BASELINE: Update Chromium to 60.0.3112.70

Change-Id: I9911c2280a014d4632f254857876a395d4baed2d
Reviewed-by: Alexandru Croitor <alexandru.croitor@qt.io>

28 files changed, 416 insertions, 193 deletions

diff --git a/chromium/ipc/BUILD.gn b/chromium/ipc/BUILD.gn
index 7c60bb18dd1..a3aaaa3e990 100644
--- a/chromium/ipc/BUILD.gn
+++ b/chromium/ipc/BUILD.gn
@@ -2,11 +2,23 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/buildflag_header.gni")
 import("//build/config/nacl/config.gni")
 import("//mojo/public/tools/bindings/mojom.gni")
 import("//testing/test.gni")
 import("//tools/ipc_fuzzer/ipc_fuzzer.gni")
 
+declare_args() {
+  # Enabling debug builds automatically sets enable_ipc_logging to true.
+  enable_ipc_logging = is_debug
+}
+
+buildflag_header("ipc_features") {
+  header = "ipc_features.h"
+
+  flags = [ "IPC_MESSAGE_LOG_ENABLED=$enable_ipc_logging" ]
+}
+
 component("ipc") {
   sources = [
     "export_template.h",
@@ -96,6 +108,7 @@ component("ipc") {
   defines = [ "IPC_IMPLEMENTATION" ]
 
   public_deps = [
+    ":ipc_features",
     ":mojom",
     ":param_traits",
     "//mojo/public/cpp/bindings",
@@ -116,13 +129,12 @@ component("ipc") {
   }
 }
 
-mojom("mojom") {
+mojom_component("mojom") {
+  output_prefix = "ipc_mojom"
+  macro_prefix = "IPC_MOJOM"
   sources = [
     "ipc.mojom",
   ]
-  export_class_attribute = "IPC_EXPORT"
-  export_define = "IPC_IMPLEMENTATION"
-  export_header = "ipc/ipc_export.h"
 }
 
 mojom("test_interfaces") {
@@ -130,6 +142,9 @@ mojom("test_interfaces") {
   sources = [
     "ipc_test.mojom",
   ]
+
+  # TODO(crbug.com/714018): Convert the implementation to use OnceCallback.
+  use_once_callback = false
 }
 
 # This is provided as a separate target so other targets can provide param
diff --git a/chromium/ipc/ipc_channel.h b/chromium/ipc/ipc_channel.h
index 527c949349c..25eac166c7e 100644
--- a/chromium/ipc/ipc_channel.h
+++ b/chromium/ipc/ipc_channel.h
@@ -133,9 +133,8 @@ class IPC_EXPORT Channel : public Sender {
     static void BindAssociatedInterfaceRequest(
         const AssociatedInterfaceFactory<Interface>& factory,
         mojo::ScopedInterfaceEndpointHandle handle) {
-      mojo::AssociatedInterfaceRequest<Interface> request;
-      request.Bind(std::move(handle));
-      factory.Run(std::move(request));
+      factory.Run(
+          mojo::AssociatedInterfaceRequest<Interface>(std::move(handle)));
     }
   };
 
diff --git a/chromium/ipc/ipc_channel_mojo.cc b/chromium/ipc/ipc_channel_mojo.cc
index ab376f4bdc4..ba6b8edfe9e 100644
--- a/chromium/ipc/ipc_channel_mojo.cc
+++ b/chromium/ipc/ipc_channel_mojo.cc
@@ -282,7 +282,7 @@ ChannelMojo::ChannelMojo(
 }
 
 void ChannelMojo::ForwardMessageFromThreadSafePtr(mojo::Message message) {
-  DCHECK(task_runner_->RunsTasksOnCurrentThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessage(
@@ -292,7 +292,7 @@ void ChannelMojo::ForwardMessageFromThreadSafePtr(mojo::Message message) {
 void ChannelMojo::ForwardMessageWithResponderFromThreadSafePtr(
     mojo::Message message,
     std::unique_ptr<mojo::MessageReceiver> responder) {
-  DCHECK(task_runner_->RunsTasksOnCurrentThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   if (!message_reader_ || !message_reader_->sender().is_bound())
     return;
   message_reader_->sender().internal_state()->ForwardMessageWithResponder(
@@ -300,12 +300,12 @@ void ChannelMojo::ForwardMessageWithResponderFromThreadSafePtr(
 }
 
 ChannelMojo::~ChannelMojo() {
-  DCHECK(task_runner_->RunsTasksOnCurrentThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   Close();
 }
 
 bool ChannelMojo::Connect() {
-  DCHECK(task_runner_->RunsTasksOnCurrentThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
 
   WillConnect();
 
@@ -347,7 +347,7 @@ void ChannelMojo::Close() {
 
 void ChannelMojo::OnPipeError() {
   DCHECK(task_runner_);
-  if (task_runner_->RunsTasksOnCurrentThread()) {
+  if (task_runner_->RunsTasksInCurrentSequence()) {
     listener_->OnChannelError();
   } else {
     task_runner_->PostTask(
diff --git a/chromium/ipc/ipc_channel_mojo_unittest.cc b/chromium/ipc/ipc_channel_mojo_unittest.cc
index a4abb3218ef..f3499b794c1 100644
--- a/chromium/ipc/ipc_channel_mojo_unittest.cc
+++ b/chromium/ipc/ipc_channel_mojo_unittest.cc
@@ -724,9 +724,8 @@ class ListenerWithSimpleProxyAssociatedInterface
       const std::string& interface_name,
       mojo::ScopedInterfaceEndpointHandle handle) override {
     DCHECK_EQ(interface_name, IPC::mojom::SimpleTestDriver::Name_);
-    IPC::mojom::SimpleTestDriverAssociatedRequest request;
-    request.Bind(std::move(handle));
-    binding_.Bind(std::move(request));
+    binding_.Bind(
+        IPC::mojom::SimpleTestDriverAssociatedRequest(std::move(handle)));
   }
 
   bool received_all_messages() const {
@@ -856,9 +855,8 @@ class ListenerWithIndirectProxyAssociatedInterface
       mojo::ScopedInterfaceEndpointHandle handle) override {
     DCHECK(!driver_binding_.is_bound());
     DCHECK_EQ(interface_name, IPC::mojom::IndirectTestDriver::Name_);
-    IPC::mojom::IndirectTestDriverAssociatedRequest request;
-    request.Bind(std::move(handle));
-    driver_binding_.Bind(std::move(request));
+    driver_binding_.Bind(
+        IPC::mojom::IndirectTestDriverAssociatedRequest(std::move(handle)));
   }
 
   void set_ping_handler(const base::Closure& handler) {
@@ -986,10 +984,8 @@ class ListenerWithSyncAssociatedInterface
       mojo::ScopedInterfaceEndpointHandle handle) override {
     DCHECK(!binding_.is_bound());
     DCHECK_EQ(interface_name, IPC::mojom::SimpleTestDriver::Name_);
-
-    IPC::mojom::SimpleTestDriverAssociatedRequest request;
-    request.Bind(std::move(handle));
-    binding_.Bind(std::move(request));
+    binding_.Bind(
+        IPC::mojom::SimpleTestDriverAssociatedRequest(std::move(handle)));
   }
 
   void BindRequest(IPC::mojom::SimpleTestDriverAssociatedRequest request) {
@@ -1122,9 +1118,8 @@ class SimpleTestClientImpl : public IPC::mojom::SimpleTestClient,
     DCHECK(!binding_.is_bound());
     DCHECK_EQ(interface_name, IPC::mojom::SimpleTestClient::Name_);
 
-    IPC::mojom::SimpleTestClientAssociatedRequest request;
-    request.Bind(std::move(handle));
-    binding_.Bind(std::move(request));
+    binding_.Bind(
+        IPC::mojom::SimpleTestClientAssociatedRequest(std::move(handle)));
   }
 
   bool use_sync_sender_ = false;
diff --git a/chromium/ipc/ipc_channel_nacl.cc b/chromium/ipc/ipc_channel_nacl.cc
index 17b680ed37a..b95f8cb5453 100644
--- a/chromium/ipc/ipc_channel_nacl.cc
+++ b/chromium/ipc/ipc_channel_nacl.cc
@@ -199,9 +199,9 @@ bool ChannelNacl::Send(Message* message) {
            << " with type " << message->type();
   std::unique_ptr<Message> message_ptr(message);
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   Logging::GetInstance()->OnSendMessage(message_ptr.get());
-#endif  // IPC_MESSAGE_LOG_ENABLED
+#endif  // BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
   TRACE_EVENT_WITH_FLOW0(TRACE_DISABLED_BY_DEFAULT("ipc.flow"),
                          "ChannelNacl::Send",
diff --git a/chromium/ipc/ipc_channel_proxy.cc b/chromium/ipc/ipc_channel_proxy.cc
index ef1c0b22725..616a99404cc 100644
--- a/chromium/ipc/ipc_channel_proxy.cc
+++ b/chromium/ipc/ipc_channel_proxy.cc
@@ -78,7 +78,7 @@ void ChannelProxy::Context::CreateChannel(
 
 bool ChannelProxy::Context::TryFilters(const Message& message) {
   DCHECK(message_filter_router_);
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   Logging* logger = Logging::GetInstance();
   if (logger->Enabled())
     logger->OnPreDispatchMessage(message);
@@ -89,7 +89,7 @@ bool ChannelProxy::Context::TryFilters(const Message& message) {
       listener_task_runner_->PostTask(
           FROM_HERE, base::Bind(&Context::OnDispatchBadMessage, this, message));
     }
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
     if (logger->Enabled())
       logger->OnPostDispatchMessage(message);
 #endif
@@ -315,7 +315,7 @@ void ChannelProxy::Context::OnDispatchMessage(const Message& message) {
 
   OnDispatchConnected();
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   Logging* logger = Logging::GetInstance();
   if (message.type() == IPC_LOGGING_ID) {
     logger->OnReceivedLoggingMessage(message);
@@ -330,7 +330,7 @@ void ChannelProxy::Context::OnDispatchMessage(const Message& message) {
   if (message.dispatch_error())
     listener_->OnBadMessageReceived(message);
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   if (logger->Enabled())
     logger->OnPostDispatchMessage(message);
 #endif
@@ -530,7 +530,7 @@ bool ChannelProxy::Send(Message* message) {
     message = outgoing_message_filter()->Rewrite(message);
 #endif
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   Logging::GetInstance()->OnSendMessage(message);
 #endif
 
@@ -562,10 +562,8 @@ void ChannelProxy::GetGenericRemoteAssociatedInterface(
     const std::string& name,
     mojo::ScopedInterfaceEndpointHandle handle) {
   DCHECK(did_init_);
-  mojom::GenericInterfaceAssociatedRequest request;
-  request.Bind(std::move(handle));
-  context()->thread_safe_channel().GetAssociatedInterface(name,
-                                                          std::move(request));
+  context()->thread_safe_channel().GetAssociatedInterface(
+      name, mojom::GenericInterfaceAssociatedRequest(std::move(handle)));
 }
 
 void ChannelProxy::ClearIPCTaskRunner() {
diff --git a/chromium/ipc/ipc_channel_proxy.h b/chromium/ipc/ipc_channel_proxy.h
index 37b6419f025..2825226e9c7 100644
--- a/chromium/ipc/ipc_channel_proxy.h
+++ b/chromium/ipc/ipc_channel_proxy.h
@@ -387,9 +387,7 @@ class IPC_EXPORT ChannelProxy : public Sender, public base::NonThreadSafe {
   static void BindAssociatedInterfaceRequest(
       const AssociatedInterfaceFactory<Interface>& factory,
       mojo::ScopedInterfaceEndpointHandle handle) {
-    mojo::AssociatedInterfaceRequest<Interface> request;
-    request.Bind(std::move(handle));
-    factory.Run(std::move(request));
+    factory.Run(mojo::AssociatedInterfaceRequest<Interface>(std::move(handle)));
   }
 
   // Always called once immediately after Init.
diff --git a/chromium/ipc/ipc_channel_proxy_unittest.cc b/chromium/ipc/ipc_channel_proxy_unittest.cc
index befbf52436a..f0590999e82 100644
--- a/chromium/ipc/ipc_channel_proxy_unittest.cc
+++ b/chromium/ipc/ipc_channel_proxy_unittest.cc
@@ -8,6 +8,7 @@
 #include <stdint.h>
 #include <memory>
 
+#include "base/message_loop/message_loop.h"
 #include "base/pickle.h"
 #include "base/run_loop.h"
 #include "base/threading/thread.h"
diff --git a/chromium/ipc/ipc_channel_reader.cc b/chromium/ipc/ipc_channel_reader.cc
index fa26734c314..e999028a6f3 100644
--- a/chromium/ipc/ipc_channel_reader.cc
+++ b/chromium/ipc/ipc_channel_reader.cc
@@ -20,7 +20,7 @@
 namespace IPC {
 namespace internal {
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
 namespace {
 std::string GetMessageText(const Message& message) {
@@ -42,7 +42,7 @@ std::string GetMessageText(const Message& message) {
                          (message).flags(), TRACE_EVENT_FLAG_FLOW_IN, "class", \
                          IPC_MESSAGE_ID_CLASS((message).type()), "line",       \
                          IPC_MESSAGE_ID_LINE((message).type()));
-#endif  // IPC_MESSAGE_LOG_ENABLED
+#endif  // BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
 ChannelReader::ChannelReader(Listener* listener)
   : listener_(listener),
diff --git a/chromium/ipc/ipc_logging.cc b/chromium/ipc/ipc_logging.cc
index af532cd318e..aad1b73326a 100644
--- a/chromium/ipc/ipc_logging.cc
+++ b/chromium/ipc/ipc_logging.cc
@@ -4,7 +4,7 @@
 
 #include "ipc/ipc_logging.h"
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 #define IPC_MESSAGE_MACROS_LOG_ENABLED
 #endif
 
@@ -31,7 +31,7 @@
 #include <unistd.h>
 #endif
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
 using base::Time;
 
@@ -310,4 +310,4 @@ void GenerateLogData(const Message& message, LogData* data, bool get_params) {
 
 }
 
-#endif  // IPC_MESSAGE_LOG_ENABLED
+#endif  // BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
diff --git a/chromium/ipc/ipc_logging.h b/chromium/ipc/ipc_logging.h
index af490f0c91e..929f55e50a9 100644
--- a/chromium/ipc/ipc_logging.h
+++ b/chromium/ipc/ipc_logging.h
@@ -5,12 +5,11 @@
 #ifndef IPC_IPC_LOGGING_H_
 #define IPC_IPC_LOGGING_H_
 
-#include <stdint.h>
-
-#include "ipc/ipc_message.h"  // For IPC_MESSAGE_LOG_ENABLED.
+#include "ipc/ipc_features.h"
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
+#include <stdint.h>
 #include <vector>
 
 #include "base/containers/hash_tables.h"
@@ -18,6 +17,7 @@
 #include "base/memory/singleton.h"
 #include "base/single_thread_task_runner.h"
 #include "ipc/ipc_export.h"
+#include "ipc/ipc_message.h"
 
 // Logging function. |name| is a string in ASCII and |params| is a string in
 // UTF-8.
@@ -123,6 +123,6 @@ class IPC_EXPORT Logging {
 
 }  // namespace IPC
 
-#endif // IPC_MESSAGE_LOG_ENABLED
+#endif  // BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
 #endif  // IPC_IPC_LOGGING_H_
diff --git a/chromium/ipc/ipc_message.cc b/chromium/ipc/ipc_message.cc
index f5e9ac7a8b8..f66b4fe882c 100644
--- a/chromium/ipc/ipc_message.cc
+++ b/chromium/ipc/ipc_message.cc
@@ -82,7 +82,7 @@ Message::Message(const Message& other) : base::Pickle(other) {
 
 void Message::Init() {
   dispatch_error_ = false;
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   received_time_ = 0;
   dont_log_ = false;
   log_data_ = NULL;
@@ -109,7 +109,7 @@ void Message::EnsureMessageAttachmentSet() {
     attachment_set_ = new MessageAttachmentSet;
 }
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 void Message::set_sent_time(int64_t time) {
   DCHECK((header()->flags & HAS_SENT_TIME_BIT) == 0);
   header()->flags |= HAS_SENT_TIME_BIT;
@@ -128,7 +128,7 @@ int64_t Message::sent_time() const {
 void Message::set_received_time(int64_t time) const {
   received_time_ = time;
 }
-#endif
+#endif  // BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 
 Message::NextMessageInfo::NextMessageInfo()
     : message_size(0), message_found(false), pickle_end(nullptr),
diff --git a/chromium/ipc/ipc_message.h b/chromium/ipc/ipc_message.h
index 43e9ae39c13..3ca75482b18 100644
--- a/chromium/ipc/ipc_message.h
+++ b/chromium/ipc/ipc_message.h
@@ -16,10 +16,7 @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "ipc/ipc_export.h"
-
-#if !defined(NDEBUG)
-#define IPC_MESSAGE_LOG_ENABLED
-#endif
+#include "ipc/ipc_features.h"
 
 namespace IPC {
 
@@ -207,7 +204,7 @@ class IPC_EXPORT Message : public base::Pickle {
   // Returns true if there are any attachment in this message.
   bool HasAttachments() const override;
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   // Adds the outgoing time from Time::Now() at the end of the message and sets
   // a bit to indicate that it's been added.
   void set_sent_time(int64_t time);
@@ -275,7 +272,7 @@ class IPC_EXPORT Message : public base::Pickle {
     return attachment_set_.get();
   }
 
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   // Used for logging.
   mutable int64_t received_time_;
   mutable std::string output_params_;
diff --git a/chromium/ipc/ipc_message_pipe_reader.cc b/chromium/ipc/ipc_message_pipe_reader.cc
index 32c7c242eeb..cd174a25393 100644
--- a/chromium/ipc/ipc_message_pipe_reader.cc
+++ b/chromium/ipc/ipc_message_pipe_reader.cc
@@ -79,9 +79,8 @@ void MessagePipeReader::GetRemoteInterface(
     mojo::ScopedInterfaceEndpointHandle handle) {
   if (!sender_.is_bound())
     return;
-  mojom::GenericInterfaceAssociatedRequest request;
-  request.Bind(std::move(handle));
-  sender_->GetAssociatedInterface(name, std::move(request));
+  sender_->GetAssociatedInterface(
+      name, mojom::GenericInterfaceAssociatedRequest(std::move(handle)));
 }
 
 void MessagePipeReader::SetPeerPid(int32_t peer_pid) {
diff --git a/chromium/ipc/ipc_message_start.h b/chromium/ipc/ipc_message_start.h
index e3d59a3aa89..e3fda0e957c 100644
--- a/chromium/ipc/ipc_message_start.h
+++ b/chromium/ipc/ipc_message_start.h
@@ -108,7 +108,6 @@ enum IPCMessageStart {
   AttachmentBrokerMsgStart,
   RenderProcessMsgStart,
   PageLoadMetricsMsgStart,
-  MemoryMsgStart,
   IPCTestMsgStart,
   ArcInstanceMsgStart,
   ArcInstanceHostMsgStart,
diff --git a/chromium/ipc/ipc_message_unittest.cc b/chromium/ipc/ipc_message_unittest.cc
index 1bf52d8f9d2..8e59e00c859 100644
--- a/chromium/ipc/ipc_message_unittest.cc
+++ b/chromium/ipc/ipc_message_unittest.cc
@@ -66,9 +66,9 @@ TEST(IPCMessageTest, BasicMessageTest) {
 
 TEST(IPCMessageTest, ListValue) {
   base::ListValue input;
-  input.Set(0, new base::Value(42.42));
-  input.Set(1, new base::Value("forty"));
-  input.Set(2, base::MakeUnique<base::Value>());
+  input.AppendDouble(42.42);
+  input.AppendString("forty");
+  input.Append(base::MakeUnique<base::Value>());
 
   IPC::Message msg(1, 2, IPC::Message::PRIORITY_NORMAL);
   IPC::WriteParam(&msg, input);
@@ -91,16 +91,16 @@ TEST(IPCMessageTest, DictionaryValue) {
   input.Set("null", base::MakeUnique<base::Value>());
   input.Set("bool", new base::Value(true));
   input.Set("int", new base::Value(42));
-  input.SetWithoutPathExpansion("int.with.dot", new base::Value(43));
+  input.SetIntegerWithoutPathExpansion("int.with.dot", 43);
 
   std::unique_ptr<base::DictionaryValue> subdict(new base::DictionaryValue());
   subdict->Set("str", new base::Value("forty two"));
   subdict->Set("bool", new base::Value(false));
 
   std::unique_ptr<base::ListValue> sublist(new base::ListValue());
-  sublist->Set(0, new base::Value(42.42));
-  sublist->Set(1, new base::Value("forty"));
-  sublist->Set(2, new base::Value("two"));
+  sublist->AppendDouble(42.42);
+  sublist->AppendString("forty");
+  sublist->AppendString("two");
   subdict->Set("list", sublist.release());
 
   input.Set("dict", subdict.release());
diff --git a/chromium/ipc/ipc_message_utils.cc b/chromium/ipc/ipc_message_utils.cc
index 23cfd1339b5..8179cd4dfb2 100644
--- a/chromium/ipc/ipc_message_utils.cc
+++ b/chromium/ipc/ipc_message_utils.cc
@@ -9,6 +9,8 @@
 
 #include "base/files/file_path.h"
 #include "base/json/json_writer.h"
+#include "base/memory/ptr_util.h"
+#include "base/memory/shared_memory_handle.h"
 #include "base/strings/nullable_string16.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -26,10 +28,6 @@
 #include "ipc/ipc_platform_file_attachment_posix.h"
 #endif
 
-#if (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
-#include "base/memory/shared_memory_handle.h"
-#endif  // (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
-
 #if defined(OS_MACOSX) && !defined(OS_IOS)
 #include "ipc/mach_port_mac.h"
 #endif
@@ -37,6 +35,7 @@
 #if defined(OS_WIN)
 #include <tchar.h>
 #include "ipc/handle_win.h"
+#include "ipc/ipc_platform_file.h"
 #endif
 
 namespace IPC {
@@ -71,7 +70,7 @@ void LogBytes(const std::vector<CharType>& data, std::string* out) {
 
 bool ReadValue(const base::Pickle* m,
                base::PickleIterator* iter,
-               base::Value** value,
+               std::unique_ptr<base::Value>* value,
                int recursion);
 
 void GetValueSize(base::PickleSizer* sizer,
@@ -110,7 +109,7 @@ void GetValueSize(base::PickleSizer* sizer,
       break;
     }
     case base::Value::Type::BINARY: {
-      sizer->AddData(static_cast<int>(value->GetSize()));
+      sizer->AddData(static_cast<int>(value->GetBlob().size()));
       break;
     }
     case base::Value::Type::DICTIONARY: {
@@ -178,7 +177,8 @@ void WriteValue(base::Pickle* m, const base::Value* value, int recursion) {
       break;
     }
     case base::Value::Type::BINARY: {
-      m->WriteData(value->GetBuffer(), static_cast<int>(value->GetSize()));
+      m->WriteData(value->GetBlob().data(),
+                   static_cast<int>(value->GetBlob().size()));
       break;
     }
     case base::Value::Type::DICTIONARY: {
@@ -217,11 +217,11 @@ bool ReadDictionaryValue(const base::Pickle* m,
 
   for (int i = 0; i < size; ++i) {
     std::string key;
-    base::Value* subval;
+    std::unique_ptr<base::Value> subval;
     if (!ReadParam(m, iter, &key) ||
         !ReadValue(m, iter, &subval, recursion + 1))
       return false;
-    value->SetWithoutPathExpansion(key, subval);
+    value->SetWithoutPathExpansion(key, std::move(subval));
   }
 
   return true;
@@ -238,10 +238,10 @@ bool ReadListValue(const base::Pickle* m,
     return false;
 
   for (int i = 0; i < size; ++i) {
-    base::Value* subval;
+    std::unique_ptr<base::Value> subval;
     if (!ReadValue(m, iter, &subval, recursion + 1))
       return false;
-    value->Set(i, subval);
+    value->Set(i, std::move(subval));
   }
 
   return true;
@@ -249,7 +249,7 @@ bool ReadListValue(const base::Pickle* m,
 
 bool ReadValue(const base::Pickle* m,
                base::PickleIterator* iter,
-               base::Value** value,
+               std::unique_ptr<base::Value>* value,
                int recursion) {
   if (recursion > kMaxRecursionDepth) {
     LOG(ERROR) << "Max recursion depth hit in ReadValue.";
@@ -262,34 +262,34 @@ bool ReadValue(const base::Pickle* m,
 
   switch (static_cast<base::Value::Type>(type)) {
     case base::Value::Type::NONE:
-      *value = new base::Value();
+      *value = base::MakeUnique<base::Value>();
       break;
     case base::Value::Type::BOOLEAN: {
       bool val;
       if (!ReadParam(m, iter, &val))
         return false;
-      *value = new base::Value(val);
+      *value = base::MakeUnique<base::Value>(val);
       break;
     }
     case base::Value::Type::INTEGER: {
       int val;
       if (!ReadParam(m, iter, &val))
         return false;
-      *value = new base::Value(val);
+      *value = base::MakeUnique<base::Value>(val);
       break;
     }
     case base::Value::Type::DOUBLE: {
       double val;
       if (!ReadParam(m, iter, &val))
         return false;
-      *value = new base::Value(val);
+      *value = base::MakeUnique<base::Value>(val);
       break;
     }
     case base::Value::Type::STRING: {
       std::string val;
       if (!ReadParam(m, iter, &val))
         return false;
-      *value = new base::Value(val);
+      *value = base::MakeUnique<base::Value>(std::move(val));
       break;
     }
     case base::Value::Type::BINARY: {
@@ -297,23 +297,21 @@ bool ReadValue(const base::Pickle* m,
       int length;
       if (!iter->ReadData(&data, &length))
         return false;
-      std::unique_ptr<base::Value> val =
-          base::Value::CreateWithCopiedBuffer(data, length);
-      *value = val.release();
+      *value = base::Value::CreateWithCopiedBuffer(data, length);
       break;
     }
     case base::Value::Type::DICTIONARY: {
-      std::unique_ptr<base::DictionaryValue> val(new base::DictionaryValue());
-      if (!ReadDictionaryValue(m, iter, val.get(), recursion))
+      base::DictionaryValue val;
+      if (!ReadDictionaryValue(m, iter, &val, recursion))
         return false;
-      *value = val.release();
+      *value = base::MakeUnique<base::Value>(std::move(val));
       break;
     }
     case base::Value::Type::LIST: {
-      std::unique_ptr<base::ListValue> val(new base::ListValue());
-      if (!ReadListValue(m, iter, val.get(), recursion))
+      base::ListValue val;
+      if (!ReadListValue(m, iter, &val, recursion))
         return false;
-      *value = val.release();
+      *value = base::MakeUnique<base::Value>(std::move(val));
       break;
     }
     default:
@@ -622,6 +620,8 @@ void ParamTraits<base::FileDescriptor>::GetSize(base::PickleSizer* sizer,
 
 void ParamTraits<base::FileDescriptor>::Write(base::Pickle* m,
                                               const param_type& p) {
+  // This serialization must be kept in sync with
+  // nacl_message_scanner.cc:WriteHandle().
   const bool valid = p.fd >= 0;
   WriteParam(m, valid);
 
@@ -647,7 +647,6 @@ bool ParamTraits<base::FileDescriptor>::Read(const base::Pickle* m,
   if (!ReadParam(m, iter, &valid))
     return false;
 
-  // TODO(morrita): Seems like this should return false.
   if (!valid)
     return true;
 
@@ -677,111 +676,178 @@ void ParamTraits<base::FileDescriptor>::Log(const param_type& p,
 }
 #endif  // defined(OS_POSIX)
 
-#if defined(OS_MACOSX) && !defined(OS_IOS)
 void ParamTraits<base::SharedMemoryHandle>::GetSize(base::PickleSizer* sizer,
                                                     const param_type& p) {
+  GetParamSize(sizer, p.IsValid());
+  if (!p.IsValid())
+    return;
+
+#if defined(OS_MACOSX) && !defined(OS_IOS)
   GetParamSize(sizer, p.GetMemoryObject());
-  uint32_t dummy = 0;
-  GetParamSize(sizer, dummy);
+#elif defined(OS_WIN)
+  GetParamSize(sizer, p.GetHandle());
+#else
+  sizer->AddAttachment();
+#endif
+
+  GetParamSize(sizer, p.GetGUID());
+  GetParamSize(sizer, static_cast<uint64_t>(p.GetSize()));
 }
 
 void ParamTraits<base::SharedMemoryHandle>::Write(base::Pickle* m,
                                                   const param_type& p) {
+  // This serialization must be kept in sync with
+  // nacl_message_scanner.cc:WriteHandle().
+  const bool valid = p.IsValid();
+  WriteParam(m, valid);
+
+  if (!valid)
+    return;
+
+#if defined(OS_MACOSX) && !defined(OS_IOS)
   MachPortMac mach_port_mac(p.GetMemoryObject());
-  ParamTraits<MachPortMac>::Write(m, mach_port_mac);
-  size_t size = 0;
-  bool result = p.GetSize(&size);
-  DCHECK(result);
-  ParamTraits<uint32_t>::Write(m, static_cast<uint32_t>(size));
+  WriteParam(m, mach_port_mac);
+#elif defined(OS_WIN)
+  HandleWin handle_win(p.GetHandle(), HandleWin::DUPLICATE);
+  WriteParam(m, handle_win);
+#else
+  if (p.OwnershipPassesToIPC()) {
+    if (!m->WriteAttachment(new internal::PlatformFileAttachment(
+            base::ScopedFD(p.GetHandle()))))
+      NOTREACHED();
+  } else {
+    if (!m->WriteAttachment(
+            new internal::PlatformFileAttachment(p.GetHandle())))
+      NOTREACHED();
+  }
+#endif
 
+#if (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
   // If the caller intended to pass ownership to the IPC stack, release a
   // reference.
   if (p.OwnershipPassesToIPC())
     p.Close();
+#endif
+
+  DCHECK(!p.GetGUID().is_empty());
+  WriteParam(m, p.GetGUID());
+  WriteParam(m, static_cast<uint64_t>(p.GetSize()));
 }
 
 bool ParamTraits<base::SharedMemoryHandle>::Read(const base::Pickle* m,
                                                  base::PickleIterator* iter,
                                                  param_type* r) {
+  *r = base::SharedMemoryHandle();
+
+  bool valid;
+  if (!ReadParam(m, iter, &valid))
+    return false;
+  if (!valid)
+    return true;
+
+#if defined(OS_MACOSX) && !defined(OS_IOS)
   MachPortMac mach_port_mac;
-  if (!ParamTraits<MachPortMac>::Read(m, iter, &mach_port_mac))
+  if (!ReadParam(m, iter, &mach_port_mac))
+    return false;
+#elif defined(OS_WIN)
+  HandleWin handle_win;
+  if (!ReadParam(m, iter, &handle_win))
+    return false;
+#else
+  scoped_refptr<base::Pickle::Attachment> attachment;
+  if (!m->ReadAttachment(iter, &attachment))
     return false;
 
-  uint32_t size;
-  if (!ParamTraits<uint32_t>::Read(m, iter, &size))
+  if (static_cast<MessageAttachment*>(attachment.get())->GetType() !=
+      MessageAttachment::Type::PLATFORM_FILE) {
     return false;
+  }
+#endif
 
+  base::UnguessableToken guid;
+  uint64_t size;
+  if (!ReadParam(m, iter, &guid) || !ReadParam(m, iter, &size)) {
+    return false;
+  }
+
+#if defined(OS_MACOSX) && !defined(OS_IOS)
   *r = base::SharedMemoryHandle(mach_port_mac.get_mach_port(),
-                                static_cast<size_t>(size),
-                                base::GetCurrentProcId());
+                                static_cast<size_t>(size), guid);
+#elif defined(OS_WIN)
+  *r = base::SharedMemoryHandle(handle_win.get_handle(),
+                                static_cast<size_t>(size), guid);
+#else
+  *r = base::SharedMemoryHandle(
+      base::FileDescriptor(
+          static_cast<internal::PlatformFileAttachment*>(attachment.get())
+              ->TakePlatformFile(),
+          true),
+      static_cast<size_t>(size), guid);
+#endif
+
   return true;
 }
 
 void ParamTraits<base::SharedMemoryHandle>::Log(const param_type& p,
                                                 std::string* l) {
+#if defined(OS_MACOSX) && !defined(OS_IOS)
   l->append("Mach port: ");
   LogParam(p.GetMemoryObject(), l);
-}
-
 #elif defined(OS_WIN)
-void ParamTraits<base::SharedMemoryHandle>::GetSize(base::PickleSizer* s,
-                                                    const param_type& p) {
-  GetParamSize(s, p.NeedsBrokering());
-  if (p.NeedsBrokering()) {
-    GetParamSize(s, p.GetHandle());
-  } else {
-    GetParamSize(s, HandleToLong(p.GetHandle()));
-  }
+  l->append("HANDLE: ");
+  LogParam(p.GetHandle(), l);
+#else
+  l->append("FD: ");
+  LogParam(p.GetHandle(), l);
+#endif
+
+  l->append("GUID: ");
+  LogParam(p.GetGUID(), l);
+  l->append("size: ");
+  LogParam(static_cast<uint64_t>(p.GetSize()), l);
 }
 
-void ParamTraits<base::SharedMemoryHandle>::Write(base::Pickle* m,
+#if defined(OS_WIN)
+void ParamTraits<PlatformFileForTransit>::GetSize(base::PickleSizer* s,
                                                   const param_type& p) {
-  m->WriteBool(p.NeedsBrokering());
+  GetParamSize(s, p.IsValid());
+  if (p.IsValid())
+    GetParamSize(s, p.GetHandle());
+}
 
-  if (p.NeedsBrokering()) {
+void ParamTraits<PlatformFileForTransit>::Write(base::Pickle* m,
+                                                const param_type& p) {
+  m->WriteBool(p.IsValid());
+  if (p.IsValid()) {
     HandleWin handle_win(p.GetHandle(), HandleWin::DUPLICATE);
     ParamTraits<HandleWin>::Write(m, handle_win);
-
-    // If the caller intended to pass ownership to the IPC stack, release a
-    // reference.
-    if (p.OwnershipPassesToIPC() && p.BelongsToCurrentProcess())
-      p.Close();
-  } else {
-    m->WriteInt(HandleToLong(p.GetHandle()));
+    ::CloseHandle(p.GetHandle());
   }
 }
 
-bool ParamTraits<base::SharedMemoryHandle>::Read(const base::Pickle* m,
-                                                 base::PickleIterator* iter,
-                                                 param_type* r) {
-  bool needs_brokering;
-  if (!iter->ReadBool(&needs_brokering))
+bool ParamTraits<PlatformFileForTransit>::Read(const base::Pickle* m,
+                                               base::PickleIterator* iter,
+                                               param_type* r) {
+  bool is_valid;
+  if (!iter->ReadBool(&is_valid))
     return false;
-
-  if (needs_brokering) {
-    HandleWin handle_win;
-    if (!ParamTraits<HandleWin>::Read(m, iter, &handle_win))
-      return false;
-    *r = base::SharedMemoryHandle(handle_win.get_handle(),
-                                  base::GetCurrentProcId());
+  if (!is_valid) {
+    *r = PlatformFileForTransit();
     return true;
   }
 
-  int handle_int;
-  if (!iter->ReadInt(&handle_int))
+  HandleWin handle_win;
+  if (!ParamTraits<HandleWin>::Read(m, iter, &handle_win))
     return false;
-  HANDLE handle = LongToHandle(handle_int);
-  *r = base::SharedMemoryHandle(handle, base::GetCurrentProcId());
+  *r = PlatformFileForTransit(handle_win.get_handle());
   return true;
 }
 
-void ParamTraits<base::SharedMemoryHandle>::Log(const param_type& p,
-                                                std::string* l) {
+void ParamTraits<PlatformFileForTransit>::Log(const param_type& p,
+                                              std::string* l) {
   LogParam(p.GetHandle(), l);
-  l->append(" needs brokering: ");
-  LogParam(p.NeedsBrokering(), l);
 }
-#endif  // defined(OS_MACOSX) && !defined(OS_IOS)
+#endif  // defined(OS_WIN)
 
 void ParamTraits<base::FilePath>::GetSize(base::PickleSizer* sizer,
                                           const param_type& p) {
@@ -996,6 +1062,8 @@ void ParamTraits<base::UnguessableToken>::Write(base::Pickle* m,
                                                 const param_type& p) {
   DCHECK(!p.is_empty());
 
+  // This serialization must be kept in sync with
+  // nacl_message_scanner.cc:WriteHandle().
   ParamTraits<uint64_t>::Write(m, p.GetHighForSerialization());
   ParamTraits<uint64_t>::Write(m, p.GetLowForSerialization());
 }
diff --git a/chromium/ipc/ipc_message_utils.h b/chromium/ipc/ipc_message_utils.h
index 2d51c984aa0..84324ebaf41 100644
--- a/chromium/ipc/ipc_message_utils.h
+++ b/chromium/ipc/ipc_message_utils.h
@@ -17,10 +17,12 @@
 #include <tuple>
 #include <vector>
 
+#include "base/containers/flat_map.h"
 #include "base/containers/small_map.h"
 #include "base/containers/stack_container.h"
 #include "base/files/file.h"
 #include "base/format_macros.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/optional.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
@@ -35,21 +37,22 @@ class DictionaryValue;
 class FilePath;
 class ListValue;
 class NullableString16;
+class SharedMemoryHandle;
 class Time;
 class TimeDelta;
 class TimeTicks;
 class UnguessableToken;
 struct FileDescriptor;
-
-#if (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
-class SharedMemoryHandle;
-#endif  // (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
 }
 
 namespace IPC {
 
 struct ChannelHandle;
 
+#if defined(OS_WIN)
+class PlatformFileForTransit;
+#endif
+
 // -----------------------------------------------------------------------------
 // How we send IPC message logs across channels.
 struct IPC_EXPORT LogData {
@@ -583,7 +586,6 @@ struct IPC_EXPORT ParamTraits<base::FileDescriptor> {
 };
 #endif  // defined(OS_POSIX)
 
-#if (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
 template <>
 struct IPC_EXPORT ParamTraits<base::SharedMemoryHandle> {
   typedef base::SharedMemoryHandle param_type;
@@ -594,7 +596,19 @@ struct IPC_EXPORT ParamTraits<base::SharedMemoryHandle> {
                    param_type* r);
   static void Log(const param_type& p, std::string* l);
 };
-#endif  // (defined(OS_MACOSX) && !defined(OS_IOS)) || defined(OS_WIN)
+
+#if defined(OS_WIN)
+template <>
+struct IPC_EXPORT ParamTraits<PlatformFileForTransit> {
+  typedef PlatformFileForTransit param_type;
+  static void GetSize(base::PickleSizer* sizer, const param_type& p);
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+#endif  // defined(OS_WIN)
 
 template <>
 struct IPC_EXPORT ParamTraits<base::FilePath> {
@@ -899,10 +913,10 @@ template <typename NormalMap,
           int kArraySize,
           typename EqualKey,
           typename MapInit>
-struct ParamTraits<base::SmallMap<NormalMap, kArraySize, EqualKey, MapInit> > {
-  typedef base::SmallMap<NormalMap, kArraySize, EqualKey, MapInit> param_type;
-  typedef typename param_type::key_type K;
-  typedef typename param_type::data_type V;
+struct ParamTraits<base::small_map<NormalMap, kArraySize, EqualKey, MapInit>> {
+  using param_type = base::small_map<NormalMap, kArraySize, EqualKey, MapInit>;
+  using K = typename param_type::key_type;
+  using V = typename param_type::data_type;
   static void GetSize(base::PickleSizer* sizer, const param_type& p) {
     GetParamSize(sizer, static_cast<int>(p.size()));
     typename param_type::const_iterator iter;
@@ -936,7 +950,53 @@ struct ParamTraits<base::SmallMap<NormalMap, kArraySize, EqualKey, MapInit> > {
     return true;
   }
   static void Log(const param_type& p, std::string* l) {
-    l->append("<base::SmallMap>");
+    l->append("<base::small_map>");
+  }
+};
+
+template <class Key, class Mapped, class Compare>
+struct ParamTraits<base::flat_map<Key, Mapped, Compare>> {
+  using param_type = base::flat_map<Key, Mapped, Compare>;
+  static void GetSize(base::PickleSizer* sizer, const param_type& p) {
+    DCHECK(base::IsValueInRangeForNumericType<int>(p.size()));
+    GetParamSize(sizer, static_cast<int>(p.size()));
+    for (const auto& iter : p) {
+      GetParamSize(sizer, iter.first);
+      GetParamSize(sizer, iter.second);
+    }
+  }
+  static void Write(base::Pickle* m, const param_type& p) {
+    DCHECK(base::IsValueInRangeForNumericType<int>(p.size()));
+    WriteParam(m, static_cast<int>(p.size()));
+    for (const auto& iter : p) {
+      WriteParam(m, iter.first);
+      WriteParam(m, iter.second);
+    }
+  }
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r) {
+    int size;
+    if (!iter->ReadLength(&size))
+      return false;
+
+    // Construct by creating in a vector and moving into the flat_map. Properly
+    // serialized flat_maps will be in-order so this will be O(n). Incorrectly
+    // serialized ones will still be handled properly.
+    std::vector<typename param_type::value_type> vect;
+    vect.resize(size);
+    for (int i = 0; i < size; ++i) {
+      if (!ReadParam(m, iter, &vect[i].first))
+        return false;
+      if (!ReadParam(m, iter, &vect[i].second))
+        return false;
+    }
+
+    *r = param_type(std::move(vect), base::KEEP_FIRST_OF_DUPES);
+    return true;
+  }
+  static void Log(const param_type& p, std::string* l) {
+    l->append("<base::flat_map>");
   }
 };
 
@@ -1100,7 +1160,7 @@ IPC_EXPORT void GenerateLogData(const Message& message,
                                 LogData* data,
                                 bool get_params);
 
-#if defined(IPC_MESSAGE_LOG_ENABLED)
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
 inline void AddOutputParamsToLog(const Message* msg, std::string* l) {
   const std::string& output_params = msg->output_params();
   if (!l->empty() && !output_params.empty())
diff --git a/chromium/ipc/ipc_message_utils_unittest.cc b/chromium/ipc/ipc_message_utils_unittest.cc
index 4a10d34e2c4..867768089ba 100644
--- a/chromium/ipc/ipc_message_utils_unittest.cc
+++ b/chromium/ipc/ipc_message_utils_unittest.cc
@@ -11,6 +11,7 @@
 #include "base/files/file_path.h"
 #include "base/json/json_reader.h"
 #include "base/memory/ptr_util.h"
+#include "base/memory/shared_memory.h"
 #include "base/unguessable_token.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_message.h"
@@ -98,13 +99,13 @@ TEST(IPCMessageUtilsTest, StackVector) {
 // Tests that PickleSizer and Pickle agree on the size of a complex base::Value.
 TEST(IPCMessageUtilsTest, ValueSize) {
   std::unique_ptr<base::DictionaryValue> value(new base::DictionaryValue);
-  value->SetWithoutPathExpansion("foo", new base::Value(42));
-  value->SetWithoutPathExpansion("bar", new base::Value(3.14));
-  value->SetWithoutPathExpansion("baz", new base::Value("hello"));
+  value->SetIntegerWithoutPathExpansion("foo", 42);
+  value->SetDoubleWithoutPathExpansion("bar", 3.14);
+  value->SetStringWithoutPathExpansion("baz", "hello");
   value->SetWithoutPathExpansion("qux", base::MakeUnique<base::Value>());
 
   std::unique_ptr<base::DictionaryValue> nested_dict(new base::DictionaryValue);
-  nested_dict->SetWithoutPathExpansion("foobar", new base::Value(5));
+  nested_dict->SetIntegerWithoutPathExpansion("foobar", 5);
   value->SetWithoutPathExpansion("nested", std::move(nested_dict));
 
   std::unique_ptr<base::ListValue> list_value(new base::ListValue);
@@ -195,6 +196,25 @@ TEST(IPCMessageUtilsTest, OptionalSet) {
   EXPECT_EQ(opt.value(), unserialized_opt.value());
 }
 
+TEST(IPCMessageUtilsTest, SharedMemoryHandle) {
+  base::SharedMemoryCreateOptions options;
+  options.size = 1004;
+  base::SharedMemory shmem;
+  ASSERT_TRUE(shmem.Create(options));
+
+  base::SharedMemoryHandle pre_pickle = shmem.handle().Duplicate();
+  ASSERT_TRUE(pre_pickle.IsValid());
+
+  IPC::Message message;
+  IPC::WriteParam(&message, pre_pickle);
+
+  base::SharedMemoryHandle post_pickle;
+  base::PickleIterator iter(message);
+  EXPECT_TRUE(IPC::ReadParam(&message, &iter, &post_pickle));
+  EXPECT_EQ(pre_pickle.GetGUID(), post_pickle.GetGUID());
+  EXPECT_EQ(pre_pickle.GetSize(), post_pickle.GetSize());
+}
+
 TEST(IPCMessageUtilsTest, UnguessableTokenTest) {
   base::UnguessableToken token = base::UnguessableToken::Create();
   base::Pickle pickle;
@@ -215,5 +235,25 @@ TEST(IPCMessageUtilsTest, UnguessableTokenTest) {
   EXPECT_EQ(token, deserialized_token);
 }
 
+TEST(IPCMessageUtilsTest, FlatMap) {
+  base::flat_map<std::string, int> input;
+  input["foo"] = 42;
+  input["bar"] = 96;
+
+  base::Pickle pickle;
+  IPC::WriteParam(&pickle, input);
+
+  base::PickleSizer sizer;
+  IPC::GetParamSize(&sizer, input);
+
+  EXPECT_EQ(sizer.payload_size(), pickle.payload_size());
+
+  base::PickleIterator iter(pickle);
+  base::flat_map<std::string, int> output;
+  EXPECT_TRUE(IPC::ReadParam(&pickle, &iter, &output));
+
+  EXPECT_EQ(input, output);
+}
+
 }  // namespace
 }  // namespace IPC
diff --git a/chromium/ipc/ipc_mojo_bootstrap.cc b/chromium/ipc/ipc_mojo_bootstrap.cc
index 2c554620e9d..5361d8e0bff 100644
--- a/chromium/ipc/ipc_mojo_bootstrap.cc
+++ b/chromium/ipc/ipc_mojo_bootstrap.cc
@@ -116,7 +116,7 @@ class ChannelAssociatedGroupController
         CreateScopedInterfaceEndpointHandle(receiver_id);
 
     sender->Bind(mojom::ChannelAssociatedPtrInfo(std::move(sender_handle), 0));
-    receiver->Bind(std::move(receiver_handle));
+    *receiver = mojom::ChannelAssociatedRequest(std::move(receiver_handle));
   }
 
   void ShutDown() {
@@ -788,6 +788,12 @@ class ChannelAssociatedGroupController
     if (!endpoint)
       return;
 
+    // Careful, if the endpoint is detached its members are cleared. Check for
+    // that before dereferencing.
+    mojo::InterfaceEndpointClient* client = endpoint->client();
+    if (!client)
+      return;
+
     DCHECK(endpoint->task_runner()->BelongsToCurrentThread());
     MessageWrapper message_wrapper = endpoint->PopSyncMessage(message_id);
 
@@ -796,10 +802,6 @@ class ChannelAssociatedGroupController
     if (message_wrapper.value().IsNull())
       return;
 
-    mojo::InterfaceEndpointClient* client = endpoint->client();
-    if (!client)
-      return;
-
     bool result = false;
     {
       base::AutoUnlock unlocker(lock_);
diff --git a/chromium/ipc/ipc_mojo_perftest.cc b/chromium/ipc/ipc_mojo_perftest.cc
index 439c14f0666..d02acda9760 100644
--- a/chromium/ipc/ipc_mojo_perftest.cc
+++ b/chromium/ipc/ipc_mojo_perftest.cc
@@ -6,6 +6,7 @@
 #include <memory>
 
 #include "base/memory/ptr_util.h"
+#include "base/message_loop/message_loop.h"
 #include "base/process/process_metrics.h"
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
@@ -471,7 +472,7 @@ MULTIPROCESS_TEST_MAIN(MojoPerfTestClientTestChildMain) {
 class ReflectorImpl : public IPC::mojom::Reflector {
  public:
   explicit ReflectorImpl(mojo::ScopedMessagePipeHandle handle)
-      : binding_(this, std::move(handle)) {}
+      : binding_(this, IPC::mojom::ReflectorRequest(std::move(handle))) {}
   ~ReflectorImpl() override {
     ignore_result(binding_.Unbind().PassMessagePipe().release());
   }
diff --git a/chromium/ipc/ipc_platform_file.cc b/chromium/ipc/ipc_platform_file.cc
index dbcfddcc779..db5f8e52346 100644
--- a/chromium/ipc/ipc_platform_file.cc
+++ b/chromium/ipc/ipc_platform_file.cc
@@ -11,6 +11,32 @@
 
 namespace IPC {
 
+#if defined(OS_WIN)
+PlatformFileForTransit::PlatformFileForTransit() : handle_(nullptr) {}
+
+PlatformFileForTransit::PlatformFileForTransit(HANDLE handle)
+    : handle_(handle) {}
+
+bool PlatformFileForTransit::operator==(
+    const PlatformFileForTransit& platform_file) const {
+  return handle_ == platform_file.handle_;
+}
+
+bool PlatformFileForTransit::operator!=(
+    const PlatformFileForTransit& platform_file) const {
+  return !(*this == platform_file);
+}
+
+HANDLE PlatformFileForTransit::GetHandle() const {
+  return handle_;
+}
+
+bool PlatformFileForTransit::IsValid() const {
+  return handle_ != nullptr;
+}
+
+#endif  // defined(OS_WIN)
+
 PlatformFileForTransit GetPlatformFileForTransit(base::PlatformFile handle,
                                                  bool close_source_handle) {
 #if defined(OS_WIN)
@@ -24,10 +50,7 @@ PlatformFileForTransit GetPlatformFileForTransit(base::PlatformFile handle,
     return IPC::InvalidPlatformFileForTransit();
   }
 
-  IPC::PlatformFileForTransit out_handle = IPC::PlatformFileForTransit(
-      raw_handle, base::GetCurrentProcId());
-  out_handle.SetOwnershipPassesToIPC(true);
-  return out_handle;
+  return IPC::PlatformFileForTransit(raw_handle);
 #elif defined(OS_POSIX)
   // If asked to close the source, we can simply re-use the source fd instead of
   // dup()ing and close()ing.
diff --git a/chromium/ipc/ipc_platform_file.h b/chromium/ipc/ipc_platform_file.h
index 15807f60b75..ea295af8c54 100644
--- a/chromium/ipc/ipc_platform_file.h
+++ b/chromium/ipc/ipc_platform_file.h
@@ -14,17 +14,32 @@
 #include "base/file_descriptor_posix.h"
 #endif
 
-#if defined(OS_WIN)
-#include "base/memory/shared_memory_handle.h"
-#endif
-
 namespace IPC {
 
 #if defined(OS_WIN)
-// The semantics for IPC transfer of a SharedMemoryHandle are exactly the same
-// as for a PlatformFileForTransit. The object wraps a HANDLE, and has some
-// metadata that indicates the process to which the HANDLE belongs.
-using PlatformFileForTransit = base::SharedMemoryHandle;
+class IPC_EXPORT PlatformFileForTransit {
+ public:
+  // Creates an invalid platform file.
+  PlatformFileForTransit();
+
+  // Creates a platform file that takes unofficial ownership of |handle|. Note
+  // that ownership is not handled by a Scoped* class due to usage patterns of
+  // this class and its POSIX counterpart [base::FileDescriptor]. When this
+  // class is used as an input to an IPC message, the IPC subsystem will close
+  // |handle|. When this class is used as the output from an IPC message, the
+  // receiver is expected to take ownership of |handle|.
+  explicit PlatformFileForTransit(HANDLE handle);
+
+  // Comparison operators.
+  bool operator==(const PlatformFileForTransit& platform_file) const;
+  bool operator!=(const PlatformFileForTransit& platform_file) const;
+
+  HANDLE GetHandle() const;
+  bool IsValid() const;
+
+ private:
+  HANDLE handle_;
+};
 #elif defined(OS_POSIX)
 typedef base::FileDescriptor PlatformFileForTransit;
 #endif
diff --git a/chromium/ipc/ipc_send_fds_test.cc b/chromium/ipc/ipc_send_fds_test.cc
index 3c814bb165d..0b8a2798e61 100644
--- a/chromium/ipc/ipc_send_fds_test.cc
+++ b/chromium/ipc/ipc_send_fds_test.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/message_loop/message_loop.h"
 #include "build/build_config.h"
 
 #if defined(OS_POSIX)
diff --git a/chromium/ipc/ipc_sync_channel.cc b/chromium/ipc/ipc_sync_channel.cc
index 0d61e08ce94..36effbca032 100644
--- a/chromium/ipc/ipc_sync_channel.cc
+++ b/chromium/ipc/ipc_sync_channel.cc
@@ -15,6 +15,7 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
+#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread_local.h"
@@ -88,9 +89,9 @@ class SyncChannel::ReceivedSyncMsgQueue :
           outer_state_(sync_msg_queue_->top_send_done_event_watcher_),
           event_(context->GetSendDoneEvent()),
           callback_(
-              base::Bind(&SyncChannel::SyncContext::OnSendDoneEventSignaled,
-                         context,
-                         run_loop)) {
+              base::BindOnce(&SyncChannel::SyncContext::OnSendDoneEventSignaled,
+                             context,
+                             run_loop)) {
       sync_msg_queue_->top_send_done_event_watcher_ = this;
       if (outer_state_)
         outer_state_->StopWatching();
@@ -104,14 +105,23 @@ class SyncChannel::ReceivedSyncMsgQueue :
     }
 
    private:
-    void StartWatching() { watcher_.StartWatching(event_, callback_); }
+    void Run(WaitableEvent* event) {
+      DCHECK(callback_);
+      std::move(callback_).Run(event);
+    }
+
+    void StartWatching() {
+      watcher_.StartWatching(event_, base::BindOnce(&NestedSendDoneWatcher::Run,
+                                                    base::Unretained(this)));
+    }
+
     void StopWatching() { watcher_.StopWatching(); }
 
     ReceivedSyncMsgQueue* const sync_msg_queue_;
     NestedSendDoneWatcher* const outer_state_;
 
     base::WaitableEvent* const event_;
-    const base::WaitableEventWatcher::EventCallback callback_;
+    base::WaitableEventWatcher::EventCallback callback_;
     base::WaitableEventWatcher watcher_;
 
     DISALLOW_COPY_AND_ASSIGN(NestedSendDoneWatcher);
@@ -578,7 +588,7 @@ scoped_refptr<SyncMessageFilter> SyncChannel::CreateSyncMessageFilter() {
 }
 
 bool SyncChannel::Send(Message* message) {
-#ifdef IPC_MESSAGE_LOG_ENABLED
+#if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   std::string name;
   Logging::GetInstance()->GetMessageText(
       message->type(), &name, message, nullptr);
@@ -665,7 +675,7 @@ void SyncChannel::WaitForReply(mojo::SyncHandleRegistry* registry,
     }
 
     if (should_pump_messages)
-      WaitForReplyWithNestedMessageLoop(context);  // Run a nested message loop.
+      WaitForReplyWithNestedMessageLoop(context);  // Run a nested run loop.
 
     break;
   }
diff --git a/chromium/ipc/ipc_sync_channel.h b/chromium/ipc/ipc_sync_channel.h
index 3f65ef38be0..74a61471174 100644
--- a/chromium/ipc/ipc_sync_channel.h
+++ b/chromium/ipc/ipc_sync_channel.h
@@ -225,12 +225,12 @@ class IPC_EXPORT SyncChannel : public ChannelProxy {
   }
 
   // Both these functions wait for a reply, timeout or process shutdown.  The
-  // latter one also runs a nested message loop in the meantime.
+  // latter one also runs a nested run loop in the meantime.
   static void WaitForReply(mojo::SyncHandleRegistry* registry,
                            SyncContext* context,
                            bool pump_messages);
 
-  // Runs a nested message loop until a reply arrives, times out, or the process
+  // Runs a nested run loop until a reply arrives, times out, or the process
   // shuts down.
   static void WaitForReplyWithNestedMessageLoop(SyncContext* context);
 
diff --git a/chromium/ipc/ipc_sync_channel_unittest.cc b/chromium/ipc/ipc_sync_channel_unittest.cc
index 55c571149c9..63d5e464219 100644
--- a/chromium/ipc/ipc_sync_channel_unittest.cc
+++ b/chromium/ipc/ipc_sync_channel_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/message_loop/message_loop.h"
 #include "base/process/process_handle.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
diff --git a/chromium/ipc/sync_socket_unittest.cc b/chromium/ipc/sync_socket_unittest.cc
index 67253aa624c..e220281bc90 100644
--- a/chromium/ipc/sync_socket_unittest.cc
+++ b/chromium/ipc/sync_socket_unittest.cc
@@ -13,6 +13,7 @@
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/macros.h"
+#include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread.h"