc/ipc_message.h"
 #include "ipc/ipc_message_macros.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "printing/buildflags/buildflags.h"
@@ -71,7 +74,8 @@ base::LazyInstance<FrameProxyMap>::DestructorAtExit g_frame_proxy_map =
 RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
     RenderFrameImpl* frame_to_replace,
     int routing_id,
-    blink::WebTreeScopeType scope) {
+    blink::mojom::TreeScopeType scope,
+    const base::UnguessableToken& proxy_frame_token) {
   CHECK_NE(routing_id, MSG_ROUTING_NONE);
 
   std::unique_ptr<RenderFrameProxy> proxy(new RenderFrameProxy(routing_id));
@@ -83,7 +87,7 @@ RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
   // follow later.
   blink::WebRemoteFrame* web_frame = blink::WebRemoteFrame::Create(
       scope, proxy.get(), proxy->blink_interface_registry_.get(),
-      proxy->GetRemoteAssociatedInterfaces());
+      proxy->GetRemoteAssociatedInterfaces(), proxy_frame_token);
 
   RenderWidget* ancestor_widget = nullptr;
   bool parent_is_local = false;
@@ -117,6 +121,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
     blink::WebFrame* opener,
     int parent_routing_id,
     const FrameReplicationState& replicated_state,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token) {
   RenderFrameProxy* parent = nullptr;
   if (parent_routing_id != MSG_ROUTING_NONE) {
@@ -140,7 +145,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
     web_frame = blink::WebRemoteFrame::CreateMainFrame(
         render_view->GetWebView(), proxy.get(),
         proxy->blink_interface_registry_.get(),
-        proxy->GetRemoteAssociatedInterfaces(), opener);
+        proxy->GetRemoteAssociatedInterfaces(), frame_token, opener);
     // Root frame proxy has no ancestors to point to their RenderWidget.
   } else {
     // Create a frame under an existing parent. The parent is always expected
@@ -152,7 +157,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
         replicated_state.frame_policy,
         replicated_state.frame_owner_element_type, proxy.get(),
         proxy->blink_interface_registry_.get(),
-        proxy->GetRemoteAssociatedInterfaces(), opener);
+        proxy->GetRemoteAssociatedInterfaces(), frame_token, opener);
     proxy->unique_name_ = replicated_state.unique_name;
     render_view = parent->render_view();
     ancestor_widget = parent->ancestor_render_widget_;
@@ -175,14 +180,15 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
 RenderFrameProxy* RenderFrameProxy::CreateProxyForPortal(
     RenderFrameImpl* parent,
     int proxy_routing_id,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token,
     const blink::WebElement& portal_element) {
   auto proxy = base::WrapUnique(new RenderFrameProxy(proxy_routing_id));
   proxy->devtools_frame_token_ = devtools_frame_token;
   blink::WebRemoteFrame* web_frame = blink::WebRemoteFrame::CreateForPortal(
-      blink::WebTreeScopeType::kDocument, proxy.get(),
+      blink::mojom::TreeScopeType::kDocument, proxy.get(),
       proxy->blink_interface_registry_.get(),
-      proxy->GetRemoteAssociatedInterfaces(), portal_element);
+      proxy->GetRemoteAssociatedInterfaces(), frame_token, portal_element);
   proxy->Init(web_frame, parent->render_view(),
               parent->GetLocalRootRenderWidget(), true);
   return proxy.release();
@@ -628,13 +634,16 @@ void RenderFrameProxy::ForwardPostMessage(
   Send(new FrameHostMsg_RouteMessageEvent(routing_id_, params));
 }
 
-void RenderFrameProxy::Navigate(const blink::WebURLRequest& request,
-                                bool should_replace_current_entry,
-                                bool is_opener_navigation,
-                                bool initiator_frame_has_download_sandbox_flag,
-                                bool blocking_downloads_in_sandbox_enabled,
-                                bool initiator_frame_is_ad,
-                                mojo::ScopedMessagePipeHandle blob_url_token) {
+void RenderFrameProxy::Navigate(
+    const blink::WebURLRequest& request,
+    blink::WebLocalFrame* initiator_frame,
+    bool should_replace_current_entry,
+    bool is_opener_navigation,
+    bool initiator_frame_has_download_sandbox_flag,
+    bool blocking_downloads_in_sandbox_enabled,
+    bool initiator_frame_is_ad,
+    mojo::ScopedMessagePipeHandle blob_url_token,
+    const base::Optional<blink::WebImpression>& impression) {
   // The request must always have a valid initiator origin.
   DCHECK(!request.RequestorOrigin().IsNull());
 
@@ -652,6 +661,15 @@ void RenderFrameProxy::Navigate(const blink::WebURLRequest& request,
   params.triggering_event_info = blink::TriggeringEventInfo::kUnknown;
   params.blob_url_token = blob_url_token.release();
 
+  RenderFrameImpl* initiator_render_frame =
+      RenderFrameImpl::FromWebFrame(initiator_frame);
+  params.initiator_routing_id = initiator_render_frame
+                                    ? initiator_render_frame->GetRoutingID()
+                                    : MSG_ROUTING_NONE;
+
+  if (impression)
+    params.impression = ConvertWebImpressionToImpression(*impression);
+
   // Note: For the AdFrame/Sandbox download policy here it only covers the case
   // where the navigation initiator frame is ad. The download_policy may be
   // further augmented in RenderFrameProxyHost::OnOpenURL if the navigating
diff --git a/chromium/content/renderer/render_frame_proxy.h b/chromium/content/renderer/render_frame_proxy.h
index d202bf52adf..6012fd36b03 100644
--- a/chromium/content/renderer/render_frame_proxy.h
+++ b/chromium/content/renderer/render_frame_proxy.h
@@ -78,7 +78,8 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   static RenderFrameProxy* CreateProxyToReplaceFrame(
       RenderFrameImpl* frame_to_replace,
       int routing_id,
-      blink::WebTreeScopeType scope);
+      blink::mojom::TreeScopeType scope,
+      const base::UnguessableToken& proxy_frame_token);
 
   // This method should be used to create a RenderFrameProxy, when there isn't
   // an existing RenderFrame. It should be called to construct a local
@@ -99,6 +100,7 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
       blink::WebFrame* opener,
       int parent_routing_id,
       const FrameReplicationState& replicated_state,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token);
 
   // Creates a RenderFrameProxy to be used with a portal owned by |parent|.
@@ -106,6 +108,7 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   static RenderFrameProxy* CreateProxyForPortal(
       RenderFrameImpl* parent,
       int proxy_routing_id,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token,
       const blink::WebElement& portal_element);
 
@@ -178,13 +181,16 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
                           blink::WebRemoteFrame* targetFrame,
                           blink::WebSecurityOrigin target,
                           blink::WebDOMMessageEvent event) override;
-  void Navigate(const blink::WebURLRequest& request,
-                bool should_replace_current_entry,
-                bool is_opener_navigation,
-                bool initiator_frame_has_download_sandbox_flag,
-                bool blocking_downloads_in_sandbox_enabled,
-                bool initiator_frame_is_ad,
-                mojo::ScopedMessagePipeHandle blob_url_token) override;
+  void Navigate(
+      const blink::WebURLRequest& request,
+      blink::WebLocalFrame* initiator_frame,
+      bool should_replace_current_entry,
+      bool is_opener_navigation,
+      bool initiator_frame_has_download_sandbox_flag,
+      bool blocking_downloads_in_sandbox_enabled,
+      bool initiator_frame_is_ad,
+      mojo::ScopedMessagePipeHandle blob_url_token,
+      const base::Optional<blink::WebImpression>& impression) override;
   void FrameRectsChanged(const blink::WebRect& local_frame_rect,
                          const blink::WebRect& screen_space_rect) override;
   void UpdateRemoteViewportIntersection(
diff --git a/chromium/content/renderer/render_process.h b/chromium/content/renderer/render_process.h
index e18ea7ae216..69f93d3ee75 100644
--- a/chromium/content/renderer/render_process.h
+++ b/chromium/content/renderer/render_process.h
@@ -30,13 +30,6 @@ class RenderProcess : public ChildProcess {
                     thread_pool_init_params);
   ~RenderProcess() override {}
 
-  // Keep track of the cumulative set of enabled bindings for this process,
-  // across any view.
-  virtual void AddBindings(int bindings) = 0;
-
-  // The cumulative set of enabled bindings for this process.
-  virtual int GetEnabledBindings() const = 0;
-
   // Returns a pointer to the RenderProcess singleton instance. Assuming that
   // we're actually a renderer or a renderer test, this static cast will
   // be correct.
diff --git a/chromium/content/renderer/render_process_impl.cc b/chromium/content/renderer/render_process_impl.cc
index f31a4f949bd..fb9d6684a78 100644
--- a/chromium/content/renderer/render_process_impl.cc
+++ b/chromium/content/renderer/render_process_impl.cc
@@ -88,8 +88,7 @@ void V8DcheckCallbackHandler(const char* file, int line, const char* message) {
 namespace content {
 
 RenderProcessImpl::RenderProcessImpl()
-    : RenderProcess("Renderer", GetThreadPoolInitParams()),
-      enabled_bindings_(0) {
+    : RenderProcess("Renderer", GetThreadPoolInitParams()) {
 #if defined(DCHECK_IS_CONFIGURABLE)
   // Some official builds ship with DCHECKs compiled in. Failing DCHECKs then
   // are either fatal or simply log the error, based on a feature flag.
@@ -221,11 +220,6 @@ RenderProcessImpl::RenderProcessImpl()
       v8::V8::SetFlagsFromString(flag.as_string().c_str(), flag.size());
     }
   }
-
-  if (command_line.HasSwitch(switches::kDomAutomationController))
-    enabled_bindings_ |= BINDINGS_POLICY_DOM_AUTOMATION;
-  if (command_line.HasSwitch(switches::kStatsCollectionController))
-    enabled_bindings_ |= BINDINGS_POLICY_STATS_COLLECTION;
 }
 
 RenderProcessImpl::~RenderProcessImpl() {
@@ -242,14 +236,6 @@ std::unique_ptr<RenderProcess> RenderProcessImpl::Create() {
   return base::WrapUnique(new RenderProcessImpl());
 }
 
-void RenderProcessImpl::AddBindings(int bindings) {
-  enabled_bindings_ |= bindings;
-}
-
-int RenderProcessImpl::GetEnabledBindings() const {
-  return enabled_bindings_;
-}
-
 void RenderProcessImpl::AddRefProcess() {
   NOTREACHED();
 }
diff --git a/chromium/content/renderer/render_process_impl.h b/chromium/content/renderer/render_process_impl.h
index b8f72956625..67dfe3f903f 100644
--- a/chromium/content/renderer/render_process_impl.h
+++ b/chromium/content/renderer/render_process_impl.h
@@ -27,10 +27,6 @@ class RenderProcessImpl : public RenderProcess {
   // required by constructor of the base class.
   static std::unique_ptr<RenderProcess> Create();
 
-  // RenderProcess implementation.
-  void AddBindings(int bindings) override;
-  int GetEnabledBindings() const override;
-
   // Do not use these functions.
   // The browser process is the only one responsible for knowing when to
   // shutdown its renderer processes. Reference counting to keep this process
@@ -42,10 +38,6 @@ class RenderProcessImpl : public RenderProcess {
  private:
   RenderProcessImpl();
 
-  // Bitwise-ORed set of extra bindings that have been enabled anywhere in this
-  // process.  See BindingsPolicy for details.
-  int enabled_bindings_;
-
   DISALLOW_COPY_AND_ASSIGN(RenderProcessImpl);
 };
 
diff --git a/chromium/content/renderer/render_thread_impl.cc b/chromium/content/renderer/render_thread_impl.cc
index 76176518dfe..b305148481d 100644
--- a/chromium/content/renderer/render_thread_impl.cc
+++ b/chromium/content/renderer/render_thread_impl.cc
@@ -61,7 +61,6 @@
 #include "content/child/thread_safe_sender.h"
 #include "content/common/buildflags.h"
 #include "content/common/content_constants_internal.h"
-#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/render_frame_metadata.mojom.h"
 #include "content/common/view_messages.h"
@@ -182,6 +181,10 @@
 #include <malloc.h>
 #endif
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+#include "base/test/clang_profiling.h"
+#endif
+
 using base::ThreadRestrictions;
 using blink::WebDocument;
 using blink::WebFrame;
@@ -662,6 +665,9 @@ void RenderThreadImpl::Init() {
 // but the system default is true.
 #if defined(OS_MACOSX)
   is_elastic_overscroll_enabled_ = true;
+#elif defined(OS_WIN)
+  is_elastic_overscroll_enabled_ =
+      base::FeatureList::IsEnabled(features::kElasticOverscrollWin);
 #else
   is_elastic_overscroll_enabled_ = false;
 #endif
@@ -880,8 +886,8 @@ IPC::SyncMessageFilter* RenderThreadImpl::GetSyncMessageFilter() {
 
 void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
   ChildThreadImpl::GetRouter()->AddRoute(routing_id, listener);
-  auto it = pending_frame_creates_.find(routing_id);
-  if (it == pending_frame_creates_.end())
+  auto it = pending_frames_.find(routing_id);
+  if (it == pending_frames_.end())
     return;
 
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(routing_id);
@@ -897,25 +903,22 @@ void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
       frame->GetTaskRunner(
           blink::TaskType::kInternalNavigationAssociatedUnfreezable));
 
-  scoped_refptr<PendingFrameCreate> create(it->second);
-  frame->BindFrame(it->second->TakeFrameReceiver());
-  pending_frame_creates_.erase(it);
+  frame->BindFrame(std::move(it->second));
+  pending_frames_.erase(it);
 }
 
 void RenderThreadImpl::RemoveRoute(int32_t routing_id) {
   ChildThreadImpl::GetRouter()->RemoveRoute(routing_id);
   unfreezable_message_filter_->RemoveListenerUnfreezableTaskRunner(routing_id);
   GetChannel()->RemoveListenerTaskRunner(routing_id);
+  pending_frames_.erase(routing_id);
 }
 
 void RenderThreadImpl::RegisterPendingFrameCreate(
     int routing_id,
     mojo::PendingReceiver<mojom::Frame> frame_receiver) {
-  std::pair<PendingFrameCreateMap::iterator, bool> result =
-      pending_frame_creates_.insert(std::make_pair(
-          routing_id, base::MakeRefCounted<PendingFrameCreate>(
-                          routing_id, std::move(frame_receiver))));
-  CHECK(result.second) << "Inserting a duplicate item.";
+  auto pair = pending_frames_.emplace(routing_id, std::move(frame_receiver));
+  CHECK(pair.second) << "Inserting a duplicate item.";
 }
 
 mojom::RendererHost* RenderThreadImpl::GetRendererHost() {
@@ -1090,9 +1093,10 @@ int RenderThreadImpl::PostTaskToAllWebWorkers(base::RepeatingClosure closure) {
 }
 
 bool RenderThreadImpl::ResolveProxy(const GURL& url, std::string* proxy_list) {
-  bool result = false;
-  Send(new ViewHostMsg_ResolveProxy(url, &result, proxy_list));
-  return result;
+  base::Optional<std::string> result;
+  GetRendererHost()->ResolveProxy(url, &result);
+  *proxy_list = result.value_or(std::string());
+  return result.has_value();
 }
 
 media::GpuVideoAcceleratorFactories* RenderThreadImpl::GetGpuFactories() {
@@ -1358,9 +1362,8 @@ RenderThreadImpl::GetCompositorMainThreadTaskRunner() {
   return main_thread_compositor_task_runner_;
 }
 
-scoped_refptr<base::SingleThreadTaskRunner>
-RenderThreadImpl::GetCompositorImplThreadTaskRunner() {
-  return compositor_task_runner_;
+bool RenderThreadImpl::IsSingleThreaded() {
+  return !compositor_task_runner_;
 }
 
 scoped_refptr<base::SingleThreadTaskRunner>
@@ -1484,6 +1487,16 @@ void RenderThreadImpl::EnableV8LowMemoryMode() {
     low_memory_mode_controller_.reset(new LowMemoryModeController());
 }
 
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+void RenderThreadImpl::WriteClangProfilingProfile(
+    WriteClangProfilingProfileCallback callback) {
+  // This will write the profiling profile to the file that has been opened and
+  // passed to this renderer by the browser.
+  base::WriteClangProfilingProfile();
+  std::move(callback).Run();
+}
+#endif
+
 bool RenderThreadImpl::GetRendererMemoryMetrics(
     RendererMemoryMetrics* memory_metrics) const {
   DCHECK(memory_metrics);
@@ -1679,9 +1692,10 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
     const GURL& url,
     LayerTreeFrameSinkCallback callback,
     const char* client_name) {
+  const bool for_web_tests = blink::WebTestMode();
   // Misconfigured bots (eg. crbug.com/780757) could run web tests on a
   // machine where gpu compositing doesn't work. Don't crash in that case.
-  if (web_test_mode() && is_gpu_compositing_disabled_) {
+  if (for_web_tests && is_gpu_compositing_disabled_) {
     LOG(FATAL) << "Web tests require gpu compositing, but it is disabled.";
     return;
   }
@@ -1705,7 +1719,7 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
       *base::CommandLine::ForCurrentProcess();
   cc::mojo_embedder::AsyncLayerTreeFrameSink::InitParams params;
   params.compositor_task_runner = compositor_task_runner_;
-  if (web_test_mode() && !compositor_task_runner_) {
+  if (for_web_tests && !compositor_task_runner_) {
     // The frame sink provider expects a compositor task runner, but we might
     // not have that if we're running web tests in single threaded mode.
     // Set it to be our thread's task runner instead.
@@ -1734,7 +1748,7 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
       compositor_frame_sink_client.InitWithNewPipeAndPassReceiver();
 
   if (is_gpu_compositing_disabled_) {
-    DCHECK(!web_test_mode());
+    DCHECK(!for_web_tests);
     frame_sink_provider_->CreateForWidget(
         render_widget->routing_id(), std::move(compositor_frame_sink_receiver),
         std::move(compositor_frame_sink_client));
@@ -1892,8 +1906,8 @@ void RenderThreadImpl::CreateFrame(mojom::CreateFrameParamsPtr params) {
       params->routing_id, std::move(interface_provider),
       std::move(browser_interface_broker), params->previous_routing_id,
       params->opener_routing_id, params->parent_routing_id,
-      params->previous_sibling_routing_id, params->devtools_frame_token,
-      params->replication_state, compositor_deps,
+      params->previous_sibling_routing_id, params->frame_token,
+      params->devtools_frame_token, params->replication_state, compositor_deps,
       std::move(params->widget_params),
       std::move(params->frame_owner_properties),
       params->has_committed_real_load);
@@ -1905,11 +1919,12 @@ void RenderThreadImpl::CreateFrameProxy(
     int32_t opener_routing_id,
     int32_t parent_routing_id,
     const FrameReplicationState& replicated_state,
+    const base::UnguessableToken& frame_token,
     const base::UnguessableToken& devtools_frame_token) {
   RenderFrameProxy::CreateFrameProxy(
       routing_id, render_view_routing_id,
       RenderFrameImpl::ResolveWebFrame(opener_routing_id), parent_routing_id,
-      replicated_state, devtools_frame_token);
+      replicated_state, frame_token, devtools_frame_token);
 }
 
 void RenderThreadImpl::OnNetworkConnectionChanged(
@@ -2201,19 +2216,6 @@ void RenderThreadImpl::ReleaseFreeMemory() {
   }
 }
 
-RenderThreadImpl::PendingFrameCreate::PendingFrameCreate(
-    int routing_id,
-    mojo::PendingReceiver<mojom::Frame> frame_receiver)
-    : routing_id_(routing_id), frame_receiver_(std::move(frame_receiver)) {}
-
-RenderThreadImpl::PendingFrameCreate::~PendingFrameCreate() = default;
-
-void RenderThreadImpl::PendingFrameCreate::OnConnectionError() {
-  size_t erased =
-      RenderThreadImpl::current()->pending_frame_creates_.erase(routing_id_);
-  DCHECK_EQ(1u, erased);
-}
-
 void RenderThreadImpl::OnSyncMemoryPressure(
     base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) {
   if (!blink::MainThreadIsolate())
diff --git a/chromium/content/renderer/render_thread_impl.h b/chromium/content/renderer/render_thread_impl.h
index 5734290d5c3..301ea6a3055 100644
--- a/chromium/content/renderer/render_thread_impl.h
+++ b/chromium/content/renderer/render_thread_impl.h
@@ -16,6 +16,7 @@
 #include <vector>
 
 #include "base/cancelable_callback.h"
+#include "base/clang_profiling_buildflags.h"
 #include "base/macros.h"
 #include "base/memory/discardable_memory_allocator.h"
 #include "base/memory/memory_pressure_listener.h"
@@ -198,10 +199,7 @@ class CONTENT_EXPORT RenderThreadImpl
   bool IsGpuMemoryBufferCompositorResourcesEnabled() override;
   bool IsElasticOverscrollEnabled() override;
   bool IsUseZoomForDSFEnabled() override;
-  scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorMainThreadTaskRunner() override;
-  scoped_refptr<base::SingleThreadTaskRunner>
-  GetCompositorImplThreadTaskRunner() override;
+  bool IsSingleThreaded() override;
   scoped_refptr<base::SingleThreadTaskRunner> GetCleanupTaskRunner() override;
   blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() override;
   cc::TaskGraphRunner* GetTaskGraphRunner() override;
@@ -218,6 +216,8 @@ class CONTENT_EXPORT RenderThreadImpl
 #endif
 
   bool IsThreadedAnimationEnabled();
+  scoped_refptr<base::SingleThreadTaskRunner>
+  GetCompositorMainThreadTaskRunner();
 
   // viz::mojom::CompositingModeWatcher implementation.
   void CompositingModeFallbackToSoftware() override;
@@ -237,12 +237,6 @@ class CONTENT_EXPORT RenderThreadImpl
 
   blink::AssociatedInterfaceRegistry* GetAssociatedInterfaceRegistry();
 
-  // True if we are running web tests. This currently disables forwarding
-  // various status messages to the console, skips network error pages, and
-  // short circuits size update and focus events.
-  bool web_test_mode() const { return web_test_mode_; }
-  void enable_web_test_mode() { web_test_mode_ = true; }
-
   base::DiscardableMemoryAllocator* GetDiscardableMemoryAllocatorForTest()
       const {
     return discardable_memory_allocator_.get();
@@ -470,6 +464,7 @@ class CONTENT_EXPORT RenderThreadImpl
       int32_t opener_routing_id,
       int32_t parent_routing_id,
       const FrameReplicationState& replicated_state,
+      const base::UnguessableToken& frame_token,
       const base::UnguessableToken& devtools_frame_token) override;
   void OnNetworkConnectionChanged(
       net::NetworkChangeNotifier::ConnectionType type,
@@ -494,7 +489,10 @@ class CONTENT_EXPORT RenderThreadImpl
   void SetSchedulerKeepActive(bool keep_active) override;
   void SetIsLockedToSite() override;
   void EnableV8LowMemoryMode() override;
-
+#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+  void WriteClangProfilingProfile(
+      WriteClangProfilingProfileCallback callback) override;
+#endif
   void OnMemoryPressure(
       base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level);
 
@@ -554,9 +552,6 @@ class CONTENT_EXPORT RenderThreadImpl
   blink::WebString user_agent_;
   blink::UserAgentMetadata user_agent_metadata_;
 
-  // Used to control web test specific behavior.
-  bool web_test_mode_ = false;
-
   // Sticky once true, indicates that compositing is done without Gpu, so
   // resources given to the compositor or to the viz service should be
   // software-based.
@@ -626,30 +621,9 @@ class CONTENT_EXPORT RenderThreadImpl
   // Target rendering ColorSpace.
   gfx::ColorSpace rendering_color_space_;
 
-  class PendingFrameCreate : public base::RefCounted<PendingFrameCreate> {
-   public:
-    PendingFrameCreate(int routing_id,
-                       mojo::PendingReceiver<mojom::Frame> frame_receiver);
-
-    mojo::PendingReceiver<mojom::Frame> TakeFrameReceiver() {
-      return std::move(frame_receiver_);
-    }
-
-   private:
-    friend class base::RefCounted<PendingFrameCreate>;
-
-    ~PendingFrameCreate();
-
-    // Mojo error handler.
-    void OnConnectionError();
-
-    int routing_id_;
-    mojo::PendingReceiver<mojom::Frame> frame_receiver_;
-  };
-
-  using PendingFrameCreateMap =
-      std::map<int, scoped_refptr<PendingFrameCreate>>;
-  PendingFrameCreateMap pending_frame_creates_;
+  // Used when AddRoute() is called and the RenderFrameImpl hasn't been created
+  // yet.
+  std::map<int, mojo::PendingReceiver<mojom::Frame>> pending_frames_;
 
   mojo::AssociatedRemote<mojom::RendererHost> renderer_host_;
 
diff --git a/chromium/content/renderer/render_thread_impl_browsertest.cc b/chromium/content/renderer/render_thread_impl_browsertest.cc
index e009558e858..9add01eef49 100644
--- a/chromium/content/renderer/render_thread_impl_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_browsertest.cc
@@ -38,17 +38,18 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/test/browser_task_environment.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_content_client_initializer.h"
 #include "content/public/test/test_launcher.h"
 #include "content/renderer/render_process_impl.h"
-#include "content/test/mock_render_process.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "gpu/command_buffer/client/gpu_memory_buffer_manager.h"
 #include "gpu/config/gpu_switches.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/scheduler/test/web_mock_thread_scheduler.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
@@ -163,7 +164,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
         ChildProcessHost::Create(this, ChildProcessHost::IpcMode::kNormal);
     process_host_->CreateChannelMojo();
 
-    mock_process_.reset(new MockRenderProcess);
+    process_.reset(new RenderProcess);
     test_task_counter_ = base::MakeRefCounted<TestTaskCounter>();
 
     // RenderThreadImpl expects the browser to pass these flags.
@@ -179,6 +180,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
     // in RenderThreadImpl::Init().
     cmd->AppendSwitch(switches::kIgnoreGpuBlacklist);
 
+    blink::Platform::InitializeBlink();
     auto main_thread_scheduler =
         blink::scheduler::CreateMockWebMainThreadSchedulerForTests();
     scoped_refptr<base::SingleThreadTaskRunner> test_task_counter(
@@ -205,11 +207,11 @@ class RenderThreadImplBrowserTest : public testing::Test,
   void TearDown() override {
     if (base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kSingleProcessTests)) {
-      // In a single-process mode, we need to avoid destructing mock_process_
+      // In a single-process mode, we need to avoid destructing process_
       // because it will call _exit(0) and kill the process before the browser
       // side is ready to exit.
-      ANNOTATE_LEAKING_OBJECT_PTR(mock_process_.get());
-      mock_process_.release();
+      ANNOTATE_LEAKING_OBJECT_PTR(process_.get());
+      process_.release();
     }
   }
 
@@ -249,7 +251,7 @@ class RenderThreadImplBrowserTest : public testing::Test,
   const base::Process null_process_;
   std::unique_ptr<ChildProcessHost> process_host_;
 
-  std::unique_ptr<MockRenderProcess> mock_process_;
+  std::unique_ptr<RenderProcess> process_;
   scoped_refptr<QuitOnTestMsgFilter> test_msg_filter_;
 
   blink::scheduler::WebMockThreadScheduler* main_thread_scheduler_;
diff --git a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
index 35e850d9958..c205b8e7172 100644
--- a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
@@ -25,6 +25,7 @@
 #include "components/discardable_memory/client/client_discardable_shared_memory_manager.h"
 #include "components/discardable_memory/service/discardable_shared_memory_manager.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
diff --git a/chromium/content/renderer/render_view_browsertest.cc b/chromium/content/renderer/render_view_browsertest.cc
index 490db5abcc8..d6f4b3560ae 100644
--- a/chromium/content/renderer/render_view_browsertest.cc
+++ b/chromium/content/renderer/render_view_browsertest.cc
@@ -18,6 +18,7 @@
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/gmock_callback_support.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -108,10 +109,10 @@
 #include "url/url_constants.h"
 
 #if defined(OS_ANDROID)
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
 #include "third_party/blink/public/common/input/web_gesture_device.h"
 #include "third_party/blink/public/common/input/web_gesture_event.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #endif
 
 #if defined(OS_WIN)
@@ -124,15 +125,13 @@
 #include "ui/events/test/events_test_utils.h"
 #include "ui/events/test/events_test_utils_x11.h"
 #include "ui/events/x/x11_event_translation.h"
-#include "ui/gfx/x/x11.h"
+#include "ui/gfx/x/x11.h"  // nogncheck
 #endif
 
 #if defined(USE_OZONE)
 #include "ui/events/keycodes/keyboard_code_conversion.h"
 #endif
 
-#include "url/url_constants.h"
-
 using base::TimeDelta;
 using blink::WebFrame;
 using blink::WebFrameContentDumper;
@@ -206,8 +205,8 @@ FrameReplicationState ReconstructReplicationStateForTesting(
   blink::WebLocalFrame* frame = test_render_frame->GetWebFrame();
 
   FrameReplicationState result;
-  // can't recover result.scope - no way to get WebTreeScopeType via public
-  // blink API...
+  // can't recover result.scope - no way to get blink::mojom::TreeScopeType via
+  // public blink API...
   result.name = frame->AssignedName().Utf8();
   result.unique_name = test_render_frame->unique_name();
   result.frame_policy.sandbox_flags = frame->EffectiveSandboxFlagsForTesting();
@@ -392,7 +391,7 @@ class RenderViewImplTest : public RenderViewTest {
     NativeWebKeyboardEvent keyup_event(*event3);
     SendNativeKeyEvent(keyup_event);
 
-    long c = DomCodeToUsLayoutCharacter(
+    base::char16 c = DomCodeToUsLayoutCharacter(
         UsLayoutKeyboardCodeToDomCode(static_cast<ui::KeyboardCode>(key_code)),
         flags);
     output->assign(1, static_cast<base::char16>(c));
@@ -418,7 +417,7 @@ class RenderViewImplTest : public RenderViewTest {
     NativeWebKeyboardEvent keyup_web_event(keyup_event);
     SendNativeKeyEvent(keyup_web_event);
 
-    long c = DomCodeToUsLayoutCharacter(
+    base::char16 c = DomCodeToUsLayoutCharacter(
         UsLayoutKeyboardCodeToDomCode(static_cast<ui::KeyboardCode>(key_code)),
         flags);
     output->assign(1, static_cast<base::char16>(c));
@@ -579,7 +578,8 @@ TEST_F(RenderViewImplTest, IsPinchGestureActivePropagatesToProxies) {
           root_web_frame->FirstChild()->NextSibling()->ToWebLocalFrame()));
   ASSERT_TRUE(child_frame_2);
   child_frame_1->Unload(kProxyRoutingId, true,
-                        ReconstructReplicationStateForTesting(child_frame_1));
+                        ReconstructReplicationStateForTesting(child_frame_1),
+                        base::UnguessableToken::Create());
   EXPECT_TRUE(root_web_frame->FirstChild()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy_1 = RenderFrameProxy::FromWebFrame(
       root_web_frame->FirstChild()->ToWebRemoteFrame());
@@ -602,7 +602,8 @@ TEST_F(RenderViewImplTest, IsPinchGestureActivePropagatesToProxies) {
   // and registering of a new RenderFrameProxy, which should pick up the
   // existing setting.
   child_frame_2->Unload(kProxyRoutingId + 1, true,
-                        ReconstructReplicationStateForTesting(child_frame_2));
+                        ReconstructReplicationStateForTesting(child_frame_2),
+                        base::UnguessableToken::Create());
   EXPECT_TRUE(root_web_frame->FirstChild()->NextSibling()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy_2 = RenderFrameProxy::FromWebFrame(
       root_web_frame->FirstChild()->NextSibling()->ToWebRemoteFrame());
@@ -858,7 +859,14 @@ class RenderViewImplUpdateTitleTest : public RenderViewImplTest {
   }
 };
 
-TEST_F(RenderViewImplUpdateTitleTest, OnNavigationLoadDataWithBaseURL) {
+#if defined(OS_ANDROID)
+// Failing on Android: http://crbug.com/1080328
+#define MAYBE_OnNavigationLoadDataWithBaseURL \
+  DISABLED_OnNavigationLoadDataWithBaseURL
+#else
+#define MAYBE_OnNavigationLoadDataWithBaseURL OnNavigationLoadDataWithBaseURL
+#endif
+TEST_F(RenderViewImplUpdateTitleTest, MAYBE_OnNavigationLoadDataWithBaseURL) {
   auto common_params = CreateCommonNavigationParams();
   common_params->url = GURL("data:text/html,");
   common_params->navigation_type = mojom::NavigationType::DIFFERENT_DOCUMENT;
@@ -891,7 +899,7 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   blink::WebSecurityOrigin requestor_origin =
       blink::WebSecurityOrigin::Create(GURL("http://foo.com"));
 
-  // Navigations to normal HTTP URLs can be handled locally.
+  // Navigations to normal HTTP URLs.
   blink::WebURLRequest request(GURL("http://foo.com"));
   request.SetMode(network::mojom::RequestMode::kNavigate);
   request.SetCredentialsMode(network::mojom::CredentialsMode::kInclude);
@@ -910,10 +918,16 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   // stop and be sent to the browser.
   EXPECT_TRUE(frame()->IsBrowserSideNavigationPending());
 
-  // Verify that form posts to WebUI URLs will be sent to the browser process.
+  // Form posts to WebUI URLs.
   auto form_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   form_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
   form_navigation_info->url_request.SetHttpMethod("POST");
+  form_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  form_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  form_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   blink::WebHTTPBody post_body;
   post_body.Initialize();
   post_body.AppendData("blah");
@@ -930,10 +944,16 @@ TEST_F(RenderViewImplTest, BeginNavigation) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that popup links to WebUI URLs also are sent to browser.
+  // Popup links to WebUI URLs.
   blink::WebURLRequest popup_request(GetWebUIURL("foo"));
   auto popup_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   popup_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
+  popup_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  popup_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  popup_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   popup_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   popup_navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kAuxiliary;
@@ -984,9 +1004,14 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   blink::WebSecurityOrigin requestor_origin =
       blink::WebSecurityOrigin::Create(GURL("http://foo.com"));
 
-  // Navigations to normal HTTP URLs will be sent to browser process.
+  // Navigations to normal HTTP URLs.
   auto navigation_info = std::make_unique<blink::WebNavigationInfo>();
   navigation_info->url_request = blink::WebURLRequest(GURL("http://foo.com"));
+  navigation_info->url_request.SetMode(network::mojom::RequestMode::kNavigate);
+  navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kTopLevel;
@@ -998,9 +1023,15 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Navigations to WebUI URLs will also be sent to browser process.
+  // Navigations to WebUI URLs.
   auto webui_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   webui_navigation_info->url_request = blink::WebURLRequest(GetWebUIURL("foo"));
+  webui_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  webui_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  webui_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   webui_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   webui_navigation_info->frame_type =
       blink::mojom::RequestContextFrameType::kTopLevel;
@@ -1012,10 +1043,16 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that form posts to data URLs will be sent to the browser process.
+  // Form posts to data URLs.
   auto data_navigation_info = std::make_unique<blink::WebNavigationInfo>();
   data_navigation_info->url_request =
       blink::WebURLRequest(GURL("data:text/html,foo"));
+  data_navigation_info->url_request.SetMode(
+      network::mojom::RequestMode::kNavigate);
+  data_navigation_info->url_request.SetRedirectMode(
+      network::mojom::RedirectMode::kManual);
+  data_navigation_info->url_request.SetRequestContext(
+      blink::mojom::RequestContextType::INTERNAL);
   data_navigation_info->url_request.SetRequestorOrigin(requestor_origin);
   data_navigation_info->url_request.SetHttpMethod("POST");
   blink::WebHTTPBody post_body;
@@ -1033,15 +1070,17 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
       FrameHostMsg_OpenURL::ID));
 
-  // Verify that a popup that creates a view first and then navigates to a
-  // normal HTTP URL will be sent to the browser process, even though the
-  // new view does not have any enabled_bindings_.
+  // A popup that creates a view first and then navigates to a
+  // normal HTTP URL.
   blink::WebURLRequest popup_request(GURL("http://foo.com"));
   popup_request.SetRequestorOrigin(requestor_origin);
+  popup_request.SetMode(network::mojom::RequestMode::kNavigate);
+  popup_request.SetRedirectMode(network::mojom::RedirectMode::kManual);
+  popup_request.SetRequestContext(blink::mojom::RequestContextType::INTERNAL);
   blink::WebView* new_web_view = view()->CreateView(
       GetMainFrame(), popup_request, blink::WebWindowFeatures(), "foo",
       blink::kWebNavigationPolicyNewForegroundTab,
-      blink::mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags::kNone,
       blink::FeaturePolicy::FeatureState(),
       blink::AllocateSessionStorageNamespaceId());
   RenderViewImpl* new_view = RenderViewImpl::FromWebView(new_web_view);
@@ -1080,7 +1119,8 @@ TEST_F(RenderViewImplScaleFactorTest, DeviceEmulationWithOOPIF) {
   ASSERT_TRUE(child_frame);
 
   child_frame->Unload(kProxyRoutingId + 1, true,
-                      ReconstructReplicationStateForTesting(child_frame));
+                      ReconstructReplicationStateForTesting(child_frame),
+                      base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
   RenderFrameProxy* child_proxy = RenderFrameProxy::FromWebFrame(
       web_frame->FirstChild()->ToWebRemoteFrame());
@@ -1123,7 +1163,8 @@ TEST_F(RenderViewImplTest, OriginReplicationForUnload) {
   content::FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(child_frame);
   replication_state.origin = url::Origin::Create(GURL("http://foo.com"));
-  child_frame->Unload(kProxyRoutingId, true, replication_state);
+  child_frame->Unload(kProxyRoutingId, true, replication_state,
+                      base::UnguessableToken::Create());
 
   // The child frame should now be a WebRemoteFrame.
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
@@ -1140,7 +1181,8 @@ TEST_F(RenderViewImplTest, OriginReplicationForUnload) {
   TestRenderFrame* child_frame2 =
       static_cast<TestRenderFrame*>(RenderFrame::FromWebFrame(
           web_frame->FirstChild()->NextSibling()->ToWebLocalFrame()));
-  child_frame2->Unload(kProxyRoutingId + 1, true, replication_state);
+  child_frame2->Unload(kProxyRoutingId + 1, true, replication_state,
+                       base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->NextSibling()->IsWebRemoteFrame());
   EXPECT_TRUE(
       web_frame->FirstChild()->NextSibling()->GetSecurityOrigin().IsOpaque());
@@ -1167,7 +1209,8 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
   content::FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(frame());
   // replication_state.origin = url::Origin(GURL("http://foo.com"));
-  frame()->Unload(kProxyRoutingId, true, replication_state);
+  frame()->Unload(kProxyRoutingId, true, replication_state,
+                  base::UnguessableToken::Create());
   EXPECT_TRUE(view()->GetWebView()->MainFrame()->IsWebRemoteFrame());
 
   // Do the remote-to-local transition for the proxy, which is to create a
@@ -1186,12 +1229,28 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
       mojom::CreateFrameWidgetParams::New();
   widget_params->routing_id = kProxyRoutingId + 2;
   widget_params->visual_properties = test_visual_properties;
+
+  mojo::AssociatedRemote<blink::mojom::FrameWidget> blink_frame_widget;
+  mojo::PendingAssociatedReceiver<blink::mojom::FrameWidget>
+      blink_frame_widget_receiver =
+          blink_frame_widget
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  mojo::AssociatedRemote<blink::mojom::FrameWidgetHost> blink_frame_widget_host;
+  mojo::PendingAssociatedReceiver<blink::mojom::FrameWidgetHost>
+      blink_frame_widget_host_receiver =
+          blink_frame_widget_host
+              .BindNewEndpointAndPassDedicatedReceiverForTesting();
+
+  widget_params->frame_widget = std::move(blink_frame_widget_receiver);
+  widget_params->frame_widget_host = blink_frame_widget_host.Unbind();
+
   RenderFrameImpl::CreateFrame(
       routing_id, std::move(stub_interface_provider),
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, MSG_ROUTING_NONE, MSG_ROUTING_NONE,
-      base::UnguessableToken::Create(), replication_state,
-      compositor_deps_.get(), std::move(widget_params),
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      replication_state, compositor_deps_.get(), std::move(widget_params),
       blink::mojom::FrameOwnerProperties::New(),
       /*has_committed_real_load=*/true);
   TestRenderFrame* provisional_frame =
@@ -1240,7 +1299,8 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
   // Unload the child frame.
   FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(child_frame);
-  child_frame->Unload(kProxyRoutingId, true, replication_state);
+  child_frame->Unload(kProxyRoutingId, true, replication_state,
+                      base::UnguessableToken::Create());
   EXPECT_TRUE(web_frame->FirstChild()->IsWebRemoteFrame());
 
   // Do the first step of a remote-to-local transition for the child proxy,
@@ -1257,7 +1317,8 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
       routing_id, std::move(stub_interface_provider),
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, frame()->GetRoutingID(), MSG_ROUTING_NONE,
-      base::UnguessableToken::Create(), replication_state, nullptr,
+      base::UnguessableToken::Create(), base::UnguessableToken::Create(),
+      replication_state, nullptr,
       /*widget_params=*/nullptr, blink::mojom::FrameOwnerProperties::New(),
       /*has_committed_real_load=*/true);
   {
@@ -1294,7 +1355,8 @@ TEST_F(RenderViewImplEnableZoomForDSFTest,
   TestRenderFrame* main_frame =
       static_cast<TestRenderFrame*>(view()->GetMainRenderFrame());
   main_frame->Unload(kProxyRoutingId, true,
-                     ReconstructReplicationStateForTesting(main_frame));
+                     ReconstructReplicationStateForTesting(main_frame),
+                     base::UnguessableToken::Create());
   EXPECT_TRUE(view()->GetWebView()->MainFrame()->IsWebRemoteFrame());
 }
 
@@ -1478,9 +1540,16 @@ TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsAndInputPanelPolicy) {
   // panel policy to auto.
   ExecuteJavaScriptForTests(
       "const editContext = new EditContext(); "
-      "editContext.focus();editContext.inputPanelPolicy=\"auto\";editContext."
-      "updateLayout(new DOMRect(10, 20, 30, 40), new DOMRect(10,20, 1, 5));");
-  base::RunLoop().RunUntilIdle();
+      "editContext.focus();editContext.inputPanelPolicy=\"auto\"; "
+      "const control_bound = new DOMRect(10, 20, 30, 40); "
+      "const selection_bound = new DOMRect(10, 20, 1, 5); "
+      "editContext.updateLayout(control_bound, selection_bound);");
+  // This RunLoop is waiting for EditContext to be created and layout bounds
+  // to be updated in the EditContext.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
+
   // Update the IME status and verify if our IME backend sends an IPC message
   // to notify layout bounds of the EditContext.
   main_widget()->UpdateTextInputState();
@@ -1501,6 +1570,49 @@ TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsAndInputPanelPolicy) {
             actual_active_element_selection_bounds);
 }
 
+TEST_F(RenderViewImplTest, EditContextGetLayoutBoundsWithFloatingValues) {
+  // Load an HTML page.
+  LoadHTML(
+      "<html>"
+      "<head>"
+      "</head>"
+      "<body>"
+      "</body>"
+      "</html>");
+  render_thread_->sink().ClearMessages();
+  // Create an EditContext with control and selection bounds and set input
+  // panel policy to auto.
+  ExecuteJavaScriptForTests(
+      "const editContext = new EditContext(); "
+      "editContext.focus();editContext.inputPanelPolicy=\"auto\"; "
+      "const control_bound = new DOMRect(10.14, 20.25, 30.15, 40.50); "
+      "const selection_bound = new DOMRect(10, 20, 1, 5); "
+      "editContext.updateLayout(control_bound, selection_bound);");
+  // This RunLoop is waiting for EditContext to be created and layout bounds
+  // to be updated in the EditContext.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
+  // Update the IME status and verify if our IME backend sends an IPC message
+  // to notify layout bounds of the EditContext.
+  main_widget()->UpdateTextInputState();
+  auto params = ProcessAndReadIPC<WidgetHostMsg_TextInputStateChanged>();
+  EXPECT_EQ(true, std::get<0>(params).show_ime_if_needed);
+  blink::WebRect edit_context_control_bounds_expected(10, 20, 31, 41);
+  blink::WebRect edit_context_selection_bounds_expected(10, 20, 1, 5);
+  main_widget()->ConvertViewportToWindow(&edit_context_control_bounds_expected);
+  main_widget()->ConvertViewportToWindow(
+      &edit_context_selection_bounds_expected);
+  blink::WebRect actual_active_element_control_bounds(
+      std::get<0>(params).edit_context_control_bounds.value());
+  blink::WebRect actual_active_element_selection_bounds(
+      std::get<0>(params).edit_context_selection_bounds.value());
+  EXPECT_EQ(edit_context_control_bounds_expected,
+            actual_active_element_control_bounds);
+  EXPECT_EQ(edit_context_selection_bounds_expected,
+            actual_active_element_selection_bounds);
+}
+
 TEST_F(RenderViewImplTest, ActiveElementGetLayoutBounds) {
   // Load an HTML page consisting of one input fields.
   LoadHTML(
@@ -1515,7 +1627,10 @@ TEST_F(RenderViewImplTest, ActiveElementGetLayoutBounds) {
   // Create an EditContext with control and selection bounds and set input
   // panel policy to auto.
   ExecuteJavaScriptForTests("document.getElementById('test').focus();");
-  base::RunLoop().RunUntilIdle();
+  // This RunLoop is waiting for focus to be processed for the active element.
+  base::RunLoop run_loop;
+  base::PostTask(FROM_HERE, run_loop.QuitClosure());
+  run_loop.Run();
   // Update the IME status and verify if our IME backend sends an IPC message
   // to notify layout bounds of the EditContext.
   main_widget()->UpdateTextInputState();
@@ -1762,7 +1877,7 @@ TEST_F(RenderViewImplTest, ContextMenu) {
 
   // Create a right click in the center of the iframe. (I'm hoping this will
   // make this a bit more robust in case of some other formatting or other bug.)
-  WebMouseEvent mouse_event(WebInputEvent::kMouseDown,
+  WebMouseEvent mouse_event(WebInputEvent::Type::kMouseDown,
                             WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   mouse_event.button = WebMouseEvent::Button::kRight;
   mouse_event.SetPositionInWidget(250, 250);
@@ -1771,7 +1886,7 @@ TEST_F(RenderViewImplTest, ContextMenu) {
   SendWebMouseEvent(mouse_event);
 
   // Now simulate the corresponding up event which should display the menu
-  mouse_event.SetType(WebInputEvent::kMouseUp);
+  mouse_event.SetType(WebInputEvent::Type::kMouseUp);
   SendWebMouseEvent(mouse_event);
 
   EXPECT_TRUE(render_thread_->sink().GetUniqueMessageMatching(
@@ -1788,7 +1903,7 @@ TEST_F(RenderViewImplTest, AndroidContextMenuSelectionOrdering) {
 
   // Create a long press in the center of the iframe. (I'm hoping this will
   // make this a bit more robust in case of some other formatting or other bug.)
-  WebGestureEvent gesture_event(WebInputEvent::kGestureLongPress,
+  WebGestureEvent gesture_event(WebInputEvent::Type::kGestureLongPress,
                                 WebInputEvent::kNoModifiers,
                                 ui::EventTimeForNow());
   gesture_event.SetPositionInWidget(gfx::PointF(250, 250));
@@ -2183,7 +2298,8 @@ class RendererErrorPageTest : public RenderViewImplTest {
   class TestContentRendererClient : public ContentRendererClient {
    public:
     bool ShouldSuppressErrorPage(RenderFrame* render_frame,
-                                 const GURL& url) override {
+                                 const GURL& url,
+                                 int error_code) override {
       return url == "http://example.com/suppress";
     }
 
@@ -2609,7 +2725,8 @@ TEST_F(RenderViewImplTest, DispatchBeforeUnloadCanDetachFrame) {
 
         // Unloads the main frame.
         frame()->OnMessageReceived(UnfreezableFrameMsg_Unload(
-            frame()->GetRoutingID(), 1, false, FrameReplicationState()));
+            frame()->GetRoutingID(), 1, false, FrameReplicationState(),
+            base::UnguessableToken::Create()));
 
         was_callback_run = true;
         run_loop.Quit();
diff --git a/chromium/content/renderer/render_view_browsertest_mac.mm b/chromium/content/renderer/render_view_browsertest_mac.mm
index f8dee2b854c..60598036c03 100644
--- a/chromium/content/renderer/render_view_browsertest_mac.mm
+++ b/chromium/content/renderer/render_view_browsertest_mac.mm
@@ -100,8 +100,12 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   render_thread_->sink().ClearMessages();
 
   const char* kArrowDownScrollDown = "40,false,false,true,false\n9844";
+  auto arrow_down_scroll_down_command =
+      std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_scroll_down_command.push_back(
+      blink::mojom::EditCommand::New("moveToEndOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToEndOfDocument", "")));
+      std::move(arrow_down_scroll_down_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowDownKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -111,8 +115,11 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   EXPECT_EQ(kArrowDownScrollDown, output);
 
   const char* kArrowUpScrollUp = "38,false,false,true,false\n0";
+  auto arrow_up_scroll_up_command = std::vector<blink::mojom::EditCommandPtr>();
+  arrow_up_scroll_up_command.push_back(
+      blink::mojom::EditCommand::New("moveToBeginningOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToBeginningOfDocument", "")));
+      std::move(arrow_up_scroll_up_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowUpKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -127,8 +134,12 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   ExecuteJavaScriptForTests("allowKeyEvents = false; window.scrollTo(0, 100)");
 
   const char* kArrowDownNoScroll = "40,false,false,true,false\n100";
+  auto arrow_down_no_scroll_command =
+      std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_no_scroll_command.push_back(
+      blink::mojom::EditCommand::New("moveToEndOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToEndOfDocument", "")));
+      std::move(arrow_down_no_scroll_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowDownKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
@@ -138,8 +149,11 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   EXPECT_EQ(kArrowDownNoScroll, output);
 
   const char* kArrowUpNoScroll = "38,false,false,true,false\n100";
+  auto arrow_up_no_scroll_command = std::vector<blink::mojom::EditCommandPtr>();
+  arrow_down_no_scroll_command.push_back(
+      blink::mojom::EditCommand::New("moveToBeginningOfDocument", ""));
   widget->OnSetEditCommandsForNextKeyEvent(
-      EditCommands(1, EditCommand("moveToBeginningOfDocument", "")));
+      std::move(arrow_down_no_scroll_command));
   SendNativeKeyEvent(NativeWebKeyboardEvent(arrowUpKeyDown));
   base::RunLoop().RunUntilIdle();
   ExecuteJavaScriptForTests("scroll.textContent = window.pageYOffset");
diff --git a/chromium/content/renderer/render_view_impl.cc b/chromium/content/renderer/render_view_impl.cc
index f0cb4833442..6fc04eb140e 100644
--- a/chromium/content/renderer/render_view_impl.cc
+++ b/chromium/content/renderer/render_view_impl.cc
@@ -447,17 +447,13 @@ void RenderViewImpl::Initialize(
   webview_ = WebView::Create(this, params->hidden,
                              /*compositing_enabled=*/true,
                              opener_frame ? opener_frame->View() : nullptr,
-                             params->blink_page_broadcast.PassHandle());
+                             std::move(params->blink_page_broadcast));
 
   g_view_map.Get().insert(std::make_pair(GetWebView(), this));
   g_routing_id_view_map.Get().insert(std::make_pair(GetRoutingID(), this));
 
   bool local_main_frame = params->main_frame_routing_id != MSG_ROUTING_NONE;
 
-  // TODO(danakj): Put this in with making the RenderFrame? Does order matter?
-  if (local_main_frame)
-    GetWebView()->SetDisplayMode(params->visual_properties.display_mode);
-
   ApplyWebPreferences(webkit_preferences_, GetWebView());
   ApplyCommandLineToSettings(GetWebView()->GetSettings());
 
@@ -465,10 +461,10 @@ void RenderViewImpl::Initialize(
     main_render_frame_ = RenderFrameImpl::CreateMainFrame(
         this, compositor_deps, opener_frame, &params, std::move(show_callback));
   } else {
-    RenderFrameProxy::CreateFrameProxy(params->proxy_routing_id, GetRoutingID(),
-                                       opener_frame, MSG_ROUTING_NONE,
-                                       params->replicated_frame_state,
-                                       params->devtools_main_frame_token);
+    RenderFrameProxy::CreateFrameProxy(
+        params->proxy_routing_id, GetRoutingID(), opener_frame,
+        MSG_ROUTING_NONE, params->replicated_frame_state,
+        params->main_frame_frame_token, params->devtools_main_frame_token);
   }
 
   // TODO(davidben): Move this state from Blink into content.
@@ -632,6 +628,9 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
   WebRuntimeFeatures::EnableAccelerated2dCanvas(
       prefs.accelerated_2d_canvas_enabled);
 
+  // Enable new canvas 2d api features
+  WebRuntimeFeatures::EnableNewCanvas2DAPI(prefs.new_canvas_2d_api_enabled);
+
   // Disable antialiasing for 2d canvas if requested on the command line.
   settings->SetAntialiased2dCanvasEnabled(
       !prefs.antialiased_2d_canvas_disabled);
@@ -821,6 +820,8 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
 #endif  // defined(OS_ANDROID)
   settings->SetForceDarkModeEnabled(prefs.force_dark_mode_enabled);
 
+  settings->SetAccessibilityAlwaysShowFocus(prefs.always_show_focus);
+
   switch (prefs.autoplay_policy) {
     case AutoplayPolicy::kNoUserGestureRequired:
       settings->SetAutoplayPolicy(
@@ -1048,11 +1049,6 @@ bool RenderViewImpl::ShouldAckSyntheticInputImmediately() {
   return false;
 }
 
-void RenderViewImpl::ApplyNewDisplayModeForWidget(
-    blink::mojom::DisplayMode new_display_mode) {
-  GetWebView()->SetDisplayMode(new_display_mode);
-}
-
 void RenderViewImpl::ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                                     const gfx::Size& max_size) {
   GetWebView()->EnableAutoResizeMode(min_size, max_size);
@@ -1187,7 +1183,6 @@ bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewMsg_MoveOrResizeStarted, OnMoveOrResizeStarted)
 
     // Page messages.
-    IPC_MESSAGE_HANDLER(PageMsg_VisibilityChanged, OnPageVisibilityChanged)
     IPC_MESSAGE_HANDLER(PageMsg_SetHistoryOffsetAndLength,
                         OnSetHistoryOffsetAndLength)
     IPC_MESSAGE_HANDLER(PageMsg_AudioStateChanged, OnAudioStateChanged)
@@ -1219,7 +1214,7 @@ WebView* RenderViewImpl::CreateView(
     const WebWindowFeatures& features,
     const WebString& frame_name,
     WebNavigationPolicy policy,
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::FeaturePolicy::FeatureState& opener_feature_state,
     const blink::SessionStorageNamespaceId& session_storage_namespace_id) {
   RenderFrameImpl* creator_frame = RenderFrameImpl::FromWebFrame(creator);
@@ -1308,6 +1303,7 @@ WebView* RenderViewImpl::CreateView(
   view_params->renderer_preferences = renderer_preferences_.Clone();
   view_params->web_preferences = webkit_preferences_;
   view_params->view_id = reply->route_id;
+  view_params->main_frame_frame_token = reply->main_frame_frame_token;
   view_params->main_frame_routing_id = reply->main_frame_route_id;
   view_params->frame_widget_host = std::move(reply->frame_widget_host);
   view_params->frame_widget = std::move(reply->frame_widget);
@@ -1386,7 +1382,6 @@ blink::WebPagePopup* RenderViewImpl::CreatePopup(
 
   RenderWidget* popup_widget = RenderWidget::CreateForPopup(
       widget_routing_id, opener_render_widget->compositor_deps(),
-      blink::mojom::DisplayMode::kUndefined,
       /*hidden=*/false,
       /*never_composited=*/false, std::move(widget_channel_receiver));
 
@@ -1627,27 +1622,16 @@ bool RenderViewImpl::AllowPopupsDuringPageUnload() {
          base::FeatureList::IsEnabled(features::kAllowPopupsDuringPageUnload);
 }
 
-bool RenderViewImpl::CanUpdateLayout() {
-  return true;
-}
-
-void RenderViewImpl::SetEditCommandForNextKeyEvent(const std::string& name,
-                                                   const std::string& value) {
-  // This is test-only code. Only propagate the command if there is a main
-  // render frame.
-  if (main_render_frame_) {
-    RenderWidget* widget = main_render_frame_->GetLocalRootRenderWidget();
-    widget->SetEditCommandForNextKeyEvent(name, value);
-  }
+void RenderViewImpl::OnPageVisibilityChanged(PageVisibilityState visibility) {
+#if defined(OS_ANDROID)
+  SuspendVideoCaptureDevices(visibility != PageVisibilityState::kVisible);
+#endif
+  for (auto& observer : observers_)
+    observer.OnPageVisibilityChanged(visibility);
 }
 
-void RenderViewImpl::ClearEditCommands() {
-  // This is test-only code. Only propagate the command if there is a main
-  // render frame.
-  if (main_render_frame_) {
-    RenderWidget* widget = main_render_frame_->GetLocalRootRenderWidget();
-    widget->ClearEditCommands();
-  }
+bool RenderViewImpl::CanUpdateLayout() {
+  return true;
 }
 
 const std::string& RenderViewImpl::GetAcceptLanguages() {
@@ -1756,16 +1740,6 @@ void RenderViewImpl::OnMoveOrResizeStarted() {
     GetWebView()->CancelPagePopup();
 }
 
-void RenderViewImpl::OnPageVisibilityChanged(
-    PageVisibilityState visibility_state) {
-#if defined(OS_ANDROID)
-  SuspendVideoCaptureDevices(visibility_state != PageVisibilityState::kVisible);
-#endif
-
-  ApplyPageVisibilityState(visibility_state,
-                           /*initial_setting=*/false);
-}
-
 void RenderViewImpl::SetPageFrozen(bool frozen) {
   if (GetWebView())
     GetWebView()->SetPageFrozen(frozen);
@@ -1800,13 +1774,6 @@ void RenderViewImpl::OnSetInsidePortal(bool inside_portal) {
   GetWebView()->SetInsidePortal(inside_portal);
 }
 
-void RenderViewImpl::DidUpdateTextAutosizerPageInfo(
-    const blink::WebTextAutosizerPageInfo& page_info) {
-  DCHECK(GetWebView()->MainFrame()->IsWebLocalFrame());
-  Send(new ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame(
-      GetRoutingID(), page_info));
-}
-
 void RenderViewImpl::DidAutoResize(const blink::WebSize& newSize) {
   // Auto resize should only happen on local main frames.
   DCHECK(main_render_frame_);
@@ -1814,11 +1781,9 @@ void RenderViewImpl::DidAutoResize(const blink::WebSize& newSize) {
 }
 
 void RenderViewImpl::DidFocus(blink::WebLocalFrame* calling_frame) {
-  // TODO(jcivelli): when https://bugs.webkit.org/show_bug.cgi?id=33389 is fixed
-  //                 we won't have to test for user gesture anymore and we can
-  //                 move that code back to render_widget.cc
-  if (calling_frame && calling_frame->HasTransientUserActivation() &&
-      !RenderThreadImpl::current()->web_test_mode()) {
+  // We only allow focus to move to this RenderView when the request comes from
+  // a user gesture. (See also https://bugs.webkit.org/show_bug.cgi?id=33389.)
+  if (calling_frame && calling_frame->HasTransientUserActivation()) {
     Send(new ViewHostMsg_Focus(GetRoutingID()));
 
     // Tattle on the frame that called |window.focus()|.
@@ -1850,29 +1815,6 @@ unsigned RenderViewImpl::GetLocalSessionHistoryLengthForTesting() const {
   return history_list_length_;
 }
 
-void RenderViewImpl::SetFocusAndActivateForTesting(bool enable) {
-  // If the main frame is remote, return immediately. Page level focus
-  // should be set from the browser process, so if needed by tests it should
-  // be properly supported.
-  if (!main_render_frame_)
-    return;
-
-  RenderWidget* render_widget = main_render_frame_->GetLocalRootRenderWidget();
-
-  if (enable == render_widget->has_focus())
-    return;
-
-  if (enable) {
-    SetActiveForWidget(true);
-    // Fake an IPC message so go through the IPC handler.
-    render_widget->OnSetFocus(true);
-  } else {
-    // Fake an IPC message so go through the IPC handler.
-    render_widget->OnSetFocus(false);
-    SetActiveForWidget(false);
-  }
-}
-
 // static
 scoped_refptr<base::SingleThreadTaskRunner>
 RenderViewImpl::GetCleanupTaskRunner() {
diff --git a/chromium/content/renderer/render_view_impl.h b/chromium/content/renderer/render_view_impl.h
index 701aac4f786..c91cfca2f65 100644
--- a/chromium/content/renderer/render_view_impl.h
+++ b/chromium/content/renderer/render_view_impl.h
@@ -191,11 +191,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // RenderView is the currently active RenderView of a WebContents.
   unsigned GetLocalSessionHistoryLengthForTesting() const;
 
-  // Invokes OnSetFocus and marks the widget as active depending on the value
-  // of |enable|. This is used for web tests that need to control the focus
-  // synchronously from the renderer.
-  void SetFocusAndActivateForTesting(bool enable);
-
   void UpdateBrowserControlsState(BrowserControlsState constraints,
                                   BrowserControlsState current,
                                   bool animate);
@@ -216,7 +211,7 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
       const blink::WebWindowFeatures& features,
       const blink::WebString& frame_name,
       blink::WebNavigationPolicy policy,
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::FeaturePolicy::FeatureState& opener_feature_state,
       const blink::SessionStorageNamespaceId& session_storage_namespace_id)
       override;
@@ -238,12 +233,11 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   blink::WebString AcceptLanguages() override;
   int HistoryBackListCount() override;
   int HistoryForwardListCount() override;
-  void DidUpdateTextAutosizerPageInfo(
-      const blink::WebTextAutosizerPageInfo& page_info) override;
   void DidAutoResize(const blink::WebSize& newSize) override;
   void DidFocus(blink::WebLocalFrame* calling_frame) override;
   bool CanHandleGestureEvent() override;
   bool AllowPopupsDuringPageUnload() override;
+  void OnPageVisibilityChanged(PageVisibilityState visibility) override;
 
   // RenderView implementation -------------------------------------------------
 
@@ -255,13 +249,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void SetWebkitPreferences(const WebPreferences& preferences) override;
   blink::WebView* GetWebView() override;
   bool GetContentStateImmediately() override;
-
-  // Only used for testing.
-  void SetEditCommandForNextKeyEvent(const std::string& name,
-                                     const std::string& value) override;
-  // Only used for testing.
-  void ClearEditCommands() override;
-
   const std::string& GetAcceptLanguages() override;
 
   // Please do not add your stuff randomly to the end here. If there is an
@@ -368,8 +355,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void SetActiveForWidget(bool active) override;
   bool SupportsMultipleWindowsForWidget() override;
   bool ShouldAckSyntheticInputImmediately() override;
-  void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) override;
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override;
   void DisableAutoResizeForWidget() override;
@@ -419,7 +404,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void OnAudioStateChanged(bool is_audio_playing);
 
   // Page message handlers -----------------------------------------------------
-  void OnPageVisibilityChanged(PageVisibilityState visibility_state);
   void SetPageFrozen(bool frozen);
   void PutPageIntoBackForwardCache();
   void RestorePageFromBackForwardCache(base::TimeTicks navigation_start);
diff --git a/chromium/content/renderer/render_widget.cc b/chromium/content/renderer/render_widget.cc
index 3010e98ca5f..1bec58e292d 100644
--- a/chromium/content/renderer/render_widget.cc
+++ b/chromium/content/renderer/render_widget.cc
@@ -54,9 +54,7 @@
 #include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/render_thread.h"
-#include "content/renderer/compositor/layer_tree_view.h"
 #include "content/renderer/drop_data_builder.h"
-#include "content/renderer/external_popup_menu.h"
 #include "content/renderer/frame_swap_message_queue.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/main_thread_event_queue.h"
@@ -348,20 +346,6 @@ ui::TextInputMode ConvertWebTextInputMode(blink::WebTextInputMode mode) {
   return static_cast<ui::TextInputMode>(mode);
 }
 
-// Returns true if the device scale is high enough that losing subpixel
-// antialiasing won't have a noticeable effect on text quality.
-static bool DeviceScaleEnsuresTextQuality(float device_scale_factor) {
-#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
-  // On Android, we never have subpixel antialiasing. On Chrome OS we prefer to
-  // composite all scrollers so that we get animated overlay scrollbars.
-  return true;
-#else
-  // 1.5 is a common touchscreen tablet device scale factor. For such
-  // devices main thread antialiasing is a heavy burden.
-  return device_scale_factor >= 1.5f;
-#endif
-}
-
 static bool ComputePreferCompositingToLCDText(
     CompositorDependencies* compositor_deps,
     float device_scale_factor) {
@@ -369,13 +353,25 @@ static bool ComputePreferCompositingToLCDText(
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kDisablePreferCompositingToLCDText))
     return false;
+#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
+  // On Android, we never have subpixel antialiasing. On Chrome OS we prefer to
+  // composite all scrollers for better scrolling performance.
+  return true;
+#else
+  // Prefer compositing if the device scale is high enough that losing subpixel
+  // antialiasing won't have a noticeable effect on text quality.
+  // Note: We should keep kHighDPIDeviceScaleFactorThreshold in
+  // cc/metrics/lcd_text_metrics_reporter.cc the same as the value below.
+  if (device_scale_factor >= 1.5f)
+    return true;
   if (command_line.HasSwitch(switches::kEnablePreferCompositingToLCDText))
     return true;
   if (!compositor_deps->IsLcdTextEnabled())
     return true;
   if (base::FeatureList::IsEnabled(features::kPreferCompositingToLCDText))
     return true;
-  return DeviceScaleEnsuresTextQuality(device_scale_factor);
+  return false;
+#endif
 }
 
 }  // namespace
@@ -391,33 +387,30 @@ void RenderWidget::InstallCreateForFrameHook(
 std::unique_ptr<RenderWidget> RenderWidget::CreateForFrame(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    blink::mojom::DisplayMode display_mode,
     bool never_composited) {
   if (g_create_render_widget_for_frame) {
     return g_create_render_widget_for_frame(widget_routing_id, compositor_deps,
-                                            display_mode, never_composited,
+                                            /*hidden=*/true, never_composited,
                                             mojo::NullReceiver());
   }
 
-  return std::make_unique<RenderWidget>(
-      widget_routing_id, compositor_deps, display_mode,
-      /*hidden=*/true, never_composited, mojo::NullReceiver());
+  return std::make_unique<RenderWidget>(widget_routing_id, compositor_deps,
+                                        /*hidden=*/true, never_composited,
+                                        mojo::NullReceiver());
 }
 
 RenderWidget* RenderWidget::CreateForPopup(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    blink::mojom::DisplayMode display_mode,
     bool hidden,
     bool never_composited,
     mojo::PendingReceiver<mojom::Widget> widget_receiver) {
-  return new RenderWidget(widget_routing_id, compositor_deps, display_mode,
-                          hidden, never_composited, std::move(widget_receiver));
+  return new RenderWidget(widget_routing_id, compositor_deps, hidden,
+                          never_composited, std::move(widget_receiver));
 }
 
 RenderWidget::RenderWidget(int32_t widget_routing_id,
                            CompositorDependencies* compositor_deps,
-                           blink::mojom::DisplayMode display_mode,
                            bool hidden,
                            bool never_composited,
                            mojo::PendingReceiver<mojom::Widget> widget_receiver)
@@ -425,7 +418,6 @@ RenderWidget::RenderWidget(int32_t widget_routing_id,
       compositor_deps_(compositor_deps),
       is_hidden_(hidden),
       never_composited_(never_composited),
-      display_mode_(display_mode),
       next_previous_flags_(kInvalidNextPreviousFlagsValue),
       frame_swap_message_queue_(new FrameSwapMessageQueue(routing_id_)),
       widget_receiver_(this, std::move(widget_receiver)) {
@@ -433,14 +425,6 @@ RenderWidget::RenderWidget(int32_t widget_routing_id,
   DCHECK(RenderThread::IsMainThread());
   DCHECK(compositor_deps_);
 
-  // In tests there may not be a RenderThreadImpl.
-  if (RenderThreadImpl::current()) {
-    render_widget_scheduling_state_ = RenderThreadImpl::current()
-                                          ->GetWebMainThreadScheduler()
-                                          ->NewRenderWidgetSchedulingState();
-    render_widget_scheduling_state_->SetHidden(is_hidden_);
-  }
-
   if (routing_id_ != MSG_ROUTING_NONE)
     g_routing_id_widget_map.Get().emplace(routing_id_, this);
 }
@@ -528,6 +512,10 @@ void RenderWidget::Initialize(ShowCallback show_callback,
 
   RenderThread::Get()->AddRoute(routing_id_, this);
 
+  webwidget_ = web_widget;
+  if (auto* scheduler_state = GetWebWidget()->RendererWidgetSchedulingState())
+    scheduler_state->SetHidden(is_hidden());
+
   InitCompositing(screen_info);
 
   // If the widget is hidden, delay starting the compositor until the user
@@ -535,14 +523,9 @@ void RenderWidget::Initialize(ShowCallback show_callback,
   // for a provisional frame, this importantly starts the compositor before
   // the frame is inserted into the frame tree, which impacts first paint
   // metrics.
-  if (!is_hidden_ && !never_composited_) {
+  if (!is_hidden_ && !never_composited_)
     web_widget->SetCompositorVisible(true);
-    layer_tree_view_->SetVisible(true);
-  }
 
-  webwidget_ = web_widget;
-  web_widget->SetCompositorHosts(layer_tree_view_->layer_tree_host(),
-                                 layer_tree_view_->animation_host());
   // Note that this calls into the WebWidget.
   UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
                              CompositorViewportRect(), screen_info);
@@ -590,11 +573,6 @@ bool RenderWidget::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(WidgetMsg_ForceRedraw, OnForceRedraw)
     IPC_MESSAGE_HANDLER(WidgetMsg_SetViewportIntersection,
                         OnSetViewportIntersection)
-    IPC_MESSAGE_HANDLER(WidgetMsg_SetIsInert, OnSetIsInert)
-    IPC_MESSAGE_HANDLER(WidgetMsg_SetInheritedEffectiveTouchAction,
-                        OnSetInheritedEffectiveTouchAction)
-    IPC_MESSAGE_HANDLER(WidgetMsg_UpdateRenderThrottlingStatus,
-                        OnUpdateRenderThrottlingStatus)
     IPC_MESSAGE_HANDLER(WidgetMsg_WaitForNextFrameForTests,
                         OnWaitNextFrameForTests)
     IPC_MESSAGE_HANDLER(DragMsg_TargetDragEnter, OnDragTargetDragEnter)
@@ -730,6 +708,13 @@ void RenderWidget::OnUpdateVisualProperties(
           visual_properties.screen_info.color_space);
   }
 
+  // TODO(danakj): In order to synchronize updates between local roots, the
+  // display mode should be propagated to RenderFrameProxies and down through
+  // their RenderWidgetHosts to child RenderWidgets via the VisualProperties
+  // waterfall, instead of coming to each RenderWidget independently.
+  // https://developer.mozilla.org/en-US/docs/Web/CSS/@media/display-mode
+  GetWebWidget()->SetDisplayMode(visual_properties.display_mode);
+
   if (delegate()) {
     if (size_ != visual_properties.new_size) {
       // Only hide popups when the size changes. Eg https://crbug.com/761908.
@@ -737,11 +722,6 @@ void RenderWidget::OnUpdateVisualProperties(
       web_view->CancelPagePopup();
     }
 
-    if (display_mode_ != visual_properties.display_mode) {
-      display_mode_ = visual_properties.display_mode;
-      delegate()->ApplyNewDisplayModeForWidget(visual_properties.display_mode);
-    }
-
     SetAutoResizeMode(visual_properties.auto_resize_enabled,
                       visual_properties.min_size_for_auto_resize,
                       visual_properties.max_size_for_auto_resize,
@@ -813,7 +793,6 @@ void RenderWidget::OnUpdateVisualProperties(
       // TODO(danakj): Isn't the display mode check redundant with the
       // fullscreen one?
       if (visual_properties.is_fullscreen_granted != is_fullscreen_granted_ ||
-          visual_properties.display_mode != display_mode_ ||
           visual_properties.screen_info.device_scale_factor !=
               screen_info_.device_scale_factor)
         ignore_resize_ipc = false;
@@ -859,7 +838,6 @@ void RenderWidget::OnUpdateVisualProperties(
       visible_viewport_size_ = visual_properties.visible_viewport_size;
 
       if (!auto_resize_mode_) {
-        display_mode_ = visual_properties.display_mode;
         size_ = visual_properties.new_size;
         ResizeWebWidget();
       }
@@ -1073,10 +1051,8 @@ viz::FrameSinkId RenderWidget::GetFrameSinkIdAtPoint(const gfx::PointF& point,
 
 bool RenderWidget::HandleInputEvent(
     const blink::WebCoalescedInputEvent& input_event,
-    const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
-  input_handler_->HandleInputEvent(input_event, latency_info,
-                                   std::move(callback));
+  input_handler_->HandleInputEvent(input_event, std::move(callback));
   return true;
 }
 
@@ -1092,17 +1068,13 @@ void RenderWidget::OnCursorVisibilityChange(bool is_visible) {
   GetWebWidget()->SetCursorVisibilityState(is_visible);
 }
 
-void RenderWidget::OnFallbackCursorModeToggled(bool is_on) {
-  GetWebWidget()->OnFallbackCursorModeToggled(is_on);
-}
-
 void RenderWidget::OnMouseCaptureLost() {
   GetWebWidget()->MouseCaptureLost();
 }
 
 void RenderWidget::OnSetEditCommandsForNextKeyEvent(
-    const EditCommands& edit_commands) {
-  edit_commands_ = edit_commands;
+    std::vector<blink::mojom::EditCommandPtr> edit_commands) {
+  edit_commands_ = std::move(edit_commands);
 }
 
 void RenderWidget::OnSetActive(bool active) {
@@ -1122,34 +1094,6 @@ void RenderWidget::OnSetFocus(bool enable) {
     observer.RenderWidgetSetFocus(enable);
 }
 
-///////////////////////////////////////////////////////////////////////////////
-// LayerTreeViewDelegate
-
-void RenderWidget::ApplyViewportChanges(
-    const cc::ApplyViewportChangesArgs& args) {
-  GetWebWidget()->ApplyViewportChanges(args);
-}
-
-void RenderWidget::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
-  GetWebWidget()->RecordManipulationTypeCounts(info);
-}
-
-void RenderWidget::SendOverscrollEventFromImplSide(
-    const gfx::Vector2dF& overscroll_delta,
-    cc::ElementId scroll_latched_element_id) {
-  GetWebWidget()->SendOverscrollEventFromImplSide(overscroll_delta,
-                                                  scroll_latched_element_id);
-}
-void RenderWidget::SendScrollEndEventFromImplSide(
-    cc::ElementId scroll_latched_element_id) {
-  GetWebWidget()->SendScrollEndEventFromImplSide(scroll_latched_element_id);
-}
-
-void RenderWidget::BeginMainFrame(base::TimeTicks frame_time) {
-  DCHECK(!IsForProvisionalFrame());
-  GetWebWidget()->BeginFrame(frame_time);
-}
-
 void RenderWidget::DispatchRafAlignedInput(base::TimeTicks frame_time) {
   input_event_queue_->DispatchRafAlignedInput(frame_time);
 }
@@ -1178,10 +1122,6 @@ void RenderWidget::OnDeferCommitsChanged(bool deferral_state) {
   widget_input_handler_manager_->OnDeferCommitsChanged(deferral_state);
 }
 
-void RenderWidget::DidBeginMainFrame() {
-  GetWebWidget()->DidBeginFrame();
-}
-
 void RenderWidget::RequestNewLayerTreeFrameSink(
     LayerTreeFrameSinkCallback callback) {
   // For widgets that are never visible, we don't start the compositor, so we
@@ -1211,19 +1151,11 @@ void RenderWidget::DidCommitAndDrawCompositorFrame() {
 
   for (auto& observer : render_frames_)
     observer.DidCommitAndDrawCompositorFrame();
-
-  // Notify subclasses that we initiated the paint operation.
-  DidInitiatePaint();
-}
-
-void RenderWidget::WillCommitCompositorFrame() {
-  GetWebWidget()->BeginCommitCompositorFrame();
 }
 
 void RenderWidget::DidCommitCompositorFrame(base::TimeTicks commit_start_time) {
   if (delegate())
     delegate()->DidCommitCompositorFrameForWidget();
-  GetWebWidget()->EndCommitCompositorFrame(commit_start_time);
 }
 
 void RenderWidget::DidCompletePageScaleAnimation() {
@@ -1238,11 +1170,6 @@ void RenderWidget::ScheduleAnimation() {
   layer_tree_host_->SetNeedsAnimate();
 }
 
-void RenderWidget::UpdateVisualState() {
-  DCHECK(!IsForProvisionalFrame());
-  GetWebWidget()->UpdateVisualState();
-}
-
 void RenderWidget::RecordTimeToFirstActivePaint(base::TimeDelta duration) {
   RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
   if (render_thread_impl->NeedsToRecordFirstActivePaint(TTFAP_AFTER_PURGED)) {
@@ -1258,34 +1185,9 @@ void RenderWidget::RecordTimeToFirstActivePaint(base::TimeDelta duration) {
   }
 }
 
-void RenderWidget::RecordStartOfFrameMetrics() {
-  GetWebWidget()->RecordStartOfFrameMetrics();
-}
-
-void RenderWidget::RecordEndOfFrameMetrics(
-    base::TimeTicks frame_begin_time,
-    cc::ActiveFrameSequenceTrackers trackers) {
-  GetWebWidget()->RecordEndOfFrameMetrics(frame_begin_time, trackers);
-}
-
-std::unique_ptr<cc::BeginMainFrameMetrics>
-RenderWidget::GetBeginMainFrameMetrics() {
-  return GetWebWidget()->GetBeginMainFrameMetrics();
-}
-
-void RenderWidget::BeginUpdateLayers() {
-  GetWebWidget()->BeginUpdateLayers();
-}
-
-void RenderWidget::EndUpdateLayers() {
-  GetWebWidget()->EndUpdateLayers();
-}
-
-void RenderWidget::WillBeginCompositorFrame() {
+void RenderWidget::WillBeginMainFrame() {
   TRACE_EVENT0("gpu", "RenderWidget::willBeginCompositorFrame");
 
-  GetWebWidget()->WillBeginCompositorFrame();
-
   // The UpdateTextInputState can result in further layout and possibly
   // enable GPU acceleration so they need to be called before any painting
   // is done.
@@ -1333,17 +1235,18 @@ void RenderWidget::OnDidHandleKeyEvent() {
 void RenderWidget::SetEditCommandForNextKeyEvent(const std::string& name,
                                                  const std::string& value) {
   ClearEditCommands();
-  edit_commands_.emplace_back(name, value);
+  edit_commands_.push_back(blink::mojom::EditCommand::New(name, value));
 }
 
 void RenderWidget::ClearEditCommands() {
   edit_commands_.clear();
 }
 
-void RenderWidget::OnDidOverscroll(const ui::DidOverscrollParams& params) {
+void RenderWidget::OnDidOverscroll(
+    blink::mojom::DidOverscrollParamsPtr params) {
   if (mojom::WidgetInputHandlerHost* host =
           widget_input_handler_manager_->GetWidgetInputHandlerHost()) {
-    host->DidOverscroll(params);
+    host->DidOverscroll(std::move(params));
   }
 }
 
@@ -1614,11 +1517,6 @@ void RenderWidget::SetScreenRects(const gfx::Rect& widget_screen_rect,
 ///////////////////////////////////////////////////////////////////////////////
 // WebWidgetClient
 
-void RenderWidget::IntrinsicSizingInfoChanged(
-    const blink::WebIntrinsicSizingInfo& sizing_info) {
-  Send(new WidgetHostMsg_IntrinsicSizingInfoChanged(routing_id_, sizing_info));
-}
-
 void RenderWidget::DidMeaningfulLayout(blink::WebMeaningfulLayout layout_type) {
   if (layout_type == blink::WebMeaningfulLayout::kVisuallyNonEmpty) {
     QueueMessage(std::make_unique<WidgetHostMsg_DidFirstVisuallyNonEmptyPaint>(
@@ -1665,23 +1563,9 @@ void RenderWidget::QueueMessage(std::unique_ptr<IPC::Message> msg) {
 }
 
 void RenderWidget::DidChangeCursor(const ui::Cursor& cursor) {
-  // TODO(darin): Eliminate this temporary.
-  WebCursor webcursor(cursor);
   // Only send a SetCursor message if we need to make a change.
-  if (input_handler_->DidChangeCursor(webcursor))
-    Send(new WidgetHostMsg_SetCursor(routing_id_, webcursor));
-}
-
-void RenderWidget::AutoscrollStart(const gfx::PointF& point) {
-  Send(new WidgetHostMsg_AutoscrollStart(routing_id_, point));
-}
-
-void RenderWidget::AutoscrollFling(const gfx::Vector2dF& velocity) {
-  Send(new WidgetHostMsg_AutoscrollFling(routing_id_, velocity));
-}
-
-void RenderWidget::AutoscrollEnd() {
-  Send(new WidgetHostMsg_AutoscrollEnd(routing_id_));
+  if (input_handler_->DidChangeCursor(cursor))
+    GetWebWidget()->SetCursor(cursor);
 }
 
 // We are supposed to get a single call to Show for a newly created RenderWidget
@@ -1719,18 +1603,13 @@ void RenderWidget::Show(WebNavigationPolicy policy) {
 void RenderWidget::InitCompositing(const ScreenInfo& screen_info) {
   TRACE_EVENT0("blink", "RenderWidget::InitializeLayerTreeView");
 
-  layer_tree_view_ = std::make_unique<LayerTreeView>(
-      this, compositor_deps_->GetCompositorMainThreadTaskRunner(),
-      compositor_deps_->GetCompositorImplThreadTaskRunner(),
+  layer_tree_host_ = webwidget_->InitializeCompositing(
       compositor_deps_->GetTaskGraphRunner(),
-      compositor_deps_->GetWebMainThreadScheduler());
-  layer_tree_view_->Initialize(
       GenerateLayerTreeSettings(compositor_deps_, for_child_local_root_frame_,
                                 screen_info.rect.size(),
                                 screen_info.device_scale_factor),
       compositor_deps_->CreateUkmRecorderFactory());
-  layer_tree_host_ = layer_tree_view_->layer_tree_host();
-
+  DCHECK(layer_tree_host_);
   blink::scheduler::WebThreadScheduler* main_thread_scheduler =
       compositor_deps_->GetWebMainThreadScheduler();
 
@@ -1812,29 +1691,25 @@ void RenderWidget::Close(std::unique_ptr<RenderWidget> widget) {
     g_routing_id_widget_map.Get().erase(routing_id_);
   }
 
-  webwidget_->Close();
-  webwidget_ = nullptr;
-
   // The |input_event_queue_| is refcounted and will live while an event is
   // being handled. This drops the connection back to this RenderWidget which
   // is being destroyed.
   input_event_queue_->ClearClient();
 
-  // The LayerTreeHost may already be in the call stack, if this RenderWidget
-  // is being destroyed during an animation callback for instance. We can not
-  // delete it here and unwind the stack back up to it, or it will crash. So
-  // we post the deletion to another task, but disconnect the LayerTreeHost
-  // (via the LayerTreeView) from the destroying RenderWidget. The
-  // LayerTreeView owns the LayerTreeHost, and is its client, so they are kept
-  // alive together for a clean call stack.
-  layer_tree_view_->Disconnect();
-  compositor_deps_->GetCleanupTaskRunner()->DeleteSoon(
-      FROM_HERE, std::move(layer_tree_view_));
-  // The |widget_input_handler_manager_| is referenced through the
-  // LayerTreeHost on the compositor thread, so must outlive the
-  // LayerTreeHost.
-  compositor_deps_->GetCleanupTaskRunner()->ReleaseSoon(
-      FROM_HERE, std::move(widget_input_handler_manager_));
+  // The |widget_input_handler_manager_| needs to outlive the LayerTreeHost,
+  // which is destroyed asynchronously by Close(). We pass ownership of it to
+  // Close() for it to destroy the LayerTreeHost and
+  // |widget_input_handler_manager_| together on the cleanup TaskRunner.
+  webwidget_->Close(
+      compositor_deps_->GetCleanupTaskRunner(),
+      base::BindOnce([](scoped_refptr<WidgetInputHandlerManager> manager) {},
+                     std::move(widget_input_handler_manager_)));
+  webwidget_ = nullptr;
+
+  // |layer_tree_host_| is valid only when |webwidget_| is valid. Close may
+  // use the WebWidgetClient while unloading the Frame so we clear this
+  // after.
+  layer_tree_host_ = nullptr;
 
   // Note the ACK is a control message going to the RenderProcessHost.
   RenderThread::Get()->Send(new WidgetHostMsg_Close_ACK(routing_id()));
@@ -2140,6 +2015,14 @@ void RenderWidget::UpdateSurfaceAndScreenInfo(
     render_frame->SetDeviceScaleFactorOnRenderView(
         compositor_deps_->IsUseZoomForDSFEnabled(),
         screen_info_.device_scale_factor);
+    // When the device scale changes, the size and position of the popup would
+    // need to be adjusted, which we can't do. Just close the popup, which is
+    // also consistent with page zoom and resize behavior.
+    if (previous_original_screen_info.device_scale_factor !=
+        screen_info_.device_scale_factor) {
+      blink::WebView* web_view = GetFrameWidget()->LocalRoot()->View();
+      web_view->CancelPagePopup();
+    }
   }
 
   // Propagate changes down to child local root RenderWidgets and BrowserPlugins
@@ -2208,23 +2091,6 @@ void RenderWidget::OnSetViewportIntersection(
   }
 }
 
-void RenderWidget::OnSetIsInert(bool inert) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->SetIsInert(inert);
-}
-
-void RenderWidget::OnSetInheritedEffectiveTouchAction(
-    cc::TouchAction touch_action) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->SetInheritedEffectiveTouchAction(touch_action);
-}
-
-void RenderWidget::OnUpdateRenderThrottlingStatus(bool is_throttled,
-                                                  bool subtree_throttled) {
-  if (auto* frame_widget = GetFrameWidget())
-    frame_widget->UpdateRenderThrottlingStatus(is_throttled, subtree_throttled);
-}
-
 void RenderWidget::OnDragTargetDragEnter(
     const std::vector<DropData::Metadata>& drop_meta_data,
     const gfx::PointF& client_point,
@@ -2420,18 +2286,16 @@ void RenderWidget::SetHidden(bool hidden) {
   // throttled acks are released in case frame production ceases.
   is_hidden_ = hidden;
 
-  if (render_widget_scheduling_state_)
-    render_widget_scheduling_state_->SetHidden(hidden);
+  if (auto* scheduler_state = GetWebWidget()->RendererWidgetSchedulingState())
+    scheduler_state->SetHidden(hidden);
 
   // If the renderer was hidden, resolve any pending synthetic gestures so they
   // aren't blocked waiting for a compositor frame to be generated.
   if (is_hidden_)
     widget_input_handler_manager_->InvokeInputProcessedCallback();
 
-  if (!never_composited_) {
+  if (!never_composited_)
     webwidget_->SetCompositorVisible(!is_hidden_);
-    layer_tree_view_->SetVisible(!is_hidden_);
-  }
 }
 
 void RenderWidget::OnImeEventGuardStart(ImeEventGuard* guard) {
@@ -2614,9 +2478,9 @@ void RenderWidget::DidHandleGestureEvent(const WebGestureEvent& event,
   }
 
 #if defined(OS_ANDROID) || defined(USE_AURA)
-  if (event.GetType() == WebInputEvent::kGestureTap) {
+  if (event.GetType() == WebInputEvent::Type::kGestureTap) {
     ShowVirtualKeyboard();
-  } else if (event.GetType() == WebInputEvent::kGestureLongPress) {
+  } else if (event.GetType() == WebInputEvent::Type::kGestureLongPress) {
     DCHECK(GetWebWidget());
     blink::WebInputMethodController* controller = GetInputMethodController();
     if (!controller || controller->TextInputInfo().value.IsEmpty())
@@ -2659,8 +2523,7 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
     bool is_for_subframe,
     const gfx::Size& initial_screen_size,
     float initial_device_scale_factor) {
-  const bool is_threaded =
-      !!compositor_deps->GetCompositorImplThreadTaskRunner();
+  const bool is_threaded = !compositor_deps->IsSingleThreaded();
 
   const base::CommandLine& cmd = *base::CommandLine::ForCurrentProcess();
   cc::LayerTreeSettings settings;
@@ -2687,8 +2550,10 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
       !cmd.HasSwitch(cc::switches::kDisableCheckerImaging) && is_threaded;
 
 #if defined(OS_ANDROID)
-  if (!viz::AlwaysUseWideColorGamut())
-    settings.prefer_raster_in_srgb = true;
+  // WebView should always raster in the default color space.
+  // Synchronous compositing indicates WebView.
+  if (!compositor_deps->UsingSynchronousCompositing())
+    settings.prefer_raster_in_srgb = features::IsDynamicColorGamutEnabled();
 
   // We can use a more aggressive limit on Android since decodes tend to take
   // longer on these devices.
@@ -2849,6 +2714,8 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
       cmd.HasSwitch(cc::switches::kShowSurfaceDamageRects);
   settings.initial_debug_state.show_screen_space_rects =
       cmd.HasSwitch(cc::switches::kShowScreenSpaceRects);
+  settings.initial_debug_state.highlight_non_lcd_text_layers =
+      cmd.HasSwitch(cc::switches::kHighlightNonLCDTextLayers);
 
   settings.initial_debug_state.SetRecordRenderingStats(
       cmd.HasSwitch(cc::switches::kEnableGpuBenchmarking));
@@ -3137,16 +3004,6 @@ void RenderWidget::SetHasPointerRawUpdateEventHandlers(bool has_handlers) {
   input_event_queue_->HasPointerRawUpdateEventHandlers(has_handlers);
 }
 
-void RenderWidget::SetHasTouchEventHandlers(bool has_handlers) {
-  if (has_touch_handlers_ && *has_touch_handlers_ == has_handlers)
-    return;
-
-  has_touch_handlers_ = has_handlers;
-  if (render_widget_scheduling_state_)
-    render_widget_scheduling_state_->SetHasTouchHandler(has_handlers);
-  Send(new WidgetHostMsg_HasTouchEventHandlers(routing_id_, has_handlers));
-}
-
 void RenderWidget::SetNeedsLowLatencyInput(bool needs_low_latency) {
   input_event_queue_->SetNeedsLowLatency(needs_low_latency);
 }
@@ -3155,35 +3012,6 @@ void RenderWidget::SetNeedsUnbufferedInputForDebugger(bool unbuffered) {
   input_event_queue_->SetNeedsUnbufferedInputForDebugger(unbuffered);
 }
 
-void RenderWidget::AnimateDoubleTapZoomInMainFrame(
-    const gfx::Point& point,
-    const blink::WebRect& rect_to_zoom) {
-  // Only oopif subframes should be sending this message.
-  DCHECK(!delegate());
-  Send(new WidgetHostMsg_AnimateDoubleTapZoomInMainFrame(routing_id(), point,
-                                                         rect_to_zoom));
-}
-
-void RenderWidget::ZoomToFindInPageRectInMainFrame(
-    const blink::WebRect& rect_to_zoom) {
-  // Only oopif subframes should be sending this message.
-  DCHECK(!delegate_);
-  Send(new WidgetHostMsg_ZoomToFindInPageRectInMainFrame(routing_id(),
-                                                         rect_to_zoom));
-}
-
-void RenderWidget::FallbackCursorModeLockCursor(bool left,
-                                                bool right,
-                                                bool up,
-                                                bool down) {
-  widget_input_handler_manager_->FallbackCursorModeLockCursor(left, right, up,
-                                                              down);
-}
-
-void RenderWidget::FallbackCursorModeSetCursorVisibility(bool visible) {
-  widget_input_handler_manager_->FallbackCursorModeSetCursorVisibility(visible);
-}
-
 void RenderWidget::SetPageScaleStateAndLimits(float page_scale_factor,
                                               bool is_pinch_gesture_active,
                                               float minimum,
@@ -3224,12 +3052,6 @@ viz::FrameSinkId RenderWidget::GetFrameSinkId() {
   return viz::FrameSinkId(RenderThread::Get()->GetClientId(), routing_id());
 }
 
-void RenderWidget::AddPresentationCallback(
-    uint32_t frame_token,
-    base::OnceCallback<void(base::TimeTicks)> callback) {
-  layer_tree_view_->AddPresentationCallback(frame_token, std::move(callback));
-}
-
 void RenderWidget::RequestUnbufferedInputEvents() {
   input_event_queue_->RequestUnbufferedInputEvents();
 }
@@ -3309,10 +3131,6 @@ bool RenderWidget::RequestPointerLockChange(
       request_unadjusted_movement);
 }
 
-void RenderWidget::PointerLockLost() {
-  mouse_lock_dispatcher_->OnMouseLockLost();
-}
-
 void RenderWidget::RequestPointerUnlock() {
   mouse_lock_dispatcher_->UnlockMouse(webwidget_mouse_lock_target_.get());
 }
@@ -3395,7 +3213,14 @@ blink::WebHitTestResult RenderWidget::GetHitTestResultAtPoint(
 }
 
 void RenderWidget::SetDeviceScaleFactorForTesting(float factor) {
-  DCHECK_GT(factor, 0.f);
+  DCHECK_GE(factor, 0.f);
+
+  // Receiving a 0 is used to reset between tests, it removes the override in
+  // order to listen to the browser for the next test.
+  if (!factor) {
+    device_scale_factor_for_testing_ = 0;
+    return;
+  }
 
   // We are changing the device scale factor from the renderer, so allocate a
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
diff --git a/chromium/content/renderer/render_widget.h b/chromium/content/renderer/render_widget.h
index a17e429dd96..a62c46d27fb 100644
--- a/chromium/content/renderer/render_widget.h
+++ b/chromium/content/renderer/render_widget.h
@@ -34,10 +34,8 @@
 #include "content/common/content_export.h"
 #include "content/common/content_to_visible_time_reporter.h"
 #include "content/common/drag_event_source_info.h"
-#include "content/common/edit_command.h"
 #include "content/common/widget.mojom.h"
 #include "content/public/common/drop_data.h"
-#include "content/renderer/compositor/layer_tree_view_delegate.h"
 #include "content/renderer/input/main_thread_event_queue.h"
 #include "content/renderer/input/render_widget_input_handler.h"
 #include "content/renderer/input/render_widget_input_handler_delegate.h"
@@ -53,7 +51,7 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/referrer_policy.mojom.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
-#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
+#include "third_party/blink/public/mojom/input/input_handler.mojom-shared.h"
 #include "third_party/blink/public/platform/viewport_intersection_state.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_text_input_info.h"
@@ -81,7 +79,6 @@ class SyncMessageFilter;
 
 namespace blink {
 namespace scheduler {
-class WebRenderWidgetSchedulingState;
 class WebWidgetScheduler;
 }
 struct WebDeviceEmulationParams;
@@ -94,7 +91,6 @@ class WebPagePopup;
 }  // namespace blink
 
 namespace cc {
-struct ApplyViewportChangesArgs;
 class SwapPromise;
 }
 
@@ -105,14 +101,13 @@ class Range;
 }
 
 namespace ui {
-struct DidOverscrollParams;
+class Cursor;
 }
 
 namespace content {
 class CompositorDependencies;
 class FrameSwapMessageQueue;
 class ImeEventGuard;
-class LayerTreeView;
 class MainThreadEventQueue;
 class PepperPluginInstanceImpl;
 class RenderFrameImpl;
@@ -146,14 +141,12 @@ class CONTENT_EXPORT RenderWidget
       public IPC::Sender,
       public blink::WebPagePopupClient,  // Is-a WebWidgetClient also.
       public mojom::Widget,
-      public LayerTreeViewDelegate,
       public RenderWidgetInputHandlerDelegate,
       public RenderWidgetScreenMetricsEmulatorDelegate,
       public MainThreadEventQueueClient {
  public:
   RenderWidget(int32_t widget_routing_id,
                CompositorDependencies* compositor_deps,
-               blink::mojom::DisplayMode display_mode,
                bool hidden,
                bool never_composited,
                mojo::PendingReceiver<mojom::Widget> widget_receiver);
@@ -174,9 +167,9 @@ class CONTENT_EXPORT RenderWidget
   // Convenience type for creation method taken by InstallCreateForFrameHook().
   // The method signature matches the RenderWidget constructor.
   using CreateRenderWidgetFunction = std::unique_ptr<RenderWidget> (*)(
-      int32_t,
+      int32_t routing_id,
       CompositorDependencies*,
-      blink::mojom::DisplayMode display_mode,
+      bool hidden,
       bool never_composited,
       mojo::PendingReceiver<mojom::Widget> widget_receiver);
   // Overrides the implementation of CreateForFrame() function below. Used by
@@ -190,7 +183,6 @@ class CONTENT_EXPORT RenderWidget
   static std::unique_ptr<RenderWidget> CreateForFrame(
       int32_t widget_routing_id,
       CompositorDependencies* compositor_deps,
-      blink::mojom::DisplayMode display_mode,
       bool never_composited);
 
   // Creates a RenderWidget for a popup. This is separate from CreateForFrame()
@@ -201,7 +193,6 @@ class CONTENT_EXPORT RenderWidget
   static RenderWidget* CreateForPopup(
       int32_t widget_routing_id,
       CompositorDependencies* compositor_deps,
-      blink::mojom::DisplayMode display_mode,
       bool hidden,
       bool never_composited,
       mojo::PendingReceiver<mojom::Widget> widget_receiver);
@@ -263,7 +254,6 @@ class CONTENT_EXPORT RenderWidget
 
   const gfx::Size& size() const { return size_; }
   bool is_fullscreen_granted() const { return is_fullscreen_granted_; }
-  blink::mojom::DisplayMode display_mode() const { return display_mode_; }
   bool is_hidden() const { return is_hidden_; }
   bool has_host_context_menu_location() const {
     return has_host_context_menu_location_;
@@ -284,7 +274,9 @@ class CONTENT_EXPORT RenderWidget
   bool IsForProvisionalFrame() const;
 
   // Manage edit commands to be used for the next keyboard event.
-  const EditCommands& edit_commands() const { return edit_commands_; }
+  const std::vector<blink::mojom::EditCommandPtr>& edit_commands() const {
+    return edit_commands_;
+  }
   void SetEditCommandForNextKeyEvent(const std::string& name,
                                      const std::string& value);
   void ClearEditCommands();
@@ -304,36 +296,6 @@ class CONTENT_EXPORT RenderWidget
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
 
-  // LayerTreeViewDelegate
-  void ApplyViewportChanges(const cc::ApplyViewportChangesArgs& args) override;
-  void RecordManipulationTypeCounts(cc::ManipulationInfo info) override;
-  void SendOverscrollEventFromImplSide(
-      const gfx::Vector2dF& overscroll_delta,
-      cc::ElementId scroll_latched_element_id) override;
-  void SendScrollEndEventFromImplSide(
-      cc::ElementId scroll_latched_element_id) override;
-  void BeginMainFrame(base::TimeTicks frame_time) override;
-  void OnDeferMainFrameUpdatesChanged(bool) override;
-  void OnDeferCommitsChanged(bool) override;
-  void DidBeginMainFrame() override;
-  void RequestNewLayerTreeFrameSink(
-      LayerTreeFrameSinkCallback callback) override;
-  void DidCommitAndDrawCompositorFrame() override;
-  void WillCommitCompositorFrame() override;
-  void DidCommitCompositorFrame(base::TimeTicks commit_start_time) override;
-  void DidCompletePageScaleAnimation() override;
-  void RecordStartOfFrameMetrics() override;
-  void RecordEndOfFrameMetrics(
-      base::TimeTicks frame_begin_time,
-      cc::ActiveFrameSequenceTrackers trackers) override;
-  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
-      override;
-
-  void BeginUpdateLayers() override;
-  void EndUpdateLayers() override;
-  void UpdateVisualState() override;
-  void WillBeginCompositorFrame() override;
-
   // RenderWidgetInputHandlerDelegate
   void FocusChangeComplete() override;
   void ObserveGestureEventAndResult(
@@ -343,7 +305,7 @@ class CONTENT_EXPORT RenderWidget
       bool event_processed) override;
 
   void OnDidHandleKeyEvent() override;
-  void OnDidOverscroll(const ui::DidOverscrollParams& params) override;
+  void OnDidOverscroll(blink::mojom::DidOverscrollParamsPtr params) override;
   void SetInputHandler(RenderWidgetInputHandler* input_handler) override;
   void ShowVirtualKeyboard() override;
   void UpdateTextInputState() override;
@@ -364,13 +326,8 @@ class CONTENT_EXPORT RenderWidget
 
   // blink::WebWidgetClient
   void ScheduleAnimation() override;
-  void IntrinsicSizingInfoChanged(
-      const blink::WebIntrinsicSizingInfo&) override;
   void DidMeaningfulLayout(blink::WebMeaningfulLayout layout_type) override;
   void DidChangeCursor(const ui::Cursor& cursor) override;
-  void AutoscrollStart(const gfx::PointF& point) override;
-  void AutoscrollFling(const gfx::Vector2dF& velocity) override;
-  void AutoscrollEnd() override;
   void ClosePopupWidgetSoon() override;
   void Show(blink::WebNavigationPolicy) override;
   blink::WebScreenInfo GetScreenInfo() override;
@@ -402,7 +359,6 @@ class CONTENT_EXPORT RenderWidget
       blink::WebLocalFrame* requester_frame,
       blink::WebWidgetClient::PointerLockCallback callback,
       bool request_unadjusted_movement) override;
-  void PointerLockLost();
   void RequestPointerUnlock() override;
   bool IsPointerLocked() override;
   void StartDragging(network::mojom::ReferrerPolicy policy,
@@ -413,18 +369,8 @@ class CONTENT_EXPORT RenderWidget
   void SetTouchAction(cc::TouchAction touch_action) override;
   void RequestUnbufferedInputEvents() override;
   void SetHasPointerRawUpdateEventHandlers(bool has_handlers) override;
-  void SetHasTouchEventHandlers(bool has_handlers) override;
   void SetNeedsLowLatencyInput(bool) override;
   void SetNeedsUnbufferedInputForDebugger(bool) override;
-  void AnimateDoubleTapZoomInMainFrame(const gfx::Point& point,
-                                       const blink::WebRect& bounds) override;
-  void ZoomToFindInPageRectInMainFrame(
-      const blink::WebRect& rect_to_zoom) override;
-  void FallbackCursorModeLockCursor(bool left,
-                                    bool right,
-                                    bool up,
-                                    bool down) override;
-  void FallbackCursorModeSetCursorVisibility(bool visible) override;
   void SetPageScaleStateAndLimits(float page_scale_factor,
                                   bool is_pinch_gesture_active,
                                   float minimum,
@@ -433,16 +379,21 @@ class CONTENT_EXPORT RenderWidget
   void RequestDecode(const cc::PaintImage& image,
                      base::OnceCallback<void(bool)> callback) override;
   viz::FrameSinkId GetFrameSinkId() override;
-  void AddPresentationCallback(
-      uint32_t frame_token,
-      base::OnceCallback<void(base::TimeTicks)> callback) override;
   void RecordTimeToFirstActivePaint(base::TimeDelta duration) override;
+  void OnDeferMainFrameUpdatesChanged(bool) override;
+  void OnDeferCommitsChanged(bool) override;
+  void DidCommitAndDrawCompositorFrame() override;
+  void DidCommitCompositorFrame(base::TimeTicks commit_start_time) override;
+  void DidCompletePageScaleAnimation() override;
+  void WillBeginMainFrame() override;
+  void RequestNewLayerTreeFrameSink(
+      LayerTreeFrameSinkCallback callback) override;
 
   // Returns the scale being applied to the document in blink by the device
   // emulator. Returns 1 if there is no emulation active. Use this to position
   // things when the coordinates did not come from blink, such as from the mouse
   // position.
-  float GetEmulatorScale() const;
+  float GetEmulatorScale() const override;
 
   // Override point to obtain that the current input method state and caret
   // position.
@@ -543,7 +494,6 @@ class CONTENT_EXPORT RenderWidget
 
   // MainThreadEventQueueClient overrides.
   bool HandleInputEvent(const blink::WebCoalescedInputEvent& input_event,
-                        const ui::LatencyInfo& latency_info,
                         HandledEventCallback callback) override;
   void SetNeedsMainFrame() override;
 
@@ -563,8 +513,8 @@ class CONTENT_EXPORT RenderWidget
   void OnSetFocus(bool enable);
   void OnMouseCaptureLost();
   void OnCursorVisibilityChange(bool is_visible);
-  void OnFallbackCursorModeToggled(bool is_on);
-  void OnSetEditCommandsForNextKeyEvent(const EditCommands& edit_commands);
+  void OnSetEditCommandsForNextKeyEvent(
+      std::vector<blink::mojom::EditCommandPtr> edit_commands);
   void OnImeSetComposition(
       const base::string16& text,
       const std::vector<blink::WebImeTextSpan>& ime_text_spans,
@@ -615,9 +565,6 @@ class CONTENT_EXPORT RenderWidget
   base::WeakPtr<RenderWidget> AsWeakPtr();
 
  protected:
-  // Notify subclasses that we initiated the paint operation.
-  virtual void DidInitiatePaint() {}
-
   // Notify subclasses that we handled OnUpdateVisualProperties.
   virtual void AfterUpdateVisualProperties() {}
 
@@ -700,10 +647,6 @@ class CONTENT_EXPORT RenderWidget
                            const gfx::Rect& window_screen_rect);
   void OnSetViewportIntersection(
       const blink::ViewportIntersectionState& intersection_state);
-  void OnSetIsInert(bool);
-  void OnSetInheritedEffectiveTouchAction(cc::TouchAction touch_action);
-  void OnUpdateRenderThrottlingStatus(bool is_throttled,
-                                      bool subtree_throttled);
   void OnDragTargetDragEnter(
       const std::vector<DropData::Metadata>& drop_meta_data,
       const gfx::PointF& client_pt,
@@ -723,7 +666,6 @@ class CONTENT_EXPORT RenderWidget
   void OnDragSourceEnded(const gfx::PointF& client_point,
                          const gfx::PointF& screen_point,
                          blink::WebDragOperation drag_operation);
-  void OnDragSourceSystemDragEnded();
   void OnOrientationChange();
   void OnWaitNextFrameForTests(int routing_id);
 
@@ -821,20 +763,17 @@ class CONTENT_EXPORT RenderWidget
   // features.
   CompositorDependencies* const compositor_deps_;
 
-  // We are responsible for destroying this object via its Close method, unless
-  // the RenderWidget is associated with a RenderViewImpl through |delegate_|.
-  // Becomes null once close is initiated on the RenderWidget.
-  blink::WebWidget* webwidget_ = nullptr;
-
   // The delegate for this object which is just a RenderViewImpl.
   // This member is non-null if and only if the RenderWidget is associated with
   // a RenderViewImpl.
   RenderWidgetDelegate* delegate_ = nullptr;
 
-  // Wraps the LayerTreeHost, providing clients for it with the ability to
-  // outlive RenderWidget during shutdown and keep the client pointers valid.
-  std::unique_ptr<LayerTreeView> layer_tree_view_;
-  // This is valid while |layer_tree_view_| is valid.
+  // We are responsible for destroying this object via its Close method, unless
+  // the RenderWidget is associated with a RenderViewImpl through |delegate_|.
+  // Becomes null once close is initiated on the RenderWidget.
+  blink::WebWidget* webwidget_ = nullptr;
+
+  // This is valid while |webwidget_| is valid.
   cc::LayerTreeHost* layer_tree_host_ = nullptr;
 
   // Present when emulation is enabled, only in a main frame RenderWidget. Used
@@ -898,9 +837,6 @@ class CONTENT_EXPORT RenderWidget
   // Indicates whether tab-initiated fullscreen was granted.
   bool is_fullscreen_granted_ = false;
 
-  // Indicates the display mode.
-  blink::mojom::DisplayMode display_mode_;
-
   // It is possible that one ImeEventGuard is nested inside another
   // ImeEventGuard. We keep track of the outermost one, and update it as needed.
   ImeEventGuard* ime_event_guard_ = nullptr;
@@ -998,9 +934,6 @@ class CONTENT_EXPORT RenderWidget
   bool has_host_context_menu_location_ = false;
   gfx::Point host_context_menu_location_;
 
-  std::unique_ptr<blink::scheduler::WebRenderWidgetSchedulingState>
-      render_widget_scheduling_state_;
-
   // Mouse Lock dispatcher attached to this view.
   std::unique_ptr<RenderWidgetMouseLockDispatcher> mouse_lock_dispatcher_;
 
@@ -1036,7 +969,7 @@ class CONTENT_EXPORT RenderWidget
 
   // Stores edit commands associated to the next key event.
   // Will be cleared as soon as the next key event is processed.
-  EditCommands edit_commands_;
+  std::vector<blink::mojom::EditCommandPtr> edit_commands_;
 
   // This field stores drag/drop related info for the event that is currently
   // being handled. If the current event results in starting a drag/drop
@@ -1062,10 +995,6 @@ class CONTENT_EXPORT RenderWidget
 
   gfx::Rect compositor_visible_rect_;
 
-  // Different consumers in the browser process makes different assumptions, so
-  // must always send the first IPC regardless of value.
-  base::Optional<bool> has_touch_handlers_;
-
   uint32_t last_capture_sequence_number_ = 0u;
 
   std::unique_ptr<blink::scheduler::WebWidgetScheduler> widget_scheduler_;
diff --git a/chromium/content/renderer/render_widget_browsertest.cc b/chromium/content/renderer/render_widget_browsertest.cc
index 1f6958648b9..c4f7ecee747 100644
--- a/chromium/content/renderer/render_widget_browsertest.cc
+++ b/chromium/content/renderer/render_widget_browsertest.cc
@@ -248,28 +248,40 @@ TEST_F(RenderWidgetTest, CompositorIdHitTestAPIWithImplicitRootScroller) {
 
 TEST_F(RenderWidgetTest, FrameSinkIdHitTestAPI) {
   LoadHTML(
-      "<body style='padding: 0px; margin: 0px'>"
-      "<div style='background: green; padding: 100px; margin: 0px;'>"
-      "<iframe style='width: 200px; height: 100px;'"
-      "srcdoc='<body style=\"margin: 0px; height: 100px; width: 200px;\">"
-      "</body>'></iframe><div></body>");
+      R"HTML(
+      <style>
+      html, body {
+        margin :0px;
+        padding: 0px;
+      }
+      </style>
+
+      <div style='background: green; padding: 100px; margin: 0px;'>
+        <iframe style='width: 200px; height: 100px;'
+          srcdoc='<body style="margin : 0px; height : 100px; width : 200px;">
+          </body>'>
+        </iframe>
+      </div>
+
+      )HTML");
+
   gfx::PointF point;
   viz::FrameSinkId main_frame_sink_id =
-      widget()->GetFrameSinkIdAtPoint(gfx::PointF(10, 10), &point);
+      widget()->GetFrameSinkIdAtPoint(gfx::PointF(10.43, 10.74), &point);
   EXPECT_EQ(static_cast<uint32_t>(widget()->routing_id()),
             main_frame_sink_id.sink_id());
   EXPECT_EQ(static_cast<uint32_t>(RenderThreadImpl::Get()->GetClientId()),
             main_frame_sink_id.client_id());
-  EXPECT_EQ(gfx::PointF(10, 10), point);
+  EXPECT_EQ(gfx::PointF(10.43, 10.74), point);
 
   // Targeting a child frame should also return the FrameSinkId for the main
   // widget.
   viz::FrameSinkId frame_sink_id =
-      widget()->GetFrameSinkIdAtPoint(gfx::PointF(150, 150), &point);
+      widget()->GetFrameSinkIdAtPoint(gfx::PointF(150.27, 150.25), &point);
   EXPECT_EQ(static_cast<uint32_t>(widget()->routing_id()),
             frame_sink_id.sink_id());
   EXPECT_EQ(main_frame_sink_id.client_id(), frame_sink_id.client_id());
-  EXPECT_EQ(gfx::PointF(150, 150), point);
+  EXPECT_EQ(gfx::PointF(150.27, 150.25), point);
 }
 
 TEST_F(RenderWidgetTest, GetCompositionRangeValidComposition) {
diff --git a/chromium/content/renderer/render_widget_delegate.h b/chromium/content/renderer/render_widget_delegate.h
index bd7d3623e69..50bc8b8c717 100644
--- a/chromium/content/renderer/render_widget_delegate.h
+++ b/chromium/content/renderer/render_widget_delegate.h
@@ -38,11 +38,6 @@ class CONTENT_EXPORT RenderWidgetDelegate {
   // These methods called during handling of a SynchronizeVisualProperties
   // message to handle updating state on the delegate.
   //
-  // Called during handling a SynchronizeVisualProperties message, with the new
-  // display mode that will be applied to the RenderWidget. The display mode in
-  // the RenderWidget is already changed when this method is called.
-  virtual void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) = 0;
   // Called during handling a SynchronizeVisualProperties message, if auto
   // resize is enabled, with the new auto size limits.
   virtual void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.cc b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
index 8622d65389a..e1ed89aa710 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.cc
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
@@ -55,7 +55,6 @@ class FullscreenMouseLockDispatcher : public MouseLockDispatcher {
   // MouseLockDispatcher implementation.
   void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                             bool request_unadjusted_movement) override;
-  void SendUnlockMouseRequest() override;
 
   RenderWidgetFullscreenPepper* widget_;
 
@@ -71,23 +70,23 @@ WebMouseEvent WebMouseEventFromGestureEvent(const WebGestureEvent& gesture) {
   if (gesture.SourceDevice() != blink::WebGestureDevice::kTouchscreen)
     return WebMouseEvent();
 
-  WebInputEvent::Type type = WebInputEvent::kUndefined;
+  WebInputEvent::Type type = WebInputEvent::Type::kUndefined;
   switch (gesture.GetType()) {
-    case WebInputEvent::kGestureScrollBegin:
-      type = WebInputEvent::kMouseDown;
+    case WebInputEvent::Type::kGestureScrollBegin:
+      type = WebInputEvent::Type::kMouseDown;
       break;
-    case WebInputEvent::kGestureScrollUpdate:
-      type = WebInputEvent::kMouseMove;
+    case WebInputEvent::Type::kGestureScrollUpdate:
+      type = WebInputEvent::Type::kMouseMove;
       break;
-    case WebInputEvent::kGestureFlingStart:
+    case WebInputEvent::Type::kGestureFlingStart:
       // A scroll gesture on the touchscreen may end with a GestureScrollEnd
       // when there is no velocity, or a GestureFlingStart when it has a
       // velocity. In both cases, it should end the drag that was initiated by
       // the GestureScrollBegin (and subsequent GestureScrollUpdate) events.
-      type = WebInputEvent::kMouseUp;
+      type = WebInputEvent::Type::kMouseUp;
       break;
-    case WebInputEvent::kGestureScrollEnd:
-      type = WebInputEvent::kMouseUp;
+    case WebInputEvent::Type::kGestureScrollEnd:
+      type = WebInputEvent::Type::kMouseUp;
       break;
     default:
       return WebMouseEvent();
@@ -97,8 +96,8 @@ WebMouseEvent WebMouseEventFromGestureEvent(const WebGestureEvent& gesture) {
                       gesture.GetModifiers() | WebInputEvent::kLeftButtonDown,
                       gesture.TimeStamp());
   mouse.button = WebMouseEvent::Button::kLeft;
-  mouse.click_count = (mouse.GetType() == WebInputEvent::kMouseDown ||
-                       mouse.GetType() == WebInputEvent::kMouseUp);
+  mouse.click_count = (mouse.GetType() == WebInputEvent::Type::kMouseDown ||
+                       mouse.GetType() == WebInputEvent::Type::kMouseUp);
 
   mouse.SetPositionInWidget(gesture.PositionInWidget());
   mouse.SetPositionInScreen(gesture.PositionInScreen());
@@ -127,12 +126,6 @@ void FullscreenMouseLockDispatcher::SendLockMouseRequest(
   }
 }
 
-void FullscreenMouseLockDispatcher::SendUnlockMouseRequest() {
-  auto* host = widget_->GetInputHandlerHost();
-  if (host)
-    host->UnlockMouse();
-}
-
 }  // anonymous namespace
 
 // We place the WebExternalWidgetClient interface on a separate class because
@@ -157,10 +150,19 @@ class PepperExternalWidgetClient : public blink::WebExternalWidgetClient {
 
   void DidResize(const gfx::Size& size) override { widget_->DidResize(size); }
 
+  void RequestNewLayerTreeFrameSink(
+      LayerTreeFrameSinkCallback callback) override {
+    widget_->RequestNewLayerTreeFrameSink(std::move(callback));
+  }
+
   void RecordTimeToFirstActivePaint(base::TimeDelta duration) override {
     widget_->RecordTimeToFirstActivePaint(duration);
   }
 
+  void DidCommitAndDrawCompositorFrame() override {
+    widget_->DidInitiatePaint();
+  }
+
  private:
   RenderWidgetFullscreenPepper* widget_;
 };
@@ -199,7 +201,6 @@ RenderWidgetFullscreenPepper::RenderWidgetFullscreenPepper(
     blink::WebURL main_frame_url)
     : RenderWidget(routing_id,
                    compositor_deps,
-                   /*display_mode=*/blink::mojom::DisplayMode::kUndefined,
                    /*hidden=*/false,
                    /*never_composited=*/false,
                    std::move(widget_receiver)),
@@ -307,8 +308,8 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
     const WebGestureEvent* gesture_event =
         static_cast<const WebGestureEvent*>(&event);
     switch (event.GetType()) {
-      case WebInputEvent::kGestureTap: {
-        WebMouseEvent mouse(WebInputEvent::kMouseMove,
+      case WebInputEvent::Type::kGestureTap: {
+        WebMouseEvent mouse(WebInputEvent::Type::kMouseMove,
                             gesture_event->GetModifiers(),
                             gesture_event->TimeStamp());
         mouse.SetPositionInWidget(gesture_event->PositionInWidget());
@@ -317,19 +318,19 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
         mouse.movement_y = 0;
         result |= plugin()->HandleInputEvent(mouse, &cursor);
 
-        mouse.SetType(WebInputEvent::kMouseDown);
+        mouse.SetType(WebInputEvent::Type::kMouseDown);
         mouse.button = WebMouseEvent::Button::kLeft;
         mouse.click_count = gesture_event->data.tap.tap_count;
         result |= plugin()->HandleInputEvent(mouse, &cursor);
 
-        mouse.SetType(WebInputEvent::kMouseUp);
+        mouse.SetType(WebInputEvent::Type::kMouseUp);
         result |= plugin()->HandleInputEvent(mouse, &cursor);
         break;
       }
 
       default: {
         WebMouseEvent mouse = WebMouseEventFromGestureEvent(*gesture_event);
-        if (mouse.GetType() != WebInputEvent::kUndefined)
+        if (mouse.GetType() != WebInputEvent::Type::kUndefined)
           result |= plugin()->HandleInputEvent(mouse, &cursor);
         break;
       }
@@ -351,22 +352,22 @@ WebInputEventResult RenderWidgetFullscreenPepper::ProcessInputEvent(
     // On Windows, we handle it on mouse up.
 #if defined(OS_WIN)
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseUp &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseUp &&
         mouse_event.button == WebMouseEvent::Button::kRight;
 #elif defined(OS_MACOSX)
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseDown &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseDown &&
         (mouse_event.button == WebMouseEvent::Button::kRight ||
          (mouse_event.button == WebMouseEvent::Button::kLeft &&
           mouse_event.GetModifiers() & WebMouseEvent::kControlKey));
 #else
     send_context_menu_event =
-        mouse_event.GetType() == WebInputEvent::kMouseDown &&
+        mouse_event.GetType() == WebInputEvent::Type::kMouseDown &&
         mouse_event.button == WebMouseEvent::Button::kRight;
 #endif
     if (send_context_menu_event) {
       WebMouseEvent context_menu_event(mouse_event);
-      context_menu_event.SetType(WebInputEvent::kContextMenu);
+      context_menu_event.SetType(WebInputEvent::Type::kContextMenu);
       plugin()->HandleInputEvent(context_menu_event, &cursor);
     }
   }
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.h b/chromium/content/renderer/render_widget_fullscreen_pepper.h
index d8c82c0b647..8c5f31d55e0 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.h
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.h
@@ -71,13 +71,13 @@ class RenderWidgetFullscreenPepper : public RenderWidget,
   ~RenderWidgetFullscreenPepper() override;
 
   // RenderWidget API.
-  void DidInitiatePaint() override;
   void Close(std::unique_ptr<RenderWidget> widget) override;
   void AfterUpdateVisualProperties() override;
 
  private:
   friend class PepperExternalWidgetClient;
 
+  void DidInitiatePaint();
   void UpdateLayerBounds();
   void DidResize(const gfx::Size& size);
   blink::WebInputEventResult ProcessInputEvent(
diff --git a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
index ac4d4534c40..4e288565b9e 100644
--- a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
+++ b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.cc
@@ -25,35 +25,19 @@ void RenderWidgetMouseLockDispatcher::SendLockMouseRequest(
       requester_frame ? requester_frame->HasTransientUserActivation() : false;
   auto* host = render_widget_->GetInputHandlerHost();
   if (host) {
-    host->RequestMouseLock(has_transient_user_activation, /*privileged=*/false,
-                           request_unadjusted_movement,
-                           base::BindOnce(&MouseLockDispatcher::OnLockMouseACK,
-                                          this->AsWeakPtr()));
-  }
-}
-
-void RenderWidgetMouseLockDispatcher::SendChangeLockRequest(
-    blink::WebLocalFrame* requester_frame,
-    bool request_unadjusted_movement) {
-  auto* host = render_widget_->GetInputHandlerHost();
-  if (host) {
-    host->RequestMouseLockChange(
+    host->RequestMouseLock(
+        has_transient_user_activation, /*privileged=*/false,
         request_unadjusted_movement,
-        base::BindOnce(&MouseLockDispatcher::OnChangeLockAck,
-                       this->AsWeakPtr()));
+        base::BindOnce(&RenderWidgetMouseLockDispatcher::OnMouseLocked,
+                       weak_ptr_factory_.GetWeakPtr()));
   }
 }
 
-void RenderWidgetMouseLockDispatcher::SendUnlockMouseRequest() {
-  auto* host = render_widget_->GetInputHandlerHost();
-  if (host)
-    host->UnlockMouse();
-}
-
-void RenderWidgetMouseLockDispatcher::OnLockMouseACK(
-    blink::mojom::PointerLockResult result) {
+void RenderWidgetMouseLockDispatcher::OnMouseLocked(
+    blink::mojom::PointerLockResult result,
+    mojo::PendingRemote<blink::mojom::PointerLockContext> context) {
   // Notify the base class.
-  MouseLockDispatcher::OnLockMouseACK(result);
+  MouseLockDispatcher::OnLockMouseACK(result, std::move(context));
 
   // Mouse Lock removes the system cursor and provides all mouse motion as
   // .movementX/Y values on events all sent to a fixed target. This requires
diff --git a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
index 85d14a82ab9..c2f969f4caf 100644
--- a/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
+++ b/chromium/content/renderer/render_widget_mouse_lock_dispatcher.h
@@ -30,12 +30,9 @@ class RenderWidgetMouseLockDispatcher : public MouseLockDispatcher {
   void SendLockMouseRequest(blink::WebLocalFrame* requester_frame,
                             bool request_unadjusted_movement) override;
 
-  void SendChangeLockRequest(blink::WebLocalFrame* requester_frame,
-                             bool request_unadjusted_movement) override;
-
-  void SendUnlockMouseRequest() override;
-
-  void OnLockMouseACK(blink::mojom::PointerLockResult result);
+  void OnMouseLocked(
+      blink::mojom::PointerLockResult result,
+      mojo::PendingRemote<blink::mojom::PointerLockContext> context);
 
   RenderWidget* render_widget_;
 
diff --git a/chromium/content/renderer/render_widget_unittest.cc b/chromium/content/renderer/render_widget_unittest.cc
index f03bffc1780..4f520250ce7 100644
--- a/chromium/content/renderer/render_widget_unittest.cc
+++ b/chromium/content/renderer/render_widget_unittest.cc
@@ -5,6 +5,7 @@
 #include "content/renderer/render_widget.h"
 
 #include <tuple>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -21,25 +22,27 @@
 #include "cc/trees/layer_tree_host.h"
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
 #include "content/common/frame_replication_state.h"
-#include "content/common/input/input_handler.mojom.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/common/input_messages.h"
 #include "content/common/view_messages.h"
 #include "content/common/visual_properties.h"
 #include "content/common/widget_messages.h"
 #include "content/public/common/content_features.h"
+#include "content/public/test/fake_render_widget_host.h"
 #include "content/public/test/mock_render_thread.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
 #include "content/renderer/render_frame_proxy.h"
+#include "content/renderer/render_process.h"
 #include "content/renderer/render_widget_delegate.h"
 #include "content/renderer/render_widget_screen_metrics_emulator.h"
 #include "content/test/fake_compositor_dependencies.h"
-#include "content/test/mock_render_process.h"
 #include "ipc/ipc_test_sink.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/input/web_coalesced_input_event.h"
+#include "third_party/blink/public/mojom/page/widget.mojom-test-utils.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
 #include "third_party/blink/public/web/web_external_widget.h"
 #include "third_party/blink/public/web/web_external_widget_client.h"
@@ -49,17 +52,18 @@
 #include "third_party/blink/public/web/web_view.h"
 #include "third_party/blink/public/web/web_view_client.h"
 #include "ui/base/cursor/cursor.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
+#include "ui/base/cursor/mojom/cursor_type.mojom-shared.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/web_input_event_traits.h"
 #include "ui/gfx/geometry/rect.h"
 
 using testing::_;
 
-namespace ui {
+namespace blink {
+namespace mojom {
 
-bool operator==(const ui::DidOverscrollParams& lhs,
-                const ui::DidOverscrollParams& rhs) {
+bool operator==(const DidOverscrollParams& lhs,
+                const DidOverscrollParams& rhs) {
   return lhs.accumulated_overscroll == rhs.accumulated_overscroll &&
          lhs.latest_overscroll_delta == rhs.latest_overscroll_delta &&
          lhs.current_fling_velocity == rhs.current_fling_velocity &&
@@ -67,7 +71,8 @@ bool operator==(const ui::DidOverscrollParams& lhs,
          lhs.overscroll_behavior == rhs.overscroll_behavior;
 }
 
-}  // namespace ui
+}  // namespace mojom
+}  // namespace blink
 
 namespace cc {
 class AnimationHost;
@@ -95,18 +100,14 @@ enum {
 class MockWidgetInputHandlerHost : public mojom::WidgetInputHandlerHost {
  public:
   MockWidgetInputHandlerHost() {}
-#if defined(OS_ANDROID)
-  MOCK_METHOD4(FallbackCursorModeLockCursor, void(bool, bool, bool, bool));
-
-  MOCK_METHOD1(FallbackCursorModeSetCursorVisibility, void(bool));
-#endif
-
   MOCK_METHOD1(SetTouchActionFromMain, void(cc::TouchAction));
 
   MOCK_METHOD3(SetWhiteListedTouchAction,
-               void(cc::TouchAction, uint32_t, content::InputEventAckState));
+               void(cc::TouchAction,
+                    uint32_t,
+                    blink::mojom::InputEventResultState));
 
-  MOCK_METHOD1(DidOverscroll, void(const ui::DidOverscrollParams&));
+  MOCK_METHOD1(DidOverscroll, void(blink::mojom::DidOverscrollParamsPtr));
 
   MOCK_METHOD0(DidStopFlinging, void());
 
@@ -148,9 +149,9 @@ class MockHandledEventCallback {
  public:
   MockHandledEventCallback() = default;
   MOCK_METHOD4_T(Run,
-                 void(InputEventAckState,
+                 void(blink::mojom::InputEventResultState,
                       const ui::LatencyInfo&,
-                      std::unique_ptr<ui::DidOverscrollParams>&,
+                      blink::mojom::DidOverscrollParams* overscroll,
                       base::Optional<cc::TouchAction>));
 
   HandledEventCallback GetCallback() {
@@ -159,11 +160,11 @@ class MockHandledEventCallback {
   }
 
  private:
-  void HandleCallback(InputEventAckState ack_state,
+  void HandleCallback(blink::mojom::InputEventResultState ack_state,
                       const ui::LatencyInfo& latency_info,
-                      std::unique_ptr<ui::DidOverscrollParams> overscroll,
+                      blink::mojom::DidOverscrollParamsPtr overscroll,
                       base::Optional<cc::TouchAction> touch_action) {
-    Run(ack_state, latency_info, overscroll, touch_action);
+    Run(ack_state, latency_info, overscroll.get(), touch_action);
   }
 
   DISALLOW_COPY_AND_ASSIGN(MockHandledEventCallback);
@@ -179,6 +180,8 @@ class MockWebExternalWidgetClient : public blink::WebExternalWidgetClient {
   MOCK_METHOD1(
       HandleInputEvent,
       blink::WebInputEventResult(const blink::WebCoalescedInputEvent&));
+  MOCK_METHOD1(RequestNewLayerTreeFrameSink, void(LayerTreeFrameSinkCallback));
+  MOCK_METHOD0(DidCommitAndDrawCompositorFrame, void());
 };
 
 }  // namespace
@@ -188,7 +191,6 @@ class InteractiveRenderWidget : public RenderWidget {
   explicit InteractiveRenderWidget(CompositorDependencies* compositor_deps)
       : RenderWidget(++next_routing_id_,
                      compositor_deps,
-                     blink::mojom::DisplayMode::kUndefined,
                      /*is_hidden=*/false,
                      /*never_composited=*/false,
                      mojo::NullReceiver()) {}
@@ -207,16 +209,21 @@ class InteractiveRenderWidget : public RenderWidget {
 
   void SendInputEvent(const blink::WebInputEvent& event,
                       HandledEventCallback callback) {
-    HandleInputEvent(blink::WebCoalescedInputEvent(
-                         event, std::vector<const blink::WebInputEvent*>(),
-                         std::vector<const blink::WebInputEvent*>()),
-                     ui::LatencyInfo(), std::move(callback));
+    HandleInputEvent(
+        blink::WebCoalescedInputEvent(event.Clone(), {}, {}, ui::LatencyInfo()),
+        std::move(callback));
   }
 
   void set_always_overscroll(bool overscroll) {
     always_overscroll_ = overscroll;
   }
 
+  MOCK_METHOD4(ObserveGestureEventAndResult,
+               void(const blink::WebGestureEvent& gesture_event,
+                    const gfx::Vector2dF& unused_delta,
+                    const cc::OverscrollBehavior& overscroll_behavior,
+                    bool event_processed));
+
   IPC::TestSink* sink() { return &sink_; }
 
   MockWidgetInputHandlerHost* mock_input_handler_host() {
@@ -232,7 +239,7 @@ class InteractiveRenderWidget : public RenderWidget {
   // Overridden from RenderWidget:
   bool WillHandleGestureEvent(const blink::WebGestureEvent& event) override {
     if (always_overscroll_ &&
-        event.GetType() == blink::WebInputEvent::kGestureScrollUpdate) {
+        event.GetType() == blink::WebInputEvent::Type::kGestureScrollUpdate) {
       DidOverscroll(gfx::Vector2dF(event.data.scroll_update.delta_x,
                                    event.data.scroll_update.delta_y),
                     gfx::Vector2dF(event.data.scroll_update.delta_x,
@@ -269,10 +276,11 @@ class RenderWidgetUnittest : public testing::Test {
     web_view_ = blink::WebView::Create(/*client=*/&web_view_client_,
                                        /*is_hidden=*/false,
                                        /*compositing_enabled=*/true, nullptr,
-                                       mojo::ScopedInterfaceEndpointHandle());
+                                       mojo::NullAssociatedReceiver());
     widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
     web_local_frame_ = blink::WebLocalFrame::CreateMainFrame(
-        web_view_, &web_frame_client_, nullptr, nullptr);
+        web_view_, &web_frame_client_, nullptr,
+        base::UnguessableToken::Create(), nullptr);
     web_frame_widget_ = blink::WebFrameWidget::CreateForMainFrame(
         widget_.get(), web_local_frame_,
         blink::CrossVariantMojoAssociatedRemote<
@@ -313,7 +321,7 @@ class RenderWidgetUnittest : public testing::Test {
 
  private:
   base::test::TaskEnvironment task_environment_;
-  MockRenderProcess render_process_;
+  RenderProcess render_process_;
   MockRenderThread render_thread_;
   blink::WebViewClient web_view_client_;
   blink::WebView* web_view_;
@@ -328,12 +336,13 @@ class RenderWidgetUnittest : public testing::Test {
 class RenderWidgetExternalWidgetUnittest : public testing::Test {
  public:
   void SetUp() override {
+    mojo::PendingAssociatedRemote<blink::mojom::WidgetHost> widget_host_remote;
+    mojo::PendingAssociatedReceiver<blink::mojom::Widget> widget_receiver;
+    std::tie(widget_host_remote, widget_receiver) =
+        render_widget_host_.BindNewWidgetInterfaces();
     external_web_widget_ = blink::WebExternalWidget::Create(
         &mock_web_external_widget_client_, blink::WebURL(),
-        blink::CrossVariantMojoAssociatedRemote<
-            blink::mojom::WidgetHostInterfaceBase>(),
-        blink::CrossVariantMojoAssociatedReceiver<
-            blink::mojom::WidgetInterfaceBase>());
+        std::move(widget_host_remote), std::move(widget_receiver));
 
     widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
     widget_->Init(external_web_widget_.get(), ScreenInfo());
@@ -358,6 +367,8 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
     return external_web_widget_.get();
   }
 
+  FakeRenderWidgetHost* render_widget_host() { return &render_widget_host_; }
+
   const base::HistogramTester& histogram_tester() const {
     return histogram_tester_;
   }
@@ -368,8 +379,9 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
 
  private:
   base::test::TaskEnvironment task_environment_;
-  MockRenderProcess render_process_;
+  RenderProcess render_process_;
   MockRenderThread render_thread_;
+  FakeRenderWidgetHost render_widget_host_;
   FakeCompositorDependencies compositor_deps_;
   MockWebExternalWidgetClient mock_web_external_widget_client_;
   std::unique_ptr<blink::WebExternalWidget> external_web_widget_;
@@ -377,29 +389,51 @@ class RenderWidgetExternalWidgetUnittest : public testing::Test {
   base::HistogramTester histogram_tester_;
 };
 
+class SetCursorInterceptor
+    : public blink::mojom::WidgetHostInterceptorForTesting {
+ public:
+  explicit SetCursorInterceptor(FakeRenderWidgetHost* render_widget_host)
+      : render_widget_host_(render_widget_host) {
+    render_widget_host_->widget_host_receiver_for_testing().SwapImplForTesting(
+        this);
+  }
+  ~SetCursorInterceptor() override = default;
+
+  WidgetHost* GetForwardingInterface() override { return render_widget_host_; }
+
+  void SetCursor(const ui::Cursor& cursor) override { set_cursor_count_++; }
+
+  int set_cursor_count() { return set_cursor_count_; }
+
+ private:
+  FakeRenderWidgetHost* render_widget_host_;
+  int set_cursor_count_ = 0;
+};
+
 TEST_F(RenderWidgetExternalWidgetUnittest, CursorChange) {
   ui::Cursor cursor;
 
+  auto set_cursor_interceptor =
+      std::make_unique<SetCursorInterceptor>(render_widget_host());
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 1U);
-  EXPECT_EQ(widget()->sink()->GetMessageAt(0)->type(),
-            WidgetHostMsg_SetCursor::ID);
-  widget()->sink()->ClearMessages();
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 0U);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
       .WillOnce(::testing::Return(blink::WebInputEventResult::kNotHandled));
   widget()->SendInputEvent(SyntheticWebMouseEventBuilder::Build(
                                blink::WebInputEvent::Type::kMouseLeave),
                            HandledEventCallback());
-  EXPECT_EQ(widget()->sink()->message_count(), 0U);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 1);
 
   widget()->DidChangeCursor(cursor);
-  EXPECT_EQ(widget()->sink()->message_count(), 1U);
-  EXPECT_EQ(widget()->sink()->GetMessageAt(0)->type(),
-            WidgetHostMsg_SetCursor::ID);
+  render_widget_host()->widget_host_receiver_for_testing().FlushForTesting();
+  EXPECT_EQ(set_cursor_interceptor->set_cursor_count(), 2);
 }
 
 TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
@@ -409,14 +443,14 @@ TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
       .WillRepeatedly(
           ::testing::Return(blink::WebInputEventResult::kNotHandled));
 
-  blink::WebGestureEvent scroll(blink::WebInputEvent::kGestureScrollUpdate,
-                                blink::WebInputEvent::kNoModifiers,
-                                ui::EventTimeForNow());
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
   scroll.SetPositionInWidget(gfx::PointF(-10, 0));
   scroll.data.scroll_update.delta_y = 10;
   MockHandledEventCallback handled_event;
 
-  ui::DidOverscrollParams expected_overscroll;
+  blink::mojom::DidOverscrollParams expected_overscroll;
   expected_overscroll.latest_overscroll_delta = gfx::Vector2dF(0, 10);
   expected_overscroll.accumulated_overscroll = gfx::Vector2dF(0, 10);
   expected_overscroll.causal_event_viewport_point = gfx::PointF(-10, 0);
@@ -424,8 +458,8 @@ TEST_F(RenderWidgetExternalWidgetUnittest, EventOverscroll) {
 
   // Overscroll notifications received while handling an input event should
   // be bundled with the event ack IPC.
-  EXPECT_CALL(handled_event, Run(INPUT_EVENT_ACK_STATE_CONSUMED, _,
-                                 testing::Pointee(expected_overscroll), _))
+  EXPECT_CALL(handled_event, Run(blink::mojom::InputEventResultState::kConsumed,
+                                 _, testing::Pointee(expected_overscroll), _))
       .Times(1);
 
   widget()->SendInputEvent(scroll, handled_event.GetCallback());
@@ -500,6 +534,47 @@ TEST_F(RenderWidgetExternalWidgetUnittest, RenderWidgetInputEventUmaMetrics) {
       PASSIVE_LISTENER_UMA_ENUM_CANCELABLE_AND_CANCELED, 1);
 }
 
+// Ensures that the compositor thread gets sent the gesture event & overscroll
+// amount for an overscroll initiated by a touchpad.
+TEST_F(RenderWidgetExternalWidgetUnittest, SendElasticOverscrollForTouchpad) {
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow(),
+      blink::WebGestureDevice::kTouchpad);
+  scroll.SetPositionInWidget(gfx::PointF(-10, 0));
+  scroll.data.scroll_update.delta_y = 10;
+
+  // We only really care that ObserveGestureEventAndResult was called; we
+  // therefore suppress the warning for the call to
+  // mock_webwidget()->HandleInputEvent().
+  EXPECT_CALL(*widget(), ObserveGestureEventAndResult(_, _, _, _)).Times(1);
+  EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
+      .Times(testing::AnyNumber());
+
+  widget()->SendInputEvent(scroll, HandledEventCallback());
+}
+
+// Ensures that the compositor thread gets sent the gesture event & overscroll
+// amount for an overscroll initiated by a touchscreen.
+TEST_F(RenderWidgetExternalWidgetUnittest,
+       SendElasticOverscrollForTouchscreen) {
+  blink::WebGestureEvent scroll(
+      blink::WebInputEvent::Type::kGestureScrollUpdate,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow(),
+      blink::WebGestureDevice::kTouchscreen);
+  scroll.SetPositionInWidget(gfx::PointF(-10, 0));
+  scroll.data.scroll_update.delta_y = 10;
+
+  // We only really care that ObserveGestureEventAndResult was called; we
+  // therefore suppress the warning for the call to
+  // mock_webwidget()->HandleInputEvent().
+  EXPECT_CALL(*widget(), ObserveGestureEventAndResult(_, _, _, _)).Times(1);
+  EXPECT_CALL(*mock_web_external_widget_client(), HandleInputEvent(_))
+      .Times(testing::AnyNumber());
+
+  widget()->SendInputEvent(scroll, HandledEventCallback());
+}
+
 // Tests that if a RenderWidget is auto-resized, it requests a new
 // viz::LocalSurfaceId to be allocated on the impl thread.
 TEST_F(RenderWidgetUnittest, AutoResizeAllocatedLocalSurfaceId) {
@@ -538,8 +613,6 @@ class StubRenderWidgetDelegate : public RenderWidgetDelegate {
   void SetActiveForWidget(bool active) override {}
   bool SupportsMultipleWindowsForWidget() override { return true; }
   bool ShouldAckSyntheticInputImmediately() override { return true; }
-  void ApplyNewDisplayModeForWidget(
-      blink::mojom::DisplayMode new_display_mode) override {}
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override {}
   void DisableAutoResizeForWidget() override {}
diff --git a/chromium/content/renderer/renderer_blink_platform_impl.cc b/chromium/content/renderer/renderer_blink_platform_impl.cc
index 8c641e6e3a6..9b6fb9c13ed 100644
--- a/chromium/content/renderer/renderer_blink_platform_impl.cc
+++ b/chromium/content/renderer/renderer_blink_platform_impl.cc
@@ -36,7 +36,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/gpu_stream_constants.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/common/webplugininfo.h"
 #include "content/public/renderer/content_renderer_client.h"
@@ -815,7 +814,7 @@ RendererBlinkPlatformImpl::CreateWebGPUGraphicsContext3DProvider(
 
   constexpr bool automatic_flushes = true;
   constexpr bool support_locking = false;
-  constexpr bool support_grcontext = false;
+  constexpr bool support_grcontext = true;
 
   scoped_refptr<viz::ContextProviderCommandBuffer> provider(
       new viz::ContextProviderCommandBuffer(
diff --git a/chromium/content/renderer/renderer_main.cc b/chromium/content/renderer/renderer_main.cc
index 222cc589473..0c7dd6cecc0 100644
--- a/chromium/content/renderer/renderer_main.cc
+++ b/chromium/content/renderer/renderer_main.cc
@@ -24,7 +24,6 @@
 #include "build/build_config.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/content_switches_internal.h"
-#include "content/common/service_manager/service_manager_connection_impl.h"
 #include "content/common/skia_utils.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
@@ -37,8 +36,8 @@
 #include "mojo/public/cpp/bindings/mojo_buildflags.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/service_manager/sandbox/switches.h"
-#include "services/tracing/public/cpp/stack_sampling/tracing_sampler_profiler.h"
 #include "services/tracing/public/cpp/trace_startup.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/webrtc_overrides/init_webrtc.h"  // nogncheck
 #include "ui/base/ui_base_switches.h"
@@ -57,6 +56,10 @@
 #include "third_party/blink/public/web/web_view.h"
 #endif  // OS_MACOSX
 
+#if defined(OS_CHROMEOS)
+#include "chromeos/system/core_scheduling.h"
+#endif  // OS_CHROMEOS
+
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/renderer/pepper/pepper_plugin_registry.h"
 #endif
@@ -121,6 +124,10 @@ int RendererMain(const MainFunctionParams& parameters) {
         command_line.GetSwitchValueASCII(switches::kLang);
     base::i18n::SetICUDefaultLocale(locale);
   }
+
+  // When we start the renderer on ChromeOS if the system has core scheduling
+  // available we want to turn it on.
+  chromeos::system::EnableCoreSchedulingIfAvailable();
 #endif
 
   InitializeSkia();
@@ -154,6 +161,7 @@ int RendererMain(const MainFunctionParams& parameters) {
     }
   }
 
+  blink::Platform::InitializeBlink();
   std::unique_ptr<blink::scheduler::WebThreadScheduler> main_thread_scheduler =
       blink::scheduler::WebThreadScheduler::CreateMainThreadScheduler(
           CreateMainThreadMessagePump(), initial_virtual_time);
@@ -204,10 +212,6 @@ int RendererMain(const MainFunctionParams& parameters) {
     }
 #endif  // OS_POSIX && !OS_ANDROID && !!OS_MACOSX
 
-    // Setup tracing sampler profiler as early as possible.
-    auto tracing_sampler_profiler =
-        tracing::TracingSamplerProfiler::CreateOnMainThread();
-
     if (need_sandbox)
       should_run_loop = platform.EnableSandbox();
 
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_linux.cc b/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
index 43ea0af7278..ca87fed75a0 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
+++ b/chromium/content/renderer/renderer_main_platform_delegate_linux.cc
@@ -7,9 +7,9 @@
 #include <errno.h>
 #include <sys/stat.h>
 
+#include "base/check_op.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
-#include "base/logging.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_init.h"
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_mac.mm b/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
index e59ac93d0e1..28ca1646af0 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
+++ b/chromium/content/renderer/renderer_main_platform_delegate_mac.mm
@@ -6,7 +6,7 @@
 
 #import <Cocoa/Cocoa.h>
 
-#include "base/logging.h"
+#include "base/check_op.h"
 #include "sandbox/mac/seatbelt.h"
 #include "sandbox/mac/system_services.h"
 
diff --git a/chromium/content/renderer/renderer_main_platform_delegate_win.cc b/chromium/content/renderer/renderer_main_platform_delegate_win.cc
index f59a53dbc38..fa4440117e3 100644
--- a/chromium/content/renderer/renderer_main_platform_delegate_win.cc
+++ b/chromium/content/renderer/renderer_main_platform_delegate_win.cc
@@ -9,7 +9,6 @@
 #include <memory>
 
 #include "base/command_line.h"
-#include "base/logging.h"
 #include "base/strings/string16.h"
 #include "base/win/win_util.h"
 #include "base/win/windows_version.h"
diff --git a/chromium/content/renderer/savable_resources.cc b/chromium/content/renderer/savable_resources.cc
index 79cf744b86c..c6515bc5550 100644
--- a/chromium/content/renderer/savable_resources.cc
+++ b/chromium/content/renderer/savable_resources.cc
@@ -7,7 +7,6 @@
 #include <set>
 
 #include "base/compiler_specific.h"
-#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "content/public/common/url_utils.h"
 #include "content/renderer/render_frame_impl.h"
diff --git a/chromium/content/renderer/savable_resources_browsertest.cc b/chromium/content/renderer/savable_resources_browsertest.cc
index ceade9d4c24..c8638aae2c7 100644
--- a/chromium/content/renderer/savable_resources_browsertest.cc
+++ b/chromium/content/renderer/savable_resources_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_frame.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/renderer/savable_resources.h"
diff --git a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
index f480ec6d127..1e7bb540976 100644
--- a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
+++ b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
@@ -50,7 +50,7 @@ class CONTENT_EXPORT EmbeddedWorkerInstanceClientImpl
           receiver);
 
   // TODO(https://crbug.com/955171): Remove this method and use Create once
-  // RenderFrameHostImpl uses service_manager::BinderMap instead of
+  // RenderFrameHostImpl uses mojo::BinderMap instead of
   // service_manager::BinderRegistry.
   static void CreateForRequest(
       scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner,
diff --git a/chromium/content/renderer/service_worker/service_worker_context_client.cc b/chromium/content/renderer/service_worker/service_worker_context_client.cc
index bb8048c87ba..a6f1f799c44 100644
--- a/chromium/content/renderer/service_worker/service_worker_context_client.cc
+++ b/chromium/content/renderer/service_worker/service_worker_context_client.cc
@@ -11,9 +11,9 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/check_op.h"
 #include "base/debug/alias.h"
 #include "base/feature_list.h"
-#include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
index d2767d68f40..59b2ded1431 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
@@ -705,6 +705,7 @@ void ServiceWorkerSubresourceLoader::RecordTimingMetrics(bool handled) {
 void ServiceWorkerSubresourceLoader::FollowRedirect(
     const std::vector<std::string>& removed_headers,
     const net::HttpRequestHeaders& modified_headers,
+    const net::HttpRequestHeaders& modified_cors_exempt_headers,
     const base::Optional<GURL>& new_url) {
   TRACE_EVENT_WITH_FLOW1(
       "ServiceWorker", "ServiceWorkerSubresourceLoader::FollowRedirect",
@@ -715,8 +716,8 @@ void ServiceWorkerSubresourceLoader::FollowRedirect(
   // TODO(arthursonzogni, juncai): This seems to be correctly implemented, but
   // not used so far. Add tests and remove this DCHECK to support this feature
   // if needed. See https://crbug.com/845683.
-  DCHECK(removed_headers.empty() && modified_headers.IsEmpty())
-      << "Redirect with removed or modified headers is not supported yet. See "
+  DCHECK(modified_headers.IsEmpty() && modified_cors_exempt_headers.IsEmpty())
+      << "Redirect with modified headers is not supported yet. See "
          "https://crbug.com/845683";
   DCHECK(!new_url.has_value()) << "Redirect with modified url was not "
                                   "supported yet. crbug.com/845683";
@@ -727,6 +728,10 @@ void ServiceWorkerSubresourceLoader::FollowRedirect(
       resource_request_.url, resource_request_.method, *redirect_info_,
       removed_headers, modified_headers, &resource_request_.headers,
       &should_clear_upload);
+  resource_request_.cors_exempt_headers.MergeFrom(modified_cors_exempt_headers);
+  for (const std::string& name : removed_headers)
+    resource_request_.cors_exempt_headers.RemoveHeader(name);
+
   if (should_clear_upload)
     resource_request_.request_body = nullptr;
 
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
index e31a69369ad..0dfce4ed99d 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
@@ -113,9 +113,11 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
                      blink::mojom::ServiceWorkerStreamHandlePtr body_as_stream);
 
   // network::mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
+  void FollowRedirect(
+      const std::vector<std::string>& removed_headers,
+      const net::HttpRequestHeaders& modified_headers,
+      const net::HttpRequestHeaders& modified_cors_exempt_headers,
+      const base::Optional<GURL>& new_url) override;
   void SetPriority(net::RequestPriority priority,
                    int intra_priority_value) override;
   void PauseReadingBodyFromNet() override;
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
index 5bf2b2951b8..2d4094787b7 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
@@ -1247,7 +1247,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RedirectResponse) {
 
   // Redirect once more.
   fake_controller_.RespondWithRedirect("https://other.example.com/baz.png");
-  loader->FollowRedirect({}, {}, base::nullopt);
+  loader->FollowRedirect({}, {}, {}, base::nullopt);
   client->RunUntilRedirectReceived();
 
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -1267,7 +1267,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RedirectResponse) {
   fake_controller_.RespondWithStream(
       stream_callback.BindNewPipeAndPassReceiver(),
       std::move(data_pipe.consumer_handle));
-  loader->FollowRedirect({}, {}, base::nullopt);
+  loader->FollowRedirect({}, {}, {}, base::nullopt);
   client->RunUntilResponseReceived();
 
   auto& info = client->response_head();
@@ -1337,7 +1337,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, TooManyRedirects) {
     redirect_location = std::string("https://www.example.com/redirect_") +
                         base::NumberToString(count);
     fake_controller_.RespondWithRedirect(redirect_location);
-    loader->FollowRedirect({}, {}, base::nullopt);
+    loader->FollowRedirect({}, {}, {}, base::nullopt);
   }
   client->RunUntilComplete();
 
diff --git a/chromium/content/renderer/service_worker/service_worker_type_converters.cc b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
index 418a442a632..a8804a4a1a9 100644
--- a/chromium/content/renderer/service_worker/service_worker_type_converters.cc
+++ b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
@@ -4,7 +4,8 @@
 
 #include "content/renderer/service_worker/service_worker_type_converters.h"
 
-#include "base/logging.h"
+#include <utility>
+
 #include "mojo/public/cpp/bindings/associated_interface_ptr_info.h"
 #include "mojo/public/cpp/bindings/associated_interface_request.h"
 
@@ -13,29 +14,27 @@ namespace mojo {
 blink::WebServiceWorkerObjectInfo
 TypeConverter<blink::WebServiceWorkerObjectInfo,
               blink::mojom::ServiceWorkerObjectInfoPtr>::
-    Convert(const blink::mojom::ServiceWorkerObjectInfoPtr& input) {
+    Convert(blink::mojom::ServiceWorkerObjectInfoPtr input) {
   if (!input) {
     return blink::WebServiceWorkerObjectInfo(
         blink::mojom::kInvalidServiceWorkerVersionId,
         blink::mojom::ServiceWorkerState::kParsed, blink::WebURL(),
-        mojo::ScopedInterfaceEndpointHandle() /* host_remote */,
-        mojo::ScopedInterfaceEndpointHandle() /* receiver */);
+        {} /* host_remote */, {} /* receiver */);
   }
   return blink::WebServiceWorkerObjectInfo(
       input->version_id, input->state, input->url,
-      input->host_remote.PassHandle(), input->receiver.PassHandle());
+      std::move(input->host_remote), std::move(input->receiver));
 }
 
 blink::WebServiceWorkerRegistrationObjectInfo
 TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
               blink::mojom::ServiceWorkerRegistrationObjectInfoPtr>::
-    Convert(const blink::mojom::ServiceWorkerRegistrationObjectInfoPtr& input) {
+    Convert(blink::mojom::ServiceWorkerRegistrationObjectInfoPtr input) {
   if (!input) {
     return blink::WebServiceWorkerRegistrationObjectInfo(
         blink::mojom::kInvalidServiceWorkerRegistrationId, blink::WebURL(),
         blink::mojom::ServiceWorkerUpdateViaCache::kImports,
-        mojo::ScopedInterfaceEndpointHandle() /* host_remote */,
-        mojo::ScopedInterfaceEndpointHandle() /* receiver */,
+        {} /* host_remote */, {} /* receiver */,
         blink::mojom::ServiceWorkerObjectInfoPtr()
             .To<blink::WebServiceWorkerObjectInfo>() /* installing */,
         blink::mojom::ServiceWorkerObjectInfoPtr()
@@ -45,10 +44,10 @@ TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
   }
   return blink::WebServiceWorkerRegistrationObjectInfo(
       input->registration_id, input->scope, input->update_via_cache,
-      input->host_remote.PassHandle(), input->receiver.PassHandle(),
-      input->installing.To<blink::WebServiceWorkerObjectInfo>(),
-      input->waiting.To<blink::WebServiceWorkerObjectInfo>(),
-      input->active.To<blink::WebServiceWorkerObjectInfo>());
+      std::move(input->host_remote), std::move(input->receiver),
+      std::move(input->installing).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(input->waiting).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(input->active).To<blink::WebServiceWorkerObjectInfo>());
 }
 
 }  // namespace mojo
diff --git a/chromium/content/renderer/service_worker/service_worker_type_converters.h b/chromium/content/renderer/service_worker/service_worker_type_converters.h
index d49816207a2..55354081fdf 100644
--- a/chromium/content/renderer/service_worker/service_worker_type_converters.h
+++ b/chromium/content/renderer/service_worker/service_worker_type_converters.h
@@ -21,14 +21,14 @@ template <>
 struct TypeConverter<blink::WebServiceWorkerObjectInfo,
                      blink::mojom::ServiceWorkerObjectInfoPtr> {
   static blink::WebServiceWorkerObjectInfo Convert(
-      const blink::mojom::ServiceWorkerObjectInfoPtr& input);
+      blink::mojom::ServiceWorkerObjectInfoPtr input);
 };
 
 template <>
 struct TypeConverter<blink::WebServiceWorkerRegistrationObjectInfo,
                      blink::mojom::ServiceWorkerRegistrationObjectInfoPtr> {
   static blink::WebServiceWorkerRegistrationObjectInfo Convert(
-      const blink::mojom::ServiceWorkerRegistrationObjectInfoPtr& input);
+      blink::mojom::ServiceWorkerRegistrationObjectInfoPtr input);
 };
 
 }  // namespace
diff --git a/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc b/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
index c62ec2e5cb1..b1f3087729c 100644
--- a/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
+++ b/chromium/content/renderer/service_worker/web_service_worker_provider_impl.cc
@@ -192,7 +192,7 @@ void WebServiceWorkerProviderImpl::SetController(
   for (blink::mojom::WebFeature feature : features)
     provider_client_->CountFeature(feature);
   provider_client_->SetController(
-      controller.To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(controller).To<blink::WebServiceWorkerObjectInfo>(),
       should_notify_controller_change);
 }
 
@@ -203,7 +203,8 @@ void WebServiceWorkerProviderImpl::PostMessageToClient(
     return;
 
   provider_client_->ReceiveMessage(
-      source.To<blink::WebServiceWorkerObjectInfo>(), std::move(message));
+      std::move(source).To<blink::WebServiceWorkerObjectInfo>(),
+      std::move(message));
 }
 
 void WebServiceWorkerProviderImpl::CountFeature(
@@ -235,7 +236,8 @@ void WebServiceWorkerProviderImpl::OnRegistered(
   DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
             registration->registration_id);
   callbacks->OnSuccess(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 void WebServiceWorkerProviderImpl::OnDidGetRegistration(
@@ -262,7 +264,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistration(
          registration->registration_id !=
              blink::mojom::kInvalidServiceWorkerRegistrationId);
   callbacks->OnSuccess(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 void WebServiceWorkerProviderImpl::OnDidGetRegistrations(
@@ -292,7 +295,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistrations(
     DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
               (*infos)[i]->registration_id);
     registrations.emplace_back(
-        (*infos)[i].To<blink::WebServiceWorkerRegistrationObjectInfo>());
+        std::move((*infos)[i])
+            .To<blink::WebServiceWorkerRegistrationObjectInfo>());
   }
   callbacks->OnSuccess(std::move(registrations));
 }
@@ -316,7 +320,8 @@ void WebServiceWorkerProviderImpl::OnDidGetRegistrationForReady(
   DCHECK_NE(blink::mojom::kInvalidServiceWorkerRegistrationId,
             registration->registration_id);
   std::move(callback).Run(
-      registration.To<blink::WebServiceWorkerRegistrationObjectInfo>());
+      std::move(registration)
+          .To<blink::WebServiceWorkerRegistrationObjectInfo>());
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/stream_texture_host_android.cc b/chromium/content/renderer/stream_texture_host_android.cc
index 749ebcc8ef3..f56e4bf36a3 100644
--- a/chromium/content/renderer/stream_texture_host_android.cc
+++ b/chromium/content/renderer/stream_texture_host_android.cc
@@ -48,8 +48,8 @@ bool StreamTextureHost::BindToCurrentThread(Listener* listener) {
 bool StreamTextureHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(StreamTextureHost, message)
-    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameWithYcbcrInfoAvailable,
-                        OnFrameWithYcbcrInfoAvailable);
+    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameWithInfoAvailable,
+                        OnFrameWithInfoAvailable);
     IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameAvailable, OnFrameAvailable);
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -61,10 +61,14 @@ void StreamTextureHost::OnChannelError() {
   channel_ = nullptr;
 }
 
-void StreamTextureHost::OnFrameWithYcbcrInfoAvailable(
-    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+void StreamTextureHost::OnFrameWithInfoAvailable(
+    const gpu::Mailbox& mailbox,
+    const gfx::Size& coded_size,
+    const gfx::Rect& visible_rect,
+    const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) {
   if (listener_)
-    listener_->OnFrameWithYcbcrInfoAvailable(std::move(ycbcr_info));
+    listener_->OnFrameWithInfoAvailable(mailbox, coded_size, visible_rect,
+                                        ycbcr_info);
 }
 
 void StreamTextureHost::OnFrameAvailable() {
@@ -80,14 +84,11 @@ void StreamTextureHost::ForwardStreamTextureForSurfaceRequest(
   }
 }
 
-gpu::Mailbox StreamTextureHost::CreateSharedImage(const gfx::Size& size) {
-  if (!channel_)
-    return gpu::Mailbox();
-
-  auto mailbox = gpu::Mailbox::GenerateForSharedImage();
-  channel_->EnqueueDeferredMessage(GpuStreamTextureMsg_CreateSharedImage(
-      route_id_, mailbox, size, ++release_id_));
-  return mailbox;
+void StreamTextureHost::UpdateRotatedVisibleSize(const gfx::Size& size) {
+  if (channel_) {
+    channel_->Send(
+        new GpuStreamTextureMsg_UpdateRotatedVisibleSize(route_id_, size));
+  }
 }
 
 gpu::SyncToken StreamTextureHost::GenUnverifiedSyncToken() {
diff --git a/chromium/content/renderer/stream_texture_host_android.h b/chromium/content/renderer/stream_texture_host_android.h
index 7ccd0f60097..0510125b73c 100644
--- a/chromium/content/renderer/stream_texture_host_android.h
+++ b/chromium/content/renderer/stream_texture_host_android.h
@@ -18,6 +18,7 @@ class UnguessableToken;
 }
 
 namespace gfx {
+class Rect;
 class Size;
 }
 
@@ -43,8 +44,11 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
   class Listener {
    public:
     virtual void OnFrameAvailable() = 0;
-    virtual void OnFrameWithYcbcrInfoAvailable(
-        base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) = 0;
+    virtual void OnFrameWithInfoAvailable(
+        const gpu::Mailbox& mailbox,
+        const gfx::Size& coded_size,
+        const gfx::Rect& visible_rect,
+        const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info) = 0;
     virtual ~Listener() {}
   };
 
@@ -56,14 +60,17 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
 
   void ForwardStreamTextureForSurfaceRequest(
       const base::UnguessableToken& request_token);
-  gpu::Mailbox CreateSharedImage(const gfx::Size& size);
+  void UpdateRotatedVisibleSize(const gfx::Size& size);
   gpu::SyncToken GenUnverifiedSyncToken();
 
  private:
   // Message handlers:
   void OnFrameAvailable();
-  void OnFrameWithYcbcrInfoAvailable(
-      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
+  void OnFrameWithInfoAvailable(
+      const gpu::Mailbox& mailbox,
+      const gfx::Size& coded_size,
+      const gfx::Rect& visible_rect,
+      const base::Optional<gpu::VulkanYCbCrInfo>& ycbcr_info);
 
   int32_t route_id_;
   Listener* listener_;
diff --git a/chromium/content/renderer/text_input_client_observer.cc b/chromium/content/renderer/text_input_client_observer.cc
index 1beba3805fe..e0129cefaf3 100644
--- a/chromium/content/renderer/text_input_client_observer.cc
+++ b/chromium/content/renderer/text_input_client_observer.cc
@@ -8,7 +8,6 @@
 
 #include <memory>
 
-#include "build/build_config.h"
 #include "content/common/text_input_client_messages.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/renderer/pepper/pepper_plugin_instance_impl.h"
@@ -16,24 +15,13 @@
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
 #include "ipc/ipc_message.h"
-#include "ppapi/buildflags/buildflags.h"
-#include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/mac/web_substring_util.h"
 #include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_view.h"
-#include "ui/gfx/geometry/rect.h"
 
 namespace content {
 
-namespace {
-uint32_t GetCurrentCursorPositionInFrame(blink::WebLocalFrame* local_frame) {
-  blink::WebRange range = local_frame->SelectionRange();
-  return range.IsNull() ? 0U : static_cast<uint32_t>(range.StartOffset());
-}
-}
-
 TextInputClientObserver::TextInputClientObserver(RenderWidget* render_widget)
     : render_widget_(render_widget) {}
 
@@ -44,10 +32,6 @@ bool TextInputClientObserver::OnMessageReceived(const IPC::Message& message) {
   IPC_BEGIN_MESSAGE_MAP(TextInputClientObserver, message)
     IPC_MESSAGE_HANDLER(TextInputClientMsg_StringAtPoint,
                         OnStringAtPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientMsg_CharacterIndexForPoint,
-                        OnCharacterIndexForPoint)
-    IPC_MESSAGE_HANDLER(TextInputClientMsg_FirstRectForCharacterRange,
-                        OnFirstRectForCharacterRange)
     IPC_MESSAGE_HANDLER(TextInputClientMsg_StringForRange, OnStringForRange)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -74,16 +58,6 @@ blink::WebLocalFrame* TextInputClientObserver::GetFocusedFrame() const {
   return nullptr;
 }
 
-#if BUILDFLAG(ENABLE_PLUGINS)
-PepperPluginInstanceImpl* TextInputClientObserver::GetFocusedPepperPlugin()
-    const {
-  blink::WebLocalFrame* frame = GetFocusedFrame();
-  if (!frame)
-    return nullptr;
-  return RenderFrameImpl::FromWebFrame(frame)->focused_pepper_plugin();
-}
-#endif
-
 void TextInputClientObserver::OnStringAtPoint(gfx::Point point) {
   gfx::Point baseline_point;
   NSAttributedString* string = nil;
@@ -99,41 +73,6 @@ void TextInputClientObserver::OnStringAtPoint(gfx::Point point) {
       MSG_ROUTING_NONE, *encoded.get(), baseline_point));
 }
 
-void TextInputClientObserver::OnCharacterIndexForPoint(gfx::Point point) {
-  uint32_t index = 0U;
-  if (auto* frame = GetFocusedFrame())
-    index = static_cast<uint32_t>(frame->CharacterIndexForPoint(point));
-
-  Send(new TextInputClientReplyMsg_GotCharacterIndexForPoint(MSG_ROUTING_NONE,
-                                                             index));
-}
-
-void TextInputClientObserver::OnFirstRectForCharacterRange(gfx::Range range) {
-  gfx::Rect rect;
-#if BUILDFLAG(ENABLE_PLUGINS)
-  PepperPluginInstanceImpl* focused_plugin = GetFocusedPepperPlugin();
-  if (focused_plugin) {
-    rect = focused_plugin->GetCaretBounds();
-  } else
-#endif
-  {
-    blink::WebLocalFrame* frame = GetFocusedFrame();
-    // TODO(yabinh): Null check should not be necessary.
-    // See crbug.com/304341
-    if (frame) {
-      blink::WebRect web_rect;
-      // When request range is invalid we will try to obtain it from current
-      // frame selection. The fallback value will be 0.
-      uint32_t start = range.IsValid() ? range.start()
-                                       : GetCurrentCursorPositionInFrame(frame);
-      frame->FirstRectForCharacterRange(start, range.length(), web_rect);
-      rect = web_rect;
-    }
-  }
-  Send(
-      new TextInputClientReplyMsg_GotFirstRectForRange(MSG_ROUTING_NONE, rect));
-}
-
 void TextInputClientObserver::OnStringForRange(gfx::Range range) {
   gfx::Point baseline_point;
   NSAttributedString* string = nil;
diff --git a/chromium/content/renderer/text_input_client_observer.h b/chromium/content/renderer/text_input_client_observer.h
index 21c636130c7..af8b5074a70 100644
--- a/chromium/content/renderer/text_input_client_observer.h
+++ b/chromium/content/renderer/text_input_client_observer.h
@@ -56,8 +56,6 @@ class TextInputClientObserver : public IPC::Listener, public IPC::Sender {
 
   // IPC Message handlers:
   void OnStringAtPoint(gfx::Point point);
-  void OnCharacterIndexForPoint(gfx::Point point);
-  void OnFirstRectForCharacterRange(gfx::Range range);
   void OnStringForRange(gfx::Range range);
 
   // The RenderWidget owning this instance of the observer.
diff --git a/chromium/content/renderer/visual_state_browsertest.cc b/chromium/content/renderer/visual_state_browsertest.cc
index 8c206d8f526..1b3814f763c 100644
--- a/chromium/content/renderer/visual_state_browsertest.cc
+++ b/chromium/content/renderer/visual_state_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/renderer/render_view.h"
 #include "content/public/renderer/render_view_observer.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/renderer/webclipboard_impl_browsertest.cc b/chromium/content/renderer/webclipboard_impl_browsertest.cc
index 889ebc35152..c7deb2a4b0e 100644
--- a/chromium/content/renderer/webclipboard_impl_browsertest.cc
+++ b/chromium/content/renderer/webclipboard_impl_browsertest.cc
@@ -7,6 +7,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
diff --git a/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc b/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
index 3d699f6695b..07df0308691 100644
--- a/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
+++ b/chromium/content/renderer/webgraphicscontext3d_provider_impl.cc
@@ -60,6 +60,11 @@ WebGraphicsContext3DProviderImpl::WebGPUInterface() {
   return provider_->WebGPUInterface();
 }
 
+bool WebGraphicsContext3DProviderImpl::IsContextLost() {
+  return RasterInterface() &&
+         RasterInterface()->GetGraphicsResetStatusKHR() != GL_NO_ERROR;
+}
+
 GrContext* WebGraphicsContext3DProviderImpl::GetGrContext() {
   return provider_->GrContext();
 }
diff --git a/chromium/content/renderer/webgraphicscontext3d_provider_impl.h b/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
index b9d65cbd87a..5f48d81523c 100644
--- a/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
+++ b/chromium/content/renderer/webgraphicscontext3d_provider_impl.h
@@ -43,6 +43,7 @@ class CONTENT_EXPORT WebGraphicsContext3DProviderImpl
   gpu::gles2::GLES2Interface* ContextGL() override;
   gpu::raster::RasterInterface* RasterInterface() override;
   gpu::webgpu::WebGPUInterface* WebGPUInterface() override;
+  bool IsContextLost() override;
   GrContext* GetGrContext() override;
   const gpu::Capabilities& GetCapabilities() const override;
   const gpu::GpuFeatureInfo& GetGpuFeatureInfo() const override;
diff --git a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
index 9ecaf561527..66c5f9877cb 100644
--- a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
+++ b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
@@ -18,6 +18,7 @@
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
+#include "third_party/blink/public/common/messaging/message_port_descriptor.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "third_party/blink/public/platform/web_fetch_client_settings_object.h"
@@ -185,7 +186,6 @@ EmbeddedSharedWorkerStub::CreateWorkerFetchContext() {
   // https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-07#section-2.1.2
   worker_fetch_context->set_site_for_cookies(
       net::SiteForCookies::FromUrl(url_));
-  worker_fetch_context->set_origin_url(url_.GetOrigin());
 
   DCHECK(response_override_);
   worker_fetch_context->SetResponseOverrideForMainScript(
@@ -202,7 +202,7 @@ void EmbeddedSharedWorkerStub::ConnectToChannel(
 }
 
 void EmbeddedSharedWorkerStub::Connect(int connection_request_id,
-                                       mojo::ScopedMessagePipeHandle port) {
+                                       blink::MessagePortDescriptor port) {
   blink::MessagePortChannel channel(std::move(port));
   if (running_) {
     ConnectToChannel(connection_request_id, std::move(channel));
diff --git a/chromium/content/renderer/worker/embedded_shared_worker_stub.h b/chromium/content/renderer/worker/embedded_shared_worker_stub.h
index b7786434217..ee4cb15a962 100644
--- a/chromium/content/renderer/worker/embedded_shared_worker_stub.h
+++ b/chromium/content/renderer/worker/embedded_shared_worker_stub.h
@@ -38,6 +38,7 @@ class WebSharedWorker;
 
 namespace blink {
 class MessagePortChannel;
+class MessagePortDescriptor;
 class PendingURLLoaderFactoryBundle;
 }  // namespace blink
 
@@ -99,7 +100,7 @@ class EmbeddedSharedWorkerStub : public blink::WebSharedWorkerClient,
 
   // mojom::SharedWorker methods:
   void Connect(int connection_request_id,
-               mojo::ScopedMessagePipeHandle port) override;
+               blink::MessagePortDescriptor port) override;
   void Terminate() override;
 
   mojo::Receiver<blink::mojom::SharedWorker> receiver_;
diff --git a/chromium/content/renderer/worker/worker_thread_registry.cc b/chromium/content/renderer/worker/worker_thread_registry.cc
index bcfe2158479..800b374981a 100644
--- a/chromium/content/renderer/worker/worker_thread_registry.cc
+++ b/chromium/content/renderer/worker/worker_thread_registry.cc
@@ -8,9 +8,9 @@
 #include <memory>
 #include <utility>
 
+#include "base/check.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
-#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/observer_list.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/content/renderer/worker/worker_thread_registry_unittest.cc b/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
index 302426e48e6..1a2c3056adc 100644
--- a/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
+++ b/chromium/content/renderer/worker/worker_thread_registry_unittest.cc
@@ -4,7 +4,6 @@
 
 #include "content/renderer/worker/worker_thread_registry.h"
 
-#include "base/logging.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
 #include "content/public/renderer/worker_thread.h"
diff --git a/chromium/content/services/isolated_xr_device/BUILD.gn b/chromium/content/services/isolated_xr_device/BUILD.gn
index 047efdd1a5b..a24bf66857b 100644
--- a/chromium/content/services/isolated_xr_device/BUILD.gn
+++ b/chromium/content/services/isolated_xr_device/BUILD.gn
@@ -27,6 +27,7 @@ source_set("lib") {
     "//content/public/common:common_sources",
     "//device/base",
     "//device/vr:vr",
+    "//device/vr:vr_base",
     "//device/vr/public/mojom",
     "//device/vr/public/mojom:test_mojom",
   ]
diff --git a/chromium/content/services/isolated_xr_device/xr_runtime_provider.cc b/chromium/content/services/isolated_xr_device/xr_runtime_provider.cc
index 61b4048efa1..0eeed975d74 100644
--- a/chromium/content/services/isolated_xr_device/xr_runtime_provider.cc
+++ b/chromium/content/services/isolated_xr_device/xr_runtime_provider.cc
@@ -11,7 +11,6 @@
 #include "content/public/common/content_switches.h"
 #include "device/base/features.h"
 #include "device/vr/buildflags/buildflags.h"
-#include "device/vr/vr_device_base.h"
 
 #if BUILDFLAG(ENABLE_OPENVR)
 #include "device/vr/openvr/openvr_device.h"
diff --git a/chromium/content/shell/BUILD.gn b/chromium/content/shell/BUILD.gn
index becfab5a27c..5a50a2d4145 100644
--- a/chromium/content/shell/BUILD.gn
+++ b/chromium/content/shell/BUILD.gn
@@ -4,6 +4,7 @@
 
 import("//build/config/chromecast_build.gni")
 import("//build/config/features.gni")
+import("//build/config/linux/gtk/gtk.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/ui.gni")
 import("//build/config/win/console_app.gni")
@@ -15,6 +16,7 @@ import("//ppapi/buildflags/buildflags.gni")
 import("//tools/grit/grit_rule.gni")
 import("//tools/grit/repack.gni")
 import("//tools/v8_context_snapshot/v8_context_snapshot.gni")
+import("//ui/ozone/ozone.gni")
 if (is_android) {
   import("//build/config/android/config.gni")
 } else if (is_mac) {
@@ -28,8 +30,8 @@ if (is_android) {
 
 declare_args() {
   content_shell_product_name = "Content Shell"
-  content_shell_version = "99.77.34.5"
-  content_shell_major_version = "99"
+  content_shell_version = "999.77.34.5"
+  content_shell_major_version = "999"
 }
 
 config("content_shell_lib_warnings") {
@@ -45,7 +47,24 @@ source_set("android_shell_descriptors") {
   public_deps = [ "//content/public/common:content_descriptors" ]
 }
 
-source_set("web_test_common") {
+mojom("web_test_common_mojom") {
+  sources = [
+    "common/web_test/fake_bluetooth_chooser.mojom",
+    "common/web_test/web_test.mojom",
+    "common/web_test/web_test_bluetooth_fake_adapter_setter.mojom",
+  ]
+  public_deps = [
+    "//content/public/common:web_preferences_mojom",
+    "//mojo/public/mojom/base",
+    "//skia/public/mojom",
+    "//ui/accessibility:ax_enums_mojo",
+    "//ui/gfx/geometry/mojom",
+    "//url/mojom:url_mojom_gurl",
+    "//url/mojom:url_mojom_origin",
+  ]
+}
+
+static_library("web_test_common") {
   testonly = true
   sources = [
     "common/web_test/web_test_constants.h",
@@ -54,9 +73,125 @@ source_set("web_test_common") {
     "common/web_test/web_test_switches.cc",
     "common/web_test/web_test_switches.h",
   ]
+  public_deps = [
+    # #include'ed by renderer/web_test/blink_test_runner.h
+    ":web_test_common_mojom",
+
+    # The generated mojom JS bindings are used by web tests.
+    ":web_test_common_mojom_js",
+  ]
+  deps = [
+    "//base",
+    "//third_party/blink/public:blink_headers",
+    "//v8",
+  ]
+}
+
+static_library("web_test_renderer") {
+  testonly = true
+
+  # This is to support our dependency on //content/renderer.
+  # See comment at the top of //content/BUILD.gn for why this is disabled in
+  # component builds.
+  if (is_component_build) {
+    check_includes = false
+  }
+
+  sources = [
+    "renderer/web_test/accessibility_controller.cc",
+    "renderer/web_test/accessibility_controller.h",
+    "renderer/web_test/app_banner_service.cc",
+    "renderer/web_test/app_banner_service.h",
+    "renderer/web_test/blink_test_helpers.cc",
+    "renderer/web_test/blink_test_helpers.h",
+    "renderer/web_test/blink_test_runner.cc",
+    "renderer/web_test/blink_test_runner.h",
+    "renderer/web_test/event_sender.cc",
+    "renderer/web_test/event_sender.h",
+    "renderer/web_test/gamepad_controller.cc",
+    "renderer/web_test/gamepad_controller.h",
+    "renderer/web_test/gc_controller.cc",
+    "renderer/web_test/gc_controller.h",
+    "renderer/web_test/layout_dump.cc",
+    "renderer/web_test/layout_dump.h",
+    "renderer/web_test/mock_content_settings_client.cc",
+    "renderer/web_test/mock_content_settings_client.h",
+    "renderer/web_test/mock_grammar_check.cc",
+    "renderer/web_test/mock_grammar_check.h",
+    "renderer/web_test/mock_screen_orientation_client.cc",
+    "renderer/web_test/mock_screen_orientation_client.h",
+    "renderer/web_test/mock_spell_check.cc",
+    "renderer/web_test/mock_spell_check.h",
+    "renderer/web_test/mock_web_document_subresource_filter.cc",
+    "renderer/web_test/mock_web_document_subresource_filter.h",
+    "renderer/web_test/pixel_dump.cc",
+    "renderer/web_test/pixel_dump.h",
+    "renderer/web_test/spell_check_client.cc",
+    "renderer/web_test/spell_check_client.h",
+    "renderer/web_test/test_interfaces.cc",
+    "renderer/web_test/test_interfaces.h",
+    "renderer/web_test/test_plugin.cc",
+    "renderer/web_test/test_plugin.h",
+    "renderer/web_test/test_preferences.cc",
+    "renderer/web_test/test_preferences.h",
+    "renderer/web_test/test_runner.cc",
+    "renderer/web_test/test_runner.h",
+    "renderer/web_test/test_runner_for_specific_view.cc",
+    "renderer/web_test/test_runner_for_specific_view.h",
+    "renderer/web_test/test_websocket_handshake_throttle_provider.cc",
+    "renderer/web_test/test_websocket_handshake_throttle_provider.h",
+    "renderer/web_test/text_input_controller.cc",
+    "renderer/web_test/text_input_controller.h",
+    "renderer/web_test/tracked_dictionary.cc",
+    "renderer/web_test/tracked_dictionary.h",
+    "renderer/web_test/web_ax_object_proxy.cc",
+    "renderer/web_test/web_ax_object_proxy.h",
+    "renderer/web_test/web_frame_test_proxy.cc",
+    "renderer/web_test/web_frame_test_proxy.h",
+    "renderer/web_test/web_test_content_renderer_client.cc",
+    "renderer/web_test/web_test_content_renderer_client.h",
+    "renderer/web_test/web_test_render_thread_observer.cc",
+    "renderer/web_test/web_test_render_thread_observer.h",
+    "renderer/web_test/web_test_runtime_flags.cc",
+    "renderer/web_test/web_test_runtime_flags.h",
+    "renderer/web_test/web_view_test_proxy.cc",
+    "renderer/web_test/web_view_test_proxy.h",
+    "renderer/web_test/web_widget_test_proxy.cc",
+    "renderer/web_test/web_widget_test_proxy.h",
+  ]
   deps = [
+    ":client_hints_util",
+    ":content_shell_lib",
+    ":web_test_common",
     "//base",
+    "//cc",
+    "//cc/paint",
+    "//components/plugins/renderer",
+    "//components/viz/common",
+    "//components/web_cache/renderer",
+    "//content/public/common",
+    "//content/public/renderer",  # For component builds.
+    "//content/renderer:for_content_tests",  # For non-component builds.
+    "//device/gamepad/public/cpp:shared_with_blink",
+    "//device/gamepad/public/mojom",
+    "//gin",
+    "//gpu",
+    "//gpu/command_buffer/client:gles2_interface",
+    "//media/capture",
+    "//printing",
+    "//services/device/public/mojom",
+    "//skia",
+    "//skia:test_fonts",
     "//third_party/blink/public:blink_headers",
+    "//third_party/blink/public:test_headers",
+    "//ui/accessibility:ax_base",
+    "//ui/display",
+    "//ui/events:dom_keycode_converter",
+    "//ui/events:events_base",
+    "//ui/events/blink",
+    "//ui/gfx",
+    "//ui/gfx:test_support",
+    "//ui/gfx/geometry",
     "//v8",
   ]
 }
@@ -87,7 +222,9 @@ static_library("content_shell_app") {
   ]
   deps = [
     ":content_shell_lib",
-    "//content/public/app:both",
+    ":web_test_common",
+    ":web_test_renderer",
+    "//content/public/app",
     "//v8",
   ]
   if (!is_fuchsia) {
@@ -111,7 +248,6 @@ static_library("content_shell_lib") {
     "browser/renderer_host/shell_render_widget_host_view_mac_delegate.mm",
     "browser/shell.cc",
     "browser/shell.h",
-    "browser/shell_android.cc",
     "browser/shell_application_mac.h",
     "browser/shell_application_mac.mm",
     "browser/shell_browser_context.cc",
@@ -134,11 +270,13 @@ static_library("content_shell_lib") {
     "browser/shell_javascript_dialog_manager.cc",
     "browser/shell_javascript_dialog_manager.h",
     "browser/shell_javascript_dialog_win.cc",
-    "browser/shell_mac.mm",
     "browser/shell_permission_manager.cc",
     "browser/shell_permission_manager.h",
     "browser/shell_platform_data_aura.cc",
     "browser/shell_platform_data_aura.h",
+    "browser/shell_platform_delegate.h",
+    "browser/shell_platform_delegate_android.cc",
+    "browser/shell_platform_delegate_mac.mm",
     "browser/shell_plugin_service_filter.cc",
     "browser/shell_plugin_service_filter.h",
     "browser/shell_quota_permission_context.cc",
@@ -149,8 +287,6 @@ static_library("content_shell_lib") {
     "browser/shell_web_contents_view_delegate_android.cc",
     "browser/shell_web_contents_view_delegate_creator.h",
     "browser/shell_web_contents_view_delegate_mac.mm",
-    "browser/web_test/blink_test_controller.cc",
-    "browser/web_test/blink_test_controller.h",
     "browser/web_test/devtools_protocol_test_bindings.cc",
     "browser/web_test/devtools_protocol_test_bindings.h",
     "browser/web_test/fake_bluetooth_chooser.cc",
@@ -195,6 +331,8 @@ static_library("content_shell_lib") {
     "browser/web_test/web_test_content_browser_client.h",
     "browser/web_test/web_test_content_index_provider.cc",
     "browser/web_test/web_test_content_index_provider.h",
+    "browser/web_test/web_test_control_host.cc",
+    "browser/web_test/web_test_control_host.h",
     "browser/web_test/web_test_devtools_bindings.cc",
     "browser/web_test/web_test_devtools_bindings.h",
     "browser/web_test/web_test_download_manager_delegate.cc",
@@ -207,6 +345,9 @@ static_library("content_shell_lib") {
     "browser/web_test/web_test_permission_manager.h",
     "browser/web_test/web_test_push_messaging_service.cc",
     "browser/web_test/web_test_push_messaging_service.h",
+    "browser/web_test/web_test_shell_platform_delegate.cc",
+    "browser/web_test/web_test_shell_platform_delegate.h",
+    "browser/web_test/web_test_shell_platform_delegate_mac.mm",
     "browser/web_test/web_test_tts_controller_delegate.cc",
     "browser/web_test/web_test_tts_controller_delegate.h",
     "browser/web_test/web_test_tts_platform.cc",
@@ -223,20 +364,8 @@ static_library("content_shell_lib") {
     "gpu/shell_content_gpu_client.h",
     "renderer/shell_content_renderer_client.cc",
     "renderer/shell_content_renderer_client.h",
-    "renderer/shell_render_view_observer.cc",
-    "renderer/shell_render_view_observer.h",
-    "renderer/web_test/blink_test_helpers.cc",
-    "renderer/web_test/blink_test_helpers.h",
-    "renderer/web_test/blink_test_runner.cc",
-    "renderer/web_test/blink_test_runner.h",
-    "renderer/web_test/test_websocket_handshake_throttle_provider.cc",
-    "renderer/web_test/test_websocket_handshake_throttle_provider.h",
-    "renderer/web_test/web_test_content_renderer_client.cc",
-    "renderer/web_test/web_test_content_renderer_client.h",
-    "renderer/web_test/web_test_render_frame_observer.cc",
-    "renderer/web_test/web_test_render_frame_observer.h",
-    "renderer/web_test/web_test_render_thread_observer.cc",
-    "renderer/web_test/web_test_render_thread_observer.h",
+    "renderer/shell_render_frame_observer.cc",
+    "renderer/shell_render_frame_observer.h",
     "utility/shell_content_utility_client.cc",
     "utility/shell_content_utility_client.h",
   ]
@@ -254,17 +383,18 @@ static_library("content_shell_lib") {
     "CONTENT_SHELL_MAJOR_VERSION=\"$content_shell_major_version\"",
   ]
 
+  # This is to support our dependency on //content/browser.
+  # See comment at the top of //content/BUILD.gn for why this is disabled in
+  # component builds.
+  if (is_component_build) {
+    check_includes = false
+  }
+
   public_deps = [
     ":android_shell_descriptors",
 
-    # #include'ed by renderer/web_test/blink_test_runner.h
-    ":mojo_bindings",
-
-    # The generated mojom JS bindings are used by web tests.
-    ":mojo_bindings_js",
-
-    # This exposes all public content APIs.
-    "//content/public/app:both",
+    # content_shell_lib also exposes all public content APIs.
+    "//content/public/app",
     "//content/public/browser",
     "//content/public/child",
     "//content/public/common",
@@ -275,6 +405,7 @@ static_library("content_shell_lib") {
   ]
   deps = [
     ":client_hints_util",
+    ":content_browsertests_mojom",
     ":resources",
     ":web_test_common",
     "//base",
@@ -292,22 +423,22 @@ static_library("content_shell_lib") {
     "//components/download/public/common:public",
     "//components/keyed_service/content",
     "//components/network_session_configurator/browser",
-    "//components/plugins/renderer",
     "//components/services/storage/test_api",
     "//components/url_formatter",
     "//components/web_cache/renderer",
     "//content:content_resources",
     "//content:dev_ui_content_resources",
     "//content/app/resources",
+    "//content/browser:for_content_tests",  # For non-component builds.
     "//content/gpu",
+    "//content/public/browser",  # For component builds.
     "//content/public/common",
     "//content/public/common:service_names",
-    "//content/shell/test_runner:test_runner",
     "//content/test:blink_test_browser_support",
     "//content/test:content_test_mojo_bindings",
     "//content/test:mojo_web_test_bindings",
     "//content/test:test_support",
-    "//content/test:web_test_support",
+    "//content/test:web_test_support_browser",
     "//device/bluetooth",
     "//device/bluetooth:fake_bluetooth",
     "//device/bluetooth:mocks",
@@ -315,7 +446,6 @@ static_library("content_shell_lib") {
     "//gin",
     "//gpu",
     "//media",
-    "//media/capture",
     "//media/mojo:buildflags",
     "//net",
     "//net:net_resources",
@@ -330,7 +460,6 @@ static_library("content_shell_lib") {
     "//services/test/echo:lib",
     "//services/test/echo/public/mojom",
     "//skia",
-    "//skia:test_fonts",
     "//storage/browser",
     "//testing/gmock",
     "//testing/gtest",
@@ -367,9 +496,6 @@ static_library("content_shell_lib") {
     deps += [ "//third_party/fuchsia-sdk/sdk/fidl/fuchsia.ui.policy" ]
   }
 
-  # Annoyingly, this target and web_test_support have circular includes.
-  allow_circular_includes_from = [ "//content/test:web_test_support" ]
-
   if (enable_plugins) {
     deps += [
       "//cc/paint",
@@ -404,6 +530,16 @@ static_library("content_shell_lib") {
     ]
   }
 
+  if (use_gtk) {
+    deps += [ "//ui/gtk" ]
+    if (use_x11 || ozone_platform_x11) {
+      deps += [
+        "//ui/gfx/x",
+        "//ui/gtk/x",
+      ]
+    }
+  }
+
   if (use_x11) {
     # Some tests rely on this tool at runtime. Note: it might be better if
     # the tests that needed it had this as a dep instead of adding it here.
@@ -437,7 +573,7 @@ static_library("content_shell_lib") {
 
     if (toolkit_views && !is_chromecast) {
       sources += [
-        "browser/shell_views.cc",
+        "browser/shell_platform_delegate_views.cc",
         "browser/shell_web_contents_view_delegate_views.cc",
       ]
       deps += [
@@ -449,7 +585,7 @@ static_library("content_shell_lib") {
       ]
     } else {
       sources += [
-        "browser/shell_aura.cc",
+        "browser/shell_platform_delegate_aura.cc",
         "browser/shell_web_contents_view_delegate_aura.cc",
       ]
     }
@@ -619,7 +755,7 @@ if (is_android) {
       ":content_shell_app",
       ":pak",
       "//build/win:default_exe_manifest",
-      "//content/public/app:both",
+      "//content/public/app",
     ]
 
     data_deps = [
@@ -657,6 +793,7 @@ if (is_android) {
       testonly = true
       binary = ":content_shell"
       package_name_override = "content_shell"
+      manifest = "fuchsia/content_shell.cmx"
     }
 
     fuchsia_package_runner("content_shell_fuchsia") {
@@ -762,7 +899,7 @@ if (is_mac) {
       ":content_shell_framework_helpers",
       ":content_shell_framework_resources",
       ":content_shell_swiftshader_library",
-      "//content/public/app:both",
+      "//content/public/app",
       "//content/public/common",
       "//third_party/icu:icudata",
     ]
@@ -899,23 +1036,8 @@ if (is_mac) {
   }
 }
 
-mojom("mojo_bindings") {
-  sources = [
-    "common/blink_test.mojom",
-    "common/power_monitor_test.mojom",
-    "common/web_test.mojom",
-    "common/web_test/fake_bluetooth_chooser.mojom",
-    "common/web_test/web_test_bluetooth_fake_adapter_setter.mojom",
-  ]
-  public_deps = [
-    "//content/public/common:web_preferences_mojom",
-    "//mojo/public/mojom/base",
-    "//skia/public/mojom",
-    "//ui/accessibility:ax_enums_mojo",
-    "//ui/gfx/geometry/mojom",
-    "//url/mojom:url_mojom_gurl",
-    "//url/mojom:url_mojom_origin",
-  ]
+mojom("content_browsertests_mojom") {
+  sources = [ "common/power_monitor_test.mojom" ]
 }
 
 group("content_shell_crash_test") {
diff --git a/chromium/content/shell/android/BUILD.gn b/chromium/content/shell/android/BUILD.gn
index 3220fbb066f..ab9633d6bb0 100644
--- a/chromium/content/shell/android/BUILD.gn
+++ b/chromium/content/shell/android/BUILD.gn
@@ -93,7 +93,7 @@ android_library("content_shell_java") {
     "//mojo/public/java:system_java",
     "//net/android:net_java",
     "//ui/android:ui_java",
-    "//ui/base/mojom:cursor_type_java",
+    "//ui/base/cursor/mojom:cursor_type_java",
   ]
   sources = [
     "java/src/org/chromium/content_shell/Shell.java",
@@ -101,7 +101,6 @@ android_library("content_shell_java") {
     "java/src/org/chromium/content_shell/ShellViewAndroidDelegate.java",
   ]
 
-  android_manifest_for_lint = content_shell_manifest
   annotation_processor_deps = [ "//base/android/jni_generator:jni_processor" ]
 }
 
@@ -144,7 +143,7 @@ android_library("content_shell_apk_java") {
     "//content/public/android:content_java",
     "//media/capture/video/android:capture_java",
     "//net/android:net_java",
-    "//third_party/jsr-305:jsr_305_javalib",
+    "//third_party/android_deps:com_google_code_findbugs_jsr305_java",
     "//ui/android:ui_java",
   ]
 
diff --git a/chromium/content/shell/common/blink_test.mojom b/chromium/content/shell/common/blink_test.mojom
deleted file mode 100644
index bda8330dc55..00000000000
--- a/chromium/content/shell/common/blink_test.mojom
+++ /dev/null
@@ -1,148 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "content/public/common/web_preferences.mojom";
-import "mojo/public/mojom/base/file_path.mojom";
-import "skia/public/mojom/bitmap.mojom";
-import "ui/gfx/geometry/mojom/geometry.mojom";
-import "url/mojom/url.mojom";
-
-struct ShellTestConfiguration {
-  // The current working directory.
-  mojo_base.mojom.FilePath current_working_directory;
-
-  // The temporary directory of the system.
-  mojo_base.mojom.FilePath temp_path;
-
-  // The URL of the current web test.
-  url.mojom.Url test_url;
-
-  // True if tests can open external URLs.
-  bool allow_external_pages;
-
-  // The expected MD5 hash of the pixel results.
-  string expected_pixel_hash;
-
-  // The initial size of the test window.
-  gfx.mojom.Size initial_size;
-
-  // Whether the test is running in protocol mode.
-  // See TestInfo::protocol_mode in browser/web_test/test_info_extractor.h.
-  bool protocol_mode;
-};
-
-// Results of a CaptureDump call.
-struct BlinkTestDump {
-  // Audio dump.
-  array<uint8>? audio;
-
-  // Layout dump.
-  string? layout;
-
-  // Image dump.
-  skia.mojom.Bitmap? pixels;
-  string actual_pixel_hash;
-
-  // Selection rect dump.
-  gfx.mojom.Rect selection_rect;
-};
-
-// Blink test messages sent from the browser process to the renderer.
-interface BlinkTestControl {
-  CaptureDump() => (BlinkTestDump result);
-
-  CompositeWithRaster() => ();
-
-  // Dumps the frame's contents into a string.
-  DumpFrameLayout() => (string frame_layout_dump);
-
-  // Replicates test config (for an already started test) to a new renderer
-  // that hosts parts of the main test window.
-  ReplicateTestConfiguration(ShellTestConfiguration config);
-
-  // Sets the test config for a web test that is being started.  This message
-  // is sent only to a renderer that hosts parts of the main test window.
-  SetTestConfiguration(ShellTestConfiguration config);
-
-  // Sets up a secondary renderer (renderer that doesn't [yet] host parts of the
-  // main test window) for a web test.
-  SetupSecondaryRenderer();
-
-  // Tells the renderer to reset all test runners.
-  Reset();
-
-  // Tells the main window that a secondary renderer in a different process
-  // asked to finish the test.
-  TestFinishedInSecondaryRenderer();
-
-  // Notifies BlinkTestRunner that the layout dump has completed (and that it
-  // can proceed with finishing up the test).
-  // TODO(crbug.com/1039247): This message should be removed and the callback
-  // should happen part of LayoutDump call on the host interface.
-  LayoutDumpCompleted(string completed_layout_dump);
-
-  // Reply Bluetooth manual events to BlinkTestRunner.
-  ReplyBluetoothManualChooserEvents(array<string> events);
-};
-
-// Blink test messages sent from the renderer process to the browser.
-interface BlinkTestClient {
-  // Asks the browser process to perform a layout dump spanning all the
-  // (potentially cross-process) frames.  This goes through multiple
-  // BlinkTestControl.DumpFrameLayout calls and ends with sending of
-  // LayoutDumpCompleted of BlinkTestControl interface.
-  InitiateLayoutDump();
-
-  // Notify the browser process the reset was done.
-  ResetDone();
-
-  // Add a message to stderr (not saved to expected output files, for debugging
-  // only).
-  PrintMessageToStderr(string message);
-
-  // Add a message.
-  PrintMessage(string message);
-
-  // Update changed WebKit preferences.
-  OverridePreferences(WebPreferences web_preferences);
-
-  // Trigger a reload navigation on the main WebView.
-  Reload();
-
-  // Invoked when the embedder should close all but the main WebView.
-  CloseRemainingWindows();
-
-  // Trigger a GoToOffset navigation on the main WebView.
-  GoToOffset(int32 offset);
-
-  // Calls the BluetoothChooser::EventHandler with the arguments here. Valid
-  // event strings are:
-  //  * "cancel" - simulates the user canceling the chooser.
-  //  * "select" - simulates the user selecting a device whose device ID is in
-  //               |argument|.
-  SendBluetoothManualChooserEvent(string event, string argument);
-
-  // If |enable| is true makes the Bluetooth chooser record its input and wait
-  // for instructions from the test program on how to proceed. Otherwise
-  // fall backs to the browser's default chooser.
-  SetBluetoothManualChooser(bool enable);
-
-  // Returns the events recorded since the last call to this function.
-  GetBluetoothManualChooserEvents();
-
-  // Manages the popup blocking setting to used for web tests.
-  SetPopupBlockingEnabled(bool block_popups);
-
-  // Trigger a loadURL navigation on the main WebView.
-  LoadURLForFrame(url.mojom.Url url, string frame_name);
-
-  // Naivgate a URL on the secondary window.
-  NavigateSecondaryWindow(url.mojom.Url url);
-
-  // Mark the orientation changed in the browser process for the layout tests
-  // that request fullscreen on screen orientation change.
-  SetScreenOrientationChanged();
-};
diff --git a/chromium/content/shell/common/power_monitor_test_impl.cc b/chromium/content/shell/common/power_monitor_test_impl.cc
index 77e27f69d11..d0864a0c65d 100644
--- a/chromium/content/shell/common/power_monitor_test_impl.cc
+++ b/chromium/content/shell/common/power_monitor_test_impl.cc
@@ -7,7 +7,6 @@
 #include <memory>
 #include <utility>
 
-#include "content/shell/common/power_monitor_test.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
diff --git a/chromium/content/shell/common/shell_switches.cc b/chromium/content/shell/common/shell_switches.cc
index 633b32357b4..5b442be7342 100644
--- a/chromium/content/shell/common/shell_switches.cc
+++ b/chromium/content/shell/common/shell_switches.cc
@@ -14,6 +14,9 @@ const char kContentShellDataPath[] = "data-path";
 // The directory breakpad should store minidumps in.
 const char kCrashDumpsDir[] = "crash-dumps-dir";
 
+// Disables the check for the system font when specified.
+const char kDisableSystemFontCheck[] = "disable-system-font-check";
+
 // Exposes the window.internals object to JavaScript for interactive development
 // and debugging of web tests that rely on it.
 const char kExposeInternalsForTesting[] = "expose-internals-for-testing";
diff --git a/chromium/content/shell/common/shell_switches.h b/chromium/content/shell/common/shell_switches.h
index d9825850951..3601d264726 100644
--- a/chromium/content/shell/common/shell_switches.h
+++ b/chromium/content/shell/common/shell_switches.h
@@ -11,6 +11,7 @@ namespace switches {
 
 extern const char kContentShellDataPath[];
 extern const char kCrashDumpsDir[];
+extern const char kDisableSystemFontCheck[];
 extern const char kExposeInternalsForTesting[];
 extern const char kContentShellHostWindowSize[];
 extern const char kContentShellHideToolbar[];
diff --git a/chromium/content/shell/common/v8_crashpad_support_win.cc b/chromium/content/shell/common/v8_crashpad_support_win.cc
index 20cbe59e908..9073b711c0f 100644
--- a/chromium/content/shell/common/v8_crashpad_support_win.cc
+++ b/chromium/content/shell/common/v8_crashpad_support_win.cc
@@ -5,7 +5,6 @@
 #include "content/shell/common/v8_crashpad_support_win.h"
 
 #include <windows.h>
-#include "base/logging.h"
 #include "components/crash/core/app/crash_export_thunks.h"
 #include "gin/public/debug.h"
 
diff --git a/chromium/content/shell/common/web_test.mojom b/chromium/content/shell/common/web_test.mojom
deleted file mode 100644
index 5038ed026f1..00000000000
--- a/chromium/content/shell/common/web_test.mojom
+++ /dev/null
@@ -1,97 +0,0 @@
-// Copyright 2020 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "mojo/public/mojom/base/file_path.mojom";
-import "mojo/public/mojom/base/values.mojom";
-import "mojo/public/mojom/base/string16.mojom";
-import "third_party/blink/public/mojom/permissions/permission_status.mojom";
-import "url/mojom/url.mojom";
-
-// Web test messages sent from the browser process to the renderer.
-interface WebTestControl {
-  // Used send flag changes to renderers - either when
-  // 1) broadcasting change happening in one renderer to all other renderers, or
-  // 2) sending accumulated changes to a single new renderer.
-  ReplicateWebTestRuntimeFlagsChanges(
-      mojo_base.mojom.DictionaryValue changed_layout_test_runtime_flags);
-};
-
-// Web test messages sent from the renderer process to the browser.
-interface WebTestClient {
-  // Start to inspect a secondary window.
-  InspectSecondaryWindow();
-
-  // Sent by secondary test window to notify the test has finished.
-  TestFinishedInSecondaryRenderer();
-
-  // Simulates a click on the notification.
-  //   - |title|: the title of the notification.
-  //   - |action_index|: indicates which action was clicked.
-  //   - |reply|: indicates the user reply.
-  SimulateWebNotificationClick(
-      string title, int32 action_index, mojo_base.mojom.String16? reply);
-
-  // Simulates closing a titled web notification depending on the user
-  // click.
-  //   - |title|: the title of the notification.
-  //   - |by_user|: whether the user clicks the notification.
-  SimulateWebNotificationClose(string title, bool by_user);
-
-  // Simulates a user deleting a content index entry.
-  SimulateWebContentIndexDelete(string id);
-
-  // Sets the cookie policy to:
-  // - allow all cookies when |block| is false
-  // - block only third-party cookies when |block| is true
-  BlockThirdPartyCookies(bool block);
-
-  // Reset all permissions of WebTestPermissionManager.
-  ResetPermissions();
-
-  // Sets the permission for |name| to |status| when queried or requested in
-  // |origin| from |embedding_origin|.
-  SetPermission(string name,
-               blink.mojom.PermissionStatus status,
-               url.mojom.Url origin,
-               url.mojom.Url embedding_origin);
-
-  // Notifies the browser that one of renderers has changed web test runtime
-  // flags (i.e. has set dump_as_text).
-  WebTestRuntimeFlagsChanged(
-      mojo_base.mojom.DictionaryValue changed_web_test_runtime_flags);
-
-  // Delete all cookies created in this associated storage context.
-  DeleteAllCookies();
-
-  // Clears all WebSQL databases.
-  ClearAllDatabases();
-
-  // Sets WebSQL quota size. If |quota| is the same to kDefaultDatabaseQuota,
-  // this resets quota to settings with a zero refresh interval to force
-  // QuotaManager to refresh settings immediately.
-  SetDatabaseQuota(int32 quota);
-
-  // Returns the absolute path to a directory this test can write data in. This
-  // returns the path to a fresh empty directory for each test that calls this
-  // method, but repeatedly calling this from the same test will return the same
-  // directory.
-  [Sync]
-  GetWritableDirectory() => (mojo_base.mojom.FilePath path);
-
-  // Registers a new isolated filesystem with the given files, and returns the
-  // new filesystem id.
-  [Sync]
-  RegisterIsolatedFileSystem(
-      array<mojo_base.mojom.FilePath> absolute_filenames)
-          => (string filesystem_id);
-
-  // For the duration of the current test this causes all file choosers to
-  // return the passed in |path|.
-  SetFilePathForMockFileDialog(mojo_base.mojom.FilePath path);
-
-  // Initialize to dump the main frame with a navigation history or pixels.
-  InitiateCaptureDump(bool capture_navigation_history, bool capture_pixels);
-};
diff --git a/chromium/content/shell/common/web_test/web_test.mojom b/chromium/content/shell/common/web_test/web_test.mojom
new file mode 100644
index 00000000000..6193f47dbaf
--- /dev/null
+++ b/chromium/content/shell/common/web_test/web_test.mojom
@@ -0,0 +1,256 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "content/public/common/web_preferences.mojom";
+import "mojo/public/mojom/base/file_path.mojom";
+import "mojo/public/mojom/base/values.mojom";
+import "mojo/public/mojom/base/string16.mojom";
+import "skia/public/mojom/bitmap.mojom";
+import "third_party/blink/public/mojom/permissions/permission_status.mojom";
+import "ui/gfx/geometry/mojom/geometry.mojom";
+import "url/mojom/url.mojom";
+
+struct WebTestRunTestConfiguration {
+  // The current working directory.
+  mojo_base.mojom.FilePath current_working_directory;
+
+  // The temporary directory of the system.
+  mojo_base.mojom.FilePath temp_path;
+
+  // The URL of the current web test.
+  url.mojom.Url test_url;
+
+  // True if tests can open external URLs.
+  bool allow_external_pages;
+
+  // The expected MD5 hash of the pixel results.
+  string expected_pixel_hash;
+
+  // Whether the test is running in protocol mode.
+  // See TestInfo::protocol_mode in browser/web_test/test_info_extractor.h.
+  bool protocol_mode;
+};
+
+// Results of a CaptureDump call.
+struct WebTestDump {
+  // Audio dump.
+  array<uint8>? audio;
+
+  // Layout dump.
+  string? layout;
+
+  // Image dump.
+  skia.mojom.Bitmap? pixels;
+  string actual_pixel_hash;
+
+  // Selection rect dump.
+  gfx.mojom.Rect selection_rect;
+};
+
+// Web test messages sent from the browser process to the renderer. This
+// interface is associated with RenderFrameHost.
+interface WebTestRenderFrame {
+  // Sets up a renderer in a window other than the main test window. This may
+  // be for a window opened by javascript (window.open()) or by the test harness
+  // (devtools inspector). This should be called as early as possible (as soon
+  // as a RenderFrame has been created for this interface to be available) after
+  // the renderer process is created, for each process not tied to the main
+  // window.
+  SetupRendererProcessForNonTestWindow();
+
+  // Dump the main frame with, and calls the given callback when it's finished.
+  CaptureDump() => (WebTestDump result);
+
+  // Performs the complete set of document lifecycle phases, including updates
+  // to the compositor state and rasterization, then calling the given callback.
+  CompositeWithRaster() => ();
+
+  // Dumps the frame's contents into a string.
+  DumpFrameLayout() => (string frame_layout_dump);
+
+  // Replicates test config (for an already started test) to a new renderer
+  // that hosts parts of the main test window.
+  ReplicateTestConfiguration(WebTestRunTestConfiguration config);
+
+  // Sets the test config for a web test that is being started.  This message
+  // is sent only to a renderer that hosts parts of the main test window.
+  SetTestConfiguration(WebTestRunTestConfiguration config);
+
+  // Tells the renderer to navigate to about:blank and reset all state
+  // in preparation for the next test. This happens before leak detection
+  // in order for the test harness to drop anything that tests passed in
+  // and which could cause a leak otherwise.
+  ResetRendererAfterWebTest();
+
+  // Tells the main window that a secondary renderer in a different process
+  // asked to finish the test.
+  FinishTestInMainWindow();
+
+  // Notifies BlinkTestRunner that the layout dump has completed (and that it
+  // can proceed with finishing up the test).
+  // TODO(crbug.com/1039247): This message should be removed and the callback
+  // should happen part of LayoutDump call on the host interface.
+  LayoutDumpCompleted(string completed_layout_dump);
+
+  // Reply Bluetooth manual events to BlinkTestRunner.
+  ReplyBluetoothManualChooserEvents(array<string> events);
+};
+
+// Web test messages related runtime flags sent from the browser process to the
+// renderer. This interface is associated with RenderProcessHost.
+interface WebTestRenderThread {
+  // Used send flag changes to renderers - either when
+  // 1) broadcasting change happening in one renderer to all other renderers, or
+  // 2) sending accumulated changes to a single new renderer.
+  ReplicateWebTestRuntimeFlagsChanges(
+      mojo_base.mojom.DictionaryValue changed_layout_test_runtime_flags);
+};
+
+// Web test messages sent from the renderer process to the browser. This
+// provides a message pipe from each renderer to the global WebTestControlHost
+// in the browser.
+interface WebTestControlHost {
+  // Asks the browser process to perform a layout dump spanning all the
+  // (potentially cross-process) frames.  This goes through multiple
+  // WebTestRenderFrame.DumpFrameLayout calls and ends with sending of
+  // LayoutDumpCompleted of WebTestRenderFrame interface.
+  InitiateLayoutDump();
+
+  // Initialize to dump the main window's navigation history to text, and/or
+  // capture a pixel dump of the main window's content.
+  InitiateCaptureDump(bool capture_navigation_history, bool capture_pixels);
+
+  // Sent by secondary test window to notify the test has finished.
+  TestFinishedInSecondaryRenderer();
+
+  // An ACK to notify the browser process that ResetRendererAfterWebTest() has
+  // completed.
+  ResetRendererAfterWebTestDone();
+
+  // Add a message to stderr (not saved to expected output files, for debugging
+  // only).
+  PrintMessageToStderr(string message);
+
+  // Add a message.
+  PrintMessage(string message);
+
+  // Update changed WebKit preferences.
+  OverridePreferences(WebPreferences web_preferences);
+
+  // Trigger a reload navigation on the main WebView.
+  Reload();
+
+  // Invoked when the embedder should close all but the main WebView.
+  CloseRemainingWindows();
+
+  // Trigger a GoToOffset navigation on the main WebView.
+  GoToOffset(int32 offset);
+
+  // Calls the BluetoothChooser::EventHandler with the arguments here. Valid
+  // event strings are:
+  //  * "cancel" - simulates the user canceling the chooser.
+  //  * "select" - simulates the user selecting a device whose device ID is in
+  //               |argument|.
+  SendBluetoothManualChooserEvent(string event, string argument);
+
+  // If |enable| is true makes the Bluetooth chooser record its input and wait
+  // for instructions from the test program on how to proceed. Otherwise
+  // fall backs to the browser's default chooser.
+  SetBluetoothManualChooser(bool enable);
+
+  // Returns the events recorded since the last call to this function.
+  GetBluetoothManualChooserEvents();
+
+  // Manages the popup blocking setting to used for web tests.
+  SetPopupBlockingEnabled(bool block_popups);
+
+  // Trigger a loadURL navigation on the main WebView.
+  LoadURLForFrame(url.mojom.Url url, string frame_name);
+
+  // Mark the orientation changed in the browser process for the layout tests
+  // that request fullscreen on screen orientation change.
+  SetScreenOrientationChanged();
+
+  // Sets the cookie policy to:
+  // - allow all cookies when |block| is false
+  // - block only third-party cookies when |block| is true
+  BlockThirdPartyCookies(bool block);
+
+  // Returns the absolute path to a directory this test can write data in. This
+  // returns the path to a fresh empty directory for each test that calls this
+  // method, but repeatedly calling this from the same test will return the same
+  // directory.
+  [Sync]
+  GetWritableDirectory() => (mojo_base.mojom.FilePath path);
+
+  // For the duration of the current test this causes all file choosers to
+  // return the passed in |path|.
+  SetFilePathForMockFileDialog(mojo_base.mojom.FilePath path);
+
+  // Moves focus and active state to the secondary devtools window, which exists
+  // only in devtools JS tests.
+  FocusDevtoolsSecondaryWindow();
+};
+
+// Web test messages sent from the renderer process to the browser.
+interface WebTestClient {
+  // Simulates a click on the notification.
+  //   - |title|: the title of the notification.
+  //   - |action_index|: indicates which action was clicked.
+  //   - |reply|: indicates the user reply.
+  SimulateWebNotificationClick(
+      string title, int32 action_index, mojo_base.mojom.String16? reply);
+
+  // Simulates closing a titled web notification depending on the user
+  // click.
+  //   - |title|: the title of the notification.
+  //   - |by_user|: whether the user clicks the notification.
+  SimulateWebNotificationClose(string title, bool by_user);
+
+  // Simulates a user deleting a content index entry.
+  SimulateWebContentIndexDelete(string id);
+
+  // Reset all permissions of WebTestPermissionManager.
+  ResetPermissions();
+
+  // Sets the permission for |name| to |status| when queried or requested in
+  // |origin| from |embedding_origin|.
+  SetPermission(string name,
+               blink.mojom.PermissionStatus status,
+               url.mojom.Url origin,
+               url.mojom.Url embedding_origin);
+
+  // Notifies the browser that one of renderers has changed web test runtime
+  // flags (i.e. has set dump_as_text).
+  WebTestRuntimeFlagsChanged(
+      mojo_base.mojom.DictionaryValue changed_web_test_runtime_flags);
+
+  // Delete all cookies created in this associated storage context.
+  DeleteAllCookies();
+
+  // Clears all WebSQL databases.
+  ClearAllDatabases();
+
+  // Sets WebSQL quota size. If |quota| is the same to kDefaultDatabaseQuota,
+  // this resets quota to settings with a zero refresh interval to force
+  // QuotaManager to refresh settings immediately.
+  SetDatabaseQuota(int32 quota);
+
+  // Registers a new isolated filesystem with the given files, and returns the
+  // new filesystem id.
+  [Sync]
+  RegisterIsolatedFileSystem(
+      array<mojo_base.mojom.FilePath> absolute_filenames)
+          => (string filesystem_id);
+
+  // Sets the network service-global Trust Tokens key commitments.
+  // |raw_commitments| should be JSON-encoded according to the format expected
+  // by NetworkService::SetTrustTokenKeyCommitments.
+  SetTrustTokenKeyCommitments(string raw_commitments) => ();
+
+  // Clears all persistent Trust Tokens state.
+  ClearTrustTokenState() => ();
+};
diff --git a/chromium/content/shell/common/web_test/web_test_switches.cc b/chromium/content/shell/common/web_test/web_test_switches.cc
index 690d0668b91..60cfad46629 100644
--- a/chromium/content/shell/common/web_test/web_test_switches.cc
+++ b/chromium/content/shell/common/web_test/web_test_switches.cc
@@ -35,6 +35,12 @@ const char kEnableLeakDetection[] = "enable-leak-detection";
 // Encode binary web test results (images, audio) using base64.
 const char kEncodeBinary[] = "encode-binary";
 
+// Disables the automatic origin isolation of web platform test domains.
+// We normally origin-isolate them for better test coverage, but tests of opt-in
+// origin isolation need to disable this.
+const char kDisableAutoWPTOriginIsolation[] =
+    "disable-auto-wpt-origin-isolation";
+
 // This makes us disable some web-platform runtime features so that we test
 // content_shell as if it was a stable release. It is only followed when
 // kRunWebTest is set. For the features' level, see
diff --git a/chromium/content/shell/common/web_test/web_test_switches.h b/chromium/content/shell/common/web_test/web_test_switches.h
index 0319e00612c..20d65160dd0 100644
--- a/chromium/content/shell/common/web_test/web_test_switches.h
+++ b/chromium/content/shell/common/web_test/web_test_switches.h
@@ -22,6 +22,7 @@ extern const char kEnableLeakDetection[];
 extern const char kEncodeBinary[];
 extern const char kStableReleaseMode[];
 extern const char kDisableHeadlessMode[];
+extern const char kDisableAutoWPTOriginIsolation[];
 
 #if defined(OS_WIN)
 extern const char kRegisterFontFiles[];
diff --git a/chromium/content/shell/test_runner/BUILD.gn b/chromium/content/shell/test_runner/BUILD.gn
deleted file mode 100644
index 401e4e7885c..00000000000
--- a/chromium/content/shell/test_runner/BUILD.gn
+++ /dev/null
@@ -1,123 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/features.gni")
-import("//build/config/jumbo.gni")
-import("//build/config/ui.gni")
-if (is_android) {
-  import("//build/config/android/config.gni")
-}
-
-jumbo_component("test_runner") {
-  testonly = true
-
-  # See comment at the top of //content/BUILD.gn for why this is disabled in
-  # component builds.
-  if (is_component_build) {
-    check_includes = false
-  }
-
-  defines = [ "TEST_RUNNER_IMPLEMENTATION" ]
-
-  sources = [
-    "accessibility_controller.cc",
-    "accessibility_controller.h",
-    "app_banner_service.cc",
-    "app_banner_service.h",
-    "event_sender.cc",
-    "event_sender.h",
-    "gamepad_controller.cc",
-    "gamepad_controller.h",
-    "gc_controller.cc",
-    "gc_controller.h",
-    "layout_dump.cc",
-    "layout_dump.h",
-    "mock_content_settings_client.cc",
-    "mock_content_settings_client.h",
-    "mock_grammar_check.cc",
-    "mock_grammar_check.h",
-    "mock_screen_orientation_client.cc",
-    "mock_screen_orientation_client.h",
-    "mock_spell_check.cc",
-    "mock_spell_check.h",
-    "mock_web_document_subresource_filter.cc",
-    "mock_web_document_subresource_filter.h",
-    "pixel_dump.cc",
-    "pixel_dump.h",
-    "spell_check_client.cc",
-    "spell_check_client.h",
-    "test_interfaces.cc",
-    "test_interfaces.h",
-    "test_plugin.cc",
-    "test_plugin.h",
-    "test_preferences.cc",
-    "test_preferences.h",
-    "test_runner.cc",
-    "test_runner.h",
-    "test_runner_export.h",
-    "test_runner_for_specific_view.cc",
-    "test_runner_for_specific_view.h",
-    "text_input_controller.cc",
-    "text_input_controller.h",
-    "tracked_dictionary.cc",
-    "tracked_dictionary.h",
-    "web_ax_object_proxy.cc",
-    "web_ax_object_proxy.h",
-    "web_frame_test_client.cc",
-    "web_frame_test_client.h",
-    "web_frame_test_proxy.cc",
-    "web_frame_test_proxy.h",
-    "web_test_delegate.h",
-    "web_test_runtime_flags.cc",
-    "web_test_runtime_flags.h",
-    "web_view_test_proxy.cc",
-    "web_view_test_proxy.h",
-    "web_widget_test_proxy.cc",
-    "web_widget_test_proxy.h",
-  ]
-
-  # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
-  configs += [ "//build/config/compiler:no_size_t_to_int_warning" ]
-
-  deps = [
-    "//base:base",
-    "//base:i18n",
-    "//cc",
-    "//cc/paint",
-    "//components/viz/common",
-    "//content/public/common",
-    "//content/public/common:client_hints_mojom",
-    "//content/public/common:service_names",
-    "//content/public/renderer",
-    "//content/renderer:for_content_tests",
-    "//content/shell:client_hints_util",
-    "//content/shell:web_test_common",
-    "//device/base/synchronization",
-    "//device/gamepad/public/cpp:shared_with_blink",
-    "//device/gamepad/public/mojom",
-    "//gin",
-    "//gpu",
-    "//gpu/command_buffer/client:gles2_interface",
-    "//media/midi:mojo",
-    "//net",
-    "//printing",
-    "//services/device/public/mojom",
-    "//skia",
-    "//third_party/blink/public:blink",
-    "//third_party/blink/public:test_support",
-    "//ui/display",
-    "//ui/events:dom_keycode_converter",
-    "//ui/events:events_base",
-    "//ui/events/blink",
-    "//ui/gfx",
-    "//ui/gfx:test_support",
-    "//ui/gfx/geometry",
-    "//url",
-    "//v8",
-  ]
-
-  if (is_mac) {
-    libs = [ "AppKit.framework" ]
-  }
-}
diff --git a/chromium/content/test/BUILD.gn b/chromium/content/test/BUILD.gn
index 8b7a2e6b16c..1a50bde4613 100644
--- a/chromium/content/test/BUILD.gn
+++ b/chromium/content/test/BUILD.gn
@@ -11,6 +11,7 @@ import("//build/config/jumbo.gni")
 import("//build/config/ui.gni")
 import("//build/nocompile.gni")
 import("//content/common/features.gni")
+import("//device/vr/buildflags/buildflags.gni")
 import("//media/media_options.gni")
 import("//mojo/public/tools/bindings/mojom.gni")
 import("//net/features.gni")
@@ -122,6 +123,8 @@ jumbo_static_library("test_support") {
     "../public/test/fake_local_frame.h",
     "../public/test/fake_remote_frame.cc",
     "../public/test/fake_remote_frame.h",
+    "../public/test/fake_render_widget_host.cc",
+    "../public/test/fake_render_widget_host.h",
     "../public/test/fake_service_worker_context.cc",
     "../public/test/fake_service_worker_context.h",
     "../public/test/fake_speech_recognition_manager.cc",
@@ -278,8 +281,8 @@ jumbo_static_library("test_support") {
     "mock_overscroll_observer.h",
     "mock_platform_notification_service.cc",
     "mock_platform_notification_service.h",
-    "mock_render_process.cc",
-    "mock_render_process.h",
+    "mock_raw_clipboard_host.cc",
+    "mock_raw_clipboard_host.h",
     "mock_render_widget_host_delegate.cc",
     "mock_render_widget_host_delegate.h",
     "mock_ssl_host_state_delegate.cc",
@@ -302,8 +305,6 @@ jumbo_static_library("test_support") {
     "render_document_feature.h",
     "storage_partition_test_helpers.cc",
     "storage_partition_test_helpers.h",
-    "stub_layer_tree_view_delegate.cc",
-    "stub_layer_tree_view_delegate.h",
     "stub_render_view_host_delegate_view.h",
     "stub_render_widget_host_owner_delegate.cc",
     "stub_render_widget_host_owner_delegate.h",
@@ -359,7 +360,7 @@ jumbo_static_library("test_support") {
   public_deps = [
     "//components/download/public/common:test_support",
     "//components/services/storage/public/mojom",
-    "//content/public/app:both",
+    "//content/public/app",
     "//content/public/browser",
     "//content/public/common",
     "//ipc",
@@ -378,7 +379,7 @@ jumbo_static_library("test_support") {
     "//cc:test_support",
     "//components/viz/client",
     "//components/viz/host",
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:for_content_tests",
     "//content/browser/speech/proto",
     "//content/child:for_content_tests",
@@ -589,6 +590,13 @@ jumbo_static_library("test_support") {
   if (is_linux) {
     deps += [ "//ui/platform_window/common" ]
   }
+
+  if (enable_vr) {
+    sources += [
+      "../public/test/xr_test_utils.cc",
+      "../public/test/xr_test_utils.h",
+    ]
+  }
 }
 
 # Fuchsia gpu integration tests use web_engine and a browser like shell
@@ -654,7 +662,7 @@ jumbo_static_library("browsertest_support") {
     "//base/test:test_config",
     "//base/test:test_support",
     "//components/network_session_configurator/common:common",
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:for_content_tests",
     "//content/shell:content_shell_app",
     "//content/shell:content_shell_lib",
@@ -670,7 +678,7 @@ jumbo_static_library("browsertest_support") {
   ]
 
   if (is_android) {
-    deps += [ "//content/public/app:both" ]
+    deps += [ "//content/public/app" ]
   } else {
     deps += [ "//content/public/browser" ]
   }
@@ -737,7 +745,7 @@ if (is_android) {
   }
 }
 
-static_library("web_test_support") {
+static_library("web_test_support_browser") {
   testonly = true
 
   # See comment at the top of //content/BUILD.gn for why this is disabled in
@@ -747,36 +755,13 @@ static_library("web_test_support") {
   }
 
   sources = [
-    "../public/test/web_test_support.h",
-    "web_test_support.cc",
+    "../public/test/web_test_support_browser.h",
+    "web_test_support_browser.cc",
   ]
-
   deps = [
-    ":test_support",
-    "//content/browser:for_content_tests",
-    "//content/child:for_content_tests",
-    "//content/public/common",
-    "//content/public/renderer",
-    "//content/renderer:for_content_tests",
-    "//content/shell/test_runner:test_runner",
-    "//device/bluetooth",
-    "//device/gamepad/public/cpp:shared_with_blink",
+    "//content/browser:for_content_tests",  # For non-component builds.
+    "//content/public/browser",  # For component builds.
     "//net:test_support",
-    "//services/device/public/cpp/generic_sensor",
-    "//skia",
-    "//ui/accessibility:ax_enums_mojo",
-    "//ui/events/blink",
-    "//ui/gfx:test_support",
-    "//ui/gfx/geometry",
-    "//v8",
-
-    # This is required to ensure content/shell/common/blink_test.mojom.h is
-    # generated before attempting to build this target. The file is included
-    # through content/shell/renderer/web_test/blink_test_runner.h. However
-    # adding a dependency on //content/shell:content_shell_lib as that would
-    # cause a circular dependency. Instead add this dependency directly to
-    # fix a flaky build (see https://crbug.com/971978 for more details).
-    "//content/shell:mojo_bindings",
   ]
 }
 
@@ -834,7 +819,6 @@ if (is_android) {
       "//testing/android/native_test:native_test_java",
       "//ui/android:ui_java",
     ]
-    android_manifest_for_lint = content_browsertests_manifest
   }
 
   android_resources("content_browsertests_resources") {
@@ -869,6 +853,7 @@ test("content_browsertests") {
     "../browser/accessibility/dump_accessibility_tree_browsertest.cc",
     "../browser/accessibility/fullscreen_browsertest.cc",
     "../browser/accessibility/hit_testing_browsertest.cc",
+    "../browser/accessibility/hit_testing_browsertest.h",
     "../browser/accessibility/line_layout_browsertest.cc",
     "../browser/accessibility/site_per_process_accessibility_browsertest.cc",
     "../browser/accessibility/snapshot_ax_tree_browsertest.cc",
@@ -893,7 +878,10 @@ test("content_browsertests") {
     "../browser/child_process_security_policy_browsertest.cc",
     "../browser/content_index/content_index_browsertest.cc",
     "../browser/content_service_browsertest.cc",
+    "../browser/conversions/conversion_internals_browsertest.cc",
     "../browser/conversions/conversion_registration_browsertest.cc",
+    "../browser/conversions/conversions_browsertest.cc",
+    "../browser/conversions/impression_declaration_browsertest.cc",
     "../browser/cross_origin_opener_policy_browsertest.cc",
     "../browser/cross_site_transfer_browsertest.cc",
     "../browser/data_decoder_browsertest.cc",
@@ -923,10 +911,10 @@ test("content_browsertests") {
     "../browser/frame_host/blocked_scheme_navigation_browsertest.cc",
     "../browser/frame_host/embedding_token_browsertest.cc",
     "../browser/frame_host/frame_tree_browsertest.cc",
-    "../browser/frame_host/interstitial_page_impl_browsertest.cc",
     "../browser/frame_host/navigation_controller_impl_browsertest.cc",
     "../browser/frame_host/navigation_request_browsertest.cc",
     "../browser/frame_host/render_document_host_browsertest.cc",
+    "../browser/frame_host/render_document_host_user_data_browsertest.cc",
     "../browser/frame_host/render_frame_host_impl_browsertest.cc",
     "../browser/frame_host/render_frame_host_impl_mac_browsertest.mm",
     "../browser/frame_host/render_frame_host_manager_browsertest.cc",
@@ -936,7 +924,6 @@ test("content_browsertests") {
     "../browser/gpu/gpu_ipc_browsertests.cc",
     "../browser/gpu/in_process_gpu_thread_browsertests.cc",
     "../browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc",
-    "../browser/idle/idle_browsertest.cc",
     "../browser/indexed_db/indexed_db_browsertest.cc",
     "../browser/indexed_db/indexed_db_feature_observer_browsertest.cc",
     "../browser/isolated_origin_browsertest.cc",
@@ -1027,6 +1014,7 @@ test("content_browsertests") {
     "../browser/resource_loading_browsertest.cc",
     "../browser/scheduler/responsiveness/native_event_observer_browsertest.mm",
     "../browser/scheduler/responsiveness/native_event_observer_browsertest_win.cc",
+    "../browser/screen_enumeration/screen_enumeration_browsertest.cc",
     "../browser/screen_orientation/screen_orientation_browsertest.cc",
     "../browser/security_exploit_browsertest.cc",
     "../browser/service_process_host_browsertest.cc",
@@ -1048,6 +1036,7 @@ test("content_browsertests") {
     "../browser/sms/sms_browsertest.cc",
     "../browser/snapshot_browsertest.cc",
     "../browser/storage_partition_impl_browsertest.cc",
+    "../browser/text_fragment_browsertest.cc",
     "../browser/tracing/background_tracing_manager_browsertest.cc",
     "../browser/tracing/memory_instrumentation_browsertest.cc",
     "../browser/tracing/memory_tracing_browsertest.cc",
@@ -1057,6 +1046,7 @@ test("content_browsertests") {
     "../browser/vibration_browsertest.cc",
     "../browser/web_contents/opened_by_dom_browsertest.cc",
     "../browser/web_contents/web_contents_impl_browsertest.cc",
+    "../browser/web_contents/web_contents_observer_browsertest.cc",
     "../browser/web_contents/web_contents_view_aura_browsertest.cc",
     "../browser/web_contents_receiver_set_browsertest.cc",
     "../browser/web_package/save_page_as_web_bundle_browsertest.cc",
@@ -1111,6 +1101,8 @@ test("content_browsertests") {
     "../test/browser_test_utils_browsertest.cc",
     "../test/content_browser_test_test.cc",
     "../test/top_frame_population_browsertest.cc",
+    "../test/trust_token_browsertest.cc",
+    "../test/trust_token_origin_trial_browsertest.cc",
     "../test/trust_token_parameters_browsertest.cc",
     "../test/url_loader_interceptor_test.cc",
     "../test/webui_resource_browsertest.cc",
@@ -1151,7 +1143,7 @@ test("content_browsertests") {
     "//components/url_formatter:url_formatter",
     "//components/viz/host",
     "//components/viz/test:test_support",
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:for_content_tests",
     "//content/browser/background_sync:background_sync_proto",
     "//content/browser/resources/media:media_internals_resources_grit",
@@ -1163,8 +1155,8 @@ test("content_browsertests") {
     "//content/public/gpu",
     "//content/public/renderer",
     "//content/renderer:for_content_tests",
+    "//content/shell:content_browsertests_mojom",
     "//content/shell:content_shell_lib",
-    "//content/shell:mojo_bindings",
     "//content/shell:pak",
     "//content/test:mojo_web_test_bindings",
     "//content/test:test_support",
@@ -1316,6 +1308,7 @@ test("content_browsertests") {
       "../browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc",
       "../browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc",
       "../browser/accessibility/ax_platform_node_win_browsertest.cc",
+      "../browser/accessibility/hit_testing_win_browsertest.cc",
       "../browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc",
       "../browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc",
       "../browser/renderer_host/direct_manipulation_test_helper_win.cc",
@@ -1429,7 +1422,6 @@ test("content_browsertests") {
   if (is_mac) {
     sources += [
       "../browser/accessibility/browser_accessibility_cocoa_browsertest.mm",
-      "../renderer/external_popup_menu_browsertest.cc",
     ]
     deps += [
       "//content/shell:content_shell",
@@ -1577,6 +1569,8 @@ test("content_unittests") {
     "../browser/appcache/mock_appcache_storage.cc",
     "../browser/appcache/mock_appcache_storage.h",
     "../browser/appcache/mock_appcache_storage_unittest.cc",
+    "../browser/appcache/test_origin_trial_policy.cc",
+    "../browser/appcache/test_origin_trial_policy.h",
     "../browser/background_fetch/background_fetch_cross_origin_filter_unittest.cc",
     "../browser/background_fetch/background_fetch_data_manager_unittest.cc",
     "../browser/background_fetch/background_fetch_delegate_proxy_unittest.cc",
@@ -1626,7 +1620,11 @@ test("content_unittests") {
     "../browser/content_index/content_index_database_unittest.cc",
     "../browser/content_index/content_index_service_impl_unittest.cc",
     "../browser/conversions/conversion_host_unittest.cc",
+    "../browser/conversions/conversion_manager_impl_unittest.cc",
+    "../browser/conversions/conversion_network_sender_impl_unittest.cc",
     "../browser/conversions/conversion_policy_unittest.cc",
+    "../browser/conversions/conversion_reporter_impl_unittest.cc",
+    "../browser/conversions/conversion_storage_delegate_impl_unittest.cc",
     "../browser/conversions/conversion_storage_sql_unittest.cc",
     "../browser/conversions/conversion_storage_unittest.cc",
     "../browser/cookie_store/cookie_store_manager_unittest.cc",
@@ -1653,7 +1651,7 @@ test("content_unittests") {
     "../browser/frame_host/navigation_entry_impl_unittest.cc",
     "../browser/frame_host/navigation_request_unittest.cc",
     "../browser/frame_host/navigation_throttle_runner_unittest.cc",
-    "../browser/frame_host/navigator_impl_unittest.cc",
+    "../browser/frame_host/navigator_unittest.cc",
     "../browser/frame_host/origin_policy_throttle_unittest.cc",
     "../browser/frame_host/render_frame_host_feature_policy_unittest.cc",
     "../browser/frame_host/render_frame_host_impl_unittest.cc",
@@ -1814,7 +1812,7 @@ test("content_unittests") {
     "../browser/renderer_host/render_widget_host_view_mac_unittest.mm",
     "../browser/renderer_host/text_input_client_mac_unittest.mm",
     "../browser/renderer_host/web_database_host_impl_unittest.cc",
-    "../browser/resolve_proxy_msg_helper_unittest.cc",
+    "../browser/resolve_proxy_helper_unittest.cc",
     "../browser/sandbox_mac_unittest.mm",
     "../browser/scheduler/browser_io_thread_delegate_unittest.cc",
     "../browser/scheduler/browser_task_executor_unittest.cc",
@@ -1828,6 +1826,7 @@ test("content_unittests") {
     "../browser/screenlock_monitor/screenlock_monitor_unittest.cc",
     "../browser/service_worker/embedded_worker_instance_unittest.cc",
     "../browser/service_worker/service_worker_cache_writer_unittest.cc",
+    "../browser/service_worker/service_worker_container_host_unittest.cc",
     "../browser/service_worker/service_worker_context_core_unittest.cc",
     "../browser/service_worker/service_worker_context_unittest.cc",
     "../browser/service_worker/service_worker_context_watcher_unittest.cc",
@@ -1837,14 +1836,13 @@ test("content_unittests") {
     "../browser/service_worker/service_worker_installed_scripts_sender_unittest.cc",
     "../browser/service_worker/service_worker_job_unittest.cc",
     "../browser/service_worker/service_worker_metrics_unittest.cc",
+    "../browser/service_worker/service_worker_navigation_loader_interceptor_unittest.cc",
     "../browser/service_worker/service_worker_navigation_loader_unittest.cc",
     "../browser/service_worker/service_worker_new_script_loader_unittest.cc",
     "../browser/service_worker/service_worker_object_host_unittest.cc",
     "../browser/service_worker/service_worker_process_manager_unittest.cc",
-    "../browser/service_worker/service_worker_provider_host_unittest.cc",
     "../browser/service_worker/service_worker_registration_unittest.cc",
     "../browser/service_worker/service_worker_registry_unittest.cc",
-    "../browser/service_worker/service_worker_request_handler_unittest.cc",
     "../browser/service_worker/service_worker_script_loader_factory_unittest.cc",
     "../browser/service_worker/service_worker_single_script_update_checker_unittest.cc",
     "../browser/service_worker/service_worker_storage_control_impl_unittest.cc",
@@ -1898,6 +1896,7 @@ test("content_unittests") {
     "../browser/worker_host/shared_worker_service_impl_unittest.cc",
     "../browser/worker_host/worker_script_fetch_initiator_unittest.cc",
     "../browser/worker_host/worker_script_loader_factory_unittest.cc",
+    "../browser/xr/metrics/session_tracker_unittest.cc",
     "../child/blink_platform_impl_unittest.cc",
     "../child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc",
     "../child/dwrite_font_proxy/font_fallback_win_unittest.cc",
@@ -1923,6 +1922,7 @@ test("content_unittests") {
     "../common/service_worker/service_worker_utils_unittest.cc",
     "../common/tab_switch_time_recorder_unittest.cc",
     "../common/unique_name_helper_unittest.cc",
+    "../common/user_agent_unittest.cc",
     "../common/webplugininfo_unittest.cc",
     "../public/browser/site_isolation_policy_unittest.cc",
 
@@ -1938,7 +1938,6 @@ test("content_unittests") {
     "../public/test/test_utils_unittest.cc",
     "../renderer/categorized_worker_pool_unittest.cc",
     "../renderer/child_frame_compositing_helper_unittest.cc",
-    "../renderer/compositor/layer_tree_view_unittest.cc",
     "../renderer/frame_swap_message_queue_unittest.cc",
     "../renderer/input/input_event_prediction_unittest.cc",
     "../renderer/input/main_thread_event_queue_unittest.cc",
@@ -1983,6 +1982,7 @@ test("content_unittests") {
   if (use_atk) {
     sources += [
       "../browser/accessibility/browser_accessibility_auralinux_unittest.cc",
+      "../browser/accessibility/browser_accessibility_manager_auralinux_unittest.cc",
     ]
     configs += [ "//build/config/linux/atk" ]
   }
@@ -2031,7 +2031,7 @@ test("content_unittests") {
     "//components/viz/host",
     "//components/viz/service",
     "//components/viz/test:test_support",
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:for_content_tests",
     "//content/browser/background_fetch:background_fetch_proto",
     "//content/browser/cache_storage:cache_storage_proto",
@@ -2112,9 +2112,9 @@ test("content_unittests") {
     "//ui/accessibility:test_support",
     "//ui/base:test_support",
     "//ui/base/clipboard:clipboard_test_support",
+    "//ui/base/cursor/mojom:cursor_type",
     "//ui/base/idle:test_support",
     "//ui/base/ime/init",
-    "//ui/base/mojom:cursor_type",
     "//ui/compositor:test_support",
     "//ui/display",
     "//ui/display:test_support",
@@ -2144,6 +2144,7 @@ test("content_unittests") {
 
   if (enable_plugins) {
     sources += [
+      "../browser/plugin_content_origin_allowlist_unittest.cc",
       "../browser/plugin_service_impl_unittest.cc",
       "../browser/renderer_host/pepper/browser_ppapi_host_test.cc",
       "../browser/renderer_host/pepper/browser_ppapi_host_test.h",
@@ -2336,6 +2337,11 @@ test("content_unittests") {
     sources += [ "../../services/service_manager/embedder/set_process_title_linux_unittest.cc" ]
     deps += [ "//services/service_manager/embedder:set_process_title_linux" ]
   }
+
+  if (enable_vr) {
+    sources += [ "../browser/xr/service/xr_runtime_manager_unittest.cc" ]
+    deps += [ "//device/vr:vr_fakes" ]
+  }
 }
 
 if (enable_nocompile_tests) {
diff --git a/chromium/content/test/fuzzer/BUILD.gn b/chromium/content/test/fuzzer/BUILD.gn
index 2f22106d1b9..4658e6e375e 100644
--- a/chromium/content/test/fuzzer/BUILD.gn
+++ b/chromium/content/test/fuzzer/BUILD.gn
@@ -150,7 +150,7 @@ fuzzer_test("appcache_fuzzer") {
   deps = [
     ":appcache_fuzzer_proto",
     "//base/test:test_support",
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:browser",
     "//content/public/browser:browser_sources",
     "//content/test:test_support",
@@ -161,42 +161,6 @@ fuzzer_test("appcache_fuzzer") {
   ]
 }
 
-# Note: this compiles and runs on Mac but may cause
-# system instability; if you try it out, close other
-# programs and then reboot afterwards. It should be
-# possible to make it work on Linux if you use the
-# --enable-speech-dispatcher flag.
-if (is_win) {
-  fuzzer_test("tts_platform_fuzzer") {
-    sources = [
-      "../../browser/speech/mock_tts_controller.cc",
-      "../../browser/speech/tts_mac.mm",
-      "../../browser/speech/tts_platform_fuzzer.cc",
-      "../../browser/speech/tts_platform_impl.cc",
-      "../../browser/speech/tts_platform_impl.h",
-      "../../browser/speech/tts_win.cc",
-      "../../public/browser/tts_controller.h",
-      "../../public/browser/tts_platform.h",
-      "//content/common/content_export.h",
-    ]
-
-    # Don't try to link the code that calls GetContentClient(), because
-    # then we'd need to link in most of //content.
-    defines = [ "NO_CONTENT_CLIENT" ]
-
-    # TODO(https://crbug.com/927728): Refactor target to not require this.
-    check_includes = false
-
-    deps = [
-      "//base",
-      "//base/test:test_support",
-      "//third_party/webrtc_overrides:webrtc_component",
-      "//ui/base",
-      "//url:url",
-    ]
-  }
-}
-
 fuzzer_test("speech_audio_encoder_fuzzer") {
   sources = [
     "../../browser/speech/audio_buffer.cc",
@@ -216,7 +180,7 @@ fuzzer_test("speech_audio_encoder_fuzzer") {
 fuzzer_test("browser_accessibility_fuzzer") {
   sources = [ "browser_accessibility_fuzzer.cc" ]
   deps = [
-    "//content/app:both_for_content_tests",
+    "//content/app:for_content_tests",
     "//content/browser:browser",
     "//content/browser:browser",
     "//content/public/browser:browser_sources",
diff --git a/chromium/content/utility/BUILD.gn b/chromium/content/utility/BUILD.gn
index 493cd749363..5f891b017a2 100644
--- a/chromium/content/utility/BUILD.gn
+++ b/chromium/content/utility/BUILD.gn
@@ -83,7 +83,7 @@ jumbo_source_set("utility") {
   }
 
   if (is_linux) {
-    deps += [ "//content/utility/soda:soda_sandbox_hook" ]
+    deps += [ "//content/utility/speech:speech_recognition_sandbox_hook" ]
   }
 
   if (enable_vr && !is_android) {
diff --git a/chromium/content/utility/services.cc b/chromium/content/utility/services.cc
index 977a53e27be..d27de48acad 100644
--- a/chromium/content/utility/services.cc
+++ b/chromium/content/utility/services.cc
@@ -49,6 +49,7 @@
 #endif
 
 #if defined(OS_WIN)
+#include "base/win/scoped_com_initializer.h"
 #include "sandbox/win/src/sandbox.h"
 
 extern sandbox::TargetServices* g_utility_target_services;
@@ -62,7 +63,7 @@ namespace {
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
 std::unique_ptr<media::CdmAuxiliaryHelper> CreateCdmHelper(
-    service_manager::mojom::InterfaceProvider* interface_provider) {
+    media::mojom::FrameInterfaceFactory* interface_provider) {
   return std::make_unique<media::MojoCdmHelper>(interface_provider);
 }
 
@@ -80,9 +81,9 @@ class ContentCdmServiceClient final : public media::CdmService::Client {
   }
 
   std::unique_ptr<media::CdmFactory> CreateCdmFactory(
-      service_manager::mojom::InterfaceProvider* host_interfaces) override {
+      media::mojom::FrameInterfaceFactory* frame_interfaces) override {
     return std::make_unique<media::CdmAdapterFactory>(
-        base::BindRepeating(&CreateCdmHelper, host_interfaces));
+        base::BindRepeating(&CreateCdmHelper, frame_interfaces));
   }
 
 #if BUILDFLAG(ENABLE_CDM_HOST_VERIFICATION)
@@ -95,6 +96,22 @@ class ContentCdmServiceClient final : public media::CdmService::Client {
 };
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
+class UtilityThreadVideoCaptureServiceImpl final
+    : public video_capture::VideoCaptureServiceImpl {
+ public:
+  explicit UtilityThreadVideoCaptureServiceImpl(
+      mojo::PendingReceiver<video_capture::mojom::VideoCaptureService> receiver,
+      scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner)
+      : VideoCaptureServiceImpl(std::move(receiver),
+                                std::move(ui_task_runner)) {}
+
+ private:
+#if defined(OS_WIN)
+  base::win::ScopedCOMInitializer com_initializer_{
+      base::win::ScopedCOMInitializer::kMTA};
+#endif
+};
+
 auto RunNetworkService(
     mojo::PendingReceiver<network::mojom::NetworkService> receiver) {
   auto binders = std::make_unique<service_manager::BinderRegistry>();
@@ -164,7 +181,7 @@ auto RunTracing(
 
 auto RunVideoCapture(
     mojo::PendingReceiver<video_capture::mojom::VideoCaptureService> receiver) {
-  return std::make_unique<video_capture::VideoCaptureServiceImpl>(
+  return std::make_unique<UtilityThreadVideoCaptureServiceImpl>(
       std::move(receiver), base::ThreadTaskRunnerHandle::Get());
 }
 
diff --git a/chromium/content/utility/soda/OWNERS b/chromium/content/utility/soda/OWNERS
deleted file mode 100644
index 97961fa525e..00000000000
--- a/chromium/content/utility/soda/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-per-file soda_sandbox_hook_linux.*=file://sandbox/linux/OWNERS
-
-# COMPONENT: Internals>Sandbox
diff --git a/chromium/content/utility/soda/BUILD.gn b/chromium/content/utility/speech/BUILD.gn
index fd62e929762..7a8ad15b25e 100644
--- a/chromium/content/utility/soda/BUILD.gn
+++ b/chromium/content/utility/speech/BUILD.gn
@@ -2,10 +2,10 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-source_set("soda_sandbox_hook") {
+source_set("speech_recognition_sandbox_hook") {
   sources = [
-    "soda_sandbox_hook_linux.cc",
-    "soda_sandbox_hook_linux.h",
+    "speech_recognition_sandbox_hook_linux.cc",
+    "speech_recognition_sandbox_hook_linux.h",
   ]
 
   deps = [
diff --git a/chromium/content/utility/soda/DEPS b/chromium/content/utility/speech/DEPS
index 4e9e1336acb..4e9e1336acb 100644
--- a/chromium/content/utility/soda/DEPS
+++ b/chromium/content/utility/speech/DEPS
diff --git a/chromium/content/utility/speech/OWNERS b/chromium/content/utility/speech/OWNERS
new file mode 100644
index 00000000000..0aa0cfce167
--- /dev/null
+++ b/chromium/content/utility/speech/OWNERS
@@ -0,0 +1,3 @@
+per-file speech_recognition_sandbox_hook_linux.*=file://sandbox/linux/OWNERS
+
+# COMPONENT: Internals>Sandbox
diff --git a/chromium/content/utility/soda/soda_sandbox_hook_linux.cc b/chromium/content/utility/speech/speech_recognition_sandbox_hook_linux.cc
index b94592d20b8..6d8e9ed2e41 100644
--- a/chromium/content/utility/soda/soda_sandbox_hook_linux.cc
+++ b/chromium/content/utility/speech/speech_recognition_sandbox_hook_linux.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/utility/soda/soda_sandbox_hook_linux.h"
+#include "content/utility/speech/speech_recognition_sandbox_hook_linux.h"
 
 #include <dlfcn.h>
 
@@ -13,10 +13,11 @@
 using sandbox::syscall_broker::BrokerFilePermission;
 using sandbox::syscall_broker::MakeBrokerCommandSet;
 
-namespace soda {
+namespace speech {
 
 namespace {
 
+// Gets the file permissions required by the Speech On-Device API (SODA).
 std::vector<BrokerFilePermission> GetSodaFilePermissions(
     base::FilePath latest_version_dir) {
   std::vector<BrokerFilePermission> permissions{
@@ -35,7 +36,8 @@ std::vector<BrokerFilePermission> GetSodaFilePermissions(
 
 }  // namespace
 
-bool SodaPreSandboxHook(service_manager::SandboxLinux::Options options) {
+bool SpeechRecognitionPreSandboxHook(
+    service_manager::SandboxLinux::Options options) {
   void* soda_library = dlopen(GetSodaBinaryPath().value().c_str(),
                               RTLD_NOW | RTLD_GLOBAL | RTLD_NODELETE);
   DCHECK(soda_library);
@@ -55,4 +57,4 @@ bool SodaPreSandboxHook(service_manager::SandboxLinux::Options options) {
   return true;
 }
 
-}  // namespace soda
+}  // namespace speech
diff --git a/chromium/content/utility/soda/soda_sandbox_hook_linux.h b/chromium/content/utility/speech/speech_recognition_sandbox_hook_linux.h
index 65efc1f6bac..7fdfd3b7436 100644
--- a/chromium/content/utility/soda/soda_sandbox_hook_linux.h
+++ b/chromium/content/utility/speech/speech_recognition_sandbox_hook_linux.h
@@ -2,17 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_UTILITY_SODA_SODA_SANDBOX_HOOK_LINUX_H_
-#define CONTENT_UTILITY_SODA_SODA_SANDBOX_HOOK_LINUX_H_
+#ifndef CONTENT_UTILITY_SPEECH_SPEECH_RECOGNITION_SANDBOX_HOOK_LINUX_H_
+#define CONTENT_UTILITY_SPEECH_SPEECH_RECOGNITION_SANDBOX_HOOK_LINUX_H_
 
 #include "services/service_manager/sandbox/linux/sandbox_linux.h"
 
-namespace soda {
+namespace speech {
 
 // Opens the libsoda.so binary and grants broker file permissions to the
 // necessary files required by the binary.
-bool SodaPreSandboxHook(service_manager::SandboxLinux::Options options);
+bool SpeechRecognitionPreSandboxHook(
+    service_manager::SandboxLinux::Options options);
 
-}  // namespace soda
+}  // namespace speech
 
-#endif  // CONTENT_UTILITY_SODA_SODA_SANDBOX_HOOK_LINUX_H_
+#endif  // CONTENT_UTILITY_SPEECH_SPEECH_RECOGNITION_SANDBOX_HOOK_LINUX_H_
diff --git a/chromium/content/utility/utility_main.cc b/chromium/content/utility/utility_main.cc
index bfd4417b6d8..58372b4a2cc 100644
--- a/chromium/content/utility/utility_main.cc
+++ b/chromium/content/utility/utility_main.cc
@@ -23,7 +23,7 @@
 #include "services/tracing/public/cpp/trace_startup.h"
 
 #if defined(OS_LINUX)
-#include "content/utility/soda/soda_sandbox_hook_linux.h"
+#include "content/utility/speech/speech_recognition_sandbox_hook_linux.h"
 #include "services/audio/audio_sandbox_hook_linux.h"
 #include "services/network/network_sandbox_hook_linux.h"
 #include "services/service_manager/sandbox/linux/sandbox_linux.h"
@@ -48,7 +48,7 @@ namespace content {
 
 // Mainline routine for running as the utility process.
 int UtilityMain(const MainFunctionParams& parameters) {
-  const base::MessagePumpType message_pump_type =
+  base::MessagePumpType message_pump_type =
       parameters.command_line.HasSwitch(switches::kMessageLoopTypeUi)
           ? base::MessagePumpType::UI
           : base::MessagePumpType::DEFAULT;
@@ -66,6 +66,12 @@ int UtilityMain(const MainFunctionParams& parameters) {
       });
 #endif
 
+#if defined(OS_FUCHSIA)
+  // On Fuchsia always use IO threads to allow FIDL calls.
+  if (message_pump_type == base::MessagePumpType::DEFAULT)
+    message_pump_type = base::MessagePumpType::IO;
+#endif  // defined(OS_FUCHSIA)
+
   // The main task executor of the utility process.
   base::SingleThreadTaskExecutor main_thread_task_executor(message_pump_type);
   base::PlatformThread::SetName("CrUtilityMain");
@@ -85,14 +91,15 @@ int UtilityMain(const MainFunctionParams& parameters) {
       sandbox_type == service_manager::SandboxType::kIme ||
 #endif  // OS_CHROMEOS
       sandbox_type == service_manager::SandboxType::kAudio ||
-      sandbox_type == service_manager::SandboxType::kSoda) {
+      sandbox_type == service_manager::SandboxType::kSpeechRecognition) {
     service_manager::SandboxLinux::PreSandboxHook pre_sandbox_hook;
     if (sandbox_type == service_manager::SandboxType::kNetwork)
       pre_sandbox_hook = base::BindOnce(&network::NetworkPreSandboxHook);
     else if (sandbox_type == service_manager::SandboxType::kAudio)
       pre_sandbox_hook = base::BindOnce(&audio::AudioPreSandboxHook);
-    else if (sandbox_type == service_manager::SandboxType::kSoda)
-      pre_sandbox_hook = base::BindOnce(&soda::SodaPreSandboxHook);
+    else if (sandbox_type == service_manager::SandboxType::kSpeechRecognition)
+      pre_sandbox_hook =
+          base::BindOnce(&speech::SpeechRecognitionPreSandboxHook);
 #if defined(OS_CHROMEOS)
     else if (sandbox_type == service_manager::SandboxType::kIme)
       pre_sandbox_hook = base::BindOnce(&chromeos::ime::ImePreSandboxHook);
diff --git a/chromium/content/zygote/zygote_browsertest.cc b/chromium/content/zygote/zygote_browsertest.cc
index 31f89097783..4f0de6ce3a4 100644
--- a/chromium/content/zygote/zygote_browsertest.cc
+++ b/chromium/content/zygote/zygote_browsertest.cc
@@ -8,6 +8,7 @@
 #include "base/command_line.h"
 #include "base/strings/string_split.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"