BASELINE: Update Chromium to 57.0.2987.144

Change-Id: I29db402ff696c71a04c4dbaec822c2e53efe0267
Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>

58 files changed, 2028 insertions, 1738 deletions

diff --git a/chromium/net/base/arena.cc b/chromium/net/base/arena.cc
index eeb286337be..3bf29a79fca 100644
--- a/chromium/net/base/arena.cc
+++ b/chromium/net/base/arena.cc
@@ -68,6 +68,7 @@ void UnsafeArena::Free(char* data, size_t size) {
 
 void UnsafeArena::Reset() {
   blocks_.clear();
+  status_.bytes_allocated_ = 0;
 }
 
 void UnsafeArena::Reserve(size_t additional_space) {
@@ -83,6 +84,7 @@ void UnsafeArena::Reserve(size_t additional_space) {
 
 void UnsafeArena::AllocBlock(size_t size) {
   blocks_.push_back(Block(size));
+  status_.bytes_allocated_ += size;
 }
 
 UnsafeArena::Block::Block(size_t s) : data(new char[s]), size(s), used(0) {}
diff --git a/chromium/net/base/arena.h b/chromium/net/base/arena.h
index 223517df5e2..f9a31acd96d 100644
--- a/chromium/net/base/arena.h
+++ b/chromium/net/base/arena.h
@@ -16,6 +16,16 @@ namespace net {
 // Not thread-safe.
 class NET_EXPORT_PRIVATE UnsafeArena {
  public:
+  class Status {
+   private:
+    friend class UnsafeArena;
+    size_t bytes_allocated_;
+
+   public:
+    Status() : bytes_allocated_(0) {}
+    size_t bytes_allocated() const { return bytes_allocated_; }
+  };
+
   // Blocks allocated by this arena will be at least |block_size| bytes.
   explicit UnsafeArena(size_t block_size);
   ~UnsafeArena();
@@ -39,6 +49,8 @@ class NET_EXPORT_PRIVATE UnsafeArena {
 
   void Reset();
 
+  Status status() const { return status_; }
+
  private:
   struct Block {
     std::unique_ptr<char[]> data;
@@ -57,6 +69,7 @@ class NET_EXPORT_PRIVATE UnsafeArena {
 
   size_t block_size_;
   std::vector<Block> blocks_;
+  Status status_;
 };
 
 }  // namespace net
diff --git a/chromium/net/base/escape.cc b/chromium/net/base/escape.cc
index 9f22778f0a5..65a23c1c395 100644
--- a/chromium/net/base/escape.cc
+++ b/chromium/net/base/escape.cc
@@ -4,13 +4,8 @@
 
 #include "net/base/escape.h"
 
-#include <algorithm>
-#include <memory>
-
 #include "base/logging.h"
-#include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
-#include "base/strings/utf_offset_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 
 namespace net {
@@ -41,7 +36,7 @@ struct Charmap {
 // to +, otherwise, if spaces are in the charmap, they are converted to
 // %20. And if keep_escaped is true, %XX will be kept as it is, otherwise, if
 // '%' is in the charmap, it is converted to %25.
-std::string Escape(const std::string& text,
+std::string Escape(base::StringPiece text,
                    const Charmap& charmap,
                    bool use_plus,
                    bool keep_escaped = false) {
@@ -106,8 +101,8 @@ const char kUrlUnescape[128] = {
 // Attempts to unescape the sequence at |index| within |escaped_text|.  If
 // successful, sets |value| to the unescaped value.  Returns whether
 // unescaping succeeded.
-template<typename STR>
-bool UnescapeUnsignedCharAtIndex(const STR& escaped_text,
+template <typename STR>
+bool UnescapeUnsignedCharAtIndex(STR escaped_text,
                                  size_t index,
                                  unsigned char* value) {
   if ((index + 2) >= escaped_text.size())
@@ -128,8 +123,8 @@ bool UnescapeUnsignedCharAtIndex(const STR& escaped_text,
 
 // Returns true if there is an Arabic Language Mark at |index|. |first_byte|
 // is the byte at |index|.
-template<typename STR>
-bool HasArabicLanguageMarkAtIndex(const STR& escaped_text,
+template <typename STR>
+bool HasArabicLanguageMarkAtIndex(STR escaped_text,
                                   unsigned char first_byte,
                                   size_t index) {
   if (first_byte != 0xD8)
@@ -142,8 +137,8 @@ bool HasArabicLanguageMarkAtIndex(const STR& escaped_text,
 
 // Returns true if there is a BiDi control char at |index|. |first_byte| is the
 // byte at |index|.
-template<typename STR>
-bool HasThreeByteBidiControlCharAtIndex(const STR& escaped_text,
+template <typename STR>
+bool HasThreeByteBidiControlCharAtIndex(STR escaped_text,
                                         unsigned char first_byte,
                                         size_t index) {
   if (first_byte != 0xE2)
@@ -167,7 +162,7 @@ bool HasThreeByteBidiControlCharAtIndex(const STR& escaped_text,
 // Returns true if there is a four-byte banned char at |index|. |first_byte| is
 // the byte at |index|.
 template <typename STR>
-bool HasFourByteBannedCharAtIndex(const STR& escaped_text,
+bool HasFourByteBannedCharAtIndex(STR escaped_text,
                                   unsigned char first_byte,
                                   size_t index) {
   // The following characters are blacklisted for spoofability concerns.
@@ -201,16 +196,16 @@ bool HasFourByteBannedCharAtIndex(const STR& escaped_text,
 // the alterations done to the string that are not one-character-to-one-
 // character.  The resulting |adjustments| will always be sorted by increasing
 // offset.
-template<typename STR>
+template <typename STR>
 STR UnescapeURLWithAdjustmentsImpl(
-    const STR& escaped_text,
+    base::BasicStringPiece<STR> escaped_text,
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments) {
   if (adjustments)
     adjustments->clear();
   // Do not unescape anything, return the |escaped_text| text.
   if (rules == UnescapeRule::NONE)
-    return escaped_text;
+    return escaped_text.as_string();
 
   // The output of the unescaping is always smaller than the input, so we can
   // reserve the input size to make sure we have enough buffer and don't have
@@ -265,19 +260,19 @@ STR UnescapeURLWithAdjustmentsImpl(
       if (!(rules & UnescapeRule::SPOOFING_AND_CONTROL_CHARS)) {
         if (HasArabicLanguageMarkAtIndex(escaped_text, first_byte, i)) {
           // Keep Arabic Language Mark escaped.
-          result.append(escaped_text, i, 6);
+          escaped_text.substr(i, 6).AppendToString(&result);
           i += 5;
           continue;
         }
         if (HasThreeByteBidiControlCharAtIndex(escaped_text, first_byte, i)) {
           // Keep BiDi control char escaped.
-          result.append(escaped_text, i, 9);
+          escaped_text.substr(i, 9).AppendToString(&result);
           i += 8;
           continue;
         }
         if (HasFourByteBannedCharAtIndex(escaped_text, first_byte, i)) {
           // Keep banned char escaped.
-          result.append(escaped_text, i, 12);
+          escaped_text.substr(i, 12).AppendToString(&result);
           i += 11;
           continue;
         }
@@ -345,12 +340,13 @@ void AppendEscapedCharForHTMLImpl(typename str::value_type c, str* output) {
 }
 
 template <class str>
-str EscapeForHTMLImpl(const str& input) {
+str EscapeForHTMLImpl(base::BasicStringPiece<str> input) {
   str result;
   result.reserve(input.size());  // Optimize for no escaping.
 
-  for (typename str::const_iterator i = input.begin(); i != input.end(); ++i)
-    AppendEscapedCharForHTMLImpl(*i, &result);
+  for (auto c : input) {
+    AppendEscapedCharForHTMLImpl(c, &result);
+  }
 
   return result;
 }
@@ -397,29 +393,29 @@ static const Charmap kExternalHandlerCharmap = {{
 
 }  // namespace
 
-std::string EscapeQueryParamValue(const std::string& text, bool use_plus) {
+std::string EscapeQueryParamValue(base::StringPiece text, bool use_plus) {
   return Escape(text, kQueryCharmap, use_plus);
 }
 
-std::string EscapePath(const std::string& path) {
+std::string EscapePath(base::StringPiece path) {
   return Escape(path, kPathCharmap, false);
 }
 
 #if defined(OS_MACOSX)
-std::string EscapeNSURLPrecursor(const std::string& precursor) {
+std::string EscapeNSURLPrecursor(base::StringPiece precursor) {
   return Escape(precursor, kNSURLCharmap, false, true);
 }
 #endif  // defined(OS_MACOSX)
 
-std::string EscapeUrlEncodedData(const std::string& path, bool use_plus) {
+std::string EscapeUrlEncodedData(base::StringPiece path, bool use_plus) {
   return Escape(path, kUrlEscape, use_plus);
 }
 
-std::string EscapeNonASCII(const std::string& input) {
+std::string EscapeNonASCII(base::StringPiece input) {
   return Escape(input, kNonASCIICharmap, false);
 }
 
-std::string EscapeExternalHandlerValue(const std::string& text) {
+std::string EscapeExternalHandlerValue(base::StringPiece text) {
   return Escape(text, kExternalHandlerCharmap, false, true);
 }
 
@@ -427,31 +423,31 @@ void AppendEscapedCharForHTML(char c, std::string* output) {
   AppendEscapedCharForHTMLImpl(c, output);
 }
 
-std::string EscapeForHTML(const std::string& input) {
+std::string EscapeForHTML(base::StringPiece input) {
   return EscapeForHTMLImpl(input);
 }
 
-base::string16 EscapeForHTML(const base::string16& input) {
+base::string16 EscapeForHTML(base::StringPiece16 input) {
   return EscapeForHTMLImpl(input);
 }
 
-std::string UnescapeURLComponent(const std::string& escaped_text,
+std::string UnescapeURLComponent(base::StringPiece escaped_text,
                                  UnescapeRule::Type rules) {
   return UnescapeURLWithAdjustmentsImpl(escaped_text, rules, NULL);
 }
 
-base::string16 UnescapeURLComponent(const base::string16& escaped_text,
+base::string16 UnescapeURLComponent(base::StringPiece16 escaped_text,
                                     UnescapeRule::Type rules) {
   return UnescapeURLWithAdjustmentsImpl(escaped_text, rules, NULL);
 }
 
-base::string16 UnescapeAndDecodeUTF8URLComponent(const std::string& text,
+base::string16 UnescapeAndDecodeUTF8URLComponent(base::StringPiece text,
                                                  UnescapeRule::Type rules) {
   return UnescapeAndDecodeUTF8URLComponentWithAdjustments(text, rules, NULL);
 }
 
 base::string16 UnescapeAndDecodeUTF8URLComponentWithAdjustments(
-    const std::string& text,
+    base::StringPiece text,
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments) {
   base::string16 result;
@@ -472,7 +468,7 @@ base::string16 UnescapeAndDecodeUTF8URLComponentWithAdjustments(
   return base::UTF8ToUTF16WithAdjustments(text, adjustments);
 }
 
-base::string16 UnescapeForHTML(const base::string16& input) {
+base::string16 UnescapeForHTML(base::StringPiece16 input) {
   static const struct {
     const char* ampersand_code;
     const char replacement;
@@ -485,10 +481,10 @@ base::string16 UnescapeForHTML(const base::string16& input) {
   };
 
   if (input.find(base::ASCIIToUTF16("&")) == std::string::npos)
-    return input;
+    return input.as_string();
 
   base::string16 ampersand_chars[arraysize(kEscapeToChars)];
-  base::string16 text(input);
+  base::string16 text = input.as_string();
   for (base::string16::iterator iter = text.begin();
        iter != text.end(); ++iter) {
     if (*iter == '&') {
diff --git a/chromium/net/base/escape.h b/chromium/net/base/escape.h
index 8637a70a5e7..cb013922dc3 100644
--- a/chromium/net/base/escape.h
+++ b/chromium/net/base/escape.h
@@ -8,9 +8,9 @@
 #include <stdint.h>
 
 #include <string>
-#include <vector>
 
 #include "base/strings/string16.h"
+#include "base/strings/string_piece.h"
 #include "base/strings/utf_offset_string_conversions.h"
 #include "net/base/net_export.h"
 
@@ -22,44 +22,44 @@ namespace net {
 // We %XX everything except alphanumerics and -_.!~*'()
 // Spaces change to "+" unless you pass usePlus=false.
 // This is basically the same as encodeURIComponent in javascript.
-NET_EXPORT std::string EscapeQueryParamValue(const std::string& text,
+NET_EXPORT std::string EscapeQueryParamValue(base::StringPiece text,
                                              bool use_plus);
 
 // Escapes a partial or complete file/pathname.  This includes:
 // non-printable, non-7bit, and (including space)  "#%:<>?[\]^`{|}
 // For the base::string16 version, we attempt a conversion to |codepage| before
 // encoding the string.  If this conversion fails, we return false.
-NET_EXPORT std::string EscapePath(const std::string& path);
+NET_EXPORT std::string EscapePath(base::StringPiece path);
 
 #if defined(OS_MACOSX)
 // Escapes characters as per expectations of NSURL. This includes:
 // non-printable, non-7bit, and (including space)  "#%<>[\]^`{|}
-NET_EXPORT std::string EscapeNSURLPrecursor(const std::string& precursor);
+NET_EXPORT std::string EscapeNSURLPrecursor(base::StringPiece precursor);
 #endif  // defined(OS_MACOSX)
 
 // Escapes application/x-www-form-urlencoded content.  This includes:
 // non-printable, non-7bit, and (including space)  ?>=<;+'&%$#"![\]^`{|}
 // Space is escaped as + (if use_plus is true) and other special characters
 // as %XX (hex).
-NET_EXPORT std::string EscapeUrlEncodedData(const std::string& path,
+NET_EXPORT std::string EscapeUrlEncodedData(base::StringPiece path,
                                             bool use_plus);
 
 // Escapes all non-ASCII input.
-NET_EXPORT std::string EscapeNonASCII(const std::string& input);
+NET_EXPORT std::string EscapeNonASCII(base::StringPiece input);
 
 // Escapes characters in text suitable for use as an external protocol handler
 // command.
 // We %XX everything except alphanumerics and -_.!~*'() and the restricted
 // chracters (;/?:@&=+$,#[]) and a valid percent escape sequence (%XX).
-NET_EXPORT std::string EscapeExternalHandlerValue(const std::string& text);
+NET_EXPORT std::string EscapeExternalHandlerValue(base::StringPiece text);
 
 // Appends the given character to the output string, escaping the character if
 // the character would be interpretted as an HTML delimiter.
 NET_EXPORT void AppendEscapedCharForHTML(char c, std::string* output);
 
 // Escapes chars that might cause this text to be interpretted as HTML tags.
-NET_EXPORT std::string EscapeForHTML(const std::string& text);
-NET_EXPORT base::string16 EscapeForHTML(const base::string16& text);
+NET_EXPORT std::string EscapeForHTML(base::StringPiece text);
+NET_EXPORT base::string16 EscapeForHTML(base::StringPiece16 text);
 
 // Unescaping ------------------------------------------------------------------
 
@@ -125,11 +125,10 @@ class UnescapeRule {
 // which, after unescaping, is supposed to be interpreted as UTF-8, and then
 // converted into full UTF-16 chars. This function won't tell you if any
 // conversions need to take place, it only unescapes.
-NET_EXPORT std::string UnescapeURLComponent(const std::string& escaped_text,
+NET_EXPORT std::string UnescapeURLComponent(base::StringPiece escaped_text,
                                             UnescapeRule::Type rules);
-NET_EXPORT base::string16 UnescapeURLComponent(
-    const base::string16& escaped_text,
-    UnescapeRule::Type rules);
+NET_EXPORT base::string16 UnescapeURLComponent(base::StringPiece16 escaped_text,
+                                               UnescapeRule::Type rules);
 
 // Unescapes the given substring as a URL, and then tries to interpret the
 // result as being encoded as UTF-8. If the result is convertable into UTF-8, it
@@ -138,16 +137,16 @@ NET_EXPORT base::string16 UnescapeURLComponent(
 // information on how the original string was adjusted to get the string
 // returned.
 NET_EXPORT base::string16 UnescapeAndDecodeUTF8URLComponent(
-    const std::string& text,
+    base::StringPiece text,
     UnescapeRule::Type rules);
 NET_EXPORT base::string16 UnescapeAndDecodeUTF8URLComponentWithAdjustments(
-    const std::string& text,
+    base::StringPiece text,
     UnescapeRule::Type rules,
     base::OffsetAdjuster::Adjustments* adjustments);
 
 // Unescapes the following ampersand character codes from |text|:
 // &lt; &gt; &amp; &quot; &#39;
-NET_EXPORT base::string16 UnescapeForHTML(const base::string16& text);
+NET_EXPORT base::string16 UnescapeForHTML(base::StringPiece16 text);
 
 }  // namespace net
 
diff --git a/chromium/net/base/int128.h b/chromium/net/base/int128.h
index b9be53dc58a..c2fc51ba48f 100644
--- a/chromium/net/base/int128.h
+++ b/chromium/net/base/int128.h
@@ -66,6 +66,10 @@ class uint128 {
   uint128(double v);
 };
 
+inline uint128 MakeUint128(uint64_t top, uint64_t bottom) {
+  return uint128(top, bottom);
+}
+
 // This is a POD form of uint128 which can be used for static variables which
 // need to be operated on as uint128.
 struct uint128_pod {
diff --git a/chromium/net/base/int128_unittest.cc b/chromium/net/base/int128_unittest.cc
index 2d740d375d7..9a9028978ab 100644
--- a/chromium/net/base/int128_unittest.cc
+++ b/chromium/net/base/int128_unittest.cc
@@ -10,9 +10,9 @@
 #include "net/base/int128.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-using net::uint128;
-using net::uint128_pod;
-using net::kuint128max;
+namespace net {
+
+namespace test {
 
 TEST(Int128, AllTests) {
   uint128 zero(0);
@@ -264,3 +264,7 @@ TEST(Int128, AliasTests) {
   x3 += x3;
   EXPECT_EQ(x4, x3);
 }
+
+}  // namespace test
+
+}  // namespace net
diff --git a/chromium/net/base/iovec.h b/chromium/net/base/iovec.h
index a98ed212148..61e2593551e 100644
--- a/chromium/net/base/iovec.h
+++ b/chromium/net/base/iovec.h
@@ -7,6 +7,8 @@
 
 #include <stddef.h>
 
+#include "build/build_config.h"
+
 #if defined(OS_POSIX) && !defined(OS_NACL)
 #include <sys/uio.h>
 #else
diff --git a/chromium/net/base/ip_address.h b/chromium/net/base/ip_address.h
index f095384a2c0..e326e78da6e 100644
--- a/chromium/net/base/ip_address.h
+++ b/chromium/net/base/ip_address.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef NET_BASE_IP_ADDRESS_NET_H_
-#define NET_BASE_IP_ADDRESS_NET_H_
+#ifndef NET_BASE_IP_ADDRESS_H_
+#define NET_BASE_IP_ADDRESS_H_
 
 #include <stddef.h>
 #include <stdint.h>
@@ -205,4 +205,4 @@ bool IPAddressStartsWith(const IPAddress& address, const uint8_t (&prefix)[N]) {
 
 }  // namespace net
 
-#endif  // NET_BASE_IP_ADDRESS_NET_H_
+#endif  // NET_BASE_IP_ADDRESS_H_
diff --git a/chromium/net/base/keygen_handler.cc b/chromium/net/base/keygen_handler.cc
deleted file mode 100644
index d1e91a4806a..00000000000
--- a/chromium/net/base/keygen_handler.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/keygen_handler.h"
-
-#if defined(USE_NSS_CERTS)
-#include "crypto/nss_crypto_module_delegate.h"
-#endif  // defined(USE_NSS_CERTS)
-
-namespace net {
-
-// The constructor and destructor must be defined in a .cc file so that
-// CryptoModuleBlockingPasswordDelegate can be forward-declared on platforms
-// which use NSS.
-
-KeygenHandler::KeygenHandler(int key_size_in_bits,
-                             const std::string& challenge,
-                             const GURL& url)
-    : key_size_in_bits_(key_size_in_bits),
-      challenge_(challenge),
-      url_(url),
-      stores_key_(true) {
-}
-
-KeygenHandler::~KeygenHandler() {
-}
-
-}  // namespace net
diff --git a/chromium/net/base/keygen_handler.h b/chromium/net/base/keygen_handler.h
deleted file mode 100644
index 67a11bc9b65..00000000000
--- a/chromium/net/base/keygen_handler.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef NET_BASE_KEYGEN_HANDLER_H_
-#define NET_BASE_KEYGEN_HANDLER_H_
-
-#include <memory>
-#include <string>
-
-#include "base/callback_forward.h"
-#include "build/build_config.h"
-#include "net/base/net_export.h"
-#include "url/gurl.h"
-
-namespace crypto {
-class NSSCryptoModuleDelegate;
-}
-
-namespace net {
-
-// This class handles keypair generation for generating client
-// certificates via the <keygen> tag.
-// <http://dev.w3.org/html5/spec/Overview.html#the-keygen-element>
-// <https://developer.mozilla.org/En/HTML/HTML_Extensions/KEYGEN_Tag>
-
-class NET_EXPORT KeygenHandler {
- public:
-  // Creates a handler that will generate a key with the given key size and
-  // incorporate the |challenge| into the Netscape SPKAC structure. The request
-  // for the key originated from |url|.
-  KeygenHandler(int key_size_in_bits,
-                const std::string& challenge,
-                const GURL& url);
-  ~KeygenHandler();
-
-  // Actually generates the key-pair and the cert request (SPKAC), and returns
-  // a base64-encoded string suitable for use as the form value of <keygen>.
-  std::string GenKeyAndSignChallenge();
-
-  // Exposed only for unit tests.
-  void set_stores_key(bool store) { stores_key_ = store;}
-
-#if defined(USE_NSS_CERTS)
-  // Register the delegate to be used to get the token to store the key in, and
-  // to get the password if the token is unauthenticated.
-  // GenKeyAndSignChallenge runs on a worker thread, so using a blocking
-  // password callback is okay here.
-  void set_crypto_module_delegate(
-      std::unique_ptr<crypto::NSSCryptoModuleDelegate> delegate);
-#endif  // defined(USE_NSS_CERTS)
-
- private:
-  int key_size_in_bits_;  // key size in bits (usually 2048)
-  std::string challenge_;  // challenge string sent by server
-  GURL url_;  // the URL that requested the key
-  bool stores_key_;  // should the generated key-pair be stored persistently?
-#if defined(USE_NSS_CERTS)
-  // The callback for requesting a password to the PKCS#11 token.
-  std::unique_ptr<crypto::NSSCryptoModuleDelegate> crypto_module_delegate_;
-#endif  // defined(USE_NSS_CERTS)
-};
-
-}  // namespace net
-
-#endif  // NET_BASE_KEYGEN_HANDLER_H_
diff --git a/chromium/net/base/keygen_handler_mac.cc b/chromium/net/base/keygen_handler_mac.cc
deleted file mode 100644
index 13814fea820..00000000000
--- a/chromium/net/base/keygen_handler_mac.cc
+++ /dev/null
@@ -1,339 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/keygen_handler.h"
-
-#include <Security/SecAsn1Coder.h>
-#include <Security/SecAsn1Templates.h>
-#include <Security/Security.h>
-
-#include "base/base64.h"
-#include "base/logging.h"
-#include "base/mac/mac_logging.h"
-#include "base/mac/scoped_cftyperef.h"
-#include "base/strings/string_util.h"
-#include "base/strings/sys_string_conversions.h"
-#include "base/synchronization/lock.h"
-#include "crypto/cssm_init.h"
-#include "crypto/mac_security_services_lock.h"
-
-// CSSM functions are deprecated as of OSX 10.7, but have no replacement.
-// https://bugs.chromium.org/p/chromium/issues/detail?id=590914#c1
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-
-// These are in Security.framework but not declared in a public header.
-extern const SecAsn1Template kSecAsn1AlgorithmIDTemplate[];
-extern const SecAsn1Template kSecAsn1SubjectPublicKeyInfoTemplate[];
-
-namespace net {
-
-// Declarations of Netscape keygen cert structures for ASN.1 encoding:
-
-struct PublicKeyAndChallenge {
-  CSSM_X509_SUBJECT_PUBLIC_KEY_INFO spki;
-  CSSM_DATA challenge_string;
-};
-
-// This is a copy of the built-in kSecAsn1IA5StringTemplate, but without the
-// 'streamable' flag, which was causing bogus data to be written.
-const SecAsn1Template kIA5StringTemplate[] = {
-    { SEC_ASN1_IA5_STRING, 0, NULL, sizeof(CSSM_DATA) }
-};
-
-static const SecAsn1Template kPublicKeyAndChallengeTemplate[] = {
-  {
-    SEC_ASN1_SEQUENCE,
-    0,
-    NULL,
-    sizeof(PublicKeyAndChallenge)
-  },
-  {
-    SEC_ASN1_INLINE,
-    offsetof(PublicKeyAndChallenge, spki),
-    kSecAsn1SubjectPublicKeyInfoTemplate
-  },
-  {
-    SEC_ASN1_INLINE,
-    offsetof(PublicKeyAndChallenge, challenge_string),
-    kIA5StringTemplate
-  },
-  {
-    0
-  }
-};
-
-struct SignedPublicKeyAndChallenge {
-  PublicKeyAndChallenge pkac;
-  CSSM_X509_ALGORITHM_IDENTIFIER signature_algorithm;
-  CSSM_DATA signature;
-};
-
-static const SecAsn1Template kSignedPublicKeyAndChallengeTemplate[] = {
-  {
-    SEC_ASN1_SEQUENCE,
-    0,
-    NULL,
-    sizeof(SignedPublicKeyAndChallenge)
-  },
-  {
-    SEC_ASN1_INLINE,
-    offsetof(SignedPublicKeyAndChallenge, pkac),
-    kPublicKeyAndChallengeTemplate
-  },
-  {
-    SEC_ASN1_INLINE,
-    offsetof(SignedPublicKeyAndChallenge, signature_algorithm),
-    kSecAsn1AlgorithmIDTemplate
-  },
-  {
-    SEC_ASN1_BIT_STRING,
-    offsetof(SignedPublicKeyAndChallenge, signature)
-  },
-  {
-    0
-  }
-};
-
-
-static OSStatus CreateRSAKeyPair(int size_in_bits,
-                                 SecAccessRef initial_access,
-                                 SecKeyRef* out_pub_key,
-                                 SecKeyRef* out_priv_key);
-static OSStatus SignData(CSSM_DATA data,
-                         SecKeyRef private_key,
-                         CSSM_DATA* signature);
-
-std::string KeygenHandler::GenKeyAndSignChallenge() {
-  std::string result;
-  OSStatus err;
-  SecAccessRef initial_access = NULL;
-  SecKeyRef public_key = NULL;
-  SecKeyRef private_key = NULL;
-  SecAsn1CoderRef coder = NULL;
-  CSSM_DATA signature = {0, NULL};
-
-  {
-    if (url_.has_host()) {
-      // TODO(davidben): Use something like "Key generated for
-      // example.com", but localize it.
-      base::ScopedCFTypeRef<CFStringRef> label(
-          base::SysUTF8ToCFStringRef(url_.host()));
-      // Create an initial access object to set the SecAccessRef. This
-      // sets a label on the Keychain dialogs. Pass NULL as the second
-      // argument to use the default trusted list; only allow the
-      // current application to access without user confirmation.
-      err = SecAccessCreate(label, NULL, &initial_access);
-      // If we fail, just continue without a label.
-      if (err)
-        crypto::LogCSSMError("SecAccessCreate", err);
-    }
-
-    // Create the key-pair.
-    err = CreateRSAKeyPair(key_size_in_bits_, initial_access,
-                           &public_key, &private_key);
-    if (err)
-      goto failure;
-
-    // Get the public key data (DER sequence of modulus, exponent).
-    CFDataRef key_data = NULL;
-    err = SecKeychainItemExport(public_key, kSecFormatBSAFE, 0, NULL,
-                                &key_data);
-    if (err) {
-      crypto::LogCSSMError("SecKeychainItemExpor", err);
-      goto failure;
-    }
-    base::ScopedCFTypeRef<CFDataRef> scoped_key_data(key_data);
-
-    // Create an ASN.1 encoder.
-    err = SecAsn1CoderCreate(&coder);
-    if (err) {
-      crypto::LogCSSMError("SecAsn1CoderCreate", err);
-      goto failure;
-    }
-
-    // The DER encoding of a NULL.
-    static const uint8_t kNullDer[] = {0x05, 0x00};
-
-    // Fill in and DER-encode the PublicKeyAndChallenge:
-    SignedPublicKeyAndChallenge spkac;
-    memset(&spkac, 0, sizeof(spkac));
-    spkac.pkac.spki.algorithm.algorithm = CSSMOID_RSA;
-    spkac.pkac.spki.algorithm.parameters.Data = const_cast<uint8_t*>(kNullDer);
-    spkac.pkac.spki.algorithm.parameters.Length = sizeof(kNullDer);
-    spkac.pkac.spki.subjectPublicKey.Length =
-        CFDataGetLength(key_data) * 8;  // interpreted as a _bit_ count
-    spkac.pkac.spki.subjectPublicKey.Data =
-        const_cast<uint8_t*>(CFDataGetBytePtr(key_data));
-    spkac.pkac.challenge_string.Length = challenge_.length();
-    spkac.pkac.challenge_string.Data =
-        reinterpret_cast<uint8_t*>(const_cast<char*>(challenge_.data()));
-
-    CSSM_DATA encoded;
-    err = SecAsn1EncodeItem(coder, &spkac.pkac,
-                            kPublicKeyAndChallengeTemplate, &encoded);
-    if (err) {
-      crypto::LogCSSMError("SecAsn1EncodeItem", err);
-      goto failure;
-    }
-
-    // Compute a signature of the result:
-    err = SignData(encoded, private_key, &signature);
-    if (err)
-      goto failure;
-    spkac.signature.Data = signature.Data;
-    spkac.signature.Length = signature.Length * 8;  // a _bit_ count
-    spkac.signature_algorithm.algorithm = CSSMOID_MD5WithRSA;
-    spkac.signature_algorithm.parameters.Data = const_cast<uint8_t*>(kNullDer);
-    spkac.signature_algorithm.parameters.Length = sizeof(kNullDer);
-    // TODO(snej): MD5 is weak. Can we use SHA1 instead?
-    // See <https://bugzilla.mozilla.org/show_bug.cgi?id=549460>
-
-    // DER-encode the entire SignedPublicKeyAndChallenge:
-    err = SecAsn1EncodeItem(coder, &spkac,
-                            kSignedPublicKeyAndChallengeTemplate, &encoded);
-    if (err) {
-      crypto::LogCSSMError("SecAsn1EncodeItem", err);
-      goto failure;
-    }
-
-    // Base64 encode the result.
-    std::string input(reinterpret_cast<char*>(encoded.Data), encoded.Length);
-    base::Base64Encode(input, &result);
-  }
-
- failure:
-  if (err)
-    OSSTATUS_LOG(ERROR, err) << "SSL Keygen failed!";
-  else
-    VLOG(1) << "SSL Keygen succeeded! Output is: " << result;
-
-  // Remove keys from keychain if asked to during unit testing:
-  if (!stores_key_) {
-    if (public_key)
-      SecKeychainItemDelete(reinterpret_cast<SecKeychainItemRef>(public_key));
-    if (private_key)
-      SecKeychainItemDelete(reinterpret_cast<SecKeychainItemRef>(private_key));
-  }
-
-  // Clean up:
-  free(signature.Data);
-  if (coder)
-    SecAsn1CoderRelease(coder);
-  if (initial_access)
-    CFRelease(initial_access);
-  if (public_key)
-    CFRelease(public_key);
-  if (private_key)
-    CFRelease(private_key);
-  return result;
-}
-
-
-// Create an RSA key pair with size |size_in_bits|. |initial_access|
-// is passed as the initial access control list in Keychain. The
-// public and private keys are placed in |out_pub_key| and
-// |out_priv_key|, respectively.
-static OSStatus CreateRSAKeyPair(int size_in_bits,
-                                 SecAccessRef initial_access,
-                                 SecKeyRef* out_pub_key,
-                                 SecKeyRef* out_priv_key) {
-  OSStatus err;
-  SecKeychainRef keychain;
-  err = SecKeychainCopyDefault(&keychain);
-  if (err) {
-    crypto::LogCSSMError("SecKeychainCopyDefault", err);
-    return err;
-  }
-  base::ScopedCFTypeRef<SecKeychainRef> scoped_keychain(keychain);
-  {
-    base::AutoLock locked(crypto::GetMacSecurityServicesLock());
-    err = SecKeyCreatePair(
-        keychain,
-        CSSM_ALGID_RSA,
-        size_in_bits,
-        0LL,
-        // public key usage and attributes:
-        CSSM_KEYUSE_ENCRYPT | CSSM_KEYUSE_VERIFY | CSSM_KEYUSE_WRAP,
-        CSSM_KEYATTR_EXTRACTABLE | CSSM_KEYATTR_PERMANENT,
-        // private key usage and attributes:
-        CSSM_KEYUSE_DECRYPT | CSSM_KEYUSE_SIGN | CSSM_KEYUSE_UNWRAP,
-        CSSM_KEYATTR_EXTRACTABLE | CSSM_KEYATTR_PERMANENT |
-            CSSM_KEYATTR_SENSITIVE,
-        initial_access,
-        out_pub_key, out_priv_key);
-  }
-  if (err)
-    crypto::LogCSSMError("SecKeyCreatePair", err);
-  return err;
-}
-
-static OSStatus CreateSignatureContext(SecKeyRef key,
-                                       CSSM_ALGORITHMS algorithm,
-                                       CSSM_CC_HANDLE* out_cc_handle) {
-  OSStatus err;
-  const CSSM_ACCESS_CREDENTIALS* credentials = NULL;
-  {
-    base::AutoLock locked(crypto::GetMacSecurityServicesLock());
-    err = SecKeyGetCredentials(key,
-                               CSSM_ACL_AUTHORIZATION_SIGN,
-                               kSecCredentialTypeDefault,
-                               &credentials);
-  }
-  if (err) {
-    crypto::LogCSSMError("SecKeyGetCredentials", err);
-    return err;
-  }
-
-  CSSM_CSP_HANDLE csp_handle = 0;
-  {
-    base::AutoLock locked(crypto::GetMacSecurityServicesLock());
-    err = SecKeyGetCSPHandle(key, &csp_handle);
-  }
-  if (err) {
-    crypto::LogCSSMError("SecKeyGetCSPHandle", err);
-    return err;
-  }
-
-  const CSSM_KEY* cssm_key = NULL;
-  {
-    base::AutoLock locked(crypto::GetMacSecurityServicesLock());
-    err = SecKeyGetCSSMKey(key, &cssm_key);
-  }
-  if (err) {
-    crypto::LogCSSMError("SecKeyGetCSSMKey", err);
-    return err;
-  }
-
-  err = CSSM_CSP_CreateSignatureContext(csp_handle,
-                                        algorithm,
-                                        credentials,
-                                        cssm_key,
-                                        out_cc_handle);
-  if (err)
-    crypto::LogCSSMError("CSSM_CSP_CreateSignatureContext", err);
-  return err;
-}
-
-static OSStatus SignData(CSSM_DATA data,
-                         SecKeyRef private_key,
-                         CSSM_DATA* signature) {
-  CSSM_CC_HANDLE cc_handle;
-  OSStatus err = CreateSignatureContext(private_key,
-                                        CSSM_ALGID_MD5WithRSA,
-                                        &cc_handle);
-  if (err) {
-    crypto::LogCSSMError("CreateSignatureContext", err);
-    return err;
-  }
-  err = CSSM_SignData(cc_handle, &data, 1, CSSM_ALGID_NONE, signature);
-  if (err)
-    crypto::LogCSSMError("CSSM_SignData", err);
-  CSSM_DeleteContext(cc_handle);
-  return err;
-}
-
-}  // namespace net
-
-#pragma clang diagnostic pop  // "-Wdeprecated-declarations"
diff --git a/chromium/net/base/keygen_handler_nss.cc b/chromium/net/base/keygen_handler_nss.cc
deleted file mode 100644
index 97e0018f5e2..00000000000
--- a/chromium/net/base/keygen_handler_nss.cc
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/keygen_handler.h"
-
-#include <utility>
-
-#include "base/logging.h"
-#include "crypto/nss_crypto_module_delegate.h"
-#include "crypto/nss_util.h"
-#include "crypto/scoped_nss_types.h"
-#include "net/third_party/mozilla_security_manager/nsKeygenHandler.h"
-
-// PSM = Mozilla's Personal Security Manager.
-namespace psm = mozilla_security_manager;
-
-namespace net {
-
-std::string KeygenHandler::GenKeyAndSignChallenge() {
-  crypto::EnsureNSSInit();
-
-  crypto::ScopedPK11Slot slot;
-  if (crypto_module_delegate_) {
-    slot = crypto_module_delegate_->RequestSlot();
-  } else {
-    LOG(ERROR) << "Could not get an NSS key slot.";
-    return std::string();
-  }
-
-  // Authenticate to the token.
-  if (SECSuccess != PK11_Authenticate(slot.get(),
-                                      PR_TRUE,
-                                      crypto_module_delegate_->wincx())) {
-    LOG(ERROR) << "Could not authenticate to the key slot.";
-    return std::string();
-  }
-
-  return psm::GenKeyAndSignChallenge(key_size_in_bits_, challenge_, url_,
-                                     slot.get(), stores_key_);
-}
-
-void KeygenHandler::set_crypto_module_delegate(
-    std::unique_ptr<crypto::NSSCryptoModuleDelegate> delegate) {
-  crypto_module_delegate_ = std::move(delegate);
-}
-
-}  // namespace net
diff --git a/chromium/net/base/keygen_handler_openssl.cc b/chromium/net/base/keygen_handler_openssl.cc
deleted file mode 100644
index 161a5b743d8..00000000000
--- a/chromium/net/base/keygen_handler_openssl.cc
+++ /dev/null
@@ -1,122 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <stdint.h>
-
-#include <memory>
-
-#include "base/base64.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/strings/string_piece.h"
-#include "crypto/openssl_util.h"
-#include "crypto/rsa_private_key.h"
-#include "net/base/keygen_handler.h"
-#include "net/base/openssl_private_key_store.h"
-#include "third_party/boringssl/src/include/openssl/bytestring.h"
-#include "third_party/boringssl/src/include/openssl/digest.h"
-#include "third_party/boringssl/src/include/openssl/evp.h"
-#include "third_party/boringssl/src/include/openssl/mem.h"
-
-namespace net {
-
-std::string KeygenHandler::GenKeyAndSignChallenge() {
-  std::unique_ptr<crypto::RSAPrivateKey> key(
-      crypto::RSAPrivateKey::Create(key_size_in_bits_));
-  EVP_PKEY* pkey = key->key();
-
-  if (stores_key_)
-    OpenSSLPrivateKeyStore::StoreKeyPair(url_, pkey);
-
-  // Serialize the following structure, from
-  // https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen.
-  //
-  //   PublicKeyAndChallenge ::= SEQUENCE {
-  //       spki SubjectPublicKeyInfo,
-  //       challenge IA5STRING
-  //   }
-  //
-  //   SignedPublicKeyAndChallenge ::= SEQUENCE {
-  //       publicKeyAndChallenge PublicKeyAndChallenge,
-  //       signatureAlgorithm AlgorithmIdentifier,
-  //       signature BIT STRING
-  //   }
-  //
-  // The signature is over the PublicKeyAndChallenge.
-
-  // TODO(davidben): If we gain another consumer, factor this code out into
-  // shared logic, sharing OID definitions with the verifier, to support signing
-  // other X.509-style structures.
-
-  crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
-
-  // Serialize up to the PublicKeyAndChallenge.
-  bssl::ScopedCBB cbb;
-  CBB spkac, public_key_and_challenge, challenge;
-  if (!CBB_init(cbb.get(), 0) ||
-      !CBB_add_asn1(cbb.get(), &spkac, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&spkac, &public_key_and_challenge, CBS_ASN1_SEQUENCE) ||
-      !EVP_marshal_public_key(&public_key_and_challenge, pkey) ||
-      !CBB_add_asn1(&public_key_and_challenge, &challenge,
-                    CBS_ASN1_IA5STRING) ||
-      !CBB_add_bytes(&challenge,
-                     reinterpret_cast<const uint8_t*>(challenge_.data()),
-                     challenge_.size()) ||
-      !CBB_flush(&spkac)) {
-    return std::string();
-  }
-
-  // Hash what's been written so far.
-  bssl::ScopedEVP_MD_CTX ctx;
-  if (!EVP_DigestSignInit(ctx.get(), nullptr, EVP_md5(), nullptr, pkey) ||
-      !EVP_DigestSignUpdate(ctx.get(), CBB_data(&spkac), CBB_len(&spkac))) {
-    return std::string();
-  }
-
-  // The DER encoding of 1.2.840.113549.1.1.4, MD5 with RSA encryption.
-  static const uint8_t kMd5WithRsaEncryption[] = {
-      0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x04,
-  };
-
-  // Write the signatureAlgorithm.
-  CBB algorithm, oid, null;
-  if (!CBB_add_asn1(&spkac, &algorithm, CBS_ASN1_SEQUENCE) ||
-      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
-      !CBB_add_bytes(&oid, kMd5WithRsaEncryption,
-                     sizeof(kMd5WithRsaEncryption)) ||
-      !CBB_add_asn1(&algorithm, &null, CBS_ASN1_NULL)) {
-    return std::string();
-  }
-
-  // Compute and write the signature. Note that X.509 signatures, although
-  // always byte strings for RSA, are encoded as BIT STRINGS with a multiple of
-  // 8 bits.
-  CBB sig_bitstring;
-  uint8_t* sig;
-  size_t sig_len;
-  if (!CBB_add_asn1(&spkac, &sig_bitstring, CBS_ASN1_BITSTRING) ||
-      !CBB_add_u8(&sig_bitstring, 0 /* no unused bits */) ||
-      // Determine the maximum length of the signature.
-      !EVP_DigestSignFinal(ctx.get(), nullptr, &sig_len) ||
-      // Reserve |sig_len| bytes and write the signature to |spkac|.
-      !CBB_reserve(&sig_bitstring, &sig, sig_len) ||
-      !EVP_DigestSignFinal(ctx.get(), sig, &sig_len) ||
-      !CBB_did_write(&sig_bitstring, sig_len)) {
-    return std::string();
-  }
-
-  // Finally, the structure is base64-encoded.
-  uint8_t* der;
-  size_t der_len;
-  if (!CBB_finish(cbb.get(), &der, &der_len)) {
-    return std::string();
-  }
-  std::string result;
-  base::Base64Encode(
-      base::StringPiece(reinterpret_cast<const char*>(der), der_len), &result);
-  OPENSSL_free(der);
-  return result;
-}
-
-}  // namespace net
diff --git a/chromium/net/base/keygen_handler_unittest.cc b/chromium/net/base/keygen_handler_unittest.cc
deleted file mode 100644
index b0c90b238ff..00000000000
--- a/chromium/net/base/keygen_handler_unittest.cc
+++ /dev/null
@@ -1,230 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/keygen_handler.h"
-
-#include <stdint.h>
-
-#include <string>
-#include <utility>
-
-#include "base/base64.h"
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/strings/string_piece.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/threading/thread_restrictions.h"
-#include "base/threading/worker_pool.h"
-#include "build/build_config.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/boringssl/src/include/openssl/bytestring.h"
-#include "third_party/boringssl/src/include/openssl/evp.h"
-
-#if defined(USE_NSS_CERTS)
-#include <private/pprthred.h>  // PR_DetachThread
-#include "crypto/nss_crypto_module_delegate.h"
-#include "crypto/scoped_test_nss_db.h"
-#endif
-
-namespace net {
-
-namespace {
-
-#if defined(USE_NSS_CERTS)
-class StubCryptoModuleDelegate : public crypto::NSSCryptoModuleDelegate {
-  public:
-   explicit StubCryptoModuleDelegate(crypto::ScopedPK11Slot slot)
-       : slot_(std::move(slot)) {}
-
-   std::string RequestPassword(const std::string& slot_name,
-                               bool retry,
-                               bool* cancelled) override {
-     return std::string();
-   }
-
-   crypto::ScopedPK11Slot RequestSlot() override {
-     return crypto::ScopedPK11Slot(PK11_ReferenceSlot(slot_.get()));
-   }
-
-  private:
-   crypto::ScopedPK11Slot slot_;
-};
-#endif
-
-const char kChallenge[] = "some challenge";
-
-class KeygenHandlerTest : public ::testing::Test {
- public:
-  KeygenHandlerTest() {}
-  ~KeygenHandlerTest() override {}
-
-  std::unique_ptr<KeygenHandler> CreateKeygenHandler() {
-    std::unique_ptr<KeygenHandler> handler(
-        new KeygenHandler(768, kChallenge, GURL("http://www.example.com")));
-#if defined(USE_NSS_CERTS)
-    handler->set_crypto_module_delegate(
-        std::unique_ptr<crypto::NSSCryptoModuleDelegate>(
-            new StubCryptoModuleDelegate(crypto::ScopedPK11Slot(
-                PK11_ReferenceSlot(test_nss_db_.slot())))));
-#endif
-    return handler;
-  }
-
- private:
-#if defined(USE_NSS_CERTS)
-  crypto::ScopedTestNSSDB test_nss_db_;
-#endif
-};
-
-base::StringPiece StringPieceFromCBS(const CBS& cbs) {
-  return base::StringPiece(reinterpret_cast<const char*>(CBS_data(&cbs)),
-                           CBS_len(&cbs));
-}
-
-// Assert that |result| is a valid output for KeygenHandler given challenge
-// string of |challenge|.
-void AssertValidSignedPublicKeyAndChallenge(const std::string& result,
-                                            const std::string& challenge) {
-  // Verify it's valid base64:
-  std::string spkac;
-  ASSERT_TRUE(base::Base64Decode(result, &spkac));
-
-  // Parse the following structure:
-  //
-  //   PublicKeyAndChallenge ::= SEQUENCE {
-  //     spki SubjectPublicKeyInfo,
-  //     challenge IA5STRING
-  //   }
-  //   SignedPublicKeyAndChallenge ::= SEQUENCE {
-  //     publicKeyAndChallenge PublicKeyAndChallenge,
-  //     signatureAlgorithm AlgorithmIdentifier,
-  //     signature BIT STRING
-  //   }
-
-  CBS cbs;
-  CBS_init(&cbs, reinterpret_cast<const uint8_t*>(spkac.data()), spkac.size());
-
-  // The input should consist of a SEQUENCE.
-  CBS child;
-  ASSERT_TRUE(CBS_get_asn1(&cbs, &child, CBS_ASN1_SEQUENCE));
-  ASSERT_EQ(0u, CBS_len(&cbs));
-
-  // Extract the raw PublicKeyAndChallenge.
-  CBS public_key_and_challenge_raw;
-  ASSERT_TRUE(CBS_get_asn1_element(&child, &public_key_and_challenge_raw,
-                                   CBS_ASN1_SEQUENCE));
-
-  // Parse out the PublicKeyAndChallenge.
-  CBS copy = public_key_and_challenge_raw;
-  CBS public_key_and_challenge;
-  ASSERT_TRUE(
-      CBS_get_asn1(&copy, &public_key_and_challenge, CBS_ASN1_SEQUENCE));
-  ASSERT_EQ(0u, CBS_len(&copy));
-  bssl::UniquePtr<EVP_PKEY> key(
-      EVP_parse_public_key(&public_key_and_challenge));
-  ASSERT_TRUE(key);
-  CBS challenge_spkac;
-  ASSERT_TRUE(CBS_get_asn1(&public_key_and_challenge, &challenge_spkac,
-                           CBS_ASN1_IA5STRING));
-  ASSERT_EQ(0u, CBS_len(&public_key_and_challenge));
-
-  // The challenge must match.
-  ASSERT_EQ(challenge, StringPieceFromCBS(challenge_spkac));
-
-  // The next element must be the AlgorithmIdentifier for MD5 with RSA.
-  static const uint8_t kMd5WithRsaEncryption[] = {
-      0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
-      0xf7, 0x0d, 0x01, 0x01, 0x04, 0x05, 0x00,
-  };
-  CBS algorithm;
-  ASSERT_TRUE(CBS_get_bytes(&child, &algorithm, sizeof(kMd5WithRsaEncryption)));
-  ASSERT_EQ(
-      base::StringPiece(reinterpret_cast<const char*>(kMd5WithRsaEncryption),
-                        sizeof(kMd5WithRsaEncryption)),
-      StringPieceFromCBS(algorithm));
-
-  // Finally, parse the signature.
-  CBS signature;
-  ASSERT_TRUE(CBS_get_asn1(&child, &signature, CBS_ASN1_BITSTRING));
-  ASSERT_EQ(0u, CBS_len(&child));
-  uint8_t pad;
-  ASSERT_TRUE(CBS_get_u8(&signature, &pad));
-  ASSERT_EQ(0u, pad);
-
-  // Check the signature.
-  bssl::ScopedEVP_MD_CTX ctx;
-  ASSERT_TRUE(
-      EVP_DigestVerifyInit(ctx.get(), nullptr, EVP_md5(), nullptr, key.get()));
-  ASSERT_TRUE(EVP_DigestVerifyUpdate(ctx.get(),
-                                     CBS_data(&public_key_and_challenge_raw),
-                                     CBS_len(&public_key_and_challenge_raw)));
-  ASSERT_TRUE(EVP_DigestVerifyFinal(ctx.get(), CBS_data(&signature),
-                                    CBS_len(&signature)));
-}
-
-TEST_F(KeygenHandlerTest, SmokeTest) {
-  std::unique_ptr<KeygenHandler> handler(CreateKeygenHandler());
-  handler->set_stores_key(false);  // Don't leave the key-pair behind
-  std::string result = handler->GenKeyAndSignChallenge();
-  VLOG(1) << "KeygenHandler produced: " << result;
-  AssertValidSignedPublicKeyAndChallenge(result, kChallenge);
-}
-
-void ConcurrencyTestCallback(const std::string& challenge,
-                             base::WaitableEvent* event,
-                             std::unique_ptr<KeygenHandler> handler,
-                             std::string* result) {
-  // We allow Singleton use on the worker thread here since we use a
-  // WaitableEvent to synchronize, so it's safe.
-  base::ThreadRestrictions::ScopedAllowSingleton scoped_allow_singleton;
-  handler->set_stores_key(false);  // Don't leave the key-pair behind.
-  *result = handler->GenKeyAndSignChallenge();
-  event->Signal();
-#if defined(USE_NSS_CERTS)
-  // Detach the thread from NSPR.
-  // Calling NSS functions attaches the thread to NSPR, which stores
-  // the NSPR thread ID in thread-specific data.
-  // The threads in our thread pool terminate after we have called
-  // PR_Cleanup.  Unless we detach them from NSPR, net_unittests gets
-  // segfaults on shutdown when the threads' thread-specific data
-  // destructors run.
-  PR_DetachThread();
-#endif
-}
-
-// We asynchronously generate the keys so as not to hang up the IO thread. This
-// test tries to catch concurrency problems in the keygen implementation.
-TEST_F(KeygenHandlerTest, ConcurrencyTest) {
-  const int NUM_HANDLERS = 5;
-  base::WaitableEvent* events[NUM_HANDLERS] = { NULL };
-  std::string results[NUM_HANDLERS];
-  for (int i = 0; i < NUM_HANDLERS; i++) {
-    std::unique_ptr<KeygenHandler> handler(CreateKeygenHandler());
-    events[i] = new base::WaitableEvent(
-        base::WaitableEvent::ResetPolicy::AUTOMATIC,
-        base::WaitableEvent::InitialState::NOT_SIGNALED);
-    base::WorkerPool::PostTask(FROM_HERE,
-                               base::Bind(ConcurrencyTestCallback,
-                                          "some challenge",
-                                          events[i],
-                                          base::Passed(&handler),
-                                          &results[i]),
-                               true);
-  }
-
-  for (int i = 0; i < NUM_HANDLERS; i++) {
-    // Make sure the job completed
-    events[i]->Wait();
-    delete events[i];
-    events[i] = NULL;
-
-    VLOG(1) << "KeygenHandler " << i << " produced: " << results[i];
-    AssertValidSignedPublicKeyAndChallenge(results[i], "some challenge");
-  }
-}
-
-}  // namespace
-
-}  // namespace net
diff --git a/chromium/net/base/keygen_handler_win.cc b/chromium/net/base/keygen_handler_win.cc
deleted file mode 100644
index f88e7e12579..00000000000
--- a/chromium/net/base/keygen_handler_win.cc
+++ /dev/null
@@ -1,218 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/keygen_handler.h"
-
-#include <windows.h>
-#include <rpc.h>
-
-#include <list>
-#include <string>
-#include <vector>
-
-#include "base/base64.h"
-#include "base/logging.h"
-#include "base/strings/string_piece.h"
-#include "base/strings/string_util.h"
-#include "base/strings/utf_string_conversions.h"
-#include "crypto/capi_util.h"
-#include "crypto/scoped_capi_types.h"
-#include "crypto/wincrypt_shim.h"
-
-namespace net {
-
-// Assigns the contents of a CERT_PUBLIC_KEY_INFO structure for the signing
-// key in |prov| to |output|. Returns true if encoding was successful.
-bool GetSubjectPublicKeyInfo(HCRYPTPROV prov, std::vector<BYTE>* output) {
-  BOOL ok;
-  DWORD size = 0;
-
-  // From the private key stored in HCRYPTPROV, obtain the public key, stored
-  // as a CERT_PUBLIC_KEY_INFO structure. Currently, only RSA public keys are
-  // supported.
-  ok = CryptExportPublicKeyInfoEx(prov, AT_KEYEXCHANGE, X509_ASN_ENCODING,
-                                  const_cast<char*>(szOID_RSA_RSA), 0, NULL,
-                                  NULL, &size);
-  DCHECK(ok);
-  if (!ok)
-    return false;
-
-  output->resize(size);
-
-  PCERT_PUBLIC_KEY_INFO public_key_casted =
-      reinterpret_cast<PCERT_PUBLIC_KEY_INFO>(&(*output)[0]);
-  ok = CryptExportPublicKeyInfoEx(prov, AT_KEYEXCHANGE, X509_ASN_ENCODING,
-                                  const_cast<char*>(szOID_RSA_RSA), 0, NULL,
-                                  public_key_casted, &size);
-  DCHECK(ok);
-  if (!ok)
-    return false;
-
-  output->resize(size);
-
-  return true;
-}
-
-// Generates a DER encoded SignedPublicKeyAndChallenge structure from the
-// signing key of |prov| and the specified ASCII |challenge| string and
-// appends it to |output|.
-// True if the encoding was successfully generated.
-bool GetSignedPublicKeyAndChallenge(HCRYPTPROV prov,
-                                    const std::string& challenge,
-                                    std::string* output) {
-  base::string16 challenge16 = base::ASCIIToUTF16(challenge);
-  std::vector<BYTE> spki;
-
-  if (!GetSubjectPublicKeyInfo(prov, &spki))
-    return false;
-
-  // PublicKeyAndChallenge ::= SEQUENCE {
-  //     spki SubjectPublicKeyInfo,
-  //     challenge IA5STRING
-  // }
-  CERT_KEYGEN_REQUEST_INFO pkac;
-  pkac.dwVersion = CERT_KEYGEN_REQUEST_V1;
-  pkac.SubjectPublicKeyInfo =
-      *reinterpret_cast<PCERT_PUBLIC_KEY_INFO>(&spki[0]);
-  pkac.pwszChallengeString = const_cast<base::char16*>(challenge16.c_str());
-
-  CRYPT_ALGORITHM_IDENTIFIER sig_alg;
-  memset(&sig_alg, 0, sizeof(sig_alg));
-  sig_alg.pszObjId = const_cast<char*>(szOID_RSA_MD5RSA);
-
-  BOOL ok;
-  DWORD size = 0;
-  std::vector<BYTE> signed_pkac;
-  ok = CryptSignAndEncodeCertificate(prov, AT_KEYEXCHANGE, X509_ASN_ENCODING,
-                                     X509_KEYGEN_REQUEST_TO_BE_SIGNED,
-                                     &pkac, &sig_alg, NULL,
-                                     NULL, &size);
-  DCHECK(ok);
-  if (!ok)
-    return false;
-
-  signed_pkac.resize(size);
-  ok = CryptSignAndEncodeCertificate(prov, AT_KEYEXCHANGE, X509_ASN_ENCODING,
-                                     X509_KEYGEN_REQUEST_TO_BE_SIGNED,
-                                     &pkac, &sig_alg, NULL,
-                                     &signed_pkac[0], &size);
-  DCHECK(ok);
-  if (!ok)
-    return false;
-
-  output->assign(reinterpret_cast<char*>(&signed_pkac[0]), size);
-  return true;
-}
-
-// Generates a unique name for the container which will store the key that is
-// generated. The traditional Windows approach is to use a GUID here.
-std::wstring GetNewKeyContainerId() {
-  RPC_STATUS status = RPC_S_OK;
-  std::wstring result;
-
-  UUID id = { 0 };
-  status = UuidCreateSequential(&id);
-  if (status != RPC_S_OK && status != RPC_S_UUID_LOCAL_ONLY)
-    return result;
-
-  RPC_WSTR rpc_string = NULL;
-  status = UuidToString(&id, &rpc_string);
-  if (status != RPC_S_OK)
-    return result;
-
-  // RPC_WSTR is unsigned short*.  wchar_t is a built-in type of Visual C++,
-  // so the type cast is necessary.
-  result.assign(reinterpret_cast<wchar_t*>(rpc_string));
-  RpcStringFree(&rpc_string);
-
-  return result;
-}
-
-// This is a helper struct designed to optionally delete a key after releasing
-// the associated provider.
-struct KeyContainer {
- public:
-  explicit KeyContainer(bool delete_keyset)
-      : delete_keyset_(delete_keyset) {}
-
-  ~KeyContainer() {
-    if (provider_) {
-      provider_.reset();
-      if (delete_keyset_ && !key_id_.empty()) {
-        HCRYPTPROV provider;
-        crypto::CryptAcquireContextLocked(&provider, key_id_.c_str(), NULL,
-            PROV_RSA_FULL, CRYPT_SILENT | CRYPT_DELETEKEYSET);
-      }
-    }
-  }
-
-  crypto::ScopedHCRYPTPROV provider_;
-  std::wstring key_id_;
-
- private:
-  bool delete_keyset_;
-};
-
-std::string KeygenHandler::GenKeyAndSignChallenge() {
-  KeyContainer key_container(!stores_key_);
-
-  // TODO(rsleevi): Have the user choose which provider they should use, which
-  // needs to be filtered by those providers which can provide the key type
-  // requested or the key size requested. This is especially important for
-  // generating certificates that will be stored on smart cards.
-  const int kMaxAttempts = 5;
-  int attempt;
-  for (attempt = 0; attempt < kMaxAttempts; ++attempt) {
-    // Per MSDN documentation for CryptAcquireContext, if applications will be
-    // creating their own keys, they should ensure unique naming schemes to
-    // prevent overlap with any other applications or consumers of CSPs, and
-    // *should not* store new keys within the default, NULL key container.
-    key_container.key_id_ = GetNewKeyContainerId();
-    if (key_container.key_id_.empty())
-      return std::string();
-
-    // Only create new key containers, so that existing key containers are not
-    // overwritten.
-    if (crypto::CryptAcquireContextLocked(key_container.provider_.receive(),
-            key_container.key_id_.c_str(), NULL, PROV_RSA_FULL,
-            CRYPT_SILENT | CRYPT_NEWKEYSET))
-      break;
-
-    if (GetLastError() != static_cast<DWORD>(NTE_BAD_KEYSET)) {
-      LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider "
-                    "context: " << GetLastError();
-      return std::string();
-    }
-  }
-  if (attempt == kMaxAttempts) {
-    LOG(ERROR) << "Keygen failed: Couldn't acquire a CryptoAPI provider "
-                  "context: Max retries exceeded";
-    return std::string();
-  }
-
-  {
-    crypto::ScopedHCRYPTKEY key;
-    if (!CryptGenKey(key_container.provider_, CALG_RSA_KEYX,
-        (key_size_in_bits_ << 16) | CRYPT_EXPORTABLE, key.receive())) {
-      LOG(ERROR) << "Keygen failed: Couldn't generate an RSA key";
-      return std::string();
-    }
-
-    std::string spkac;
-    if (!GetSignedPublicKeyAndChallenge(key_container.provider_, challenge_,
-                                        &spkac)) {
-      LOG(ERROR) << "Keygen failed: Couldn't generate the signed public key "
-                    "and challenge";
-      return std::string();
-    }
-
-    std::string result;
-    base::Base64Encode(spkac, &result);
-
-    VLOG(1) << "Keygen succeeded";
-    return result;
-  }
-}
-
-}  // namespace net
diff --git a/chromium/net/base/linked_hash_map.h b/chromium/net/base/linked_hash_map.h
index 8397243958c..e12fd12af38 100644
--- a/chromium/net/base/linked_hash_map.h
+++ b/chromium/net/base/linked_hash_map.h
@@ -12,8 +12,8 @@
 // Iterators should be stable in the face of mutations, except for an
 // iterator pointing to an element that was just deleted.
 
-#ifndef UTIL_GTL_LINKED_HASH_MAP_H_
-#define UTIL_GTL_LINKED_HASH_MAP_H_
+#ifndef NET_BASE_LINKED_HASH_MAP_H_
+#define NET_BASE_LINKED_HASH_MAP_H_
 
 #include <stddef.h>
 
@@ -261,4 +261,4 @@ class linked_hash_map {
 
 }  // namespace net
 
-#endif  // UTIL_GTL_LINKED_HASH_MAP_H_
+#endif  // NET_BASE_LINKED_HASH_MAP_H_
diff --git a/chromium/net/base/load_timing_info.cc b/chromium/net/base/load_timing_info.cc
index f3301fb2191..875acdd1bbe 100644
--- a/chromium/net/base/load_timing_info.cc
+++ b/chromium/net/base/load_timing_info.cc
@@ -20,4 +20,3 @@ LoadTimingInfo::LoadTimingInfo(const LoadTimingInfo& other) = default;
 LoadTimingInfo::~LoadTimingInfo() {}
 
 }  // namespace net
-
diff --git a/chromium/net/base/logging_network_change_observer.h b/chromium/net/base/logging_network_change_observer.h
index 503cb4ff3d8..1d0d61e6e33 100644
--- a/chromium/net/base/logging_network_change_observer.h
+++ b/chromium/net/base/logging_network_change_observer.h
@@ -54,4 +54,4 @@ class NET_EXPORT LoggingNetworkChangeObserver
 
 }  // namespace net
 
-#endif  // NET_BASE_LOGGING_NETWORK_CHANGE_OBSERVER_H_
\ No newline at end of file
+#endif  // NET_BASE_LOGGING_NETWORK_CHANGE_OBSERVER_H_
diff --git a/chromium/net/base/mime_sniffer.cc b/chromium/net/base/mime_sniffer.cc
index faa5a0d84d3..0b280ca70b9 100644
--- a/chromium/net/base/mime_sniffer.cc
+++ b/chromium/net/base/mime_sniffer.cc
@@ -108,11 +108,11 @@ namespace net {
 static const size_t kBytesRequiredForMagic = 42;
 
 struct MagicNumber {
-  const char* const mime_type;
-  const char* const magic;
+  const char* mime_type;
+  const char* magic;
   size_t magic_len;
   bool is_string;
-  const char* const mask;  // if set, must have same length as |magic|
+  const char* mask;  // if set, must have same length as |magic|
 };
 
 #define MAGIC_NUMBER(mime_type, magic) \
@@ -203,7 +203,7 @@ enum OfficeDocType {
 
 struct OfficeExtensionType {
   OfficeDocType doc_type;
-  const char* const extension;
+  const char* extension;
   size_t extension_len;
 };
 
diff --git a/chromium/net/base/net_error_details.h b/chromium/net/base/net_error_details.h
index a7f239a3a91..5d10d11c517 100644
--- a/chromium/net/base/net_error_details.h
+++ b/chromium/net/base/net_error_details.h
@@ -7,7 +7,7 @@
 
 #include "net/base/net_export.h"
 #include "net/http/http_response_info.h"
-#include "net/quic/core/quic_protocol.h"
+#include "net/quic/core/quic_packets.h"
 
 namespace net {
 
@@ -41,4 +41,4 @@ struct NET_EXPORT NetErrorDetails {
 
 }  // namespace net
 
-#endif
+#endif  // NET_BASE_NET_ERROR_DETAILS_H_
diff --git a/chromium/net/base/net_error_list.h b/chromium/net/base/net_error_list.h
index 0694b6958d2..617a56d41f7 100644
--- a/chromium/net/base/net_error_list.h
+++ b/chromium/net/base/net_error_list.h
@@ -112,6 +112,14 @@ NET_ERROR(CONTEXT_SHUT_DOWN, -26)
 // checks, for instance).
 NET_ERROR(BLOCKED_BY_RESPONSE, -27)
 
+// The request failed after the response was received, based on client-side
+// heuristics that point to the possiblility of a cross-site scripting attack.
+NET_ERROR(BLOCKED_BY_XSS_AUDITOR, -28)
+
+// The request was blocked by system policy disallowing some or all cleartext
+// requests. Used for NetworkSecurityPolicy on Android.
+NET_ERROR(CLEARTEXT_NOT_PERMITTED, -29)
+
 // A connection was closed (corresponding to a TCP FIN).
 NET_ERROR(CONNECTION_CLOSED, -100)
 
@@ -316,8 +324,7 @@ NET_ERROR(SSL_SERVER_CERT_CHANGED, -156)
 
 // Error -157 was removed (SSL_INAPPROPRIATE_FALLBACK).
 
-// Certificate Transparency: All Signed Certificate Timestamps failed to verify.
-NET_ERROR(CT_NO_SCTS_VERIFIED_OK, -158)
+// Error -158 was removed (CT_NO_SCTS_VERIFIED_OK).
 
 // The SSL server sent us a fatal unrecognized_name alert.
 NET_ERROR(SSL_UNRECOGNIZED_NAME_ALERT, -159)
@@ -375,6 +382,10 @@ NET_ERROR(CT_CONSISTENCY_PROOF_PARSING_FAILED, -171)
 // fallback will be removed.
 NET_ERROR(SSL_OBSOLETE_CIPHER, -172)
 
+// When a WebSocket handshake is done successfully and the connection has been
+// upgraded, the URLRequest is cancelled with this error code.
+NET_ERROR(WS_UPGRADE, -173)
+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.
@@ -732,11 +743,11 @@ NET_ERROR(CACHE_AUTH_FAILURE_AFTER_READ, -410)
 // The server's response was insecure (e.g. there was a cert error).
 NET_ERROR(INSECURE_RESPONSE, -501)
 
-// The server responded to a <keygen> with a generated client cert that we
-// don't have the matching private key for.
+// An attempt to import a client certificate failed, as the user's key
+// database lacked a corresponding private key.
 NET_ERROR(NO_PRIVATE_KEY_FOR_CERT, -502)
 
-// An error adding to the OS certificate database (e.g. OS X Keychain).
+// An error adding a certificate to the OS certificate database.
 NET_ERROR(ADD_USER_CERT_FAILED, -503)
 
 // *** Code -600 is reserved (was FTP_PASV_COMMAND_FAILED). ***
diff --git a/chromium/net/base/net_errors_posix.cc b/chromium/net/base/net_errors_posix.cc
index a8573fdfc68..123f7e54d67 100644
--- a/chromium/net/base/net_errors_posix.cc
+++ b/chromium/net/base/net_errors_posix.cc
@@ -10,7 +10,6 @@
 #include <unistd.h>
 
 #include "base/logging.h"
-#include "base/strings/stringprintf.h"
 
 namespace net {
 
diff --git a/chromium/net/base/network_change_notifier.h b/chromium/net/base/network_change_notifier.h
index 27a798d04d1..1cefe85ff6e 100644
--- a/chromium/net/base/network_change_notifier.h
+++ b/chromium/net/base/network_change_notifier.h
@@ -15,8 +15,6 @@
 #include "base/time/time.h"
 #include "net/base/net_export.h"
 
-class GURL;
-
 namespace net {
 
 struct DnsConfig;
diff --git a/chromium/net/base/network_delegate.cc b/chromium/net/base/network_delegate.cc
index 192b9e37cef..8116432060d 100644
--- a/chromium/net/base/network_delegate.cc
+++ b/chromium/net/base/network_delegate.cc
@@ -9,6 +9,7 @@
 #include "base/trace_event/trace_event.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
+#include "net/base/trace_constants.h"
 #include "net/proxy/proxy_info.h"
 #include "net/url_request/url_request.h"
 
@@ -17,8 +18,7 @@ namespace net {
 int NetworkDelegate::NotifyBeforeURLRequest(
     URLRequest* request, const CompletionCallback& callback,
     GURL* new_url) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
-               "NetworkDelegate::NotifyBeforeURLRequest");
+  TRACE_EVENT0(kNetTracingCategory, "NetworkDelegate::NotifyBeforeURLRequest");
   DCHECK(CalledOnValidThread());
   DCHECK(request);
   DCHECK(!callback.is_null());
@@ -33,7 +33,7 @@ int NetworkDelegate::NotifyBeforeStartTransaction(
     URLRequest* request,
     const CompletionCallback& callback,
     HttpRequestHeaders* headers) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
+  TRACE_EVENT0(kNetTracingCategory,
                "NetworkDelegate::NotifyBeforeStartTransation");
   DCHECK(CalledOnValidThread());
   DCHECK(headers);
@@ -54,8 +54,7 @@ void NetworkDelegate::NotifyBeforeSendHeaders(
 void NetworkDelegate::NotifyStartTransaction(
     URLRequest* request,
     const HttpRequestHeaders& headers) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
-               "NetworkDelegate::NotifyStartTransaction");
+  TRACE_EVENT0(kNetTracingCategory, "NetworkDelegate::NotifyStartTransaction");
   DCHECK(CalledOnValidThread());
   OnStartTransaction(request, headers);
 }
@@ -66,8 +65,7 @@ int NetworkDelegate::NotifyHeadersReceived(
     const HttpResponseHeaders* original_response_headers,
     scoped_refptr<HttpResponseHeaders>* override_response_headers,
     GURL* allowed_unsafe_redirect_url) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
-               "NetworkDelegate::NotifyHeadersReceived");
+  TRACE_EVENT0(kNetTracingCategory, "NetworkDelegate::NotifyHeadersReceived");
   DCHECK(CalledOnValidThread());
   DCHECK(original_response_headers);
   DCHECK(!callback.is_null());
@@ -88,7 +86,7 @@ void NetworkDelegate::NotifyResponseStarted(URLRequest* request,
 
 void NetworkDelegate::NotifyNetworkBytesReceived(URLRequest* request,
                                                  int64_t bytes_received) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
+  TRACE_EVENT0(kNetTracingCategory,
                "NetworkDelegate::NotifyNetworkBytesReceived");
   DCHECK(CalledOnValidThread());
   DCHECK_GT(bytes_received, 0);
@@ -112,8 +110,7 @@ void NetworkDelegate::NotifyBeforeRedirect(URLRequest* request,
 void NetworkDelegate::NotifyCompleted(URLRequest* request,
                                       bool started,
                                       int net_error) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
-               "NetworkDelegate::NotifyCompleted");
+  TRACE_EVENT0(kNetTracingCategory, "NetworkDelegate::NotifyCompleted");
   DCHECK(CalledOnValidThread());
   DCHECK(request);
   // TODO(cbentzel): Remove ScopedTracker below once crbug.com/475753 is fixed.
@@ -124,7 +121,7 @@ void NetworkDelegate::NotifyCompleted(URLRequest* request,
 }
 
 void NetworkDelegate::NotifyURLRequestDestroyed(URLRequest* request) {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
+  TRACE_EVENT0(kNetTracingCategory,
                "NetworkDelegate::NotifyURLRequestDestroyed");
   DCHECK(CalledOnValidThread());
   DCHECK(request);
@@ -170,8 +167,7 @@ bool NetworkDelegate::CanAccessFile(const URLRequest& request,
 bool NetworkDelegate::CanEnablePrivacyMode(
     const GURL& url,
     const GURL& first_party_for_cookies) const {
-  TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("net"),
-               "NetworkDelegate::CanEnablePrivacyMode");
+  TRACE_EVENT0(kNetTracingCategory, "NetworkDelegate::CanEnablePrivacyMode");
   DCHECK(CalledOnValidThread());
   return OnCanEnablePrivacyMode(url, first_party_for_cookies);
 }
diff --git a/chromium/net/base/network_interfaces_unittest.cc b/chromium/net/base/network_interfaces_unittest.cc
index 718e796e8d3..7f36c556343 100644
--- a/chromium/net/base/network_interfaces_unittest.cc
+++ b/chromium/net/base/network_interfaces_unittest.cc
@@ -14,7 +14,6 @@
 #include "base/scoped_native_library.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
-#include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/sys_byteorder.h"
 #include "base/time/time.h"
diff --git a/chromium/net/base/network_throttle_manager.h b/chromium/net/base/network_throttle_manager.h
index 4fde0f245d2..96a864e6784 100644
--- a/chromium/net/base/network_throttle_manager.h
+++ b/chromium/net/base/network_throttle_manager.h
@@ -24,12 +24,13 @@ namespace net {
 // Methods are virtual to allow for test mocks.
 class NET_EXPORT_PRIVATE NetworkThrottleManager {
  public:
+  class Throttle;
+
   // Abstract base class other classes can inherit from to get
   // notifications from throttle state changes.
   class NET_EXPORT_PRIVATE ThrottleDelegate {
    public:
-    // Called whenever the throttle state of this stream has changed.
-    // The new state can be determined through Throttle::IsThrottled().
+    // Called when a throttle is unblocked.
     //
     // Note that this call may occur as the result of either a call to
     // Throttle::SetPriority (on the throttle related to this delegate
@@ -37,7 +38,7 @@ class NET_EXPORT_PRIVATE NetworkThrottleManager {
     // so will occur synchronously during those events.  It will not
     // be called from the destructor of the Throttle associated with
     // the ThrottleDelegate.
-    virtual void OnThrottleStateChanged() = 0;
+    virtual void OnThrottleUnblocked(Throttle* throttle) = 0;
 
    protected:
     virtual ~ThrottleDelegate() {}
@@ -45,24 +46,28 @@ class NET_EXPORT_PRIVATE NetworkThrottleManager {
 
   // Class owned by external stream representations that
   // routes notifications.  It may be constructed in either the
-  // throttled or unthrottled state according to the state of the
-  // NetworkThrottleManager; if it's constructed in the throttled
-  // state, it will only make a single transition to unthrottled,
-  // which will be signaled by delegate->OnThrottleStateChanged().
-  // If it's constructed in the unthrottled state, it will remain
+  // blocked or unblocked state according to the state of the
+  // NetworkThrottleManager; if it's constructed in the unblocked
+  // state, it will only make a single transition to unblocked,
+  // which will be signaled by delegate->OnThrottleUnblocked(this).
+  // If it's constructed in the unblocked state, it will remain
   // there.
   class NET_EXPORT_PRIVATE Throttle {
    public:
     virtual ~Throttle() {}
 
-    virtual bool IsThrottled() const = 0;
+    virtual bool IsBlocked() const = 0;
+
+    virtual RequestPriority Priority() const = 0;
 
     // Note that this may result in a possibly reentrant call to
-    // |ThrottleDelegate::OnThrottleStateChanged|, as well as the resumption
+    // |ThrottleDelegate::OnThrottleUnblocked|, as well as the resumption
     // of this or other requests, which may result in request completion
     // and destruction before return.  Any caller of this function
     // should not rely on this object or containing objects surviving
     // this call.
+    //
+    // This call is a no-op if the priority is set to its current value.
     virtual void SetPriority(RequestPriority priority) = 0;
 
    protected:
@@ -80,8 +85,6 @@ class NET_EXPORT_PRIVATE NetworkThrottleManager {
                                                    RequestPriority priority,
                                                    bool ignore_limits) = 0;
 
-  static std::unique_ptr<NetworkThrottleManager> CreateThrottler();
-
  protected:
   NetworkThrottleManager() {}
 
diff --git a/chromium/net/base/network_throttle_manager_impl.cc b/chromium/net/base/network_throttle_manager_impl.cc
new file mode 100644
index 00000000000..eda6fea2cfc
--- /dev/null
+++ b/chromium/net/base/network_throttle_manager_impl.cc
@@ -0,0 +1,326 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/network_throttle_manager_impl.h"
+
+#include <algorithm>
+
+#include "base/logging.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "base/time/default_tick_clock.h"
+
+namespace net {
+
+const size_t NetworkThrottleManagerImpl::kActiveRequestThrottlingLimit = 2;
+const int NetworkThrottleManagerImpl::kMedianLifetimeMultiple = 5;
+
+// Initial estimate based on the median in the
+// Net.RequestTime2.Success histogram, excluding cached results by eye.
+const int NetworkThrottleManagerImpl::kInitialMedianInMs = 400;
+
+// Set timers slightly further into the future than they need to be set, so
+// that the algorithm isn't vulnerable to timer round off errors triggering
+// the callback before the throttle would be considered aged out of the set.
+// Set to 17 to hanlde systems with |!base::TimeTicks::IsHighResolution()|.
+// Note that even if the timer goes off before it should, all that should cost
+// is a second task; this class does not rely on timer accuracy for its
+// correctness.
+const int kTimerFudgeInMs = 17;
+
+class NetworkThrottleManagerImpl::ThrottleImpl
+    : public NetworkThrottleManager::Throttle {
+ public:
+  // Allowed state transitions are BLOCKED -> OUTSTANDING -> AGED.
+  // Throttles may be created in the BLOCKED or OUTSTANDING states.
+  enum class State {
+    // Not allowed to proceed by manager.
+    BLOCKED,
+
+    // Allowed to proceed, counts as an "outstanding" request for
+    // manager accounting purposes.
+    OUTSTANDING,
+
+    // Old enough to not count as "outstanding" anymore for
+    // manager accounting purposes.
+    AGED
+  };
+
+  using ThrottleListQueuePointer =
+      NetworkThrottleManagerImpl::ThrottleList::iterator;
+
+  // Caller must arrange that |*delegate| and |*manager| outlive
+  // the ThrottleImpl class.
+  ThrottleImpl(bool blocked,
+               RequestPriority priority,
+               ThrottleDelegate* delegate,
+               NetworkThrottleManagerImpl* manager,
+               ThrottleListQueuePointer queue_pointer);
+
+  ~ThrottleImpl() override;
+
+  // Throttle:
+  bool IsBlocked() const override;
+  RequestPriority Priority() const override;
+  void SetPriority(RequestPriority priority) override;
+
+  State state() const { return state_; }
+
+  ThrottleListQueuePointer queue_pointer() const { return queue_pointer_; }
+  void set_queue_pointer(const ThrottleListQueuePointer& pointer) {
+    if (state_ != State::AGED)
+      DCHECK_EQ(this, *pointer);
+    queue_pointer_ = pointer;
+  }
+
+  void set_start_time(base::TimeTicks start_time) { start_time_ = start_time; }
+  base::TimeTicks start_time() const { return start_time_; }
+
+  // Change the throttle's state to AGED.  The previous
+  // state must be OUTSTANDING.
+  void SetAged();
+
+  // Note that this call calls the delegate, and hence may result in
+  // re-entrant calls into the manager or ThrottleImpl.  The manager should
+  // not rely on any state other than its own existence being persistent
+  // across this call.
+  void NotifyUnblocked();
+
+ private:
+  State state_;
+  RequestPriority priority_;
+  ThrottleDelegate* const delegate_;
+  NetworkThrottleManagerImpl* const manager_;
+
+  base::TimeTicks start_time_;
+
+  // To allow deletion from the blocked queue (when the throttle is in the
+  // blocked queue).
+  ThrottleListQueuePointer queue_pointer_;
+
+  DISALLOW_COPY_AND_ASSIGN(ThrottleImpl);
+};
+
+NetworkThrottleManagerImpl::ThrottleImpl::ThrottleImpl(
+    bool blocked,
+    RequestPriority priority,
+    NetworkThrottleManager::ThrottleDelegate* delegate,
+    NetworkThrottleManagerImpl* manager,
+    ThrottleListQueuePointer queue_pointer)
+    : state_(blocked ? State::BLOCKED : State::OUTSTANDING),
+      priority_(priority),
+      delegate_(delegate),
+      manager_(manager),
+      queue_pointer_(queue_pointer) {
+  DCHECK(delegate);
+  if (!blocked)
+    start_time_ = manager->tick_clock_->NowTicks();
+}
+
+NetworkThrottleManagerImpl::ThrottleImpl::~ThrottleImpl() {
+  manager_->OnThrottleDestroyed(this);
+}
+
+bool NetworkThrottleManagerImpl::ThrottleImpl::IsBlocked() const {
+  return state_ == State::BLOCKED;
+}
+
+RequestPriority NetworkThrottleManagerImpl::ThrottleImpl::Priority() const {
+  return priority_;
+}
+
+void NetworkThrottleManagerImpl::ThrottleImpl::SetPriority(
+    RequestPriority new_priority) {
+  RequestPriority old_priority(priority_);
+  if (old_priority == new_priority)
+    return;
+  priority_ = new_priority;
+  manager_->OnThrottlePriorityChanged(this, old_priority, new_priority);
+}
+
+void NetworkThrottleManagerImpl::ThrottleImpl::SetAged() {
+  DCHECK_EQ(State::OUTSTANDING, state_);
+  state_ = State::AGED;
+}
+
+void NetworkThrottleManagerImpl::ThrottleImpl::NotifyUnblocked() {
+  // This method should only be called once, and only if the
+  // current state is blocked.
+  DCHECK_EQ(State::BLOCKED, state_);
+  state_ = State::OUTSTANDING;
+  delegate_->OnThrottleUnblocked(this);
+}
+
+NetworkThrottleManagerImpl::NetworkThrottleManagerImpl()
+    : lifetime_median_estimate_(PercentileEstimator::kMedianPercentile,
+                                kInitialMedianInMs),
+      outstanding_recomputation_timer_(false /* retain_user_task */,
+                                       false /* is_repeating */),
+      tick_clock_(new base::DefaultTickClock()),
+      weak_ptr_factory_(this) {
+  outstanding_recomputation_timer_.SetTaskRunner(
+      base::ThreadTaskRunnerHandle::Get());
+}
+
+NetworkThrottleManagerImpl::~NetworkThrottleManagerImpl() {}
+
+std::unique_ptr<NetworkThrottleManager::Throttle>
+NetworkThrottleManagerImpl::CreateThrottle(
+    NetworkThrottleManager::ThrottleDelegate* delegate,
+    RequestPriority priority,
+    bool ignore_limits) {
+  bool blocked =
+      (!ignore_limits && priority == THROTTLED &&
+       outstanding_throttles_.size() >= kActiveRequestThrottlingLimit);
+
+  std::unique_ptr<NetworkThrottleManagerImpl::ThrottleImpl> throttle(
+      new ThrottleImpl(blocked, priority, delegate, this,
+                       blocked_throttles_.end()));
+
+  ThrottleList& insert_list(blocked ? blocked_throttles_
+                                    : outstanding_throttles_);
+
+  throttle->set_queue_pointer(
+      insert_list.insert(insert_list.end(), throttle.get()));
+
+  // In case oustanding_throttles_ was empty, set up timer.
+  if (!blocked)
+    RecomputeOutstanding();
+
+  return std::move(throttle);
+}
+
+void NetworkThrottleManagerImpl::SetTickClockForTesting(
+    std::unique_ptr<base::TickClock> tick_clock) {
+  tick_clock_ = std::move(tick_clock);
+}
+
+bool NetworkThrottleManagerImpl::ConditionallyTriggerTimerForTesting() {
+  if (!outstanding_recomputation_timer_.IsRunning() ||
+      (tick_clock_->NowTicks() <
+       outstanding_recomputation_timer_.desired_run_time())) {
+    return false;
+  }
+
+  base::Closure timer_callback(outstanding_recomputation_timer_.user_task());
+  outstanding_recomputation_timer_.Stop();
+  timer_callback.Run();
+  return true;
+}
+
+void NetworkThrottleManagerImpl::OnThrottlePriorityChanged(
+    NetworkThrottleManagerImpl::ThrottleImpl* throttle,
+    RequestPriority old_priority,
+    RequestPriority new_priority) {
+  // The only case requiring a state change is if the priority change
+  // implies unblocking, which can only happen on a transition from blocked
+  // (implies THROTTLED) to non-THROTTLED.
+  if (throttle->IsBlocked() && new_priority != THROTTLED) {
+    // May result in re-entrant calls into this class.
+    UnblockThrottle(throttle);
+  }
+}
+
+void NetworkThrottleManagerImpl::OnThrottleDestroyed(ThrottleImpl* throttle) {
+  switch (throttle->state()) {
+    case ThrottleImpl::State::BLOCKED:
+      DCHECK(throttle->queue_pointer() != blocked_throttles_.end());
+      DCHECK_EQ(throttle, *(throttle->queue_pointer()));
+      blocked_throttles_.erase(throttle->queue_pointer());
+      break;
+    case ThrottleImpl::State::OUTSTANDING:
+      DCHECK(throttle->queue_pointer() != outstanding_throttles_.end());
+      DCHECK_EQ(throttle, *(throttle->queue_pointer()));
+      outstanding_throttles_.erase(throttle->queue_pointer());
+    // Fall through
+    case ThrottleImpl::State::AGED:
+      DCHECK(!throttle->start_time().is_null());
+      lifetime_median_estimate_.AddSample(
+          (tick_clock_->NowTicks() - throttle->start_time())
+              .InMillisecondsRoundedUp());
+      break;
+  }
+
+  DCHECK(std::find(blocked_throttles_.begin(), blocked_throttles_.end(),
+                   throttle) == blocked_throttles_.end());
+  DCHECK(std::find(outstanding_throttles_.begin(), outstanding_throttles_.end(),
+                   throttle) == outstanding_throttles_.end());
+
+  // Unblock the throttles if there's some chance there's a throttle to
+  // unblock.
+  if (outstanding_throttles_.size() < kActiveRequestThrottlingLimit &&
+      !blocked_throttles_.empty()) {
+    // Via PostTask so there aren't upcalls from within destructors.
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::Bind(&NetworkThrottleManagerImpl::MaybeUnblockThrottles,
+                   weak_ptr_factory_.GetWeakPtr()));
+  }
+}
+
+void NetworkThrottleManagerImpl::RecomputeOutstanding() {
+  // Remove all throttles that have aged out of the outstanding set.
+  base::TimeTicks now(tick_clock_->NowTicks());
+  base::TimeDelta age_horizon(base::TimeDelta::FromMilliseconds((
+      kMedianLifetimeMultiple * lifetime_median_estimate_.current_estimate())));
+  while (!outstanding_throttles_.empty()) {
+    ThrottleImpl* throttle = *outstanding_throttles_.begin();
+    if (throttle->start_time() + age_horizon >= now)
+      break;
+
+    outstanding_throttles_.erase(outstanding_throttles_.begin());
+    throttle->SetAged();
+    throttle->set_queue_pointer(outstanding_throttles_.end());
+  }
+
+  if (outstanding_throttles_.empty())
+    return;
+
+  // If the timer is already running, be conservative and leave it alone;
+  // the time for which it would be set will only be later than when it's
+  // currently set.
+  // This addresses, e.g., situations where a RecomputeOutstanding() races
+  // with a running timer which would unblock blocked throttles.
+  if (outstanding_recomputation_timer_.IsRunning())
+    return;
+
+  ThrottleImpl* first_throttle(*outstanding_throttles_.begin());
+  DCHECK_GE(first_throttle->start_time() + age_horizon, now);
+  outstanding_recomputation_timer_.Start(
+      FROM_HERE, ((first_throttle->start_time() + age_horizon) - now +
+                  base::TimeDelta::FromMilliseconds(kTimerFudgeInMs)),
+      // Unretained use of |this| is safe because the timer is
+      // owned by this object, and will be torn down if this object
+      // is destroyed.
+      base::Bind(&NetworkThrottleManagerImpl::MaybeUnblockThrottles,
+                 base::Unretained(this)));
+}
+
+void NetworkThrottleManagerImpl::UnblockThrottle(ThrottleImpl* throttle) {
+  DCHECK(throttle->IsBlocked());
+
+  blocked_throttles_.erase(throttle->queue_pointer());
+  throttle->set_start_time(tick_clock_->NowTicks());
+  throttle->set_queue_pointer(
+      outstanding_throttles_.insert(outstanding_throttles_.end(), throttle));
+
+  // Called in case |*throttle| was added to a null set.
+  RecomputeOutstanding();
+
+  // May result in re-entrant calls into this class.
+  throttle->NotifyUnblocked();
+}
+
+void NetworkThrottleManagerImpl::MaybeUnblockThrottles() {
+  RecomputeOutstanding();
+
+  while (outstanding_throttles_.size() < kActiveRequestThrottlingLimit &&
+         !blocked_throttles_.empty()) {
+    // NOTE: This call may result in reentrant calls into
+    // NetworkThrottleManagerImpl; no state should be assumed to be
+    // persistent across this call.
+    UnblockThrottle(blocked_throttles_.front());
+  }
+}
+
+}  // namespace net
diff --git a/chromium/net/base/network_throttle_manager_impl.h b/chromium/net/base/network_throttle_manager_impl.h
new file mode 100644
index 00000000000..47afcc46ffa
--- /dev/null
+++ b/chromium/net/base/network_throttle_manager_impl.h
@@ -0,0 +1,152 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_NETWORK_THROTTLE_MANAGER_IMPL_H_
+#define NET_BASE_NETWORK_THROTTLE_MANAGER_IMPL_H_
+
+#include <list>
+#include <memory>
+#include <set>
+
+#include "base/memory/weak_ptr.h"
+#include "base/time/tick_clock.h"
+#include "base/time/time.h"
+#include "base/timer/timer.h"
+#include "net/base/network_throttle_manager.h"
+#include "net/base/percentile_estimator.h"
+
+namespace net {
+
+// The NetworkThrottleManagerImpl implements the following semantics:
+// * All throttles of priority above THROTTLED are created unblocked.
+// * Throttles of priority THROTTLED are created unblocked, unless
+//   there are |kActiveRequestThrottlingLimit| or more throttles active,
+//   in which case they are created blocked.
+//   When that condition is no longer true, throttles of priority
+//   THROTTLED are unblocked, in FIFO order.
+// * Throttles that have been alive for more than |kMedianLifetimeMultiple|
+//   times the current estimate of the throttle median lifetime do
+//   not count against the |kActiveRequestThrottlingLimit| limit.
+class NET_EXPORT NetworkThrottleManagerImpl : public NetworkThrottleManager {
+ public:
+  // Maximum number of active requests before new THROTTLED throttles
+  // are created blocked.  Throttles are unblocked as the active requests
+  // fall below this limit.
+  static const size_t kActiveRequestThrottlingLimit;
+
+  // Note that the following constants are implementation details exposed in the
+  // header file only for testing, and should not be relied on by consumers.
+
+  // Constants used for the running estimate of the median lifetime
+  // for throttles created by this class.  That estimate is used to detect
+  // throttles that are "unusually old" and hence may represent hanging GETs
+  // or long-running streams.  Such throttles should not be considered
+  // "active" for the purposes of determining whether THROTTLED throttles
+  // should be created in a blocked state.
+  // Note that the precise details of this algorithm aren't very important;
+  // specifically, if it takes a while for the median estimate to reach the
+  // "actual" median of a request stream, the consequence is either a bit more
+  // of a delay in unblocking THROTTLED requests or more THROTTLED requests
+  // being unblocked than would be ideal (i.e. performance tweaks at
+  // the margins).
+
+  // Multiple of the current median lifetime beyond which a throttle is
+  // considered "unusually old" and not considered in counting active
+  // requests. This is used instead of a percentile estimate because the goal
+  // is eliminating requests that are qualitatively different
+  // (e.g. hanging gets, streams), and the percentage of all requests
+  // that are in that category can vary greatly.
+  static const int kMedianLifetimeMultiple;
+
+  // The median lifetime estimate starts at class creation at
+  // |kInitialMedianInMs|.
+  static const int kInitialMedianInMs;
+
+  NetworkThrottleManagerImpl();
+  ~NetworkThrottleManagerImpl() override;
+
+  // NetworkThrottleManager:
+  std::unique_ptr<Throttle> CreateThrottle(ThrottleDelegate* delegate,
+                                           RequestPriority priority,
+                                           bool ignore_limits) override;
+
+  void SetTickClockForTesting(std::unique_ptr<base::TickClock> tick_clock);
+
+  // If the |NowTicks()| value of |tick_clock_| is greater than the
+  // time the outstanding_recomputation_timer_ has set to go off, Stop()
+  // the timer and manually run the associated user task.  This is to allow
+  // "fast-forwarding" of the clock for testing by working around
+  // base::Timer's direct use of base::TimeTicks rather than a base::TickClock.
+  //
+  // Note specifically that base::Timer::Start takes a time delta into the
+  // future and adds it to base::TimeTicks::Now() to get
+  // base::Timer::desired_run_time(), which is what this method compares
+  // |tick_clock_->NowTicks()| against.  So tests should be written so that
+  // the timer Start() routine whose callback should be run is called
+  // with |tick_clock_| in accord with wallclock time.  This routine can then
+  // be called with |tick_clock_| set into the future.
+  //
+  // Returns true if there was a timer running and it was triggerred
+  // (|tick_clock_->NowTicks() >
+  //   outstanding_recomputation_timer_.desired_run_time()|).
+  bool ConditionallyTriggerTimerForTesting();
+
+ private:
+  class ThrottleImpl;
+  using ThrottleList = std::list<ThrottleImpl*>;
+
+  void OnThrottlePriorityChanged(ThrottleImpl* throttle,
+                                 RequestPriority old_priority,
+                                 RequestPriority new_priority);
+  void OnThrottleDestroyed(ThrottleImpl* throttle);
+
+  // Recompute how many requests count as outstanding (i.e.
+  // are not older than kMedianLifetimeMultiple * MedianThrottleLifetime()).
+  // If outstanding_recomputation_timer_ is not set, it will be set
+  // to the earliest a throttle might "age out" of the outstanding list.
+  void RecomputeOutstanding();
+
+  // Unblock the specified throttle.  May result in re-entrant calls
+  // into NetworkThrottleManagerImpl.
+  void UnblockThrottle(ThrottleImpl* throttle);
+
+  // Recomputes how many requests count as outstanding, checks to see
+  // if any currently blocked throttles should be unblocked,
+  // and unblock them if so.  Note that unblocking may result in
+  // re-entrant calls to this class, so no assumptions about state persistence
+  // should be made across this call.
+  void MaybeUnblockThrottles();
+
+  PercentileEstimator lifetime_median_estimate_;
+
+  // base::Timer controlling outstanding request recomputation.
+  //
+  // This is started whenever it is not running and a new throttle is
+  // added to |outstanding_throttles_|, and is never cleared except by
+  // execution, which re-starts it if there are any
+  // outstanding_throttles_.  So it should always be running if any
+  // throttles are outstanding.  This guarantees that the class will
+  // eventually detect aging out of outstanding throttles and unblock
+  // throttles blocked on those outstanding throttles.
+  base::Timer outstanding_recomputation_timer_;
+
+  // FIFO of OUTSTANDING throttles (ordered by time of entry into the
+  // OUTSTANDING state).
+  ThrottleList outstanding_throttles_;
+
+  // FIFO list of BLOCKED throttles.  This is a list so that the
+  // throttles can store iterators to themselves.
+  ThrottleList blocked_throttles_;
+
+  // For testing.
+  std::unique_ptr<base::TickClock> tick_clock_;
+
+  base::WeakPtrFactory<NetworkThrottleManagerImpl> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkThrottleManagerImpl);
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_NETWORK_THROTTLE_MANAGER_IMPL_H_
diff --git a/chromium/net/base/network_throttle_manager_impl_unittest.cc b/chromium/net/base/network_throttle_manager_impl_unittest.cc
new file mode 100644
index 00000000000..bc672b2c679
--- /dev/null
+++ b/chromium/net/base/network_throttle_manager_impl_unittest.cc
@@ -0,0 +1,568 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/network_throttle_manager_impl.h"
+
+#include <memory>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/callback_helpers.h"
+#include "base/memory/scoped_vector.h"
+#include "base/run_loop.h"
+#include "base/test/simple_test_tick_clock.h"
+#include "base/test/test_message_loop.h"
+#include "net/base/request_priority.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace net {
+
+namespace {
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+const int kInitialAgeHorizonForUncountedRequests =
+    (NetworkThrottleManagerImpl::kInitialMedianInMs *
+     NetworkThrottleManagerImpl::kMedianLifetimeMultiple);
+
+// Must be greater than the corresponding fudge factor in
+// network_throttle_manager_impl.cc.
+const int kAgeHorizonFudgeFactor = 20;
+
+// Test fixture for throttle manager tests.
+
+// Note that the manager owned and managed by this fixture has a clock
+// that is set to base::TimeTicks::Now() (which value is also exposed
+// via an accessor) on creation but does not change without
+// intervention by tests (to make the tests more predictable).
+//
+// HOWEVER, also note that that manager uses the base::Timer class, which
+// uses the system clock, which isn't affected by the setting of the
+// test fixture clock.  So test should be written to a) avoid situations
+// in which the manager's timer will actually go off based on the system
+// clock, and b) call ConditionallyTriggerTimerForTesting() (which does
+// evaluate the manager's clock) when timer based tests are necessary.
+class NetworkThrottleManagerTest : public testing::Test,
+                                   NetworkThrottleManager::ThrottleDelegate {
+ public:
+  NetworkThrottleManagerTest()
+      : clock_(new base::SimpleTestTickClock),
+        now_(base::TimeTicks::Now()),
+        throttle_state_change_count_(0),
+        last_throttle_to_change_state_(nullptr),
+        throttle_manager_(new NetworkThrottleManagerImpl) {
+    clock_->SetNowTicks(now_);
+    throttle_manager_->SetTickClockForTesting(
+        std::unique_ptr<base::TickClock>(clock_));
+  }
+
+ protected:
+  enum ExpectedThrottleBlockState { BLOCKED, UNBLOCKED };
+
+  base::TimeTicks now() { return now_; }
+  NetworkThrottleManagerImpl* throttle_manager() {
+    return throttle_manager_.get();
+  }
+
+  // Set the offset of the test clock from now_.
+  void SetClockDelta(base::TimeDelta time_delta) {
+    clock_->SetNowTicks(now_ + time_delta);
+  }
+
+  // Throttle creation
+  std::unique_ptr<NetworkThrottleManager::Throttle> CreateThrottle(
+      net::RequestPriority priority,
+      ExpectedThrottleBlockState throttle_state) {
+    std::unique_ptr<NetworkThrottleManager::Throttle> throttle(
+        throttle_manager_->CreateThrottle(this, priority, false));
+    EXPECT_EQ(throttle_state == BLOCKED, throttle->IsBlocked());
+    return throttle;
+  }
+  std::unique_ptr<NetworkThrottleManager::Throttle>
+  CreateThrottleIgnoringLimits(net::RequestPriority priority) {
+    std::unique_ptr<NetworkThrottleManager::Throttle> throttle(
+        throttle_manager_->CreateThrottle(this, priority, true));
+    EXPECT_FALSE(throttle->IsBlocked());
+    return throttle;
+  }
+
+  // Throttle state change information.
+  int throttle_state_change_count() { return throttle_state_change_count_; }
+  NetworkThrottleManager::Throttle* last_throttle_to_change_state() {
+    return last_throttle_to_change_state_;
+  }
+
+  // Setting a callback to be invoked when a throttle's state changes.
+  void SetThrottleStateChangedCallback(const base::Closure& callback) {
+    throttle_state_changed_callback_ = callback;
+  }
+
+ private:
+  // NetworkThrottleManager::Delegate
+  void OnThrottleUnblocked(
+      NetworkThrottleManager::Throttle* throttle) override {
+    ++throttle_state_change_count_;
+    last_throttle_to_change_state_ = throttle;
+    if (!throttle_state_changed_callback_.is_null())
+      base::ResetAndReturn(&throttle_state_changed_callback_).Run();
+  }
+
+  base::SimpleTestTickClock* clock_;
+  base::TimeTicks now_;
+  int throttle_state_change_count_;
+  NetworkThrottleManager::Throttle* last_throttle_to_change_state_;
+  std::unique_ptr<NetworkThrottleManagerImpl> throttle_manager_;
+  base::Closure throttle_state_changed_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkThrottleManagerTest);
+};
+
+// Check to confirm that all created throttles at priorities other than
+// THROTTLED start unblocked.
+TEST_F(NetworkThrottleManagerTest, AllUnthrottled) {
+  for (int i = MINIMUM_PRIORITY; i <= MAXIMUM_PRIORITY; ++i) {
+    if (i == THROTTLED)
+      continue;
+    CreateThrottle(static_cast<RequestPriority>(i), UNBLOCKED);
+  }
+}
+
+// Check for basic semantics around the new THROTTLED level.
+TEST_F(NetworkThrottleManagerTest, ThrottledBlocking) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  throttle1.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle3.get(), last_throttle_to_change_state());
+
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_TRUE(throttle4->IsBlocked());
+  EXPECT_TRUE(throttle5->IsBlocked());
+
+  throttle2.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(2, throttle_state_change_count());
+  EXPECT_EQ(throttle4.get(), last_throttle_to_change_state());
+
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_FALSE(throttle4->IsBlocked());
+  EXPECT_TRUE(throttle5->IsBlocked());
+}
+
+// Check that THROTTLED semantics are dependent on all outstanding requests.
+TEST_F(NetworkThrottleManagerTest, ThrottledBlockingMultiPriority) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(HIGHEST, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(LOW, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  throttle1.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(0, throttle_state_change_count());
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_TRUE(throttle4->IsBlocked());
+  EXPECT_TRUE(throttle5->IsBlocked());
+
+  throttle2.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle4.get(), last_throttle_to_change_state());
+
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_FALSE(throttle4->IsBlocked());
+  EXPECT_TRUE(throttle5->IsBlocked());
+
+  throttle3.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(2, throttle_state_change_count());
+  EXPECT_EQ(throttle5.get(), last_throttle_to_change_state());
+
+  EXPECT_FALSE(throttle4->IsBlocked());
+  EXPECT_FALSE(throttle5->IsBlocked());
+}
+
+// Check that a SetPriority() away from THROTTLED results in unblocking
+// and an upcall.
+TEST_F(NetworkThrottleManagerTest, ThrottledSetPriority) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  throttle3->SetPriority(LOW);
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle3.get(), last_throttle_to_change_state());
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_TRUE(throttle4->IsBlocked());
+}
+
+void ResetThrottles(bool* function_called,
+                    ScopedVector<NetworkThrottleManager::Throttle> throttles) {
+  *function_called = true;
+  // All pointers in the vector should be deleted on exit.
+}
+
+// Check that tearing down all elements in the NTM on a SetPriority
+// upcall doesn't create any problems.
+TEST_F(NetworkThrottleManagerTest, ThrottleTeardown) {
+  ScopedVector<NetworkThrottleManager::Throttle> throttles;
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle_temporary;
+
+  throttles.push_back(std::unique_ptr<NetworkThrottleManager::Throttle>(
+      CreateThrottle(THROTTLED, UNBLOCKED)));
+  throttles.push_back(std::unique_ptr<NetworkThrottleManager::Throttle>(
+      CreateThrottle(THROTTLED, UNBLOCKED)));
+
+  // Note that if there is more than one throttle blocked, then the
+  // number of throttle state changes is dependent on destruction order.
+  // So only one blocked throttle is created.
+  throttle_temporary = CreateThrottle(THROTTLED, BLOCKED);
+  NetworkThrottleManager::Throttle* throttle3 = throttle_temporary.get();
+  throttles.push_back(std::move(throttle_temporary));
+
+  bool callback_called(false);
+  SetThrottleStateChangedCallback(
+      base::Bind(&ResetThrottles, &callback_called, base::Passed(&throttles)));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  throttle3->SetPriority(LOW);
+
+  // If the test is functioning as expected, throttle3 now points to
+  // a deleted object and can no longer be indirected through.
+
+  EXPECT_TRUE(callback_called);
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle3, last_throttle_to_change_state());
+}
+
+// Note that this routine is dependent on priority setting *not* resulting in
+// destruction of any throttle and should only be used in tests where that is
+// true.
+void SetAllToPriority(
+    RequestPriority priority,
+    std::vector<NetworkThrottleManager::Throttle*> throttles) {
+  for (size_t i = 0; i < throttles.size(); ++i)
+    throttles[i]->SetPriority(priority);
+}
+
+// Check that modifying all the priorities of the allocated throttles in
+// the callback works properly.
+TEST_F(NetworkThrottleManagerTest, ThrottlePriorityReset) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  std::vector<NetworkThrottleManager::Throttle*> throttles;
+  throttles.push_back(throttle1.get());
+  throttles.push_back(throttle2.get());
+  throttles.push_back(throttle3.get());
+
+  SetThrottleStateChangedCallback(
+      base::Bind(&SetAllToPriority, MEDIUM, base::Passed(&throttles)));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+  throttle3->SetPriority(HIGHEST);
+
+  // Expected result: throttles 1-3 @ medium priority (the callback should
+  // have overridden the priority setting above), only throttle 4 blocked
+  // (throttle3 should have been unblocked by either of the priority changes),
+  // and one state changes (the unblocking).
+  EXPECT_EQ(MEDIUM, throttle1->Priority());
+  EXPECT_EQ(MEDIUM, throttle2->Priority());
+  EXPECT_EQ(MEDIUM, throttle3->Priority());
+  EXPECT_EQ(THROTTLED, throttle4->Priority());
+  EXPECT_FALSE(throttle1->IsBlocked());
+  EXPECT_FALSE(throttle2->IsBlocked());
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_TRUE(throttle4->IsBlocked());
+  EXPECT_EQ(1, throttle_state_change_count());
+}
+
+// Check that modifying the priority of a request from a non-THROTTLED
+// value to THROTTLED causes no change in behavior.
+TEST_F(NetworkThrottleManagerTest, ThrottlePriorityResetToThrottled) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(LOW, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+  throttle3->SetPriority(THROTTLED);
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  EXPECT_FALSE(throttle1->IsBlocked());
+  EXPECT_FALSE(throttle2->IsBlocked());
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_TRUE(throttle4->IsBlocked());
+
+  EXPECT_EQ(THROTTLED, throttle1->Priority());
+  EXPECT_EQ(THROTTLED, throttle2->Priority());
+  EXPECT_EQ(THROTTLED, throttle3->Priority());
+  EXPECT_EQ(THROTTLED, throttle4->Priority());
+}
+
+// Confirm that old requests don't count against the limit.
+TEST_F(NetworkThrottleManagerTest, DontCountAgedRequests) {
+  const int age_in_days_of_old_throttles = 4;
+
+  // Confirm default median and timing means that 4 days is long enough ago
+  // to be aged out.
+  EXPECT_GT(age_in_days_of_old_throttles * 24 * 60 * 60 * 1000,
+            kInitialAgeHorizonForUncountedRequests);
+
+  SetClockDelta(-base::TimeDelta::FromDays(age_in_days_of_old_throttles));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+
+  SetClockDelta(base::TimeDelta());
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(LOW, UNBLOCKED));
+
+  // First throttled request should not be blocked.
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+
+  // Second should be.
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  // Destroying the old requests should not result in any upcalls.
+  EXPECT_EQ(0, throttle_state_change_count());
+  throttle1.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(0, throttle_state_change_count());
+  throttle2.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  // But destroying a new request should result in a state change.
+  throttle3.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle5.get(), last_throttle_to_change_state());
+}
+
+// Confirm that a slew of throttles of a specific age will shift the
+// median for determining "aged requests" to that age.
+TEST_F(NetworkThrottleManagerTest, ShiftMedian) {
+  // Setup two throttles of age *just short* of aging out; confirm
+  // they result in blocked THROTTLED requests.
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests - 1));
+  EXPECT_FALSE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  throttle1.reset();
+  throttle2.reset();
+  throttle3.reset();
+  base::RunLoop().RunUntilIdle();  // Allow posttasks to run.
+
+  // Create 100 throttles and destroy them, effectively with lifetime zero.
+  // This should substantially decrease the median age estimate.
+  SetClockDelta(base::TimeDelta());
+  for (int i = 0; i < 100; ++i) {
+    std::unique_ptr<NetworkThrottleManager::Throttle> tmp(
+        CreateThrottle(IDLE, UNBLOCKED));
+  }
+
+  // Clear out any possible leftover timer by setting the clock to a point
+  // in the future at which it will definitely go off, and triggering it.
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      2 * kInitialAgeHorizonForUncountedRequests + kAgeHorizonFudgeFactor));
+  throttle_manager()->ConditionallyTriggerTimerForTesting();
+
+  // The identical test above should no longer result in blocked throttles.
+  SetClockDelta(base::TimeDelta());
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle6(
+      CreateThrottle(IDLE, UNBLOCKED));
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests - 1));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle7(
+      CreateThrottle(THROTTLED, UNBLOCKED));
+}
+
+// Confirm that just "aging out" requests will result in unblocking
+// blocked requests.
+TEST_F(NetworkThrottleManagerTest, AgeInvalidThrottles) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests + kAgeHorizonFudgeFactor));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle3.get(), last_throttle_to_change_state());
+  EXPECT_FALSE(throttle3->IsBlocked());
+}
+
+// Confirm that if throttles are unblocked and made active by all
+// existing outstanding throttles aging out, they will also eventually
+// age out and let new throttles through.
+TEST_F(NetworkThrottleManagerTest, NewlyUnblockedThrottlesAlsoAge) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle6(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  // Age the first two throttles out of the outstanding, which should
+  // result in the next two throttles becoming unblocked (and in the
+  // oustanding list).  (The internal implementation will zero out
+  // the outstanding queue and then add in the two new unblocked throttles.)
+  EXPECT_EQ(0, throttle_state_change_count());
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests + kAgeHorizonFudgeFactor));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(2, throttle_state_change_count());
+  EXPECT_FALSE(throttle3->IsBlocked());
+  EXPECT_FALSE(throttle4->IsBlocked());
+
+  // Age the next two throttles out of the outstanding queue, which
+  // should result in the next two throttles becoming unblocked (and
+  // in the oustanding list).  This will only happen if a timer was properly
+  // set in the above age process as the oustanding queue went through
+  // the empty state.
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      2 * (kInitialAgeHorizonForUncountedRequests + kAgeHorizonFudgeFactor)));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(4, throttle_state_change_count());
+  EXPECT_FALSE(throttle5->IsBlocked());
+  EXPECT_FALSE(throttle6->IsBlocked());
+}
+
+// Confirm that throttles that are blocked for a while and then
+// unblocked don't "age out".
+TEST_F(NetworkThrottleManagerTest, AgeBlockedThrottles) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(THROTTLED, BLOCKED));
+
+  EXPECT_EQ(0, throttle_state_change_count());
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests + kAgeHorizonFudgeFactor));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+
+  // If blocked throttles aged out, all three throttles should have been
+  // unblocked.  If not, only the two replacing the IDLE throttles should
+  // have.
+  EXPECT_EQ(2, throttle_state_change_count());
+}
+
+// Confirm that deleting old throttles before they age out doesn't
+// interfere with the aging out of more recent throttles.
+TEST_F(NetworkThrottleManagerTest, DeletionAgingInterference) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(THROTTLED, BLOCKED));
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      kInitialAgeHorizonForUncountedRequests / 2));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottle(IDLE, UNBLOCKED));
+  EXPECT_FALSE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  throttle1.reset();
+  throttle2.reset();
+  EXPECT_FALSE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(0, throttle_state_change_count());
+
+  SetClockDelta(base::TimeDelta::FromMilliseconds(
+      (3 * kInitialAgeHorizonForUncountedRequests / 2 +
+       2 * kAgeHorizonFudgeFactor)));
+  EXPECT_TRUE(throttle_manager()->ConditionallyTriggerTimerForTesting());
+  EXPECT_EQ(1, throttle_state_change_count());
+  EXPECT_EQ(throttle3.get(), last_throttle_to_change_state());
+  EXPECT_FALSE(throttle3->IsBlocked());
+}
+
+// Confirm that "ignore_limits" boolean is respected.
+TEST_F(NetworkThrottleManagerTest, IgnoreLimits) {
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle1(
+      CreateThrottle(HIGHEST, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle2(
+      CreateThrottle(LOW, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle3(
+      CreateThrottle(IDLE, UNBLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle4(
+      CreateThrottle(THROTTLED, BLOCKED));
+  std::unique_ptr<NetworkThrottleManager::Throttle> throttle5(
+      CreateThrottleIgnoringLimits(THROTTLED));
+}
+
+}  // namespace
+
+}  // namespace net
diff --git a/chromium/net/base/openssl_private_key_store.h b/chromium/net/base/openssl_private_key_store.h
deleted file mode 100644
index ee4bc35f9bb..00000000000
--- a/chromium/net/base/openssl_private_key_store.h
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef NET_BASE_OPENSSL_PRIVATE_KEY_STORE_H_
-#define NET_BASE_OPENSSL_PRIVATE_KEY_STORE_H_
-
-#include <vector>
-
-// Avoid including <openssl/evp.h>
-typedef struct evp_pkey_st EVP_PKEY;
-
-#include "base/macros.h"
-#include "net/base/net_export.h"
-
-class GURL;
-
-namespace net {
-
-class X509Certificate;
-
-// OpenSSLPrivateKeyStore provides an interface for storing
-// public/private key pairs to system storage on platforms where
-// OpenSSL is used.
-// This class shall only be used from the network thread.
-class NET_EXPORT OpenSSLPrivateKeyStore {
- public:
-  // Called to permanently store a private/public key pair, generated
-  // via <keygen> while visiting |url|, to an appropriate system
-  // location. Increments |pkey|'s reference count, so the caller is still
-  // responsible for calling EVP_PKEY_free on it.
-  // |url| is the corresponding server URL.
-  // |pkey| is the key pair handle.
-  // Returns false if an error occurred whilst attempting to store the key.
-  static bool StoreKeyPair(const GURL& url, EVP_PKEY* pkey);
-
-  // Checks that the private key for a given public key is installed.
-  // |pub_key| a public key.
-  // Returns true if there is a private key that was previously
-  // recorded through StoreKeyPair().
-  // NOTE: Intentionally not implemented on Android because there is no
-  // platform API that can perform this operation silently.
-  static bool HasPrivateKey(EVP_PKEY* pub_key);
-
- private:
-  OpenSSLPrivateKeyStore();  // not implemented.
-  ~OpenSSLPrivateKeyStore();  // not implemented.
-  DISALLOW_COPY_AND_ASSIGN(OpenSSLPrivateKeyStore);
-};
-
-} // namespace net
-
-#endif  // NET_BASE_OPENSSL_PRIVATE_KEY_STORE_H_
diff --git a/chromium/net/base/openssl_private_key_store_android.cc b/chromium/net/base/openssl_private_key_store_android.cc
deleted file mode 100644
index 59cd8b0ffb4..00000000000
--- a/chromium/net/base/openssl_private_key_store_android.cc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/base/openssl_private_key_store.h"
-
-#include "base/logging.h"
-#include "base/memory/singleton.h"
-#include "crypto/openssl_util.h"
-#include "net/android/network_library.h"
-#include "third_party/boringssl/src/include/openssl/bytestring.h"
-#include "third_party/boringssl/src/include/openssl/evp.h"
-#include "third_party/boringssl/src/include/openssl/mem.h"
-
-namespace net {
-
-bool OpenSSLPrivateKeyStore::StoreKeyPair(const GURL& url, EVP_PKEY* pkey) {
-  // Always clear openssl errors on exit.
-  crypto::OpenSSLErrStackTracer err_trace(FROM_HERE);
-
-  uint8_t* public_key;
-  size_t public_len;
-  bssl::ScopedCBB cbb;
-  if (!CBB_init(cbb.get(), 0) || !EVP_marshal_public_key(cbb.get(), pkey) ||
-      !CBB_finish(cbb.get(), &public_key, &public_len)) {
-    return false;
-  }
-  bssl::UniquePtr<uint8_t> free_public_key(public_key);
-
-  uint8_t* private_key;
-  size_t private_len;
-  cbb.Reset();
-  if (!CBB_init(cbb.get(), 0) || !EVP_marshal_private_key(cbb.get(), pkey) ||
-      !CBB_finish(cbb.get(), &private_key, &private_len)) {
-    return false;
-  }
-  bssl::UniquePtr<uint8_t> free_private_key(private_key);
-
-  if (!android::StoreKeyPair(public_key, public_len, private_key,
-                             private_len)) {
-    LOG(ERROR) << "StoreKeyPair failed. public_len = " << public_len
-               << " private_len = " << private_len;
-  }
-  return true;
-}
-
-}  // namespace net
diff --git a/chromium/net/base/openssl_private_key_store_memory.cc b/chromium/net/base/openssl_private_key_store_memory.cc
deleted file mode 100644
index 5b86b1523c7..00000000000
--- a/chromium/net/base/openssl_private_key_store_memory.cc
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Defines an in-memory private key store, primarily used for testing.
-
-#include "net/base/openssl_private_key_store.h"
-
-#include "base/logging.h"
-#include "base/macros.h"
-#include "base/memory/singleton.h"
-#include "base/synchronization/lock.h"
-#include "third_party/boringssl/src/include/openssl/evp.h"
-
-namespace net {
-
-namespace {
-
-// A small in-memory store for public/private key pairs held in
-// a single EVP_PKEY object. This is intentionally distinct from
-// net::SSLClientKeyStore.
-class MemoryKeyPairStore {
- public:
-  MemoryKeyPairStore() {}
-
-  static MemoryKeyPairStore* GetInstance() {
-    return base::Singleton<MemoryKeyPairStore>::get();
-  }
-
-  ~MemoryKeyPairStore() {
-    base::AutoLock lock(lock_);
-    for (std::vector<EVP_PKEY*>::iterator it = keys_.begin();
-         it != keys_.end(); ++it) {
-      EVP_PKEY_free(*it);
-    }
-  }
-
-  bool StoreKeyPair(EVP_PKEY* pkey) {
-    EVP_PKEY_up_ref(pkey);
-    base::AutoLock lock(lock_);
-    keys_.push_back(pkey);
-    return true;
-  }
-
-  bool HasPrivateKey(EVP_PKEY* pkey) {
-    base::AutoLock lock(lock_);
-    for (std::vector<EVP_PKEY*>::iterator it = keys_.begin();
-         it != keys_.end(); ++it) {
-      if (EVP_PKEY_cmp(*it, pkey) == 1)
-        return true;
-    }
-    return false;
-  }
-
- private:
-  std::vector<EVP_PKEY*> keys_;
-  base::Lock lock_;
-
-  DISALLOW_COPY_AND_ASSIGN(MemoryKeyPairStore);
-};
-
-}  // namespace
-
-bool OpenSSLPrivateKeyStore::StoreKeyPair(const GURL& url,
-                                          EVP_PKEY* pkey) {
-  return MemoryKeyPairStore::GetInstance()->StoreKeyPair(pkey);
-}
-
-bool OpenSSLPrivateKeyStore::HasPrivateKey(EVP_PKEY* pub_key) {
-  return MemoryKeyPairStore::GetInstance()->HasPrivateKey(pub_key);
-}
-
-} // namespace net
-
diff --git a/chromium/net/base/parse_number.h b/chromium/net/base/parse_number.h
index dc66fb6d8b5..0b4cfc1f8e3 100644
--- a/chromium/net/base/parse_number.h
+++ b/chromium/net/base/parse_number.h
@@ -27,8 +27,6 @@
 //   This API tries to avoid these problems by picking sensible defaults for
 //   //net code. For more details see crbug.com/596523.
 
-class GURL;
-
 namespace net {
 
 // Format to use when parsing integers.
diff --git a/chromium/net/base/percentile_estimator.cc b/chromium/net/base/percentile_estimator.cc
new file mode 100644
index 00000000000..7b3d9cf0c16
--- /dev/null
+++ b/chromium/net/base/percentile_estimator.cc
@@ -0,0 +1,100 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "percentile_estimator.h"
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/rand_util.h"
+
+namespace {
+
+// Random number wrapper to allow substitutions for testing.
+int GenerateRand0To99() {
+  return base::RandInt(0, 99);
+}
+
+}  // namespace
+
+namespace net {
+
+// The algorithm used for percentile estimation is "Algorithm 3" from
+// https://arxiv.org/pdf/1407.1121v1.pdf.  There are several parts to the
+// algorithm:
+// * The estimate is conditionally moved towards the sample by a step amount.
+//   This means that if the samples are clustered around a value the estimates
+//   will converge to that sample.
+// * The percentile requested (e.g. 90%l) is handled by the conditional move.
+//   If the estimate is accurate, there is a chance equal to the percentile
+//   value that a sample will be lower than it, and a chance equal to
+//   1-percentile that it will be higher.  So the code balances those
+//   probabilities by increasing the estimate in the percentile fraction
+//   of the cases where the sample is over the estimate, and decreases the
+//   estimate in (1-percentile) fraction of the cases where the sample is under
+//   the estimate.
+//   E.g. in the case of the 90%l estimation, the estimate would
+//   move up in 90% of the cases in which the sample was above the
+//   estimate (which would be 10% of the total samples, presuming the
+//   estimate was accurate), and it would move down in 10% of the cases
+//   in which the sample was below the estimate.
+// * Every time the estimate moves in the same direction, the step
+//   amount is increased by one, and every time the estimate reverses
+//   direction, the step amount is decreased (to 1, if greater than 1,
+//   by one, if zero or negative).  The effective step amount is
+//   Max(step, 1).
+// * If the estimate
+//   would be moved beyond the sample causing its move, it is moved to
+//   be equal to the same (and the step amount set to the distance to
+//   the sample).  See the paper for further details.
+
+PercentileEstimator::PercentileEstimator(int percentile, int initial_estimate)
+    : percentile_(percentile),
+      sign_positive_(true),
+      current_estimate_(initial_estimate),
+      current_step_(1),
+      generator_callback_(base::Bind(&GenerateRand0To99)) {}
+
+PercentileEstimator::~PercentileEstimator() {}
+
+void PercentileEstimator::AddSample(int sample) {
+  int rand100 = generator_callback_.Run();
+  if (sample > current_estimate_ && rand100 > 1 - percentile_) {
+    current_step_ += sign_positive_ ? 1 : -1;
+    current_estimate_ += (current_step_ > 0) ? current_step_ : 1;
+
+    // Clamp movement to distance to sample.
+    if (current_estimate_ > sample) {
+      current_step_ -= current_estimate_ - sample;
+      current_estimate_ = sample;
+    }
+
+    // If we've reversed direction, reset the step down.
+    if (!sign_positive_ && current_step_ > 1)
+      current_step_ = 1;
+
+    sign_positive_ = true;
+  } else if (sample < current_estimate_ && rand100 > percentile_) {
+    current_step_ += !sign_positive_ ? 1 : -1;
+    current_estimate_ -= (current_step_ > 0) ? current_step_ : 1;
+
+    // Clamp movement to distance to sample.
+    if (current_estimate_ < sample) {
+      current_step_ -= sample - current_estimate_;
+      current_estimate_ = sample;
+    }
+
+    // If we've reversed direction, reset the step down.
+    if (sign_positive_ && current_step_ > 1)
+      current_step_ = 1;
+
+    sign_positive_ = false;
+  }
+}
+
+void PercentileEstimator::SetRandomNumberGeneratorForTesting(
+    RandomNumberCallback generator_callback) {
+  generator_callback_ = generator_callback;
+}
+
+}  // namespace net
diff --git a/chromium/net/base/percentile_estimator.h b/chromium/net/base/percentile_estimator.h
new file mode 100644
index 00000000000..0ff7b8176e2
--- /dev/null
+++ b/chromium/net/base/percentile_estimator.h
@@ -0,0 +1,59 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_PERCENTILE_ESTIMATOR_H_
+#define NET_BASE_PERCENTILE_ESTIMATOR_H_
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "net/base/net_export.h"
+
+namespace net {
+
+// This class estimates statistical percentiles (e.g. 10%l, 50%l) for
+// integer distributions presented in stream form.  These estimates
+// adjust automatically when the stream distribution changes.
+// TODO(rdsmith): Expand the class to maintain floating point
+// estimates rather than integer estimates, when there's a use case
+// for that that deserves the extra complexity and pitfalls of
+// floating point arithmetic.
+class NET_EXPORT PercentileEstimator {
+ public:
+  using RandomNumberCallback = base::Callback<int(void)>;
+
+  static const int kMedianPercentile = 50;
+
+  // |percentile| is a number between 0 and 100 indicating what percentile
+  // should be estimated (e.g. 50 would be a median estimate).
+  // |initial_estimate| is the value the class is seeded with; in other
+  // words, if AddSample() is never called,
+  // |CurrentEstimate() == initial_estimate|.
+  PercentileEstimator(int percentile, int initial_estimate);
+
+  ~PercentileEstimator();
+
+  int current_estimate() const { return current_estimate_; }
+  void AddSample(int sample);
+
+  // Specify a callback that will generate a "random" number
+  // in the range [0,99] on each call.  Used so that tests can
+  // rely on reproducible behavior.
+  void SetRandomNumberGeneratorForTesting(
+      RandomNumberCallback generator_callback);
+
+ private:
+  const int percentile_;
+
+  bool sign_positive_;
+  int current_estimate_;
+  int current_step_;
+
+  RandomNumberCallback generator_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(PercentileEstimator);
+};
+
+}  // namespace net
+
+#endif  // NET_BASE_PERCENTILE_ESTIMATOR_H_
diff --git a/chromium/net/base/percentile_estimator_unittest.cc b/chromium/net/base/percentile_estimator_unittest.cc
new file mode 100644
index 00000000000..71d9c1d386b
--- /dev/null
+++ b/chromium/net/base/percentile_estimator_unittest.cc
@@ -0,0 +1,242 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/percentile_estimator.h"
+
+#include "base/bind.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+// A number to turn sawtooth ramps from 0->100 into something that looks more
+// random to the algorithm.
+const int kPrimeMultipleToRandomizeRamps = 71;
+
+// Random numbers (fixed here for repeatability of tests).  Generated originally
+// by using python's random module with randrange(0,100).
+int random_numbers[] = {
+    83, 11, 33, 98, 49, 54, 83, 19, 93, 37, 98, 39, 59, 13, 51, 39, 69, 18, 17,
+    17, 6,  85, 95, 51, 83, 39, 18, 82, 88, 47, 69, 27, 20, 82, 86, 38, 98, 65,
+    53, 13, 71, 66, 29, 40, 70, 28, 64, 35, 47, 50, 84, 90, 36, 54, 15, 93, 98,
+    51, 82, 50, 17, 46, 12, 18, 26, 39, 95, 61, 52, 63, 97, 92, 12, 71, 7,  15,
+    74, 10, 64, 57, 25, 82, 95, 40, 76, 8,  28, 83, 58, 1,  22, 58, 17, 33, 61,
+    94, 40, 50, 84, 47, 81, 9,  79, 16, 45, 78, 15, 3,  97, 60, 70, 25, 11, 11,
+    68, 64, 61, 84, 52, 64, 54, 72, 24, 46, 48, 4,  46, 34, 10, 97, 2,  42, 13,
+    9,  95, 75, 11, 99, 92, 33, 65, 48, 19, 72, 63, 39, 0,  10, 83, 62, 12, 99,
+    67, 98, 99, 83, 40, 45, 34, 80, 13, 94, 22, 74, 8,  11, 11, 98, 35, 86, 80,
+    94, 87, 60, 16, 46, 9,  25, 75, 50, 54, 23, 31, 63, 9,  50, 5,  18, 87, 16,
+    47, 72, 24, 93, 14, 1,  26, 41, 50, 49, 41, 77, 54, 48, 50, 3,  50, 16, 54,
+    97, 57, 63, 83, 33, 65, 90, 48, 55, 44, 11, 71, 6,  86, 29, 46, 61, 20, 8,
+    88, 3,  70, 76, 84, 59, 36, 50, 77, 63, 10, 55, 32, 82, 58, 19, 97, 8,  73,
+    47, 55, 74, 46, 52, 62, 19, 65, 75, 57, 23, 98, 39, 63, 19, 75, 48, 93, 58,
+    29, 96, 57, 31, 17, 33, 8,  69, 89, 90, 17, 79, 59, 67, 34, 20, 44, 80, 71,
+    79, 24, 63, 13, 27, 28, 61, 38, 67, 82, 46, 9,  4,  69, 41, 49, 49, 10, 3,
+    93, 46, 57, 96, 78, 51, 45, 37, 0,  6,  99, 93, 87, 18, 72, 83, 95, 39, 54,
+    84, 12, 47, 14, 55, 15, 27, 95, 6,  13, 80, 40, 8,  39, 18, 15, 52, 31, 66,
+    59, 67, 90, 12, 61, 77, 66, 61, 33, 89, 47, 40, 86, 34, 98, 13, 76, 30, 43,
+    56, 57, 88, 34, 48, 67, 6,  29, 92, 38, 11, 23, 74, 45, 38, 35, 94, 15, 72,
+    65, 20, 94, 72, 97, 78, 61, 79, 75, 0,  45, 38, 32, 94, 3,  5,  67, 91, 34,
+    37, 12, 11, 15, 75, 14, 73, 34, 55, 78, 64, 52, 29, 60, 62, 16, 51, 44, 78,
+    0,  15, 41, 5,  52, 4,  68, 53, 39, 39, 68, 71, 66, 68, 97, 65, 55, 39, 94,
+    57, 43, 81, 67, 22, 30, 64, 37, 42, 35, 60, 61, 2,  51, 49, 43, 82, 61, 70,
+    63, 47, 57, 8,  55, 96, 68, 7,  46, 69, 8,  43, 18, 9,  25, 8,  97, 98, 83,
+    79, 19, 92, 54, 90, 72, 80, 92, 94, 26, 48, 94, 74, 32, 29, 44, 34, 55, 56,
+    97, 40, 86, 35, 64, 25, 85, 13, 57, 2,  29, 77, 19, 94, 46, 85, 15, 71, 81,
+    25, 45, 2,  1,  62, 77, 28, 95, 72, 72, 28, 3,  36, 76, 81, 56, 52, 27, 62,
+    8,  5,  62, 1,  43, 68, 40, 68, 22, 65, 30, 50, 36, 89, 5,  71, 68, 99, 53,
+    22, 26, 0,  1,  72, 76, 79, 50, 2,  32, 39, 40, 6,  99, 60, 59, 55, 28, 17,
+    12, 94, 51, 3,  4,  71, 36, 88, 26, 99, 25, 13, 80, 53, 4,  57, 55, 44, 26,
+    82, 4,  53, 34, 47, 16, 97, 56, 30, 0,  73, 85, 59, 86, 24, 70, 73, 53, 68,
+    15, 91, 90, 74, 39, 61, 32, 98, 14, 82, 99, 31, 7,  99, 34, 6,  3,  30, 57,
+    44, 58, 86, 37, 12, 63, 82, 78, 94, 4,  93, 89, 92, 59, 40, 94, 88, 97, 95,
+    5,  88, 40, 80, 79, 0,  2,  46, 86, 46, 75, 87, 86, 8,  23, 35, 62, 79, 66,
+    16, 16, 45, 11, 78, 76, 40, 73, 85, 28, 44, 33, 34, 22, 11, 62, 8,  35, 88,
+    92, 35, 53, 50, 51, 54, 75, 41, 21, 83, 57, 82, 80, 84, 65, 19, 11, 85, 41,
+    80, 86, 62, 34, 54, 54, 79, 81, 52, 87, 54, 54, 43, 17, 44, 63, 54, 14, 88,
+    84, 86, 73, 58, 44, 2,  70, 86, 80, 94, 13, 85, 78, 6,  44, 11, 11, 97, 67,
+    65, 28, 42, 40, 84, 92, 66, 85, 75, 29, 84, 82, 54, 50, 26, 12, 83, 57, 90,
+    9,  40, 69, 38, 70, 65, 76, 85, 76, 4,  30, 86, 43, 79, 77, 69, 53, 35, 12,
+    98, 7,  47, 12, 63, 10, 81, 39, 88, 12, 16, 88, 22, 72, 25, 41, 22, 34, 87,
+    68, 51, 86, 45, 27, 51, 80, 69, 89, 64, 89, 68, 61, 80, 6,  83, 47, 18, 86,
+    73, 16, 61, 89, 47, 5,  33, 59, 47, 75, 15, 60, 28, 18, 59, 65, 51, 13, 28,
+    26, 84, 89, 80, 51, 15, 92, 36, 89, 83, 28, 56, 65, 25, 44, 84, 70, 26, 10,
+    74, 91, 55, 85, 73, 25, 24, 64, 11, 1,  55, 32, 45, 74, 4,  55, 98, 42, 91,
+    88, 18, 79, 37, 15, 5,  98, 63, 65, 77, 66, 18, 99, 1,  78, 96, 15, 16, 16,
+    51, 11, 47, 58, 1,  12, 46, 5,  56, 34, 40, 36, 20, 4,  89, 59, 4,  13, 3,
+    8,  74, 41, 21, 64, 88, 97, 42, 14, 29, 38, 53, 65, 55, 67, 33, 69, 17, 79,
+    45, 2,  63, 2,  97, 47, 73, 22, 86, 32, 31, 95, 90, 84, 25, 86, 91, 77, 1,
+    5,  6,  22, 91, 3,  94, 52, 2,  95, 17, 1,  19, 22, 34, 49, 96, 88, 63, 26,
+    5,  25, 75, 23, 25, 80, 21, 83, 86, 81, 11, 70, 67, 11, 95, 81, 57, 63, 8,
+    43, 60, 40, 42, 67, 50, 2,  51, 43, 34, 7,  1,  90, 59, 74, 87, 23, 23, 71,
+    20, 89, 2,  75, 21, 91, 32, 87, 67, 98, 99, 22, 31, 59, 50, 64, 55, 22, 84,
+    9,  31, 31, 84, 36, 92, 60, 37, 85, 18, 12, 38, 55, 55, 93, 36, 9,  46, 48,
+    24, 91, 60, 95, 55, 73, 63, 27, 55, 96, 79, 50, 41, 5,  67, 85, 99, 95, 3,
+    97, 28, 27, 78, 38, 11, 77, 11, 64, 25, 22, 88, 34, 86, 30, 78, 95, 17, 9,
+    29, 58, 35, 22, 99, 28, 66, 35, 60, 10, 7,  51, 64, 86, 30, 27, 97, 63, 0,
+    36, 87, 52, 16, 5,  90, 8,  66, 58, 91, 85, 3,  95, 31, 73, 87, 30, 78, 46,
+    30, 75, 36, 44, 52, 76, 24, 58, 8,  70, 58, 95, 88, 0,  35, 86, 21, 96, 90,
+    54, 85, 56, 30, 37, 30, 62, 56, 63, 91, 25, 56, 20, 56, 23, 12, 8,  70, 56,
+    83, 49, 70, 67, 61, 95, 50, 41, 88, 37, 89, 37, 21, 63, 25, 46, 16, 75, 73,
+    86, 39, 4,  55, 41, 39, 45, 31, 97, 6,  81, 68, 38, 49, 80, 9,  87, 22, 37,
+    41, 28, 47, 74, 76, 34, 72, 65, 34, 41, 59, 42, 73, 32, 75, 25, 18, 26, 71,
+    93, 92, 12, 76, 93, 84, 44, 43, 4,  9,  3,  90, 91, 45, 0,  10, 43, 45, 65,
+    34, 82, 54, 1,  78, 36, 74, 58, 3,  26, 89, 21, 57, 42, 37, 12, 90, 97, 48,
+    27, 75, 40, 69, 61, 56, 44, 75, 77, 55, 31, 0,  77, 12, 23, 16, 98, 77, 8,
+    96, 92, 91, 26, 50, 42, 65, 38, 58, 41, 45, 69, 42, 37, 89, 92, 40, 74, 68,
+    86, 80, 49, 16, 48, 74, 50, 92, 54, 6,  82, 21, 35, 57, 81, 29, 10, 60, 74,
+    41, 70, 18, 65, 44, 77, 64, 8,  87, 90, 24, 52, 67, 58, 56, 89, 47, 15, 20,
+    4,  87, 72, 87, 13, 79, 3,  26, 43, 52, 72, 83, 17, 99, 29, 10, 61, 62, 42,
+    35, 47, 42, 40, 17, 71, 54, 30, 99, 64, 78, 70, 75, 38, 32, 51, 2,  49, 47,
+    0,  41, 50, 41, 64, 57, 78, 22, 17, 94, 24, 65, 84, 38, 75, 3,  58, 18, 51,
+    91, 72, 91, 55, 6,  70, 76, 73, 30, 54, 73, 77, 45, 85, 88, 58, 25, 80, 35,
+    99, 57, 73, 15, 55, 71, 44, 44, 79, 20, 63, 29, 14, 51, 10, 46, 80, 36, 47,
+    80, 53, 15, 64, 42, 59, 94, 55, 99, 28, 76, 80, 51, 4,  98, 98, 38, 59, 71,
+    9,  93, 91, 46, 74, 63, 10, 39, 1,  43, 11, 64, 39, 59, 54, 9,  44, 78, 52,
+    98, 9,  73, 24, 15, 40, 5,  55, 23, 83, 67, 10, 58, 45, 64, 41, 92, 85, 72,
+    18, 67, 65, 30, 56, 84, 63, 96, 51, 55, 19, 70, 48, 81, 2,  37, 85, 77};
+
+class PercentileEstimatorTest : public testing::Test {
+ public:
+  PercentileEstimatorTest() : index_(0) {}
+
+  // Create a new estimator with the given parameters.
+  void SetUpEstimator(int percentile, int initial_estimate) {
+    estimator_.reset(
+        new net::PercentileEstimator(percentile, initial_estimate));
+    estimator_->SetRandomNumberGeneratorForTesting(
+        base::Bind(&PercentileEstimatorTest::GetRandomNumber,
+                   // Safe since |estimator_| is owned by and
+                   // will not survive destruction of |this|.
+                   base::Unretained(this)));
+  }
+
+  int CurrentEstimate() { return estimator_->current_estimate(); }
+  void AddSample(int sample) { estimator_->AddSample(sample); }
+
+  // Add the sample until there's a change in the estimate, then return the
+  // new estimate.  To get around the randomness of whether samples are
+  // incorporated or not.
+  int AddSampleUntilRegistered(int sample) {
+    int old_estimate = estimator_->current_estimate();
+    while (old_estimate == estimator_->current_estimate())
+      estimator_->AddSample(sample);
+
+    return estimator_->current_estimate();
+  }
+
+  int GetRandomNumber() {
+    int result = random_numbers[index_];
+    ++index_;
+    if (static_cast<unsigned long>(index_) >=
+        sizeof(random_numbers) / sizeof(int)) {
+      index_ = 0;
+    }
+    return result;
+  }
+
+ private:
+  int index_;
+  std::unique_ptr<net::PercentileEstimator> estimator_;
+
+  DISALLOW_COPY_AND_ASSIGN(PercentileEstimatorTest);
+};
+
+// Converges upwards fairly quickly.
+TEST_F(PercentileEstimatorTest, MedianConvergesUpwards) {
+  SetUpEstimator(50, 100);
+
+  for (int i = 0; i < 40; ++i)
+    AddSample(150);
+
+  EXPECT_EQ(150, CurrentEstimate());
+}
+
+// Converges downwards fairly quickly.
+TEST_F(PercentileEstimatorTest, MedianConvergesDownwards) {
+  SetUpEstimator(50, 100);
+
+  for (int i = 0; i < 40; ++i)
+    AddSample(50);
+
+  EXPECT_EQ(50, CurrentEstimate());
+}
+
+// Stable if the value is bouncing around.
+TEST_F(PercentileEstimatorTest, BounceStable) {
+  SetUpEstimator(50, 100);
+
+  for (int i = 0; i < 20; ++i)
+    AddSample(50 + (i % 2) * 100);
+
+  EXPECT_LE(97, CurrentEstimate());
+  EXPECT_LE(CurrentEstimate(), 103);
+}
+
+// Correctly converges to a 90%l value upwards.
+TEST_F(PercentileEstimatorTest, NinetythConvergesUpwards) {
+  SetUpEstimator(90, 50);
+
+  for (int i = 0; i < 10000; ++i)
+    AddSample((i * kPrimeMultipleToRandomizeRamps) % 100);
+
+  EXPECT_LE(86, CurrentEstimate());
+  EXPECT_LE(CurrentEstimate(), 94);
+}
+
+// Correctly converges to a 90%l value downwards.
+TEST_F(PercentileEstimatorTest, NinetythConvergesDownwards) {
+  SetUpEstimator(90, 150);
+
+  for (int i = 0; i < 1000; ++i)
+    AddSample((i * kPrimeMultipleToRandomizeRamps) % 100);
+
+  EXPECT_LT(86, CurrentEstimate());
+  EXPECT_LT(CurrentEstimate(), 94);
+}
+
+// Doesn't overshoot sample heading upwards.
+TEST_F(PercentileEstimatorTest, NoUpwardsOvershoot) {
+  SetUpEstimator(50, 100);
+
+  // Crank up the step size
+  for (int i = 0; i < 20; ++i)
+    AddSample(1000);
+
+  // Derive the step size.
+  int e1 = CurrentEstimate();
+  int e2 = AddSampleUntilRegistered(1000);
+  int step_size = e2 - e1;
+  ASSERT_GT(step_size, 1);
+
+  // Increment by less than the current step size.
+  int new_sample = e2 + step_size / 2;
+  AddSampleUntilRegistered(new_sample);
+  EXPECT_EQ(new_sample, CurrentEstimate());
+  AddSampleUntilRegistered(1000);
+  EXPECT_GT(new_sample + step_size, CurrentEstimate());
+}
+
+// Doesn't overshoot sample heading downwards
+TEST_F(PercentileEstimatorTest, NoDownwardsOvershoot) {
+  SetUpEstimator(50, 1000);
+
+  // Crank up the step size
+  for (int i = 0; i < 20; ++i)
+    AddSample(100);
+
+  // Derive the step size.
+  int e1 = CurrentEstimate();
+  int e2 = AddSampleUntilRegistered(100);
+  int step_size = e1 - e2;
+  ASSERT_GT(step_size, 1);
+
+  // Increment by less than the current step size.
+  int new_sample = e2 - step_size / 2;
+  AddSampleUntilRegistered(new_sample);
+  EXPECT_EQ(new_sample, CurrentEstimate());
+  AddSampleUntilRegistered(100);
+  EXPECT_LT(new_sample - step_size, CurrentEstimate());
+}
+
+}  // namespace
diff --git a/chromium/net/base/port_util.cc b/chromium/net/base/port_util.cc
index 7328b5e842f..543d9db9435 100644
--- a/chromium/net/base/port_util.cc
+++ b/chromium/net/base/port_util.cc
@@ -84,6 +84,7 @@ const int kRestrictedPorts[] = {
     6667,    // Standard IRC [Apple addition]
     6668,    // Alternate IRC [Apple addition]
     6669,    // Alternate IRC [Apple addition]
+    6697,    // IRC + TLS
     0xFFFF,  // Used to block all invalid port numbers (see
              // third_party/WebKit/Source/platform/weborigin/KURL.cpp,
              // KURL::port())
diff --git a/chromium/net/base/port_util.h b/chromium/net/base/port_util.h
index 99a1ec484e3..d1cc5fe6ccd 100644
--- a/chromium/net/base/port_util.h
+++ b/chromium/net/base/port_util.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef NET_BASE_NET_PORT_UTIL_
-#define NET_BASE_NET_PORT_UTIL_
+#ifndef NET_BASE_PORT_UTIL_H_
+#define NET_BASE_PORT_UTIL_H_
 
 #include <stddef.h>
 
@@ -45,4 +45,4 @@ class NET_EXPORT ScopedPortException {
 
 }  // namespace net
 
-#endif  // NET_BASE_NET_PORT_UTIL_
+#endif  // NET_BASE_PORT_UTIL_H_
diff --git a/chromium/net/base/proxy_delegate.h b/chromium/net/base/proxy_delegate.h
index ad3a2bcafdd..2343196969f 100644
--- a/chromium/net/base/proxy_delegate.h
+++ b/chromium/net/base/proxy_delegate.h
@@ -20,7 +20,6 @@ class HostPortPair;
 class ProxyInfo;
 class ProxyServer;
 class ProxyService;
-class URLRequest;
 
 // Delegate for setting up a connection.
 class NET_EXPORT ProxyDelegate {
diff --git a/chromium/net/base/registry_controlled_domains/effective_tld_names.dat b/chromium/net/base/registry_controlled_domains/effective_tld_names.dat
index e93211f79e1..bba925debcd 100644
--- a/chromium/net/base/registry_controlled_domains/effective_tld_names.dat
+++ b/chromium/net/base/registry_controlled_domains/effective_tld_names.dat
@@ -4440,20 +4440,21 @@ org.ng
 sch.ng
 
 // ni : http://www.nic.ni/
+ni
+ac.ni
+biz.ni
+co.ni
 com.ni
-gob.ni
 edu.ni
-org.ni
-nom.ni
-net.ni
-mil.ni
-co.ni
-biz.ni
-web.ni
-int.ni
-ac.ni
+gob.ni
 in.ni
 info.ni
+int.ni
+mil.ni
+net.ni
+nom.ni
+org.ni
+web.ni
 
 // nl : https://en.wikipedia.org/wiki/.nl
 //      https://www.sidn.nl/
@@ -5279,6 +5280,9 @@ net.om
 org.om
 pro.om
 
+// onion : https://tools.ietf.org/html/rfc7686
+onion
+
 // org : https://en.wikipedia.org/wiki/.org
 org
 
@@ -5680,143 +5684,13 @@ gov.rs
 in.rs
 org.rs
 
-// ru : http://www.cctld.ru/ru/docs/aktiv_8.php
-// Industry domains
+// ru : https://cctld.ru/en/domains/domens_ru/reserved/
 ru
 ac.ru
-com.ru
 edu.ru
-int.ru
-net.ru
-org.ru
-pp.ru
-// Geographical domains
-adygeya.ru
-altai.ru
-amur.ru
-arkhangelsk.ru
-astrakhan.ru
-bashkiria.ru
-belgorod.ru
-bir.ru
-bryansk.ru
-buryatia.ru
-cbg.ru
-chel.ru
-chelyabinsk.ru
-chita.ru
-chukotka.ru
-chuvashia.ru
-dagestan.ru
-dudinka.ru
-e-burg.ru
-grozny.ru
-irkutsk.ru
-ivanovo.ru
-izhevsk.ru
-jar.ru
-joshkar-ola.ru
-kalmykia.ru
-kaluga.ru
-kamchatka.ru
-karelia.ru
-kazan.ru
-kchr.ru
-kemerovo.ru
-khabarovsk.ru
-khakassia.ru
-khv.ru
-kirov.ru
-koenig.ru
-komi.ru
-kostroma.ru
-krasnoyarsk.ru
-kuban.ru
-kurgan.ru
-kursk.ru
-lipetsk.ru
-magadan.ru
-mari.ru
-mari-el.ru
-marine.ru
-mordovia.ru
-// mosreg.ru  Bug 1090800 - removed at request of Aleksey Konstantinov <konstantinovav@mosreg.ru>
-msk.ru
-murmansk.ru
-nalchik.ru
-nnov.ru
-nov.ru
-novosibirsk.ru
-nsk.ru
-omsk.ru
-orenburg.ru
-oryol.ru
-palana.ru
-penza.ru
-perm.ru
-ptz.ru
-rnd.ru
-ryazan.ru
-sakhalin.ru
-samara.ru
-saratov.ru
-simbirsk.ru
-smolensk.ru
-spb.ru
-stavropol.ru
-stv.ru
-surgut.ru
-tambov.ru
-tatarstan.ru
-tom.ru
-tomsk.ru
-tsaritsyn.ru
-tsk.ru
-tula.ru
-tuva.ru
-tver.ru
-tyumen.ru
-udm.ru
-udmurtia.ru
-ulan-ude.ru
-vladikavkaz.ru
-vladimir.ru
-vladivostok.ru
-volgograd.ru
-vologda.ru
-voronezh.ru
-vrn.ru
-vyatka.ru
-yakutia.ru
-yamal.ru
-yaroslavl.ru
-yekaterinburg.ru
-yuzhno-sakhalinsk.ru
-// More geographical domains
-amursk.ru
-baikal.ru
-cmw.ru
-fareast.ru
-jamal.ru
-kms.ru
-k-uralsk.ru
-kustanai.ru
-kuzbass.ru
-mytis.ru
-nakhodka.ru
-nkz.ru
-norilsk.ru
-oskol.ru
-pyatigorsk.ru
-rubtsovsk.ru
-snz.ru
-syzran.ru
-vdonsk.ru
-zgrad.ru
-// State domains
 gov.ru
+int.ru
 mil.ru
-// Technical domains
 test.ru
 
 // rw : http://www.nic.rw/cgi-bin/policy.pl
@@ -5990,38 +5864,6 @@ store.st
 
 // su : https://en.wikipedia.org/wiki/.su
 su
-adygeya.su
-arkhangelsk.su
-balashov.su
-bashkiria.su
-bryansk.su
-dagestan.su
-grozny.su
-ivanovo.su
-kalmykia.su
-kaluga.su
-karelia.su
-khakassia.su
-krasnodar.su
-kurgan.su
-lenug.su
-mordovia.su
-msk.su
-murmansk.su
-nalchik.su
-nov.su
-obninsk.su
-penza.su
-pokrovsk.su
-sochi.su
-spb.su
-togliatti.su
-troitsk.su
-tula.su
-tuva.su
-vladikavkaz.su
-vladimir.su
-vologda.su
 
 // sv : http://www.svnet.org.sv/niveldos.pdf
 sv
@@ -10661,32 +10503,34 @@ beep.pl
 cloudfront.net
 
 // Amazon Elastic Compute Cloud: https://aws.amazon.com/ec2/
-// Submitted by Luke Wells <lawells@amazon.com>
+// Submitted by Luke Wells <psl-maintainers@amazon.com>
 *.compute.amazonaws.com
 *.compute-1.amazonaws.com
 *.compute.amazonaws.com.cn
 us-east-1.amazonaws.com
 
 // Amazon Elastic Beanstalk : https://aws.amazon.com/elasticbeanstalk/
-// Submitted by Luke Wells <lawells@amazon.com>
+// Submitted by Luke Wells <psl-maintainers@amazon.com>
 elasticbeanstalk.cn-north-1.amazonaws.com.cn
 *.elasticbeanstalk.com
 
 // Amazon Elastic Load Balancing : https://aws.amazon.com/elasticloadbalancing/
-// Submitted by Luke Wells <lawells@amazon.com>
+// Submitted by Luke Wells <psl-maintainers@amazon.com>
 *.elb.amazonaws.com
 *.elb.amazonaws.com.cn
 
 // Amazon S3 : https://aws.amazon.com/s3/
-// Submitted by Luke Wells <lawells@amazon.com>
+// Submitted by Luke Wells <psl-maintainers@amazon.com>
 s3.amazonaws.com
 s3-ap-northeast-1.amazonaws.com
 s3-ap-northeast-2.amazonaws.com
 s3-ap-south-1.amazonaws.com
 s3-ap-southeast-1.amazonaws.com
 s3-ap-southeast-2.amazonaws.com
+s3-ca-central-1.amazonaws.com
 s3-eu-central-1.amazonaws.com
 s3-eu-west-1.amazonaws.com
+s3-eu-west-2.amazonaws.com
 s3-external-1.amazonaws.com
 s3-fips-us-gov-west-1.amazonaws.com
 s3-sa-east-1.amazonaws.com
@@ -10697,15 +10541,19 @@ s3-us-west-2.amazonaws.com
 s3.ap-northeast-2.amazonaws.com
 s3.ap-south-1.amazonaws.com
 s3.cn-north-1.amazonaws.com.cn
+s3.ca-central-1.amazonaws.com
 s3.eu-central-1.amazonaws.com
+s3.eu-west-2.amazonaws.com
 s3.us-east-2.amazonaws.com
 s3.dualstack.ap-northeast-1.amazonaws.com
 s3.dualstack.ap-northeast-2.amazonaws.com
 s3.dualstack.ap-south-1.amazonaws.com
 s3.dualstack.ap-southeast-1.amazonaws.com
 s3.dualstack.ap-southeast-2.amazonaws.com
+s3.dualstack.ca-central-1.amazonaws.com
 s3.dualstack.eu-central-1.amazonaws.com
 s3.dualstack.eu-west-1.amazonaws.com
+s3.dualstack.eu-west-2.amazonaws.com
 s3.dualstack.sa-east-1.amazonaws.com
 s3.dualstack.us-east-1.amazonaws.com
 s3.dualstack.us-east-2.amazonaws.com
@@ -10719,13 +10567,24 @@ s3-website-eu-west-1.amazonaws.com
 s3-website-sa-east-1.amazonaws.com
 s3-website.ap-northeast-2.amazonaws.com
 s3-website.ap-south-1.amazonaws.com
+s3-website.ca-central-1.amazonaws.com
 s3-website.eu-central-1.amazonaws.com
+s3-website.eu-west-2.amazonaws.com
 s3-website.us-east-2.amazonaws.com
 
+// Amune : https://amune.org/
+// Submitted by Team Amune <cert@amune.org>
+t3l3p0rt.net
+tele.amune.org
+
 // Aptible : https://www.aptible.com/
 // Submitted by Thomas Orozco <thomas@aptible.com>
 on-aptible.com
 
+// Asociación Amigos de la Informática "Euskalamiga" : http://encounter.eus/
+// Submitted by Hector Martin <marcan@euskalencounter.org>
+user.party.eus
+
 // Association potager.org : https://potager.org/
 // Submitted by Lunar <jardiniers@potager.org>
 pimienta.org
@@ -11321,13 +11180,92 @@ us-2.evennode.com
 // Submitted by Peter Ruibal <public-suffix@fb.com>
 apps.fbsbx.com
 
-// Fastly Inc. http://www.fastly.com/
-// Submitted by Vladimir Vuksan <vladimir@fastly.com>
+// FAITID : https://faitid.org/
+// Submitted by Maxim Alzoba <tech.contact@faitid.org>
+// https://www.flexireg.net/stat_info
+ru.net
+adygeya.ru
+bashkiria.ru
+bir.ru
+cbg.ru
+com.ru
+dagestan.ru
+grozny.ru
+kalmykia.ru
+kustanai.ru
+marine.ru
+mordovia.ru
+msk.ru
+mytis.ru
+nalchik.ru
+nov.ru
+pyatigorsk.ru
+spb.ru
+vladikavkaz.ru
+vladimir.ru
+abkhazia.su
+adygeya.su
+aktyubinsk.su
+arkhangelsk.su
+armenia.su
+ashgabad.su
+azerbaijan.su
+balashov.su
+bashkiria.su
+bryansk.su
+bukhara.su
+chimkent.su
+dagestan.su
+east-kazakhstan.su
+exnet.su
+georgia.su
+grozny.su
+ivanovo.su
+jambyl.su
+kalmykia.su
+kaluga.su
+karacol.su
+karaganda.su
+karelia.su
+khakassia.su
+krasnodar.su
+kurgan.su
+kustanai.su
+lenug.su
+mangyshlak.su
+mordovia.su
+msk.su
+murmansk.su
+nalchik.su
+navoi.su
+north-kazakhstan.su
+nov.su
+obninsk.su
+penza.su
+pokrovsk.su
+sochi.su
+spb.su
+tashkent.su
+termez.su
+togliatti.su
+troitsk.su
+tselinograd.su
+tula.su
+tuva.su
+vladikavkaz.su
+vladimir.su
+vologda.su
+
+// Fastly Inc. : http://www.fastly.com/
+// Submitted by Fastly Security <security@fastly.com>
+map.fastly.net
+a.prod.fastly.net
+global.prod.fastly.net
 a.ssl.fastly.net
 b.ssl.fastly.net
 global.ssl.fastly.net
-a.prod.fastly.net
-global.prod.fastly.net
+fastlylb.net
+map.fastlylb.net
 
 // Featherhead : https://featherhead.xyz/
 // Submitted by Simon Menke <simon@featherhead.xyz>
@@ -11380,9 +11318,12 @@ gist.githubcloud.com
 // Submitted by Alex Hanselka <alex@gitlab.com>
 gitlab.io
 
+// UKHomeOffice : https://www.gov.uk/government/organisations/home-office
+// Submitted by Jon Shanks <jon.shanks@digital.homeoffice.gov.uk>
+homeoffice.gov.uk
+
 // GlobeHosting, Inc.
 // Submitted by Zoltan Egresi <egresi@globehosting.com>
-ro.com
 ro.im
 shop.ro
 
@@ -11732,6 +11673,10 @@ gotpantheon.com
 // Submitted by Steve Leung <steveleung@peplink.com>
 mypep.link
 
+// Planet-Work : https://www.planet-work.com/
+// Submitted by Frédéric VANNIÈRE <f.vanniere@planet-work.com>
+on-web.fr
+
 // prgmr.com : https://prgmr.com/
 // Submitted by Sarah Newman <owner@prgmr.com>
 xen.prgmr.com
@@ -11888,6 +11833,22 @@ townnews-staging.com
 // Submitted by TuxFamily administrators <adm@staff.tuxfamily.org>
 tuxfamily.org
 
+// TwoDNS : https://www.twodns.de/
+// Submitted by TwoDNS-Support <support@two-dns.de>
+dd-dns.de
+diskstation.eu
+diskstation.org
+dray-dns.de
+draydns.de
+dyn-vpn.de
+dynvpn.de
+mein-vigor.de
+my-vigor.de
+my-wan.de
+syno-ds.de
+synology-diskstation.de
+synology-ds.de
+
 // UDR Limited : http://www.udr.hk.com
 // Submitted by registry <hostmaster@udr.hk.com>
 hk.com
@@ -11903,6 +11864,10 @@ lib.de.us
 // Submitted by Simon Kissel <hostmaster@viprinet.com>
 router.management
 
+// Western Digital Technologies, Inc : https://www.wdc.com
+// Submitted by Jung Jin <jungseok.jin@wdc.com>
+remotewd.com
+
 // Wikimedia Labs : https://wikitech.wikimedia.org
 // Submitted by Yuvi Panda <yuvipanda@wikimedia.org>
 wmflabs.org
@@ -11930,4 +11895,10 @@ za.org
 // Submitted by Olli Vanhoja <olli@zeit.co>
 now.sh
 
+// 1GB LLC : https://www.1gb.ua/
+// Submitted by 1GB LLC <noc@1gb.com.ua>
+cc.ua
+inf.ua
+ltd.ua
+
 // ===END PRIVATE DOMAINS===
diff --git a/chromium/net/base/registry_controlled_domains/effective_tld_names.gperf b/chromium/net/base/registry_controlled_domains/effective_tld_names.gperf
index 58f69a044f9..5d152382a64 100644
--- a/chromium/net/base/registry_controlled_domains/effective_tld_names.gperf
+++ b/chromium/net/base/registry_controlled_domains/effective_tld_names.gperf
@@ -45,6 +45,7 @@ abc, 0
 abeno.osaka.jp, 0
 abiko.chiba.jp, 0
 abira.hokkaido.jp, 0
+abkhazia.su, 4
 able, 0
 abo.pa, 0
 abogado, 0
@@ -117,8 +118,8 @@ adult, 0
 adult.ht, 0
 adv.br, 0
 adv.mz, 0
-adygeya.ru, 0
-adygeya.su, 0
+adygeya.ru, 4
+adygeya.su, 4
 ae, 0
 ae.org, 4
 aeg, 0
@@ -198,6 +199,7 @@ akkeshi.hokkaido.jp, 0
 aknoluokta.no, 0
 ako.hyogo.jp, 0
 akrehamn.no, 0
+aktyubinsk.su, 4
 akune.kagoshima.jp, 0
 al, 0
 al.eu.org, 4
@@ -226,7 +228,6 @@ alstahaug.no, 0
 alstom, 0
 alt.za, 0
 alta.no, 0
-altai.ru, 0
 alto-adige.it, 0
 altoadige.it, 0
 alvdal.no, 0
@@ -256,8 +257,6 @@ amli.no, 0
 amot.no, 0
 amsterdam, 0
 amsterdam.museum, 0
-amur.ru, 0
-amursk.ru, 0
 amusement.aero, 0
 an.it, 0
 analytics, 0
@@ -336,8 +335,8 @@ ariake.saga.jp, 0
 arida.wakayama.jp, 0
 aridagawa.wakayama.jp, 0
 arita.saga.jp, 0
-arkhangelsk.ru, 0
-arkhangelsk.su, 0
+arkhangelsk.su, 4
+armenia.su, 4
 army, 0
 arna.no, 0
 arpa, 0
@@ -380,6 +379,7 @@ ascoli-piceno.it, 0
 ascolipiceno.it, 0
 asda, 0
 aseral.no, 0
+ashgabad.su, 4
 ashibetsu.hokkaido.jp, 0
 ashikaga.tochigi.jp, 0
 ashiya.fukuoka.jp, 0
@@ -416,7 +416,6 @@ associates, 0
 association.aero, 0
 association.museum, 0
 asti.it, 0
-astrakhan.ru, 0
 astronomy.museum, 0
 asuke.aichi.jp, 0
 at, 0
@@ -476,6 +475,7 @@ ayagawa.kagawa.jp, 0
 ayase.kanagawa.jp, 0
 az, 0
 az.us, 0
+azerbaijan.su, 4
 azumino.nagano.jp, 0
 azure, 0
 azure-mobile.net, 4
@@ -498,9 +498,8 @@ bahccavuotna.no, 0
 bahn.museum, 0
 baidar.no, 0
 baidu, 0
-baikal.ru, 0
 bajddar.no, 0
-balashov.su, 0
+balashov.su, 4
 balat.no, 0
 bale.museum, 0
 balestrand.no, 0
@@ -536,8 +535,8 @@ bas.it, 0
 baseball, 0
 baseball.museum, 0
 basel.museum, 0
-bashkiria.ru, 0
-bashkiria.su, 0
+bashkiria.ru, 4
+bashkiria.su, 4
 basilicata.it, 0
 basketball, 0
 baths.museum, 0
@@ -570,7 +569,6 @@ beer, 0
 beiarn.no, 0
 bel.tr, 0
 belau.pw, 0
-belgorod.ru, 0
 bellevue.museum, 0
 belluno.it, 0
 benevento.it, 0
@@ -621,7 +619,7 @@ bing, 0
 bingo, 0
 bio, 0
 bio.br, 0
-bir.ru, 0
+bir.ru, 4
 biratori.hokkaido.jp, 0
 birdart.museum, 0
 birkenes.no, 0
@@ -820,8 +818,7 @@ brussel.museum, 0
 brussels, 0
 brussels.museum, 0
 bruxelles.museum, 0
-bryansk.ru, 0
-bryansk.su, 0
+bryansk.su, 4
 bryne.no, 0
 bs, 0
 bs.it, 0
@@ -834,11 +831,11 @@ bugatti, 0
 build, 0
 builders, 0
 building.museum, 0
+bukhara.su, 4
 bungoono.oita.jp, 0
 bungotakada.oita.jp, 0
 bunkyo.tokyo.jp, 0
 burghof.museum, 0
-buryatia.ru, 0
 bus.museum, 0
 busan.kr, 0
 bushey.museum, 0
@@ -931,7 +928,7 @@ catering.aero, 0
 catholic, 0
 cb.it, 0
 cba, 0
-cbg.ru, 0
+cbg.ru, 4
 cbn, 0
 cbre, 0
 cbs, 0
@@ -984,6 +981,7 @@ cc.sc.us, 0
 cc.sd.us, 0
 cc.tn.us, 0
 cc.tx.us, 0
+cc.ua, 4
 cc.ut.us, 0
 cc.va.us, 0
 cc.vi.us, 0
@@ -1025,9 +1023,7 @@ chase, 0
 chat, 0
 chattanooga.museum, 0
 cheap, 0
-chel.ru, 0
 cheltenham.museum, 0
-chelyabinsk.ru, 0
 cherkassy.ua, 0
 cherkasy.ua, 0
 chernigov.ua, 0
@@ -1053,6 +1049,7 @@ chikuzen.fukuoka.jp, 0
 children.museum, 0
 childrens.museum, 0
 childrensgarden.museum, 0
+chimkent.su, 4
 chino.nagano.jp, 0
 chintai, 0
 chippubetsu.hokkaido.jp, 0
@@ -1061,7 +1058,6 @@ chirurgiens-dentistes-en-france.fr, 4
 chirurgiens-dentistes.fr, 0
 chiryu.aichi.jp, 0
 chita.aichi.jp, 0
-chita.ru, 0
 chitose.hokkaido.jp, 0
 chiyoda.gunma.jp, 0
 chiyoda.tokyo.jp, 0
@@ -1078,7 +1074,6 @@ christmas, 0
 chrome, 0
 chrysler, 0
 chtr.k12.ma.us, 0
-chukotka.ru, 0
 chungbuk.kr, 0
 chungnam.kr, 0
 chuo.chiba.jp, 0
@@ -1087,7 +1082,6 @@ chuo.osaka.jp, 0
 chuo.tokyo.jp, 0
 chuo.yamanashi.jp, 0
 church, 0
-chuvashia.ru, 0
 ci, 0
 ci.it, 0
 cieszyn.pl, 0
@@ -1150,7 +1144,6 @@ club.aero, 0
 club.tw, 0
 clubmed, 0
 cm, 0
-cmw.ru, 0
 cn, 0
 cn.com, 4
 cn.eu.org, 4
@@ -1339,7 +1332,7 @@ com.py, 0
 com.qa, 0
 com.re, 0
 com.ro, 0
-com.ru, 0
+com.ru, 4
 com.rw, 0
 com.sa, 0
 com.sb, 0
@@ -1486,8 +1479,8 @@ dabur, 0
 dad, 0
 daegu.kr, 0
 daejeon.kr, 0
-dagestan.ru, 0
-dagestan.su, 0
+dagestan.ru, 4
+dagestan.su, 4
 daigo.ibaraki.jp, 0
 daisen.akita.jp, 0
 daito.osaka.jp, 0
@@ -1510,6 +1503,7 @@ day, 0
 dazaifu.fukuoka.jp, 0
 dc.us, 0
 dclk, 0
+dd-dns.de, 4
 ddns.me, 4
 ddns.net, 4
 ddnsking.com, 4
@@ -1566,7 +1560,9 @@ discount, 0
 discover, 0
 discovery.museum, 0
 dish, 0
+diskstation.eu, 4
 diskstation.me, 4
+diskstation.org, 4
 ditchyourip.com, 4
 divtasvuodna.no, 0
 divttasvuotna.no, 0
@@ -1620,6 +1616,8 @@ dr.na, 0
 dr.tr, 0
 drammen.no, 0
 drangedal.no, 0
+dray-dns.de, 4
+draydns.de, 4
 dreamhosters.com, 4
 drive, 0
 drobak.no, 0
@@ -1635,7 +1633,6 @@ dtv, 0
 dubai, 0
 duck, 0
 duckdns.org, 4
-dudinka.ru, 0
 dunlop, 0
 duns, 0
 dupont, 0
@@ -1649,6 +1646,7 @@ dwg, 0
 dy.fi, 4
 dyn-ip24.de, 4
 dyn-o-saur.com, 4
+dyn-vpn.de, 4
 dyn.cosidns.de, 4
 dyn.ddnss.de, 4
 dyn.home-webserver.de, 4
@@ -1681,15 +1679,16 @@ dyndns.ws, 4
 dyndns1.de, 4
 dynns.com, 4
 dynv6.net, 4
+dynvpn.de, 4
 dyroy.no, 0
 dz, 0
-e-burg.ru, 0
 e.bg, 0
 e.se, 0
 e12.ve, 0
 e164.arpa, 0
 e4.cz, 4
 earth, 0
+east-kazakhstan.su, 4
 eastafrica.museum, 0
 eastcoast.museum, 0
 eat, 0
@@ -1950,6 +1949,7 @@ exchange, 0
 exchange.aero, 0
 exeter.museum, 0
 exhibition.museum, 0
+exnet.su, 4
 expert, 0
 experts-comptables.fr, 0
 exposed, 0
@@ -1973,7 +1973,6 @@ fan, 0
 fans, 0
 fantasyleague.cc, 4
 far.br, 0
-fareast.ru, 0
 farm, 0
 farm.museum, 0
 farmequipment.museum, 0
@@ -1983,6 +1982,7 @@ farmstead.museum, 0
 farsund.no, 0
 fashion, 0
 fast, 0
+fastlylb.net, 4
 fauske.no, 0
 fbx-os.fr, 4
 fbxos.fr, 4
@@ -2335,6 +2335,7 @@ geology.museum, 0
 geometre-expert.fr, 0
 george, 0
 georgia.museum, 0
+georgia.su, 4
 getmyip.com, 4
 gets-it.net, 4
 gf, 0
@@ -2617,8 +2618,8 @@ grosseto.it, 0
 groundhandling.aero, 0
 group, 0
 group.aero, 0
-grozny.ru, 0
-grozny.su, 0
+grozny.ru, 4
+grozny.su, 4
 grp.lk, 0
 grue.no, 0
 gs, 0
@@ -2908,6 +2909,7 @@ homelink.one, 4
 homelinux.com, 4
 homelinux.net, 4
 homelinux.org, 4
+homeoffice.gov.uk, 4
 homes, 0
 homesecuritymac.com, 4
 homesecuritypc.com, 4
@@ -3095,6 +3097,7 @@ ine.kyoto.jp, 0
 inf.br, 0
 inf.cu, 0
 inf.mk, 0
+inf.ua, 4
 infiniti, 0
 info, 0
 info.at, 4
@@ -3172,7 +3175,6 @@ ir, 0
 iraq.museum, 0
 iris.arpa, 0
 irish, 0
-irkutsk.ru, 0
 iron.museum, 0
 iruma.saitama.jp, 0
 is, 0
@@ -3299,8 +3301,7 @@ itoman.okinawa.jp, 0
 its.me, 0
 itv, 0
 ivano-frankivsk.ua, 0
-ivanovo.ru, 0
-ivanovo.su, 0
+ivanovo.su, 4
 iveco, 0
 iveland.no, 0
 ivgu.no, 0
@@ -3323,7 +3324,6 @@ iwi.nz, 0
 iyo.ehime.jp, 0
 iz.hr, 0
 izena.okinawa.jp, 0
-izhevsk.ru, 0
 izu.shizuoka.jp, 0
 izumi.kagoshima.jp, 0
 izumi.osaka.jp, 0
@@ -3335,10 +3335,9 @@ izumozaki.niigata.jp, 0
 izunokuni.shizuoka.jp, 0
 j.bg, 0
 jaguar, 0
-jamal.ru, 0
+jambyl.su, 4
 jamison.museum, 0
 jan-mayen.no, 0
-jar.ru, 0
 java, 0
 jaworzno.pl, 0
 jcb, 0
@@ -3380,7 +3379,6 @@ jolster.no, 0
 jondal.no, 0
 jor.br, 0
 jorpeland.no, 0
-joshkar-ola.ru, 0
 joso.ibaraki.jp, 0
 jot, 0
 journal.aero, 0
@@ -3405,7 +3403,6 @@ juniper, 0
 jur.pro, 0
 jus.br, 0
 jx.cn, 0
-k-uralsk.ru, 0
 k.bg, 0
 k.se, 0
 k12.ak.us, 0
@@ -3489,14 +3486,12 @@ kakinoki.shimane.jp, 0
 kakogawa.hyogo.jp, 0
 kakuda.miyagi.jp, 0
 kalisz.pl, 0
-kalmykia.ru, 0
-kalmykia.su, 0
-kaluga.ru, 0
-kaluga.su, 0
+kalmykia.ru, 4
+kalmykia.su, 4
+kaluga.su, 4
 kamagaya.chiba.jp, 0
 kamaishi.iwate.jp, 0
 kamakura.kanagawa.jp, 0
-kamchatka.ru, 0
 kameoka.kyoto.jp, 0
 kameyama.mie.jp, 0
 kami.kochi.jp, 0
@@ -3542,13 +3537,14 @@ kanoya.kagoshima.jp, 0
 kanra.gunma.jp, 0
 kanuma.tochigi.jp, 0
 kanzaki.saga.jp, 0
+karacol.su, 4
+karaganda.su, 4
 karasjohka.no, 0
 karasjok.no, 0
 karasuyama.tochigi.jp, 0
 karate.museum, 0
 karatsu.saga.jp, 0
-karelia.ru, 0
-karelia.su, 0
+karelia.su, 4
 karikatur.museum, 0
 kariwa.niigata.jp, 0
 kariya.aichi.jp, 0
@@ -3615,16 +3611,13 @@ kawatana.nagasaki.jp, 0
 kawaue.gifu.jp, 0
 kawazu.shizuoka.jp, 0
 kayabe.hokkaido.jp, 0
-kazan.ru, 0
 kazimierz-dolny.pl, 0
 kazo.saitama.jp, 0
 kazuno.akita.jp, 0
-kchr.ru, 0
 kddi, 0
 ke, 2
 keisen.fukuoka.jp, 0
 kembuchi.hokkaido.jp, 0
-kemerovo.ru, 0
 kep.tr, 0
 kepno.pl, 0
 kerryhotels, 0
@@ -3637,15 +3630,12 @@ kg, 0
 kg.kr, 0
 kh, 2
 kh.ua, 0
-khabarovsk.ru, 0
-khakassia.ru, 0
-khakassia.su, 0
+khakassia.su, 4
 kharkiv.ua, 0
 kharkov.ua, 0
 kherson.ua, 0
 khmelnitskiy.ua, 0
 khmelnytskyi.ua, 0
-khv.ru, 0
 ki, 0
 kia, 0
 kibichuo.okayama.jp, 0
@@ -3671,7 +3661,6 @@ kinko.kagoshima.jp, 0
 kinokawa.wakayama.jp, 0
 kira.aichi.jp, 0
 kirkenes.no, 0
-kirov.ru, 0
 kirovograd.ua, 0
 kiryu.gunma.jp, 0
 kisarazu.chiba.jp, 0
@@ -3717,7 +3706,6 @@ klodzko.pl, 0
 km, 0
 km.ua, 0
 kmpsp.gov.pl, 0
-kms.ru, 0
 kn, 0
 knightpoint.systems, 4
 knowsitall.info, 4
@@ -3731,7 +3719,6 @@ kodaira.tokyo.jp, 0
 koebenhavn.museum, 0
 koeln, 0
 koeln.museum, 0
-koenig.ru, 0
 kofu.yamanashi.jp, 0
 koga.fukuoka.jp, 0
 koga.ibaraki.jp, 0
@@ -3748,7 +3735,6 @@ komatsu, 0
 komatsu.ishikawa.jp, 0
 komatsushima.tokushima.jp, 0
 komforb.se, 0
-komi.ru, 0
 kommunalforbund.se, 0
 kommune.no, 0
 komono.mie.jp, 0
@@ -3773,7 +3759,6 @@ kosher, 0
 koshigaya.saitama.jp, 0
 koshimizu.hokkaido.jp, 0
 koshu.yamanashi.jp, 0
-kostroma.ru, 0
 kosuge.yamanashi.jp, 0
 kota.aichi.jp, 0
 koto.shiga.jp, 0
@@ -3800,8 +3785,7 @@ kr.ua, 0
 kraanghke.no, 0
 kragero.no, 0
 krakow.pl, 4
-krasnodar.su, 0
-krasnoyarsk.ru, 0
+krasnodar.su, 4
 krd, 0
 kred, 0
 kristiansand.no, 0
@@ -3811,7 +3795,6 @@ krokstadelva.no, 0
 krym.ua, 0
 ks.ua, 0
 ks.us, 0
-kuban.ru, 0
 kuchinotsu.nagasaki.jp, 0
 kudamatsu.yamaguchi.jp, 0
 kudoyama.wakayama.jp, 0
@@ -3845,8 +3828,7 @@ kuokgroup, 0
 kurashiki.okayama.jp, 0
 kurate.fukuoka.jp, 0
 kure.hiroshima.jp, 0
-kurgan.ru, 0
-kurgan.su, 0
+kurgan.su, 4
 kuriyama.hokkaido.jp, 0
 kurobe.toyama.jp, 0
 kurogi.fukuoka.jp, 0
@@ -3854,19 +3836,18 @@ kuroishi.aomori.jp, 0
 kuroiso.tochigi.jp, 0
 kuromatsunai.hokkaido.jp, 0
 kurotaki.nara.jp, 0
-kursk.ru, 0
 kurume.fukuoka.jp, 0
 kusatsu.gunma.jp, 0
 kusatsu.shiga.jp, 0
 kushima.miyazaki.jp, 0
 kushimoto.wakayama.jp, 0
 kushiro.hokkaido.jp, 0
-kustanai.ru, 0
+kustanai.ru, 4
+kustanai.su, 4
 kusu.oita.jp, 0
 kutchan.hokkaido.jp, 0
 kutno.pl, 0
 kuwana.mie.jp, 0
-kuzbass.ru, 0
 kuzumaki.iwate.jp, 0
 kv.ua, 0
 kvafjord.no, 0
@@ -3966,7 +3947,7 @@ leitungsen.de, 4
 leka.no, 0
 leksvik.no, 0
 lel.br, 0
-lenug.su, 0
+lenug.su, 4
 lenvik.no, 0
 lerdal.no, 0
 lesja.no, 0
@@ -4060,7 +4041,6 @@ linde, 0
 lindesnes.no, 0
 link, 0
 linz.museum, 0
-lipetsk.ru, 0
 lipsy, 0
 live, 0
 living, 0
@@ -4116,6 +4096,7 @@ ltd.cy, 0
 ltd.gi, 0
 ltd.hk, 4
 ltd.lk, 0
+ltd.ua, 4
 ltd.uk, 0
 ltda, 0
 lu, 0
@@ -4157,7 +4138,6 @@ mad.museum, 0
 madrid, 0
 madrid.museum, 0
 maebashi.gunma.jp, 0
-magadan.ru, 0
 magazine.aero, 0
 magentosite.cloud, 6
 maibara.shiga.jp, 0
@@ -4181,6 +4161,7 @@ management, 0
 manchester.museum, 0
 mandal.no, 0
 mango, 0
+mangyshlak.su, 4
 maniwa.okayama.jp, 0
 manno.kagawa.jp, 0
 mansion.museum, 0
@@ -4189,12 +4170,12 @@ mantova.it, 0
 manx.museum, 0
 maori.nz, 0
 map, 0
+map.fastly.net, 4
+map.fastlylb.net, 4
 mar.it, 0
 marburg.museum, 0
 marche.it, 0
-mari-el.ru, 0
-mari.ru, 0
-marine.ru, 0
+marine.ru, 4
 maritime.museum, 0
 maritimo.museum, 0
 marker.no, 0
@@ -4284,6 +4265,7 @@ medizinhistorisches.museum, 0
 meeres.museum, 0
 meet, 0
 meguro.tokyo.jp, 0
+mein-vigor.de, 4
 meiwa.gunma.jp, 0
 meiwa.mie.jp, 0
 meland.no, 0
@@ -4549,8 +4531,8 @@ monzabrianza.it, 0
 monzaebrianza.it, 0
 monzaedellabrianza.it, 0
 mopar, 0
-mordovia.ru, 0
-mordovia.su, 0
+mordovia.ru, 4
+mordovia.su, 4
 moriguchi.osaka.jp, 0
 morimachi.shizuoka.jp, 0
 morioka.iwate.jp, 0
@@ -4590,8 +4572,8 @@ ms.kr, 0
 ms.leg.br, 4
 ms.us, 0
 msd, 0
-msk.ru, 0
-msk.su, 0
+msk.ru, 4
+msk.su, 4
 mt, 0
 mt.eu.org, 4
 mt.it, 0
@@ -4616,8 +4598,7 @@ mup.gov.pl, 0
 murakami.niigata.jp, 0
 murata.miyagi.jp, 0
 murayama.yamagata.jp, 0
-murmansk.ru, 0
-murmansk.su, 0
+murmansk.su, 4
 muroran.hokkaido.jp, 0
 muroto.kochi.jp, 0
 mus.br, 0
@@ -4646,6 +4627,8 @@ my, 0
 my-firewall.org, 4
 my-gateway.de, 4
 my-router.de, 4
+my-vigor.de, 4
+my-wan.de, 4
 my.eu.org, 4
 my.id, 0
 myactivedirectory.com, 4
@@ -4673,7 +4656,7 @@ mysecuritycamera.com, 4
 mysecuritycamera.net, 4
 mysecuritycamera.org, 4
 myshopblocks.com, 4
-mytis.ru, 0
+mytis.ru, 4
 myvnc.com, 4
 mz, 0
 n.bg, 0
@@ -4731,11 +4714,10 @@ nakatane.kagoshima.jp, 0
 nakatombetsu.hokkaido.jp, 0
 nakatsugawa.gifu.jp, 0
 nakayama.yamagata.jp, 0
-nakhodka.ru, 0
 nakijin.okinawa.jp, 0
 naklo.pl, 0
-nalchik.ru, 0
-nalchik.su, 0
+nalchik.ru, 4
+nalchik.su, 4
 namdalseid.no, 0
 name, 0
 name.az, 0
@@ -4808,6 +4790,7 @@ naumburg.museum, 0
 naustdal.no, 0
 naval.museum, 0
 navigation.aero, 0
+navoi.su, 4
 navuotna.no, 0
 navy, 0
 nayoro.hokkaido.jp, 0
@@ -4934,7 +4917,6 @@ net.ps, 0
 net.pt, 0
 net.py, 0
 net.qa, 0
-net.ru, 0
 net.rw, 0
 net.sa, 0
 net.sb, 0
@@ -5055,14 +5037,12 @@ nisshin.aichi.jp, 0
 nittedal.no, 0
 niyodogawa.kochi.jp, 0
 nj.us, 0
-nkz.ru, 0
 nl, 0
 nl.ca, 0
 nl.eu.org, 4
 nl.no, 0
 nm.cn, 0
 nm.us, 0
-nnov.ru, 0
 no, 0
 no-ip.biz, 4
 no-ip.ca, 4
@@ -5111,7 +5091,7 @@ nordre-land.no, 0
 nordreisa.no, 0
 nore-og-uvdal.no, 0
 norfolk.museum, 0
-norilsk.ru, 0
+north-kazakhstan.su, 4
 north.museum, 0
 northwesternmutual, 0
 norton, 0
@@ -5125,10 +5105,9 @@ noto.ishikawa.jp, 0
 notodden.no, 0
 notogawa.shiga.jp, 0
 notteroy.no, 0
-nov.ru, 0
-nov.su, 0
+nov.ru, 4
+nov.su, 4
 novara.it, 0
-novosibirsk.ru, 0
 now, 0
 now.sh, 4
 nowaruda.pl, 0
@@ -5141,7 +5120,6 @@ nra, 0
 nrw, 0
 nrw.museum, 0
 ns.ca, 0
-nsk.ru, 0
 nsn.us, 0
 nsupdate.info, 4
 nsw.au, 0
@@ -5183,7 +5161,7 @@ obanazawa.yamagata.jp, 0
 obi, 0
 obihiro.hokkaido.jp, 0
 obira.hokkaido.jp, 0
-obninsk.su, 0
+obninsk.su, 4
 observer, 0
 obu.aichi.jp, 0
 obuse.nagano.jp, 0
@@ -5288,16 +5266,17 @@ omihachiman.shiga.jp, 0
 omitama.ibaraki.jp, 0
 omiya.saitama.jp, 0
 omotego.fukushima.jp, 0
-omsk.ru, 0
 omura.nagasaki.jp, 0
 omuta.fukuoka.jp, 0
 on-aptible.com, 4
 on-the-web.tv, 4
+on-web.fr, 4
 on.ca, 0
 onagawa.miyagi.jp, 0
 one, 0
 ong, 0
 onga.fukuoka.jp, 0
+onion, 0
 onjuku.chiba.jp, 0
 onl, 0
 online, 0
@@ -5342,7 +5321,6 @@ oracle, 0
 orange, 0
 oregon.museum, 0
 oregontrail.museum, 0
-orenburg.ru, 0
 org, 0
 org.ac, 0
 org.ae, 0
@@ -5450,7 +5428,6 @@ org.py, 0
 org.qa, 0
 org.ro, 0
 org.rs, 0
-org.ru, 0
 org.sa, 0
 org.sb, 0
 org.sc, 0
@@ -5494,7 +5471,6 @@ orkdal.no, 0
 orland.no, 0
 orskog.no, 0
 orsta.no, 0
-oryol.ru, 0
 os.hedmark.no, 0
 os.hordaland.no, 0
 osaka, 0
@@ -5508,7 +5484,6 @@ oshima.tokyo.jp, 0
 oshima.yamaguchi.jp, 0
 oshino.yamanashi.jp, 0
 oshu.iwate.jp, 0
-oskol.ru, 0
 oslo.no, 0
 osoyro.no, 0
 osteroy.no, 0
@@ -5579,7 +5554,6 @@ page, 0
 pagefrontapp.com, 4
 pagespeedmobilizer.com, 4
 palace.museum, 0
-palana.ru, 0
 paleo.museum, 0
 palermo.it, 0
 palmsprings.museum, 0
@@ -5618,12 +5592,10 @@ pe.ca, 0
 pe.it, 0
 pe.kr, 0
 pe.leg.br, 4
-penza.ru, 0
-penza.su, 0
+penza.su, 4
 per.la, 0
 per.nf, 0
 per.sg, 0
-perm.ru, 0
 perso.ht, 0
 perso.sn, 0
 perso.tn, 0
@@ -5714,7 +5686,7 @@ point2this.com, 4
 pointto.us, 4
 poivron.org, 4
 poker, 0
-pokrovsk.su, 0
+pokrovsk.su, 4
 pol.dz, 0
 pol.ht, 0
 pol.tr, 0
@@ -5740,7 +5712,6 @@ potenza.it, 0
 powiat.pl, 0
 poznan.pl, 4
 pp.az, 0
-pp.ru, 0
 pp.se, 0
 pp.ua, 4
 ppg.br, 0
@@ -5813,7 +5784,6 @@ pt, 0
 pt.eu.org, 4
 pt.it, 0
 ptplus.fit, 4
-ptz.ru, 0
 pu.it, 0
 pub, 0
 pub.sa, 0
@@ -5831,7 +5801,7 @@ pvt.k12.ma.us, 0
 pw, 0
 pwc, 0
 py, 0
-pyatigorsk.ru, 0
+pyatigorsk.ru, 4
 pz.it, 0
 q-a.eu.org, 4
 q.bg, 0
@@ -5917,6 +5887,7 @@ reklam.hu, 0
 rel.ht, 0
 rel.pl, 0
 reliance, 0
+remotewd.com, 4
 ren, 0
 rendalen.no, 0
 rennebu.no, 0
@@ -5972,12 +5943,10 @@ rm.it, 0
 rmit, 0
 rn.it, 0
 rn.leg.br, 4
-rnd.ru, 0
 rnrt.tn, 0
 rns.tn, 0
 rnu.tn, 0
 ro, 0
-ro.com, 4
 ro.eu.org, 4
 ro.im, 4
 ro.it, 0
@@ -6014,7 +5983,7 @@ rsvp, 0
 ru, 0
 ru.com, 4
 ru.eu.org, 4
-rubtsovsk.ru, 0
+ru.net, 4
 ruhr, 0
 run, 0
 ruovat.no, 0
@@ -6022,7 +5991,6 @@ russia.museum, 0
 rv.ua, 0
 rw, 0
 rwe, 0
-ryazan.ru, 0
 rybnik.pl, 0
 rygge.no, 0
 ryokami.saitama.jp, 0
@@ -6038,8 +6006,10 @@ s3-ap-northeast-2.amazonaws.com, 4
 s3-ap-south-1.amazonaws.com, 4
 s3-ap-southeast-1.amazonaws.com, 4
 s3-ap-southeast-2.amazonaws.com, 4
+s3-ca-central-1.amazonaws.com, 4
 s3-eu-central-1.amazonaws.com, 4
 s3-eu-west-1.amazonaws.com, 4
+s3-eu-west-2.amazonaws.com, 4
 s3-external-1.amazonaws.com, 4
 s3-fips-us-gov-west-1.amazonaws.com, 4
 s3-sa-east-1.amazonaws.com, 4
@@ -6057,23 +6027,29 @@ s3-website-us-west-1.amazonaws.com, 4
 s3-website-us-west-2.amazonaws.com, 4
 s3-website.ap-northeast-2.amazonaws.com, 4
 s3-website.ap-south-1.amazonaws.com, 4
+s3-website.ca-central-1.amazonaws.com, 4
 s3-website.eu-central-1.amazonaws.com, 4
+s3-website.eu-west-2.amazonaws.com, 4
 s3-website.us-east-2.amazonaws.com, 4
 s3.amazonaws.com, 4
 s3.ap-northeast-2.amazonaws.com, 4
 s3.ap-south-1.amazonaws.com, 4
+s3.ca-central-1.amazonaws.com, 4
 s3.cn-north-1.amazonaws.com.cn, 4
 s3.dualstack.ap-northeast-1.amazonaws.com, 4
 s3.dualstack.ap-northeast-2.amazonaws.com, 4
 s3.dualstack.ap-south-1.amazonaws.com, 4
 s3.dualstack.ap-southeast-1.amazonaws.com, 4
 s3.dualstack.ap-southeast-2.amazonaws.com, 4
+s3.dualstack.ca-central-1.amazonaws.com, 4
 s3.dualstack.eu-central-1.amazonaws.com, 4
 s3.dualstack.eu-west-1.amazonaws.com, 4
+s3.dualstack.eu-west-2.amazonaws.com, 4
 s3.dualstack.sa-east-1.amazonaws.com, 4
 s3.dualstack.us-east-1.amazonaws.com, 4
 s3.dualstack.us-east-2.amazonaws.com, 4
 s3.eu-central-1.amazonaws.com, 4
+s3.eu-west-2.amazonaws.com, 4
 s3.us-east-2.amazonaws.com, 4
 sa, 0
 sa.au, 0
@@ -6114,7 +6090,6 @@ sakaki.nagano.jp, 0
 sakata.yamagata.jp, 0
 sakawa.kochi.jp, 0
 sakegawa.yamagata.jp, 0
-sakhalin.ru, 0
 saku.nagano.jp, 0
 sakuho.nagano.jp, 0
 sakura, 0
@@ -6132,7 +6107,6 @@ salon, 0
 saltdal.no, 0
 salvadordali.museum, 0
 salzburg.museum, 0
-samara.ru, 0
 samegawa.fukushima.jp, 0
 samnanger.no, 0
 samsclub, 0
@@ -6168,7 +6142,6 @@ sap, 0
 sapo, 0
 sapporo.jp, 2
 sar.it, 0
-saratov.ru, 0
 sardegna.it, 0
 sardinia.it, 0
 sarl, 0
@@ -6472,7 +6445,6 @@ sigdal.no, 0
 siljan.no, 0
 silk, 0
 silk.museum, 0
-simbirsk.ru, 0
 simple-url.com, 4
 sina, 0
 sinaapp.com, 4
@@ -6520,7 +6492,6 @@ sm.ua, 0
 smart, 0
 smile, 0
 smola.no, 0
-smolensk.ru, 0
 sn, 0
 sn.cn, 0
 snaase.no, 0
@@ -6528,14 +6499,13 @@ snasa.no, 0
 sncf, 0
 snillfjord.no, 0
 snoasa.no, 0
-snz.ru, 0
 so, 0
 so.gov.pl, 0
 so.it, 0
 sobetsu.hokkaido.jp, 0
 soc.lk, 0
 soccer, 0
-sochi.su, 0
+sochi.su, 4
 social, 0
 society.museum, 0
 sodegaura.chiba.jp, 0
@@ -6586,8 +6556,8 @@ space, 0
 space-to-rent.com, 4
 space.museum, 0
 spacekit.io, 4
-spb.ru, 0
-spb.su, 0
+spb.ru, 4
+spb.su, 4
 spdns.de, 4
 spdns.eu, 4
 spdns.org, 4
@@ -6635,7 +6605,6 @@ station.museum, 0
 statoil, 0
 stavanger.no, 0
 stavern.no, 0
-stavropol.ru, 0
 stc, 0
 stcgroup, 0
 steam.museum, 0
@@ -6673,7 +6642,6 @@ stuff-4-sale.org, 4
 stuff-4-sale.us, 4
 stufftoread.com, 4
 stuttgart.museum, 0
-stv.ru, 0
 style, 0
 su, 0
 sucks, 0
@@ -6703,7 +6671,6 @@ support, 0
 surf, 0
 surgeonshall.museum, 0
 surgery, 0
-surgut.ru, 0
 surnadal.no, 0
 surrey.museum, 0
 susaki.kochi.jp, 0
@@ -6735,10 +6702,12 @@ sydney, 0
 sydney.museum, 0
 sykkylven.no, 0
 symantec, 0
+syno-ds.de, 4
+synology-diskstation.de, 4
+synology-ds.de, 4
 synology.me, 4
 systems, 0
 sytes.net, 4
-syzran.ru, 0
 sz, 0
 szczecin.pl, 0
 szczytno.pl, 0
@@ -6746,6 +6715,7 @@ szex.hu, 0
 szkola.pl, 0
 t.bg, 0
 t.se, 0
+t3l3p0rt.net, 4
 ta.it, 0
 taa.it, 0
 tab, 0
@@ -6821,7 +6791,6 @@ tamano.okayama.jp, 0
 tamatsukuri.ibaraki.jp, 0
 tamayu.shimane.jp, 0
 tamba.hyogo.jp, 0
-tambov.ru, 0
 tana.no, 0
 tanabe.kyoto.jp, 0
 tanabe.wakayama.jp, 0
@@ -6841,9 +6810,9 @@ tarumizu.kagoshima.jp, 0
 tas.au, 0
 tas.edu.au, 0
 tas.gov.au, 0
+tashkent.su, 4
 tatamotors, 0
 tatar, 0
-tatarstan.ru, 0
 tatebayashi.gunma.jp, 0
 tateshina.nagano.jp, 0
 tateyama.chiba.jp, 0
@@ -6870,6 +6839,7 @@ technology, 0
 technology.museum, 0
 tel, 0
 tel.tr, 0
+tele.amune.org, 4
 telecity, 0
 telefonica, 0
 telekommunikation.museum, 0
@@ -6884,6 +6854,7 @@ tennis, 0
 tenri.nara.jp, 0
 teo.br, 0
 teramo.it, 0
+termez.su, 4
 terni.it, 0
 ternopil.ua, 0
 teshikaga.hokkaido.jp, 0
@@ -6957,7 +6928,7 @@ toga.toyama.jp, 0
 togakushi.nagano.jp, 0
 togane.chiba.jp, 0
 togitsu.nagasaki.jp, 0
-togliatti.su, 0
+togliatti.su, 4
 togo.aichi.jp, 0
 togura.nagano.jp, 0
 tohma.hokkaido.jp, 0
@@ -6978,7 +6949,6 @@ tokuyama.yamaguchi.jp, 0
 tokyo, 0
 tokyo.jp, 0
 tolga.no, 0
-tom.ru, 0
 tomakomai.hokkaido.jp, 0
 tomari.hokkaido.jp, 0
 tome.miyagi.jp, 0
@@ -6989,7 +6959,6 @@ tomioka.gunma.jp, 0
 tomisato.chiba.jp, 0
 tomiya.miyagi.jp, 0
 tomobe.ibaraki.jp, 0
-tomsk.ru, 0
 tonaki.okinawa.jp, 0
 tonami.toyama.jp, 0
 tondabayashi.osaka.jp, 0
@@ -7107,7 +7076,7 @@ trieste.it, 0
 triton.zone, 6
 troandin.no, 0
 trogstad.no, 0
-troitsk.su, 0
+troitsk.su, 4
 trolley.museum, 0
 tromsa.no, 0
 tromso.no, 0
@@ -7118,8 +7087,7 @@ trustee.museum, 0
 trv, 0
 trysil.no, 0
 ts.it, 0
-tsaritsyn.ru, 0
-tsk.ru, 0
+tselinograd.su, 4
 tsu.mie.jp, 0
 tsubame.niigata.jp, 0
 tsubata.ishikawa.jp, 0
@@ -7151,8 +7119,7 @@ tt, 0
 tt.im, 0
 tube, 0
 tui, 0
-tula.ru, 0
-tula.su, 0
+tula.su, 4
 tunes, 0
 tunk.org, 4
 tur.ar, 0
@@ -7163,8 +7130,7 @@ turin.it, 0
 turystyka.pl, 0
 tuscany.it, 0
 tushu, 0
-tuva.ru, 0
-tuva.su, 0
+tuva.su, 4
 tuxfamily.org, 4
 tv, 0
 tv.bb, 0
@@ -7177,7 +7143,6 @@ tv.sd, 0
 tv.tr, 0
 tv.tz, 0
 tvedestrand.no, 0
-tver.ru, 0
 tvs, 0
 tw, 0
 tw.cn, 0
@@ -7188,7 +7153,6 @@ tynset.no, 0
 tysfjord.no, 0
 tysnes.no, 0
 tysvar.no, 0
-tyumen.ru, 0
 tz, 0
 u.bg, 0
 u.se, 0
@@ -7204,8 +7168,6 @@ uconnect, 0
 ud.it, 0
 uda.nara.jp, 0
 udine.it, 0
-udm.ru, 0
-udmurtia.ru, 0
 udono.mie.jp, 0
 ueda.nagano.jp, 0
 ueno.gunma.jp, 0
@@ -7224,7 +7186,6 @@ uk.eu.org, 4
 uk.net, 4
 uki.kumamoto.jp, 0
 ukiha.fukuoka.jp, 0
-ulan-ude.ru, 0
 ullensaker.no, 0
 ullensvang.no, 0
 ulm.museum, 0
@@ -7282,6 +7243,7 @@ usarts.museum, 0
 uscountryestate.museum, 0
 usculture.museum, 0
 usdecorativearts.museum, 0
+user.party.eus, 4
 usgarden.museum, 0
 ushiku.ibaraki.jp, 0
 ushistory.museum, 0
@@ -7349,7 +7311,6 @@ vb.it, 0
 vc, 0
 vc.it, 0
 vda.it, 0
-vdonsk.ru, 0
 ve, 0
 ve.it, 0
 vefsn.no, 0
@@ -7422,25 +7383,21 @@ viva, 0
 vivo, 0
 vlaanderen, 0
 vlaanderen.museum, 0
-vladikavkaz.ru, 0
-vladikavkaz.su, 0
-vladimir.ru, 0
-vladimir.su, 0
-vladivostok.ru, 0
+vladikavkaz.ru, 4
+vladikavkaz.su, 4
+vladimir.ru, 4
+vladimir.su, 4
 vlog.br, 0
 vn, 0
 vn.ua, 0
 voagat.no, 0
 vodka, 0
 volda.no, 0
-volgograd.ru, 0
 volkenkunde.museum, 0
 volkswagen, 0
-vologda.ru, 0
-vologda.su, 0
+vologda.su, 4
 volvo, 0
 volyn.ua, 0
-voronezh.ru, 0
 voss.no, 0
 vossevangen.no, 0
 vote, 0
@@ -7448,14 +7405,12 @@ voting, 0
 voto, 0
 voyage, 0
 vr.it, 0
-vrn.ru, 0
 vs.it, 0
 vt.it, 0
 vt.us, 0
 vu, 0
 vuelos, 0
 vv.it, 0
-vyatka.ru, 0
 w.bg, 0
 w.se, 0
 wa.au, 0
@@ -8019,7 +7974,6 @@ yaizu.shizuoka.jp, 0
 yakage.okayama.jp, 0
 yakumo.hokkaido.jp, 0
 yakumo.shimane.jp, 0
-yakutia.ru, 0
 yalta.ua, 0
 yamada.fukuoka.jp, 0
 yamada.iwate.jp, 0
@@ -8032,7 +7986,6 @@ yamagata.nagano.jp, 0
 yamagata.yamagata.jp, 0
 yamaguchi.jp, 0
 yamakita.kanagawa.jp, 0
-yamal.ru, 0
 yamamoto.miyagi.jp, 0
 yamanakako.yamanashi.jp, 0
 yamanashi.jp, 0
@@ -8054,7 +8007,6 @@ yanaizu.fukushima.jp, 0
 yandex, 0
 yao.osaka.jp, 0
 yaotsu.gifu.jp, 0
-yaroslavl.ru, 0
 yasaka.nagano.jp, 0
 yashio.saitama.jp, 0
 yashiro.hyogo.jp, 0
@@ -8075,7 +8027,6 @@ ybo.review, 4
 ybo.science, 4
 ybo.trade, 4
 ye, 2
-yekaterinburg.ru, 0
 yk.ca, 0
 yn.cn, 0
 yodobashi, 0
@@ -8131,7 +8082,6 @@ yusui.kagoshima.jp, 0
 yuu.yamaguchi.jp, 0
 yuza.yamagata.jp, 0
 yuzawa.niigata.jp, 0
-yuzhno-sakhalinsk.ru, 0
 z.bg, 0
 z.se, 0
 za, 0
@@ -8155,7 +8105,6 @@ zentsuji.kagawa.jp, 0
 zero, 0
 zgora.pl, 0
 zgorzelec.pl, 0
-zgrad.ru, 0
 zhitomir.ua, 0
 zhytomyr.ua, 0
 zip, 0
diff --git a/chromium/net/base/registry_controlled_domains/registry_controlled_domain.cc b/chromium/net/base/registry_controlled_domains/registry_controlled_domain.cc
index 5af090a891a..3777582812b 100644
--- a/chromium/net/base/registry_controlled_domains/registry_controlled_domain.cc
+++ b/chromium/net/base/registry_controlled_domains/registry_controlled_domain.cc
@@ -54,6 +54,7 @@
 #include "url/gurl.h"
 #include "url/origin.h"
 #include "url/third_party/mozilla/url_parse.h"
+#include "url/url_util.h"
 
 namespace net {
 namespace registry_controlled_domains {
@@ -190,10 +191,9 @@ base::StringPiece GetDomainAndRegistryImpl(
 // TODO(pkalinnikov): Eliminate this helper by exposing StringPiece as the
 // interface type for all the APIs.
 base::StringPiece GetDomainAndRegistryAsStringPiece(
-    const GURL& gurl,
+    base::StringPiece host,
     PrivateRegistryFilter filter) {
-  base::StringPiece host = gurl.host_piece();
-  if (host.empty() || gurl.HostIsIPAddress())
+  if (host.empty() || url::HostIsIPAddress(host))
     return base::StringPiece();
   return GetDomainAndRegistryImpl(host, filter);
 }
@@ -309,11 +309,31 @@ size_t DoPermissiveGetHostRegistryLength(base::BasicStringPiece<Str> host,
   return canonical_rcd_len;
 }
 
+bool SameDomainOrHost(base::StringPiece host1,
+                      base::StringPiece host2,
+                      PrivateRegistryFilter filter) {
+  // Quickly reject cases where either host is empty.
+  if (host1.empty() || host2.empty())
+    return false;
+
+  // Check for exact host matches, which is faster than looking up the domain
+  // and registry.
+  if (host1 == host2)
+    return true;
+
+  // Check for a domain and registry match.
+  const base::StringPiece& domain1 =
+      GetDomainAndRegistryAsStringPiece(host1, filter);
+  return !domain1.empty() &&
+         (domain1 == GetDomainAndRegistryAsStringPiece(host2, filter));
+}
+
 }  // namespace
 
 std::string GetDomainAndRegistry(const GURL& gurl,
                                  PrivateRegistryFilter filter) {
-  return GetDomainAndRegistryAsStringPiece(gurl, filter).as_string();
+  return GetDomainAndRegistryAsStringPiece(gurl.host_piece(), filter)
+      .as_string();
 }
 
 std::string GetDomainAndRegistry(base::StringPiece host,
@@ -329,34 +349,26 @@ bool SameDomainOrHost(
     const GURL& gurl1,
     const GURL& gurl2,
     PrivateRegistryFilter filter) {
-  // Quickly reject cases where either host is empty.
-  if (!gurl1.has_host() || !gurl2.has_host())
-    return false;
-
-  // Check for exact host matches, which is faster than looking up the domain
-  // and registry.
-  if (gurl1.host_piece() == gurl2.host_piece())
-    return true;
-
-  // Check for a domain and registry match.
-  const base::StringPiece& domain1 =
-      GetDomainAndRegistryAsStringPiece(gurl1, filter);
-  return !domain1.empty() &&
-         (domain1 == GetDomainAndRegistryAsStringPiece(gurl2, filter));
+  return SameDomainOrHost(gurl1.host_piece(), gurl2.host_piece(), filter);
 }
 
 bool SameDomainOrHost(const url::Origin& origin1,
                       const url::Origin& origin2,
                       PrivateRegistryFilter filter) {
-  return SameDomainOrHost(origin1.GetURL(), origin2.GetURL(), filter);
+  return SameDomainOrHost(origin1.host(), origin2.host(), filter);
 }
 
 bool SameDomainOrHost(const url::Origin& origin1,
                       const base::Optional<url::Origin>& origin2,
                       PrivateRegistryFilter filter) {
-  if (!origin2.has_value())
-    return false;
-  return SameDomainOrHost(origin1, origin2.value(), filter);
+  return origin2.has_value() &&
+         SameDomainOrHost(origin1, origin2.value(), filter);
+}
+
+bool SameDomainOrHost(const GURL& gurl,
+                      const url::Origin& origin,
+                      PrivateRegistryFilter filter) {
+  return SameDomainOrHost(gurl.host_piece(), origin.host(), filter);
 }
 
 size_t GetRegistryLength(
diff --git a/chromium/net/base/registry_controlled_domains/registry_controlled_domain.h b/chromium/net/base/registry_controlled_domains/registry_controlled_domain.h
index 429a5770cc2..9f3101a5c4a 100644
--- a/chromium/net/base/registry_controlled_domains/registry_controlled_domain.h
+++ b/chromium/net/base/registry_controlled_domains/registry_controlled_domain.h
@@ -204,6 +204,9 @@ NET_EXPORT bool SameDomainOrHost(const url::Origin& origin1,
 NET_EXPORT bool SameDomainOrHost(const url::Origin& origin1,
                                  const base::Optional<url::Origin>& origin2,
                                  PrivateRegistryFilter filter);
+NET_EXPORT bool SameDomainOrHost(const GURL& gurl,
+                                 const url::Origin& origin,
+                                 PrivateRegistryFilter filter);
 
 // Finds the length in bytes of the registrar portion of the host in the
 // given GURL.  Returns std::string::npos if the GURL is invalid or has no
diff --git a/chromium/net/base/sdch_dictionary.h b/chromium/net/base/sdch_dictionary.h
index c2fb7c87bf9..4d0ddbc80d3 100644
--- a/chromium/net/base/sdch_dictionary.h
+++ b/chromium/net/base/sdch_dictionary.h
@@ -17,11 +17,6 @@
 #include "net/base/sdch_problem_codes.h"
 #include "url/gurl.h"
 
-namespace base {
-class Clock;
-class Value;
-}
-
 namespace net {
 
 // Contains all information for an SDCH dictionary.  This class is intended
diff --git a/chromium/net/base/sdch_manager.cc b/chromium/net/base/sdch_manager.cc
index e57d73cfb24..d577db8436c 100644
--- a/chromium/net/base/sdch_manager.cc
+++ b/chromium/net/base/sdch_manager.cc
@@ -13,7 +13,10 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/time/default_clock.h"
+#include "base/trace_event/memory_allocator_dump.h"
+#include "base/trace_event/process_memory_dump.h"
 #include "base/values.h"
 #include "crypto/sha2.h"
 #include "net/base/parse_number.h"
@@ -324,6 +327,36 @@ void SdchManager::RemoveObserver(SdchObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
+void SdchManager::DumpMemoryStats(
+    base::trace_event::ProcessMemoryDump* pmd,
+    const std::string& parent_dump_absolute_name) const {
+  // If there are no dictionaries stored, return early without creating a new
+  // MemoryAllocatorDump.
+  size_t total_count = dictionaries_.size();
+  if (total_count == 0)
+    return;
+  std::string name = base::StringPrintf("net/sdch_manager_%p", this);
+  base::trace_event::MemoryAllocatorDump* dump = pmd->GetAllocatorDump(name);
+  if (dump == nullptr) {
+    dump = pmd->CreateAllocatorDump(name);
+    size_t total_size = 0;
+    for (const auto& dictionary : dictionaries_) {
+      total_size += dictionary.second->data.text().size();
+    }
+    dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
+                    base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                    total_size);
+    dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameObjectCount,
+                    base::trace_event::MemoryAllocatorDump::kUnitsObjects,
+                    total_count);
+  }
+  // Create an empty row under parent's dump so size can be attributed correctly
+  // if |this| is shared between URLRequestContexts.
+  base::trace_event::MemoryAllocatorDump* empty_row_dump =
+      pmd->CreateAllocatorDump(parent_dump_absolute_name + "/sdch_manager");
+  pmd->AddOwnershipEdge(empty_row_dump->guid(), dump->guid());
+}
+
 SdchProblemCode SdchManager::AddSdchDictionary(
     const std::string& dictionary_text,
     const GURL& dictionary_url,
diff --git a/chromium/net/base/sdch_manager.h b/chromium/net/base/sdch_manager.h
index dcb47717851..1db8105e9a8 100644
--- a/chromium/net/base/sdch_manager.h
+++ b/chromium/net/base/sdch_manager.h
@@ -32,6 +32,10 @@ class GURL;
 
 namespace base {
 class Value;
+
+namespace trace_event {
+class ProcessMemoryDump;
+}
 }
 
 namespace net {
@@ -195,6 +199,11 @@ class NET_EXPORT SdchManager {
   void AddObserver(SdchObserver* observer);
   void RemoveObserver(SdchObserver* observer);
 
+  // Dumps memory allocation stats. |parent_dump_absolute_name| is the name
+  // used by the parent MemoryAllocatorDump in the memory dump hierarchy.
+  void DumpMemoryStats(base::trace_event::ProcessMemoryDump* pmd,
+                       const std::string& parent_dump_absolute_name) const;
+
   // Logs an SDCH failure to UMA and |netlog|.
   static void LogSdchProblem(NetLogWithSource netlog, SdchProblemCode problem);
 
diff --git a/chromium/net/base/sdch_manager_unittest.cc b/chromium/net/base/sdch_manager_unittest.cc
index bfdb78fc7ca..31162841b6c 100644
--- a/chromium/net/base/sdch_manager_unittest.cc
+++ b/chromium/net/base/sdch_manager_unittest.cc
@@ -11,8 +11,12 @@
 
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/test/simple_test_clock.h"
+#include "base/trace_event/memory_allocator_dump.h"
+#include "base/trace_event/process_memory_dump.h"
+#include "base/trace_event/trace_event_argument.h"
 #include "net/base/sdch_observer.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -636,4 +640,58 @@ TEST_F(SdchManagerTest, AddRemoveNotifications) {
   sdch_manager()->RemoveObserver(&observer);
 }
 
+TEST_F(SdchManagerTest, DumpMemoryStats) {
+  MockSdchObserver observer;
+  sdch_manager()->AddObserver(&observer);
+
+  std::string dictionary_domain("x.y.z.google.com");
+  GURL target_gurl("http://" + dictionary_domain);
+  std::string dictionary_text(NewSdchDictionary(dictionary_domain));
+  std::string client_hash;
+  std::string server_hash;
+  SdchManager::GenerateHash(dictionary_text, &client_hash, &server_hash);
+  EXPECT_TRUE(AddSdchDictionary(dictionary_text, target_gurl));
+  EXPECT_EQ(1, observer.dictionary_added_notifications());
+  EXPECT_EQ(target_gurl, observer.last_dictionary_url());
+  EXPECT_EQ(server_hash, observer.last_server_hash());
+
+  base::trace_event::MemoryDumpArgs dump_args = {
+      base::trace_event::MemoryDumpLevelOfDetail::DETAILED};
+  std::unique_ptr<base::trace_event::ProcessMemoryDump> pmd(
+      new base::trace_event::ProcessMemoryDump(nullptr, dump_args));
+
+  base::trace_event::MemoryAllocatorDump* parent =
+      pmd->CreateAllocatorDump("parent");
+  sdch_manager()->DumpMemoryStats(pmd.get(), parent->absolute_name());
+
+  const base::trace_event::MemoryAllocatorDump* sub_dump =
+      pmd->GetAllocatorDump("parent/sdch_manager");
+  ASSERT_NE(nullptr, sub_dump);
+  const base::trace_event::MemoryAllocatorDump* dump = pmd->GetAllocatorDump(
+      base::StringPrintf("net/sdch_manager_%p", sdch_manager()));
+  std::unique_ptr<base::Value> raw_attrs =
+      dump->attributes_for_testing()->ToBaseValue();
+  base::DictionaryValue* attrs;
+  ASSERT_TRUE(raw_attrs->GetAsDictionary(&attrs));
+  base::DictionaryValue* size_attrs;
+  ASSERT_TRUE(attrs->GetDictionary(
+      base::trace_event::MemoryAllocatorDump::kNameSize, &size_attrs));
+  size_t offset = dictionary_text.find("\n\n") + 2;
+  std::string size;
+  ASSERT_TRUE(size_attrs->GetString("value", &size));
+  int actual_size;
+  ASSERT_TRUE(base::HexStringToInt(size, &actual_size));
+  EXPECT_EQ(dictionary_text.size() - offset, static_cast<size_t>(actual_size));
+
+  base::DictionaryValue* count_attrs;
+  ASSERT_TRUE(attrs->GetDictionary(
+      base::trace_event::MemoryAllocatorDump::kNameObjectCount, &count_attrs));
+  std::string count;
+  ASSERT_TRUE(count_attrs->GetString("value", &count));
+  // One dictionary.
+  EXPECT_EQ("1", count);
+
+  sdch_manager()->RemoveObserver(&observer);
+}
+
 }  // namespace net
diff --git a/chromium/net/base/sdch_observer.h b/chromium/net/base/sdch_observer.h
index b2311de88f8..927e88d7ab6 100644
--- a/chromium/net/base/sdch_observer.h
+++ b/chromium/net/base/sdch_observer.h
@@ -56,4 +56,4 @@ class NET_EXPORT SdchObserver {
 
 }  // namespace net
 
-#endif  // NET_BASE_SDCH_MANAGER_H_
+#endif  // NET_BASE_SDCH_OBSERVER_H_
diff --git a/chromium/net/base/sys_addrinfo.h b/chromium/net/base/sys_addrinfo.h
index 78f491c0263..1799fc2dd12 100644
--- a/chromium/net/base/sys_addrinfo.h
+++ b/chromium/net/base/sys_addrinfo.h
@@ -15,6 +15,9 @@
 // Prefer including this file instead of directly writing the #if / #else,
 // since it avoids duplicating the platform-specific selections.
 
+#ifndef NET_BASE_SYS_ADDRINFO_H_
+#define NET_BASE_SYS_ADDRINFO_H_
+
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
@@ -24,3 +27,5 @@
 #include <netinet/in.h>
 #include <sys/socket.h>
 #endif
+
+#endif  // NET_BASE_SYS_ADDRINFO_H_
diff --git a/chromium/net/base/test_completion_callback.cc b/chromium/net/base/test_completion_callback.cc
index 07658503673..c50ba8cf74a 100644
--- a/chromium/net/base/test_completion_callback.cc
+++ b/chromium/net/base/test_completion_callback.cc
@@ -27,10 +27,6 @@ void TestCompletionCallbackBaseInternal::WaitForResult() {
     run_loop_->Run();
     run_loop_.reset();
     DCHECK(have_result_);
-    // A huge number of tests depend on this class running events after the
-    // result is set.
-    // TODO(mmenke):  We really should fix this.
-    base::RunLoop().RunUntilIdle();
   }
   have_result_ = false;  // Auto-reset for next callback.
 }
diff --git a/chromium/net/base/test_completion_callback_unittest.cc b/chromium/net/base/test_completion_callback_unittest.cc
index a2bc49092dd..db62f7e6ae3 100644
--- a/chromium/net/base/test_completion_callback_unittest.cc
+++ b/chromium/net/base/test_completion_callback_unittest.cc
@@ -2,15 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Illustrates how to use worker threads that issue completion callbacks
+// Illustrates how to use net::TestCompletionCallback.
 
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/single_thread_task_runner.h"
-#include "base/threading/worker_pool.h"
+#include "base/threading/thread_task_runner_handle.h"
 #include "net/base/completion_callback.h"
 #include "net/base/test_completion_callback.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -38,9 +37,8 @@ class ExampleEmployer {
   ExampleEmployer();
   ~ExampleEmployer();
 
-  // Do some imaginary work on a worker thread;
-  // when done, worker posts callback on the original thread.
-  // Returns true on success
+  // Posts to the current thread a task which itself posts |callback| to the
+  // current thread. Returns true on success
   bool DoSomething(const CompletionCallback& callback);
 
  private:
@@ -50,14 +48,12 @@ class ExampleEmployer {
   DISALLOW_COPY_AND_ASSIGN(ExampleEmployer);
 };
 
-// Helper class; this is how ExampleEmployer puts work on a different thread
+// Helper class; this is how ExampleEmployer schedules work.
 class ExampleEmployer::ExampleWorker
     : public base::RefCountedThreadSafe<ExampleWorker> {
  public:
   ExampleWorker(ExampleEmployer* employer, const CompletionCallback& callback)
-      : employer_(employer),
-        callback_(callback),
-        origin_loop_(base::MessageLoop::current()) {}
+      : employer_(employer), callback_(callback) {}
   void DoWork();
   void DoCallback();
  private:
@@ -69,23 +65,15 @@ class ExampleEmployer::ExampleWorker
   ExampleEmployer* employer_;
   CompletionCallback callback_;
   // Used to post ourselves onto the origin thread.
-  base::Lock origin_loop_lock_;
-  base::MessageLoop* origin_loop_;
+  const scoped_refptr<base::SingleThreadTaskRunner> origin_task_runner_ =
+      base::ThreadTaskRunnerHandle::Get();
 };
 
 void ExampleEmployer::ExampleWorker::DoWork() {
-  // Running on the worker thread
   // In a real worker thread, some work would be done here.
   // Pretend it is, and send the completion callback.
-
-  // The origin loop could go away while we are trying to post to it, so we
-  // need to call its PostTask method inside a lock.  See ~ExampleEmployer.
-  {
-    base::AutoLock locked(origin_loop_lock_);
-    if (origin_loop_)
-      origin_loop_->task_runner()->PostTask(
-          FROM_HERE, base::Bind(&ExampleWorker::DoCallback, this));
-  }
+  origin_task_runner_->PostTask(FROM_HERE,
+                                base::Bind(&ExampleWorker::DoCallback, this));
 }
 
 void ExampleEmployer::ExampleWorker::DoCallback() {
@@ -110,9 +98,8 @@ bool ExampleEmployer::DoSomething(const CompletionCallback& callback) {
 
   request_ = new ExampleWorker(this, callback);
 
-  // Dispatch to worker thread...
-  if (!base::WorkerPool::PostTask(
-          FROM_HERE, base::Bind(&ExampleWorker::DoWork, request_), true)) {
+  if (!base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::Bind(&ExampleWorker::DoWork, request_))) {
     NOTREACHED();
     request_ = NULL;
     return false;
diff --git a/chromium/net/base/test_data_stream.cc b/chromium/net/base/test_data_stream.cc
index 66728043011..b77642150a4 100644
--- a/chromium/net/base/test_data_stream.cc
+++ b/chromium/net/base/test_data_stream.cc
@@ -65,4 +65,3 @@ void TestDataStream::Consume(int bytes) {
 }
 
 }  // namespace net
-
diff --git a/chromium/net/base/test_proxy_delegate.cc b/chromium/net/base/test_proxy_delegate.cc
index bfaa28e1dc0..66fd1a9bad6 100644
--- a/chromium/net/base/test_proxy_delegate.cc
+++ b/chromium/net/base/test_proxy_delegate.cc
@@ -101,4 +101,4 @@ ProxyServer TestProxyDelegate::GetDefaultAlternativeProxy() const {
   return alternative_proxy_server_;
 }
 
-}  // namespace net
\ No newline at end of file
+}  // namespace net
diff --git a/chromium/net/base/test_proxy_delegate.h b/chromium/net/base/test_proxy_delegate.h
index dea1e609930..373995306d2 100644
--- a/chromium/net/base/test_proxy_delegate.h
+++ b/chromium/net/base/test_proxy_delegate.h
@@ -19,7 +19,6 @@ class HttpRequestHeaders;
 class HttpResponseHeaders;
 class ProxyInfo;
 class ProxyService;
-class URLRequest;
 
 class TestProxyDelegate : public ProxyDelegate {
  public:
@@ -103,4 +102,4 @@ class TestProxyDelegate : public ProxyDelegate {
 
 }  // namespace net
 
-#endif  // NET_BASE_TEST_PROXY_DELEGATE_H_
\ No newline at end of file
+#endif  // NET_BASE_TEST_PROXY_DELEGATE_H_
diff --git a/chromium/net/base/trace_constants.cc b/chromium/net/base/trace_constants.cc
new file mode 100644
index 00000000000..ceade2cab01
--- /dev/null
+++ b/chromium/net/base/trace_constants.cc
@@ -0,0 +1,13 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/base/trace_constants.h"
+
+#include "base/trace_event/common/trace_event_common.h"
+
+namespace net {
+
+const char kNetTracingCategory[] = TRACE_DISABLED_BY_DEFAULT("net");
+
+}  // namespace net
diff --git a/chromium/net/base/trace_constants.h b/chromium/net/base/trace_constants.h
new file mode 100644
index 00000000000..dc5d84aabc2
--- /dev/null
+++ b/chromium/net/base/trace_constants.h
@@ -0,0 +1,15 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_BASE_TRACE_CONSTANTS_H_
+#define NET_BASE_TRACE_CONSTANTS_H_
+
+namespace net {
+
+// Net Category used in Tracing.
+extern const char kNetTracingCategory[];
+
+}  // namespace net
+
+#endif  // NET_BASE_TRACE_CONSTANTS_H_
diff --git a/chromium/net/base/upload_data_stream.h b/chromium/net/base/upload_data_stream.h
index 6b8f1bffb0c..b84e3d930a9 100644
--- a/chromium/net/base/upload_data_stream.h
+++ b/chromium/net/base/upload_data_stream.h
@@ -18,7 +18,6 @@
 
 namespace net {
 
-class DrainableIOBuffer;
 class IOBuffer;
 class UploadElementReader;
 
diff --git a/chromium/net/base/url_util.cc b/chromium/net/base/url_util.cc
index 111c95400a8..062481fef39 100644
--- a/chromium/net/base/url_util.cc
+++ b/chromium/net/base/url_util.cc
@@ -373,6 +373,9 @@ bool IsLocalhost(base::StringPiece host) {
 
 GURL SimplifyUrlForRequest(const GURL& url) {
   DCHECK(url.is_valid());
+  // Fast path to avoid re-canonicalization via ReplaceComponents.
+  if (!url.has_username() && !url.has_password() && !url.has_ref())
+    return url;
   GURL::Replacements replacements;
   replacements.ClearUsername();
   replacements.ClearPassword();